bpf/progs/profiler.h

0001 // SPDX-License-Identifier: GPL-2.0
0002 /* Copyright (c) 2020 Facebook */
0003 #pragma once
0004
0005 #define TASK_COMM_LEN 16
0006 #define MAX_ANCESTORS 4
0007 #define MAX_PATH 256
0008 #define KILL_TARGET_LEN 64
0009 #define CTL_MAXNAME 10
0010 #define MAX_ARGS_LEN 4096
0011 #define MAX_FILENAME_LEN 512
0012 #define MAX_ENVIRON_LEN 8192
0013 #define MAX_PATH_DEPTH 32
0014 #define MAX_FILEPATH_LENGTH (MAX_PATH_DEPTH * MAX_PATH)
0015 #define MAX_CGROUPS_PATH_DEPTH 8
0016
0017 #define MAX_METADATA_PAYLOAD_LEN TASK_COMM_LEN
0018
0019 #define MAX_CGROUP_PAYLOAD_LEN \
0020     (MAX_PATH * 2 + (MAX_PATH * MAX_CGROUPS_PATH_DEPTH))
0021
0022 #define MAX_CAP_PAYLOAD_LEN (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN)
0023
0024 #define MAX_SYSCTL_PAYLOAD_LEN \
0025     (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + CTL_MAXNAME + MAX_PATH)
0026
0027 #define MAX_KILL_PAYLOAD_LEN \
0028     (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + TASK_COMM_LEN + \
0029      KILL_TARGET_LEN)
0030
0031 #define MAX_EXEC_PAYLOAD_LEN \
0032     (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + MAX_FILENAME_LEN + \
0033      MAX_ARGS_LEN + MAX_ENVIRON_LEN)
0034
0035 #define MAX_FILEMOD_PAYLOAD_LEN \
0036     (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + MAX_FILEPATH_LENGTH + \
0037      MAX_FILEPATH_LENGTH)
0038
0039 enum data_type {
0040     INVALID_EVENT,
0041     EXEC_EVENT,
0042     FORK_EVENT,
0043     KILL_EVENT,
0044     SYSCTL_EVENT,
0045     FILEMOD_EVENT,
0046     MAX_DATA_TYPE_EVENT
0047 };
0048
0049 enum filemod_type {
0050     FMOD_OPEN,
0051     FMOD_LINK,
0052     FMOD_SYMLINK,
0053 };
0054
0055 struct ancestors_data_t {
0056     pid_t ancestor_pids[MAX_ANCESTORS];
0057     uint32_t ancestor_exec_ids[MAX_ANCESTORS];
0058     uint64_t ancestor_start_times[MAX_ANCESTORS];
0059     uint32_t num_ancestors;
0060 };
0061
0062 struct var_metadata_t {
0063     enum data_type type;
0064     pid_t pid;
0065     uint32_t exec_id;
0066     uid_t uid;
0067     gid_t gid;
0068     uint64_t start_time;
0069     uint32_t cpu_id;
0070     uint64_t bpf_stats_num_perf_events;
0071     uint64_t bpf_stats_start_ktime_ns;
0072     uint8_t comm_length;
0073 };
0074
0075 struct cgroup_data_t {
0076     ino_t cgroup_root_inode;
0077     ino_t cgroup_proc_inode;
0078     uint64_t cgroup_root_mtime;
0079     uint64_t cgroup_proc_mtime;
0080     uint16_t cgroup_root_length;
0081     uint16_t cgroup_proc_length;
0082     uint16_t cgroup_full_length;
0083     int cgroup_full_path_root_pos;
0084 };
0085
0086 struct var_sysctl_data_t {
0087     struct var_metadata_t meta;
0088     struct cgroup_data_t cgroup_data;
0089     struct ancestors_data_t ancestors_info;
0090     uint8_t sysctl_val_length;
0091     uint16_t sysctl_path_length;
0092     char payload[MAX_SYSCTL_PAYLOAD_LEN];
0093 };
0094
0095 struct var_kill_data_t {
0096     struct var_metadata_t meta;
0097     struct cgroup_data_t cgroup_data;
0098     struct ancestors_data_t ancestors_info;
0099     pid_t kill_target_pid;
0100     int kill_sig;
0101     uint32_t kill_count;
0102     uint64_t last_kill_time;
0103     uint8_t kill_target_name_length;
0104     uint8_t kill_target_cgroup_proc_length;
0105     char payload[MAX_KILL_PAYLOAD_LEN];
0106     size_t payload_length;
0107 };
0108
0109 struct var_exec_data_t {
0110     struct var_metadata_t meta;
0111     struct cgroup_data_t cgroup_data;
0112     pid_t parent_pid;
0113     uint32_t parent_exec_id;
0114     uid_t parent_uid;
0115     uint64_t parent_start_time;
0116     uint16_t bin_path_length;
0117     uint16_t cmdline_length;
0118     uint16_t environment_length;
0119     char payload[MAX_EXEC_PAYLOAD_LEN];
0120 };
0121
0122 struct var_fork_data_t {
0123     struct var_metadata_t meta;
0124     pid_t parent_pid;
0125     uint32_t parent_exec_id;
0126     uint64_t parent_start_time;
0127     char payload[MAX_METADATA_PAYLOAD_LEN];
0128 };
0129
0130 struct var_filemod_data_t {
0131     struct var_metadata_t meta;
0132     struct cgroup_data_t cgroup_data;
0133     enum filemod_type fmod_type;
0134     unsigned int dst_flags;
0135     uint32_t src_device_id;
0136     uint32_t dst_device_id;
0137     ino_t src_inode;
0138     ino_t dst_inode;
0139     uint16_t src_filepath_length;
0140     uint16_t dst_filepath_length;
0141     char payload[MAX_FILEMOD_PAYLOAD_LEN];
0142 };
0143
0144 struct profiler_config_struct {
0145     bool fetch_cgroups_from_bpf;
0146     ino_t cgroup_fs_inode;
0147     ino_t cgroup_login_session_inode;
0148     uint64_t kill_signals_mask;
0149     ino_t inode_filter;
0150     uint32_t stale_info_secs;
0151     bool use_variable_buffers;
0152     bool read_environ_from_exec;
0153     bool enable_cgroup_v1_resolver;
0154 };
0155
0156 struct bpf_func_stats_data {
0157     uint64_t time_elapsed_ns;
0158     uint64_t num_executions;
0159     uint64_t num_perf_events;
0160 };
0161
0162 struct bpf_func_stats_ctx {
0163     uint64_t start_time_ns;
0164     struct bpf_func_stats_data* bpf_func_stats_data_val;
0165 };
0166
0167 enum bpf_function_id {
0168     profiler_bpf_proc_sys_write,
0169     profiler_bpf_sched_process_exec,
0170     profiler_bpf_sched_process_exit,
0171     profiler_bpf_sys_enter_kill,
0172     profiler_bpf_do_filp_open_ret,
0173     profiler_bpf_sched_process_fork,
0174     profiler_bpf_vfs_link,
0175     profiler_bpf_vfs_symlink,
0176     profiler_bpf_max_function_id
0177 };