ELF � �t @ @ � � w c
�� � {
�� �� ������ ���� � � y U) � � � � � � " � # a��� c � � �� ����� � � q � � y��� �� ����� � q a��� c �q � � aa W �� �q � �c � - �q � � � � � � � w c�� g w ]J �� ���� � � � � ya � y U9 �� ���� � y y -q. � ( � � � � ' � # � {v a��� c � � �� �� ����� � q � � y��� �� ����� � q a��� c � 0 �� ����� �� � q a��� w W � c �a � � �a � � � � � Dual BSD/GPL �� �9 �9 /( . 2
8 @ K P @ \ � `
� f K P @ q K P @ y � � � @ � ` � � � ! � � K � � � � � #
( , " � �� ' % 3 ' � 9 ) � ? * � E @ L ` S . � ^ b n & @ � 2 � � � � � � � � @ � ` � � � 3 � � 5 � C � E � � F � � � �
� Q & S @ 0 V � ; 9 � A W P 7 @ b X e X @ o Y � x j � � `! � �! � �! � �! � & " � @" � `" � a" � b" c" �" �" ( �" 8 �" L �" S & �" ` l # � �$ n �$ s & �$ � 2 % � 2 @% � 9 �% � 9 & � 2 �& � 9 �& � 9 @' � | �' � � ( � 9 * � 9 �* � � + � � @+
� �+ �+ # , ) @, / � �, < & @- B & �- I �- T . c & @. k & �. s � �. � � @1 � � �1 � � �1 � � 2 � � @2 � � �2 � � 3 � � @3 � � �3 � � 4 � � @4 � � �4 � � �4 � � 5 � � @5 � �5 � �5 & �6 ( � �6 4 7 A � @7 L � �7 Z � �7 c �7 m � 8 u �8 � �8 � � 9 � � 9 � � @9 � � �9 � 2 : � � @: � ) �: � � �: � � ; � � @; � � �;
� �; � < % & @< 4 � �< A � �< F �> T �> a ? n � @? { � �? � �? � �? � � @ � 9 @@ � � �@ � � A � 9 @A � � �A � B C & � @C 6 � �C G 9 �D W g @E a � �E i � �E x � �E } F � & @F � � �F � G � � �G � � �G � � @H � �H � �H � & �H � I � @I
& �I
& �I %
� J +
@J >
2 �J N
� �J \
* K k
) @K t
�K }
�K �
�K �
�K >�
� L �
� N ' � & �
@ �
@ ( �
@ �
+ �
�
, �
- �
/ 1 @ & 0 / + 3 , $ 4
u ; � H 6 M 7 � V 9 @ � � f a @ r � { � � � ; @ �
� ? @
� @ �
� @ �
� & � A � � & � @ � � & 8 @ 8 � 7 & : # : @ 9 ( � 9 D @ M � X � a n @ y � � � � < � @ � � � � � � @ � � � �
/
@ D
� O
� _
r
@ �
� �
� �
�
@ �
� �
= �
> �
@ 5 P �
@ @ � * � 3 � B & K & @ X & � a B � a j s x 0 � 9 � & � � & � � � � 0 � D @ C { � �� � 7 � � � � @ � � � � <
@ � � � � + � 6 � H � S G � \ G � k @ s H x I � J @ � N � 3 O � � O � � O � � O � � s 7 � I � � < K
L M � � � G [ � P � R
S T U & 0 & "
@ ,
� 9
� E ( � P 9 @ Z 9 � b o ( d k i @ [ p � & � & @ � Z � � Z � � 7 � & � � X � \ @ � & � � _ � � 9 � � ` @ � a � � & � � c ) @ d � + g � 5 h H ] Q Q ^ X & d 7 g & � I b
~ W w e � f �
< a 5 Z � � � k ` 0 � m p @ n
( o l ( � q � s � z ( � r � @ � ` � � � � � r � t K v w @ � � � u � % / x 4 y H e @ { E @ J ` V & � ] & � p l e & ~ p @ } ~ } R / # @ v � � { � � � � � � � � � , � � � O O � � � � � � � s P � � � @ � ` � @ $ 4 � < 4 � K 8 @ 4 � 8 � �
S _ c W ` � w j s 9 Y X d y x } � � U � � 9 � � � � � � � � & � J � � � � � � � m � � � @ v � � � � � & � � t L M q K ] O � ^ # 8 6 < @ B � H � N Y @ e � { � U � � � � T r Q Z � � d � � @ � � ` � 9 � � � , � � � � v � @ � � � � 9 � � � � " 9 - 9 � ; 9 K � U � _ � i � q y � @ � * ` � 2 � � � � � � @ � � � � � � ) @ � � � o �
� @ � & � � @ �
� � s 5 � : � @ I � H R T l � q w * � � n � � � � @ � ` f z } � � � � � & � � � � � 0 � & @ � & � � � � & � � & � & @ & � & � & @ * � 5 � H L
� X � _ � e � K � ( k � , m � - q � / s � 0 z � 4 ~ � 5 � � 6 � � 7 � � 8 � � � D � � 9 � 9 � � 9 V 7 � � @ � 9 � � } � 9 � � � @ � � � � � � ) 3 � @ ` � � � ( e � 4 G @ Z � a � q � v � �
� � �
� � �
� � ( � � d @ � e � � e � � � � 9 � � � � � ^ � � 9 � 2 � � � � , � d � 9 @ & � $ 0 � @ 6 � = @ L ` Y � � � i , � u � � � � & � � � � @ � � � � � @ � � � � � ) � @ � � � k
) @ 9 � + ����A ����W ����n ����� � � � � � � � � d � 5 �x K � � @ � � � � � � @ A B C D ' E 6 F A G N H � I S J X K e L � M t N ~ O � Q � R � S � T � U � V � W � X � Y Z [ & \ 1 ] 9 ^ C _ N ` U a � � b � � � � j @ } � � � � � � � � @ � � ` � � p � � � � � " 3 ; G S [ b n { � �
� � � 2 u ) @ � & � 3 � � � � @ � � � � � � � @ � � � � ` � � � � � �
` � � @ & � & � - 1 @ � ` : � � D � @ O � c @ g ` - � @ k G m 9 u } @ ( � � � 9 � � � & � & @ � O � K O � � O � O � � � @ � � i � � � v � � 9 @ V � � � s . � / � , @ �
� � � 9 v � � * � g
� m
:
�
R � c h @ l
� u � � | @ � � K � � � @ � � � � � � @ � � � � � � � � � � @
� �
N �
k h � � � % . 7 ! C % N & Y ( � b ^ f j o y } @ � � � & � & @ � & � � & � � & � & @ � & � � & � � & � & @ � & � � & � � & � & @ � & � � & � � & � & @ � & � � & � � & N | U � \ � � & H @ 1 � & @ 3 � � ! ! ! ) ! + ! / ! p (! ,! 0! @ 4! ` 8! � <! � @! � D! � �
` M! (! � ,! � 0! � Z! � 0 " @ ^! � d! � D! % o! & � '
( � # $ y! }! @ 4! 8! <! @ @! ` @ 0 �! ' �! ' �! � (! ,! 0! @ 4! ` 8! � <! � @! � D! � �! O ` �! O h �! O p �! O x �! O � �! O � � * � �! ` �! @ �! ! �! , �! . " @ " " @ f - � O O 1 [# � � � @ � � � � � !
( 0 �# 2
�% 4
7
�% 6 :
; < �% ( �%
� @ �% ` � � � � � �% 9 ?
@ A �% � � �% � � @ �% B � �% > & = C
& & 8 & 5
& � L � � 2& ;& � D& \& � g& o& |& �& �& �& �& �&
�& \ �& W �& � � �& � �& ' '' 3' H' � X' f' � v' � }' x �' � �' �' �' �' �' �' �' ( ( %( int __ARRAY_SIZE_TYPE__ pid_t __kernel_pid_t u64 __u64 unsigned long long type max_entries key value exec_start rb_exec rb_exit trace_event_raw_sched_process_exec ent __data_loc_filename pid old_pid __data trace_entry flags preempt_count unsigned short unsigned char u32 __u32 unsigned int char ctx handle_exec tp/sched/sched_process_exec /root/eunomia-bpf/bpf-loader-rs/bpf-loader-lib/assets/multiple_export_ringbuf/multiple.bpf.c int handle_exec(struct trace_event_raw_sched_process_exec* ctx) { pid = bpf_get_current_pid_tgid() >> 32; ts = bpf_ktime_get_ns(); bpf_map_update_elem(&exec_start, &pid, &ts, BPF_ANY); if (min_duration_ns) e = bpf_ringbuf_reserve(&rb_exec, sizeof(*e), 0); if (!e) task = (struct task_struct*)bpf_get_current_task(); e->pid = pid; task_struct thread_info state stack usage ptrace on_cpu wake_entry cpu wakee_flips wakee_flip_decay_ts last_wakee recent_used_cpu wake_cpu on_rq prio static_prio normal_prio rt_priority sched_class se rt sched_task_group dl btrace_seq policy nr_cpus_allowed cpus_ptr cpus_mask sched_info tasks pushable_tasks pushable_dl_tasks mm active_mm vmacache rss_stat exit_state exit_code exit_signal pdeath_signal jobctl personality sched_reset_on_fork sched_contributes_to_load sched_migrated sched_remote_wakeup in_execve in_iowait restore_sigmask no_cgroup_migration frozen atomic_flags restart_block tgid stack_canary real_parent parent children sibling group_leader ptraced ptrace_entry thread_pid pid_links thread_group thread_node vfork_done set_child_tid clear_child_tid utime stime gtime prev_cputime nvcsw nivcsw start_time start_boottime min_flt maj_flt posix_cputimers ptracer_cred real_cred cred cached_requested_key comm nameidata sysvsem sysvshm fs files nsproxy signal sighand blocked real_blocked saved_sigmask pending sas_ss_sp sas_ss_size sas_ss_flags task_works audit_context loginuid sessionid seccomp parent_exec_id self_exec_id alloc_lock pi_lock wake_q pi_waiters pi_top_task pi_blocked_on journal_info bio_list plug reclaim_state backing_dev_info io_context capture_control ptrace_message last_siginfo ioac acct_rss_mem1 acct_vm_mem1 acct_timexpd mems_allowed mems_allowed_seq cpuset_mem_spread_rotor cpuset_slab_spread_rotor cgroups cg_list robust_list compat_robust_list pi_state_list pi_state_cache futex_exit_mutex futex_state perf_event_ctxp perf_event_mutex perf_event_list mempolicy il_prev pref_node_fork rseq rseq_sig rseq_event_mask tlb_ubc splice_pipe task_frag delays nr_dirtied nr_dirtied_pause dirty_paused_when timer_slack_ns default_timer_slack_ns trace trace_recursion utask pagefault_disabled oom_reaper_list stack_vm_area stack_refcount security mce_addr mce_ripv mce_whole_page __mce_reserved mce_kill_me thread status unsigned long long refcount_t refcount_struct refs atomic_t counter __call_single_node llist llist_node next u_flags a_flags sched_entity load run_node group_node sum_exec_runtime vruntime prev_sum_exec_runtime nr_migrations statistics depth cfs_rq my_q runnable_weight avg load_weight weight inv_weight rb_node __rb_parent_color rb_right rb_left list_head prev sched_statistics wait_start wait_max wait_count wait_sum iowait_count iowait_sum sleep_start sleep_max sum_sleep_runtime block_start block_max exec_max slice_max nr_migrations_cold nr_failed_migrations_affine nr_failed_migrations_running nr_failed_migrations_hot nr_forced_migrations nr_wakeups nr_wakeups_sync nr_wakeups_migrate nr_wakeups_local nr_wakeups_remote nr_wakeups_affine nr_wakeups_affine_attempts nr_wakeups_passive nr_wakeups_idle s64 __s64 long long sched_avg last_update_time load_sum runnable_sum util_sum period_contrib load_avg runnable_avg util_avg util_est enqueued ewma sched_rt_entity run_list timeout watchdog_stamp time_slice on_list back sched_dl_entity dl_runtime dl_deadline dl_period dl_bw dl_density runtime deadline dl_throttled dl_boosted dl_yielded dl_non_contending dl_overrun dl_timer inactive_timer hrtimer node _softexpires function base is_rel is_soft is_hard timerqueue_node expires ktime_t hrtimer_restart HRTIMER_NORESTART HRTIMER_RESTART u8 __u8 cpumask_t cpumask bits pcount run_delay last_arrival last_queued plist_node prio_list node_list seqnum vmas vm_area_struct vm_start vm_end vm_next vm_prev vm_rb rb_subtree_gap vm_mm vm_page_prot vm_flags shared anon_vma_chain anon_vma vm_ops vm_pgoff vm_file vm_private_data swap_readahead_info vm_policy vm_userfaultfd_ctx pgprot_t pgprot pgprotval_t rb rb_subtree_last atomic_long_t atomic64_t task_rss_stat events count fn futex nanosleep poll uaddr val bitset time uaddr2 clockid clockid_t __kernel_clockid_t timespec_type TT_NONE TT_NATIVE TT_COMPAT rmtp compat_rmtp ufds nfds has_timeout tv_sec tv_nsec hlist_node pprev lock raw_spinlock_t raw_spinlock raw_lock arch_spinlock_t qspinlock locked locked_pending tail u16 __u16 bases timers_active expiry_active posix_cputimer_base nextevt tqhead timerqueue_head rb_root rb_root_cached rb_leftmost sysv_sem undo_list sysv_shm shm_clist sigset_t sig sigpending list size_t __kernel_size_t __kernel_ulong_t kuid_t uid_t __kernel_uid32_t mode filter spinlock_t spinlock rlock wake_q_node kernel_siginfo_t task_io_accounting rchar wchar syscr syscw read_bytes write_bytes cancelled_write_bytes nodemask_t seqcount_t seqcount sequence mutex owner wait_lock osq wait_list optimistic_spin_queue perf_event_context pmu active_ctx_list pinned_groups flexible_groups event_list pinned_active flexible_active nr_events nr_active is_active nr_stat nr_freq rotate_disable rotate_necessary refcount task timestamp parent_ctx parent_gen generation pin_count task_ctx_data callback_head perf_event_groups tree index func short tlbflush_unmap_batch arch flush_required writable arch_tlbflush_unmap_batch bool _Bool rcu_users rcu page_frag page offset size thread_struct tls_array sp es ds fsindex gsindex fsbase gsbase ptrace_bps debugreg6 ptrace_dr7 cr2 trap_nr error_code io_bitmap iopl_emul addr_limit sig_on_uaccess_err fpu desc_struct limit0 base0 base1 s dpl p limit1 avl l d g base2 perf_event event_entry sibling_list active_list group_index migrate_entry hlist_entry active_entry nr_siblings event_caps group_caps pmu_private attach_state child_count total_time_enabled total_time_running tstamp shadow_ctx_time attr header_size id_header_size read_size hw child_total_time_enabled child_total_time_running child_mutex child_list oncpu owner_entry mmap_mutex mmap_count rb_entry rcu_batches rcu_pending waitq fasync pending_wakeup pending_kill pending_disable event_limit addr_filters addr_filter_ranges addr_filters_gen aux_event destroy ns id clock overflow_handler overflow_handler_context orig_overflow_handler prog tp_event sb_list perf_event_state PERF_EVENT_STATE_DEAD PERF_EVENT_STATE_EXIT PERF_EVENT_STATE_ERROR PERF_EVENT_STATE_OFF PERF_EVENT_STATE_INACTIVE PERF_EVENT_STATE_ACTIVE local64_t a local_t perf_event_attr config sample_type read_format disabled inherit pinned exclusive exclude_user exclude_kernel exclude_hv exclude_idle mmap freq inherit_stat enable_on_exec watermark precise_ip mmap_data sample_id_all exclude_host exclude_guest exclude_callchain_kernel exclude_callchain_user mmap2 comm_exec use_clockid context_switch write_backward namespaces ksymbol bpf_event aux_output cgroup __reserved_1 bp_type branch_sample_type sample_regs_user sample_stack_user sample_regs_intr aux_watermark sample_max_stack __reserved_2 aux_sample_size __reserved_3 sample_period sample_freq wakeup_events wakeup_watermark bp_addr kprobe_func uprobe_path config1 bp_len kprobe_addr probe_offset config2 __s32 hw_perf_event target prev_count last_period period_left interrupts_seq interrupts freq_time_stamp freq_count_stamp last_tag config_base event_base event_base_rdpmc idx last_cpu extra_reg branch_reg hw_perf_event_extra reg alloc tp_list pwr_acc ptsc info bp_list arch_hw_breakpoint address mask len iommu_bank iommu_cntr padding conf conf1 wait_queue_head_t wait_queue_head head irq_work llnode perf_addr_filters_head nr_file_filters perf_overflow_handler_t perf_sample_data addr raw br_stack period txn data_src ip tid_entry stream_id cpu_entry callchain aux_size regs_user regs_user_copy regs_intr stack_user_size phys_addr perf_mem_data_src mem_op mem_lvl mem_snoop mem_lock mem_dtlb mem_lvl_num mem_remote mem_snoopx mem_rsvd tid reserved perf_regs abi regs pt_regs r15 r14 r13 r12 bp bx r11 r10 r9 r8 ax cx dx si di orig_ax cs ss mm_segment_t seg avx512_timestamp fpregs_state fsave fxsave soft xsave __padding fregs_state cwd swd twd fip fcs foo fos st_space fxregs_state fop mxcsr mxcsr_mask xmm_space rip rdp padding1 sw_reserved swregs_state ftop changed lookahead no_update rm alimit entry_eip xregs_state i387 header extended_state_area xstate_header xfeatures xcomp_bv 0:57 e->ppid = BPF_CORE_READ(task, real_parent, tgid); 0:55 bpf_get_current_comm(&e->comm, sizeof(e->comm)); 0:1 fname_off = ctx->__data_loc_filename & 0xFFFF; (void*)ctx + fname_off); bpf_probe_read_str(&e->filename, sizeof(e->filename), bpf_ringbuf_submit(e, 0); } trace_event_raw_sched_process_template handle_exit tp/sched/sched_process_exit id = bpf_get_current_pid_tgid(); pid = id >> 32; tid = (u32)id; if (pid != tid) start_ts = bpf_map_lookup_elem(&exec_start, &pid); if (start_ts) duration_ns = bpf_ktime_get_ns() - *start_ts; else if (min_duration_ns) bpf_map_delete_elem(&exec_start, &pid); if (min_duration_ns && duration_ns < min_duration_ns) e = bpf_ringbuf_reserve(&rb_exit, sizeof(*e), 0); e->duration_ns = duration_ns; 0:38 e->exit_code = (BPF_CORE_READ(task, exit_code) >> 8) & 0xff; LICENSE min_duration_ns event_exit duration_ns ppid __dummy1 event_exec filename __dummy2 .bss .maps .rodata license __kernel_timespec blk_plug bpf_prog compat_robust_list_head completion css_set event_filter fasync_struct file files_struct fs_struct futex_pi_state hrtimer_clock_base kernel_siginfo math_emu_info mm_struct old_timespec32 perf_addr_filter_range perf_branch_stack perf_buffer perf_callchain_entry perf_raw_record pid_namespace pipe_inode_info pollfd robust_list_head rt_mutex_waiter seccomp_filter sem_undo_list sighand_struct signal_struct task_delay_info task_group trace_event_call uprobe_task vm_operations_struct vm_struct �� $ $ t � t 8 # �# 3 8 T � � T � � T � &� T � � T
� ( T � 8 T P T < � p T v � � T v � � T � � � T � � � T � !� � T � � T � � T T *" � 8 T @ T *" � P T *" � X T *"
� ` T e" � p T e" � � T �" � � T �" # � T # � � T # � � T ;# � T Y# �# ) T �#
< T �# @ T �# @ T �# D 0 T �# P @ T H T
$ ` h T A$ d p T S$ h � T S$ ,h � T S$ *h � T �$ l � T �$ l � T � T �$ t � T �$ � T �$ � T �$ *� T �$ � T
% � H T � � P T � !� ` T C% � h T � p T � � T � T *" � � T � T *" � � T *" � � T *"
� T T j% � 0 T j% � 8 T j% 4� @ T j% :� H T j% � P T e" � ` T e" � p T ;# � � T Y# � 8 � $ %" $ `" � �" �# x $ %" � $ `" � $ e% � � � � � � � � � � � ^ � ? � K 0 �
P p
� H �
� �
�6 �6 �6 �6 7
7
07 , < P ` p � � � � � � � � 0 @ P ` p � � � � � � � � ( 8 H X h x � � � � � � � � ( 8 H X h x � � � � � � � � ( 8 H X h x � � � � � � � .text .rel.BTF.ext exec_start .reltp/sched/sched_process_exit handle_exit rb_exit .bss .maps min_duration_ns .llvm_addrsig license .reltp/sched/sched_process_exec handle_exec rb_exec .strtab .symtab .rodata .rel.BTF LICENSE LBB1_8 LBB1_6 LBB1_4 LBB1_3 LBB0_3 __dummy2 __dummy1 � �s @ � @ � � @ �m 0 # ( � @ n P | �
� � X � @ S � b � @ hn p g , @ �n �
n L�o � �s � Pl �