diff --git a/test/drivers/event_class/event_class.cpp b/test/drivers/event_class/event_class.cpp index 0b33f79bfca..7244343cfc3 100644 --- a/test/drivers/event_class/event_class.cpp +++ b/test/drivers/event_class/event_class.cpp @@ -146,6 +146,22 @@ event_test::event_test(int syscall_id, int event_direction): { m_tp_set[SYS_EXIT] = 1; m_event_type = g_syscall_table[syscall_id].exit_event_type; + if(is_bpf_engine()) + { + /* The bpf engine retrieves syscall params from sys_enter tracepoints + * in kernel versions < 4.17. Moreover for syscalls that generate a + * child we need a `sched_process_fork` tracepoint to duplicate the + * syscall args for the child exit event! + */ + m_tp_set[SYS_ENTER] = 1; + if(m_event_type == PPME_SYSCALL_CLONE_20_X || + m_event_type == PPME_SYSCALL_FORK_20_X || + m_event_type == PPME_SYSCALL_VFORK_20_X || + m_event_type == PPME_SYSCALL_CLONE3_X) + { + m_tp_set[SCHED_PROC_FORK] = 1; + } + } } m_current_param = 0; diff --git a/test/drivers/test_suites/syscall_exit_suite/clone3_x.cpp b/test/drivers/test_suites/syscall_exit_suite/clone3_x.cpp index 28cfeae71f1..c2db47451bc 100644 --- a/test/drivers/test_suites/syscall_exit_suite/clone3_x.cpp +++ b/test/drivers/test_suites/syscall_exit_suite/clone3_x.cpp @@ -189,6 +189,11 @@ TEST(SyscallExit, clone3X_child) #else evt_test->assert_event_presence(ret_pid); + if(HasFatalFailure()) + { + return; + } + evt_test->parse_event(); evt_test->assert_header(); diff --git a/test/drivers/test_suites/syscall_exit_suite/clone_x.cpp b/test/drivers/test_suites/syscall_exit_suite/clone_x.cpp index b28da2d03da..6242b475901 100644 --- a/test/drivers/test_suites/syscall_exit_suite/clone_x.cpp +++ b/test/drivers/test_suites/syscall_exit_suite/clone_x.cpp @@ -233,6 +233,11 @@ TEST(SyscallExit, cloneX_child) #else evt_test->assert_event_presence(ret_pid); + if(HasFatalFailure()) + { + return; + } + evt_test->parse_event(); evt_test->assert_header(); diff --git a/test/drivers/test_suites/syscall_exit_suite/fork_x.cpp b/test/drivers/test_suites/syscall_exit_suite/fork_x.cpp index 7805ad3b4a6..3bbb5ca8e67 100644 --- a/test/drivers/test_suites/syscall_exit_suite/fork_x.cpp +++ b/test/drivers/test_suites/syscall_exit_suite/fork_x.cpp @@ -178,6 +178,11 @@ TEST(SyscallExit, forkX_child) #else evt_test->assert_event_presence(ret_pid); + if(HasFatalFailure()) + { + return; + } + evt_test->parse_event(); evt_test->assert_header();