Skip to content

Commit 5094013

Browse files
Rohith-RajuRohith-Raju
committed
update: retain original parameter order
Signed-off-by: rohith-raju <[email protected]>
1 parent ded2f47 commit 5094013

File tree

7 files changed

+87
-92
lines changed

7 files changed

+87
-92
lines changed

‎driver/bpf/fillers.h

+24-24
Original file line numberDiff line numberDiff line change
@@ -1088,11 +1088,6 @@ FILLER(sys_setrlrimit_x, true)
10881088
res = bpf_push_s64_to_ring(data, retval);
10891089
CHECK_RES(res);
10901090

1091-
/* Parameter 2: resource (type: PT_ERRNO) */
1092-
unsigned long resource = bpf_syscall_get_argument(data, 0);
1093-
res = bpf_push_u8_to_ring(data, rlimit_resource_to_scap(resource));
1094-
CHECK_RES(res);
1095-
10961091
/*
10971092
* Copy the user structure and extract cur and max
10981093
*/
@@ -1111,12 +1106,17 @@ FILLER(sys_setrlrimit_x, true)
11111106
max = -1;
11121107
}
11131108

1114-
/* Parameter 3: cur (type: PT_ERRNO) */
1109+
/* Parameter 2: cur (type: PT_ERRNO) */
11151110
res = bpf_push_s64_to_ring(data, cur);
11161111
CHECK_RES(res);
11171112

1118-
/* Parameter 4: max (type: PT_ERRNO) */
1119-
return bpf_push_s64_to_ring(data, max);
1113+
/* Parameter 3: max (type: PT_ERRNO) */
1114+
res = bpf_push_s64_to_ring(data, max);
1115+
CHECK_RES(res);
1116+
1117+
/* Parameter 4: resource (type: PT_ERRNO) */
1118+
unsigned long resource = bpf_syscall_get_argument(data, 0);
1119+
return bpf_push_u8_to_ring(data, rlimit_resource_to_scap(resource));
11201120
}
11211121

11221122
FILLER(sys_connect_e, true)
@@ -3861,22 +3861,12 @@ FILLER(sys_prlimit_x, true)
38613861
s64 oldmax;
38623862
int res;
38633863

3864-
/*
3865-
* res
3866-
*/
3864+
/* Parameter 1: res */
38673865
retval = bpf_syscall_get_retval(data->ctx);
38683866
res = bpf_push_s64_to_ring(data, retval);
38693867
CHECK_RES(res);
38703868

3871-
/* Parameter 1: pid */
3872-
pid_t pid = bpf_syscall_get_argument(data, 0);
3873-
res = bpf_push_s64_to_ring(data, (s64)pid);
3874-
CHECK_RES(res);
3875-
3876-
/* Parameter 2: resource */
3877-
unsigned long resource = bpf_syscall_get_argument(data, 1);
3878-
res = bpf_push_u8_to_ring(data, rlimit_resource_to_scap(resource));
3879-
CHECK_RES(res);
3869+
38803870

38813871
/*
38823872
* Copy the user structure and extract cur and max
@@ -3904,20 +3894,30 @@ FILLER(sys_prlimit_x, true)
39043894
oldmax = rl.rlim_max;
39053895
}
39063896

3907-
/* Parameter 3: newcur */
3897+
/* Parameter 2: newcur */
39083898
res = bpf_push_s64_to_ring(data, newcur);
39093899
CHECK_RES(res);
39103900

3911-
/* Parameter 4: newmax */
3901+
/* Parameter 3: newmax */
39123902
res = bpf_push_s64_to_ring(data, newmax);
39133903
CHECK_RES(res);
39143904

3915-
/* Parameter 5: oldcur */
3905+
/* Parameter 4: oldcur */
39163906
res = bpf_push_s64_to_ring(data, oldcur);
39173907
CHECK_RES(res);
39183908

39193909
/* Parameter 5: oldmax */
3920-
return bpf_push_s64_to_ring(data, oldmax);
3910+
res = bpf_push_s64_to_ring(data, oldmax);
3911+
CHECK_RES(res);
3912+
3913+
/* Parameter 6: pid */
3914+
pid_t pid = bpf_syscall_get_argument(data, 0);
3915+
res = bpf_push_s64_to_ring(data, (s64)pid);
3916+
CHECK_RES(res);
3917+
3918+
/* Parameter 7: resource */
3919+
unsigned long resource = bpf_syscall_get_argument(data, 1);
3920+
return bpf_push_u8_to_ring(data, rlimit_resource_to_scap(resource));
39213921
}
39223922

39233923
FILLER(sys_pwritev_e, true)

‎driver/event_table.c

+2-2
Original file line numberDiff line numberDiff line change
@@ -192,9 +192,9 @@ const struct ppm_event_info g_event_info[] = {
192192
[PPME_SYSCALL_GETRLIMIT_E] = {"getrlimit", EC_PROCESS | EC_SYSCALL, EF_NONE, 1, {{"resource", PT_ENUMFLAGS8, PF_DEC, rlimit_resources} } },
193193
[PPME_SYSCALL_GETRLIMIT_X] = {"getrlimit", EC_PROCESS | EC_SYSCALL, EF_NONE, 3, {{"res", PT_ERRNO, PF_DEC}, {"cur", PT_INT64, PF_DEC}, {"max", PT_INT64, PF_DEC} } },
194194
[PPME_SYSCALL_SETRLIMIT_E] = {"setrlimit", EC_PROCESS | EC_SYSCALL, EF_NONE, 1, {{"resource", PT_ENUMFLAGS8, PF_DEC, rlimit_resources} } },
195-
[PPME_SYSCALL_SETRLIMIT_X] = {"setrlimit", EC_PROCESS | EC_SYSCALL, EF_NONE, 4, {{"res", PT_ERRNO, PF_DEC}, {"resource", PT_ENUMFLAGS8, PF_DEC, rlimit_resources}, {"cur", PT_INT64, PF_DEC}, {"max", PT_INT64, PF_DEC} } },
195+
[PPME_SYSCALL_SETRLIMIT_X] = {"setrlimit", EC_PROCESS | EC_SYSCALL, EF_NONE, 4, {{"res", PT_ERRNO, PF_DEC},{"cur", PT_INT64, PF_DEC}, {"max", PT_INT64, PF_DEC}, {"resource", PT_ENUMFLAGS8, PF_DEC, rlimit_resources} } },
196196
[PPME_SYSCALL_PRLIMIT_E] = {"prlimit", EC_PROCESS | EC_SYSCALL, EF_NONE, 2, {{"pid", PT_PID, PF_DEC}, {"resource", PT_ENUMFLAGS8, PF_DEC, rlimit_resources} } },
197-
[PPME_SYSCALL_PRLIMIT_X] = {"prlimit", EC_PROCESS | EC_SYSCALL, EF_NONE, 7, {{"res", PT_ERRNO, PF_DEC}, {"pid", PT_INT64, PF_DEC}, {"resource", PT_ENUMFLAGS8, PF_DEC, rlimit_resources}, {"newcur", PT_INT64, PF_DEC}, {"newmax", PT_INT64, PF_DEC}, {"oldcur", PT_INT64, PF_DEC}, {"oldmax", PT_INT64, PF_DEC}} },
197+
[PPME_SYSCALL_PRLIMIT_X] = {"prlimit", EC_PROCESS | EC_SYSCALL, EF_NONE, 7, {{"res", PT_ERRNO, PF_DEC}, {"newcur", PT_INT64, PF_DEC}, {"newmax", PT_INT64, PF_DEC}, {"oldcur", PT_INT64, PF_DEC}, {"oldmax", PT_INT64, PF_DEC}, {"pid", PT_INT64, PF_DEC}, {"resource", PT_ENUMFLAGS8, PF_DEC, rlimit_resources} } },
198198
[PPME_SCHEDSWITCH_1_E] = {"switch", EC_SCHEDULER | EC_TRACEPOINT, EF_SKIPPARSERESET | EF_OLD_VERSION, 1, {{"next", PT_PID, PF_DEC} } },
199199
[PPME_SCHEDSWITCH_1_X] = {"NA", EC_UNKNOWN, EF_SKIPPARSERESET | EF_UNUSED | EF_OLD_VERSION, 0},
200200
[PPME_DROP_E] = {"drop", EC_INTERNAL | EC_METAEVENT, EF_SKIPPARSERESET, 1, {{"ratio", PT_UINT32, PF_DEC} } },

‎driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/prlimit64.bpf.c

+12-12
Original file line numberDiff line numberDiff line change
@@ -61,22 +61,14 @@ int BPF_PROG(prlimit64_x,
6161
/* Parameter 1: res (type: PT_ERRNO) */
6262
ringbuf__store_s64(&ringbuf, ret);
6363

64-
/* Parameter 2: pid (type: PT_PID) */
65-
pid_t pid = (s32)extract__syscall_argument(regs, 0);
66-
ringbuf__store_s64(&ringbuf, (s64)pid);
67-
68-
/* Parameter 3: resource (type: PT_ENUMFLAGS8) */
69-
unsigned long resource = extract__syscall_argument(regs, 1);
70-
ringbuf__store_u8(&ringbuf, rlimit_resource_to_scap(resource));
71-
7264
struct rlimit new_rlimit = {0};
7365
unsigned long rlimit_pointer = extract__syscall_argument(regs, 2);
7466
bpf_probe_read_user((void *)&new_rlimit, bpf_core_type_size(struct rlimit), (void *)rlimit_pointer);
7567

76-
/* Parameter 4: newcur (type: PT_INT64) */
68+
/* Parameter 2: newcur (type: PT_INT64) */
7769
ringbuf__store_s64(&ringbuf, new_rlimit.rlim_cur);
7870

79-
/* Parameter 5: newmax (type: PT_INT64) */
71+
/* Parameter 3: newmax (type: PT_INT64) */
8072
ringbuf__store_s64(&ringbuf, new_rlimit.rlim_max);
8173

8274
/* We take the old `rlimit` only if the syscall is successful otherwise this
@@ -89,12 +81,20 @@ int BPF_PROG(prlimit64_x,
8981
bpf_probe_read_user((void *)&old_rlimit, bpf_core_type_size(struct rlimit), (void *)rlimit_pointer);
9082
}
9183

92-
/* Parameter 6: oldcur (type: PT_INT64) */
84+
/* Parameter 4: oldcur (type: PT_INT64) */
9385
ringbuf__store_s64(&ringbuf, old_rlimit.rlim_cur);
9486

95-
/* Parameter 7: oldmax (type: PT_INT64) */
87+
/* Parameter 5: oldmax (type: PT_INT64) */
9688
ringbuf__store_s64(&ringbuf, old_rlimit.rlim_max);
9789

90+
/* Parameter 6: pid (type: PT_PID) */
91+
pid_t pid = (s32)extract__syscall_argument(regs, 0);
92+
ringbuf__store_s64(&ringbuf, (s64)pid);
93+
94+
/* Parameter 7: resource (type: PT_ENUMFLAGS8) */
95+
unsigned long resource = extract__syscall_argument(regs, 1);
96+
ringbuf__store_u8(&ringbuf, rlimit_resource_to_scap(resource));
97+
9898
/*=============================== COLLECT PARAMETERS ===========================*/
9999

100100
ringbuf__submit_event(&ringbuf);

‎driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setrlimit.bpf.c

+6-6
Original file line numberDiff line numberDiff line change
@@ -57,20 +57,20 @@ int BPF_PROG(setrlimit_x,
5757
/* Parameter 1: res (type: PT_ERRNO)*/
5858
ringbuf__store_s64(&ringbuf, ret);
5959

60-
/* Parameter 2: resource (type: PT_ENUMFLAGS8) */
61-
unsigned long resource = extract__syscall_argument(regs, 0);
62-
ringbuf__store_u8(&ringbuf, rlimit_resource_to_scap(resource));
63-
6460
struct rlimit rl = {0};
6561
unsigned long rlimit_pointer = extract__syscall_argument(regs, 1);
6662
bpf_probe_read_user((void *)&rl, bpf_core_type_size(struct rlimit), (void *)rlimit_pointer);
6763

68-
/* Parameter 3: cur (type: PT_INT64)*/
64+
/* Parameter 2: cur (type: PT_INT64)*/
6965
ringbuf__store_s64(&ringbuf, rl.rlim_cur);
7066

71-
/* Parameter 4: max (type: PT_INT64)*/
67+
/* Parameter 3: max (type: PT_INT64)*/
7268
ringbuf__store_s64(&ringbuf, rl.rlim_max);
7369

70+
/* Parameter 4: resource (type: PT_ENUMFLAGS8) */
71+
unsigned long resource = extract__syscall_argument(regs, 0);
72+
ringbuf__store_u8(&ringbuf, rlimit_resource_to_scap(resource));
73+
7474
/*=============================== COLLECT PARAMETERS ===========================*/
7575

7676
ringbuf__submit_event(&ringbuf);

‎driver/ppm_fillers.c

+28-34
Original file line numberDiff line numberDiff line change
@@ -4345,16 +4345,11 @@ int f_sys_setrlrimit_x(struct event_filler_arguments *args)
43454345
int64_t cur;
43464346
int64_t max;
43474347

4348-
/* Parameter 1: res */
4348+
/* Parameter 1: res (type: PT_ERRNO) */
43494349
retval = (int64_t)(long)syscall_get_return_value(current, args->regs);
43504350
res = val_to_ring(args, retval, 0, false, 0);
43514351
CHECK_RES(res);
43524352

4353-
/* Parameter 2: resource */
4354-
syscall_get_arguments_deprecated(args, 0, 1, &val);
4355-
res = val_to_ring(args, rlimit_resource_to_scap(val), 0, false, 0);
4356-
CHECK_RES(res);
4357-
43584353
/*
43594354
* Copy the user structure and extract cur and max
43604355
*/
@@ -4381,14 +4376,19 @@ int f_sys_setrlrimit_x(struct event_filler_arguments *args)
43814376
max = -1;
43824377
}
43834378

4384-
/* Parameter 3: cur */
4379+
/* Parameter 2: (type: PT_INT64) */
43854380
res = val_to_ring(args, cur, 0, false, 0);
43864381
CHECK_RES(res);
43874382

4388-
/* Parameter 4: max */
4383+
/* Parameter 3: max (type: PT_INT64) */
43894384
res = val_to_ring(args, max, 0, false, 0);
43904385
CHECK_RES(res);
43914386

4387+
/* Parameter 4: resource (type: PT_ENUMFLAGS8) */
4388+
syscall_get_arguments_deprecated(args, 0, 1, &val);
4389+
res = val_to_ring(args, rlimit_resource_to_scap(val), 0, false, 0);
4390+
CHECK_RES(res);
4391+
43924392
return add_sentinel(args);
43934393
}
43944394

@@ -4427,25 +4427,12 @@ int f_sys_prlimit_x(struct event_filler_arguments *args)
44274427
int64_t oldmax;
44284428
pid_t pid = 0;
44294429

4430-
/*
4431-
* res
4432-
*/
4430+
/* Parameter 1: res ((type: PT_ERRNO) */
44334431
retval = (int64_t)(long)syscall_get_return_value(current, args->regs);
44344432
res = val_to_ring(args, retval, 0, false, 0);
44354433
if (unlikely(res != PPM_SUCCESS))
44364434
return res;
44374435

4438-
/* Parameter 1: pid */
4439-
syscall_get_arguments_deprecated(args, 0, 1, &val);
4440-
pid = (s32)val;
4441-
res = val_to_ring(args, (s64)pid, 0, false, 0);
4442-
CHECK_RES(res);
4443-
4444-
/* Parameter 2: resource (type: PT_ENUMFLAGS8) */
4445-
syscall_get_arguments_deprecated(args, 1, 1, &val);
4446-
res = val_to_ring(args, rlimit_resource_to_scap(val), 0, false, 0);
4447-
CHECK_RES(res);
4448-
44494436
/*
44504437
* Copy the user structure and extract cur and max
44514438
*/
@@ -4499,25 +4486,32 @@ int f_sys_prlimit_x(struct event_filler_arguments *args)
44994486
}
45004487
}
45014488
#endif
4502-
/* Parameter 3: newcur (PT_INT64)*/
4489+
/* Parameter 2: newcur (type: PT_INT64) */
45034490
res = val_to_ring(args, newcur, 0, false, 0);
4504-
if (unlikely(res != PPM_SUCCESS))
4505-
return res;
4491+
CHECK_RES(res);
45064492

4507-
/* Parameter 4: newmax (PT_INT64)*/
4493+
/* Parameter 3: newmax (type: PT_INT64) */
45084494
res = val_to_ring(args, newmax, 0, false, 0);
4509-
if (unlikely(res != PPM_SUCCESS))
4510-
return res;
4495+
CHECK_RES(res);
45114496

4512-
/* Parameter 5: oldcur (PT_INT64)*/
4497+
/* Parameter 4: oldcur (type: PT_INT64) */
45134498
res = val_to_ring(args, oldcur, 0, false, 0);
4514-
if (unlikely(res != PPM_SUCCESS))
4515-
return res;
4499+
CHECK_RES(res);
45164500

4517-
/* Parameter 6: oldmax (PT_INT64)*/
4501+
/* Parameter 5: oldmax (type: PT_INT64) */
45184502
res = val_to_ring(args, oldmax, 0, false, 0);
4519-
if (unlikely(res != PPM_SUCCESS))
4520-
return res;
4503+
CHECK_RES(res);
4504+
4505+
/* Parameter 6: pid (type: PT_INT64) */
4506+
syscall_get_arguments_deprecated(args, 0, 1, &val);
4507+
pid = (s32)val;
4508+
res = val_to_ring(args, (s64)pid, 0, false, 0);
4509+
CHECK_RES(res);
4510+
4511+
/* Parameter 7: resource (type: PT_ENUMFLAGS8) */
4512+
syscall_get_arguments_deprecated(args, 1, 1, &val);
4513+
res = val_to_ring(args, rlimit_resource_to_scap(val), 0, false, 0);
4514+
CHECK_RES(res);
45214515

45224516
return add_sentinel(args);
45234517
}

‎test/drivers/test_suites/syscall_exit_suite/prlimit64_x.cpp

+10-10
Original file line numberDiff line numberDiff line change
@@ -46,23 +46,23 @@ TEST(SyscallExit, prlimit64X)
4646
/* Parameter 1: res (type: PT_ERRNO) */
4747
evt_test->assert_numeric_param(1, (int64_t)0);
4848

49-
/* Parameter 2: pid (type: PT_INT64) */
50-
evt_test->assert_numeric_param(2, (int64_t)pid);
49+
/* Parameter 2: newcur (type: PT_INT64) */
50+
evt_test->assert_numeric_param(2, (int64_t)file_rlimit.rlim_cur);
5151

52-
/* Parameter 3: resource (type: PT_ENUMFLAGS8) */
53-
evt_test->assert_numeric_param(3, (uint8_t)PPM_RLIMIT_NOFILE);
52+
/* Parameter 3: newmax (type: PT_INT64) */
53+
evt_test->assert_numeric_param(3, (int64_t)file_rlimit.rlim_max);
5454

55-
/* Parameter 4: newcur (type: PT_INT64) */
55+
/* Parameter 4: oldcur (type: PT_INT64) */
5656
evt_test->assert_numeric_param(4, (int64_t)file_rlimit.rlim_cur);
5757

58-
/* Parameter 5: newmax (type: PT_INT64) */
58+
/* Parameter 5: oldmax (type: PT_INT64) */
5959
evt_test->assert_numeric_param(5, (int64_t)file_rlimit.rlim_max);
6060

61-
/* Parameter 6: oldcur (type: PT_INT64) */
62-
evt_test->assert_numeric_param(6, (int64_t)file_rlimit.rlim_cur);
61+
/* Parameter 6: pid (type: PT_INT64) */
62+
evt_test->assert_numeric_param(6, (int64_t)pid);
6363

64-
/* Parameter 7: oldmax (type: PT_INT64) */
65-
evt_test->assert_numeric_param(7, (int64_t)file_rlimit.rlim_max);
64+
/* Parameter 7: resource (type: PT_ENUMFLAGS8) */
65+
evt_test->assert_numeric_param(7, (uint8_t)PPM_RLIMIT_NOFILE);
6666

6767
/*=============================== ASSERT PARAMETERS ===========================*/
6868

‎test/drivers/test_suites/syscall_exit_suite/setrlimit_x.cpp

+5-4
Original file line numberDiff line numberDiff line change
@@ -39,13 +39,14 @@ TEST(SyscallExit, setrlimitX)
3939
/* Parameter 1: res (type: PT_ERRNO) */
4040
evt_test->assert_numeric_param(1, (int64_t)errno_value);
4141

42-
evt_test->assert_numeric_param(2, (uint8_t)resource);
43-
4442
/* Parameter 2: cur (type: PT_INT64) */
45-
evt_test->assert_numeric_param(3, (int64_t)rlim.rlim_cur);
43+
evt_test->assert_numeric_param(2, (int64_t)rlim.rlim_cur);
4644

4745
/* Parameter 3: max (type: PT_INT64) */
48-
evt_test->assert_numeric_param(4, (int64_t)rlim.rlim_max);
46+
evt_test->assert_numeric_param(3, (int64_t)rlim.rlim_max);
47+
48+
/* Parameter 4: resource (type: PT_ENUMFLAGS8) */
49+
evt_test->assert_numeric_param(4, (uint8_t)resource);
4950

5051
/*=============================== ASSERT PARAMETERS ===========================*/
5152

0 commit comments

Comments
 (0)