diff --git a/driver/SCHEMA_VERSION b/driver/SCHEMA_VERSION index 6ceb272eec..3cf561c0b6 100644 --- a/driver/SCHEMA_VERSION +++ b/driver/SCHEMA_VERSION @@ -1 +1 @@ -2.11.1 +2.12.1 diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h index d9ea448581..16f256cfd5 100644 --- a/driver/bpf/fillers.h +++ b/driver/bpf/fillers.h @@ -5730,9 +5730,9 @@ FILLER(sys_ptrace_x, true) FILLER(sys_bpf_e, true) { - /* Parameter 1: cmd (type: PT_INT64) */ + /* Parameter 1: cmd (type: PT_INT32) */ s32 cmd = (s32)bpf_syscall_get_argument(data, 0); - return bpf_push_s64_to_ring(data, (s64)cmd); + return bpf_push_s32_to_ring(data, (s32)cmd); } FILLER(sys_bpf_x, true) diff --git a/driver/event_table.c b/driver/event_table.c index c5a7693af3..f67a09b3d1 100644 --- a/driver/event_table.c +++ b/driver/event_table.c @@ -417,7 +417,7 @@ const struct ppm_event_info g_event_info[] = { [PPME_SYSCALL_DUP3_X] = {"dup3", EC_IO_OTHER | EC_SYSCALL, EF_CREATES_FD | EF_USES_FD | EF_MODIFIES_STATE, 4, {{"res", PT_FD, PF_DEC}, {"oldfd", PT_FD, PF_DEC}, {"newfd", PT_FD, PF_DEC}, {"flags", PT_FLAGS32, PF_HEX, file_flags} } }, [PPME_SYSCALL_DUP_1_E] = {"dup", EC_IO_OTHER | EC_SYSCALL, EF_CREATES_FD | EF_USES_FD | EF_MODIFIES_STATE, 1, {{"fd", PT_FD, PF_DEC} } }, [PPME_SYSCALL_DUP_1_X] = {"dup", EC_IO_OTHER | EC_SYSCALL, EF_CREATES_FD | EF_USES_FD | EF_MODIFIES_STATE, 2, {{"res", PT_FD, PF_DEC}, {"oldfd", PT_FD, PF_DEC} } }, - [PPME_SYSCALL_BPF_2_E] = {"bpf", EC_OTHER | EC_SYSCALL, EF_CREATES_FD, 1, {{"cmd", PT_INT64, PF_DEC} } }, + [PPME_SYSCALL_BPF_2_E] = {"bpf", EC_OTHER | EC_SYSCALL, EF_CREATES_FD, 1, {{"cmd", PT_INT32, PF_DEC} } }, [PPME_SYSCALL_BPF_2_X] = {"bpf", EC_OTHER | EC_SYSCALL, EF_CREATES_FD, 1, { {"fd", PT_FD, PF_DEC} } }, [PPME_SYSCALL_MLOCK2_E] = {"mlock2", EC_MEMORY | EC_SYSCALL, EF_NONE, 0}, [PPME_SYSCALL_MLOCK2_X] = {"mlock2", EC_MEMORY | EC_SYSCALL, EF_NONE, 4, {{"res", PT_ERRNO, PF_DEC}, {"addr", PT_UINT64, PF_HEX}, {"len", PT_UINT64, PF_DEC}, {"flags", PT_UINT32, PF_HEX, mlock2_flags}}}, diff --git a/driver/modern_bpf/definitions/events_dimensions.h b/driver/modern_bpf/definitions/events_dimensions.h index b512d7b096..20df151f35 100644 --- a/driver/modern_bpf/definitions/events_dimensions.h +++ b/driver/modern_bpf/definitions/events_dimensions.h @@ -103,7 +103,7 @@ #define RENAMEAT2_E_SIZE HEADER_LEN #define PIPE_E_SIZE HEADER_LEN #define PIPE_X_SIZE HEADER_LEN + sizeof(int64_t) * 3 + sizeof(uint64_t) + PARAM_LEN * 4 -#define BPF_E_SIZE HEADER_LEN + sizeof(int64_t) + PARAM_LEN +#define BPF_E_SIZE HEADER_LEN + sizeof(int32_t) + PARAM_LEN #define BPF_X_SIZE HEADER_LEN + sizeof(int64_t) + PARAM_LEN #define FLOCK_E_SIZE HEADER_LEN + sizeof(int64_t) + sizeof(uint32_t) + PARAM_LEN * 2 #define FLOCK_X_SIZE HEADER_LEN + sizeof(int64_t) + PARAM_LEN diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/bpf.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/bpf.bpf.c index eeac9e4639..a96ee026d1 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/bpf.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/bpf.bpf.c @@ -24,9 +24,9 @@ int BPF_PROG(bpf_e, /*=============================== COLLECT PARAMETERS ===========================*/ - /* Parameter 1: cmd (type: PT_INT64) */ + /* Parameter 1: cmd (type: PT_INT32) */ s32 cmd = (s32)extract__syscall_argument(regs, 0); - ringbuf__store_s64(&ringbuf, (s64)cmd); + ringbuf__store_s32(&ringbuf, (s32)cmd); /*=============================== COLLECT PARAMETERS ===========================*/ diff --git a/driver/ppm_fillers.c b/driver/ppm_fillers.c index 7b99686160..163620f310 100644 --- a/driver/ppm_fillers.c +++ b/driver/ppm_fillers.c @@ -7006,9 +7006,9 @@ int f_sys_bpf_e(struct event_filler_arguments *args) unsigned long val = 0; syscall_get_arguments_deprecated(args, 0, 1, &val); - /* Parameter 1: cmd (type: PT_INT64) */ + /* Parameter 1: cmd (type: PT_INT32) */ cmd = (int32_t)val; - res = val_to_ring(args, (int64_t)cmd, 0, false, 0); + res = val_to_ring(args, (int32_t)cmd, 0, false, 0); CHECK_RES(res); return add_sentinel(args); } diff --git a/test/drivers/test_suites/syscall_enter_suite/bpf_e.cpp b/test/drivers/test_suites/syscall_enter_suite/bpf_e.cpp index 7d2b4442d6..4d4d82eca7 100644 --- a/test/drivers/test_suites/syscall_enter_suite/bpf_e.cpp +++ b/test/drivers/test_suites/syscall_enter_suite/bpf_e.cpp @@ -66,8 +66,8 @@ TEST(SyscallEnter, bpfE) /*=============================== ASSERT PARAMETERS ===========================*/ - /* Parameter 1: cmd (type: PT_INT64) */ - evt_test->assert_numeric_param(1, (int64_t)cmd); + /* Parameter 1: cmd (type: int32_t) */ + evt_test->assert_numeric_param(1, (int32_t)cmd); /*=============================== ASSERT PARAMETERS ===========================*/