1 // SPDX-License-Identifier: GPL-2.0-only
2 /* Copyright (c) 2020 Facebook */
4 #include <linux/init.h>
5 #include <linux/namei.h>
6 #include <linux/pid_namespace.h>
8 #include <linux/fdtable.h>
9 #include <linux/filter.h>
10 #include <linux/btf_ids.h>
11 #include "mmap_unlock_work.h"
13 struct bpf_iter_seq_task_common {
14 struct pid_namespace *ns;
17 struct bpf_iter_seq_task_info {
18 /* The first field must be struct bpf_iter_seq_task_common.
19 * this is assumed by {init, fini}_seq_pidns() callback functions.
21 struct bpf_iter_seq_task_common common;
25 static struct task_struct *task_seq_get_next(struct pid_namespace *ns,
27 bool skip_if_dup_files)
29 struct task_struct *task = NULL;
34 pid = find_ge_pid(*tid, ns);
36 *tid = pid_nr_ns(pid, ns);
37 task = get_pid_task(pid, PIDTYPE_PID);
41 } else if (skip_if_dup_files && !thread_group_leader(task) &&
42 task->files == task->group_leader->files) {
43 put_task_struct(task);
54 static void *task_seq_start(struct seq_file *seq, loff_t *pos)
56 struct bpf_iter_seq_task_info *info = seq->private;
57 struct task_struct *task;
59 task = task_seq_get_next(info->common.ns, &info->tid, false);
68 static void *task_seq_next(struct seq_file *seq, void *v, loff_t *pos)
70 struct bpf_iter_seq_task_info *info = seq->private;
71 struct task_struct *task;
75 put_task_struct((struct task_struct *)v);
76 task = task_seq_get_next(info->common.ns, &info->tid, false);
83 struct bpf_iter__task {
84 __bpf_md_ptr(struct bpf_iter_meta *, meta);
85 __bpf_md_ptr(struct task_struct *, task);
88 DEFINE_BPF_ITER_FUNC(task, struct bpf_iter_meta *meta, struct task_struct *task)
90 static int __task_seq_show(struct seq_file *seq, struct task_struct *task,
93 struct bpf_iter_meta meta;
94 struct bpf_iter__task ctx;
95 struct bpf_prog *prog;
98 prog = bpf_iter_get_info(&meta, in_stop);
104 return bpf_iter_run_prog(prog, &ctx);
107 static int task_seq_show(struct seq_file *seq, void *v)
109 return __task_seq_show(seq, v, false);
112 static void task_seq_stop(struct seq_file *seq, void *v)
115 (void)__task_seq_show(seq, v, true);
117 put_task_struct((struct task_struct *)v);
120 static const struct seq_operations task_seq_ops = {
121 .start = task_seq_start,
122 .next = task_seq_next,
123 .stop = task_seq_stop,
124 .show = task_seq_show,
127 struct bpf_iter_seq_task_file_info {
128 /* The first field must be struct bpf_iter_seq_task_common.
129 * this is assumed by {init, fini}_seq_pidns() callback functions.
131 struct bpf_iter_seq_task_common common;
132 struct task_struct *task;
138 task_file_seq_get_next(struct bpf_iter_seq_task_file_info *info)
140 struct pid_namespace *ns = info->common.ns;
141 u32 curr_tid = info->tid;
142 struct task_struct *curr_task;
143 unsigned int curr_fd = info->fd;
145 /* If this function returns a non-NULL file object,
146 * it held a reference to the task/file.
147 * Otherwise, it does not hold any reference.
151 curr_task = info->task;
154 curr_task = task_seq_get_next(ns, &curr_tid, true);
157 info->tid = curr_tid;
161 /* set info->task and info->tid */
162 info->task = curr_task;
163 if (curr_tid == info->tid) {
166 info->tid = curr_tid;
174 f = task_lookup_next_fd_rcu(curr_task, &curr_fd);
177 if (!get_file_rcu(f))
186 /* the current task is done, go to the next task */
188 put_task_struct(curr_task);
191 curr_tid = ++(info->tid);
195 static void *task_file_seq_start(struct seq_file *seq, loff_t *pos)
197 struct bpf_iter_seq_task_file_info *info = seq->private;
201 file = task_file_seq_get_next(info);
202 if (file && *pos == 0)
208 static void *task_file_seq_next(struct seq_file *seq, void *v, loff_t *pos)
210 struct bpf_iter_seq_task_file_info *info = seq->private;
214 fput((struct file *)v);
215 return task_file_seq_get_next(info);
218 struct bpf_iter__task_file {
219 __bpf_md_ptr(struct bpf_iter_meta *, meta);
220 __bpf_md_ptr(struct task_struct *, task);
222 __bpf_md_ptr(struct file *, file);
225 DEFINE_BPF_ITER_FUNC(task_file, struct bpf_iter_meta *meta,
226 struct task_struct *task, u32 fd,
229 static int __task_file_seq_show(struct seq_file *seq, struct file *file,
232 struct bpf_iter_seq_task_file_info *info = seq->private;
233 struct bpf_iter__task_file ctx;
234 struct bpf_iter_meta meta;
235 struct bpf_prog *prog;
238 prog = bpf_iter_get_info(&meta, in_stop);
243 ctx.task = info->task;
246 return bpf_iter_run_prog(prog, &ctx);
249 static int task_file_seq_show(struct seq_file *seq, void *v)
251 return __task_file_seq_show(seq, v, false);
254 static void task_file_seq_stop(struct seq_file *seq, void *v)
256 struct bpf_iter_seq_task_file_info *info = seq->private;
259 (void)__task_file_seq_show(seq, v, true);
261 fput((struct file *)v);
262 put_task_struct(info->task);
267 static int init_seq_pidns(void *priv_data, struct bpf_iter_aux_info *aux)
269 struct bpf_iter_seq_task_common *common = priv_data;
271 common->ns = get_pid_ns(task_active_pid_ns(current));
275 static void fini_seq_pidns(void *priv_data)
277 struct bpf_iter_seq_task_common *common = priv_data;
279 put_pid_ns(common->ns);
282 static const struct seq_operations task_file_seq_ops = {
283 .start = task_file_seq_start,
284 .next = task_file_seq_next,
285 .stop = task_file_seq_stop,
286 .show = task_file_seq_show,
289 struct bpf_iter_seq_task_vma_info {
290 /* The first field must be struct bpf_iter_seq_task_common.
291 * this is assumed by {init, fini}_seq_pidns() callback functions.
293 struct bpf_iter_seq_task_common common;
294 struct task_struct *task;
295 struct vm_area_struct *vma;
297 unsigned long prev_vm_start;
298 unsigned long prev_vm_end;
301 enum bpf_task_vma_iter_find_op {
302 task_vma_iter_first_vma, /* use mm->mmap */
303 task_vma_iter_next_vma, /* use curr_vma->vm_next */
304 task_vma_iter_find_vma, /* use find_vma() to find next vma */
307 static struct vm_area_struct *
308 task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info)
310 struct pid_namespace *ns = info->common.ns;
311 enum bpf_task_vma_iter_find_op op;
312 struct vm_area_struct *curr_vma;
313 struct task_struct *curr_task;
314 u32 curr_tid = info->tid;
316 /* If this function returns a non-NULL vma, it holds a reference to
317 * the task_struct, and holds read lock on vma->mm->mmap_lock.
318 * If this function returns NULL, it does not hold any reference or
322 curr_task = info->task;
323 curr_vma = info->vma;
324 /* In case of lock contention, drop mmap_lock to unblock
327 * After relock, call find(mm, prev_vm_end - 1) to find
328 * new vma to process.
330 * +------+------+-----------+
331 * | VMA1 | VMA2 | VMA3 |
332 * +------+------+-----------+
336 * For example, curr_vma == VMA2. Before unlock, we set
341 * There are a few cases:
343 * 1) VMA2 is freed, but VMA3 exists.
345 * find_vma() will return VMA3, just process VMA3.
347 * 2) VMA2 still exists.
349 * find_vma() will return VMA2, process VMA2->next.
351 * 3) no more vma in this mm.
353 * Process the next task.
355 * 4) find_vma() returns a different vma, VMA2'.
357 * 4.1) If VMA2 covers same range as VMA2', skip VMA2',
358 * because we already covered the range;
359 * 4.2) VMA2 and VMA2' covers different ranges, process
362 if (mmap_lock_is_contended(curr_task->mm)) {
363 info->prev_vm_start = curr_vma->vm_start;
364 info->prev_vm_end = curr_vma->vm_end;
365 op = task_vma_iter_find_vma;
366 mmap_read_unlock(curr_task->mm);
367 if (mmap_read_lock_killable(curr_task->mm))
370 op = task_vma_iter_next_vma;
374 curr_task = task_seq_get_next(ns, &curr_tid, true);
376 info->tid = curr_tid + 1;
380 if (curr_tid != info->tid) {
381 info->tid = curr_tid;
382 /* new task, process the first vma */
383 op = task_vma_iter_first_vma;
385 /* Found the same tid, which means the user space
386 * finished data in previous buffer and read more.
387 * We dropped mmap_lock before returning to user
388 * space, so it is necessary to use find_vma() to
389 * find the next vma to process.
391 op = task_vma_iter_find_vma;
397 if (mmap_read_lock_killable(curr_task->mm))
402 case task_vma_iter_first_vma:
403 curr_vma = curr_task->mm->mmap;
405 case task_vma_iter_next_vma:
406 curr_vma = curr_vma->vm_next;
408 case task_vma_iter_find_vma:
409 /* We dropped mmap_lock so it is necessary to use find_vma
410 * to find the next vma. This is similar to the mechanism
411 * in show_smaps_rollup().
413 curr_vma = find_vma(curr_task->mm, info->prev_vm_end - 1);
414 /* case 1) and 4.2) above just use curr_vma */
416 /* check for case 2) or case 4.1) above */
418 curr_vma->vm_start == info->prev_vm_start &&
419 curr_vma->vm_end == info->prev_vm_end)
420 curr_vma = curr_vma->vm_next;
424 /* case 3) above, or case 2) 4.1) with vma->next == NULL */
425 mmap_read_unlock(curr_task->mm);
428 info->task = curr_task;
429 info->vma = curr_vma;
433 put_task_struct(curr_task);
440 put_task_struct(curr_task);
446 static void *task_vma_seq_start(struct seq_file *seq, loff_t *pos)
448 struct bpf_iter_seq_task_vma_info *info = seq->private;
449 struct vm_area_struct *vma;
451 vma = task_vma_seq_get_next(info);
452 if (vma && *pos == 0)
458 static void *task_vma_seq_next(struct seq_file *seq, void *v, loff_t *pos)
460 struct bpf_iter_seq_task_vma_info *info = seq->private;
463 return task_vma_seq_get_next(info);
466 struct bpf_iter__task_vma {
467 __bpf_md_ptr(struct bpf_iter_meta *, meta);
468 __bpf_md_ptr(struct task_struct *, task);
469 __bpf_md_ptr(struct vm_area_struct *, vma);
472 DEFINE_BPF_ITER_FUNC(task_vma, struct bpf_iter_meta *meta,
473 struct task_struct *task, struct vm_area_struct *vma)
475 static int __task_vma_seq_show(struct seq_file *seq, bool in_stop)
477 struct bpf_iter_seq_task_vma_info *info = seq->private;
478 struct bpf_iter__task_vma ctx;
479 struct bpf_iter_meta meta;
480 struct bpf_prog *prog;
483 prog = bpf_iter_get_info(&meta, in_stop);
488 ctx.task = info->task;
490 return bpf_iter_run_prog(prog, &ctx);
493 static int task_vma_seq_show(struct seq_file *seq, void *v)
495 return __task_vma_seq_show(seq, false);
498 static void task_vma_seq_stop(struct seq_file *seq, void *v)
500 struct bpf_iter_seq_task_vma_info *info = seq->private;
503 (void)__task_vma_seq_show(seq, true);
505 /* info->vma has not been seen by the BPF program. If the
506 * user space reads more, task_vma_seq_get_next should
507 * return this vma again. Set prev_vm_start to ~0UL,
508 * so that we don't skip the vma returned by the next
509 * find_vma() (case task_vma_iter_find_vma in
510 * task_vma_seq_get_next()).
512 info->prev_vm_start = ~0UL;
513 info->prev_vm_end = info->vma->vm_end;
514 mmap_read_unlock(info->task->mm);
515 put_task_struct(info->task);
520 static const struct seq_operations task_vma_seq_ops = {
521 .start = task_vma_seq_start,
522 .next = task_vma_seq_next,
523 .stop = task_vma_seq_stop,
524 .show = task_vma_seq_show,
527 static const struct bpf_iter_seq_info task_seq_info = {
528 .seq_ops = &task_seq_ops,
529 .init_seq_private = init_seq_pidns,
530 .fini_seq_private = fini_seq_pidns,
531 .seq_priv_size = sizeof(struct bpf_iter_seq_task_info),
534 static struct bpf_iter_reg task_reg_info = {
536 .feature = BPF_ITER_RESCHED,
537 .ctx_arg_info_size = 1,
539 { offsetof(struct bpf_iter__task, task),
540 PTR_TO_BTF_ID_OR_NULL },
542 .seq_info = &task_seq_info,
545 static const struct bpf_iter_seq_info task_file_seq_info = {
546 .seq_ops = &task_file_seq_ops,
547 .init_seq_private = init_seq_pidns,
548 .fini_seq_private = fini_seq_pidns,
549 .seq_priv_size = sizeof(struct bpf_iter_seq_task_file_info),
552 static struct bpf_iter_reg task_file_reg_info = {
553 .target = "task_file",
554 .feature = BPF_ITER_RESCHED,
555 .ctx_arg_info_size = 2,
557 { offsetof(struct bpf_iter__task_file, task),
558 PTR_TO_BTF_ID_OR_NULL },
559 { offsetof(struct bpf_iter__task_file, file),
560 PTR_TO_BTF_ID_OR_NULL },
562 .seq_info = &task_file_seq_info,
565 static const struct bpf_iter_seq_info task_vma_seq_info = {
566 .seq_ops = &task_vma_seq_ops,
567 .init_seq_private = init_seq_pidns,
568 .fini_seq_private = fini_seq_pidns,
569 .seq_priv_size = sizeof(struct bpf_iter_seq_task_vma_info),
572 static struct bpf_iter_reg task_vma_reg_info = {
573 .target = "task_vma",
574 .feature = BPF_ITER_RESCHED,
575 .ctx_arg_info_size = 2,
577 { offsetof(struct bpf_iter__task_vma, task),
578 PTR_TO_BTF_ID_OR_NULL },
579 { offsetof(struct bpf_iter__task_vma, vma),
580 PTR_TO_BTF_ID_OR_NULL },
582 .seq_info = &task_vma_seq_info,
585 BPF_CALL_5(bpf_find_vma, struct task_struct *, task, u64, start,
586 bpf_callback_t, callback_fn, void *, callback_ctx, u64, flags)
588 struct mmap_unlock_irq_work *work = NULL;
589 struct vm_area_struct *vma;
590 bool irq_work_busy = false;
591 struct mm_struct *mm;
604 irq_work_busy = bpf_mmap_unlock_get_irq_work(&work);
606 if (irq_work_busy || !mmap_read_trylock(mm))
609 vma = find_vma(mm, start);
611 if (vma && vma->vm_start <= start && vma->vm_end > start) {
612 callback_fn((u64)(long)task, (u64)(long)vma,
613 (u64)(long)callback_ctx, 0, 0);
616 bpf_mmap_unlock_mm(work, mm);
620 const struct bpf_func_proto bpf_find_vma_proto = {
621 .func = bpf_find_vma,
622 .ret_type = RET_INTEGER,
623 .arg1_type = ARG_PTR_TO_BTF_ID,
624 .arg1_btf_id = &btf_tracing_ids[BTF_TRACING_TYPE_TASK],
625 .arg2_type = ARG_ANYTHING,
626 .arg3_type = ARG_PTR_TO_FUNC,
627 .arg4_type = ARG_PTR_TO_STACK_OR_NULL,
628 .arg5_type = ARG_ANYTHING,
631 DEFINE_PER_CPU(struct mmap_unlock_irq_work, mmap_unlock_work);
633 static void do_mmap_read_unlock(struct irq_work *entry)
635 struct mmap_unlock_irq_work *work;
637 if (WARN_ON_ONCE(IS_ENABLED(CONFIG_PREEMPT_RT)))
640 work = container_of(entry, struct mmap_unlock_irq_work, irq_work);
641 mmap_read_unlock_non_owner(work->mm);
644 static int __init task_iter_init(void)
646 struct mmap_unlock_irq_work *work;
649 for_each_possible_cpu(cpu) {
650 work = per_cpu_ptr(&mmap_unlock_work, cpu);
651 init_irq_work(&work->irq_work, do_mmap_read_unlock);
654 task_reg_info.ctx_arg_info[0].btf_id = btf_tracing_ids[BTF_TRACING_TYPE_TASK];
655 ret = bpf_iter_reg_target(&task_reg_info);
659 task_file_reg_info.ctx_arg_info[0].btf_id = btf_tracing_ids[BTF_TRACING_TYPE_TASK];
660 task_file_reg_info.ctx_arg_info[1].btf_id = btf_tracing_ids[BTF_TRACING_TYPE_FILE];
661 ret = bpf_iter_reg_target(&task_file_reg_info);
665 task_vma_reg_info.ctx_arg_info[0].btf_id = btf_tracing_ids[BTF_TRACING_TYPE_TASK];
666 task_vma_reg_info.ctx_arg_info[1].btf_id = btf_tracing_ids[BTF_TRACING_TYPE_VMA];
667 return bpf_iter_reg_target(&task_vma_reg_info);
669 late_initcall(task_iter_init);