bpf/progs/bpf_iter_task_vma.c

0001 // SPDX-License-Identifier: GPL-2.0
0002 /* Copyright (c) 2020 Facebook */
0003 #include "bpf_iter.h"
0004 #include <bpf/bpf_helpers.h>
0005
0006 char _license[] SEC("license") = "GPL";
0007
0008 /* Copied from mm.h */
0009 #define VM_READ     0x00000001
0010 #define VM_WRITE    0x00000002
0011 #define VM_EXEC     0x00000004
0012 #define VM_MAYSHARE 0x00000080
0013
0014 /* Copied from kdev_t.h */
0015 #define MINORBITS   20
0016 #define MINORMASK   ((1U << MINORBITS) - 1)
0017 #define MAJOR(dev)  ((unsigned int) ((dev) >> MINORBITS))
0018 #define MINOR(dev)  ((unsigned int) ((dev) & MINORMASK))
0019
0020 #define D_PATH_BUF_SIZE 1024
0021 char d_path_buf[D_PATH_BUF_SIZE] = {};
0022 __u32 pid = 0;
0023
0024 SEC("iter/task_vma") int proc_maps(struct bpf_iter__task_vma *ctx)
0025 {
0026     struct vm_area_struct *vma = ctx->vma;
0027     struct seq_file *seq = ctx->meta->seq;
0028     struct task_struct *task = ctx->task;
0029     struct file *file;
0030     char perm_str[] = "----";
0031
0032     if (task == (void *)0 || vma == (void *)0)
0033         return 0;
0034
0035     file = vma->vm_file;
0036     if (task->tgid != pid)
0037         return 0;
0038     perm_str[0] = (vma->vm_flags & VM_READ) ? 'r' : '-';
0039     perm_str[1] = (vma->vm_flags & VM_WRITE) ? 'w' : '-';
0040     perm_str[2] = (vma->vm_flags & VM_EXEC) ? 'x' : '-';
0041     perm_str[3] = (vma->vm_flags & VM_MAYSHARE) ? 's' : 'p';
0042     BPF_SEQ_PRINTF(seq, "%08llx-%08llx %s ", vma->vm_start, vma->vm_end, perm_str);
0043
0044     if (file) {
0045         __u32 dev = file->f_inode->i_sb->s_dev;
0046
0047         bpf_d_path(&file->f_path, d_path_buf, D_PATH_BUF_SIZE);
0048
0049         BPF_SEQ_PRINTF(seq, "%08llx ", vma->vm_pgoff << 12);
0050         BPF_SEQ_PRINTF(seq, "%02x:%02x %u", MAJOR(dev), MINOR(dev),
0051                    file->f_inode->i_ino);
0052         BPF_SEQ_PRINTF(seq, "\t%s\n", d_path_buf);
0053     } else {
0054         BPF_SEQ_PRINTF(seq, "%08llx 00:00 0\n", 0ULL);
0055     }
0056     return 0;
0057 }