1 // SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) 2 /* Copyright (c) 2020 Facebook */ 3 #include <vmlinux.h> 4 #include <bpf/bpf_helpers.h> 5 #include <bpf/bpf_core_read.h> 6 #include <bpf/bpf_tracing.h> 7 #include "pid_iter.h" 8 9 /* keep in sync with the definition in main.h */ 10 enum bpf_obj_type { 11 BPF_OBJ_UNKNOWN, 12 BPF_OBJ_PROG, 13 BPF_OBJ_MAP, 14 BPF_OBJ_LINK, 15 BPF_OBJ_BTF, 16 }; 17 18 struct bpf_perf_link___local { 19 struct bpf_link link; 20 struct file *perf_file; 21 } __attribute__((preserve_access_index)); 22 23 struct perf_event___local { 24 u64 bpf_cookie; 25 } __attribute__((preserve_access_index)); 26 27 enum bpf_link_type___local { 28 BPF_LINK_TYPE_PERF_EVENT___local = 7, 29 }; 30 31 extern const void bpf_link_fops __ksym; 32 extern const void bpf_map_fops __ksym; 33 extern const void bpf_prog_fops __ksym; 34 extern const void btf_fops __ksym; 35 36 const volatile enum bpf_obj_type obj_type = BPF_OBJ_UNKNOWN; 37 38 static __always_inline __u32 get_obj_id(void *ent, enum bpf_obj_type type) 39 { 40 switch (type) { 41 case BPF_OBJ_PROG: 42 return BPF_CORE_READ((struct bpf_prog *)ent, aux, id); 43 case BPF_OBJ_MAP: 44 return BPF_CORE_READ((struct bpf_map *)ent, id); 45 case BPF_OBJ_BTF: 46 return BPF_CORE_READ((struct btf *)ent, id); 47 case BPF_OBJ_LINK: 48 return BPF_CORE_READ((struct bpf_link *)ent, id); 49 default: 50 return 0; 51 } 52 } 53 54 /* could be used only with BPF_LINK_TYPE_PERF_EVENT links */ 55 static __u64 get_bpf_cookie(struct bpf_link *link) 56 { 57 struct bpf_perf_link___local *perf_link; 58 struct perf_event___local *event; 59 60 perf_link = container_of(link, struct bpf_perf_link___local, link); 61 event = BPF_CORE_READ(perf_link, perf_file, private_data); 62 return BPF_CORE_READ(event, bpf_cookie); 63 } 64 65 SEC("iter/task_file") 66 int iter(struct bpf_iter__task_file *ctx) 67 { 68 struct file *file = ctx->file; 69 struct task_struct *task = ctx->task; 70 struct pid_iter_entry e; 71 const void *fops; 72 73 if (!file || !task) 74 return 0; 75 76 switch (obj_type) { 77 case BPF_OBJ_PROG: 78 fops = &bpf_prog_fops; 79 break; 80 case BPF_OBJ_MAP: 81 fops = &bpf_map_fops; 82 break; 83 case BPF_OBJ_BTF: 84 fops = &btf_fops; 85 break; 86 case BPF_OBJ_LINK: 87 fops = &bpf_link_fops; 88 break; 89 default: 90 return 0; 91 } 92 93 if (file->f_op != fops) 94 return 0; 95 96 __builtin_memset(&e, 0, sizeof(e)); 97 e.pid = task->tgid; 98 e.id = get_obj_id(file->private_data, obj_type); 99 100 if (obj_type == BPF_OBJ_LINK && 101 bpf_core_enum_value_exists(enum bpf_link_type___local, 102 BPF_LINK_TYPE_PERF_EVENT___local)) { 103 struct bpf_link *link = (struct bpf_link *) file->private_data; 104 105 if (link->type == bpf_core_enum_value(enum bpf_link_type___local, 106 BPF_LINK_TYPE_PERF_EVENT___local)) { 107 e.has_bpf_cookie = true; 108 e.bpf_cookie = get_bpf_cookie(link); 109 } 110 } 111 112 bpf_probe_read_kernel_str(&e.comm, sizeof(e.comm), 113 task->group_leader->comm); 114 bpf_seq_write(ctx->meta->seq, &e, sizeof(e)); 115 116 return 0; 117 } 118 119 char LICENSE[] SEC("license") = "Dual BSD/GPL"; 120