1*4882a593Smuzhiyun /* SPDX-License-Identifier: LGPL-2.1 WITH Linux-syscall-note */ 2*4882a593Smuzhiyun /* 3*4882a593Smuzhiyun * cn_proc.h - process events connector 4*4882a593Smuzhiyun * 5*4882a593Smuzhiyun * Copyright (C) Matt Helsley, IBM Corp. 2005 6*4882a593Smuzhiyun * Based on cn_fork.h by Nguyen Anh Quynh and Guillaume Thouvenin 7*4882a593Smuzhiyun * Copyright (C) 2005 Nguyen Anh Quynh <aquynh@gmail.com> 8*4882a593Smuzhiyun * Copyright (C) 2005 Guillaume Thouvenin <guillaume.thouvenin@bull.net> 9*4882a593Smuzhiyun * 10*4882a593Smuzhiyun * This program is free software; you can redistribute it and/or modify it 11*4882a593Smuzhiyun * under the terms of version 2.1 of the GNU Lesser General Public License 12*4882a593Smuzhiyun * as published by the Free Software Foundation. 13*4882a593Smuzhiyun * 14*4882a593Smuzhiyun * This program is distributed in the hope that it would be useful, but 15*4882a593Smuzhiyun * WITHOUT ANY WARRANTY; without even the implied warranty of 16*4882a593Smuzhiyun * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 17*4882a593Smuzhiyun */ 18*4882a593Smuzhiyun 19*4882a593Smuzhiyun #ifndef _UAPICN_PROC_H 20*4882a593Smuzhiyun #define _UAPICN_PROC_H 21*4882a593Smuzhiyun 22*4882a593Smuzhiyun #include <linux/types.h> 23*4882a593Smuzhiyun 24*4882a593Smuzhiyun /* 25*4882a593Smuzhiyun * Userspace sends this enum to register with the kernel that it is listening 26*4882a593Smuzhiyun * for events on the connector. 27*4882a593Smuzhiyun */ 28*4882a593Smuzhiyun enum proc_cn_mcast_op { 29*4882a593Smuzhiyun PROC_CN_MCAST_LISTEN = 1, 30*4882a593Smuzhiyun PROC_CN_MCAST_IGNORE = 2 31*4882a593Smuzhiyun }; 32*4882a593Smuzhiyun 33*4882a593Smuzhiyun /* 34*4882a593Smuzhiyun * From the user's point of view, the process 35*4882a593Smuzhiyun * ID is the thread group ID and thread ID is the internal 36*4882a593Smuzhiyun * kernel "pid". So, fields are assigned as follow: 37*4882a593Smuzhiyun * 38*4882a593Smuzhiyun * In user space - In kernel space 39*4882a593Smuzhiyun * 40*4882a593Smuzhiyun * parent process ID = parent->tgid 41*4882a593Smuzhiyun * parent thread ID = parent->pid 42*4882a593Smuzhiyun * child process ID = child->tgid 43*4882a593Smuzhiyun * child thread ID = child->pid 44*4882a593Smuzhiyun */ 45*4882a593Smuzhiyun 46*4882a593Smuzhiyun struct proc_event { 47*4882a593Smuzhiyun enum what { 48*4882a593Smuzhiyun /* Use successive bits so the enums can be used to record 49*4882a593Smuzhiyun * sets of events as well 50*4882a593Smuzhiyun */ 51*4882a593Smuzhiyun PROC_EVENT_NONE = 0x00000000, 52*4882a593Smuzhiyun PROC_EVENT_FORK = 0x00000001, 53*4882a593Smuzhiyun PROC_EVENT_EXEC = 0x00000002, 54*4882a593Smuzhiyun PROC_EVENT_UID = 0x00000004, 55*4882a593Smuzhiyun PROC_EVENT_GID = 0x00000040, 56*4882a593Smuzhiyun PROC_EVENT_SID = 0x00000080, 57*4882a593Smuzhiyun PROC_EVENT_PTRACE = 0x00000100, 58*4882a593Smuzhiyun PROC_EVENT_COMM = 0x00000200, 59*4882a593Smuzhiyun /* "next" should be 0x00000400 */ 60*4882a593Smuzhiyun /* "last" is the last process event: exit, 61*4882a593Smuzhiyun * while "next to last" is coredumping event */ 62*4882a593Smuzhiyun PROC_EVENT_COREDUMP = 0x40000000, 63*4882a593Smuzhiyun PROC_EVENT_EXIT = 0x80000000 64*4882a593Smuzhiyun } what; 65*4882a593Smuzhiyun __u32 cpu; 66*4882a593Smuzhiyun __u64 __attribute__((aligned(8))) timestamp_ns; 67*4882a593Smuzhiyun /* Number of nano seconds since system boot */ 68*4882a593Smuzhiyun union { /* must be last field of proc_event struct */ 69*4882a593Smuzhiyun struct { 70*4882a593Smuzhiyun __u32 err; 71*4882a593Smuzhiyun } ack; 72*4882a593Smuzhiyun 73*4882a593Smuzhiyun struct fork_proc_event { 74*4882a593Smuzhiyun __kernel_pid_t parent_pid; 75*4882a593Smuzhiyun __kernel_pid_t parent_tgid; 76*4882a593Smuzhiyun __kernel_pid_t child_pid; 77*4882a593Smuzhiyun __kernel_pid_t child_tgid; 78*4882a593Smuzhiyun } fork; 79*4882a593Smuzhiyun 80*4882a593Smuzhiyun struct exec_proc_event { 81*4882a593Smuzhiyun __kernel_pid_t process_pid; 82*4882a593Smuzhiyun __kernel_pid_t process_tgid; 83*4882a593Smuzhiyun } exec; 84*4882a593Smuzhiyun 85*4882a593Smuzhiyun struct id_proc_event { 86*4882a593Smuzhiyun __kernel_pid_t process_pid; 87*4882a593Smuzhiyun __kernel_pid_t process_tgid; 88*4882a593Smuzhiyun union { 89*4882a593Smuzhiyun __u32 ruid; /* task uid */ 90*4882a593Smuzhiyun __u32 rgid; /* task gid */ 91*4882a593Smuzhiyun } r; 92*4882a593Smuzhiyun union { 93*4882a593Smuzhiyun __u32 euid; 94*4882a593Smuzhiyun __u32 egid; 95*4882a593Smuzhiyun } e; 96*4882a593Smuzhiyun } id; 97*4882a593Smuzhiyun 98*4882a593Smuzhiyun struct sid_proc_event { 99*4882a593Smuzhiyun __kernel_pid_t process_pid; 100*4882a593Smuzhiyun __kernel_pid_t process_tgid; 101*4882a593Smuzhiyun } sid; 102*4882a593Smuzhiyun 103*4882a593Smuzhiyun struct ptrace_proc_event { 104*4882a593Smuzhiyun __kernel_pid_t process_pid; 105*4882a593Smuzhiyun __kernel_pid_t process_tgid; 106*4882a593Smuzhiyun __kernel_pid_t tracer_pid; 107*4882a593Smuzhiyun __kernel_pid_t tracer_tgid; 108*4882a593Smuzhiyun } ptrace; 109*4882a593Smuzhiyun 110*4882a593Smuzhiyun struct comm_proc_event { 111*4882a593Smuzhiyun __kernel_pid_t process_pid; 112*4882a593Smuzhiyun __kernel_pid_t process_tgid; 113*4882a593Smuzhiyun char comm[16]; 114*4882a593Smuzhiyun } comm; 115*4882a593Smuzhiyun 116*4882a593Smuzhiyun struct coredump_proc_event { 117*4882a593Smuzhiyun __kernel_pid_t process_pid; 118*4882a593Smuzhiyun __kernel_pid_t process_tgid; 119*4882a593Smuzhiyun __kernel_pid_t parent_pid; 120*4882a593Smuzhiyun __kernel_pid_t parent_tgid; 121*4882a593Smuzhiyun } coredump; 122*4882a593Smuzhiyun 123*4882a593Smuzhiyun struct exit_proc_event { 124*4882a593Smuzhiyun __kernel_pid_t process_pid; 125*4882a593Smuzhiyun __kernel_pid_t process_tgid; 126*4882a593Smuzhiyun __u32 exit_code, exit_signal; 127*4882a593Smuzhiyun __kernel_pid_t parent_pid; 128*4882a593Smuzhiyun __kernel_pid_t parent_tgid; 129*4882a593Smuzhiyun } exit; 130*4882a593Smuzhiyun 131*4882a593Smuzhiyun } event_data; 132*4882a593Smuzhiyun }; 133*4882a593Smuzhiyun 134*4882a593Smuzhiyun #endif /* _UAPICN_PROC_H */ 135