mirror of
https://github.com/eunomia-bpf/bpf-developer-tutorial.git
synced 2026-10-30 04:06:26 +08:00
90e93e05f6
* Rebase lesson 54 as a standalone monitor * docs: preserve lesson 54 introduction * docs: remove design aside from lesson 54 * Simplify lesson 54 to the monitor path --------- Co-authored-by: LinuxDev9002 <i@littlefisher.me>
106 lines
2.3 KiB
Plaintext
106 lines
2.3 KiB
Plaintext
digraph exec_image_flow {
|
|
graph [
|
|
rankdir=TB,
|
|
bgcolor="white",
|
|
pad="0.25",
|
|
nodesep="0.34",
|
|
ranksep="0.46",
|
|
splines=spline,
|
|
size="10,7.5",
|
|
ratio=compress,
|
|
newrank=true,
|
|
fontname="DejaVu Sans"
|
|
];
|
|
node [
|
|
shape=box,
|
|
style="rounded,filled",
|
|
fillcolor="#F7FAFC",
|
|
color="#4A5568",
|
|
fontcolor="#1A202C",
|
|
fontname="DejaVu Sans",
|
|
fontsize=12,
|
|
margin="0.16,0.10"
|
|
];
|
|
edge [
|
|
color="#4A5568",
|
|
fontcolor="#2D3748",
|
|
fontname="DejaVu Sans",
|
|
fontsize=10,
|
|
arrowsize=0.75
|
|
];
|
|
|
|
start [
|
|
label="User space\nstart system-wide monitor",
|
|
fillcolor="#EBF8FF",
|
|
color="#3182CE"
|
|
];
|
|
prepare [
|
|
label="load LSM + ring buffer",
|
|
fillcolor="#EBF8FF",
|
|
color="#3182CE"
|
|
];
|
|
exec [
|
|
label="any process calls exec",
|
|
fillcolor="#EBF8FF",
|
|
color="#3182CE"
|
|
];
|
|
hook [
|
|
label="bprm_committed_creds\nobserve every committed exec",
|
|
fillcolor="#FFFAF0",
|
|
color="#DD6B20"
|
|
];
|
|
pending [
|
|
label="pending[pid_tgid]\nscheduled_ns + task work",
|
|
shape=cylinder,
|
|
fillcolor="#FFF5F5",
|
|
color="#C05621"
|
|
];
|
|
schedule [
|
|
label="bpf_task_work_schedule_signal\ninspect_executable",
|
|
fillcolor="#FAF5FF",
|
|
color="#805AD5"
|
|
];
|
|
callback [
|
|
label="sleepable task-work callback\nrecord callback latency",
|
|
fillcolor="#FAF5FF",
|
|
color="#805AD5"
|
|
];
|
|
file [
|
|
label="bpf_get_task_exe_file\nresolve path",
|
|
fillcolor="#FAF5FF",
|
|
color="#805AD5"
|
|
];
|
|
read [
|
|
label="file-backed dynptr\nread ELF header\ndiscard dynptr + put file",
|
|
fillcolor="#FAF5FF",
|
|
color="#805AD5"
|
|
];
|
|
event [
|
|
label="ring buffer event\npath + ELF + latency\ndelete pending entry",
|
|
fillcolor="#F0FFF4",
|
|
color="#38A169"
|
|
];
|
|
collect [
|
|
label="User space\nstream events until SIGINT/SIGTERM\nfinal drain + stats",
|
|
fillcolor="#EBF8FF",
|
|
color="#3182CE"
|
|
];
|
|
|
|
{ rank=same; start; prepare; exec; }
|
|
{ rank=same; hook; pending; schedule; }
|
|
{ rank=same; callback; file; read; }
|
|
{ rank=same; event; collect; }
|
|
|
|
start -> prepare;
|
|
prepare -> exec [label="READY"];
|
|
exec -> hook [label="each committed exec"];
|
|
hook -> pending;
|
|
pending -> schedule;
|
|
schedule -> callback [label="task work runs"];
|
|
callback -> file;
|
|
file -> read;
|
|
read -> event;
|
|
event -> collect;
|
|
collect -> exec [label="keep monitoring", style=dashed];
|
|
}
|