178 lines · c
1// SPDX-License-Identifier: GPL-2.02/* Copyright (c) 2020 Facebook */3#pragma once4 5#define TASK_COMM_LEN 166#define MAX_ANCESTORS 47#define MAX_PATH 2568#define KILL_TARGET_LEN 649#define CTL_MAXNAME 1010#define MAX_ARGS_LEN 409611#define MAX_FILENAME_LEN 51212#define MAX_ENVIRON_LEN 819213#define MAX_PATH_DEPTH 3214#define MAX_FILEPATH_LENGTH (MAX_PATH_DEPTH * MAX_PATH)15#define MAX_CGROUPS_PATH_DEPTH 816 17#define MAX_METADATA_PAYLOAD_LEN TASK_COMM_LEN18 19#define MAX_CGROUP_PAYLOAD_LEN \20 (MAX_PATH * 2 + (MAX_PATH * MAX_CGROUPS_PATH_DEPTH))21 22#define MAX_CAP_PAYLOAD_LEN (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN)23 24#define MAX_SYSCTL_PAYLOAD_LEN \25 (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + CTL_MAXNAME + MAX_PATH)26 27#define MAX_KILL_PAYLOAD_LEN \28 (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + TASK_COMM_LEN + \29 KILL_TARGET_LEN)30 31#define MAX_EXEC_PAYLOAD_LEN \32 (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + MAX_FILENAME_LEN + \33 MAX_ARGS_LEN + MAX_ENVIRON_LEN)34 35#define MAX_FILEMOD_PAYLOAD_LEN \36 (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + MAX_FILEPATH_LENGTH + \37 MAX_FILEPATH_LENGTH)38 39enum data_type {40 INVALID_EVENT,41 EXEC_EVENT,42 FORK_EVENT,43 KILL_EVENT,44 SYSCTL_EVENT,45 FILEMOD_EVENT,46 MAX_DATA_TYPE_EVENT47};48 49enum filemod_type {50 FMOD_OPEN,51 FMOD_LINK,52 FMOD_SYMLINK,53};54 55struct ancestors_data_t {56 pid_t ancestor_pids[MAX_ANCESTORS];57 uint32_t ancestor_exec_ids[MAX_ANCESTORS];58 uint64_t ancestor_start_times[MAX_ANCESTORS];59 uint32_t num_ancestors;60};61 62struct var_metadata_t {63 enum data_type type;64 pid_t pid;65 uint32_t exec_id;66 uid_t uid;67 gid_t gid;68 uint64_t start_time;69 uint32_t cpu_id;70 uint64_t bpf_stats_num_perf_events;71 uint64_t bpf_stats_start_ktime_ns;72 uint8_t comm_length;73};74 75struct cgroup_data_t {76 ino_t cgroup_root_inode;77 ino_t cgroup_proc_inode;78 uint64_t cgroup_root_mtime;79 uint64_t cgroup_proc_mtime;80 uint16_t cgroup_root_length;81 uint16_t cgroup_proc_length;82 uint16_t cgroup_full_length;83 int cgroup_full_path_root_pos;84};85 86struct var_sysctl_data_t {87 struct var_metadata_t meta;88 struct cgroup_data_t cgroup_data;89 struct ancestors_data_t ancestors_info;90 uint8_t sysctl_val_length;91 uint16_t sysctl_path_length;92 char payload[MAX_SYSCTL_PAYLOAD_LEN];93};94 95struct var_kill_data_t {96 struct var_metadata_t meta;97 struct cgroup_data_t cgroup_data;98 struct ancestors_data_t ancestors_info;99 pid_t kill_target_pid;100 int kill_sig;101 uint32_t kill_count;102 uint64_t last_kill_time;103 uint8_t kill_target_name_length;104 uint8_t kill_target_cgroup_proc_length;105 char payload[MAX_KILL_PAYLOAD_LEN];106 size_t payload_length;107};108 109struct var_exec_data_t {110 struct var_metadata_t meta;111 struct cgroup_data_t cgroup_data;112 pid_t parent_pid;113 uint32_t parent_exec_id;114 uid_t parent_uid;115 uint64_t parent_start_time;116 uint16_t bin_path_length;117 uint16_t cmdline_length;118 uint16_t environment_length;119 char payload[MAX_EXEC_PAYLOAD_LEN];120};121 122struct var_fork_data_t {123 struct var_metadata_t meta;124 pid_t parent_pid;125 uint32_t parent_exec_id;126 uint64_t parent_start_time;127 char payload[MAX_METADATA_PAYLOAD_LEN];128};129 130struct var_filemod_data_t {131 struct var_metadata_t meta;132 struct cgroup_data_t cgroup_data;133 enum filemod_type fmod_type;134 unsigned int dst_flags;135 uint32_t src_device_id;136 uint32_t dst_device_id;137 ino_t src_inode;138 ino_t dst_inode;139 uint16_t src_filepath_length;140 uint16_t dst_filepath_length;141 char payload[MAX_FILEMOD_PAYLOAD_LEN];142};143 144struct profiler_config_struct {145 bool fetch_cgroups_from_bpf;146 ino_t cgroup_fs_inode;147 ino_t cgroup_login_session_inode;148 uint64_t kill_signals_mask;149 ino_t inode_filter;150 uint32_t stale_info_secs;151 bool use_variable_buffers;152 bool read_environ_from_exec;153 bool enable_cgroup_v1_resolver;154};155 156struct bpf_func_stats_data {157 uint64_t time_elapsed_ns;158 uint64_t num_executions;159 uint64_t num_perf_events;160};161 162struct bpf_func_stats_ctx {163 uint64_t start_time_ns;164 struct bpf_func_stats_data* bpf_func_stats_data_val;165};166 167enum bpf_function_id {168 profiler_bpf_proc_sys_write,169 profiler_bpf_sched_process_exec,170 profiler_bpf_sched_process_exit,171 profiler_bpf_sys_enter_kill,172 profiler_bpf_do_filp_open_ret,173 profiler_bpf_sched_process_fork,174 profiler_bpf_vfs_link,175 profiler_bpf_vfs_symlink,176 profiler_bpf_max_function_id177};178