From b6e6649bc5745fef4916109a76c8ed0933be45e5 Mon Sep 17 00:00:00 2001 From: Andrea Terzolo Date: Wed, 6 Nov 2024 12:09:13 +0100 Subject: [PATCH 1/9] cleanup: move `sched_p_exec` tail calls With this new approach the tail calls are only visible inside the sched_proc_exec file. Signed-off-by: Andrea Terzolo --- .../attached/events/sched_process_exec.bpf.c | 37 +++++++++++++++++-- driver/ppm_events_public.h | 3 +- userspace/libpman/src/events_prog_names.h | 4 -- 3 files changed, 35 insertions(+), 9 deletions(-) diff --git a/driver/modern_bpf/programs/attached/events/sched_process_exec.bpf.c b/driver/modern_bpf/programs/attached/events/sched_process_exec.bpf.c index 3fbec7532f..11613adc65 100644 --- a/driver/modern_bpf/programs/attached/events/sched_process_exec.bpf.c +++ b/driver/modern_bpf/programs/attached/events/sched_process_exec.bpf.c @@ -13,6 +13,37 @@ * struct linux_binprm *bprm) */ #ifdef CAPTURE_SCHED_PROC_EXEC + +enum extra_sched_proc_exec_codes { + T1_SCHED_PROC_EXEC, + T2_SCHED_PROC_EXEC, + // add more codes here. + T_SCHED_PROC_EXEC_MAX, +}; + +/* + * FORWARD DECLARATIONS: + * See the `BPF_PROG` macro in libbpf `libbpf/src/bpf_tracing.h` + * #define BPF_PROG(name, args...) \ + * name(unsigned long long *ctx); \ + */ +int t1_sched_p_exec(unsigned long long *ctx); +int t2_sched_p_exec(unsigned long long *ctx); + +struct { + __uint(type, BPF_MAP_TYPE_PROG_ARRAY); + __uint(max_entries, T_SCHED_PROC_EXEC_MAX); + __uint(key_size, sizeof(__u32)); + __array(values, int(void *)); +} extra_sched_proc_exec_calls SEC(".maps") = { + .values = + { + [T1_SCHED_PROC_EXEC] = (void *)&t1_sched_p_exec, + [T2_SCHED_PROC_EXEC] = (void *)&t2_sched_p_exec, + // add more tail calls here. + }, +}; + /* chose a short name for bpftool debugging*/ SEC("tp_btf/sched_process_exec") int BPF_PROG(sched_p_exec, struct task_struct *p, pid_t old_pid, struct linux_binprm *bprm) { @@ -114,7 +145,7 @@ int BPF_PROG(sched_p_exec, struct task_struct *p, pid_t old_pid, struct linux_bi /*=============================== COLLECT PARAMETERS ===========================*/ - bpf_tail_call(ctx, &extra_event_prog_tail_table, T1_SCHED_PROC_EXEC); + bpf_tail_call(ctx, &extra_sched_proc_exec_calls, T1_SCHED_PROC_EXEC); return 0; } @@ -234,11 +265,11 @@ int BPF_PROG(t1_sched_p_exec, struct task_struct *p, pid_t old_pid, struct linux /*=============================== COLLECT PARAMETERS ===========================*/ - bpf_tail_call(ctx, &extra_event_prog_tail_table, T2_SCHED_PROC_EXEC); + bpf_tail_call(ctx, &extra_sched_proc_exec_calls, T2_SCHED_PROC_EXEC); return 0; } -SEC("tp_btf/sys_exit") +SEC("tp_btf/sched_process_exec") int BPF_PROG(t2_sched_p_exec, struct pt_regs *regs, long ret) { struct auxiliary_map *auxmap = auxmap__get(); if(!auxmap) { diff --git a/driver/ppm_events_public.h b/driver/ppm_events_public.h index 7d01ab76d4..f7d9890ac3 100644 --- a/driver/ppm_events_public.h +++ b/driver/ppm_events_public.h @@ -1525,6 +1525,7 @@ typedef enum { * - `X` = means that we need this extra tail call for the exit event, `E` means enter the event. * */ +// todo!: rename this `extra_syscall_exit_calls`. enum extra_event_prog_code { T1_EXECVE_X = 0, T1_EXECVEAT_X = 1, @@ -1532,7 +1533,6 @@ enum extra_event_prog_code { T1_CLONE3_X = 3, T1_FORK_X = 4, T1_VFORK_X = 5, - T1_SCHED_PROC_EXEC = 6, T1_SCHED_PROC_FORK = 7, T2_SCHED_PROC_FORK = 8, T2_CLONE_X = 9, @@ -1545,7 +1545,6 @@ enum extra_event_prog_code { T1_OPEN_BY_HANDLE_AT_X = 16, T2_EXECVE_X = 17, T2_EXECVEAT_X = 18, - T2_SCHED_PROC_EXEC = 19, TAIL_EXTRA_EVENT_PROG_MAX = 20 }; diff --git a/userspace/libpman/src/events_prog_names.h b/userspace/libpman/src/events_prog_names.h index ed2577ec0d..f8b7cdc878 100644 --- a/userspace/libpman/src/events_prog_names.h +++ b/userspace/libpman/src/events_prog_names.h @@ -349,10 +349,6 @@ static const char* extra_event_prog_names[TAIL_EXTRA_EVENT_PROG_MAX] = { [T1_CLONE3_X] = "t1_clone3_x", [T1_FORK_X] = "t1_fork_x", [T1_VFORK_X] = "t1_vfork_x", -#ifdef CAPTURE_SCHED_PROC_EXEC - [T1_SCHED_PROC_EXEC] = "t1_sched_p_exec", - [T2_SCHED_PROC_EXEC] = "t2_sched_p_exec", -#endif #ifdef CAPTURE_SCHED_PROC_FORK [T1_SCHED_PROC_FORK] = "t1_sched_p_fork", [T2_SCHED_PROC_FORK] = "t2_sched_p_fork", From ad552f30d5b21ca068d607223bbdc6a95ad36e63 Mon Sep 17 00:00:00 2001 From: Andrea Terzolo Date: Wed, 6 Nov 2024 12:39:26 +0100 Subject: [PATCH 2/9] cleanup: move `sched_p_fork` tail calls Signed-off-by: Andrea Terzolo --- .../attached/events/sched_process_fork.bpf.c | 35 +++++++++++++++++-- driver/ppm_events_public.h | 2 -- userspace/libpman/src/events_prog_names.h | 4 --- 3 files changed, 33 insertions(+), 8 deletions(-) diff --git a/driver/modern_bpf/programs/attached/events/sched_process_fork.bpf.c b/driver/modern_bpf/programs/attached/events/sched_process_fork.bpf.c index f33ccd440a..059b5a5646 100644 --- a/driver/modern_bpf/programs/attached/events/sched_process_fork.bpf.c +++ b/driver/modern_bpf/programs/attached/events/sched_process_fork.bpf.c @@ -14,6 +14,37 @@ */ #ifdef CAPTURE_SCHED_PROC_FORK + +enum extra_sched_proc_fork_codes { + T1_SCHED_PROC_FORK, + T2_SCHED_PROC_FORK, + // add more codes here. + T_SCHED_PROC_FORK_MAX, +}; + +/* + * FORWARD DECLARATIONS: + * See the `BPF_PROG` macro in libbpf `libbpf/src/bpf_tracing.h` + * #define BPF_PROG(name, args...) \ + * name(unsigned long long *ctx); \ + */ +int t1_sched_p_fork(unsigned long long *ctx); +int t2_sched_p_fork(unsigned long long *ctx); + +struct { + __uint(type, BPF_MAP_TYPE_PROG_ARRAY); + __uint(max_entries, T_SCHED_PROC_FORK_MAX); + __uint(key_size, sizeof(__u32)); + __array(values, int(void *)); +} extra_sched_proc_fork_calls SEC(".maps") = { + .values = + { + [T1_SCHED_PROC_FORK] = (void *)&t1_sched_p_fork, + [T2_SCHED_PROC_FORK] = (void *)&t2_sched_p_fork, + // add more tail calls here. + }, +}; + /* chose a short name for bpftool debugging*/ SEC("tp_btf/sched_process_fork") int BPF_PROG(sched_p_fork, struct task_struct *parent, struct task_struct *child) { @@ -128,7 +159,7 @@ int BPF_PROG(sched_p_fork, struct task_struct *parent, struct task_struct *child /*=============================== COLLECT PARAMETERS ===========================*/ - bpf_tail_call(ctx, &extra_event_prog_tail_table, T1_SCHED_PROC_FORK); + bpf_tail_call(ctx, &extra_sched_proc_fork_calls, T1_SCHED_PROC_FORK); return 0; } @@ -206,7 +237,7 @@ int BPF_PROG(t1_sched_p_fork, struct task_struct *parent, struct task_struct *ch /* We have to split here the bpf program, otherwise, it is too large * for the verifier (limit 1000000 instructions). */ - bpf_tail_call(ctx, &extra_event_prog_tail_table, T2_SCHED_PROC_FORK); + bpf_tail_call(ctx, &extra_sched_proc_fork_calls, T2_SCHED_PROC_FORK); return 0; } diff --git a/driver/ppm_events_public.h b/driver/ppm_events_public.h index f7d9890ac3..e85e566f5b 100644 --- a/driver/ppm_events_public.h +++ b/driver/ppm_events_public.h @@ -1533,8 +1533,6 @@ enum extra_event_prog_code { T1_CLONE3_X = 3, T1_FORK_X = 4, T1_VFORK_X = 5, - T1_SCHED_PROC_FORK = 7, - T2_SCHED_PROC_FORK = 8, T2_CLONE_X = 9, T2_CLONE3_X = 10, T2_FORK_X = 11, diff --git a/userspace/libpman/src/events_prog_names.h b/userspace/libpman/src/events_prog_names.h index f8b7cdc878..d896f606b9 100644 --- a/userspace/libpman/src/events_prog_names.h +++ b/userspace/libpman/src/events_prog_names.h @@ -349,10 +349,6 @@ static const char* extra_event_prog_names[TAIL_EXTRA_EVENT_PROG_MAX] = { [T1_CLONE3_X] = "t1_clone3_x", [T1_FORK_X] = "t1_fork_x", [T1_VFORK_X] = "t1_vfork_x", -#ifdef CAPTURE_SCHED_PROC_FORK - [T1_SCHED_PROC_FORK] = "t1_sched_p_fork", - [T2_SCHED_PROC_FORK] = "t2_sched_p_fork", -#endif [T2_CLONE_X] = "t2_clone_x", [T2_CLONE3_X] = "t2_clone3_x", [T2_FORK_X] = "t2_fork_x", From 94cc1b0dd05948d2bbbd74602025c7a3272fc3bb Mon Sep 17 00:00:00 2001 From: Andrea Terzolo Date: Wed, 6 Nov 2024 14:34:58 +0100 Subject: [PATCH 3/9] cleanup: move `hotplug` logic into sys_exit Signed-off-by: Andrea Terzolo --- driver/modern_bpf/helpers/store/auxmap_store_params.h | 5 +++-- driver/modern_bpf/helpers/store/ringbuf_store_params.h | 5 +++-- .../programs/attached/dispatchers/syscall_exit.bpf.c | 10 ++++++++++ .../tail_called/events/custom_logic/hotplug.bpf.c | 2 +- 4 files changed, 17 insertions(+), 5 deletions(-) diff --git a/driver/modern_bpf/helpers/store/auxmap_store_params.h b/driver/modern_bpf/helpers/store/auxmap_store_params.h index 3943e06ff6..c3d444aedf 100644 --- a/driver/modern_bpf/helpers/store/auxmap_store_params.h +++ b/driver/modern_bpf/helpers/store/auxmap_store_params.h @@ -119,11 +119,12 @@ static __always_inline void auxmap__finalize_event_header(struct auxiliary_map * * @param auxmap pointer to the auxmap in which we have already written the entire event. * @param ctx BPF prog context */ +// todo!: we need to remove the context because we don't perform any tail call static __always_inline void auxmap__submit_event(struct auxiliary_map *auxmap, void *ctx) { struct ringbuf_map *rb = maps__get_ringbuf_map(); if(!rb) { - bpf_tail_call(ctx, &extra_event_prog_tail_table, T1_HOTPLUG_E); - bpf_printk("failed to tail call into the 'hotplug' prog"); + // this should never happen because we check it in sys_enter/sys_exit + bpf_printk("FAILURE: unable to obtain the ring buffer"); return; } diff --git a/driver/modern_bpf/helpers/store/ringbuf_store_params.h b/driver/modern_bpf/helpers/store/ringbuf_store_params.h index 0dee9f1346..1d7708bf6c 100644 --- a/driver/modern_bpf/helpers/store/ringbuf_store_params.h +++ b/driver/modern_bpf/helpers/store/ringbuf_store_params.h @@ -94,14 +94,15 @@ struct ringbuf_struct { * @param event_size exact size of the fixed-size event * @return `1` in case of success, `0` in case of failure. */ +// todo!: we need to remove the context because we don't perform any tail call static __always_inline uint32_t ringbuf__reserve_space(struct ringbuf_struct *ringbuf, void *ctx, uint32_t event_size, uint16_t event_type) { struct ringbuf_map *rb = maps__get_ringbuf_map(); if(!rb) { - bpf_tail_call(ctx, &extra_event_prog_tail_table, T1_HOTPLUG_E); - bpf_printk("failed to tail call into the 'hotplug' prog"); + // this should never happen because we check it in sys_enter/sys_exit + bpf_printk("FAILURE: unable to obtain the ring buffer"); return 0; } diff --git a/driver/modern_bpf/programs/attached/dispatchers/syscall_exit.bpf.c b/driver/modern_bpf/programs/attached/dispatchers/syscall_exit.bpf.c index 53714500a0..732cb31b32 100644 --- a/driver/modern_bpf/programs/attached/dispatchers/syscall_exit.bpf.c +++ b/driver/modern_bpf/programs/attached/dispatchers/syscall_exit.bpf.c @@ -71,6 +71,16 @@ int BPF_PROG(sys_exit, struct pt_regs *regs, long ret) { return 0; } + // If we cannot find a ring buffer for this CPU we probably have an hotplug event. It's ok to + // check only in the exit path since we will always have at least one exit syscall enabled. If + // we change our architecture we may need to update this logic. + struct ringbuf_map *rb = maps__get_ringbuf_map(); + if(!rb) { + bpf_tail_call(ctx, &extra_event_prog_tail_table, T1_HOTPLUG_E); + bpf_printk("failed to tail call into the 'hotplug' prog"); + return 0; + } + bpf_tail_call(ctx, &syscall_exit_tail_table, syscall_id); return 0; diff --git a/driver/modern_bpf/programs/tail_called/events/custom_logic/hotplug.bpf.c b/driver/modern_bpf/programs/tail_called/events/custom_logic/hotplug.bpf.c index 256fddfa0f..ce969ed8e3 100644 --- a/driver/modern_bpf/programs/tail_called/events/custom_logic/hotplug.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/custom_logic/hotplug.bpf.c @@ -8,7 +8,7 @@ #include -SEC("tp_btf/sys_enter") +SEC("tp_btf/sys_exit") int BPF_PROG(t1_hotplug_e) { /* We assume that the ring buffer for CPU 0 is always there so we send the * HOT-PLUG event through this buffer. From db869dee60f74ebaf6a590fecb5cb233fcd87821 Mon Sep 17 00:00:00 2001 From: Andrea Terzolo Date: Wed, 6 Nov 2024 17:10:56 +0100 Subject: [PATCH 4/9] cleanup: simplify droppping logic for tracepoint Signed-off-by: Andrea Terzolo --- driver/modern_bpf/helpers/base/maps_getters.h | 5 -- .../helpers/interfaces/attached_programs.h | 19 +---- driver/modern_bpf/maps/maps.h | 9 -- .../attached/dispatchers/syscall_enter.bpf.c | 2 +- .../attached/dispatchers/syscall_exit.bpf.c | 2 +- .../attached/events/page_fault_kernel.bpf.c | 3 +- .../attached/events/page_fault_user.bpf.c | 3 +- .../attached/events/sched_switch.bpf.c | 82 ++++++++++++++++++- .../attached/events/signal_deliver.bpf.c | 3 +- userspace/libpman/src/maps.c | 10 --- 10 files changed, 91 insertions(+), 47 deletions(-) diff --git a/driver/modern_bpf/helpers/base/maps_getters.h b/driver/modern_bpf/helpers/base/maps_getters.h index 2dc3477a5e..a71f7108fc 100644 --- a/driver/modern_bpf/helpers/base/maps_getters.h +++ b/driver/modern_bpf/helpers/base/maps_getters.h @@ -85,11 +85,6 @@ static __always_inline uint8_t maps__64bit_sampling_syscall_table(uint32_t sysca return g_64bit_sampling_syscall_table[syscall_id & (SYSCALL_TABLE_SIZE - 1)]; } -static __always_inline uint8_t maps__64bit_sampling_tracepoint_table(uint32_t event_id) { - return g_64bit_sampling_tracepoint_table[event_id < PPM_EVENT_MAX ? event_id - : PPM_EVENT_MAX - 1]; -} - /*=============================== SAMPLING TABLES ===========================*/ /*=============================== SYSCALL-64 INTERESTING TABLE ===========================*/ diff --git a/driver/modern_bpf/helpers/interfaces/attached_programs.h b/driver/modern_bpf/helpers/interfaces/attached_programs.h index cde3053481..488bfa3caa 100644 --- a/driver/modern_bpf/helpers/interfaces/attached_programs.h +++ b/driver/modern_bpf/helpers/interfaces/attached_programs.h @@ -10,17 +10,11 @@ #include -/* This enum is used to tell if we are considering a syscall or a tracepoint */ -enum intrumentation_type { - MODERN_BPF_SYSCALL = 0, - MODERN_BPF_TRACEPOINT = 1, -}; - /* The sampling logic is used by all BPF programs attached to the kernel. * We treat the syscalls tracepoints in a dedicated way because they could generate * more than one event (1 for each syscall) for this reason we need a dedicated table. */ -static __always_inline bool sampling_logic(void* ctx, uint32_t id, enum intrumentation_type type) { +static __always_inline bool sampling_logic(void* ctx, uint32_t id) { /* If dropping mode is not enabled we don't perform any sampling * false: means don't drop the syscall * true: means drop the syscall @@ -29,16 +23,7 @@ static __always_inline bool sampling_logic(void* ctx, uint32_t id, enum intrumen return false; } - uint8_t sampling_flag = 0; - - /* If we have a syscall we use the sampling_syscall_table otherwise - * with tracepoints we use the sampling_tracepoint_table. - */ - if(type == MODERN_BPF_SYSCALL) { - sampling_flag = maps__64bit_sampling_syscall_table(id); - } else { - sampling_flag = maps__64bit_sampling_tracepoint_table(id); - } + uint8_t sampling_flag = maps__64bit_sampling_syscall_table(id); if(sampling_flag == UF_NEVER_DROP) { return false; diff --git a/driver/modern_bpf/maps/maps.h b/driver/modern_bpf/maps/maps.h index ecd77f04d9..c2ecfe22ff 100644 --- a/driver/modern_bpf/maps/maps.h +++ b/driver/modern_bpf/maps/maps.h @@ -65,15 +65,6 @@ __weak bool g_64bit_interesting_syscalls_table[SYSCALL_TABLE_SIZE]; */ __weak uint8_t g_64bit_sampling_syscall_table[SYSCALL_TABLE_SIZE]; -/** - * @brief Given the tracepoint enum returns: - * - `UF_NEVER_DROP` if the syscall must not be dropped in the sampling logic. - * - `UF_ALWAYS_DROP` if the syscall must always be dropped in the sampling logic. - * - `UF_NONE` if we drop the syscall depends on the sampling ratio. - */ -/// TOOD: we need to change the dimension! we need to create a dedicated enum for tracepoints! -__weak uint8_t g_64bit_sampling_tracepoint_table[PPM_EVENT_MAX]; - /** * @brief Given the syscall id on 32-bit x86 arch returns * its x64 value. Used to support ia32 syscall emulation. diff --git a/driver/modern_bpf/programs/attached/dispatchers/syscall_enter.bpf.c b/driver/modern_bpf/programs/attached/dispatchers/syscall_enter.bpf.c index 7732b738e2..0bc17f1702 100644 --- a/driver/modern_bpf/programs/attached/dispatchers/syscall_enter.bpf.c +++ b/driver/modern_bpf/programs/attached/dispatchers/syscall_enter.bpf.c @@ -49,7 +49,7 @@ int BPF_PROG(sys_enter, struct pt_regs *regs, long syscall_id) { return 0; } - if(sampling_logic(ctx, syscall_id, MODERN_BPF_SYSCALL)) { + if(sampling_logic(ctx, syscall_id)) { return 0; } diff --git a/driver/modern_bpf/programs/attached/dispatchers/syscall_exit.bpf.c b/driver/modern_bpf/programs/attached/dispatchers/syscall_exit.bpf.c index 732cb31b32..cbe1fc33e9 100644 --- a/driver/modern_bpf/programs/attached/dispatchers/syscall_exit.bpf.c +++ b/driver/modern_bpf/programs/attached/dispatchers/syscall_exit.bpf.c @@ -63,7 +63,7 @@ int BPF_PROG(sys_exit, struct pt_regs *regs, long ret) { return 0; } - if(sampling_logic(ctx, syscall_id, MODERN_BPF_SYSCALL)) { + if(sampling_logic(ctx, syscall_id)) { return 0; } diff --git a/driver/modern_bpf/programs/attached/events/page_fault_kernel.bpf.c b/driver/modern_bpf/programs/attached/events/page_fault_kernel.bpf.c index f9576a93da..4e5818f89c 100644 --- a/driver/modern_bpf/programs/attached/events/page_fault_kernel.bpf.c +++ b/driver/modern_bpf/programs/attached/events/page_fault_kernel.bpf.c @@ -16,7 +16,8 @@ #ifdef CAPTURE_PAGE_FAULTS SEC("tp_btf/page_fault_kernel") int BPF_PROG(pf_kernel, unsigned long address, struct pt_regs *regs, unsigned long error_code) { - if(sampling_logic(ctx, PPME_PAGE_FAULT_E, MODERN_BPF_TRACEPOINT)) { + // In case of dropping mode we don't want this kind of events. + if(maps__get_dropping_mode()) { return 0; } diff --git a/driver/modern_bpf/programs/attached/events/page_fault_user.bpf.c b/driver/modern_bpf/programs/attached/events/page_fault_user.bpf.c index c6179c3aea..5178ffa83f 100644 --- a/driver/modern_bpf/programs/attached/events/page_fault_user.bpf.c +++ b/driver/modern_bpf/programs/attached/events/page_fault_user.bpf.c @@ -16,7 +16,8 @@ #ifdef CAPTURE_PAGE_FAULTS SEC("tp_btf/page_fault_user") int BPF_PROG(pf_user, unsigned long address, struct pt_regs *regs, unsigned long error_code) { - if(sampling_logic(ctx, PPME_PAGE_FAULT_E, MODERN_BPF_TRACEPOINT)) { + // In case of dropping mode we don't want this kind of events. + if(maps__get_dropping_mode()) { return 0; } diff --git a/driver/modern_bpf/programs/attached/events/sched_switch.bpf.c b/driver/modern_bpf/programs/attached/events/sched_switch.bpf.c index d639edbd7c..60d84820b8 100644 --- a/driver/modern_bpf/programs/attached/events/sched_switch.bpf.c +++ b/driver/modern_bpf/programs/attached/events/sched_switch.bpf.c @@ -9,13 +9,93 @@ #include #include +SEC("tp_btf/sched_switch") +int BPF_PROG(t1_drop_sched_switch_e) { + struct ringbuf_struct ringbuf; + if(!ringbuf__reserve_space(&ringbuf, ctx, DROP_E_SIZE, PPME_DROP_E)) { + return 0; + } + + ringbuf__store_event_header(&ringbuf); + + /*=============================== COLLECT PARAMETERS ===========================*/ + + ringbuf__store_u32(&ringbuf, maps__get_sampling_ratio()); + + /*=============================== COLLECT PARAMETERS ===========================*/ + + ringbuf__submit_event(&ringbuf); + return 0; +} + +SEC("tp_btf/sched_switch") +int BPF_PROG(t1_drop_sched_switch_x) { + struct ringbuf_struct ringbuf; + if(!ringbuf__reserve_space(&ringbuf, ctx, DROP_X_SIZE, PPME_DROP_X)) { + return 0; + } + + ringbuf__store_event_header(&ringbuf); + + /*=============================== COLLECT PARAMETERS ===========================*/ + + ringbuf__store_u32(&ringbuf, maps__get_sampling_ratio()); + + /*=============================== COLLECT PARAMETERS ===========================*/ + + ringbuf__submit_event(&ringbuf); + return 0; +} + +enum extra_sched_proc_exec_codes { + SCHED_SWITCH_DROP_E, + SCHED_SWITCH_DROP_X, +}; + +struct { + __uint(type, BPF_MAP_TYPE_PROG_ARRAY); + __uint(max_entries, 2); + __uint(key_size, sizeof(__u32)); + __array(values, int(void *)); +} sched_switch_drop_calls SEC(".maps") = { + .values = + { + [SCHED_SWITCH_DROP_E] = (void *)&t1_drop_sched_switch_e, + [SCHED_SWITCH_DROP_X] = (void *)&t1_drop_sched_switch_x, + }, +}; + +// todo!: probably we can remove all this logic in the future and just adapt SCHED_SWITCH to +// other tracepoints like signal_deliver +static __always_inline bool sched_switch_sampling_logic(void *ctx) { + if(!maps__get_dropping_mode()) { + return false; + } + + if((bpf_ktime_get_boot_ns() % SECOND_TO_NS) >= (SECOND_TO_NS / maps__get_sampling_ratio())) { + if(!maps__get_is_dropping()) { + maps__set_is_dropping(true); + bpf_tail_call(ctx, &sched_switch_drop_calls, SCHED_SWITCH_DROP_E); + bpf_printk("unable to tail call into 'sched_switch_drop_e' prog"); + } + return true; + } + + if(maps__get_is_dropping()) { + maps__set_is_dropping(false); + bpf_tail_call(ctx, &sched_switch_drop_calls, SCHED_SWITCH_DROP_X); + bpf_printk("unable to tail call into 'sched_switch_drop_x' prog"); + } + return false; +} + /* From linux tree: /include/linux/events/sched.h * TP_PROTO(bool preempt, struct task_struct *prev, * struct task_struct *next) */ SEC("tp_btf/sched_switch") int BPF_PROG(sched_switch, bool preempt, struct task_struct *prev, struct task_struct *next) { - if(sampling_logic(ctx, PPME_SCHEDSWITCH_6_E, MODERN_BPF_TRACEPOINT)) { + if(sched_switch_sampling_logic(ctx)) { return 0; } diff --git a/driver/modern_bpf/programs/attached/events/signal_deliver.bpf.c b/driver/modern_bpf/programs/attached/events/signal_deliver.bpf.c index 4b455eca05..9ff90d6528 100644 --- a/driver/modern_bpf/programs/attached/events/signal_deliver.bpf.c +++ b/driver/modern_bpf/programs/attached/events/signal_deliver.bpf.c @@ -14,7 +14,8 @@ */ SEC("tp_btf/signal_deliver") int BPF_PROG(signal_deliver, int sig, struct kernel_siginfo *info, struct k_sigaction *ka) { - if(sampling_logic(ctx, PPME_SIGNALDELIVER_E, MODERN_BPF_TRACEPOINT)) { + // In case of dropping mode we don't want this kind of events. + if(maps__get_dropping_mode()) { return 0; } diff --git a/userspace/libpman/src/maps.c b/userspace/libpman/src/maps.c index 0229119747..58478d29b3 100644 --- a/userspace/libpman/src/maps.c +++ b/userspace/libpman/src/maps.c @@ -120,15 +120,6 @@ void pman_fill_syscall_sampling_table() { } } -void pman_fill_syscall_tracepoint_table() { - /* Right now these are the only 2 tracepoints involved in the dropping logic. We need to add - * them here */ - g_state.skel->bss->g_64bit_sampling_tracepoint_table[PPME_PROCEXIT_1_E] = UF_NEVER_DROP; - g_state.skel->bss->g_64bit_sampling_tracepoint_table[PPME_SCHEDSWITCH_6_E] = 0; - g_state.skel->bss->g_64bit_sampling_tracepoint_table[PPME_PAGE_FAULT_E] = UF_ALWAYS_DROP; - g_state.skel->bss->g_64bit_sampling_tracepoint_table[PPME_SIGNALDELIVER_E] = UF_ALWAYS_DROP; -} - void pman_fill_ia32_to_64_table() { for(int syscall_id = 0; syscall_id < SYSCALL_TABLE_SIZE; syscall_id++) { // Note: we will map all syscalls from the upper limit of the ia32 table @@ -339,7 +330,6 @@ int pman_finalize_maps_after_loading() { /* We have to fill all ours tail tables. */ pman_fill_syscall_sampling_table(); - pman_fill_syscall_tracepoint_table(); pman_fill_ia32_to_64_table(); err = pman_fill_syscalls_tail_table(); err = err ?: pman_fill_extra_event_prog_tail_table(); From abd088df0dc434114f11b161163043d1ff76061f Mon Sep 17 00:00:00 2001 From: Andrea Terzolo Date: Wed, 6 Nov 2024 17:15:26 +0100 Subject: [PATCH 5/9] update: set sched_switch as UF_ALWAYS_DROP Signed-off-by: Andrea Terzolo --- driver/bpf/probe.c | 2 +- driver/main.c | 2 +- .../attached/events/sched_switch.bpf.c | 83 +------------------ 3 files changed, 4 insertions(+), 83 deletions(-) diff --git a/driver/bpf/probe.c b/driver/bpf/probe.c index 19b36b0c6d..48237f844c 100644 --- a/driver/bpf/probe.c +++ b/driver/bpf/probe.c @@ -253,7 +253,7 @@ BPF_PROBE("sched/", sched_switch, sched_switch_args) { evt_type = PPME_SCHEDSWITCH_6_E; - call_filler(ctx, ctx, evt_type, 0, -1); + call_filler(ctx, ctx, evt_type, UF_ALWAYS_DROP, -1); return 0; } diff --git a/driver/main.c b/driver/main.c index 9d4cea6381..93e33f5951 100644 --- a/driver/main.c +++ b/driver/main.c @@ -2393,7 +2393,7 @@ TRACEPOINT_PROBE(sched_switch_probe, * handler calling printk() and potentially deadlocking the system. */ record_event_all_consumers(PPME_SCHEDSWITCH_6_E, - UF_USED | UF_ATOMIC, + UF_ALWAYS_DROP | UF_ATOMIC, &event_data, KMOD_PROG_SCHED_SWITCH); } diff --git a/driver/modern_bpf/programs/attached/events/sched_switch.bpf.c b/driver/modern_bpf/programs/attached/events/sched_switch.bpf.c index 60d84820b8..122a64f9d1 100644 --- a/driver/modern_bpf/programs/attached/events/sched_switch.bpf.c +++ b/driver/modern_bpf/programs/attached/events/sched_switch.bpf.c @@ -9,93 +9,14 @@ #include #include -SEC("tp_btf/sched_switch") -int BPF_PROG(t1_drop_sched_switch_e) { - struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, DROP_E_SIZE, PPME_DROP_E)) { - return 0; - } - - ringbuf__store_event_header(&ringbuf); - - /*=============================== COLLECT PARAMETERS ===========================*/ - - ringbuf__store_u32(&ringbuf, maps__get_sampling_ratio()); - - /*=============================== COLLECT PARAMETERS ===========================*/ - - ringbuf__submit_event(&ringbuf); - return 0; -} - -SEC("tp_btf/sched_switch") -int BPF_PROG(t1_drop_sched_switch_x) { - struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, DROP_X_SIZE, PPME_DROP_X)) { - return 0; - } - - ringbuf__store_event_header(&ringbuf); - - /*=============================== COLLECT PARAMETERS ===========================*/ - - ringbuf__store_u32(&ringbuf, maps__get_sampling_ratio()); - - /*=============================== COLLECT PARAMETERS ===========================*/ - - ringbuf__submit_event(&ringbuf); - return 0; -} - -enum extra_sched_proc_exec_codes { - SCHED_SWITCH_DROP_E, - SCHED_SWITCH_DROP_X, -}; - -struct { - __uint(type, BPF_MAP_TYPE_PROG_ARRAY); - __uint(max_entries, 2); - __uint(key_size, sizeof(__u32)); - __array(values, int(void *)); -} sched_switch_drop_calls SEC(".maps") = { - .values = - { - [SCHED_SWITCH_DROP_E] = (void *)&t1_drop_sched_switch_e, - [SCHED_SWITCH_DROP_X] = (void *)&t1_drop_sched_switch_x, - }, -}; - -// todo!: probably we can remove all this logic in the future and just adapt SCHED_SWITCH to -// other tracepoints like signal_deliver -static __always_inline bool sched_switch_sampling_logic(void *ctx) { - if(!maps__get_dropping_mode()) { - return false; - } - - if((bpf_ktime_get_boot_ns() % SECOND_TO_NS) >= (SECOND_TO_NS / maps__get_sampling_ratio())) { - if(!maps__get_is_dropping()) { - maps__set_is_dropping(true); - bpf_tail_call(ctx, &sched_switch_drop_calls, SCHED_SWITCH_DROP_E); - bpf_printk("unable to tail call into 'sched_switch_drop_e' prog"); - } - return true; - } - - if(maps__get_is_dropping()) { - maps__set_is_dropping(false); - bpf_tail_call(ctx, &sched_switch_drop_calls, SCHED_SWITCH_DROP_X); - bpf_printk("unable to tail call into 'sched_switch_drop_x' prog"); - } - return false; -} - /* From linux tree: /include/linux/events/sched.h * TP_PROTO(bool preempt, struct task_struct *prev, * struct task_struct *next) */ SEC("tp_btf/sched_switch") int BPF_PROG(sched_switch, bool preempt, struct task_struct *prev, struct task_struct *next) { - if(sched_switch_sampling_logic(ctx)) { + // In case of dropping mode we don't want this kind of events. + if(maps__get_dropping_mode()) { return 0; } From 44c96080e699f23bce38ec5ac200567f3ec34cb6 Mon Sep 17 00:00:00 2001 From: Andrea Terzolo Date: Wed, 6 Nov 2024 17:39:49 +0100 Subject: [PATCH 6/9] cleanup: rename some methods Signed-off-by: Andrea Terzolo --- .../helpers/interfaces/attached_programs.h | 4 ++-- driver/modern_bpf/maps/maps.h | 4 ++-- .../attached/dispatchers/syscall_exit.bpf.c | 2 +- .../events/syscall_dispatched_events/clone.bpf.c | 4 ++-- .../events/syscall_dispatched_events/clone3.bpf.c | 4 ++-- .../events/syscall_dispatched_events/execve.bpf.c | 4 ++-- .../events/syscall_dispatched_events/execveat.bpf.c | 4 ++-- .../events/syscall_dispatched_events/fork.bpf.c | 4 ++-- .../open_by_handle_at.bpf.c | 2 +- .../events/syscall_dispatched_events/vfork.bpf.c | 4 ++-- driver/ppm_events_public.h | 3 +-- userspace/libpman/include/libpman.h | 8 ++++---- userspace/libpman/src/maps.c | 13 ++++++------- 13 files changed, 29 insertions(+), 31 deletions(-) diff --git a/driver/modern_bpf/helpers/interfaces/attached_programs.h b/driver/modern_bpf/helpers/interfaces/attached_programs.h index 488bfa3caa..77299e1c03 100644 --- a/driver/modern_bpf/helpers/interfaces/attached_programs.h +++ b/driver/modern_bpf/helpers/interfaces/attached_programs.h @@ -44,7 +44,7 @@ static __always_inline bool sampling_logic(void* ctx, uint32_t id) { * an iteration we will synchronize again the next time the logic is enabled. */ maps__set_is_dropping(true); - bpf_tail_call(ctx, &extra_event_prog_tail_table, T1_DROP_E); + bpf_tail_call(ctx, &extra_syscall_calls, T1_DROP_E); bpf_printk("unable to tail call into 'drop_e' prog"); } return true; @@ -52,7 +52,7 @@ static __always_inline bool sampling_logic(void* ctx, uint32_t id) { if(maps__get_is_dropping()) { maps__set_is_dropping(false); - bpf_tail_call(ctx, &extra_event_prog_tail_table, T1_DROP_X); + bpf_tail_call(ctx, &extra_syscall_calls, T1_DROP_X); bpf_printk("unable to tail call into 'drop_x' prog"); } diff --git a/driver/modern_bpf/maps/maps.h b/driver/modern_bpf/maps/maps.h index c2ecfe22ff..59cdb3dd54 100644 --- a/driver/modern_bpf/maps/maps.h +++ b/driver/modern_bpf/maps/maps.h @@ -122,7 +122,7 @@ struct { * programs directly attached in the kernel (like page_faults, * context_switch, ...) and by syscall_events (like * ppme_syscall_execveat_x, ...). - * Given a predefined tail-code (`extra_event_prog_code`), it calls + * Given a predefined tail-code (`extra_syscall_codes`), it calls * the right bpf program. */ struct { @@ -130,7 +130,7 @@ struct { __uint(max_entries, TAIL_EXTRA_EVENT_PROG_MAX); __type(key, uint32_t); __type(value, uint32_t); -} extra_event_prog_tail_table __weak SEC(".maps"); +} extra_syscall_calls __weak SEC(".maps"); /*=============================== BPF_MAP_TYPE_PROG_ARRAY ===============================*/ diff --git a/driver/modern_bpf/programs/attached/dispatchers/syscall_exit.bpf.c b/driver/modern_bpf/programs/attached/dispatchers/syscall_exit.bpf.c index cbe1fc33e9..9355466f7e 100644 --- a/driver/modern_bpf/programs/attached/dispatchers/syscall_exit.bpf.c +++ b/driver/modern_bpf/programs/attached/dispatchers/syscall_exit.bpf.c @@ -76,7 +76,7 @@ int BPF_PROG(sys_exit, struct pt_regs *regs, long ret) { // we change our architecture we may need to update this logic. struct ringbuf_map *rb = maps__get_ringbuf_map(); if(!rb) { - bpf_tail_call(ctx, &extra_event_prog_tail_table, T1_HOTPLUG_E); + bpf_tail_call(ctx, &extra_syscall_calls, T1_HOTPLUG_E); bpf_printk("failed to tail call into the 'hotplug' prog"); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/clone.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/clone.bpf.c index 682566b755..91a6ae9355 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/clone.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/clone.bpf.c @@ -150,7 +150,7 @@ int BPF_PROG(clone_x, struct pt_regs *regs, long ret) { /* We have to split here the bpf program, otherwise, it is too large * for the verifier (limit 1000000 instructions). */ - bpf_tail_call(ctx, &extra_event_prog_tail_table, T1_CLONE_X); + bpf_tail_call(ctx, &extra_syscall_calls, T1_CLONE_X); return 0; } @@ -206,7 +206,7 @@ int BPF_PROG(t1_clone_x, struct pt_regs *regs, long ret) { /* We have to split here the bpf program, otherwise, it is too large * for the verifier (limit 1000000 instructions). */ - bpf_tail_call(ctx, &extra_event_prog_tail_table, T2_CLONE_X); + bpf_tail_call(ctx, &extra_syscall_calls, T2_CLONE_X); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/clone3.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/clone3.bpf.c index c87ffec713..b74a354d44 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/clone3.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/clone3.bpf.c @@ -150,7 +150,7 @@ int BPF_PROG(clone3_x, struct pt_regs *regs, long ret) { /* We have to split here the bpf program, otherwise, it is too large * for the verifier (limit 1000000 instructions). */ - bpf_tail_call(ctx, &extra_event_prog_tail_table, T1_CLONE3_X); + bpf_tail_call(ctx, &extra_syscall_calls, T1_CLONE3_X); return 0; } @@ -204,7 +204,7 @@ int BPF_PROG(t1_clone3_x, struct pt_regs *regs, long ret) { /* We have to split here the bpf program, otherwise, it is too large * for the verifier (limit 1000000 instructions). */ - bpf_tail_call(ctx, &extra_event_prog_tail_table, T2_CLONE3_X); + bpf_tail_call(ctx, &extra_syscall_calls, T2_CLONE3_X); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c index 693118b395..d2f5582459 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c @@ -155,7 +155,7 @@ int BPF_PROG(execve_x, struct pt_regs *regs, long ret) { /* We have to split here the bpf program, otherwise, it is too large * for the verifier (limit 1000000 instructions). */ - bpf_tail_call(ctx, &extra_event_prog_tail_table, T1_EXECVE_X); + bpf_tail_call(ctx, &extra_syscall_calls, T1_EXECVE_X); return 0; } @@ -284,7 +284,7 @@ int BPF_PROG(t1_execve_x, struct pt_regs *regs, long ret) { /*=============================== COLLECT PARAMETERS ===========================*/ - bpf_tail_call(ctx, &extra_event_prog_tail_table, T2_EXECVE_X); + bpf_tail_call(ctx, &extra_syscall_calls, T2_EXECVE_X); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execveat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execveat.bpf.c index 6776314bc7..b6d80a65fe 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execveat.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execveat.bpf.c @@ -168,7 +168,7 @@ int BPF_PROG(execveat_x, struct pt_regs *regs, long ret) { /* We have to split here the bpf program, otherwise it is too large * for the verifier (limit 1000000 instructions). */ - bpf_tail_call(ctx, &extra_event_prog_tail_table, T1_EXECVEAT_X); + bpf_tail_call(ctx, &extra_syscall_calls, T1_EXECVEAT_X); return 0; } @@ -296,7 +296,7 @@ int BPF_PROG(t1_execveat_x, struct pt_regs *regs, long ret) { /*=============================== COLLECT PARAMETERS ===========================*/ - bpf_tail_call(ctx, &extra_event_prog_tail_table, T2_EXECVEAT_X); + bpf_tail_call(ctx, &extra_syscall_calls, T2_EXECVEAT_X); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fork.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fork.bpf.c index 87d870fb08..2a1241def0 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fork.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fork.bpf.c @@ -152,7 +152,7 @@ int BPF_PROG(fork_x, struct pt_regs *regs, long ret) { /* We have to split here the bpf program, otherwise, it is too large * for the verifier (limit 1000000 instructions). */ - bpf_tail_call(ctx, &extra_event_prog_tail_table, T1_FORK_X); + bpf_tail_call(ctx, &extra_syscall_calls, T1_FORK_X); return 0; } @@ -198,7 +198,7 @@ int BPF_PROG(t1_fork_x, struct pt_regs *regs, long ret) { /* We have to split here the bpf program, otherwise, it is too large * for the verifier (limit 1000000 instructions). */ - bpf_tail_call(ctx, &extra_event_prog_tail_table, T2_FORK_X); + bpf_tail_call(ctx, &extra_syscall_calls, T2_FORK_X); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/open_by_handle_at.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/open_by_handle_at.bpf.c index da09ec6e1b..45c21c3896 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/open_by_handle_at.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/open_by_handle_at.bpf.c @@ -61,7 +61,7 @@ int BPF_PROG(open_by_handle_at_x, struct pt_regs *regs, long ret) { /*=============================== COLLECT PARAMETERS ===========================*/ - bpf_tail_call(ctx, &extra_event_prog_tail_table, T1_OPEN_BY_HANDLE_AT_X); + bpf_tail_call(ctx, &extra_syscall_calls, T1_OPEN_BY_HANDLE_AT_X); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/vfork.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/vfork.bpf.c index 544d5ebffd..d6201142eb 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/vfork.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/vfork.bpf.c @@ -150,7 +150,7 @@ int BPF_PROG(vfork_x, struct pt_regs *regs, long ret) { /* We have to split here the bpf program, otherwise, it is too large * for the verifier (limit 1000000 instructions). */ - bpf_tail_call(ctx, &extra_event_prog_tail_table, T1_VFORK_X); + bpf_tail_call(ctx, &extra_syscall_calls, T1_VFORK_X); return 0; } @@ -196,7 +196,7 @@ int BPF_PROG(t1_vfork_x, struct pt_regs *regs, long ret) { /* We have to split here the bpf program, otherwise, it is too large * for the verifier (limit 1000000 instructions). */ - bpf_tail_call(ctx, &extra_event_prog_tail_table, T2_VFORK_X); + bpf_tail_call(ctx, &extra_syscall_calls, T2_VFORK_X); return 0; } diff --git a/driver/ppm_events_public.h b/driver/ppm_events_public.h index e85e566f5b..06e5255ab8 100644 --- a/driver/ppm_events_public.h +++ b/driver/ppm_events_public.h @@ -1525,8 +1525,7 @@ typedef enum { * - `X` = means that we need this extra tail call for the exit event, `E` means enter the event. * */ -// todo!: rename this `extra_syscall_exit_calls`. -enum extra_event_prog_code { +enum extra_syscall_codes { T1_EXECVE_X = 0, T1_EXECVEAT_X = 1, T1_CLONE_X = 2, diff --git a/userspace/libpman/include/libpman.h b/userspace/libpman/include/libpman.h index 00c9f8212f..b916bb6164 100644 --- a/userspace/libpman/include/libpman.h +++ b/userspace/libpman/include/libpman.h @@ -398,17 +398,17 @@ uint64_t pman_get_probe_schema_ver(void); /** * @brief Some bpf programs exceed the maximum complexity * so they have to tail-call other programs. To do that, they - * need a particular tail table that we call `extra_event_prog_tail_table`. + * need a particular tail table that we call `extra_syscall_calls`. * * -> EXTRA EVENT PROG TAIL TABLE - * extra_event_prog_tail_table(extra_event_prog_code, program_fd). + * extra_syscall_calls(extra_syscall_codes, program_fd). * - * `extra_event_prog_code` is an enum defined in + * `extra_syscall_codes` is an enum defined in * `/driver/ppm_events_public.h` * * @return `0` on success, `errno` in case of error. */ -int pman_fill_extra_event_prog_tail_table(void); +int pman_fill_extra_syscall_calls_table(void); /** * @brief The syscall dispatchers will look into these tables diff --git a/userspace/libpman/src/maps.c b/userspace/libpman/src/maps.c index 58478d29b3..d3c15529e6 100644 --- a/userspace/libpman/src/maps.c +++ b/userspace/libpman/src/maps.c @@ -249,12 +249,11 @@ int pman_fill_syscalls_tail_table() { return errno; } -int pman_fill_extra_event_prog_tail_table() { - int extra_event_prog_tail_table_fd = 0; +int pman_fill_extra_syscall_calls_table() { + int extra_syscall_call_table_fd = bpf_map__fd(g_state.skel->maps.extra_syscall_calls); const char* tail_prog_name; - extra_event_prog_tail_table_fd = bpf_map__fd(g_state.skel->maps.extra_event_prog_tail_table); - if(extra_event_prog_tail_table_fd <= 0) { + if(extra_syscall_call_table_fd <= 0) { pman_print_error("unable to get the extra event programs tail table"); return errno; } @@ -266,8 +265,8 @@ int pman_fill_extra_event_prog_tail_table() { continue; } - if(add_bpf_program_to_tail_table(extra_event_prog_tail_table_fd, tail_prog_name, j)) { - close(extra_event_prog_tail_table_fd); + if(add_bpf_program_to_tail_table(extra_syscall_call_table_fd, tail_prog_name, j)) { + close(extra_syscall_call_table_fd); return errno; } } @@ -332,6 +331,6 @@ int pman_finalize_maps_after_loading() { pman_fill_syscall_sampling_table(); pman_fill_ia32_to_64_table(); err = pman_fill_syscalls_tail_table(); - err = err ?: pman_fill_extra_event_prog_tail_table(); + err = err ?: pman_fill_extra_syscall_calls_table(); return err; } From fa0b323701bb75f63165cebc2186d171d473ece5 Mon Sep 17 00:00:00 2001 From: Andrea Terzolo Date: Wed, 6 Nov 2024 18:04:46 +0100 Subject: [PATCH 7/9] cleanup: don't initialize enums if not needed Signed-off-by: Andrea Terzolo --- driver/ppm_events_public.h | 35 ++++++++++++++++++----------------- userspace/libpman/src/maps.c | 6 +++--- 2 files changed, 21 insertions(+), 20 deletions(-) diff --git a/driver/ppm_events_public.h b/driver/ppm_events_public.h index 06e5255ab8..2a6d9fca43 100644 --- a/driver/ppm_events_public.h +++ b/driver/ppm_events_public.h @@ -1526,23 +1526,24 @@ typedef enum { * */ enum extra_syscall_codes { - T1_EXECVE_X = 0, - T1_EXECVEAT_X = 1, - T1_CLONE_X = 2, - T1_CLONE3_X = 3, - T1_FORK_X = 4, - T1_VFORK_X = 5, - T2_CLONE_X = 9, - T2_CLONE3_X = 10, - T2_FORK_X = 11, - T2_VFORK_X = 12, - T1_DROP_E = 13, - T1_DROP_X = 14, - T1_HOTPLUG_E = 15, - T1_OPEN_BY_HANDLE_AT_X = 16, - T2_EXECVE_X = 17, - T2_EXECVEAT_X = 18, - TAIL_EXTRA_EVENT_PROG_MAX = 20 + T1_EXECVE_X, + T1_EXECVEAT_X, + T1_CLONE_X, + T1_CLONE3_X, + T1_FORK_X, + T1_VFORK_X, + T2_CLONE_X, + T2_CLONE3_X, + T2_FORK_X, + T2_VFORK_X, + T1_DROP_E, + T1_DROP_X, + T1_HOTPLUG_E, + T1_OPEN_BY_HANDLE_AT_X, + T2_EXECVE_X, + T2_EXECVEAT_X, + // Add new codes here... + TAIL_EXTRA_EVENT_PROG_MAX, }; /* diff --git a/userspace/libpman/src/maps.c b/userspace/libpman/src/maps.c index d3c15529e6..759e43cd8d 100644 --- a/userspace/libpman/src/maps.c +++ b/userspace/libpman/src/maps.c @@ -251,18 +251,18 @@ int pman_fill_syscalls_tail_table() { int pman_fill_extra_syscall_calls_table() { int extra_syscall_call_table_fd = bpf_map__fd(g_state.skel->maps.extra_syscall_calls); - const char* tail_prog_name; - if(extra_syscall_call_table_fd <= 0) { pman_print_error("unable to get the extra event programs tail table"); return errno; } + const char* tail_prog_name = NULL; for(int j = 0; j < TAIL_EXTRA_EVENT_PROG_MAX; j++) { tail_prog_name = extra_event_prog_names[j]; if(!tail_prog_name) { - continue; + pman_print_error("unknown entry in the extra event programs tail table"); + return -1; } if(add_bpf_program_to_tail_table(extra_syscall_call_table_fd, tail_prog_name, j)) { From a3a3f65e3a7972da26c8f14b45cd073e682611ae Mon Sep 17 00:00:00 2001 From: Andrea Terzolo Date: Wed, 6 Nov 2024 18:11:38 +0100 Subject: [PATCH 8/9] cleanup: remove `ctx` Signed-off-by: Andrea Terzolo --- driver/modern_bpf/helpers/store/auxmap_store_params.h | 4 +--- driver/modern_bpf/helpers/store/ringbuf_store_params.h | 3 --- .../programs/attached/events/page_fault_kernel.bpf.c | 2 +- .../programs/attached/events/page_fault_user.bpf.c | 2 +- .../programs/attached/events/sched_process_exec.bpf.c | 2 +- .../programs/attached/events/sched_process_exit.bpf.c | 2 +- .../programs/attached/events/sched_process_fork.bpf.c | 2 +- .../programs/attached/events/sched_switch.bpf.c | 2 +- .../programs/attached/events/signal_deliver.bpf.c | 2 +- .../tail_called/events/custom_logic/drop.bpf.c | 4 ++-- .../events/syscall_dispatched_events/accept.bpf.c | 4 ++-- .../events/syscall_dispatched_events/accept4.bpf.c | 4 ++-- .../events/syscall_dispatched_events/access.bpf.c | 4 ++-- .../events/syscall_dispatched_events/bind.bpf.c | 4 ++-- .../events/syscall_dispatched_events/bpf.bpf.c | 4 ++-- .../events/syscall_dispatched_events/brk.bpf.c | 4 ++-- .../events/syscall_dispatched_events/capset.bpf.c | 4 ++-- .../events/syscall_dispatched_events/chdir.bpf.c | 4 ++-- .../events/syscall_dispatched_events/chmod.bpf.c | 4 ++-- .../events/syscall_dispatched_events/chown.bpf.c | 4 ++-- .../events/syscall_dispatched_events/chroot.bpf.c | 4 ++-- .../events/syscall_dispatched_events/clone.bpf.c | 4 ++-- .../events/syscall_dispatched_events/clone3.bpf.c | 4 ++-- .../events/syscall_dispatched_events/close.bpf.c | 4 ++-- .../events/syscall_dispatched_events/connect.bpf.c | 4 ++-- .../syscall_dispatched_events/copy_file_range.bpf.c | 7 ++----- .../events/syscall_dispatched_events/creat.bpf.c | 4 ++-- .../syscall_dispatched_events/delete_module.bpf.c | 4 ++-- .../events/syscall_dispatched_events/dup.bpf.c | 4 ++-- .../events/syscall_dispatched_events/dup2.bpf.c | 4 ++-- .../events/syscall_dispatched_events/dup3.bpf.c | 4 ++-- .../syscall_dispatched_events/epoll_create.bpf.c | 4 ++-- .../syscall_dispatched_events/epoll_create1.bpf.c | 4 ++-- .../events/syscall_dispatched_events/epoll_wait.bpf.c | 4 ++-- .../events/syscall_dispatched_events/eventfd.bpf.c | 4 ++-- .../events/syscall_dispatched_events/eventfd2.bpf.c | 4 ++-- .../events/syscall_dispatched_events/execve.bpf.c | 4 ++-- .../events/syscall_dispatched_events/execveat.bpf.c | 4 ++-- .../events/syscall_dispatched_events/fchdir.bpf.c | 4 ++-- .../events/syscall_dispatched_events/fchmod.bpf.c | 4 ++-- .../events/syscall_dispatched_events/fchmodat.bpf.c | 4 ++-- .../events/syscall_dispatched_events/fchown.bpf.c | 4 ++-- .../events/syscall_dispatched_events/fchownat.bpf.c | 4 ++-- .../events/syscall_dispatched_events/fcntl.bpf.c | 4 ++-- .../syscall_dispatched_events/finit_module.bpf.c | 4 ++-- .../events/syscall_dispatched_events/flock.bpf.c | 4 ++-- .../events/syscall_dispatched_events/fork.bpf.c | 4 ++-- .../events/syscall_dispatched_events/fsconfig.bpf.c | 4 ++-- .../events/syscall_dispatched_events/fstat.bpf.c | 4 ++-- .../events/syscall_dispatched_events/futex.bpf.c | 4 ++-- .../events/syscall_dispatched_events/generic.bpf.c | 4 ++-- .../events/syscall_dispatched_events/getcwd.bpf.c | 4 ++-- .../events/syscall_dispatched_events/getdents.bpf.c | 4 ++-- .../events/syscall_dispatched_events/getdents64.bpf.c | 4 ++-- .../events/syscall_dispatched_events/getegid.bpf.c | 4 ++-- .../events/syscall_dispatched_events/geteuid.bpf.c | 4 ++-- .../events/syscall_dispatched_events/getgid.bpf.c | 4 ++-- .../events/syscall_dispatched_events/getpeername.bpf.c | 4 ++-- .../events/syscall_dispatched_events/getresgid.bpf.c | 4 ++-- .../events/syscall_dispatched_events/getresuid.bpf.c | 4 ++-- .../events/syscall_dispatched_events/getrlimit.bpf.c | 4 ++-- .../events/syscall_dispatched_events/getsockname.bpf.c | 4 ++-- .../events/syscall_dispatched_events/getsockopt.bpf.c | 4 ++-- .../events/syscall_dispatched_events/getuid.bpf.c | 4 ++-- .../events/syscall_dispatched_events/init_module.bpf.c | 4 ++-- .../syscall_dispatched_events/inotify_init.bpf.c | 4 ++-- .../syscall_dispatched_events/inotify_init1.bpf.c | 4 ++-- .../syscall_dispatched_events/io_uring_enter.bpf.c | 10 ++-------- .../syscall_dispatched_events/io_uring_register.bpf.c | 2 -- .../syscall_dispatched_events/io_uring_setup.bpf.c | 10 ++-------- .../events/syscall_dispatched_events/ioctl.bpf.c | 4 ++-- .../events/syscall_dispatched_events/kill.bpf.c | 4 ++-- .../events/syscall_dispatched_events/lchown.bpf.c | 4 ++-- .../events/syscall_dispatched_events/link.bpf.c | 4 ++-- .../events/syscall_dispatched_events/linkat.bpf.c | 4 ++-- .../events/syscall_dispatched_events/listen.bpf.c | 4 ++-- .../events/syscall_dispatched_events/llseek.bpf.c | 4 ++-- .../events/syscall_dispatched_events/lseek.bpf.c | 4 ++-- .../events/syscall_dispatched_events/lstat.bpf.c | 4 ++-- .../syscall_dispatched_events/memfd_create.bpf.c | 4 ++-- .../events/syscall_dispatched_events/mkdir.bpf.c | 4 ++-- .../events/syscall_dispatched_events/mkdirat.bpf.c | 4 ++-- .../events/syscall_dispatched_events/mknod.bpf.c | 4 ++-- .../events/syscall_dispatched_events/mknodat.bpf.c | 4 ++-- .../events/syscall_dispatched_events/mlock.bpf.c | 4 ++-- .../events/syscall_dispatched_events/mlock2.bpf.c | 4 ++-- .../events/syscall_dispatched_events/mlockall.bpf.c | 4 ++-- .../events/syscall_dispatched_events/mmap.bpf.c | 4 ++-- .../events/syscall_dispatched_events/mmap2.bpf.c | 4 ++-- .../events/syscall_dispatched_events/mount.bpf.c | 4 ++-- .../events/syscall_dispatched_events/mprotect.bpf.c | 4 ++-- .../events/syscall_dispatched_events/munlock.bpf.c | 4 ++-- .../events/syscall_dispatched_events/munlockall.bpf.c | 4 ++-- .../events/syscall_dispatched_events/munmap.bpf.c | 4 ++-- .../events/syscall_dispatched_events/nanosleep.bpf.c | 4 ++-- .../events/syscall_dispatched_events/newfstatat.bpf.c | 4 ++-- .../events/syscall_dispatched_events/open.bpf.c | 4 ++-- .../syscall_dispatched_events/open_by_handle_at.bpf.c | 3 +-- .../events/syscall_dispatched_events/openat.bpf.c | 4 ++-- .../events/syscall_dispatched_events/openat2.bpf.c | 4 ++-- .../events/syscall_dispatched_events/pidfd_getfd.bpf.c | 4 ++-- .../events/syscall_dispatched_events/pidfd_open.bpf.c | 4 ++-- .../events/syscall_dispatched_events/pipe.bpf.c | 4 ++-- .../events/syscall_dispatched_events/pipe2.bpf.c | 4 ++-- .../events/syscall_dispatched_events/poll.bpf.c | 4 ++-- .../events/syscall_dispatched_events/ppoll.bpf.c | 4 ++-- .../events/syscall_dispatched_events/prctl.bpf.c | 4 ++-- .../events/syscall_dispatched_events/pread64.bpf.c | 4 ++-- .../events/syscall_dispatched_events/preadv.bpf.c | 4 ++-- .../events/syscall_dispatched_events/prlimit64.bpf.c | 4 ++-- .../syscall_dispatched_events/process_vm_readv.bpf.c | 3 +-- .../syscall_dispatched_events/process_vm_writev.bpf.c | 3 +-- .../events/syscall_dispatched_events/ptrace.bpf.c | 4 ++-- .../events/syscall_dispatched_events/pwrite64.bpf.c | 4 ++-- .../events/syscall_dispatched_events/pwritev.bpf.c | 4 ++-- .../events/syscall_dispatched_events/quotactl.bpf.c | 4 ++-- .../events/syscall_dispatched_events/read.bpf.c | 4 ++-- .../events/syscall_dispatched_events/readv.bpf.c | 4 ++-- .../events/syscall_dispatched_events/recv.bpf.c | 4 ++-- .../events/syscall_dispatched_events/recvfrom.bpf.c | 4 ++-- .../events/syscall_dispatched_events/recvmmsg.bpf.c | 4 ++-- .../events/syscall_dispatched_events/recvmsg.bpf.c | 4 ++-- .../events/syscall_dispatched_events/rename.bpf.c | 4 ++-- .../events/syscall_dispatched_events/renameat.bpf.c | 4 ++-- .../events/syscall_dispatched_events/renameat2.bpf.c | 4 ++-- .../events/syscall_dispatched_events/rmdir.bpf.c | 4 ++-- .../events/syscall_dispatched_events/seccomp.bpf.c | 4 ++-- .../events/syscall_dispatched_events/select.bpf.c | 4 ++-- .../events/syscall_dispatched_events/semctl.bpf.c | 4 ++-- .../events/syscall_dispatched_events/semget.bpf.c | 4 ++-- .../events/syscall_dispatched_events/semop.bpf.c | 4 ++-- .../events/syscall_dispatched_events/send.bpf.c | 4 ++-- .../events/syscall_dispatched_events/sendfile.bpf.c | 4 ++-- .../events/syscall_dispatched_events/sendmmsg.bpf.c | 4 ++-- .../events/syscall_dispatched_events/sendmsg.bpf.c | 4 ++-- .../events/syscall_dispatched_events/sendto.bpf.c | 4 ++-- .../events/syscall_dispatched_events/setgid.bpf.c | 4 ++-- .../events/syscall_dispatched_events/setns.bpf.c | 4 ++-- .../events/syscall_dispatched_events/setpgid.bpf.c | 4 ++-- .../events/syscall_dispatched_events/setregid.bpf.c | 4 ++-- .../events/syscall_dispatched_events/setresgid.bpf.c | 4 ++-- .../events/syscall_dispatched_events/setresuid.bpf.c | 4 ++-- .../events/syscall_dispatched_events/setreuid.bpf.c | 4 ++-- .../events/syscall_dispatched_events/setrlimit.bpf.c | 4 ++-- .../events/syscall_dispatched_events/setsid.bpf.c | 4 ++-- .../events/syscall_dispatched_events/setsockopt.bpf.c | 4 ++-- .../events/syscall_dispatched_events/setuid.bpf.c | 4 ++-- .../events/syscall_dispatched_events/shutdown.bpf.c | 4 ++-- .../events/syscall_dispatched_events/signalfd.bpf.c | 4 ++-- .../events/syscall_dispatched_events/signalfd4.bpf.c | 4 ++-- .../events/syscall_dispatched_events/socket.bpf.c | 4 ++-- .../events/syscall_dispatched_events/socketpair.bpf.c | 4 ++-- .../events/syscall_dispatched_events/splice.bpf.c | 4 ++-- .../events/syscall_dispatched_events/stat.bpf.c | 4 ++-- .../events/syscall_dispatched_events/symlink.bpf.c | 4 ++-- .../events/syscall_dispatched_events/symlinkat.bpf.c | 4 ++-- .../events/syscall_dispatched_events/tgkill.bpf.c | 4 ++-- .../syscall_dispatched_events/timerfd_create.bpf.c | 10 ++-------- .../events/syscall_dispatched_events/tkill.bpf.c | 4 ++-- .../events/syscall_dispatched_events/umount.bpf.c | 4 ++-- .../events/syscall_dispatched_events/umount2.bpf.c | 4 ++-- .../events/syscall_dispatched_events/unlink.bpf.c | 4 ++-- .../events/syscall_dispatched_events/unlinkat.bpf.c | 4 ++-- .../events/syscall_dispatched_events/unshare.bpf.c | 4 ++-- .../events/syscall_dispatched_events/userfaultfd.bpf.c | 4 ++-- .../events/syscall_dispatched_events/vfork.bpf.c | 4 ++-- .../events/syscall_dispatched_events/write.bpf.c | 4 ++-- .../events/syscall_dispatched_events/writev.bpf.c | 4 ++-- 168 files changed, 321 insertions(+), 352 deletions(-) diff --git a/driver/modern_bpf/helpers/store/auxmap_store_params.h b/driver/modern_bpf/helpers/store/auxmap_store_params.h index c3d444aedf..6de128c521 100644 --- a/driver/modern_bpf/helpers/store/auxmap_store_params.h +++ b/driver/modern_bpf/helpers/store/auxmap_store_params.h @@ -117,10 +117,8 @@ static __always_inline void auxmap__finalize_event_header(struct auxiliary_map * * of events sent to userspace, otherwise we increment the dropped events. * * @param auxmap pointer to the auxmap in which we have already written the entire event. - * @param ctx BPF prog context */ -// todo!: we need to remove the context because we don't perform any tail call -static __always_inline void auxmap__submit_event(struct auxiliary_map *auxmap, void *ctx) { +static __always_inline void auxmap__submit_event(struct auxiliary_map *auxmap) { struct ringbuf_map *rb = maps__get_ringbuf_map(); if(!rb) { // this should never happen because we check it in sys_enter/sys_exit diff --git a/driver/modern_bpf/helpers/store/ringbuf_store_params.h b/driver/modern_bpf/helpers/store/ringbuf_store_params.h index 1d7708bf6c..135d2e9dfb 100644 --- a/driver/modern_bpf/helpers/store/ringbuf_store_params.h +++ b/driver/modern_bpf/helpers/store/ringbuf_store_params.h @@ -90,13 +90,10 @@ struct ringbuf_struct { * to know the event dimension at compile time. * * @param ringbuf pointer to the `ringbuf_struct` - * @param ctx BPF prog context * @param event_size exact size of the fixed-size event * @return `1` in case of success, `0` in case of failure. */ -// todo!: we need to remove the context because we don't perform any tail call static __always_inline uint32_t ringbuf__reserve_space(struct ringbuf_struct *ringbuf, - void *ctx, uint32_t event_size, uint16_t event_type) { struct ringbuf_map *rb = maps__get_ringbuf_map(); diff --git a/driver/modern_bpf/programs/attached/events/page_fault_kernel.bpf.c b/driver/modern_bpf/programs/attached/events/page_fault_kernel.bpf.c index 4e5818f89c..3ce886d22a 100644 --- a/driver/modern_bpf/programs/attached/events/page_fault_kernel.bpf.c +++ b/driver/modern_bpf/programs/attached/events/page_fault_kernel.bpf.c @@ -22,7 +22,7 @@ int BPF_PROG(pf_kernel, unsigned long address, struct pt_regs *regs, unsigned lo } struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, PAGE_FAULT_SIZE, PPME_PAGE_FAULT_E)) { + if(!ringbuf__reserve_space(&ringbuf, PAGE_FAULT_SIZE, PPME_PAGE_FAULT_E)) { return 0; } diff --git a/driver/modern_bpf/programs/attached/events/page_fault_user.bpf.c b/driver/modern_bpf/programs/attached/events/page_fault_user.bpf.c index 5178ffa83f..98a3416142 100644 --- a/driver/modern_bpf/programs/attached/events/page_fault_user.bpf.c +++ b/driver/modern_bpf/programs/attached/events/page_fault_user.bpf.c @@ -22,7 +22,7 @@ int BPF_PROG(pf_user, unsigned long address, struct pt_regs *regs, unsigned long } struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, PAGE_FAULT_SIZE, PPME_PAGE_FAULT_E)) { + if(!ringbuf__reserve_space(&ringbuf, PAGE_FAULT_SIZE, PPME_PAGE_FAULT_E)) { return 0; } diff --git a/driver/modern_bpf/programs/attached/events/sched_process_exec.bpf.c b/driver/modern_bpf/programs/attached/events/sched_process_exec.bpf.c index 11613adc65..d9fe04e480 100644 --- a/driver/modern_bpf/programs/attached/events/sched_process_exec.bpf.c +++ b/driver/modern_bpf/programs/attached/events/sched_process_exec.bpf.c @@ -295,7 +295,7 @@ int BPF_PROG(t2_sched_p_exec, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/attached/events/sched_process_exit.bpf.c b/driver/modern_bpf/programs/attached/events/sched_process_exit.bpf.c index 9e05b34472..42d6d2f701 100644 --- a/driver/modern_bpf/programs/attached/events/sched_process_exit.bpf.c +++ b/driver/modern_bpf/programs/attached/events/sched_process_exit.bpf.c @@ -201,7 +201,7 @@ int BPF_PROG(sched_proc_exit, struct task_struct *task) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/attached/events/sched_process_fork.bpf.c b/driver/modern_bpf/programs/attached/events/sched_process_fork.bpf.c index 059b5a5646..854104df7b 100644 --- a/driver/modern_bpf/programs/attached/events/sched_process_fork.bpf.c +++ b/driver/modern_bpf/programs/attached/events/sched_process_fork.bpf.c @@ -255,7 +255,7 @@ int BPF_PROG(t2_sched_p_fork, struct task_struct *parent, struct task_struct *ch auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } #endif /* CAPTURE_SCHED_PROC_EXEC */ diff --git a/driver/modern_bpf/programs/attached/events/sched_switch.bpf.c b/driver/modern_bpf/programs/attached/events/sched_switch.bpf.c index 122a64f9d1..a273d7d5ff 100644 --- a/driver/modern_bpf/programs/attached/events/sched_switch.bpf.c +++ b/driver/modern_bpf/programs/attached/events/sched_switch.bpf.c @@ -23,7 +23,7 @@ int BPF_PROG(sched_switch, bool preempt, struct task_struct *prev, struct task_s /// TODO: we could avoid switches from kernel threads to kernel threads (?). struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SCHED_SWITCH_SIZE, PPME_SCHEDSWITCH_6_E)) { + if(!ringbuf__reserve_space(&ringbuf, SCHED_SWITCH_SIZE, PPME_SCHEDSWITCH_6_E)) { return 0; } diff --git a/driver/modern_bpf/programs/attached/events/signal_deliver.bpf.c b/driver/modern_bpf/programs/attached/events/signal_deliver.bpf.c index 9ff90d6528..65c2be8dee 100644 --- a/driver/modern_bpf/programs/attached/events/signal_deliver.bpf.c +++ b/driver/modern_bpf/programs/attached/events/signal_deliver.bpf.c @@ -20,7 +20,7 @@ int BPF_PROG(signal_deliver, int sig, struct kernel_siginfo *info, struct k_siga } struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SIGNAL_DELIVER_SIZE, PPME_SIGNALDELIVER_E)) { + if(!ringbuf__reserve_space(&ringbuf, SIGNAL_DELIVER_SIZE, PPME_SIGNALDELIVER_E)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/custom_logic/drop.bpf.c b/driver/modern_bpf/programs/tail_called/events/custom_logic/drop.bpf.c index 49f90f9f32..ca725ad1be 100644 --- a/driver/modern_bpf/programs/tail_called/events/custom_logic/drop.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/custom_logic/drop.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(t1_drop_e) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, DROP_E_SIZE, PPME_DROP_E)) { + if(!ringbuf__reserve_space(&ringbuf, DROP_E_SIZE, PPME_DROP_E)) { return 0; } @@ -36,7 +36,7 @@ int BPF_PROG(t1_drop_e) { SEC("tp_btf/sys_exit") int BPF_PROG(t1_drop_x) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, DROP_X_SIZE, PPME_DROP_X)) { + if(!ringbuf__reserve_space(&ringbuf, DROP_X_SIZE, PPME_DROP_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/accept.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/accept.bpf.c index 5efa008f14..e51b98855f 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/accept.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/accept.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(accept_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, ACCEPT_E_SIZE, PPME_SOCKET_ACCEPT_5_E)) { + if(!ringbuf__reserve_space(&ringbuf, ACCEPT_E_SIZE, PPME_SOCKET_ACCEPT_5_E)) { return 0; } @@ -105,7 +105,7 @@ int BPF_PROG(accept_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/accept4.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/accept4.bpf.c index 034c015e4b..59f3f20ee3 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/accept4.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/accept4.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(accept4_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, ACCEPT4_E_SIZE, PPME_SOCKET_ACCEPT4_6_E)) { + if(!ringbuf__reserve_space(&ringbuf, ACCEPT4_E_SIZE, PPME_SOCKET_ACCEPT4_6_E)) { return 0; } @@ -109,7 +109,7 @@ int BPF_PROG(accept4_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/access.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/access.bpf.c index fd71693a0c..d1809e94c2 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/access.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/access.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(access_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, ACCESS_E_SIZE, PPME_SYSCALL_ACCESS_E)) { + if(!ringbuf__reserve_space(&ringbuf, ACCESS_E_SIZE, PPME_SYSCALL_ACCESS_E)) { return 0; } @@ -59,7 +59,7 @@ int BPF_PROG(access_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/bind.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/bind.bpf.c index b980be086a..0d106c1eff 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/bind.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/bind.bpf.c @@ -18,7 +18,7 @@ int BPF_PROG(bind_e, struct pt_regs *regs, long id) { extract__network_args(&socket_fd, 1, regs); struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, BIND_E_SIZE, PPME_SOCKET_BIND_E)) { + if(!ringbuf__reserve_space(&ringbuf, BIND_E_SIZE, PPME_SOCKET_BIND_E)) { return 0; } @@ -70,7 +70,7 @@ int BPF_PROG(bind_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/bpf.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/bpf.bpf.c index d13fe1666f..c74045dcd5 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/bpf.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/bpf.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(bpf_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, BPF_E_SIZE, PPME_SYSCALL_BPF_2_E)) { + if(!ringbuf__reserve_space(&ringbuf, BPF_E_SIZE, PPME_SYSCALL_BPF_2_E)) { return 0; } @@ -39,7 +39,7 @@ int BPF_PROG(bpf_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(bpf_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, BPF_X_SIZE, PPME_SYSCALL_BPF_2_X)) { + if(!ringbuf__reserve_space(&ringbuf, BPF_X_SIZE, PPME_SYSCALL_BPF_2_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/brk.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/brk.bpf.c index 679594cd2a..c1810418e5 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/brk.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/brk.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(brk_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, BRK_E_SIZE, PPME_SYSCALL_BRK_4_E)) { + if(!ringbuf__reserve_space(&ringbuf, BRK_E_SIZE, PPME_SYSCALL_BRK_4_E)) { return 0; } @@ -39,7 +39,7 @@ int BPF_PROG(brk_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(brk_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, BRK_X_SIZE, PPME_SYSCALL_BRK_4_X)) { + if(!ringbuf__reserve_space(&ringbuf, BRK_X_SIZE, PPME_SYSCALL_BRK_4_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/capset.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/capset.bpf.c index aec9278646..ea2a11f9f9 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/capset.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/capset.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(capset_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, CAPSET_E_SIZE, PPME_SYSCALL_CAPSET_E)) { + if(!ringbuf__reserve_space(&ringbuf, CAPSET_E_SIZE, PPME_SYSCALL_CAPSET_E)) { return 0; } @@ -37,7 +37,7 @@ int BPF_PROG(capset_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(capset_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, CAPSET_X_SIZE, PPME_SYSCALL_CAPSET_X)) { + if(!ringbuf__reserve_space(&ringbuf, CAPSET_X_SIZE, PPME_SYSCALL_CAPSET_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/chdir.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/chdir.bpf.c index c7a0d52b6d..2054b64327 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/chdir.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/chdir.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(chdir_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, CHDIR_E_SIZE, PPME_SYSCALL_CHDIR_E)) { + if(!ringbuf__reserve_space(&ringbuf, CHDIR_E_SIZE, PPME_SYSCALL_CHDIR_E)) { return 0; } @@ -57,7 +57,7 @@ int BPF_PROG(chdir_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/chmod.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/chmod.bpf.c index c3fe03887f..dc7c726e0f 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/chmod.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/chmod.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(chmod_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, CHMOD_E_SIZE, PPME_SYSCALL_CHMOD_E)) { + if(!ringbuf__reserve_space(&ringbuf, CHMOD_E_SIZE, PPME_SYSCALL_CHMOD_E)) { return 0; } @@ -61,7 +61,7 @@ int BPF_PROG(chmod_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/chown.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/chown.bpf.c index a8aaa7d06f..9af2bd4e82 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/chown.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/chown.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(chown_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, CHOWN_E_SIZE, PPME_SYSCALL_CHOWN_E)) { + if(!ringbuf__reserve_space(&ringbuf, CHOWN_E_SIZE, PPME_SYSCALL_CHOWN_E)) { return 0; } @@ -65,7 +65,7 @@ int BPF_PROG(chown_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/chroot.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/chroot.bpf.c index 0a98215e0a..e8c5fbf2c0 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/chroot.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/chroot.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(chroot_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, CHROOT_E_SIZE, PPME_SYSCALL_CHROOT_E)) { + if(!ringbuf__reserve_space(&ringbuf, CHROOT_E_SIZE, PPME_SYSCALL_CHROOT_E)) { return 0; } @@ -57,7 +57,7 @@ int BPF_PROG(chroot_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/clone.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/clone.bpf.c index 91a6ae9355..c38c3f02c3 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/clone.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/clone.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(clone_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, CLONE_E_SIZE, PPME_SYSCALL_CLONE_20_E)) { + if(!ringbuf__reserve_space(&ringbuf, CLONE_E_SIZE, PPME_SYSCALL_CLONE_20_E)) { return 0; } @@ -228,7 +228,7 @@ int BPF_PROG(t2_clone_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/clone3.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/clone3.bpf.c index b74a354d44..ac8ba9e41a 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/clone3.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/clone3.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(clone3_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, CLONE3_E_SIZE, PPME_SYSCALL_CLONE3_E)) { + if(!ringbuf__reserve_space(&ringbuf, CLONE3_E_SIZE, PPME_SYSCALL_CLONE3_E)) { return 0; } @@ -226,7 +226,7 @@ int BPF_PROG(t2_clone3_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/close.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/close.bpf.c index 93c51c89c8..53bc2375f1 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/close.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/close.bpf.c @@ -42,7 +42,7 @@ int BPF_PROG(close_e, struct pt_regs *regs, long id) { } struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, CLOSE_E_SIZE, PPME_SYSCALL_CLOSE_E)) { + if(!ringbuf__reserve_space(&ringbuf, CLOSE_E_SIZE, PPME_SYSCALL_CLOSE_E)) { return 0; } @@ -72,7 +72,7 @@ int BPF_PROG(close_x, struct pt_regs *regs, long ret) { } struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, CLOSE_X_SIZE, PPME_SYSCALL_CLOSE_X)) { + if(!ringbuf__reserve_space(&ringbuf, CLOSE_X_SIZE, PPME_SYSCALL_CLOSE_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/connect.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/connect.bpf.c index 3e36f4d953..49086e195d 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/connect.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/connect.bpf.c @@ -37,7 +37,7 @@ int BPF_PROG(connect_e, struct pt_regs *regs, long id) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } @@ -81,7 +81,7 @@ int BPF_PROG(connect_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/copy_file_range.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/copy_file_range.bpf.c index 80336c49c3..355bfd2935 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/copy_file_range.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/copy_file_range.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(copy_file_range_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; if(!ringbuf__reserve_space(&ringbuf, - ctx, + COPY_FILE_RANGE_E_SIZE, PPME_SYSCALL_COPY_FILE_RANGE_E)) { return 0; @@ -50,10 +50,7 @@ int BPF_PROG(copy_file_range_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(copy_file_range_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, - ctx, - COPY_FILE_RANGE_X_SIZE, - PPME_SYSCALL_COPY_FILE_RANGE_X)) { + if(!ringbuf__reserve_space(&ringbuf, COPY_FILE_RANGE_X_SIZE, PPME_SYSCALL_COPY_FILE_RANGE_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/creat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/creat.bpf.c index 617c239a75..83fbbacc9f 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/creat.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/creat.bpf.c @@ -33,7 +33,7 @@ int BPF_PROG(creat_e, struct pt_regs *regs, long id) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } @@ -90,7 +90,7 @@ int BPF_PROG(creat_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/delete_module.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/delete_module.bpf.c index da08bff07f..8d17c94bdf 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/delete_module.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/delete_module.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(delete_module_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, DELETE_MODULE_E_SIZE, PPME_SYSCALL_DELETE_MODULE_E)) { + if(!ringbuf__reserve_space(&ringbuf, DELETE_MODULE_E_SIZE, PPME_SYSCALL_DELETE_MODULE_E)) { return 0; } @@ -61,7 +61,7 @@ int BPF_PROG(delete_module_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/dup.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/dup.bpf.c index 301db7ba22..bfa6930df5 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/dup.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/dup.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(dup_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, DUP_E_SIZE, PPME_SYSCALL_DUP_1_E)) { + if(!ringbuf__reserve_space(&ringbuf, DUP_E_SIZE, PPME_SYSCALL_DUP_1_E)) { return 0; } @@ -39,7 +39,7 @@ int BPF_PROG(dup_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(dup_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, DUP_X_SIZE, PPME_SYSCALL_DUP_1_X)) { + if(!ringbuf__reserve_space(&ringbuf, DUP_X_SIZE, PPME_SYSCALL_DUP_1_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/dup2.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/dup2.bpf.c index 54201dbb1a..ca9407e3b5 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/dup2.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/dup2.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(dup2_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, DUP2_E_SIZE, PPME_SYSCALL_DUP2_E)) { + if(!ringbuf__reserve_space(&ringbuf, DUP2_E_SIZE, PPME_SYSCALL_DUP2_E)) { return 0; } @@ -39,7 +39,7 @@ int BPF_PROG(dup2_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(dup2_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, DUP2_X_SIZE, PPME_SYSCALL_DUP2_X)) { + if(!ringbuf__reserve_space(&ringbuf, DUP2_X_SIZE, PPME_SYSCALL_DUP2_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/dup3.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/dup3.bpf.c index 3e833f137c..fda56c7c7b 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/dup3.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/dup3.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(dup3_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, DUP3_E_SIZE, PPME_SYSCALL_DUP3_E)) { + if(!ringbuf__reserve_space(&ringbuf, DUP3_E_SIZE, PPME_SYSCALL_DUP3_E)) { return 0; } @@ -39,7 +39,7 @@ int BPF_PROG(dup3_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(dup3_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, DUP3_X_SIZE, PPME_SYSCALL_DUP3_X)) { + if(!ringbuf__reserve_space(&ringbuf, DUP3_X_SIZE, PPME_SYSCALL_DUP3_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/epoll_create.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/epoll_create.bpf.c index 35f3cde769..e1c8bf373f 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/epoll_create.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/epoll_create.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(epoll_create_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, EPOLL_CREATE_E_SIZE, PPME_SYSCALL_EPOLL_CREATE_E)) { + if(!ringbuf__reserve_space(&ringbuf, EPOLL_CREATE_E_SIZE, PPME_SYSCALL_EPOLL_CREATE_E)) { return 0; } @@ -39,7 +39,7 @@ int BPF_PROG(epoll_create_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(epoll_create_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, EPOLL_CREATE_X_SIZE, PPME_SYSCALL_EPOLL_CREATE_X)) { + if(!ringbuf__reserve_space(&ringbuf, EPOLL_CREATE_X_SIZE, PPME_SYSCALL_EPOLL_CREATE_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/epoll_create1.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/epoll_create1.bpf.c index 159a4b6e6e..adb286afbd 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/epoll_create1.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/epoll_create1.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(epoll_create1_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, EPOLL_CREATE1_E_SIZE, PPME_SYSCALL_EPOLL_CREATE1_E)) { + if(!ringbuf__reserve_space(&ringbuf, EPOLL_CREATE1_E_SIZE, PPME_SYSCALL_EPOLL_CREATE1_E)) { return 0; } @@ -39,7 +39,7 @@ int BPF_PROG(epoll_create1_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(epoll_create1_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, EPOLL_CREATE1_X_SIZE, PPME_SYSCALL_EPOLL_CREATE1_X)) { + if(!ringbuf__reserve_space(&ringbuf, EPOLL_CREATE1_X_SIZE, PPME_SYSCALL_EPOLL_CREATE1_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/epoll_wait.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/epoll_wait.bpf.c index 01aa162b74..afab49ccab 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/epoll_wait.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/epoll_wait.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(epoll_wait_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, EPOLL_WAIT_E_SIZE, PPME_SYSCALL_EPOLLWAIT_E)) { + if(!ringbuf__reserve_space(&ringbuf, EPOLL_WAIT_E_SIZE, PPME_SYSCALL_EPOLLWAIT_E)) { return 0; } @@ -39,7 +39,7 @@ int BPF_PROG(epoll_wait_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(epoll_wait_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, EPOLL_WAIT_X_SIZE, PPME_SYSCALL_EPOLLWAIT_X)) { + if(!ringbuf__reserve_space(&ringbuf, EPOLL_WAIT_X_SIZE, PPME_SYSCALL_EPOLLWAIT_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/eventfd.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/eventfd.bpf.c index 890e76de71..9ed9f73aca 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/eventfd.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/eventfd.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(eventfd_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, EVENTFD_E_SIZE, PPME_SYSCALL_EVENTFD_E)) { + if(!ringbuf__reserve_space(&ringbuf, EVENTFD_E_SIZE, PPME_SYSCALL_EVENTFD_E)) { return 0; } @@ -45,7 +45,7 @@ int BPF_PROG(eventfd_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(eventfd_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, EVENTFD_X_SIZE, PPME_SYSCALL_EVENTFD_X)) { + if(!ringbuf__reserve_space(&ringbuf, EVENTFD_X_SIZE, PPME_SYSCALL_EVENTFD_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/eventfd2.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/eventfd2.bpf.c index bd8284e566..4f9c29393a 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/eventfd2.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/eventfd2.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(eventfd2_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, EVENTFD2_E_SIZE, PPME_SYSCALL_EVENTFD2_E)) { + if(!ringbuf__reserve_space(&ringbuf, EVENTFD2_E_SIZE, PPME_SYSCALL_EVENTFD2_E)) { return 0; } @@ -39,7 +39,7 @@ int BPF_PROG(eventfd2_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(eventfd2_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, EVENTFD2_X_SIZE, PPME_SYSCALL_EVENTFD2_X)) { + if(!ringbuf__reserve_space(&ringbuf, EVENTFD2_X_SIZE, PPME_SYSCALL_EVENTFD2_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c index d2f5582459..22d0ef76f9 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c @@ -28,7 +28,7 @@ int BPF_PROG(execve_e, struct pt_regs *regs, long id) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } @@ -314,7 +314,7 @@ int BPF_PROG(t2_execve_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execveat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execveat.bpf.c index b6d80a65fe..beed1e9c13 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execveat.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execveat.bpf.c @@ -39,7 +39,7 @@ int BPF_PROG(execveat_e, struct pt_regs *regs, long id) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } @@ -326,7 +326,7 @@ int BPF_PROG(t2_execveat_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchdir.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchdir.bpf.c index 8d348f959f..df141d3d8c 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchdir.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchdir.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(fchdir_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, FCHDIR_E_SIZE, PPME_SYSCALL_FCHDIR_E)) { + if(!ringbuf__reserve_space(&ringbuf, FCHDIR_E_SIZE, PPME_SYSCALL_FCHDIR_E)) { return 0; } @@ -39,7 +39,7 @@ int BPF_PROG(fchdir_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(fchdir_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, FCHDIR_X_SIZE, PPME_SYSCALL_FCHDIR_X)) { + if(!ringbuf__reserve_space(&ringbuf, FCHDIR_X_SIZE, PPME_SYSCALL_FCHDIR_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchmod.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchmod.bpf.c index 0be335b573..9195184016 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchmod.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchmod.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(fchmod_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, FCHMOD_E_SIZE, PPME_SYSCALL_FCHMOD_E)) { + if(!ringbuf__reserve_space(&ringbuf, FCHMOD_E_SIZE, PPME_SYSCALL_FCHMOD_E)) { return 0; } @@ -37,7 +37,7 @@ int BPF_PROG(fchmod_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(fchmod_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, FCHMOD_X_SIZE, PPME_SYSCALL_FCHMOD_X)) { + if(!ringbuf__reserve_space(&ringbuf, FCHMOD_X_SIZE, PPME_SYSCALL_FCHMOD_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchmodat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchmodat.bpf.c index 929b3bccb0..1488556b02 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchmodat.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchmodat.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(fchmodat_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, FCHMODAT_E_SIZE, PPME_SYSCALL_FCHMODAT_E)) { + if(!ringbuf__reserve_space(&ringbuf, FCHMODAT_E_SIZE, PPME_SYSCALL_FCHMODAT_E)) { return 0; } @@ -68,7 +68,7 @@ int BPF_PROG(fchmodat_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchown.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchown.bpf.c index bbfeddfbde..e1daf2f1ea 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchown.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchown.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(fchown_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, FCHOWN_E_SIZE, PPME_SYSCALL_FCHOWN_E)) { + if(!ringbuf__reserve_space(&ringbuf, FCHOWN_E_SIZE, PPME_SYSCALL_FCHOWN_E)) { return 0; } @@ -37,7 +37,7 @@ int BPF_PROG(fchown_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(fchown_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, FCHOWN_X_SIZE, PPME_SYSCALL_FCHOWN_X)) { + if(!ringbuf__reserve_space(&ringbuf, FCHOWN_X_SIZE, PPME_SYSCALL_FCHOWN_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchownat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchownat.bpf.c index f3c703e61f..09ee554021 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchownat.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fchownat.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(fchownat_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, FCHOWNAT_E_SIZE, PPME_SYSCALL_FCHOWNAT_E)) { + if(!ringbuf__reserve_space(&ringbuf, FCHOWNAT_E_SIZE, PPME_SYSCALL_FCHOWNAT_E)) { return 0; } @@ -76,7 +76,7 @@ int BPF_PROG(fchownat_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fcntl.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fcntl.bpf.c index 8ab8c29aac..4960b518f9 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fcntl.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fcntl.bpf.c @@ -25,7 +25,7 @@ int BPF_PROG(fcntl_e, struct pt_regs *regs, long id) { } struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, FCNTL_E_SIZE, PPME_SYSCALL_FCNTL_E)) { + if(!ringbuf__reserve_space(&ringbuf, FCNTL_E_SIZE, PPME_SYSCALL_FCNTL_E)) { return 0; } @@ -59,7 +59,7 @@ int BPF_PROG(fcntl_x, struct pt_regs *regs, long ret) { } struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, FCNTL_X_SIZE, PPME_SYSCALL_FCNTL_X)) { + if(!ringbuf__reserve_space(&ringbuf, FCNTL_X_SIZE, PPME_SYSCALL_FCNTL_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/finit_module.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/finit_module.bpf.c index 924a39bd98..14a32b6582 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/finit_module.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/finit_module.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(finit_module_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, FINIT_MODULE_E_SIZE, PPME_SYSCALL_FINIT_MODULE_E)) { + if(!ringbuf__reserve_space(&ringbuf, FINIT_MODULE_E_SIZE, PPME_SYSCALL_FINIT_MODULE_E)) { return 0; } @@ -65,7 +65,7 @@ int BPF_PROG(finit_module_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/flock.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/flock.bpf.c index a5c350286b..aad159ca34 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/flock.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/flock.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(flock_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, FLOCK_E_SIZE, PPME_SYSCALL_FLOCK_E)) { + if(!ringbuf__reserve_space(&ringbuf, FLOCK_E_SIZE, PPME_SYSCALL_FLOCK_E)) { return 0; } @@ -43,7 +43,7 @@ int BPF_PROG(flock_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(flock_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, FLOCK_X_SIZE, PPME_SYSCALL_FLOCK_X)) { + if(!ringbuf__reserve_space(&ringbuf, FLOCK_X_SIZE, PPME_SYSCALL_FLOCK_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fork.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fork.bpf.c index 2a1241def0..983130d87f 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fork.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fork.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(fork_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, FORK_E_SIZE, PPME_SYSCALL_FORK_20_E)) { + if(!ringbuf__reserve_space(&ringbuf, FORK_E_SIZE, PPME_SYSCALL_FORK_20_E)) { return 0; } @@ -220,7 +220,7 @@ int BPF_PROG(t2_fork_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fsconfig.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fsconfig.bpf.c index d1facea82d..a122858531 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fsconfig.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fsconfig.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(fsconfig_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, FSCONFIG_E_SIZE, PPME_SYSCALL_FSCONFIG_E)) { + if(!ringbuf__reserve_space(&ringbuf, FSCONFIG_E_SIZE, PPME_SYSCALL_FSCONFIG_E)) { return 0; } @@ -136,7 +136,7 @@ int BPF_PROG(fsconfig_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fstat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fstat.bpf.c index ab899a37d4..8aeb6c571a 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fstat.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/fstat.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(fstat_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, FSTAT_E_SIZE, PPME_SYSCALL_FSTAT_E)) { + if(!ringbuf__reserve_space(&ringbuf, FSTAT_E_SIZE, PPME_SYSCALL_FSTAT_E)) { return 0; } @@ -39,7 +39,7 @@ int BPF_PROG(fstat_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(fstat_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, FSTAT_X_SIZE, PPME_SYSCALL_FSTAT_X)) { + if(!ringbuf__reserve_space(&ringbuf, FSTAT_X_SIZE, PPME_SYSCALL_FSTAT_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/futex.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/futex.bpf.c index c901387355..68eb727789 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/futex.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/futex.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(futex_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, FUTEX_E_SIZE, PPME_SYSCALL_FUTEX_E)) { + if(!ringbuf__reserve_space(&ringbuf, FUTEX_E_SIZE, PPME_SYSCALL_FUTEX_E)) { return 0; } @@ -47,7 +47,7 @@ int BPF_PROG(futex_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(futex_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, FUTEX_X_SIZE, PPME_SYSCALL_FUTEX_X)) { + if(!ringbuf__reserve_space(&ringbuf, FUTEX_X_SIZE, PPME_SYSCALL_FUTEX_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/generic.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/generic.bpf.c index 9975816d7b..2c4cca26ed 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/generic.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/generic.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(generic_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GENERIC_E_SIZE, PPME_GENERIC_E)) { + if(!ringbuf__reserve_space(&ringbuf, GENERIC_E_SIZE, PPME_GENERIC_E)) { return 0; } @@ -52,7 +52,7 @@ int BPF_PROG(generic_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(generic_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GENERIC_X_SIZE, PPME_GENERIC_X)) { + if(!ringbuf__reserve_space(&ringbuf, GENERIC_X_SIZE, PPME_GENERIC_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getcwd.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getcwd.bpf.c index 68003a4706..0d79466add 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getcwd.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getcwd.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(getcwd_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETCWD_E_SIZE, PPME_SYSCALL_GETCWD_E)) { + if(!ringbuf__reserve_space(&ringbuf, GETCWD_E_SIZE, PPME_SYSCALL_GETCWD_E)) { return 0; } @@ -64,7 +64,7 @@ int BPF_PROG(getcwd_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getdents.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getdents.bpf.c index ccf832b8c5..9e012ff307 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getdents.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getdents.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(getdents_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETDENTS_E_SIZE, PPME_SYSCALL_GETDENTS_E)) { + if(!ringbuf__reserve_space(&ringbuf, GETDENTS_E_SIZE, PPME_SYSCALL_GETDENTS_E)) { return 0; } @@ -39,7 +39,7 @@ int BPF_PROG(getdents_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(getdents_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETDENTS_X_SIZE, PPME_SYSCALL_GETDENTS_X)) { + if(!ringbuf__reserve_space(&ringbuf, GETDENTS_X_SIZE, PPME_SYSCALL_GETDENTS_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getdents64.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getdents64.bpf.c index 3ec34d142c..a4653755cb 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getdents64.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getdents64.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(getdents64_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETDENTS64_E_SIZE, PPME_SYSCALL_GETDENTS64_E)) { + if(!ringbuf__reserve_space(&ringbuf, GETDENTS64_E_SIZE, PPME_SYSCALL_GETDENTS64_E)) { return 0; } @@ -39,7 +39,7 @@ int BPF_PROG(getdents64_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(getdents64_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETDENTS64_X_SIZE, PPME_SYSCALL_GETDENTS64_X)) { + if(!ringbuf__reserve_space(&ringbuf, GETDENTS64_X_SIZE, PPME_SYSCALL_GETDENTS64_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getegid.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getegid.bpf.c index d45e721ed2..27a5dfabb3 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getegid.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getegid.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(getegid_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETEGID_E_SIZE, PPME_SYSCALL_GETEGID_E)) { + if(!ringbuf__reserve_space(&ringbuf, GETEGID_E_SIZE, PPME_SYSCALL_GETEGID_E)) { return 0; } @@ -35,7 +35,7 @@ int BPF_PROG(getegid_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(getegid_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETEGID_X_SIZE, PPME_SYSCALL_GETEGID_X)) { + if(!ringbuf__reserve_space(&ringbuf, GETEGID_X_SIZE, PPME_SYSCALL_GETEGID_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/geteuid.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/geteuid.bpf.c index aebbff35ae..3dad99fa38 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/geteuid.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/geteuid.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(geteuid_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETEUID_E_SIZE, PPME_SYSCALL_GETEUID_E)) { + if(!ringbuf__reserve_space(&ringbuf, GETEUID_E_SIZE, PPME_SYSCALL_GETEUID_E)) { return 0; } @@ -35,7 +35,7 @@ int BPF_PROG(geteuid_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(geteuid_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETEUID_X_SIZE, PPME_SYSCALL_GETEUID_X)) { + if(!ringbuf__reserve_space(&ringbuf, GETEUID_X_SIZE, PPME_SYSCALL_GETEUID_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getgid.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getgid.bpf.c index d24fa144c9..de24f8e333 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getgid.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getgid.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(getgid_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETGID_E_SIZE, PPME_SYSCALL_GETGID_E)) { + if(!ringbuf__reserve_space(&ringbuf, GETGID_E_SIZE, PPME_SYSCALL_GETGID_E)) { return 0; } @@ -35,7 +35,7 @@ int BPF_PROG(getgid_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(getgid_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETGID_X_SIZE, PPME_SYSCALL_GETGID_X)) { + if(!ringbuf__reserve_space(&ringbuf, GETGID_X_SIZE, PPME_SYSCALL_GETGID_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getpeername.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getpeername.bpf.c index 7162d5da48..07c405ae93 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getpeername.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getpeername.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(getpeername_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETPEERNAME_E_SIZE, PPME_SOCKET_GETPEERNAME_E)) { + if(!ringbuf__reserve_space(&ringbuf, GETPEERNAME_E_SIZE, PPME_SOCKET_GETPEERNAME_E)) { return 0; } @@ -37,7 +37,7 @@ int BPF_PROG(getpeername_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(getpeername_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETPEERNAME_X_SIZE, PPME_SOCKET_GETPEERNAME_X)) { + if(!ringbuf__reserve_space(&ringbuf, GETPEERNAME_X_SIZE, PPME_SOCKET_GETPEERNAME_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getresgid.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getresgid.bpf.c index c591a96768..2ff57762a7 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getresgid.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getresgid.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(getresgid_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETRESGID_E_SIZE, PPME_SYSCALL_GETRESGID_E)) { + if(!ringbuf__reserve_space(&ringbuf, GETRESGID_E_SIZE, PPME_SYSCALL_GETRESGID_E)) { return 0; } @@ -35,7 +35,7 @@ int BPF_PROG(getresgid_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(getresgid_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETRESGID_X_SIZE, PPME_SYSCALL_GETRESGID_X)) { + if(!ringbuf__reserve_space(&ringbuf, GETRESGID_X_SIZE, PPME_SYSCALL_GETRESGID_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getresuid.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getresuid.bpf.c index 3d013d91c1..b1bfc69768 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getresuid.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getresuid.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(getresuid_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETRESUID_E_SIZE, PPME_SYSCALL_GETRESUID_E)) { + if(!ringbuf__reserve_space(&ringbuf, GETRESUID_E_SIZE, PPME_SYSCALL_GETRESUID_E)) { return 0; } @@ -35,7 +35,7 @@ int BPF_PROG(getresuid_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(getresuid_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETRESUID_X_SIZE, PPME_SYSCALL_GETRESUID_X)) { + if(!ringbuf__reserve_space(&ringbuf, GETRESUID_X_SIZE, PPME_SYSCALL_GETRESUID_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getrlimit.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getrlimit.bpf.c index 51a4a6c0d4..59aa94ec21 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getrlimit.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getrlimit.bpf.c @@ -15,7 +15,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(getrlimit_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETRLIMIT_E_SIZE, PPME_SYSCALL_GETRLIMIT_E)) { + if(!ringbuf__reserve_space(&ringbuf, GETRLIMIT_E_SIZE, PPME_SYSCALL_GETRLIMIT_E)) { return 0; } @@ -41,7 +41,7 @@ int BPF_PROG(getrlimit_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(getrlimit_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETRLIMIT_X_SIZE, PPME_SYSCALL_GETRLIMIT_X)) { + if(!ringbuf__reserve_space(&ringbuf, GETRLIMIT_X_SIZE, PPME_SYSCALL_GETRLIMIT_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getsockname.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getsockname.bpf.c index cc3c0e6197..1f5e672ad1 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getsockname.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getsockname.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(getsockname_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETSOCKNAME_E_SIZE, PPME_SOCKET_GETSOCKNAME_E)) { + if(!ringbuf__reserve_space(&ringbuf, GETSOCKNAME_E_SIZE, PPME_SOCKET_GETSOCKNAME_E)) { return 0; } @@ -37,7 +37,7 @@ int BPF_PROG(getsockname_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(getsockname_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETSOCKNAME_X_SIZE, PPME_SOCKET_GETSOCKNAME_X)) { + if(!ringbuf__reserve_space(&ringbuf, GETSOCKNAME_X_SIZE, PPME_SOCKET_GETSOCKNAME_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getsockopt.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getsockopt.bpf.c index f2643c07f1..c725a37815 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getsockopt.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getsockopt.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(getsockopt_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETSOCKOPT_E_SIZE, PPME_SOCKET_GETSOCKOPT_E)) { + if(!ringbuf__reserve_space(&ringbuf, GETSOCKOPT_E_SIZE, PPME_SOCKET_GETSOCKOPT_E)) { return 0; } @@ -83,7 +83,7 @@ int BPF_PROG(getsockopt_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getuid.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getuid.bpf.c index 461d18c15a..270ce09a7d 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getuid.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/getuid.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(getuid_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETUID_E_SIZE, PPME_SYSCALL_GETUID_E)) { + if(!ringbuf__reserve_space(&ringbuf, GETUID_E_SIZE, PPME_SYSCALL_GETUID_E)) { return 0; } @@ -35,7 +35,7 @@ int BPF_PROG(getuid_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(getuid_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, GETUID_X_SIZE, PPME_SYSCALL_GETUID_X)) { + if(!ringbuf__reserve_space(&ringbuf, GETUID_X_SIZE, PPME_SYSCALL_GETUID_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/init_module.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/init_module.bpf.c index cec78a40dc..ab7725c9d5 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/init_module.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/init_module.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(init_module_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, INIT_MODULE_E_SIZE, PPME_SYSCALL_INIT_MODULE_E)) { + if(!ringbuf__reserve_space(&ringbuf, INIT_MODULE_E_SIZE, PPME_SYSCALL_INIT_MODULE_E)) { return 0; } @@ -66,7 +66,7 @@ int BPF_PROG(init_module_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/inotify_init.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/inotify_init.bpf.c index de95403feb..4772d79ffb 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/inotify_init.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/inotify_init.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(inotify_init_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, INOTIFY_INIT_E_SIZE, PPME_SYSCALL_INOTIFY_INIT_E)) { + if(!ringbuf__reserve_space(&ringbuf, INOTIFY_INIT_E_SIZE, PPME_SYSCALL_INOTIFY_INIT_E)) { return 0; } @@ -42,7 +42,7 @@ int BPF_PROG(inotify_init_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(inotify_init_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, INOTIFY_INIT_X_SIZE, PPME_SYSCALL_INOTIFY_INIT_X)) { + if(!ringbuf__reserve_space(&ringbuf, INOTIFY_INIT_X_SIZE, PPME_SYSCALL_INOTIFY_INIT_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/inotify_init1.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/inotify_init1.bpf.c index 6dc0d1da11..e60b3357ad 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/inotify_init1.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/inotify_init1.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(inotify_init1_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, INOTIFY_INIT1_E_SIZE, PPME_SYSCALL_INOTIFY_INIT1_E)) { + if(!ringbuf__reserve_space(&ringbuf, INOTIFY_INIT1_E_SIZE, PPME_SYSCALL_INOTIFY_INIT1_E)) { return 0; } @@ -37,7 +37,7 @@ int BPF_PROG(inotify_init1_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(inotify_init1_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, INOTIFY_INIT1_X_SIZE, PPME_SYSCALL_INOTIFY_INIT1_X)) { + if(!ringbuf__reserve_space(&ringbuf, INOTIFY_INIT1_X_SIZE, PPME_SYSCALL_INOTIFY_INIT1_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/io_uring_enter.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/io_uring_enter.bpf.c index 6371213cf7..78dee7e01d 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/io_uring_enter.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/io_uring_enter.bpf.c @@ -13,10 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(io_uring_enter_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, - ctx, - IO_URING_ENTER_E_SIZE, - PPME_SYSCALL_IO_URING_ENTER_E)) { + if(!ringbuf__reserve_space(&ringbuf, IO_URING_ENTER_E_SIZE, PPME_SYSCALL_IO_URING_ENTER_E)) { return 0; } @@ -40,10 +37,7 @@ int BPF_PROG(io_uring_enter_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(io_uring_enter_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, - ctx, - IO_URING_ENTER_X_SIZE, - PPME_SYSCALL_IO_URING_ENTER_X)) { + if(!ringbuf__reserve_space(&ringbuf, IO_URING_ENTER_X_SIZE, PPME_SYSCALL_IO_URING_ENTER_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/io_uring_register.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/io_uring_register.bpf.c index cc9058394b..2bf1b0aba5 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/io_uring_register.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/io_uring_register.bpf.c @@ -14,7 +14,6 @@ SEC("tp_btf/sys_enter") int BPF_PROG(io_uring_register_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; if(!ringbuf__reserve_space(&ringbuf, - ctx, IO_URING_REGISTER_E_SIZE, PPME_SYSCALL_IO_URING_REGISTER_E)) { return 0; @@ -41,7 +40,6 @@ SEC("tp_btf/sys_exit") int BPF_PROG(io_uring_register_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; if(!ringbuf__reserve_space(&ringbuf, - ctx, IO_URING_REGISTER_X_SIZE, PPME_SYSCALL_IO_URING_REGISTER_X)) { return 0; diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/io_uring_setup.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/io_uring_setup.bpf.c index 9fa8bc49f8..534411d6c5 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/io_uring_setup.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/io_uring_setup.bpf.c @@ -13,10 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(io_uring_setup_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, - ctx, - IO_URING_SETUP_E_SIZE, - PPME_SYSCALL_IO_URING_SETUP_E)) { + if(!ringbuf__reserve_space(&ringbuf, IO_URING_SETUP_E_SIZE, PPME_SYSCALL_IO_URING_SETUP_E)) { return 0; } @@ -40,10 +37,7 @@ int BPF_PROG(io_uring_setup_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(io_uring_setup_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, - ctx, - IO_URING_SETUP_X_SIZE, - PPME_SYSCALL_IO_URING_SETUP_X)) { + if(!ringbuf__reserve_space(&ringbuf, IO_URING_SETUP_X_SIZE, PPME_SYSCALL_IO_URING_SETUP_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/ioctl.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/ioctl.bpf.c index b70ea3cf95..3c41b8b452 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/ioctl.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/ioctl.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(ioctl_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, IOCTL_E_SIZE, PPME_SYSCALL_IOCTL_3_E)) { + if(!ringbuf__reserve_space(&ringbuf, IOCTL_E_SIZE, PPME_SYSCALL_IOCTL_3_E)) { return 0; } @@ -47,7 +47,7 @@ int BPF_PROG(ioctl_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(ioctl_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, IOCTL_X_SIZE, PPME_SYSCALL_IOCTL_3_X)) { + if(!ringbuf__reserve_space(&ringbuf, IOCTL_X_SIZE, PPME_SYSCALL_IOCTL_3_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/kill.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/kill.bpf.c index a16f7f5780..619516f319 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/kill.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/kill.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(kill_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, KILL_E_SIZE, PPME_SYSCALL_KILL_E)) { + if(!ringbuf__reserve_space(&ringbuf, KILL_E_SIZE, PPME_SYSCALL_KILL_E)) { return 0; } @@ -43,7 +43,7 @@ int BPF_PROG(kill_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(kill_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, KILL_X_SIZE, PPME_SYSCALL_KILL_X)) { + if(!ringbuf__reserve_space(&ringbuf, KILL_X_SIZE, PPME_SYSCALL_KILL_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/lchown.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/lchown.bpf.c index 5af19d6f17..e1bb88d108 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/lchown.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/lchown.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(lchown_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, LCHOWN_E_SIZE, PPME_SYSCALL_LCHOWN_E)) { + if(!ringbuf__reserve_space(&ringbuf, LCHOWN_E_SIZE, PPME_SYSCALL_LCHOWN_E)) { return 0; } @@ -65,7 +65,7 @@ int BPF_PROG(lchown_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/link.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/link.bpf.c index 7017d509ce..726440b20c 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/link.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/link.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(link_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, LINK_E_SIZE, PPME_SYSCALL_LINK_2_E)) { + if(!ringbuf__reserve_space(&ringbuf, LINK_E_SIZE, PPME_SYSCALL_LINK_2_E)) { return 0; } @@ -61,7 +61,7 @@ int BPF_PROG(link_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/linkat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/linkat.bpf.c index ec1879c0e8..2b2597adbf 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/linkat.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/linkat.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(linkat_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, LINKAT_E_SIZE, PPME_SYSCALL_LINKAT_2_E)) { + if(!ringbuf__reserve_space(&ringbuf, LINKAT_E_SIZE, PPME_SYSCALL_LINKAT_2_E)) { return 0; } @@ -79,7 +79,7 @@ int BPF_PROG(linkat_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/listen.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/listen.bpf.c index d16483f291..b36ea8ff3d 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/listen.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/listen.bpf.c @@ -17,7 +17,7 @@ int BPF_PROG(listen_e, struct pt_regs *regs, long id) { extract__network_args(args, 2, regs); struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, LISTEN_E_SIZE, PPME_SOCKET_LISTEN_E)) { + if(!ringbuf__reserve_space(&ringbuf, LISTEN_E_SIZE, PPME_SOCKET_LISTEN_E)) { return 0; } @@ -47,7 +47,7 @@ int BPF_PROG(listen_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(listen_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, LISTEN_X_SIZE, PPME_SOCKET_LISTEN_X)) { + if(!ringbuf__reserve_space(&ringbuf, LISTEN_X_SIZE, PPME_SOCKET_LISTEN_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/llseek.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/llseek.bpf.c index f34e0f188c..6447927b23 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/llseek.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/llseek.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(llseek_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, LLSEEK_E_SIZE, PPME_SYSCALL_LLSEEK_E)) { + if(!ringbuf__reserve_space(&ringbuf, LLSEEK_E_SIZE, PPME_SYSCALL_LLSEEK_E)) { return 0; } @@ -47,7 +47,7 @@ int BPF_PROG(llseek_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(llseek_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, LLSEEK_X_SIZE, PPME_SYSCALL_LLSEEK_X)) { + if(!ringbuf__reserve_space(&ringbuf, LLSEEK_X_SIZE, PPME_SYSCALL_LLSEEK_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/lseek.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/lseek.bpf.c index c2d0fb4203..6963cd0c42 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/lseek.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/lseek.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(lseek_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, LSEEK_E_SIZE, PPME_SYSCALL_LSEEK_E)) { + if(!ringbuf__reserve_space(&ringbuf, LSEEK_E_SIZE, PPME_SYSCALL_LSEEK_E)) { return 0; } @@ -45,7 +45,7 @@ int BPF_PROG(lseek_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(lseek_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, LSEEK_X_SIZE, PPME_SYSCALL_LSEEK_X)) { + if(!ringbuf__reserve_space(&ringbuf, LSEEK_X_SIZE, PPME_SYSCALL_LSEEK_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/lstat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/lstat.bpf.c index 97d73c19ff..023a9aa641 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/lstat.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/lstat.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(lstat_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, LSTAT_E_SIZE, PPME_SYSCALL_LSTAT_E)) { + if(!ringbuf__reserve_space(&ringbuf, LSTAT_E_SIZE, PPME_SYSCALL_LSTAT_E)) { return 0; } @@ -57,7 +57,7 @@ int BPF_PROG(lstat_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/memfd_create.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/memfd_create.bpf.c index 0f5b7fa747..63c9ca12c9 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/memfd_create.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/memfd_create.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(memfd_create_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MEMFD_CREATE_E_SIZE, PPME_SYSCALL_MEMFD_CREATE_E)) { + if(!ringbuf__reserve_space(&ringbuf, MEMFD_CREATE_E_SIZE, PPME_SYSCALL_MEMFD_CREATE_E)) { return 0; } @@ -58,7 +58,7 @@ int BPF_PROG(memfd_create_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mkdir.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mkdir.bpf.c index 8e5b13a9c1..27cc99e34e 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mkdir.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mkdir.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(mkdir_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MKDIR_E_SIZE, PPME_SYSCALL_MKDIR_2_E)) { + if(!ringbuf__reserve_space(&ringbuf, MKDIR_E_SIZE, PPME_SYSCALL_MKDIR_2_E)) { return 0; } @@ -59,7 +59,7 @@ int BPF_PROG(mkdir_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mkdirat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mkdirat.bpf.c index 8d7245189e..b5ff6f6958 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mkdirat.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mkdirat.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(mkdirat_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MKDIRAT_E_SIZE, PPME_SYSCALL_MKDIRAT_E)) { + if(!ringbuf__reserve_space(&ringbuf, MKDIRAT_E_SIZE, PPME_SYSCALL_MKDIRAT_E)) { return 0; } @@ -68,7 +68,7 @@ int BPF_PROG(mkdirat_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mknod.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mknod.bpf.c index 651e63281a..56ebe0807d 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mknod.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mknod.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(mknod_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MKNOD_E_SIZE, PPME_SYSCALL_MKNOD_E)) { + if(!ringbuf__reserve_space(&ringbuf, MKNOD_E_SIZE, PPME_SYSCALL_MKNOD_E)) { return 0; } @@ -65,7 +65,7 @@ int BPF_PROG(mknod_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mknodat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mknodat.bpf.c index a29c845192..b8a7f223bc 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mknodat.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mknodat.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(mknodat_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MKNODAT_E_SIZE, PPME_SYSCALL_MKNODAT_E)) { + if(!ringbuf__reserve_space(&ringbuf, MKNODAT_E_SIZE, PPME_SYSCALL_MKNODAT_E)) { return 0; } @@ -72,7 +72,7 @@ int BPF_PROG(mknodat_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mlock.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mlock.bpf.c index 925cdf03d7..a1a6b576e8 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mlock.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mlock.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(mlock_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MLOCK_E_SIZE, PPME_SYSCALL_MLOCK_E)) { + if(!ringbuf__reserve_space(&ringbuf, MLOCK_E_SIZE, PPME_SYSCALL_MLOCK_E)) { return 0; } @@ -35,7 +35,7 @@ int BPF_PROG(mlock_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(mlock_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MLOCK_X_SIZE, PPME_SYSCALL_MLOCK_X)) { + if(!ringbuf__reserve_space(&ringbuf, MLOCK_X_SIZE, PPME_SYSCALL_MLOCK_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mlock2.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mlock2.bpf.c index 518decea87..ff9f15772d 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mlock2.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mlock2.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(mlock2_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MLOCK2_E_SIZE, PPME_SYSCALL_MLOCK2_E)) { + if(!ringbuf__reserve_space(&ringbuf, MLOCK2_E_SIZE, PPME_SYSCALL_MLOCK2_E)) { return 0; } @@ -35,7 +35,7 @@ int BPF_PROG(mlock2_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(mlock2_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MLOCK2_X_SIZE, PPME_SYSCALL_MLOCK2_X)) { + if(!ringbuf__reserve_space(&ringbuf, MLOCK2_X_SIZE, PPME_SYSCALL_MLOCK2_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mlockall.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mlockall.bpf.c index c196e7b504..b28faaeffc 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mlockall.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mlockall.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(mlockall_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MLOCKALL_E_SIZE, PPME_SYSCALL_MLOCKALL_E)) { + if(!ringbuf__reserve_space(&ringbuf, MLOCKALL_E_SIZE, PPME_SYSCALL_MLOCKALL_E)) { return 0; } @@ -35,7 +35,7 @@ int BPF_PROG(mlockall_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(mlockall_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MLOCKALL_X_SIZE, PPME_SYSCALL_MLOCKALL_X)) { + if(!ringbuf__reserve_space(&ringbuf, MLOCKALL_X_SIZE, PPME_SYSCALL_MLOCKALL_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mmap.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mmap.bpf.c index 67007645da..aa7e8217f3 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mmap.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mmap.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(mmap_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MMAP_E_SIZE, PPME_SYSCALL_MMAP_E)) { + if(!ringbuf__reserve_space(&ringbuf, MMAP_E_SIZE, PPME_SYSCALL_MMAP_E)) { return 0; } @@ -59,7 +59,7 @@ int BPF_PROG(mmap_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(mmap_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MMAP_X_SIZE, PPME_SYSCALL_MMAP_X)) { + if(!ringbuf__reserve_space(&ringbuf, MMAP_X_SIZE, PPME_SYSCALL_MMAP_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mmap2.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mmap2.bpf.c index e83cbaa9c0..dfc5471ddc 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mmap2.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mmap2.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(mmap2_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MMAP2_E_SIZE, PPME_SYSCALL_MMAP2_E)) { + if(!ringbuf__reserve_space(&ringbuf, MMAP2_E_SIZE, PPME_SYSCALL_MMAP2_E)) { return 0; } @@ -59,7 +59,7 @@ int BPF_PROG(mmap2_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(mmap2_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MMAP2_X_SIZE, PPME_SYSCALL_MMAP2_X)) { + if(!ringbuf__reserve_space(&ringbuf, MMAP2_X_SIZE, PPME_SYSCALL_MMAP2_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mount.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mount.bpf.c index 75a56b2b08..06d0e204cd 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mount.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mount.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(mount_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MOUNT_E_SIZE, PPME_SYSCALL_MOUNT_E)) { + if(!ringbuf__reserve_space(&ringbuf, MOUNT_E_SIZE, PPME_SYSCALL_MOUNT_E)) { return 0; } @@ -79,7 +79,7 @@ int BPF_PROG(mount_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mprotect.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mprotect.bpf.c index b9714fd97d..009f14b805 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mprotect.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/mprotect.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(mprotect_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MPROTECT_E_SIZE, PPME_SYSCALL_MPROTECT_E)) { + if(!ringbuf__reserve_space(&ringbuf, MPROTECT_E_SIZE, PPME_SYSCALL_MPROTECT_E)) { return 0; } @@ -47,7 +47,7 @@ int BPF_PROG(mprotect_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(mprotect_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MPROTECT_X_SIZE, PPME_SYSCALL_MPROTECT_X)) { + if(!ringbuf__reserve_space(&ringbuf, MPROTECT_X_SIZE, PPME_SYSCALL_MPROTECT_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/munlock.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/munlock.bpf.c index 528c4c8915..feabbfeaac 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/munlock.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/munlock.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(munlock_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MUNLOCK_E_SIZE, PPME_SYSCALL_MUNLOCK_E)) { + if(!ringbuf__reserve_space(&ringbuf, MUNLOCK_E_SIZE, PPME_SYSCALL_MUNLOCK_E)) { return 0; } @@ -35,7 +35,7 @@ int BPF_PROG(munlock_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(munlock_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MUNLOCK_X_SIZE, PPME_SYSCALL_MUNLOCK_X)) { + if(!ringbuf__reserve_space(&ringbuf, MUNLOCK_X_SIZE, PPME_SYSCALL_MUNLOCK_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/munlockall.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/munlockall.bpf.c index b67490fbd2..e43d2dea07 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/munlockall.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/munlockall.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(munlockall_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MUNLOCKALL_E_SIZE, PPME_SYSCALL_MUNLOCKALL_E)) { + if(!ringbuf__reserve_space(&ringbuf, MUNLOCKALL_E_SIZE, PPME_SYSCALL_MUNLOCKALL_E)) { return 0; } @@ -35,7 +35,7 @@ int BPF_PROG(munlockall_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(munlockall_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MUNLOCKALL_X_SIZE, PPME_SYSCALL_MUNLOCKALL_X)) { + if(!ringbuf__reserve_space(&ringbuf, MUNLOCKALL_X_SIZE, PPME_SYSCALL_MUNLOCKALL_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/munmap.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/munmap.bpf.c index 637deb70f7..8e0257d5b7 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/munmap.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/munmap.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(munmap_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MUNMAP_E_SIZE, PPME_SYSCALL_MUNMAP_E)) { + if(!ringbuf__reserve_space(&ringbuf, MUNMAP_E_SIZE, PPME_SYSCALL_MUNMAP_E)) { return 0; } @@ -43,7 +43,7 @@ int BPF_PROG(munmap_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(munmap_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, MUNMAP_X_SIZE, PPME_SYSCALL_MUNMAP_X)) { + if(!ringbuf__reserve_space(&ringbuf, MUNMAP_X_SIZE, PPME_SYSCALL_MUNMAP_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/nanosleep.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/nanosleep.bpf.c index 7e88c76407..8584e9ece9 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/nanosleep.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/nanosleep.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(nanosleep_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, NANOSLEEP_E_SIZE, PPME_SYSCALL_NANOSLEEP_E)) { + if(!ringbuf__reserve_space(&ringbuf, NANOSLEEP_E_SIZE, PPME_SYSCALL_NANOSLEEP_E)) { return 0; } @@ -49,7 +49,7 @@ int BPF_PROG(nanosleep_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(nanosleep_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, NANOSLEEP_X_SIZE, PPME_SYSCALL_NANOSLEEP_X)) { + if(!ringbuf__reserve_space(&ringbuf, NANOSLEEP_X_SIZE, PPME_SYSCALL_NANOSLEEP_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/newfstatat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/newfstatat.bpf.c index ab543ced66..96e7f159a7 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/newfstatat.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/newfstatat.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(newfstatat_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, NEWFSTATAT_E_SIZE, PPME_SYSCALL_NEWFSTATAT_E)) { + if(!ringbuf__reserve_space(&ringbuf, NEWFSTATAT_E_SIZE, PPME_SYSCALL_NEWFSTATAT_E)) { return 0; } @@ -68,7 +68,7 @@ int BPF_PROG(newfstatat_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/open.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/open.bpf.c index 3dedae2768..f4e66b57cf 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/open.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/open.bpf.c @@ -37,7 +37,7 @@ int BPF_PROG(open_e, struct pt_regs *regs, long id) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } @@ -98,7 +98,7 @@ int BPF_PROG(open_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/open_by_handle_at.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/open_by_handle_at.bpf.c index 45c21c3896..274d84a03b 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/open_by_handle_at.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/open_by_handle_at.bpf.c @@ -15,7 +15,6 @@ SEC("tp_btf/sys_enter") int BPF_PROG(open_by_handle_at_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; if(!ringbuf__reserve_space(&ringbuf, - ctx, OPEN_BY_HANDLE_AT_E_SIZE, PPME_SYSCALL_OPEN_BY_HANDLE_AT_E)) { return 0; @@ -118,7 +117,7 @@ int BPF_PROG(t1_open_by_handle_at_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/openat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/openat.bpf.c index 786bdd663e..14e0d55903 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/openat.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/openat.bpf.c @@ -44,7 +44,7 @@ int BPF_PROG(openat_e, struct pt_regs *regs, long id) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } @@ -112,7 +112,7 @@ int BPF_PROG(openat_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/openat2.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/openat2.bpf.c index 63b0a9307e..c895200d50 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/openat2.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/openat2.bpf.c @@ -52,7 +52,7 @@ int BPF_PROG(openat2_e, struct pt_regs *regs, long id) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } @@ -129,7 +129,7 @@ int BPF_PROG(openat2_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pidfd_getfd.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pidfd_getfd.bpf.c index d4dd11309a..6955276e2f 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pidfd_getfd.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pidfd_getfd.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(pidfd_getfd_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, PIDFD_GETFD_E_SIZE, PPME_SYSCALL_PIDFD_GETFD_E)) { + if(!ringbuf__reserve_space(&ringbuf, PIDFD_GETFD_E_SIZE, PPME_SYSCALL_PIDFD_GETFD_E)) { return 0; } @@ -39,7 +39,7 @@ int BPF_PROG(pidfd_getfd_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, PIDFD_GETFD_X_SIZE, PPME_SYSCALL_PIDFD_GETFD_X)) { + if(!ringbuf__reserve_space(&ringbuf, PIDFD_GETFD_X_SIZE, PPME_SYSCALL_PIDFD_GETFD_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pidfd_open.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pidfd_open.bpf.c index f46602eaa0..7170f8f2d7 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pidfd_open.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pidfd_open.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(pidfd_open_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, PIDFD_OPEN_E_SIZE, PPME_SYSCALL_PIDFD_OPEN_E)) { + if(!ringbuf__reserve_space(&ringbuf, PIDFD_OPEN_E_SIZE, PPME_SYSCALL_PIDFD_OPEN_E)) { return 0; } @@ -37,7 +37,7 @@ int BPF_PROG(pidfd_open_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(pidfd_open_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, PIDFD_OPEN_X_SIZE, PPME_SYSCALL_PIDFD_OPEN_X)) { + if(!ringbuf__reserve_space(&ringbuf, PIDFD_OPEN_X_SIZE, PPME_SYSCALL_PIDFD_OPEN_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pipe.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pipe.bpf.c index 9a6e165173..b2c89a2995 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pipe.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pipe.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(pipe_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, PIPE_E_SIZE, PPME_SYSCALL_PIPE_E)) { + if(!ringbuf__reserve_space(&ringbuf, PIPE_E_SIZE, PPME_SYSCALL_PIPE_E)) { return 0; } @@ -37,7 +37,7 @@ int BPF_PROG(pipe_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(pipe_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, PIPE_X_SIZE, PPME_SYSCALL_PIPE_X)) { + if(!ringbuf__reserve_space(&ringbuf, PIPE_X_SIZE, PPME_SYSCALL_PIPE_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pipe2.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pipe2.bpf.c index 3ce8237dcd..131925a7b9 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pipe2.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pipe2.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(pipe2_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, PIPE2_E_SIZE, PPME_SYSCALL_PIPE2_E)) { + if(!ringbuf__reserve_space(&ringbuf, PIPE2_E_SIZE, PPME_SYSCALL_PIPE2_E)) { return 0; } @@ -37,7 +37,7 @@ int BPF_PROG(pipe2_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(pipe2_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, PIPE2_X_SIZE, PPME_SYSCALL_PIPE2_X)) { + if(!ringbuf__reserve_space(&ringbuf, PIPE2_X_SIZE, PPME_SYSCALL_PIPE2_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/poll.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/poll.bpf.c index c3f42a0516..abe789170a 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/poll.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/poll.bpf.c @@ -40,7 +40,7 @@ int BPF_PROG(poll_e, struct pt_regs *regs, long id) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } @@ -74,7 +74,7 @@ int BPF_PROG(poll_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/ppoll.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/ppoll.bpf.c index 934f0d22e6..f64fab84f0 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/ppoll.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/ppoll.bpf.c @@ -67,7 +67,7 @@ int BPF_PROG(ppoll_e, struct pt_regs *regs, long id) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } @@ -101,7 +101,7 @@ int BPF_PROG(ppoll_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/prctl.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/prctl.bpf.c index 2ed50d1457..a313585aac 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/prctl.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/prctl.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(prctl_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, PRCTL_E_SIZE, PPME_SYSCALL_PRCTL_E)) { + if(!ringbuf__reserve_space(&ringbuf, PRCTL_E_SIZE, PPME_SYSCALL_PRCTL_E)) { return 0; } @@ -85,7 +85,7 @@ int BPF_PROG(prctl_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pread64.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pread64.bpf.c index 35b61a31e6..25c650e03a 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pread64.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pread64.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(pread64_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, PREAD64_E_SIZE, PPME_SYSCALL_PREAD_E)) { + if(!ringbuf__reserve_space(&ringbuf, PREAD64_E_SIZE, PPME_SYSCALL_PREAD_E)) { return 0; } @@ -81,7 +81,7 @@ int BPF_PROG(pread64_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/preadv.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/preadv.bpf.c index f62a03853f..0eda713df2 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/preadv.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/preadv.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(preadv_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, PREADV_E_SIZE, PPME_SYSCALL_PREADV_E)) { + if(!ringbuf__reserve_space(&ringbuf, PREADV_E_SIZE, PPME_SYSCALL_PREADV_E)) { return 0; } @@ -85,7 +85,7 @@ int BPF_PROG(preadv_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/prlimit64.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/prlimit64.bpf.c index adea2e2881..8961b002b7 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/prlimit64.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/prlimit64.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(prlimit64_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, PRLIMIT64_E_SIZE, PPME_SYSCALL_PRLIMIT_E)) { + if(!ringbuf__reserve_space(&ringbuf, PRLIMIT64_E_SIZE, PPME_SYSCALL_PRLIMIT_E)) { return 0; } @@ -43,7 +43,7 @@ int BPF_PROG(prlimit64_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(prlimit64_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, PRLIMIT64_X_SIZE, PPME_SYSCALL_PRLIMIT_X)) { + if(!ringbuf__reserve_space(&ringbuf, PRLIMIT64_X_SIZE, PPME_SYSCALL_PRLIMIT_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/process_vm_readv.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/process_vm_readv.bpf.c index 532e30ca6b..f2fe852388 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/process_vm_readv.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/process_vm_readv.bpf.c @@ -15,7 +15,6 @@ SEC("tp_btf/sys_enter") int BPF_PROG(process_vm_readv_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; if(!ringbuf__reserve_space(&ringbuf, - ctx, PROCESS_VM_READV_E_SIZE, PPME_SYSCALL_PROCESS_VM_READV_E)) { return 0; @@ -80,7 +79,7 @@ int BPF_PROG(process_vm_readv_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/process_vm_writev.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/process_vm_writev.bpf.c index 3afa1e4a1b..7db933e957 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/process_vm_writev.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/process_vm_writev.bpf.c @@ -15,7 +15,6 @@ SEC("tp_btf/sys_enter") int BPF_PROG(process_vm_writev_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; if(!ringbuf__reserve_space(&ringbuf, - ctx, PROCESS_VM_WRITEV_E_SIZE, PPME_SYSCALL_PROCESS_VM_WRITEV_E)) { return 0; @@ -80,7 +79,7 @@ int BPF_PROG(process_vm_writev_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/ptrace.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/ptrace.bpf.c index bc6c1e9e64..f086b8e97f 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/ptrace.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/ptrace.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(ptrace_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, PTRACE_E_SIZE, PPME_SYSCALL_PTRACE_E)) { + if(!ringbuf__reserve_space(&ringbuf, PTRACE_E_SIZE, PPME_SYSCALL_PTRACE_E)) { return 0; } @@ -71,7 +71,7 @@ int BPF_PROG(ptrace_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pwrite64.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pwrite64.bpf.c index 8a8c5f4777..643610b3d3 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pwrite64.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pwrite64.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(pwrite64_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, PWRITE64_E_SIZE, PPME_SYSCALL_PWRITE_E)) { + if(!ringbuf__reserve_space(&ringbuf, PWRITE64_E_SIZE, PPME_SYSCALL_PWRITE_E)) { return 0; } @@ -77,7 +77,7 @@ int BPF_PROG(pwrite64_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pwritev.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pwritev.bpf.c index ce90fd71eb..c0f87a6d74 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pwritev.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/pwritev.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(pwritev_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, PWRITEV_E_SIZE, PPME_SYSCALL_PWRITEV_E)) { + if(!ringbuf__reserve_space(&ringbuf, PWRITEV_E_SIZE, PPME_SYSCALL_PWRITEV_E)) { return 0; } @@ -82,7 +82,7 @@ int BPF_PROG(pwritev_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/quotactl.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/quotactl.bpf.c index c8fb6e0b5c..1f2c0a3980 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/quotactl.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/quotactl.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(quotactl_e, struct pt_regs *regs, long syscall_id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, QUOTACTL_E_SIZE, PPME_SYSCALL_QUOTACTL_E)) { + if(!ringbuf__reserve_space(&ringbuf, QUOTACTL_E_SIZE, PPME_SYSCALL_QUOTACTL_E)) { return 0; } @@ -209,7 +209,7 @@ int BPF_PROG(quotactl_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/read.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/read.bpf.c index db4ea28e43..c6df32c6ba 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/read.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/read.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(read_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, READ_E_SIZE, PPME_SYSCALL_READ_E)) { + if(!ringbuf__reserve_space(&ringbuf, READ_E_SIZE, PPME_SYSCALL_READ_E)) { return 0; } @@ -77,7 +77,7 @@ int BPF_PROG(read_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/readv.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/readv.bpf.c index 07a79b41e5..2d8f6ba7c6 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/readv.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/readv.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(readv_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, READV_E_SIZE, PPME_SYSCALL_READV_E)) { + if(!ringbuf__reserve_space(&ringbuf, READV_E_SIZE, PPME_SYSCALL_READV_E)) { return 0; } @@ -81,7 +81,7 @@ int BPF_PROG(readv_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recv.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recv.bpf.c index 72dce1fc21..34a8106ccf 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recv.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recv.bpf.c @@ -18,7 +18,7 @@ int BPF_PROG(recv_e, struct pt_regs *regs, long id) { extract__network_args(args, 3, regs); struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, RECV_E_SIZE, PPME_SOCKET_RECV_E)) { + if(!ringbuf__reserve_space(&ringbuf, RECV_E_SIZE, PPME_SOCKET_RECV_E)) { return 0; } @@ -82,7 +82,7 @@ int BPF_PROG(recv_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvfrom.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvfrom.bpf.c index ceba3632ef..7f90812e12 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvfrom.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvfrom.bpf.c @@ -18,7 +18,7 @@ int BPF_PROG(recvfrom_e, struct pt_regs *regs, long id) { extract__network_args(args, 3, regs); struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, RECVFROM_E_SIZE, PPME_SOCKET_RECVFROM_E)) { + if(!ringbuf__reserve_space(&ringbuf, RECVFROM_E_SIZE, PPME_SOCKET_RECVFROM_E)) { return 0; } @@ -93,7 +93,7 @@ int BPF_PROG(recvfrom_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvmmsg.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvmmsg.bpf.c index 117f12fa94..98b6a62063 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvmmsg.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvmmsg.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(recvmmsg_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, RECVMMSG_E_SIZE, PPME_SOCKET_RECVMMSG_E)) { + if(!ringbuf__reserve_space(&ringbuf, RECVMMSG_E_SIZE, PPME_SOCKET_RECVMMSG_E)) { return 0; } @@ -37,7 +37,7 @@ int BPF_PROG(recvmmsg_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(recvmmsg_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, RECVMMSG_X_SIZE, PPME_SOCKET_RECVMMSG_X)) { + if(!ringbuf__reserve_space(&ringbuf, RECVMMSG_X_SIZE, PPME_SOCKET_RECVMMSG_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvmsg.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvmsg.bpf.c index d1a0d57875..b4c4b310f0 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvmsg.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/recvmsg.bpf.c @@ -18,7 +18,7 @@ int BPF_PROG(recvmsg_e, struct pt_regs *regs, long id) { extract__network_args(&socket_fd, 1, regs); struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, RECVMSG_E_SIZE, PPME_SOCKET_RECVMSG_E)) { + if(!ringbuf__reserve_space(&ringbuf, RECVMSG_E_SIZE, PPME_SOCKET_RECVMSG_E)) { return 0; } @@ -107,7 +107,7 @@ int BPF_PROG(recvmsg_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/rename.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/rename.bpf.c index dc252d6aa8..49c9665102 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/rename.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/rename.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(rename_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, RENAME_E_SIZE, PPME_SYSCALL_RENAME_E)) { + if(!ringbuf__reserve_space(&ringbuf, RENAME_E_SIZE, PPME_SYSCALL_RENAME_E)) { return 0; } @@ -61,7 +61,7 @@ int BPF_PROG(rename_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/renameat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/renameat.bpf.c index b1edf9b0a4..dd36a18653 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/renameat.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/renameat.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(renameat_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, RENAMEAT_E_SIZE, PPME_SYSCALL_RENAMEAT_E)) { + if(!ringbuf__reserve_space(&ringbuf, RENAMEAT_E_SIZE, PPME_SYSCALL_RENAMEAT_E)) { return 0; } @@ -75,7 +75,7 @@ int BPF_PROG(renameat_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/renameat2.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/renameat2.bpf.c index 4d96aabb4e..6ab6988155 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/renameat2.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/renameat2.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(renameat2_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, RENAMEAT2_E_SIZE, PPME_SYSCALL_RENAMEAT2_E)) { + if(!ringbuf__reserve_space(&ringbuf, RENAMEAT2_E_SIZE, PPME_SYSCALL_RENAMEAT2_E)) { return 0; } @@ -80,7 +80,7 @@ int BPF_PROG(renameat2_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/rmdir.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/rmdir.bpf.c index 419a169717..a7e70fbd7d 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/rmdir.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/rmdir.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(rmdir_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, RMDIR_E_SIZE, PPME_SYSCALL_RMDIR_2_E)) { + if(!ringbuf__reserve_space(&ringbuf, RMDIR_E_SIZE, PPME_SYSCALL_RMDIR_2_E)) { return 0; } @@ -57,7 +57,7 @@ int BPF_PROG(rmdir_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/seccomp.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/seccomp.bpf.c index 7c806af647..f70301898e 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/seccomp.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/seccomp.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(seccomp_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SECCOMP_E_SIZE, PPME_SYSCALL_SECCOMP_E)) { + if(!ringbuf__reserve_space(&ringbuf, SECCOMP_E_SIZE, PPME_SYSCALL_SECCOMP_E)) { return 0; } @@ -42,7 +42,7 @@ int BPF_PROG(seccomp_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(seccomp_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SECCOMP_X_SIZE, PPME_SYSCALL_SECCOMP_X)) { + if(!ringbuf__reserve_space(&ringbuf, SECCOMP_X_SIZE, PPME_SYSCALL_SECCOMP_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/select.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/select.bpf.c index 8638949bbc..2207ccda62 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/select.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/select.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(select_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SELECT_E_SIZE, PPME_SYSCALL_SELECT_E)) { + if(!ringbuf__reserve_space(&ringbuf, SELECT_E_SIZE, PPME_SYSCALL_SELECT_E)) { return 0; } @@ -37,7 +37,7 @@ int BPF_PROG(select_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(select_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SELECT_X_SIZE, PPME_SYSCALL_SELECT_X)) { + if(!ringbuf__reserve_space(&ringbuf, SELECT_X_SIZE, PPME_SYSCALL_SELECT_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/semctl.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/semctl.bpf.c index 9d39edcb66..523d55cecc 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/semctl.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/semctl.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(semctl_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SEMCTL_E_SIZE, PPME_SYSCALL_SEMCTL_E)) { + if(!ringbuf__reserve_space(&ringbuf, SEMCTL_E_SIZE, PPME_SYSCALL_SEMCTL_E)) { return 0; } @@ -50,7 +50,7 @@ int BPF_PROG(semctl_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(semctl_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SEMCTL_X_SIZE, PPME_SYSCALL_SEMCTL_X)) { + if(!ringbuf__reserve_space(&ringbuf, SEMCTL_X_SIZE, PPME_SYSCALL_SEMCTL_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/semget.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/semget.bpf.c index 78a96158a2..03cbaee1bd 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/semget.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/semget.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(semget_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SEMGET_E_SIZE, PPME_SYSCALL_SEMGET_E)) { + if(!ringbuf__reserve_space(&ringbuf, SEMGET_E_SIZE, PPME_SYSCALL_SEMGET_E)) { return 0; } @@ -43,7 +43,7 @@ int BPF_PROG(semget_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(semget_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SEMGET_X_SIZE, PPME_SYSCALL_SEMGET_X)) { + if(!ringbuf__reserve_space(&ringbuf, SEMGET_X_SIZE, PPME_SYSCALL_SEMGET_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/semop.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/semop.bpf.c index 54b869e082..fc840c2842 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/semop.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/semop.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(semop_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SEMOP_E_SIZE, PPME_SYSCALL_SEMOP_E)) { + if(!ringbuf__reserve_space(&ringbuf, SEMOP_E_SIZE, PPME_SYSCALL_SEMOP_E)) { return 0; } @@ -39,7 +39,7 @@ int BPF_PROG(semop_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(semop_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SEMOP_X_SIZE, PPME_SYSCALL_SEMOP_X)) { + if(!ringbuf__reserve_space(&ringbuf, SEMOP_X_SIZE, PPME_SYSCALL_SEMOP_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/send.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/send.bpf.c index 95a427fda7..c7beaa5365 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/send.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/send.bpf.c @@ -18,7 +18,7 @@ int BPF_PROG(send_e, struct pt_regs *regs, long id) { extract__network_args(args, 3, regs); struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SEND_E_SIZE, PPME_SOCKET_SEND_E)) { + if(!ringbuf__reserve_space(&ringbuf, SEND_E_SIZE, PPME_SOCKET_SEND_E)) { return 0; } @@ -78,7 +78,7 @@ int BPF_PROG(send_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendfile.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendfile.bpf.c index e66b78c019..12a7c06ad7 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendfile.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendfile.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(sendfile_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SENDFILE_E_SIZE, PPME_SYSCALL_SENDFILE_E)) { + if(!ringbuf__reserve_space(&ringbuf, SENDFILE_E_SIZE, PPME_SYSCALL_SENDFILE_E)) { return 0; } @@ -53,7 +53,7 @@ int BPF_PROG(sendfile_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(sendfile_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SENDFILE_X_SIZE, PPME_SYSCALL_SENDFILE_X)) { + if(!ringbuf__reserve_space(&ringbuf, SENDFILE_X_SIZE, PPME_SYSCALL_SENDFILE_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendmmsg.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendmmsg.bpf.c index 36c80463e5..864030bf52 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendmmsg.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendmmsg.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(sendmmsg_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SENDMMSG_E_SIZE, PPME_SOCKET_SENDMMSG_E)) { + if(!ringbuf__reserve_space(&ringbuf, SENDMMSG_E_SIZE, PPME_SOCKET_SENDMMSG_E)) { return 0; } @@ -37,7 +37,7 @@ int BPF_PROG(sendmmsg_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(sendmmsg_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SENDMMSG_X_SIZE, PPME_SOCKET_SENDMMSG_X)) { + if(!ringbuf__reserve_space(&ringbuf, SENDMMSG_X_SIZE, PPME_SOCKET_SENDMMSG_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendmsg.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendmsg.bpf.c index f5307a78de..cc48b1ddf8 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendmsg.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendmsg.bpf.c @@ -52,7 +52,7 @@ int BPF_PROG(sendmsg_e, struct pt_regs *regs, long id) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } @@ -98,7 +98,7 @@ int BPF_PROG(sendmsg_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendto.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendto.bpf.c index 3fdd6a8a9b..989c88e951 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendto.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendto.bpf.c @@ -50,7 +50,7 @@ int BPF_PROG(sendto_e, struct pt_regs *regs, long id) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } @@ -95,7 +95,7 @@ int BPF_PROG(sendto_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setgid.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setgid.bpf.c index 6dfae9e213..aea208f5c7 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setgid.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setgid.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(setgid_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETGID_E_SIZE, PPME_SYSCALL_SETGID_E)) { + if(!ringbuf__reserve_space(&ringbuf, SETGID_E_SIZE, PPME_SYSCALL_SETGID_E)) { return 0; } @@ -39,7 +39,7 @@ int BPF_PROG(setgid_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(setgid_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETGID_X_SIZE, PPME_SYSCALL_SETGID_X)) { + if(!ringbuf__reserve_space(&ringbuf, SETGID_X_SIZE, PPME_SYSCALL_SETGID_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setns.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setns.bpf.c index 87b36d1a35..8f5f255686 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setns.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setns.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(setns_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETNS_E_SIZE, PPME_SYSCALL_SETNS_E)) { + if(!ringbuf__reserve_space(&ringbuf, SETNS_E_SIZE, PPME_SYSCALL_SETNS_E)) { return 0; } @@ -43,7 +43,7 @@ int BPF_PROG(setns_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(setns_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETNS_X_SIZE, PPME_SYSCALL_SETNS_X)) { + if(!ringbuf__reserve_space(&ringbuf, SETNS_X_SIZE, PPME_SYSCALL_SETNS_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setpgid.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setpgid.bpf.c index ea54ad2042..3c347d1bd4 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setpgid.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setpgid.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(setpgid_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETPGID_E_SIZE, PPME_SYSCALL_SETPGID_E)) { + if(!ringbuf__reserve_space(&ringbuf, SETPGID_E_SIZE, PPME_SYSCALL_SETPGID_E)) { return 0; } @@ -43,7 +43,7 @@ int BPF_PROG(setpgid_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(setpgid_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETPGID_X_SIZE, PPME_SYSCALL_SETPGID_X)) { + if(!ringbuf__reserve_space(&ringbuf, SETPGID_X_SIZE, PPME_SYSCALL_SETPGID_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setregid.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setregid.bpf.c index 66f10515b3..88721a8033 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setregid.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setregid.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(setregid_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETREGID_E_SIZE, PPME_SYSCALL_SETREGID_E)) { + if(!ringbuf__reserve_space(&ringbuf, SETREGID_E_SIZE, PPME_SYSCALL_SETREGID_E)) { return 0; } @@ -35,7 +35,7 @@ int BPF_PROG(setregid_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(setregid_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETREGID_X_SIZE, PPME_SYSCALL_SETREGID_X)) { + if(!ringbuf__reserve_space(&ringbuf, SETREGID_X_SIZE, PPME_SYSCALL_SETREGID_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setresgid.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setresgid.bpf.c index 69fe107f75..1f11184477 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setresgid.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setresgid.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(setresgid_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETRESGID_E_SIZE, PPME_SYSCALL_SETRESGID_E)) { + if(!ringbuf__reserve_space(&ringbuf, SETRESGID_E_SIZE, PPME_SYSCALL_SETRESGID_E)) { return 0; } @@ -47,7 +47,7 @@ int BPF_PROG(setresgid_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(setresgid_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETRESGID_X_SIZE, PPME_SYSCALL_SETRESGID_X)) { + if(!ringbuf__reserve_space(&ringbuf, SETRESGID_X_SIZE, PPME_SYSCALL_SETRESGID_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setresuid.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setresuid.bpf.c index 9e1d6ea468..77f0243489 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setresuid.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setresuid.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(setresuid_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETRESUID_E_SIZE, PPME_SYSCALL_SETRESUID_E)) { + if(!ringbuf__reserve_space(&ringbuf, SETRESUID_E_SIZE, PPME_SYSCALL_SETRESUID_E)) { return 0; } @@ -47,7 +47,7 @@ int BPF_PROG(setresuid_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(setresuid_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETRESUID_X_SIZE, PPME_SYSCALL_SETRESUID_X)) { + if(!ringbuf__reserve_space(&ringbuf, SETRESUID_X_SIZE, PPME_SYSCALL_SETRESUID_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setreuid.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setreuid.bpf.c index 058a18b606..811900fe49 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setreuid.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setreuid.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(setreuid_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETREUID_E_SIZE, PPME_SYSCALL_SETREUID_E)) { + if(!ringbuf__reserve_space(&ringbuf, SETREUID_E_SIZE, PPME_SYSCALL_SETREUID_E)) { return 0; } @@ -35,7 +35,7 @@ int BPF_PROG(setreuid_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(setreuid_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETREUID_X_SIZE, PPME_SYSCALL_SETREUID_X)) { + if(!ringbuf__reserve_space(&ringbuf, SETREUID_X_SIZE, PPME_SYSCALL_SETREUID_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setrlimit.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setrlimit.bpf.c index 420cecda92..0d7c606766 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setrlimit.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setrlimit.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(setrlimit_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETRLIMIT_E_SIZE, PPME_SYSCALL_SETRLIMIT_E)) { + if(!ringbuf__reserve_space(&ringbuf, SETRLIMIT_E_SIZE, PPME_SYSCALL_SETRLIMIT_E)) { return 0; } @@ -39,7 +39,7 @@ int BPF_PROG(setrlimit_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(setrlimit_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETRLIMIT_X_SIZE, PPME_SYSCALL_SETRLIMIT_X)) { + if(!ringbuf__reserve_space(&ringbuf, SETRLIMIT_X_SIZE, PPME_SYSCALL_SETRLIMIT_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setsid.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setsid.bpf.c index 35c98acbfc..bc37cd3fef 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setsid.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setsid.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(setsid_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETSID_E_SIZE, PPME_SYSCALL_SETSID_E)) { + if(!ringbuf__reserve_space(&ringbuf, SETSID_E_SIZE, PPME_SYSCALL_SETSID_E)) { return 0; } @@ -37,7 +37,7 @@ int BPF_PROG(setsid_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(setsid_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETSID_X_SIZE, PPME_SYSCALL_SETSID_X)) { + if(!ringbuf__reserve_space(&ringbuf, SETSID_X_SIZE, PPME_SYSCALL_SETSID_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setsockopt.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setsockopt.bpf.c index 3e5c92359a..5471e6c234 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setsockopt.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setsockopt.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(setsockopt_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETSOCKOPT_E_SIZE, PPME_SOCKET_SETSOCKOPT_E)) { + if(!ringbuf__reserve_space(&ringbuf, SETSOCKOPT_E_SIZE, PPME_SOCKET_SETSOCKOPT_E)) { return 0; } @@ -77,7 +77,7 @@ int BPF_PROG(setsockopt_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setuid.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setuid.bpf.c index bde1f8295b..6889ec031e 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setuid.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setuid.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(setuid_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETUID_E_SIZE, PPME_SYSCALL_SETUID_E)) { + if(!ringbuf__reserve_space(&ringbuf, SETUID_E_SIZE, PPME_SYSCALL_SETUID_E)) { return 0; } @@ -39,7 +39,7 @@ int BPF_PROG(setuid_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(setuid_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SETUID_X_SIZE, PPME_SYSCALL_SETUID_X)) { + if(!ringbuf__reserve_space(&ringbuf, SETUID_X_SIZE, PPME_SYSCALL_SETUID_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/shutdown.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/shutdown.bpf.c index 55fede6ca2..6a77636f6b 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/shutdown.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/shutdown.bpf.c @@ -17,7 +17,7 @@ int BPF_PROG(shutdown_e, struct pt_regs *regs, long id) { extract__network_args(args, 2, regs); struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SHUTDOWN_E_SIZE, PPME_SOCKET_SHUTDOWN_E)) { + if(!ringbuf__reserve_space(&ringbuf, SHUTDOWN_E_SIZE, PPME_SOCKET_SHUTDOWN_E)) { return 0; } @@ -47,7 +47,7 @@ int BPF_PROG(shutdown_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(shutdown_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SHUTDOWN_X_SIZE, PPME_SOCKET_SHUTDOWN_X)) { + if(!ringbuf__reserve_space(&ringbuf, SHUTDOWN_X_SIZE, PPME_SOCKET_SHUTDOWN_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/signalfd.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/signalfd.bpf.c index a38f70d05a..efebbfbd61 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/signalfd.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/signalfd.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(signalfd_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SIGNALFD_E_SIZE, PPME_SYSCALL_SIGNALFD_E)) { + if(!ringbuf__reserve_space(&ringbuf, SIGNALFD_E_SIZE, PPME_SYSCALL_SIGNALFD_E)) { return 0; } @@ -49,7 +49,7 @@ int BPF_PROG(signalfd_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(signalfd_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SIGNALFD_X_SIZE, PPME_SYSCALL_SIGNALFD_X)) { + if(!ringbuf__reserve_space(&ringbuf, SIGNALFD_X_SIZE, PPME_SYSCALL_SIGNALFD_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/signalfd4.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/signalfd4.bpf.c index 3097ad382e..cf39a2fb53 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/signalfd4.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/signalfd4.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(signalfd4_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SIGNALFD4_E_SIZE, PPME_SYSCALL_SIGNALFD4_E)) { + if(!ringbuf__reserve_space(&ringbuf, SIGNALFD4_E_SIZE, PPME_SYSCALL_SIGNALFD4_E)) { return 0; } @@ -43,7 +43,7 @@ int BPF_PROG(signalfd4_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(signalfd4_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SIGNALFD4_X_SIZE, PPME_SYSCALL_SIGNALFD4_X)) { + if(!ringbuf__reserve_space(&ringbuf, SIGNALFD4_X_SIZE, PPME_SYSCALL_SIGNALFD4_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/socket.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/socket.bpf.c index 35c3c002e0..cf07e85eac 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/socket.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/socket.bpf.c @@ -17,7 +17,7 @@ int BPF_PROG(socket_e, struct pt_regs *regs, long id) { extract__network_args(args, 3, regs); struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SOCKET_E_SIZE, PPME_SOCKET_SOCKET_E)) { + if(!ringbuf__reserve_space(&ringbuf, SOCKET_E_SIZE, PPME_SOCKET_SOCKET_E)) { return 0; } @@ -54,7 +54,7 @@ int BPF_PROG(socket_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(socket_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SOCKET_X_SIZE, PPME_SOCKET_SOCKET_X)) { + if(!ringbuf__reserve_space(&ringbuf, SOCKET_X_SIZE, PPME_SOCKET_SOCKET_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/socketpair.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/socketpair.bpf.c index 5338fd9af1..3aaa9f77a5 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/socketpair.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/socketpair.bpf.c @@ -17,7 +17,7 @@ int BPF_PROG(socketpair_e, struct pt_regs *regs, long id) { extract__network_args(args, 3, regs); struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SOCKETPAIR_E_SIZE, PPME_SOCKET_SOCKETPAIR_E)) { + if(!ringbuf__reserve_space(&ringbuf, SOCKETPAIR_E_SIZE, PPME_SOCKET_SOCKETPAIR_E)) { return 0; } @@ -54,7 +54,7 @@ int BPF_PROG(socketpair_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(socketpair_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SOCKETPAIR_X_SIZE, PPME_SOCKET_SOCKETPAIR_X)) { + if(!ringbuf__reserve_space(&ringbuf, SOCKETPAIR_X_SIZE, PPME_SOCKET_SOCKETPAIR_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/splice.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/splice.bpf.c index 5498157ed5..99f7ce5144 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/splice.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/splice.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(splice_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SPLICE_E_SIZE, PPME_SYSCALL_SPLICE_E)) { + if(!ringbuf__reserve_space(&ringbuf, SPLICE_E_SIZE, PPME_SYSCALL_SPLICE_E)) { return 0; } @@ -51,7 +51,7 @@ int BPF_PROG(splice_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(splice_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SPLICE_X_SIZE, PPME_SYSCALL_SPLICE_X)) { + if(!ringbuf__reserve_space(&ringbuf, SPLICE_X_SIZE, PPME_SYSCALL_SPLICE_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/stat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/stat.bpf.c index d85967434a..a48922b318 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/stat.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/stat.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(stat_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, STAT_E_SIZE, PPME_SYSCALL_STAT_E)) { + if(!ringbuf__reserve_space(&ringbuf, STAT_E_SIZE, PPME_SYSCALL_STAT_E)) { return 0; } @@ -57,7 +57,7 @@ int BPF_PROG(stat_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/symlink.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/symlink.bpf.c index f6fd68a290..ff38aa4222 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/symlink.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/symlink.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(symlink_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SYMLINK_E_SIZE, PPME_SYSCALL_SYMLINK_E)) { + if(!ringbuf__reserve_space(&ringbuf, SYMLINK_E_SIZE, PPME_SYSCALL_SYMLINK_E)) { return 0; } @@ -61,7 +61,7 @@ int BPF_PROG(symlink_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/symlinkat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/symlinkat.bpf.c index 45d94128fc..52d446b3c5 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/symlinkat.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/symlinkat.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(symlinkat_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, SYMLINKAT_E_SIZE, PPME_SYSCALL_SYMLINKAT_E)) { + if(!ringbuf__reserve_space(&ringbuf, SYMLINKAT_E_SIZE, PPME_SYSCALL_SYMLINKAT_E)) { return 0; } @@ -68,7 +68,7 @@ int BPF_PROG(symlinkat_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/tgkill.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/tgkill.bpf.c index 9affe99d9c..698a4d7201 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/tgkill.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/tgkill.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(tgkill_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, TGKILL_E_SIZE, PPME_SYSCALL_TGKILL_E)) { + if(!ringbuf__reserve_space(&ringbuf, TGKILL_E_SIZE, PPME_SYSCALL_TGKILL_E)) { return 0; } @@ -47,7 +47,7 @@ int BPF_PROG(tgkill_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(tgkill_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, TGKILL_X_SIZE, PPME_SYSCALL_TGKILL_X)) { + if(!ringbuf__reserve_space(&ringbuf, TGKILL_X_SIZE, PPME_SYSCALL_TGKILL_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/timerfd_create.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/timerfd_create.bpf.c index 0e891ac938..1dad343c09 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/timerfd_create.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/timerfd_create.bpf.c @@ -13,10 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(timerfd_create_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, - ctx, - TIMERFD_CREATE_E_SIZE, - PPME_SYSCALL_TIMERFD_CREATE_E)) { + if(!ringbuf__reserve_space(&ringbuf, TIMERFD_CREATE_E_SIZE, PPME_SYSCALL_TIMERFD_CREATE_E)) { return 0; } @@ -46,10 +43,7 @@ int BPF_PROG(timerfd_create_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(timerfd_create_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, - ctx, - TIMERFD_CREATE_X_SIZE, - PPME_SYSCALL_TIMERFD_CREATE_X)) { + if(!ringbuf__reserve_space(&ringbuf, TIMERFD_CREATE_X_SIZE, PPME_SYSCALL_TIMERFD_CREATE_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/tkill.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/tkill.bpf.c index 1cd4e1d7eb..fd72ab0978 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/tkill.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/tkill.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(tkill_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, TKILL_E_SIZE, PPME_SYSCALL_TKILL_E)) { + if(!ringbuf__reserve_space(&ringbuf, TKILL_E_SIZE, PPME_SYSCALL_TKILL_E)) { return 0; } @@ -43,7 +43,7 @@ int BPF_PROG(tkill_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(tkill_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, TKILL_X_SIZE, PPME_SYSCALL_TKILL_X)) { + if(!ringbuf__reserve_space(&ringbuf, TKILL_X_SIZE, PPME_SYSCALL_TKILL_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/umount.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/umount.bpf.c index d05962c6c0..b13d1ad7be 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/umount.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/umount.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(umount_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, UMOUNT_E_SIZE, PPME_SYSCALL_UMOUNT_1_E)) { + if(!ringbuf__reserve_space(&ringbuf, UMOUNT_E_SIZE, PPME_SYSCALL_UMOUNT_1_E)) { return 0; } @@ -57,7 +57,7 @@ int BPF_PROG(umount_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/umount2.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/umount2.bpf.c index 8e5f6c1d90..c9afa9f3aa 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/umount2.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/umount2.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(umount2_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, UMOUNT2_E_SIZE, PPME_SYSCALL_UMOUNT2_E)) { + if(!ringbuf__reserve_space(&ringbuf, UMOUNT2_E_SIZE, PPME_SYSCALL_UMOUNT2_E)) { return 0; } @@ -59,7 +59,7 @@ int BPF_PROG(umount2_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/unlink.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/unlink.bpf.c index 41cdfdc132..5fddd1f006 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/unlink.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/unlink.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(unlink_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, UNLINK_E_SIZE, PPME_SYSCALL_UNLINK_2_E)) { + if(!ringbuf__reserve_space(&ringbuf, UNLINK_E_SIZE, PPME_SYSCALL_UNLINK_2_E)) { return 0; } @@ -57,7 +57,7 @@ int BPF_PROG(unlink_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/unlinkat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/unlinkat.bpf.c index eef96a8a52..0a28a69639 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/unlinkat.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/unlinkat.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(unlinkat_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, UNLINKAT_E_SIZE, PPME_SYSCALL_UNLINKAT_2_E)) { + if(!ringbuf__reserve_space(&ringbuf, UNLINKAT_E_SIZE, PPME_SYSCALL_UNLINKAT_2_E)) { return 0; } @@ -68,7 +68,7 @@ int BPF_PROG(unlinkat_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/unshare.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/unshare.bpf.c index f8f2c316b2..863f54d5d7 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/unshare.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/unshare.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(unshare_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, UNSHARE_E_SIZE, PPME_SYSCALL_UNSHARE_E)) { + if(!ringbuf__reserve_space(&ringbuf, UNSHARE_E_SIZE, PPME_SYSCALL_UNSHARE_E)) { return 0; } @@ -39,7 +39,7 @@ int BPF_PROG(unshare_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(unshare_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, UNSHARE_X_SIZE, PPME_SYSCALL_UNSHARE_X)) { + if(!ringbuf__reserve_space(&ringbuf, UNSHARE_X_SIZE, PPME_SYSCALL_UNSHARE_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/userfaultfd.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/userfaultfd.bpf.c index 6a8830c185..8b433efffb 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/userfaultfd.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/userfaultfd.bpf.c @@ -13,7 +13,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(userfaultfd_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, USERFAULTFD_E_SIZE, PPME_SYSCALL_USERFAULTFD_E)) { + if(!ringbuf__reserve_space(&ringbuf, USERFAULTFD_E_SIZE, PPME_SYSCALL_USERFAULTFD_E)) { return 0; } @@ -37,7 +37,7 @@ int BPF_PROG(userfaultfd_e, struct pt_regs *regs, long id) { SEC("tp_btf/sys_exit") int BPF_PROG(userfaultfd_x, struct pt_regs *regs, long ret) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, USERFAULTFD_X_SIZE, PPME_SYSCALL_USERFAULTFD_X)) { + if(!ringbuf__reserve_space(&ringbuf, USERFAULTFD_X_SIZE, PPME_SYSCALL_USERFAULTFD_X)) { return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/vfork.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/vfork.bpf.c index d6201142eb..8ede844bc1 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/vfork.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/vfork.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(vfork_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, VFORK_E_SIZE, PPME_SYSCALL_VFORK_20_E)) { + if(!ringbuf__reserve_space(&ringbuf, VFORK_E_SIZE, PPME_SYSCALL_VFORK_20_E)) { return 0; } @@ -218,7 +218,7 @@ int BPF_PROG(t2_vfork_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/write.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/write.bpf.c index 45fcfb392c..98ab3c4cdf 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/write.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/write.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(write_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, WRITE_E_SIZE, PPME_SYSCALL_WRITE_E)) { + if(!ringbuf__reserve_space(&ringbuf, WRITE_E_SIZE, PPME_SYSCALL_WRITE_E)) { return 0; } @@ -73,7 +73,7 @@ int BPF_PROG(write_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/writev.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/writev.bpf.c index ab9fc8ccb6..b77844e28a 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/writev.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/writev.bpf.c @@ -14,7 +14,7 @@ SEC("tp_btf/sys_enter") int BPF_PROG(writev_e, struct pt_regs *regs, long id) { struct ringbuf_struct ringbuf; - if(!ringbuf__reserve_space(&ringbuf, ctx, WRITEV_E_SIZE, PPME_SYSCALL_WRITEV_E)) { + if(!ringbuf__reserve_space(&ringbuf, WRITEV_E_SIZE, PPME_SYSCALL_WRITEV_E)) { return 0; } @@ -78,7 +78,7 @@ int BPF_PROG(writev_x, struct pt_regs *regs, long ret) { auxmap__finalize_event_header(auxmap); - auxmap__submit_event(auxmap, ctx); + auxmap__submit_event(auxmap); return 0; } From 77ea1cae2f96b297fb39fd65fc77f190ce7cf2d4 Mon Sep 17 00:00:00 2001 From: Andrea Terzolo Date: Thu, 7 Nov 2024 10:17:44 +0100 Subject: [PATCH 9/9] cleanup(tests): improve test stability Signed-off-by: Andrea Terzolo --- test/drivers/test_suites/actions_suite/sampling_ratio.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/test/drivers/test_suites/actions_suite/sampling_ratio.cpp b/test/drivers/test_suites/actions_suite/sampling_ratio.cpp index 6e916b1937..adfcaffda9 100644 --- a/test/drivers/test_suites/actions_suite/sampling_ratio.cpp +++ b/test/drivers/test_suites/actions_suite/sampling_ratio.cpp @@ -276,11 +276,11 @@ TEST(Actions, sampling_ratio_check_DROP_E_DROP_X) { /* Enable all syscalls */ auto evt_test = get_syscall_event_test(); - evt_test->enable_sampling_logic(128); + evt_test->enable_sampling_logic(2); evt_test->enable_capture(); - uint32_t max_events_to_process = 50000; + uint32_t max_events_to_process = 100000; uint32_t events_processed = 0; uint16_t cpu_id = 0; bool drop_e = false;