Skip to content

Commit debf97a

Browse files
Rohith-RajuRohith-Raju
committed
update: retain original parameter order
Signed-off-by: rohith-raju <rohithraju488@gmail.com>
1 parent 355a51a commit debf97a

7 files changed

Lines changed: 87 additions & 88 deletions

File tree

‎driver/bpf/fillers.h‎

Lines changed: 23 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1089,11 +1089,6 @@ FILLER(sys_setrlrimit_x, true)
10891089
res = bpf_push_s64_to_ring(data, retval);
10901090
CHECK_RES(res);
10911091

1092-
/* Parameter 2: resource (type: PT_ERRNO) */
1093-
unsigned long resource = bpf_syscall_get_argument(data, 0);
1094-
res = bpf_push_u8_to_ring(data, rlimit_resource_to_scap(resource));
1095-
CHECK_RES(res);
1096-
10971092
/*
10981093
* Copy the user structure and extract cur and max
10991094
*/
@@ -1112,12 +1107,17 @@ FILLER(sys_setrlrimit_x, true)
11121107
max = -1;
11131108
}
11141109

1115-
/* Parameter 3: cur (type: PT_ERRNO) */
1110+
/* Parameter 2: cur (type: PT_ERRNO) */
11161111
res = bpf_push_s64_to_ring(data, cur);
11171112
CHECK_RES(res);
11181113

1119-
/* Parameter 4: max (type: PT_ERRNO) */
1120-
return bpf_push_s64_to_ring(data, max);
1114+
/* Parameter 3: max (type: PT_ERRNO) */
1115+
res = bpf_push_s64_to_ring(data, max);
1116+
CHECK_RES(res);
1117+
1118+
/* Parameter 4: resource (type: PT_ERRNO) */
1119+
unsigned long resource = bpf_syscall_get_argument(data, 0);
1120+
return bpf_push_u8_to_ring(data, rlimit_resource_to_scap(resource));
11211121
}
11221122

11231123
FILLER(sys_connect_e, true)
@@ -3877,23 +3877,11 @@ FILLER(sys_prlimit_x, true)
38773877
int64_t oldmax;
38783878
int res;
38793879

3880-
/*
3881-
* res
3882-
*/
3880+
/* Parameter 1: res */
38833881
retval = bpf_syscall_get_retval(data->ctx);
38843882
res = bpf_push_s64_to_ring(data, retval);
38853883
CHECK_RES(res);
38863884

3887-
/* Parameter 1: pid */
3888-
pid_t pid = bpf_syscall_get_argument(data, 0);
3889-
res = bpf_push_s64_to_ring(data, (s64)pid);
3890-
CHECK_RES(res);
3891-
3892-
/* Parameter 2: resource */
3893-
unsigned long resource = bpf_syscall_get_argument(data, 1);
3894-
res = bpf_push_u8_to_ring(data, rlimit_resource_to_scap(resource));
3895-
CHECK_RES(res);
3896-
38973885
/*
38983886
* Copy the user structure and extract cur and max
38993887
*/
@@ -3920,20 +3908,30 @@ FILLER(sys_prlimit_x, true)
39203908
oldmax = rl.rlim_max;
39213909
}
39223910

3923-
/* Parameter 3: newcur */
3911+
/* Parameter 2: newcur */
39243912
res = bpf_push_s64_to_ring(data, newcur);
39253913
CHECK_RES(res);
39263914

3927-
/* Parameter 4: newmax */
3915+
/* Parameter 3: newmax */
39283916
res = bpf_push_s64_to_ring(data, newmax);
39293917
CHECK_RES(res);
39303918

3931-
/* Parameter 5: oldcur */
3919+
/* Parameter 4: oldcur */
39323920
res = bpf_push_s64_to_ring(data, oldcur);
39333921
CHECK_RES(res);
39343922

39353923
/* Parameter 5: oldmax */
3936-
return bpf_push_s64_to_ring(data, oldmax);
3924+
res = bpf_push_s64_to_ring(data, oldmax);
3925+
CHECK_RES(res);
3926+
3927+
/* Parameter 6: pid */
3928+
pid_t pid = bpf_syscall_get_argument(data, 0);
3929+
res = bpf_push_s64_to_ring(data, (s64)pid);
3930+
CHECK_RES(res);
3931+
3932+
/* Parameter 7: resource */
3933+
unsigned long resource = bpf_syscall_get_argument(data, 1);
3934+
return bpf_push_u8_to_ring(data, rlimit_resource_to_scap(resource));
39373935
}
39383936

39393937
FILLER(sys_pwritev_e, true)

‎driver/event_table.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -193,9 +193,9 @@ const struct ppm_event_info g_event_info[] = {
193193
[PPME_SYSCALL_GETRLIMIT_E] = {"getrlimit", EC_PROCESS | EC_SYSCALL, EF_NONE, 1, {{"resource", PT_ENUMFLAGS8, PF_DEC, rlimit_resources} } },
194194
[PPME_SYSCALL_GETRLIMIT_X] = {"getrlimit", EC_PROCESS | EC_SYSCALL, EF_NONE, 3, {{"res", PT_ERRNO, PF_DEC}, {"cur", PT_INT64, PF_DEC}, {"max", PT_INT64, PF_DEC} } },
195195
[PPME_SYSCALL_SETRLIMIT_E] = {"setrlimit", EC_PROCESS | EC_SYSCALL, EF_NONE, 1, {{"resource", PT_ENUMFLAGS8, PF_DEC, rlimit_resources} } },
196-
[PPME_SYSCALL_SETRLIMIT_X] = {"setrlimit", EC_PROCESS | EC_SYSCALL, EF_NONE, 4, {{"res", PT_ERRNO, PF_DEC}, {"resource", PT_ENUMFLAGS8, PF_DEC, rlimit_resources}, {"cur", PT_INT64, PF_DEC}, {"max", PT_INT64, PF_DEC} } },
196+
[PPME_SYSCALL_SETRLIMIT_X] = {"setrlimit", EC_PROCESS | EC_SYSCALL, EF_NONE, 4, {{"res", PT_ERRNO, PF_DEC},{"cur", PT_INT64, PF_DEC}, {"max", PT_INT64, PF_DEC}, {"resource", PT_ENUMFLAGS8, PF_DEC, rlimit_resources} } },
197197
[PPME_SYSCALL_PRLIMIT_E] = {"prlimit", EC_PROCESS | EC_SYSCALL, EF_NONE, 2, {{"pid", PT_PID, PF_DEC}, {"resource", PT_ENUMFLAGS8, PF_DEC, rlimit_resources} } },
198-
[PPME_SYSCALL_PRLIMIT_X] = {"prlimit", EC_PROCESS | EC_SYSCALL, EF_NONE, 7, {{"res", PT_ERRNO, PF_DEC}, {"pid", PT_INT64, PF_DEC}, {"resource", PT_ENUMFLAGS8, PF_DEC, rlimit_resources}, {"newcur", PT_INT64, PF_DEC}, {"newmax", PT_INT64, PF_DEC}, {"oldcur", PT_INT64, PF_DEC}, {"oldmax", PT_INT64, PF_DEC}} },
198+
[PPME_SYSCALL_PRLIMIT_X] = {"prlimit", EC_PROCESS | EC_SYSCALL, EF_NONE, 7, {{"res", PT_ERRNO, PF_DEC}, {"newcur", PT_INT64, PF_DEC}, {"newmax", PT_INT64, PF_DEC}, {"oldcur", PT_INT64, PF_DEC}, {"oldmax", PT_INT64, PF_DEC}, {"pid", PT_INT64, PF_DEC}, {"resource", PT_ENUMFLAGS8, PF_DEC, rlimit_resources} } },
199199
[PPME_SCHEDSWITCH_1_E] = {"switch", EC_SCHEDULER | EC_TRACEPOINT, EF_SKIPPARSERESET | EF_OLD_VERSION, 1, {{"next", PT_PID, PF_DEC} } },
200200
[PPME_SCHEDSWITCH_1_X] = {"NA", EC_UNKNOWN, EF_SKIPPARSERESET | EF_UNUSED | EF_OLD_VERSION, 0},
201201
[PPME_DROP_E] = {"drop", EC_INTERNAL | EC_METAEVENT, EF_SKIPPARSERESET, 1, {{"ratio", PT_UINT32, PF_DEC} } },

‎driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/prlimit64.bpf.c‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -62,22 +62,14 @@ int BPF_PROG(prlimit64_x,
6262
/* Parameter 1: res (type: PT_ERRNO) */
6363
ringbuf__store_s64(&ringbuf, ret);
6464

65-
/* Parameter 2: pid (type: PT_PID) */
66-
pid_t pid = (s32)extract__syscall_argument(regs, 0);
67-
ringbuf__store_s64(&ringbuf, (s64)pid);
68-
69-
/* Parameter 3: resource (type: PT_ENUMFLAGS8) */
70-
unsigned long resource = extract__syscall_argument(regs, 1);
71-
ringbuf__store_u8(&ringbuf, rlimit_resource_to_scap(resource));
72-
7365
struct rlimit new_rlimit = {0};
7466
unsigned long rlimit_pointer = extract__syscall_argument(regs, 2);
7567
bpf_probe_read_user((void *)&new_rlimit, bpf_core_type_size(struct rlimit), (void *)rlimit_pointer);
7668

77-
/* Parameter 4: newcur (type: PT_INT64) */
69+
/* Parameter 2: newcur (type: PT_INT64) */
7870
ringbuf__store_s64(&ringbuf, new_rlimit.rlim_cur);
7971

80-
/* Parameter 5: newmax (type: PT_INT64) */
72+
/* Parameter 3: newmax (type: PT_INT64) */
8173
ringbuf__store_s64(&ringbuf, new_rlimit.rlim_max);
8274

8375
/* We take the old `rlimit` only if the syscall is successful otherwise this
@@ -90,12 +82,20 @@ int BPF_PROG(prlimit64_x,
9082
bpf_probe_read_user((void *)&old_rlimit, bpf_core_type_size(struct rlimit), (void *)rlimit_pointer);
9183
}
9284

93-
/* Parameter 6: oldcur (type: PT_INT64) */
85+
/* Parameter 4: oldcur (type: PT_INT64) */
9486
ringbuf__store_s64(&ringbuf, old_rlimit.rlim_cur);
9587

96-
/* Parameter 7: oldmax (type: PT_INT64) */
88+
/* Parameter 5: oldmax (type: PT_INT64) */
9789
ringbuf__store_s64(&ringbuf, old_rlimit.rlim_max);
9890

91+
/* Parameter 6: pid (type: PT_PID) */
92+
pid_t pid = (s32)extract__syscall_argument(regs, 0);
93+
ringbuf__store_s64(&ringbuf, (s64)pid);
94+
95+
/* Parameter 7: resource (type: PT_ENUMFLAGS8) */
96+
unsigned long resource = extract__syscall_argument(regs, 1);
97+
ringbuf__store_u8(&ringbuf, rlimit_resource_to_scap(resource));
98+
9999
/*=============================== COLLECT PARAMETERS ===========================*/
100100

101101
ringbuf__submit_event(&ringbuf);

‎driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setrlimit.bpf.c‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -58,20 +58,20 @@ int BPF_PROG(setrlimit_x,
5858
/* Parameter 1: res (type: PT_ERRNO)*/
5959
ringbuf__store_s64(&ringbuf, ret);
6060

61-
/* Parameter 2: resource (type: PT_ENUMFLAGS8) */
62-
unsigned long resource = extract__syscall_argument(regs, 0);
63-
ringbuf__store_u8(&ringbuf, rlimit_resource_to_scap(resource));
64-
6561
struct rlimit rl = {0};
6662
unsigned long rlimit_pointer = extract__syscall_argument(regs, 1);
6763
bpf_probe_read_user((void *)&rl, bpf_core_type_size(struct rlimit), (void *)rlimit_pointer);
6864

69-
/* Parameter 3: cur (type: PT_INT64)*/
65+
/* Parameter 2: cur (type: PT_INT64)*/
7066
ringbuf__store_s64(&ringbuf, rl.rlim_cur);
7167

72-
/* Parameter 4: max (type: PT_INT64)*/
68+
/* Parameter 3: max (type: PT_INT64)*/
7369
ringbuf__store_s64(&ringbuf, rl.rlim_max);
7470

71+
/* Parameter 4: resource (type: PT_ENUMFLAGS8) */
72+
unsigned long resource = extract__syscall_argument(regs, 0);
73+
ringbuf__store_u8(&ringbuf, rlimit_resource_to_scap(resource));
74+
7575
/*=============================== COLLECT PARAMETERS ===========================*/
7676

7777
ringbuf__submit_event(&ringbuf);

‎driver/ppm_fillers.c‎

Lines changed: 29 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -4092,7 +4092,7 @@ int f_sys_getrlimit_x(struct event_filler_arguments *args) {
40924092
int64_t cur;
40934093
int64_t max;
40944094

4095-
/* Parameter 1: res */
4095+
/* Parameter 1: res (type: PT_ERRNO) */
40964096
retval = (int64_t)(long)syscall_get_return_value(current, args->regs);
40974097
res = val_to_ring(args, retval, 0, false, 0);
40984098
CHECK_RES(res);
@@ -4130,11 +4130,11 @@ int f_sys_getrlimit_x(struct event_filler_arguments *args) {
41304130
max = -1;
41314131
}
41324132

4133-
/* Parameter 2: cur */
4133+
/* Parameter 2: cur (type: PT_INT64) */
41344134
res = val_to_ring(args, cur, 0, false, 0);
41354135
CHECK_RES(res);
41364136

4137-
/* Parameter 3: max */
4137+
/* Parameter 3: max (type: PT_INT64)*/
41384138
res = val_to_ring(args, max, 0, false, 0);
41394139
CHECK_RES(res);
41404140

@@ -4155,16 +4155,11 @@ int f_sys_setrlrimit_x(struct event_filler_arguments *args)
41554155
int64_t cur;
41564156
int64_t max;
41574157

4158-
/* Parameter 1: res */
4158+
/* Parameter 1: res (type: PT_ERRNO) */
41594159
retval = (int64_t)(long)syscall_get_return_value(current, args->regs);
41604160
res = val_to_ring(args, retval, 0, false, 0);
41614161
CHECK_RES(res);
41624162

4163-
/* Parameter 2: resource */
4164-
syscall_get_arguments_deprecated(args, 0, 1, &val);
4165-
res = val_to_ring(args, rlimit_resource_to_scap(val), 0, false, 0);
4166-
CHECK_RES(res);
4167-
41684163
/*
41694164
* Copy the user structure and extract cur and max
41704165
*/
@@ -4191,14 +4186,19 @@ int f_sys_setrlrimit_x(struct event_filler_arguments *args)
41914186
max = -1;
41924187
}
41934188

4194-
/* Parameter 3: cur */
4189+
/* Parameter 2: (type: PT_INT64) */
41954190
res = val_to_ring(args, cur, 0, false, 0);
41964191
CHECK_RES(res);
41974192

4198-
/* Parameter 4: max */
4193+
/* Parameter 3: max (type: PT_INT64) */
41994194
res = val_to_ring(args, max, 0, false, 0);
42004195
CHECK_RES(res);
42014196

4197+
/* Parameter 4: resource (type: PT_ENUMFLAGS8) */
4198+
syscall_get_arguments_deprecated(args, 0, 1, &val);
4199+
res = val_to_ring(args, rlimit_resource_to_scap(val), 0, false, 0);
4200+
CHECK_RES(res);
4201+
42024202
return add_sentinel(args);
42034203
}
42044204

@@ -4237,24 +4237,11 @@ int f_sys_prlimit_x(struct event_filler_arguments *args)
42374237
int64_t oldmax;
42384238
pid_t pid = 0;
42394239

4240-
/*
4241-
* res
4242-
*/
4240+
/* Parameter 1: res (type: PT_ERRNO) */
42434241
retval = (int64_t)(long)syscall_get_return_value(current, args->regs);
42444242
res = val_to_ring(args, retval, 0, false, 0);
42454243
CHECK_RES(res);
42464244

4247-
/* Parameter 1: pid */
4248-
syscall_get_arguments_deprecated(args, 0, 1, &val);
4249-
pid = (s32)val;
4250-
res = val_to_ring(args, (s64)pid, 0, false, 0);
4251-
CHECK_RES(res);
4252-
4253-
/* Parameter 2: resource (type: PT_ENUMFLAGS8) */
4254-
syscall_get_arguments_deprecated(args, 1, 1, &val);
4255-
res = val_to_ring(args, rlimit_resource_to_scap(val), 0, false, 0);
4256-
CHECK_RES(res);
4257-
42584245
/*
42594246
* Copy the user structure and extract cur and max
42604247
*/
@@ -4308,22 +4295,35 @@ int f_sys_prlimit_x(struct event_filler_arguments *args)
43084295
}
43094296
}
43104297
#endif
4311-
/* Parameter 3: newcur (PT_INT64)*/
4298+
/* Parameter 2: newcur (type: PT_INT64) */
43124299
res = val_to_ring(args, newcur, 0, false, 0);
43134300
CHECK_RES(res);
4301+
CHECK_RES(res);
43144302

4315-
/* Parameter 4: newmax (PT_INT64)*/
4303+
/* Parameter 3: newmax (type: PT_INT64) */
43164304
res = val_to_ring(args, newmax, 0, false, 0);
43174305
CHECK_RES(res);
4306+
CHECK_RES(res);
43184307

4319-
/* Parameter 5: oldcur (PT_INT64)*/
4308+
/* Parameter 4: oldcur (type: PT_INT64) */
43204309
res = val_to_ring(args, oldcur, 0, false, 0);
43214310
CHECK_RES(res);
43224311

4323-
/* Parameter 6: oldmax (PT_INT64)*/
4312+
/* Parameter 5: oldmax (type: PT_INT64) */
43244313
res = val_to_ring(args, oldmax, 0, false, 0);
43254314
CHECK_RES(res);
43264315

4316+
/* Parameter 6: pid (type: PT_INT64) */
4317+
syscall_get_arguments_deprecated(args, 0, 1, &val);
4318+
pid = (s32)val;
4319+
res = val_to_ring(args, (s64)pid, 0, false, 0);
4320+
CHECK_RES(res);
4321+
4322+
/* Parameter 7: resource (type: PT_ENUMFLAGS8) */
4323+
syscall_get_arguments_deprecated(args, 1, 1, &val);
4324+
res = val_to_ring(args, rlimit_resource_to_scap(val), 0, false, 0);
4325+
CHECK_RES(res);
4326+
43274327
return add_sentinel(args);
43284328
}
43294329

‎test/drivers/test_suites/syscall_exit_suite/prlimit64_x.cpp‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -46,23 +46,23 @@ TEST(SyscallExit, prlimit64X)
4646
/* Parameter 1: res (type: PT_ERRNO) */
4747
evt_test->assert_numeric_param(1, (int64_t)0);
4848

49-
/* Parameter 2: pid (type: PT_INT64) */
50-
evt_test->assert_numeric_param(2, (int64_t)pid);
49+
/* Parameter 2: newcur (type: PT_INT64) */
50+
evt_test->assert_numeric_param(2, (int64_t)file_rlimit.rlim_cur);
5151

52-
/* Parameter 3: resource (type: PT_ENUMFLAGS8) */
53-
evt_test->assert_numeric_param(3, (uint8_t)PPM_RLIMIT_NOFILE);
52+
/* Parameter 3: newmax (type: PT_INT64) */
53+
evt_test->assert_numeric_param(3, (int64_t)file_rlimit.rlim_max);
5454

55-
/* Parameter 4: newcur (type: PT_INT64) */
55+
/* Parameter 4: oldcur (type: PT_INT64) */
5656
evt_test->assert_numeric_param(4, (int64_t)file_rlimit.rlim_cur);
5757

58-
/* Parameter 5: newmax (type: PT_INT64) */
58+
/* Parameter 5: oldmax (type: PT_INT64) */
5959
evt_test->assert_numeric_param(5, (int64_t)file_rlimit.rlim_max);
6060

61-
/* Parameter 6: oldcur (type: PT_INT64) */
62-
evt_test->assert_numeric_param(6, (int64_t)file_rlimit.rlim_cur);
61+
/* Parameter 6: pid (type: PT_INT64) */
62+
evt_test->assert_numeric_param(6, (int64_t)pid);
6363

64-
/* Parameter 7: oldmax (type: PT_INT64) */
65-
evt_test->assert_numeric_param(7, (int64_t)file_rlimit.rlim_max);
64+
/* Parameter 7: resource (type: PT_ENUMFLAGS8) */
65+
evt_test->assert_numeric_param(7, (uint8_t)PPM_RLIMIT_NOFILE);
6666

6767
/*=============================== ASSERT PARAMETERS ===========================*/
6868

‎test/drivers/test_suites/syscall_exit_suite/setrlimit_x.cpp‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,13 +39,14 @@ TEST(SyscallExit, setrlimitX)
3939
/* Parameter 1: res (type: PT_ERRNO) */
4040
evt_test->assert_numeric_param(1, (int64_t)errno_value);
4141

42-
evt_test->assert_numeric_param(2, (uint8_t)resource);
43-
4442
/* Parameter 2: cur (type: PT_INT64) */
45-
evt_test->assert_numeric_param(3, (int64_t)rlim.rlim_cur);
43+
evt_test->assert_numeric_param(2, (int64_t)rlim.rlim_cur);
4644

4745
/* Parameter 3: max (type: PT_INT64) */
48-
evt_test->assert_numeric_param(4, (int64_t)rlim.rlim_max);
46+
evt_test->assert_numeric_param(3, (int64_t)rlim.rlim_max);
47+
48+
/* Parameter 4: resource (type: PT_ENUMFLAGS8) */
49+
evt_test->assert_numeric_param(4, (uint8_t)resource);
4950

5051
/*=============================== ASSERT PARAMETERS ===========================*/
5152

0 commit comments

Comments
 (0)