pid_iter.bpf.c 2.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119
  1. // SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
  2. /* Copyright (c) 2020 Facebook */
  3. #include <vmlinux.h>
  4. #include <bpf/bpf_helpers.h>
  5. #include <bpf/bpf_core_read.h>
  6. #include <bpf/bpf_tracing.h>
  7. #include "pid_iter.h"
  8. /* keep in sync with the definition in main.h */
  9. enum bpf_obj_type {
  10. BPF_OBJ_UNKNOWN,
  11. BPF_OBJ_PROG,
  12. BPF_OBJ_MAP,
  13. BPF_OBJ_LINK,
  14. BPF_OBJ_BTF,
  15. };
  16. struct bpf_perf_link___local {
  17. struct bpf_link link;
  18. struct file *perf_file;
  19. } __attribute__((preserve_access_index));
  20. struct perf_event___local {
  21. u64 bpf_cookie;
  22. } __attribute__((preserve_access_index));
  23. enum bpf_link_type___local {
  24. BPF_LINK_TYPE_PERF_EVENT___local = 7,
  25. };
  26. extern const void bpf_link_fops __ksym;
  27. extern const void bpf_map_fops __ksym;
  28. extern const void bpf_prog_fops __ksym;
  29. extern const void btf_fops __ksym;
  30. const volatile enum bpf_obj_type obj_type = BPF_OBJ_UNKNOWN;
  31. static __always_inline __u32 get_obj_id(void *ent, enum bpf_obj_type type)
  32. {
  33. switch (type) {
  34. case BPF_OBJ_PROG:
  35. return BPF_CORE_READ((struct bpf_prog *)ent, aux, id);
  36. case BPF_OBJ_MAP:
  37. return BPF_CORE_READ((struct bpf_map *)ent, id);
  38. case BPF_OBJ_BTF:
  39. return BPF_CORE_READ((struct btf *)ent, id);
  40. case BPF_OBJ_LINK:
  41. return BPF_CORE_READ((struct bpf_link *)ent, id);
  42. default:
  43. return 0;
  44. }
  45. }
  46. /* could be used only with BPF_LINK_TYPE_PERF_EVENT links */
  47. static __u64 get_bpf_cookie(struct bpf_link *link)
  48. {
  49. struct bpf_perf_link___local *perf_link;
  50. struct perf_event___local *event;
  51. perf_link = container_of(link, struct bpf_perf_link___local, link);
  52. event = BPF_CORE_READ(perf_link, perf_file, private_data);
  53. return BPF_CORE_READ(event, bpf_cookie);
  54. }
  55. SEC("iter/task_file")
  56. int iter(struct bpf_iter__task_file *ctx)
  57. {
  58. struct file *file = ctx->file;
  59. struct task_struct *task = ctx->task;
  60. struct pid_iter_entry e;
  61. const void *fops;
  62. if (!file || !task)
  63. return 0;
  64. switch (obj_type) {
  65. case BPF_OBJ_PROG:
  66. fops = &bpf_prog_fops;
  67. break;
  68. case BPF_OBJ_MAP:
  69. fops = &bpf_map_fops;
  70. break;
  71. case BPF_OBJ_BTF:
  72. fops = &btf_fops;
  73. break;
  74. case BPF_OBJ_LINK:
  75. fops = &bpf_link_fops;
  76. break;
  77. default:
  78. return 0;
  79. }
  80. if (file->f_op != fops)
  81. return 0;
  82. __builtin_memset(&e, 0, sizeof(e));
  83. e.pid = task->tgid;
  84. e.id = get_obj_id(file->private_data, obj_type);
  85. if (obj_type == BPF_OBJ_LINK &&
  86. bpf_core_enum_value_exists(enum bpf_link_type___local,
  87. BPF_LINK_TYPE_PERF_EVENT___local)) {
  88. struct bpf_link *link = (struct bpf_link *) file->private_data;
  89. if (link->type == bpf_core_enum_value(enum bpf_link_type___local,
  90. BPF_LINK_TYPE_PERF_EVENT___local)) {
  91. e.has_bpf_cookie = true;
  92. e.bpf_cookie = get_bpf_cookie(link);
  93. }
  94. }
  95. bpf_probe_read_kernel_str(&e.comm, sizeof(e.comm),
  96. task->group_leader->comm);
  97. bpf_seq_write(ctx->meta->seq, &e, sizeof(e));
  98. return 0;
  99. }
  100. char LICENSE[] SEC("license") = "Dual BSD/GPL";