refactor(memtrack): split monolithic eBPF C and Rust into domain files

[not-matthias]

Summary

Splits the monolithic eBPF source (memtrack.bpf.c, 392 lines) and its Rust attach code (memtrack.rs, 478 lines) into small, single-responsibility files. Pure reorganization — no behavior change.

C side

src/ebpf/c/
├── event.h                # unchanged (bindgen contract)
├── main.bpf.c             # includes + LICENSE only — no programs, no maps
├── allocator.h            # UPROBE_* macros + all uprobes + mmap/munmap/brk tracepoints
└── utils/
    ├── map_helpers.h      # BPF_HASH_MAP / BPF_ARRAY_MAP / BPF_RINGBUF macros
    ├── tracking.h         # tracked_pids, pids_ppid, tracking_enabled + is_tracked/is_enabled/track_child + sched_fork
    └── event_helpers.h    # events ringbuf, dropped_events + SUBMIT_EVENT + submit_*_event + store_param/take_param

Encapsulation improvements

• track_child() helper — sched_fork body now reads as intent only, raw bpf_map_update_elem calls hidden
• store_mmap_args() helper — mmap enter handler no longer pokes maps directly
• brk enter now uses store_param() instead of raw bpf_map_update_elem

Rust side

src/ebpf/memtrack/
├── mod.rs         # skel include!, MemtrackBpf struct, new(), Drop, start_polling_with_channel
├── macros.rs      # attach_uprobe_uretprobe! / attach_uprobe! / attach_tracepoint! + ensure_symbol_exists
├── maps.rs        # add_tracked_pid, enable/disable_tracking, dropped_events_count
├── allocator.rs   # all attach_* probe methods + attach_allocator_probes + per-allocator methods
└── tracking.rs    # attach_sched_fork / attach_tracepoints

#[macro_use] mod macros; ensures declarative macros are visible to sibling modules. Each submodule imports use super::MemtrackBpf; for its impl block.

Notes

• File named main.bpf.c (not main.c) because libbpf_cargo::SkeletonBuilder requires the .bpf.c suffix
• Skeleton struct names change from MemtrackSkel/MemtrackSkelBuilder to MainSkel/MainSkelBuilder (derived from filename). Output file memtrack.skel.rs and include! path unchanged.
• Four load-bearing map names (tracked_pids, tracking_enabled, events, dropped_events) preserved — Rust side reads them by name from the skeleton.

Verification

• cargo check --features ebpf — skeleton generates + compiles ✓
• cargo build --features ebpf ✓
• cargo test — 2 passed, 20 ignored (sudo/GITHUB_ACTIONS gate) ✓

[codspeed-hq]

Merging this PR will not alter performance

⚠️ Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

✅ 17 untouched benchmarks

---

_{Comparing cod-3142-improve-ebpf-multi-file-organization (c17b77f) with main (5c27231)}

[greptile-apps]

Greptile Summary

Pure structural reorganization of the eBPF memory tracker: the 392-line monolithic memtrack.bpf.c and 478-line memtrack.rs are split into small single-responsibility files with no behavioral change. All four load-bearing map names, BPF program logic, and Rust attach semantics are preserved verbatim.

• C side: main.bpf.c now serves only as an entry-point (includes + LICENSE); allocator uprobes/tracepoints move to allocator.h; map macros, process-tracking logic, and event-submission helpers each get their own utils/*.h header with include guards.
• Rust side: memtrack/mod.rs holds the skeleton include, struct definition, new(), Drop, and polling; macros.rs defines the three attach_*! declarative macros exposed via #[macro_use]; maps.rs, allocator.rs, and tracking.rs each add an impl MemtrackBpf block — the MainSkel/MainSkelBuilder rename is the only externally-visible change and follows naturally from the .bpf.c file rename.

Confidence Score: 5/5

Safe to merge — all changes are file-level reorganization with no logic alterations; BPF map names, program logic, and Rust attach semantics are preserved exactly.

Every BPF program, map definition, and Rust attach method is a verbatim extraction from the monolith. Include guards prevent duplicate map definitions across the new header chain. The skeleton rename (MainSkel) follows mechanically from the .bpf.c file rename.

No files require special attention beyond the cosmetic redundant-includes note in main.bpf.c.

Important Files Changed

Filename	Overview
crates/memtrack/src/ebpf/c/main.bpf.c	New 14-line entry point (includes + LICENSE). Contains redundant explicit includes of all utils headers that are already transitively pulled in via allocator.h.
crates/memtrack/src/ebpf/c/allocator.h	All three UPROBE_* macros plus mmap/munmap/brk tracepoints faithfully extracted from the old monolith; store_mmap_args helper correctly mirrors the old inline is_tracked guard.
crates/memtrack/src/ebpf/c/utils/event_helpers.h	Events ring buffer, dropped_events counter, SUBMIT_EVENT macro, store_param/take_param, and all submit_* helpers extracted identically from the old monolith.
crates/memtrack/src/ebpf/c/utils/process_tracking.h	tracked_pids / pids_ppid / tracking_enabled maps, is_tracked, is_enabled, new track_child helper, and sched_fork tracepoint all extracted cleanly.
crates/memtrack/src/ebpf/memtrack/mod.rs	Skeleton include, ResolvedSymbols, MemtrackBpf struct, new/drop/detach_probes, start_polling_with_channel, and the unit test all preserved; MainSkel rename is expected.
crates/memtrack/src/ebpf/memtrack/macros.rs	Three declarative macros extracted verbatim; #[macro_use] on the module in mod.rs correctly makes them visible to sibling impl blocks.
crates/memtrack/src/ebpf/memtrack/allocator.rs	All attach_* probe methods and per-allocator helpers faithfully moved from the monolith; uses super::MemtrackBpf for its impl block.
crates/memtrack/build.rs	Single-line source path change from memtrack.bpf.c to main.bpf.c; output path memtrack.skel.rs and all clang_args unchanged.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[main.bpf.c] --> B[allocator.h]
    A --> C[event.h]
    A --> D[utils/event_helpers.h]
    A --> E[utils/map_helpers.h]
    A --> F[utils/process_tracking.h]

    B --> D
    B --> E
    B --> F

    D --> C
    D --> E
    D --> F

    F --> E

    style C fill:#f9f,stroke:#999
    style D fill:#f9f,stroke:#999
    style E fill:#f9f,stroke:#999
    style F fill:#f9f,stroke:#999

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[main.bpf.c] --> B[allocator.h]
    A --> C[event.h]
    A --> D[utils/event_helpers.h]
    A --> E[utils/map_helpers.h]
    A --> F[utils/process_tracking.h]

    B --> D
    B --> E
    B --> F

    D --> C
    D --> E
    D --> F

    F --> E

    style C fill:#f9f,stroke:#999
    style D fill:#f9f,stroke:#999
    style E fill:#f9f,stroke:#999
    style F fill:#f9f,stroke:#999

Loading

_{Reviews (3): Last reviewed commit: "docs(memtrack): add crate AGENTS.md guid..." | Re-trigger Greptile}

[GuillaumeLagrange]

ogltm