1// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
 2/* Copyright (c) 2020 Facebook */
 3#include <vmlinux.h>
 4#include <bpf/bpf_helpers.h>
 5#include <bpf/bpf_core_read.h>
 6#include <bpf/bpf_tracing.h>
 7#include "pid_iter.h"
 8
 9/* keep in sync with the definition in main.h */
10enum bpf_obj_type {
11	BPF_OBJ_UNKNOWN,
12	BPF_OBJ_PROG,
13	BPF_OBJ_MAP,
14	BPF_OBJ_LINK,
15	BPF_OBJ_BTF,
16};
17
 
 
 
 
 
 
 
 
 
 
 
 
 
18extern const void bpf_link_fops __ksym;
19extern const void bpf_map_fops __ksym;
20extern const void bpf_prog_fops __ksym;
21extern const void btf_fops __ksym;
22
23const volatile enum bpf_obj_type obj_type = BPF_OBJ_UNKNOWN;
24
25static __always_inline __u32 get_obj_id(void *ent, enum bpf_obj_type type)
26{
27	switch (type) {
28	case BPF_OBJ_PROG:
29		return BPF_CORE_READ((struct bpf_prog *)ent, aux, id);
30	case BPF_OBJ_MAP:
31		return BPF_CORE_READ((struct bpf_map *)ent, id);
32	case BPF_OBJ_BTF:
33		return BPF_CORE_READ((struct btf *)ent, id);
34	case BPF_OBJ_LINK:
35		return BPF_CORE_READ((struct bpf_link *)ent, id);
36	default:
37		return 0;
38	}
39}
40
 
 
 
 
 
 
 
 
 
 
 
41SEC("iter/task_file")
42int iter(struct bpf_iter__task_file *ctx)
43{
44	struct file *file = ctx->file;
45	struct task_struct *task = ctx->task;
46	struct pid_iter_entry e;
47	const void *fops;
48
49	if (!file || !task)
50		return 0;
51
52	switch (obj_type) {
53	case BPF_OBJ_PROG:
54		fops = &bpf_prog_fops;
55		break;
56	case BPF_OBJ_MAP:
57		fops = &bpf_map_fops;
58		break;
59	case BPF_OBJ_BTF:
60		fops = &btf_fops;
61		break;
62	case BPF_OBJ_LINK:
63		fops = &bpf_link_fops;
64		break;
65	default:
66		return 0;
67	}
68
69	if (file->f_op != fops)
70		return 0;
71
 
72	e.pid = task->tgid;
73	e.id = get_obj_id(file->private_data, obj_type);
74	bpf_probe_read_kernel(&e.comm, sizeof(e.comm),
75			      task->group_leader->comm);
 
 
 
 
 
 
 
 
 
 
 
 
 
76	bpf_seq_write(ctx->meta->seq, &e, sizeof(e));
77
78	return 0;
79}
80
81char LICENSE[] SEC("license") = "Dual BSD/GPL";

  1// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
  2/* Copyright (c) 2020 Facebook */
  3#include <vmlinux.h>
  4#include <bpf/bpf_helpers.h>
  5#include <bpf/bpf_core_read.h>
  6#include <bpf/bpf_tracing.h>
  7#include "pid_iter.h"
  8
  9/* keep in sync with the definition in main.h */
 10enum bpf_obj_type {
 11	BPF_OBJ_UNKNOWN,
 12	BPF_OBJ_PROG,
 13	BPF_OBJ_MAP,
 14	BPF_OBJ_LINK,
 15	BPF_OBJ_BTF,
 16};
 17
 18struct bpf_perf_link___local {
 19	struct bpf_link link;
 20	struct file *perf_file;
 21} __attribute__((preserve_access_index));
 22
 23struct perf_event___local {
 24	u64 bpf_cookie;
 25} __attribute__((preserve_access_index));
 26
 27enum bpf_link_type___local {
 28	BPF_LINK_TYPE_PERF_EVENT___local = 7,
 29};
 30
 31extern const void bpf_link_fops __ksym;
 32extern const void bpf_map_fops __ksym;
 33extern const void bpf_prog_fops __ksym;
 34extern const void btf_fops __ksym;
 35
 36const volatile enum bpf_obj_type obj_type = BPF_OBJ_UNKNOWN;
 37
 38static __always_inline __u32 get_obj_id(void *ent, enum bpf_obj_type type)
 39{
 40	switch (type) {
 41	case BPF_OBJ_PROG:
 42		return BPF_CORE_READ((struct bpf_prog *)ent, aux, id);
 43	case BPF_OBJ_MAP:
 44		return BPF_CORE_READ((struct bpf_map *)ent, id);
 45	case BPF_OBJ_BTF:
 46		return BPF_CORE_READ((struct btf *)ent, id);
 47	case BPF_OBJ_LINK:
 48		return BPF_CORE_READ((struct bpf_link *)ent, id);
 49	default:
 50		return 0;
 51	}
 52}
 53
 54/* could be used only with BPF_LINK_TYPE_PERF_EVENT links */
 55static __u64 get_bpf_cookie(struct bpf_link *link)
 56{
 57	struct bpf_perf_link___local *perf_link;
 58	struct perf_event___local *event;
 59
 60	perf_link = container_of(link, struct bpf_perf_link___local, link);
 61	event = BPF_CORE_READ(perf_link, perf_file, private_data);
 62	return BPF_CORE_READ(event, bpf_cookie);
 63}
 64
 65SEC("iter/task_file")
 66int iter(struct bpf_iter__task_file *ctx)
 67{
 68	struct file *file = ctx->file;
 69	struct task_struct *task = ctx->task;
 70	struct pid_iter_entry e;
 71	const void *fops;
 72
 73	if (!file || !task)
 74		return 0;
 75
 76	switch (obj_type) {
 77	case BPF_OBJ_PROG:
 78		fops = &bpf_prog_fops;
 79		break;
 80	case BPF_OBJ_MAP:
 81		fops = &bpf_map_fops;
 82		break;
 83	case BPF_OBJ_BTF:
 84		fops = &btf_fops;
 85		break;
 86	case BPF_OBJ_LINK:
 87		fops = &bpf_link_fops;
 88		break;
 89	default:
 90		return 0;
 91	}
 92
 93	if (file->f_op != fops)
 94		return 0;
 95
 96	__builtin_memset(&e, 0, sizeof(e));
 97	e.pid = task->tgid;
 98	e.id = get_obj_id(file->private_data, obj_type);
 99
100	if (obj_type == BPF_OBJ_LINK &&
101	    bpf_core_enum_value_exists(enum bpf_link_type___local,
102				       BPF_LINK_TYPE_PERF_EVENT___local)) {
103		struct bpf_link *link = (struct bpf_link *) file->private_data;
104
105		if (link->type == bpf_core_enum_value(enum bpf_link_type___local,
106						      BPF_LINK_TYPE_PERF_EVENT___local)) {
107			e.has_bpf_cookie = true;
108			e.bpf_cookie = get_bpf_cookie(link);
109		}
110	}
111
112	bpf_probe_read_kernel_str(&e.comm, sizeof(e.comm),
113				  task->group_leader->comm);
114	bpf_seq_write(ctx->meta->seq, &e, sizeof(e));
115
116	return 0;
117}
118
119char LICENSE[] SEC("license") = "Dual BSD/GPL";