3 "/ˆl–Ðz¾””ÔD¨ ÅÍÀ³q–”Å£Ç ƒh¹ÀÅ/0 1ˆ¿Ç ƒh¹ÀÅ10 3ˆÈÇ ƒ / ÄÀÅf3/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ #ifndef _UAPI__LINUX_BPF_COMMON_H__ #define _UAPI__LINUX_BPF_COMMON_H__ /* Instruction classes */ #define BPF_CLASS(code) ((code) & 0x07) #define BPF_LD 0x00 #define BPF_LDX 0x01 #define BPF_ST 0x02 #define BPF_STX 0x03 #define BPF_ALU 0x04 #define BPF_JMP 0x05 #define BPF_RET 0x06 #define BPF_MISC 0x07 /* ld/ldx fields */ #define BPF_SIZE(code) ((code) & 0x18) #define BPF_W 0x00 /* 32-bit */ #define BPF_H 0x08 /* 16-bit */ #define BPF_B 0x10 /* 8-bit */ /* eBPF BPF_DW 0x18 64-bit */ #define BPF_MODE(code) ((code) & 0xe0) #define BPF_IMM 0x00 #define BPF_ABS 0x20 #define BPF_IND 0x40 #define BPF_MEM 0x60 #define BPF_LEN 0x80 #define BPF_MSH 0xa0 /* alu/jmp fields */ #define BPF_OP(code) ((code) & 0xf0) #define BPF_ADD 0x00 #define BPF_SUB 0x10 #define BPF_MUL 0x20 #define BPF_DIV 0x30 #define BPF_OR 0x40 #define BPF_AND 0x50 #define BPF_LSH 0x60 #define BPF_RSH 0x70 #define BPF_NEG 0x80 #define BPF_MOD 0x90 #define BPF_XOR 0xa0 #define BPF_JA 0x00 #define BPF_JEQ 0x10 #define BPF_JGT 0x20 #define BPF_JGE 0x30 #define BPF_JSET 0x40 #define BPF_SRC(code) ((code) & 0x08) #define BPF_K 0x00 #define BPF_X 0x08 #ifndef BPF_MAXINSNS #define BPF_MAXINSNS 4096 #endif #endif /* _UAPI__LINUX_BPF_COMMON_H__ */ 5ˆÈÇ ƒh.ÄÀÅ@5/* SPDX-License-Identifier: LGPL-2.1 WITH Linux-syscall-note */ /* * cn_proc.h - process events connector * * Copyright (C) Matt Helsley, IBM Corp. 2005 * Based on cn_fork.h by Nguyen Anh Quynh and Guillaume Thouvenin * Copyright (C) 2005 Nguyen Anh Quynh * Copyright (C) 2005 Guillaume Thouvenin * * This program is free software; you can redistribute it and/or modify it * under the terms of version 2.1 of the GNU Lesser General Public License * as published by the Free Software Foundation. * * This program is distributed in the hope that it would be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. */ #ifndef _UAPICN_PROC_H #define _UAPICN_PROC_H #include /* * Userspace sends this enum to register with the kernel that it is listening * for events on the connector. */ enum proc_cn_mcast_op { PROC_CN_MCAST_LISTEN = 1, PROC_CN_MCAST_IGNORE = 2 }; #define PROC_EVENT_ALL (PROC_EVENT_FORK | PROC_EVENT_EXEC | PROC_EVENT_UID | \ PROC_EVENT_GID | PROC_EVENT_SID | PROC_EVENT_PTRACE | \ PROC_EVENT_COMM | PROC_EVENT_NONZERO_EXIT | \ PROC_EVENT_COREDUMP | PROC_EVENT_EXIT) /* * If you add an entry in proc_cn_event, make sure you add it in * PROC_EVENT_ALL above as well. */ enum proc_cn_event { /* Use successive bits so the enums can be used to record * sets of events as well */ PROC_EVENT_NONE = 0x00000000, PROC_EVENT_FORK = 0x00000001, PROC_EVENT_EXEC = 0x00000002, PROC_EVENT_UID = 0x00000004, PROC_EVENT_GID = 0x00000040, PROC_EVENT_SID = 0x00000080, PROC_EVENT_PTRACE = 0x00000100, PROC_EVENT_COMM = 0x00000200, /* "next" should be 0x00000400 */ /* "last" is the last process event: exit, * while "next to last" is coredumping event * before that is report only if process dies * with non-zero exit status */ PROC_EVENT_NONZERO_EXIT = 0x20000000, PROC_EVENT_COREDUMP = 0x40000000, PROC_EVENT_EXIT = 0x80000000 }; struct proc_input { enum proc_cn_mcast_op mcast_op; enum proc_cn_event event_type; }; static inline enum proc_cn_event valid_event(enum proc_cn_event ev_type) { ev_type &= PROC_EVENT_ALL; return ev_type; } /* * From the user's point of view, the process * ID is the thread group ID and thread ID is the internal * kernel "pid". So, fields are assigned as follow: * * In user space - In kernel space * * parent process ID = parent->tgid * parent thread ID = parent->pid * child process ID =