mirror of
https://github.com/torvalds/linux
synced 2024-09-06 18:01:05 +00:00
fe879bb42f
Current 'bpftool link' command does not show pids, e.g.,
$ tools/build/bpftool/bpftool link
...
4: tracing prog 23
prog_type lsm attach_type lsm_mac
target_obj_id 1 target_btf_id 31320
Hack the following change to enable normal libbpf debug output,
--- a/tools/bpf/bpftool/pids.c
+++ b/tools/bpf/bpftool/pids.c
@@ -121,9 +121,9 @@ int build_obj_refs_table(struct hashmap **map, enum bpf_obj_type type)
/* we don't want output polluted with libbpf errors if bpf_iter is not
* supported
*/
- default_print = libbpf_set_print(libbpf_print_none);
+ /* default_print = libbpf_set_print(libbpf_print_none); */
err = pid_iter_bpf__load(skel);
- libbpf_set_print(default_print);
+ /* libbpf_set_print(default_print); */
Rerun the above bpftool command:
$ tools/build/bpftool/bpftool link
libbpf: prog 'iter': BPF program load failed: Permission denied
libbpf: prog 'iter': -- BEGIN PROG LOAD LOG --
0: R1=ctx() R10=fp0
; struct task_struct *task = ctx->task; @ pid_iter.bpf.c:69
0: (79) r6 = *(u64 *)(r1 +8) ; R1=ctx() R6_w=ptr_or_null_task_struct(id=1)
; struct file *file = ctx->file; @ pid_iter.bpf.c:68
...
; struct bpf_link *link = (struct bpf_link *) file->private_data; @ pid_iter.bpf.c:103
80: (79) r3 = *(u64 *)(r8 +432) ; R3_w=scalar() R8=ptr_file()
; if (link->type == bpf_core_enum_value(enum bpf_link_type___local, @ pid_iter.bpf.c:105
81: (61) r1 = *(u32 *)(r3 +12)
R3 invalid mem access 'scalar'
processed 39 insns (limit 1000000) max_states_per_insn 0 total_states 3 peak_states 3 mark_read 2
-- END PROG LOAD LOG --
libbpf: prog 'iter': failed to load: -13
...
The 'file->private_data' returns a 'void' type and this caused subsequent 'link->type'
(insn #81) failed in verification.
To fix the issue, restore the previous BPF_CORE_READ so old kernels can also work.
With this patch, the 'bpftool link' runs successfully with 'pids'.
$ tools/build/bpftool/bpftool link
...
4: tracing prog 23
prog_type lsm attach_type lsm_mac
target_obj_id 1 target_btf_id 31320
pids systemd(1)
Fixes: 44ba7b30e8 ("bpftool: Use a local copy of BPF_LINK_TYPE_PERF_EVENT in pid_iter.bpf.c")
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Tested-by: Quentin Monnet <quentin@isovalent.com>
Reviewed-by: Quentin Monnet <quentin@isovalent.com>
Link: https://lore.kernel.org/bpf/20240312023249.3776718-1-yonghong.song@linux.dev
120 lines
2.8 KiB
C
120 lines
2.8 KiB
C
// SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
|
|
/* Copyright (c) 2020 Facebook */
|
|
#include <vmlinux.h>
|
|
#include <bpf/bpf_helpers.h>
|
|
#include <bpf/bpf_core_read.h>
|
|
#include <bpf/bpf_tracing.h>
|
|
#include "pid_iter.h"
|
|
|
|
/* keep in sync with the definition in main.h */
|
|
enum bpf_obj_type {
|
|
BPF_OBJ_UNKNOWN,
|
|
BPF_OBJ_PROG,
|
|
BPF_OBJ_MAP,
|
|
BPF_OBJ_LINK,
|
|
BPF_OBJ_BTF,
|
|
};
|
|
|
|
struct bpf_perf_link___local {
|
|
struct bpf_link link;
|
|
struct file *perf_file;
|
|
} __attribute__((preserve_access_index));
|
|
|
|
struct perf_event___local {
|
|
u64 bpf_cookie;
|
|
} __attribute__((preserve_access_index));
|
|
|
|
enum bpf_link_type___local {
|
|
BPF_LINK_TYPE_PERF_EVENT___local = 7,
|
|
};
|
|
|
|
extern const void bpf_link_fops __ksym;
|
|
extern const void bpf_map_fops __ksym;
|
|
extern const void bpf_prog_fops __ksym;
|
|
extern const void btf_fops __ksym;
|
|
|
|
const volatile enum bpf_obj_type obj_type = BPF_OBJ_UNKNOWN;
|
|
|
|
static __always_inline __u32 get_obj_id(void *ent, enum bpf_obj_type type)
|
|
{
|
|
switch (type) {
|
|
case BPF_OBJ_PROG:
|
|
return BPF_CORE_READ((struct bpf_prog *)ent, aux, id);
|
|
case BPF_OBJ_MAP:
|
|
return BPF_CORE_READ((struct bpf_map *)ent, id);
|
|
case BPF_OBJ_BTF:
|
|
return BPF_CORE_READ((struct btf *)ent, id);
|
|
case BPF_OBJ_LINK:
|
|
return BPF_CORE_READ((struct bpf_link *)ent, id);
|
|
default:
|
|
return 0;
|
|
}
|
|
}
|
|
|
|
/* could be used only with BPF_LINK_TYPE_PERF_EVENT links */
|
|
static __u64 get_bpf_cookie(struct bpf_link *link)
|
|
{
|
|
struct bpf_perf_link___local *perf_link;
|
|
struct perf_event___local *event;
|
|
|
|
perf_link = container_of(link, struct bpf_perf_link___local, link);
|
|
event = BPF_CORE_READ(perf_link, perf_file, private_data);
|
|
return BPF_CORE_READ(event, bpf_cookie);
|
|
}
|
|
|
|
SEC("iter/task_file")
|
|
int iter(struct bpf_iter__task_file *ctx)
|
|
{
|
|
struct file *file = ctx->file;
|
|
struct task_struct *task = ctx->task;
|
|
struct pid_iter_entry e;
|
|
const void *fops;
|
|
|
|
if (!file || !task)
|
|
return 0;
|
|
|
|
switch (obj_type) {
|
|
case BPF_OBJ_PROG:
|
|
fops = &bpf_prog_fops;
|
|
break;
|
|
case BPF_OBJ_MAP:
|
|
fops = &bpf_map_fops;
|
|
break;
|
|
case BPF_OBJ_BTF:
|
|
fops = &btf_fops;
|
|
break;
|
|
case BPF_OBJ_LINK:
|
|
fops = &bpf_link_fops;
|
|
break;
|
|
default:
|
|
return 0;
|
|
}
|
|
|
|
if (file->f_op != fops)
|
|
return 0;
|
|
|
|
__builtin_memset(&e, 0, sizeof(e));
|
|
e.pid = task->tgid;
|
|
e.id = get_obj_id(file->private_data, obj_type);
|
|
|
|
if (obj_type == BPF_OBJ_LINK &&
|
|
bpf_core_enum_value_exists(enum bpf_link_type___local,
|
|
BPF_LINK_TYPE_PERF_EVENT___local)) {
|
|
struct bpf_link *link = (struct bpf_link *) file->private_data;
|
|
|
|
if (BPF_CORE_READ(link, type) == bpf_core_enum_value(enum bpf_link_type___local,
|
|
BPF_LINK_TYPE_PERF_EVENT___local)) {
|
|
e.has_bpf_cookie = true;
|
|
e.bpf_cookie = get_bpf_cookie(link);
|
|
}
|
|
}
|
|
|
|
bpf_probe_read_kernel_str(&e.comm, sizeof(e.comm),
|
|
task->group_leader->comm);
|
|
bpf_seq_write(ctx->meta->seq, &e, sizeof(e));
|
|
|
|
return 0;
|
|
}
|
|
|
|
char LICENSE[] SEC("license") = "Dual BSD/GPL";
|