Loading...
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 | // SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) /* Copyright (c) 2020 Facebook */ #include <vmlinux.h> #include <bpf/bpf_helpers.h> #include <bpf/bpf_core_read.h> #include <bpf/bpf_tracing.h> #include "pid_iter.h" /* keep in sync with the definition in main.h */ enum bpf_obj_type { BPF_OBJ_UNKNOWN, BPF_OBJ_PROG, BPF_OBJ_MAP, BPF_OBJ_LINK, BPF_OBJ_BTF, }; extern const void bpf_link_fops __ksym; extern const void bpf_map_fops __ksym; extern const void bpf_prog_fops __ksym; extern const void btf_fops __ksym; const volatile enum bpf_obj_type obj_type = BPF_OBJ_UNKNOWN; static __always_inline __u32 get_obj_id(void *ent, enum bpf_obj_type type) { switch (type) { case BPF_OBJ_PROG: return BPF_CORE_READ((struct bpf_prog *)ent, aux, id); case BPF_OBJ_MAP: return BPF_CORE_READ((struct bpf_map *)ent, id); case BPF_OBJ_BTF: return BPF_CORE_READ((struct btf *)ent, id); case BPF_OBJ_LINK: return BPF_CORE_READ((struct bpf_link *)ent, id); default: return 0; } } /* could be used only with BPF_LINK_TYPE_PERF_EVENT links */ static __u64 get_bpf_cookie(struct bpf_link *link) { struct bpf_perf_link *perf_link; struct perf_event *event; perf_link = container_of(link, struct bpf_perf_link, link); event = BPF_CORE_READ(perf_link, perf_file, private_data); return BPF_CORE_READ(event, bpf_cookie); } SEC("iter/task_file") int iter(struct bpf_iter__task_file *ctx) { struct file *file = ctx->file; struct task_struct *task = ctx->task; struct pid_iter_entry e; const void *fops; if (!file || !task) return 0; switch (obj_type) { case BPF_OBJ_PROG: fops = &bpf_prog_fops; break; case BPF_OBJ_MAP: fops = &bpf_map_fops; break; case BPF_OBJ_BTF: fops = &btf_fops; break; case BPF_OBJ_LINK: fops = &bpf_link_fops; break; default: return 0; } if (file->f_op != fops) return 0; __builtin_memset(&e, 0, sizeof(e)); e.pid = task->tgid; e.id = get_obj_id(file->private_data, obj_type); if (obj_type == BPF_OBJ_LINK) { struct bpf_link *link = (struct bpf_link *) file->private_data; if (BPF_CORE_READ(link, type) == BPF_LINK_TYPE_PERF_EVENT) { e.has_bpf_cookie = true; e.bpf_cookie = get_bpf_cookie(link); } } bpf_probe_read_kernel_str(&e.comm, sizeof(e.comm), task->group_leader->comm); bpf_seq_write(ctx->meta->seq, &e, sizeof(e)); return 0; } char LICENSE[] SEC("license") = "Dual BSD/GPL"; |