On Wed, Apr 16, 2025 at 3:51 PM T.J. Mercier tjmercier@google.com wrote: [...]
IIUC, the iterator simply traverses elements in a linked list. I feel it is an overkill to implement a new BPF iterator for it.
Like other BPF iterators such as kmem_cache_iter or task_iter. Cgroup_iter iterates trees instead of lists. This is iterating over kernel objects just like the docs say, "A BPF iterator is a type of BPF program that allows users to iterate over specific types of kernel objects". More complicated iteration should not be a requirement here.
Maybe we simply use debugging tools like crash or drgn for this? The access with these tools will not be protected by the mutex. But from my personal experience, this is not a big issue for user space debugging tools.
drgn is *way* too slow, and even if it weren't the dependencies for running it aren't available. crash needs debug symbols which also aren't available on user builds. This is not just for manual debugging, it's for reporting memory use in production. Or anything else someone might care to extract like attachment info or refcounts.
Could you please share more information about the use cases and the time constraint here, and why drgn is too slow. Is most of the delay comes from parsing DWARF? This is mostly for my curiosity, because I have been thinking about using drgn to do some monitoring in production.
Thanks, Song