libbpf-tools/profile: Add support for PID-namespacing

libbpf-tools/profile.bpf.c

@@ -17,6 +17,9 @@ const volatile bool user_stacks_only = false;
 const volatile bool include_idle = false;
 const volatile bool filter_by_pid = false;
 const volatile bool filter_by_tid = false;
+const volatile bool use_pidns = false;
+const volatile __u64 pidns_dev = 0;
+const volatile __u64 pidns_ino = 0;
 
 struct {
 	__uint(type, BPF_MAP_TYPE_STACK_TRACE);
@@ -47,12 +50,23 @@ struct {
 SEC("perf_event")
 int do_perf_event(struct bpf_perf_event_data *ctx)
 {
-	u64 id = bpf_get_current_pid_tgid();
-	u32 pid = id >> 32;
-	u32 tid = id;
 	u64 *valp;
 	static const u64 zero;
 	struct key_t key = {};
+	u64 id;
+	u32 pid;
+	u32 tid;
+	struct bpf_pidns_info ns = {};
+
+	if (use_pidns && !bpf_get_ns_current_pid_tgid(pidns_dev, pidns_ino, &ns,
+						      sizeof(struct bpf_pidns_info))) {
+		pid = ns.tgid;
+		tid = ns.pid;
+	} else {
+		id = bpf_get_current_pid_tgid();
+		pid = id >> 32;
+		tid = id;
+	}
 
 	if (!include_idle && tid == 0)
 		return 0;

libbpf-tools/profile.c

@@ -17,6 +17,7 @@
 #include <asm/unistd.h>
 #include <bpf/libbpf.h>
 #include <bpf/bpf.h>
+#include <sys/stat.h>
 #include "profile.h"
 #include "profile.skel.h"
 #include "trace_helpers.h"
@@ -506,6 +507,23 @@ static int print_counts(int counts_map, int stack_map)
 	return ret;
 }
 
+static int set_pidns(const struct profile_bpf *obj)
+{
+	struct stat statbuf;
+
+	if (!probe_bpf_ns_current_pid_tgid())
+		return -EPERM;
+
+	if (stat("/proc/self/ns/pid", &statbuf) == -1)
+		return -errno;
+
+	obj->rodata->use_pidns = true;
+	obj->rodata->pidns_dev = statbuf.st_dev;
+	obj->rodata->pidns_ino = statbuf.st_ino;
+
+	return 0;
+}
+
 static void print_headers()
 {
 	int i;
@@ -595,6 +613,10 @@ int main(int argc, char **argv)
 				env.perf_max_stack_depth * sizeof(unsigned long));
 	bpf_map__set_max_entries(obj->maps.stackmap, env.stack_storage_size);
 
+	err = set_pidns(obj);
+	if (err && env.verbose)
+		fprintf(stderr, "failed to translate pidns: %s\n", strerror(-err));
+
 	err = profile_bpf__load(obj);
 	if (err) {
 		fprintf(stderr, "failed to load BPF programs\n");

libbpf-tools/trace_helpers.c

@@ -1248,6 +1248,28 @@ bool probe_ringbuf()
 	return true;
 }
 
+bool probe_bpf_ns_current_pid_tgid(void)
+{
+	int fd, insn_cnt;
+	struct bpf_insn insns[] = {
+		{ .code = BPF_ALU64 | BPF_MOV | BPF_X, .dst_reg = 3, .src_reg = BPF_REG_10, .off = 0, .imm = 0 },
+		{ .code = BPF_ALU64 | BPF_ADD | BPF_K, .dst_reg = 3, .src_reg = 0, .off = 0, .imm = -8 },
+		{ .code = BPF_ALU64 | BPF_MOV | BPF_K, .dst_reg = 1, .src_reg = 0, .off = 0, .imm = 0 },
+		{ .code = BPF_ALU64 | BPF_MOV | BPF_K, .dst_reg = 2, .src_reg = 0, .off = 0, .imm = 0 },
+		{ .code = BPF_ALU64 | BPF_MOV | BPF_K, .dst_reg = 4, .src_reg = 0, .off = 0, .imm = 8 },
+		{ .code = BPF_JMP | BPF_CALL, .imm = BPF_FUNC_get_ns_current_pid_tgid },
+		{ .code = BPF_JMP | BPF_EXIT },
+	};
+
+	insn_cnt = sizeof(insns) / sizeof(struct bpf_insn);
+
+	fd = bpf_prog_load(BPF_PROG_TYPE_KPROBE, NULL, "GPL", insns, insn_cnt, NULL);
+	if (fd >= 0)
+		close(fd);
+
+	return fd >= 0;
+}
+
 int split_convert(char *s, const char* delim, void *elems, size_t elems_size,
 		  size_t elem_size, convert_fn_t convert)
 {

libbpf-tools/trace_helpers.h

@@ -107,6 +107,7 @@ bool module_btf_exists(const char *mod);
 
 bool probe_tp_btf(const char *name);
 bool probe_ringbuf();
+bool probe_bpf_ns_current_pid_tgid(void);
 
 typedef int (*convert_fn_t)(const char *src, void *dest);
 int split_convert(char *s, const char* delim, void *elems, size_t elems_size,