diff --git a/driver/event_table.c b/driver/event_table.c index 3f765cfd5b..32f8199f99 100644 --- a/driver/event_table.c +++ b/driver/event_table.c @@ -421,7 +421,7 @@ const struct ppm_event_info g_event_info[] = { [PPME_SYSCALL_DUP_1_E] = {"dup", EC_IO_OTHER | EC_SYSCALL, EF_CREATES_FD | EF_USES_FD | EF_MODIFIES_STATE, 1, {{"fd", PT_FD, PF_DEC} } }, [PPME_SYSCALL_DUP_1_X] = {"dup", EC_IO_OTHER | EC_SYSCALL, EF_CREATES_FD | EF_USES_FD | EF_MODIFIES_STATE, 2, {{"res", PT_FD, PF_DEC}, {"oldfd", PT_FD, PF_DEC} } }, [PPME_SYSCALL_BPF_2_E] = {"bpf", EC_OTHER | EC_SYSCALL, EF_CREATES_FD, 1, {{"cmd", PT_INT64, PF_DEC} } }, - [PPME_SYSCALL_BPF_2_X] = {"bpf", EC_OTHER | EC_SYSCALL, EF_CREATES_FD, 2, { {"fd", PT_FD, PF_DEC}, {"cmd", PT_FLAGS32, PF_DEC, bpf_commands} } }, + [PPME_SYSCALL_BPF_2_X] = {"bpf", EC_OTHER | EC_SYSCALL, EF_CREATES_FD, 2, { {"fd", PT_FD, PF_DEC}, {"cmd", PT_ENUMFLAGS32, PF_DEC, bpf_commands} } }, [PPME_SYSCALL_MLOCK2_E] = {"mlock2", EC_MEMORY | EC_SYSCALL, EF_NONE, 0}, [PPME_SYSCALL_MLOCK2_X] = {"mlock2", EC_MEMORY | EC_SYSCALL, EF_NONE, 4, {{"res", PT_ERRNO, PF_DEC}, {"addr", PT_UINT64, PF_HEX}, {"len", PT_UINT64, PF_DEC}, {"flags", PT_UINT32, PF_HEX, mlock2_flags}}}, [PPME_SYSCALL_FSCONFIG_E] = {"fsconfig", EC_SYSTEM | EC_SYSCALL, EF_NONE, 0}, diff --git a/driver/flags_table.c b/driver/flags_table.c index 13cffb813e..2e101444b8 100644 --- a/driver/flags_table.c +++ b/driver/flags_table.c @@ -716,5 +716,36 @@ const struct ppm_name_value bpf_commands[] = { {"BPF_MAP_DELETE_ELEM", PPM_BPF_MAP_DELETE_ELEM}, {"BPF_MAP_GET_NEXT_KEY", PPM_BPF_MAP_GET_NEXT_KEY}, {"BPF_PROG_LOAD", PPM_BPF_PROG_LOAD}, + {"BPF_OBJ,PIN", PPM_BPF_OBJ_PIN}, + {"BPF_OBJ_GET", PPM_BPF_OBJ_GET}, + {"BPF_PROG_ATTACH", PPM_BPF_PROG_ATTACH}, + {"BPF_PROG_DETACH", PPM_BPF_PROG_DETACH}, + {"BPF_PROG_TEST_RUN", PPM_BPF_PROG_TEST_RUN}, + {"BPF_PROG_RUN", PPM_BPF_PROG_RUN}, + {"BPF_PROG_GET_NEXT_ID", PPM_BPF_PROG_GET_NEXT_ID}, + {"BPF_MAP_GET_NEXT_ID", PPM_BPF_MAP_GET_NEXT_ID}, + {"BPF_PROG_GET_FD_BY_ID", PPM_BPF_PROG_GET_FD_BY_ID}, + {"BPF_MAP_GET_FD_BY_ID", PPM_BPF_MAP_GET_FD_BY_ID}, + {"BPF_OBJ_GET_INFO_BY_FD", PPM_BPF_OBJ_GET_INFO_BY_FD}, + {"BPF_PROG_QUERY", PPM_BPF_PROG_QUERY}, + {"BPF_RAW_TRACEPOINT_OPEN", PPM_BPF_RAW_TRACEPOINT_OPEN}, + {"BPF_BTF_LOAD", PPM_BPF_BTF_LOAD}, + {"BPF_BTF_GET_FD_BY_ID", PPM_BPF_BTF_GET_FD_BY_ID}, + {"BPF_TASK_FD_QUERY", PPM_BPF_TASK_FD_QUERY}, + {"BPF_MAP_LOOKUP_AND_DELETE_ELEM", PPM_BPF_MAP_LOOKUP_AND_DELETE_ELEM}, + {"BPF_MAP_FREEZE", PPM_BPF_MAP_FREEZE}, + {"BPF_BTF_GET_NEXT_ID", PPM_BPF_BTF_GET_NEXT_ID}, + {"BPF_MAP_LOOKUP_BATCH", PPM_BPF_MAP_LOOKUP_BATCH}, + {"BPF_MAP_LOOKUP_AND_DELETE_BATCH", PPM_BPF_MAP_LOOKUP_AND_DELETE_BATCH}, + {"BPF_MAP_UPDATE_BATCH", PPM_BPF_MAP_UPDATE_BATCH}, + {"BPF_MAP_DELETE_BATCH", PPM_BPF_MAP_DELETE_BATCH}, + {"BPF_LINK_CREATE", PPM_BPF_LINK_CREATE}, + {"BPF_LINK_UPDATE", PPM_BPF_LINK_UPDATE}, + {"BPF_LINK_GET_FD_BY_ID", PPM_BPF_LINK_GET_FD_BY_ID}, + {"BPF_LINK_GET_NEXT_ID", PPM_BPF_LINK_GET_NEXT_ID}, + {"BPF_ENABLE_STATS", PPM_BPF_ENABLE_STATS}, + {"BPF_ITER_CREATE", PPM_BPF_ITER_CREATE}, + {"BPF_LINK_DETACH", PPM_BPF_LINK_DETACH}, + {"BPF_PROG_BIND_MAP", PPM_BPF_PROG_BIND_MAP}, {0,0}, }; \ No newline at end of file diff --git a/driver/ppm_events_public.h b/driver/ppm_events_public.h index 2ae292f921..aeb7b59f8e 100644 --- a/driver/ppm_events_public.h +++ b/driver/ppm_events_public.h @@ -801,12 +801,43 @@ or GPL2.txt for full copies of the license. /* * bpf_commands */ -#define PPM_BPF_MAP_CREATE (0<<1) -#define PPM_BPF_MAP_LOOKUP_ELEM (1<<1) -#define PPM_BPF_MAP_UPDATE_ELEM (1<<2) -#define PPM_BPF_MAP_DELETE_ELEM (1<<3) -#define PPM_BPF_MAP_GET_NEXT_KEY (1<<4) -#define PPM_BPF_PROG_LOAD (1<<5) +#define PPM_BPF_MAP_CREATE 1 +#define PPM_BPF_MAP_LOOKUP_ELEM 2 +#define PPM_BPF_MAP_UPDATE_ELEM 3 +#define PPM_BPF_MAP_DELETE_ELEM 4 +#define PPM_BPF_MAP_GET_NEXT_KEY 5 +#define PPM_BPF_PROG_LOAD 6 +#define PPM_BPF_OBJ_PIN 7 +#define PPM_BPF_OBJ_GET 8 +#define PPM_BPF_PROG_ATTACH 9 +#define PPM_BPF_PROG_DETACH 10 +#define PPM_BPF_PROG_TEST_RUN 11 +#define PPM_BPF_PROG_RUN PPM_BPF_PROG_TEST_RUN +#define PPM_BPF_PROG_GET_NEXT_ID 12 +#define PPM_BPF_MAP_GET_NEXT_ID 13 +#define PPM_BPF_PROG_GET_FD_BY_ID 14 +#define PPM_BPF_MAP_GET_FD_BY_ID 15 +#define PPM_BPF_OBJ_GET_INFO_BY_FD 16 +#define PPM_BPF_PROG_QUERY 17 +#define PPM_BPF_RAW_TRACEPOINT_OPEN 18 +#define PPM_BPF_BTF_LOAD 19 +#define PPM_BPF_BTF_GET_FD_BY_ID 20 +#define PPM_BPF_TASK_FD_QUERY 21 +#define PPM_BPF_MAP_LOOKUP_AND_DELETE_ELEM 22 +#define PPM_BPF_MAP_FREEZE 23 +#define PPM_BPF_BTF_GET_NEXT_ID 24 +#define PPM_BPF_MAP_LOOKUP_BATCH 25 +#define PPM_BPF_MAP_LOOKUP_AND_DELETE_BATCH 26 +#define PPM_BPF_MAP_UPDATE_BATCH 27 +#define PPM_BPF_MAP_DELETE_BATCH 28 +#define PPM_BPF_LINK_CREATE 29 +#define PPM_BPF_LINK_UPDATE 30 +#define PPM_BPF_LINK_GET_FD_BY_ID 31 +#define PPM_BPF_LINK_GET_NEXT_ID 32 +#define PPM_BPF_ENABLE_STATS 33 +#define PPM_BPF_ITER_CREATE 34 +#define PPM_BPF_LINK_DETACH 35 +#define PPM_BPF_PROG_BIND_MAP 36 /* * Get/set the timerslack as used by poll/select/nanosleep diff --git a/driver/ppm_flag_helpers.h b/driver/ppm_flag_helpers.h index c97e683da2..686e7fa6a0 100644 --- a/driver/ppm_flag_helpers.h +++ b/driver/ppm_flag_helpers.h @@ -2202,33 +2202,14 @@ static __always_inline uint32_t mknod_mode_to_scap(uint32_t modes) } static __always_inline uint32_t bpf_cmd_to_scap (unsigned long cmd){ - switch (cmd) - { -#ifdef BPF_MAP_CREATE - case BPF_MAP_CREATE: - return PPM_BPF_MAP_CREATE; -#endif -#ifdef BPF_MAP_LOOKUP_ELEM - case BPF_MAP_LOOKUP_ELEM: - return PPM_BPF_MAP_LOOKUP_ELEM; -#endif -#ifdef BPF_MAP_UPDATE_ELEM - case BPF_MAP_UPDATE_ELEM: - return PPM_BPF_MAP_UPDATE_ELEM; -#endif -#ifdef BPF_MAP_DELETE_ELEM - case BPF_MAP_DELETE_ELEM: - return PPM_BPF_MAP_DELETE_ELEM; -#endif -#ifdef BPF_MAP_GET_NEXT_KEY - case BPF_MAP_GET_NEXT_KEY: - return PPM_BPF_MAP_GET_NEXT_KEY; -#endif -#ifdef BPF_PROG_LOAD - case BPF_PROG_LOAD: - return PPM_BPF_PROG_LOAD; -#endif - } + /* + * fsconfig opcodes are defined via enum in uapi/linux/bpf.h. + * It is userspace API (thus stable) and arch-independent. + * Therefore we map them 1:1; if any unmapped flag arrives, + * we will just print its value to userspace without mapping it to a string flag. + * We then need to append new flags to both flags_table and ppm_events_public PPM_ flags. + */ + return cmd; } #endif /* PPM_FLAG_HELPERS_H_ */ \ No newline at end of file