Home | History | Annotate | Download | only in linux
      1 /*
      2  * cn_proc.h - process events connector
      3  *
      4  * Copyright (C) Matt Helsley, IBM Corp. 2005
      5  * Based on cn_fork.h by Nguyen Anh Quynh and Guillaume Thouvenin
      6  * Copyright (C) 2005 Nguyen Anh Quynh <aquynh (at) gmail.com>
      7  * Copyright (C) 2005 Guillaume Thouvenin <guillaume.thouvenin (at) bull.net>
      8  *
      9  * This program is free software; you can redistribute it and/or modify it
     10  * under the terms of version 2.1 of the GNU Lesser General Public License
     11  * as published by the Free Software Foundation.
     12  *
     13  * This program is distributed in the hope that it would be useful, but
     14  * WITHOUT ANY WARRANTY; without even the implied warranty of
     15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
     16  */
     17 
     18 #ifndef CN_PROC_H
     19 #define CN_PROC_H
     20 
     21 #include <linux/types.h>
     22 
     23 /*
     24  * Userspace sends this enum to register with the kernel that it is listening
     25  * for events on the connector.
     26  */
     27 enum proc_cn_mcast_op {
     28 	PROC_CN_MCAST_LISTEN = 1,
     29 	PROC_CN_MCAST_IGNORE = 2
     30 };
     31 
     32 /*
     33  * From the user's point of view, the process
     34  * ID is the thread group ID and thread ID is the internal
     35  * kernel "pid". So, fields are assigned as follow:
     36  *
     37  *  In user space     -  In  kernel space
     38  *
     39  * parent process ID  =  parent->tgid
     40  * parent thread  ID  =  parent->pid
     41  * child  process ID  =  child->tgid
     42  * child  thread  ID  =  child->pid
     43  */
     44 
     45 struct proc_event {
     46 	enum what {
     47 		/* Use successive bits so the enums can be used to record
     48 		 * sets of events as well
     49 		 */
     50 		PROC_EVENT_NONE = 0x00000000,
     51 		PROC_EVENT_FORK = 0x00000001,
     52 		PROC_EVENT_EXEC = 0x00000002,
     53 		PROC_EVENT_UID  = 0x00000004,
     54 		PROC_EVENT_GID  = 0x00000040,
     55 		/* "next" should be 0x00000400 */
     56 		/* "last" is the last process event: exit */
     57 		PROC_EVENT_EXIT = 0x80000000
     58 	} what;
     59 	__u32 cpu;
     60 	__u64 __attribute__((aligned(8))) timestamp_ns;
     61 		/* Number of nano seconds since system boot */
     62 	union { /* must be last field of proc_event struct */
     63 		struct {
     64 			__u32 err;
     65 		} ack;
     66 
     67 		struct fork_proc_event {
     68 			pid_t parent_pid;
     69 			pid_t parent_tgid;
     70 			pid_t child_pid;
     71 			pid_t child_tgid;
     72 		} fork;
     73 
     74 		struct exec_proc_event {
     75 			pid_t process_pid;
     76 			pid_t process_tgid;
     77 		} exec;
     78 
     79 		struct id_proc_event {
     80 			pid_t process_pid;
     81 			pid_t process_tgid;
     82 			union {
     83 				__u32 ruid; /* task uid */
     84 				__u32 rgid; /* task gid */
     85 			} r;
     86 			union {
     87 				__u32 euid;
     88 				__u32 egid;
     89 			} e;
     90 		} id;
     91 
     92 		struct exit_proc_event {
     93 			pid_t process_pid;
     94 			pid_t process_tgid;
     95 			__u32 exit_code, exit_signal;
     96 		} exit;
     97 	} event_data;
     98 };
     99 
    100 #endif	/* CN_PROC_H */
    101