update: address review requests

Signed-off-by: RohithRaju <[email protected]>

driver/event_table.c

@@ -421,7 +421,7 @@ const struct ppm_event_info g_event_info[] = {
 	[PPME_SYSCALL_DUP_1_E] = {"dup", EC_IO_OTHER | EC_SYSCALL, EF_CREATES_FD | EF_USES_FD | EF_MODIFIES_STATE, 1, {{"fd", PT_FD, PF_DEC} } },
 	[PPME_SYSCALL_DUP_1_X] = {"dup", EC_IO_OTHER | EC_SYSCALL, EF_CREATES_FD | EF_USES_FD | EF_MODIFIES_STATE, 2, {{"res", PT_FD, PF_DEC}, {"oldfd", PT_FD, PF_DEC} } },
 	[PPME_SYSCALL_BPF_2_E] = {"bpf", EC_OTHER | EC_SYSCALL, EF_CREATES_FD, 1, {{"cmd", PT_INT64, PF_DEC} } },
-	[PPME_SYSCALL_BPF_2_X] = {"bpf", EC_OTHER | EC_SYSCALL, EF_CREATES_FD, 2, { {"fd", PT_FD, PF_DEC}, {"cmd", PT_FLAGS32, PF_DEC, bpf_commands} } },
+	[PPME_SYSCALL_BPF_2_X] = {"bpf", EC_OTHER | EC_SYSCALL, EF_CREATES_FD, 2, { {"fd", PT_FD, PF_DEC}, {"cmd", PT_ENUMFLAGS32, PF_DEC, bpf_commands} } },
 	[PPME_SYSCALL_MLOCK2_E] = {"mlock2", EC_MEMORY | EC_SYSCALL, EF_NONE, 0},
 	[PPME_SYSCALL_MLOCK2_X] = {"mlock2", EC_MEMORY | EC_SYSCALL, EF_NONE, 4, {{"res", PT_ERRNO, PF_DEC}, {"addr", PT_UINT64, PF_HEX}, {"len", PT_UINT64, PF_DEC}, {"flags", PT_UINT32, PF_HEX, mlock2_flags}}},
 	[PPME_SYSCALL_FSCONFIG_E] = {"fsconfig", EC_SYSTEM | EC_SYSCALL, EF_NONE, 0},

driver/flags_table.c

@@ -723,5 +723,36 @@ const struct ppm_name_value bpf_commands[] = {
 	{"BPF_MAP_DELETE_ELEM", PPM_BPF_MAP_DELETE_ELEM},
 	{"BPF_MAP_GET_NEXT_KEY", PPM_BPF_MAP_GET_NEXT_KEY},
 	{"BPF_PROG_LOAD", PPM_BPF_PROG_LOAD},
+	{"BPF_OBJ,PIN", PPM_BPF_OBJ_PIN},
+	{"BPF_OBJ_GET", PPM_BPF_OBJ_GET},
+	{"BPF_PROG_ATTACH", PPM_BPF_PROG_ATTACH},
+	{"BPF_PROG_DETACH", PPM_BPF_PROG_DETACH},
+	{"BPF_PROG_TEST_RUN", PPM_BPF_PROG_TEST_RUN},
+	{"BPF_PROG_RUN", PPM_BPF_PROG_RUN},
+	{"BPF_PROG_GET_NEXT_ID", PPM_BPF_PROG_GET_NEXT_ID},
+	{"BPF_MAP_GET_NEXT_ID", PPM_BPF_MAP_GET_NEXT_ID},
+	{"BPF_PROG_GET_FD_BY_ID", PPM_BPF_PROG_GET_FD_BY_ID},
+	{"BPF_MAP_GET_FD_BY_ID", PPM_BPF_MAP_GET_FD_BY_ID},
+	{"BPF_OBJ_GET_INFO_BY_FD", PPM_BPF_OBJ_GET_INFO_BY_FD},
+	{"BPF_PROG_QUERY", PPM_BPF_PROG_QUERY},
+	{"BPF_RAW_TRACEPOINT_OPEN", PPM_BPF_RAW_TRACEPOINT_OPEN},
+	{"BPF_BTF_LOAD", PPM_BPF_BTF_LOAD},
+	{"BPF_BTF_GET_FD_BY_ID", PPM_BPF_BTF_GET_FD_BY_ID},
+	{"BPF_TASK_FD_QUERY", PPM_BPF_TASK_FD_QUERY},
+	{"BPF_MAP_LOOKUP_AND_DELETE_ELEM", PPM_BPF_MAP_LOOKUP_AND_DELETE_ELEM},
+	{"BPF_MAP_FREEZE", PPM_BPF_MAP_FREEZE},
+	{"BPF_BTF_GET_NEXT_ID", PPM_BPF_BTF_GET_NEXT_ID},
+	{"BPF_MAP_LOOKUP_BATCH", PPM_BPF_MAP_LOOKUP_BATCH},
+	{"BPF_MAP_LOOKUP_AND_DELETE_BATCH", PPM_BPF_MAP_LOOKUP_AND_DELETE_BATCH},
+	{"BPF_MAP_UPDATE_BATCH", PPM_BPF_MAP_UPDATE_BATCH},
+	{"BPF_MAP_DELETE_BATCH", PPM_BPF_MAP_DELETE_BATCH},
+	{"BPF_LINK_CREATE", PPM_BPF_LINK_CREATE},
+	{"BPF_LINK_UPDATE", PPM_BPF_LINK_UPDATE},
+	{"BPF_LINK_GET_FD_BY_ID", PPM_BPF_LINK_GET_FD_BY_ID},
+	{"BPF_LINK_GET_NEXT_ID", PPM_BPF_LINK_GET_NEXT_ID},
+	{"BPF_ENABLE_STATS", PPM_BPF_ENABLE_STATS},
+	{"BPF_ITER_CREATE", PPM_BPF_ITER_CREATE},
+	{"BPF_LINK_DETACH", PPM_BPF_LINK_DETACH},
+	{"BPF_PROG_BIND_MAP", PPM_BPF_PROG_BIND_MAP},
 	{0,0},
 };

driver/ppm_events_public.h

@@ -808,12 +808,43 @@ or GPL2.txt for full copies of the license.
 /*
  * bpf_commands 
 */
-#define PPM_BPF_MAP_CREATE 		 (0<<1)
-#define PPM_BPF_MAP_LOOKUP_ELEM  (1<<1)
-#define PPM_BPF_MAP_UPDATE_ELEM  (1<<2)
-#define PPM_BPF_MAP_DELETE_ELEM  (1<<3)
-#define PPM_BPF_MAP_GET_NEXT_KEY (1<<4)
-#define PPM_BPF_PROG_LOAD 		 (1<<5)
+#define PPM_BPF_MAP_CREATE			0
+#define	PPM_BPF_MAP_LOOKUP_ELEM     1
+#define	PPM_BPF_MAP_UPDATE_ELEM		2
+#define	PPM_BPF_MAP_DELETE_ELEM		3
+#define	PPM_BPF_MAP_GET_NEXT_KEY	4
+#define	PPM_BPF_PROG_LOAD			5
+#define	PPM_BPF_OBJ_PIN				6
+#define	PPM_BPF_OBJ_GET				7
+#define	PPM_BPF_PROG_ATTACH			8
+#define	PPM_BPF_PROG_DETACH			9
+#define	PPM_BPF_PROG_TEST_RUN		10
+#define	PPM_BPF_PROG_RUN  PPM_BPF_PROG_TEST_RUN
+#define	PPM_BPF_PROG_GET_NEXT_ID	11
+#define	PPM_BPF_MAP_GET_NEXT_ID		12
+#define	PPM_BPF_PROG_GET_FD_BY_ID	13
+#define	PPM_BPF_MAP_GET_FD_BY_ID	14
+#define	PPM_BPF_OBJ_GET_INFO_BY_FD	15
+#define	PPM_BPF_PROG_QUERY			16
+#define	PPM_BPF_RAW_TRACEPOINT_OPEN	17
+#define	PPM_BPF_BTF_LOAD			18
+#define	PPM_BPF_BTF_GET_FD_BY_ID	19
+#define	PPM_BPF_TASK_FD_QUERY		20
+#define	PPM_BPF_MAP_LOOKUP_AND_DELETE_ELEM 21
+#define	PPM_BPF_MAP_FREEZE			22
+#define	PPM_BPF_BTF_GET_NEXT_ID		23
+#define	PPM_BPF_MAP_LOOKUP_BATCH	24		
+#define	PPM_BPF_MAP_LOOKUP_AND_DELETE_BATCH 25
+#define	PPM_BPF_MAP_UPDATE_BATCH	26
+#define	PPM_BPF_MAP_DELETE_BATCH	27
+#define	PPM_BPF_LINK_CREATE			28
+#define	PPM_BPF_LINK_UPDATE			29
+#define	PPM_BPF_LINK_GET_FD_BY_ID	30
+#define	PPM_BPF_LINK_GET_NEXT_ID	31
+#define	PPM_BPF_ENABLE_STATS		32
+#define	PPM_BPF_ITER_CREATE			33
+#define	PPM_BPF_LINK_DETACH			34
+#define	PPM_BPF_PROG_BIND_MAP		35
 
 /*
  * Get/set the timerslack as used by poll/select/nanosleep

driver/ppm_flag_helpers.h

@@ -2223,33 +2223,14 @@ static __always_inline uint32_t mknod_mode_to_scap(uint32_t modes)
 }
 
 static __always_inline uint32_t bpf_cmd_to_scap (unsigned long cmd){
-	switch (cmd)
-	{
-#ifdef BPF_MAP_CREATE
-	case BPF_MAP_CREATE: 
-		return PPM_BPF_MAP_CREATE;
-#endif
-#ifdef BPF_MAP_LOOKUP_ELEM
-	case BPF_MAP_LOOKUP_ELEM: 
-		return PPM_BPF_MAP_LOOKUP_ELEM;
-#endif
-#ifdef BPF_MAP_UPDATE_ELEM
-	case BPF_MAP_UPDATE_ELEM: 
-		return PPM_BPF_MAP_UPDATE_ELEM;
-#endif
-#ifdef BPF_MAP_DELETE_ELEM
-	case BPF_MAP_DELETE_ELEM: 
-		return PPM_BPF_MAP_DELETE_ELEM;
-#endif
-#ifdef BPF_MAP_GET_NEXT_KEY
-	case BPF_MAP_GET_NEXT_KEY: 
-		return PPM_BPF_MAP_GET_NEXT_KEY;
-#endif
-#ifdef BPF_PROG_LOAD
-	case BPF_PROG_LOAD:
-		return PPM_BPF_PROG_LOAD;
-#endif 	
-	}
+	/*
+	 * bpf opcodes are defined via enum in uapi/linux/bpf.h.
+	 * It is userspace API (thus stable) and arch-independent.
+	 * Therefore we map them 1:1; if any unmapped flag arrives,
+	 * we will just print its value to userspace without mapping it to a string flag.
+	 * We then need to append new flags to both flags_table and ppm_events_public PPM_ flags.
+	 */
+
 	return cmd;
 }
 #endif /* PPM_FLAG_HELPERS_H_ */