profiler.h 4.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177
  1. // SPDX-License-Identifier: GPL-2.0
  2. /* Copyright (c) 2020 Facebook */
  3. #pragma once
  4. #define TASK_COMM_LEN 16
  5. #define MAX_ANCESTORS 4
  6. #define MAX_PATH 256
  7. #define KILL_TARGET_LEN 64
  8. #define CTL_MAXNAME 10
  9. #define MAX_ARGS_LEN 4096
  10. #define MAX_FILENAME_LEN 512
  11. #define MAX_ENVIRON_LEN 8192
  12. #define MAX_PATH_DEPTH 32
  13. #define MAX_FILEPATH_LENGTH (MAX_PATH_DEPTH * MAX_PATH)
  14. #define MAX_CGROUPS_PATH_DEPTH 8
  15. #define MAX_METADATA_PAYLOAD_LEN TASK_COMM_LEN
  16. #define MAX_CGROUP_PAYLOAD_LEN \
  17. (MAX_PATH * 2 + (MAX_PATH * MAX_CGROUPS_PATH_DEPTH))
  18. #define MAX_CAP_PAYLOAD_LEN (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN)
  19. #define MAX_SYSCTL_PAYLOAD_LEN \
  20. (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + CTL_MAXNAME + MAX_PATH)
  21. #define MAX_KILL_PAYLOAD_LEN \
  22. (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + TASK_COMM_LEN + \
  23. KILL_TARGET_LEN)
  24. #define MAX_EXEC_PAYLOAD_LEN \
  25. (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + MAX_FILENAME_LEN + \
  26. MAX_ARGS_LEN + MAX_ENVIRON_LEN)
  27. #define MAX_FILEMOD_PAYLOAD_LEN \
  28. (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + MAX_FILEPATH_LENGTH + \
  29. MAX_FILEPATH_LENGTH)
  30. enum data_type {
  31. INVALID_EVENT,
  32. EXEC_EVENT,
  33. FORK_EVENT,
  34. KILL_EVENT,
  35. SYSCTL_EVENT,
  36. FILEMOD_EVENT,
  37. MAX_DATA_TYPE_EVENT
  38. };
  39. enum filemod_type {
  40. FMOD_OPEN,
  41. FMOD_LINK,
  42. FMOD_SYMLINK,
  43. };
  44. struct ancestors_data_t {
  45. pid_t ancestor_pids[MAX_ANCESTORS];
  46. uint32_t ancestor_exec_ids[MAX_ANCESTORS];
  47. uint64_t ancestor_start_times[MAX_ANCESTORS];
  48. uint32_t num_ancestors;
  49. };
  50. struct var_metadata_t {
  51. enum data_type type;
  52. pid_t pid;
  53. uint32_t exec_id;
  54. uid_t uid;
  55. gid_t gid;
  56. uint64_t start_time;
  57. uint32_t cpu_id;
  58. uint64_t bpf_stats_num_perf_events;
  59. uint64_t bpf_stats_start_ktime_ns;
  60. uint8_t comm_length;
  61. };
  62. struct cgroup_data_t {
  63. ino_t cgroup_root_inode;
  64. ino_t cgroup_proc_inode;
  65. uint64_t cgroup_root_mtime;
  66. uint64_t cgroup_proc_mtime;
  67. uint16_t cgroup_root_length;
  68. uint16_t cgroup_proc_length;
  69. uint16_t cgroup_full_length;
  70. int cgroup_full_path_root_pos;
  71. };
  72. struct var_sysctl_data_t {
  73. struct var_metadata_t meta;
  74. struct cgroup_data_t cgroup_data;
  75. struct ancestors_data_t ancestors_info;
  76. uint8_t sysctl_val_length;
  77. uint16_t sysctl_path_length;
  78. char payload[MAX_SYSCTL_PAYLOAD_LEN];
  79. };
  80. struct var_kill_data_t {
  81. struct var_metadata_t meta;
  82. struct cgroup_data_t cgroup_data;
  83. struct ancestors_data_t ancestors_info;
  84. pid_t kill_target_pid;
  85. int kill_sig;
  86. uint32_t kill_count;
  87. uint64_t last_kill_time;
  88. uint8_t kill_target_name_length;
  89. uint8_t kill_target_cgroup_proc_length;
  90. char payload[MAX_KILL_PAYLOAD_LEN];
  91. size_t payload_length;
  92. };
  93. struct var_exec_data_t {
  94. struct var_metadata_t meta;
  95. struct cgroup_data_t cgroup_data;
  96. pid_t parent_pid;
  97. uint32_t parent_exec_id;
  98. uid_t parent_uid;
  99. uint64_t parent_start_time;
  100. uint16_t bin_path_length;
  101. uint16_t cmdline_length;
  102. uint16_t environment_length;
  103. char payload[MAX_EXEC_PAYLOAD_LEN];
  104. };
  105. struct var_fork_data_t {
  106. struct var_metadata_t meta;
  107. pid_t parent_pid;
  108. uint32_t parent_exec_id;
  109. uint64_t parent_start_time;
  110. char payload[MAX_METADATA_PAYLOAD_LEN];
  111. };
  112. struct var_filemod_data_t {
  113. struct var_metadata_t meta;
  114. struct cgroup_data_t cgroup_data;
  115. enum filemod_type fmod_type;
  116. unsigned int dst_flags;
  117. uint32_t src_device_id;
  118. uint32_t dst_device_id;
  119. ino_t src_inode;
  120. ino_t dst_inode;
  121. uint16_t src_filepath_length;
  122. uint16_t dst_filepath_length;
  123. char payload[MAX_FILEMOD_PAYLOAD_LEN];
  124. };
  125. struct profiler_config_struct {
  126. bool fetch_cgroups_from_bpf;
  127. ino_t cgroup_fs_inode;
  128. ino_t cgroup_login_session_inode;
  129. uint64_t kill_signals_mask;
  130. ino_t inode_filter;
  131. uint32_t stale_info_secs;
  132. bool use_variable_buffers;
  133. bool read_environ_from_exec;
  134. bool enable_cgroup_v1_resolver;
  135. };
  136. struct bpf_func_stats_data {
  137. uint64_t time_elapsed_ns;
  138. uint64_t num_executions;
  139. uint64_t num_perf_events;
  140. };
  141. struct bpf_func_stats_ctx {
  142. uint64_t start_time_ns;
  143. struct bpf_func_stats_data* bpf_func_stats_data_val;
  144. };
  145. enum bpf_function_id {
  146. profiler_bpf_proc_sys_write,
  147. profiler_bpf_sched_process_exec,
  148. profiler_bpf_sched_process_exit,
  149. profiler_bpf_sys_enter_kill,
  150. profiler_bpf_do_filp_open_ret,
  151. profiler_bpf_sched_process_fork,
  152. profiler_bpf_vfs_link,
  153. profiler_bpf_vfs_symlink,
  154. profiler_bpf_max_function_id
  155. };