1*4882a593Smuzhiyun // SPDX-License-Identifier: GPL-2.0 2*4882a593Smuzhiyun /* Copyright (c) 2020 Facebook */ 3*4882a593Smuzhiyun #pragma once 4*4882a593Smuzhiyun 5*4882a593Smuzhiyun #define TASK_COMM_LEN 16 6*4882a593Smuzhiyun #define MAX_ANCESTORS 4 7*4882a593Smuzhiyun #define MAX_PATH 256 8*4882a593Smuzhiyun #define KILL_TARGET_LEN 64 9*4882a593Smuzhiyun #define CTL_MAXNAME 10 10*4882a593Smuzhiyun #define MAX_ARGS_LEN 4096 11*4882a593Smuzhiyun #define MAX_FILENAME_LEN 512 12*4882a593Smuzhiyun #define MAX_ENVIRON_LEN 8192 13*4882a593Smuzhiyun #define MAX_PATH_DEPTH 32 14*4882a593Smuzhiyun #define MAX_FILEPATH_LENGTH (MAX_PATH_DEPTH * MAX_PATH) 15*4882a593Smuzhiyun #define MAX_CGROUPS_PATH_DEPTH 8 16*4882a593Smuzhiyun 17*4882a593Smuzhiyun #define MAX_METADATA_PAYLOAD_LEN TASK_COMM_LEN 18*4882a593Smuzhiyun 19*4882a593Smuzhiyun #define MAX_CGROUP_PAYLOAD_LEN \ 20*4882a593Smuzhiyun (MAX_PATH * 2 + (MAX_PATH * MAX_CGROUPS_PATH_DEPTH)) 21*4882a593Smuzhiyun 22*4882a593Smuzhiyun #define MAX_CAP_PAYLOAD_LEN (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN) 23*4882a593Smuzhiyun 24*4882a593Smuzhiyun #define MAX_SYSCTL_PAYLOAD_LEN \ 25*4882a593Smuzhiyun (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + CTL_MAXNAME + MAX_PATH) 26*4882a593Smuzhiyun 27*4882a593Smuzhiyun #define MAX_KILL_PAYLOAD_LEN \ 28*4882a593Smuzhiyun (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + TASK_COMM_LEN + \ 29*4882a593Smuzhiyun KILL_TARGET_LEN) 30*4882a593Smuzhiyun 31*4882a593Smuzhiyun #define MAX_EXEC_PAYLOAD_LEN \ 32*4882a593Smuzhiyun (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + MAX_FILENAME_LEN + \ 33*4882a593Smuzhiyun MAX_ARGS_LEN + MAX_ENVIRON_LEN) 34*4882a593Smuzhiyun 35*4882a593Smuzhiyun #define MAX_FILEMOD_PAYLOAD_LEN \ 36*4882a593Smuzhiyun (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + MAX_FILEPATH_LENGTH + \ 37*4882a593Smuzhiyun MAX_FILEPATH_LENGTH) 38*4882a593Smuzhiyun 39*4882a593Smuzhiyun enum data_type { 40*4882a593Smuzhiyun INVALID_EVENT, 41*4882a593Smuzhiyun EXEC_EVENT, 42*4882a593Smuzhiyun FORK_EVENT, 43*4882a593Smuzhiyun KILL_EVENT, 44*4882a593Smuzhiyun SYSCTL_EVENT, 45*4882a593Smuzhiyun FILEMOD_EVENT, 46*4882a593Smuzhiyun MAX_DATA_TYPE_EVENT 47*4882a593Smuzhiyun }; 48*4882a593Smuzhiyun 49*4882a593Smuzhiyun enum filemod_type { 50*4882a593Smuzhiyun FMOD_OPEN, 51*4882a593Smuzhiyun FMOD_LINK, 52*4882a593Smuzhiyun FMOD_SYMLINK, 53*4882a593Smuzhiyun }; 54*4882a593Smuzhiyun 55*4882a593Smuzhiyun struct ancestors_data_t { 56*4882a593Smuzhiyun pid_t ancestor_pids[MAX_ANCESTORS]; 57*4882a593Smuzhiyun uint32_t ancestor_exec_ids[MAX_ANCESTORS]; 58*4882a593Smuzhiyun uint64_t ancestor_start_times[MAX_ANCESTORS]; 59*4882a593Smuzhiyun uint32_t num_ancestors; 60*4882a593Smuzhiyun }; 61*4882a593Smuzhiyun 62*4882a593Smuzhiyun struct var_metadata_t { 63*4882a593Smuzhiyun enum data_type type; 64*4882a593Smuzhiyun pid_t pid; 65*4882a593Smuzhiyun uint32_t exec_id; 66*4882a593Smuzhiyun uid_t uid; 67*4882a593Smuzhiyun gid_t gid; 68*4882a593Smuzhiyun uint64_t start_time; 69*4882a593Smuzhiyun uint32_t cpu_id; 70*4882a593Smuzhiyun uint64_t bpf_stats_num_perf_events; 71*4882a593Smuzhiyun uint64_t bpf_stats_start_ktime_ns; 72*4882a593Smuzhiyun uint8_t comm_length; 73*4882a593Smuzhiyun }; 74*4882a593Smuzhiyun 75*4882a593Smuzhiyun struct cgroup_data_t { 76*4882a593Smuzhiyun ino_t cgroup_root_inode; 77*4882a593Smuzhiyun ino_t cgroup_proc_inode; 78*4882a593Smuzhiyun uint64_t cgroup_root_mtime; 79*4882a593Smuzhiyun uint64_t cgroup_proc_mtime; 80*4882a593Smuzhiyun uint16_t cgroup_root_length; 81*4882a593Smuzhiyun uint16_t cgroup_proc_length; 82*4882a593Smuzhiyun uint16_t cgroup_full_length; 83*4882a593Smuzhiyun int cgroup_full_path_root_pos; 84*4882a593Smuzhiyun }; 85*4882a593Smuzhiyun 86*4882a593Smuzhiyun struct var_sysctl_data_t { 87*4882a593Smuzhiyun struct var_metadata_t meta; 88*4882a593Smuzhiyun struct cgroup_data_t cgroup_data; 89*4882a593Smuzhiyun struct ancestors_data_t ancestors_info; 90*4882a593Smuzhiyun uint8_t sysctl_val_length; 91*4882a593Smuzhiyun uint16_t sysctl_path_length; 92*4882a593Smuzhiyun char payload[MAX_SYSCTL_PAYLOAD_LEN]; 93*4882a593Smuzhiyun }; 94*4882a593Smuzhiyun 95*4882a593Smuzhiyun struct var_kill_data_t { 96*4882a593Smuzhiyun struct var_metadata_t meta; 97*4882a593Smuzhiyun struct cgroup_data_t cgroup_data; 98*4882a593Smuzhiyun struct ancestors_data_t ancestors_info; 99*4882a593Smuzhiyun pid_t kill_target_pid; 100*4882a593Smuzhiyun int kill_sig; 101*4882a593Smuzhiyun uint32_t kill_count; 102*4882a593Smuzhiyun uint64_t last_kill_time; 103*4882a593Smuzhiyun uint8_t kill_target_name_length; 104*4882a593Smuzhiyun uint8_t kill_target_cgroup_proc_length; 105*4882a593Smuzhiyun char payload[MAX_KILL_PAYLOAD_LEN]; 106*4882a593Smuzhiyun size_t payload_length; 107*4882a593Smuzhiyun }; 108*4882a593Smuzhiyun 109*4882a593Smuzhiyun struct var_exec_data_t { 110*4882a593Smuzhiyun struct var_metadata_t meta; 111*4882a593Smuzhiyun struct cgroup_data_t cgroup_data; 112*4882a593Smuzhiyun pid_t parent_pid; 113*4882a593Smuzhiyun uint32_t parent_exec_id; 114*4882a593Smuzhiyun uid_t parent_uid; 115*4882a593Smuzhiyun uint64_t parent_start_time; 116*4882a593Smuzhiyun uint16_t bin_path_length; 117*4882a593Smuzhiyun uint16_t cmdline_length; 118*4882a593Smuzhiyun uint16_t environment_length; 119*4882a593Smuzhiyun char payload[MAX_EXEC_PAYLOAD_LEN]; 120*4882a593Smuzhiyun }; 121*4882a593Smuzhiyun 122*4882a593Smuzhiyun struct var_fork_data_t { 123*4882a593Smuzhiyun struct var_metadata_t meta; 124*4882a593Smuzhiyun pid_t parent_pid; 125*4882a593Smuzhiyun uint32_t parent_exec_id; 126*4882a593Smuzhiyun uint64_t parent_start_time; 127*4882a593Smuzhiyun char payload[MAX_METADATA_PAYLOAD_LEN]; 128*4882a593Smuzhiyun }; 129*4882a593Smuzhiyun 130*4882a593Smuzhiyun struct var_filemod_data_t { 131*4882a593Smuzhiyun struct var_metadata_t meta; 132*4882a593Smuzhiyun struct cgroup_data_t cgroup_data; 133*4882a593Smuzhiyun enum filemod_type fmod_type; 134*4882a593Smuzhiyun unsigned int dst_flags; 135*4882a593Smuzhiyun uint32_t src_device_id; 136*4882a593Smuzhiyun uint32_t dst_device_id; 137*4882a593Smuzhiyun ino_t src_inode; 138*4882a593Smuzhiyun ino_t dst_inode; 139*4882a593Smuzhiyun uint16_t src_filepath_length; 140*4882a593Smuzhiyun uint16_t dst_filepath_length; 141*4882a593Smuzhiyun char payload[MAX_FILEMOD_PAYLOAD_LEN]; 142*4882a593Smuzhiyun }; 143*4882a593Smuzhiyun 144*4882a593Smuzhiyun struct profiler_config_struct { 145*4882a593Smuzhiyun bool fetch_cgroups_from_bpf; 146*4882a593Smuzhiyun ino_t cgroup_fs_inode; 147*4882a593Smuzhiyun ino_t cgroup_login_session_inode; 148*4882a593Smuzhiyun uint64_t kill_signals_mask; 149*4882a593Smuzhiyun ino_t inode_filter; 150*4882a593Smuzhiyun uint32_t stale_info_secs; 151*4882a593Smuzhiyun bool use_variable_buffers; 152*4882a593Smuzhiyun bool read_environ_from_exec; 153*4882a593Smuzhiyun bool enable_cgroup_v1_resolver; 154*4882a593Smuzhiyun }; 155*4882a593Smuzhiyun 156*4882a593Smuzhiyun struct bpf_func_stats_data { 157*4882a593Smuzhiyun uint64_t time_elapsed_ns; 158*4882a593Smuzhiyun uint64_t num_executions; 159*4882a593Smuzhiyun uint64_t num_perf_events; 160*4882a593Smuzhiyun }; 161*4882a593Smuzhiyun 162*4882a593Smuzhiyun struct bpf_func_stats_ctx { 163*4882a593Smuzhiyun uint64_t start_time_ns; 164*4882a593Smuzhiyun struct bpf_func_stats_data* bpf_func_stats_data_val; 165*4882a593Smuzhiyun }; 166*4882a593Smuzhiyun 167*4882a593Smuzhiyun enum bpf_function_id { 168*4882a593Smuzhiyun profiler_bpf_proc_sys_write, 169*4882a593Smuzhiyun profiler_bpf_sched_process_exec, 170*4882a593Smuzhiyun profiler_bpf_sched_process_exit, 171*4882a593Smuzhiyun profiler_bpf_sys_enter_kill, 172*4882a593Smuzhiyun profiler_bpf_do_filp_open_ret, 173*4882a593Smuzhiyun profiler_bpf_sched_process_fork, 174*4882a593Smuzhiyun profiler_bpf_vfs_link, 175*4882a593Smuzhiyun profiler_bpf_vfs_symlink, 176*4882a593Smuzhiyun profiler_bpf_max_function_id 177*4882a593Smuzhiyun }; 178