diff --git a/driver/event_table.c b/driver/event_table.c index 9705be0925..1a55687d15 100644 --- a/driver/event_table.c +++ b/driver/event_table.c @@ -421,7 +421,7 @@ const struct ppm_event_info g_event_info[] = { [PPME_SYSCALL_DUP_1_E] = {"dup", EC_IO_OTHER | EC_SYSCALL, EF_CREATES_FD | EF_USES_FD | EF_MODIFIES_STATE, 1, {{"fd", PT_FD, PF_DEC} } }, [PPME_SYSCALL_DUP_1_X] = {"dup", EC_IO_OTHER | EC_SYSCALL, EF_CREATES_FD | EF_USES_FD | EF_MODIFIES_STATE, 2, {{"res", PT_FD, PF_DEC}, {"oldfd", PT_FD, PF_DEC} } }, [PPME_SYSCALL_BPF_2_E] = {"bpf", EC_OTHER | EC_SYSCALL, EF_CREATES_FD, 1, {{"cmd", PT_INT64, PF_DEC} } }, - [PPME_SYSCALL_BPF_2_X] = {"bpf", EC_OTHER | EC_SYSCALL, EF_CREATES_FD, 2, { {"fd", PT_FD, PF_DEC}, {"cmd", PT_FLAGS32, PF_DEC, bpf_commands} } }, + [PPME_SYSCALL_BPF_2_X] = {"bpf", EC_OTHER | EC_SYSCALL, EF_CREATES_FD, 2, { {"fd", PT_FD, PF_DEC}, {"cmd", PT_ENUMFLAGS32, PF_DEC, bpf_commands} } }, [PPME_SYSCALL_MLOCK2_E] = {"mlock2", EC_MEMORY | EC_SYSCALL, EF_NONE, 0}, [PPME_SYSCALL_MLOCK2_X] = {"mlock2", EC_MEMORY | EC_SYSCALL, EF_NONE, 4, {{"res", PT_ERRNO, PF_DEC}, {"addr", PT_UINT64, PF_HEX}, {"len", PT_UINT64, PF_DEC}, {"flags", PT_UINT32, PF_HEX, mlock2_flags}}}, [PPME_SYSCALL_FSCONFIG_E] = {"fsconfig", EC_SYSTEM | EC_SYSCALL, EF_NONE, 0}, diff --git a/driver/flags_table.c b/driver/flags_table.c index 64536e0e4f..18c7a9c6b3 100644 --- a/driver/flags_table.c +++ b/driver/flags_table.c @@ -723,5 +723,36 @@ const struct ppm_name_value bpf_commands[] = { {"BPF_MAP_DELETE_ELEM", PPM_BPF_MAP_DELETE_ELEM}, {"BPF_MAP_GET_NEXT_KEY", PPM_BPF_MAP_GET_NEXT_KEY}, {"BPF_PROG_LOAD", PPM_BPF_PROG_LOAD}, + {"BPF_OBJ,PIN", PPM_BPF_OBJ_PIN}, + {"BPF_OBJ_GET", PPM_BPF_OBJ_GET}, + {"BPF_PROG_ATTACH", PPM_BPF_PROG_ATTACH}, + {"BPF_PROG_DETACH", PPM_BPF_PROG_DETACH}, + {"BPF_PROG_TEST_RUN", PPM_BPF_PROG_TEST_RUN}, + {"BPF_PROG_RUN", PPM_BPF_PROG_RUN}, + {"BPF_PROG_GET_NEXT_ID", PPM_BPF_PROG_GET_NEXT_ID}, + {"BPF_MAP_GET_NEXT_ID", PPM_BPF_MAP_GET_NEXT_ID}, + {"BPF_PROG_GET_FD_BY_ID", PPM_BPF_PROG_GET_FD_BY_ID}, + {"BPF_MAP_GET_FD_BY_ID", PPM_BPF_MAP_GET_FD_BY_ID}, + {"BPF_OBJ_GET_INFO_BY_FD", PPM_BPF_OBJ_GET_INFO_BY_FD}, + {"BPF_PROG_QUERY", PPM_BPF_PROG_QUERY}, + {"BPF_RAW_TRACEPOINT_OPEN", PPM_BPF_RAW_TRACEPOINT_OPEN}, + {"BPF_BTF_LOAD", PPM_BPF_BTF_LOAD}, + {"BPF_BTF_GET_FD_BY_ID", PPM_BPF_BTF_GET_FD_BY_ID}, + {"BPF_TASK_FD_QUERY", PPM_BPF_TASK_FD_QUERY}, + {"BPF_MAP_LOOKUP_AND_DELETE_ELEM", PPM_BPF_MAP_LOOKUP_AND_DELETE_ELEM}, + {"BPF_MAP_FREEZE", PPM_BPF_MAP_FREEZE}, + {"BPF_BTF_GET_NEXT_ID", PPM_BPF_BTF_GET_NEXT_ID}, + {"BPF_MAP_LOOKUP_BATCH", PPM_BPF_MAP_LOOKUP_BATCH}, + {"BPF_MAP_LOOKUP_AND_DELETE_BATCH", PPM_BPF_MAP_LOOKUP_AND_DELETE_BATCH}, + {"BPF_MAP_UPDATE_BATCH", PPM_BPF_MAP_UPDATE_BATCH}, + {"BPF_MAP_DELETE_BATCH", PPM_BPF_MAP_DELETE_BATCH}, + {"BPF_LINK_CREATE", PPM_BPF_LINK_CREATE}, + {"BPF_LINK_UPDATE", PPM_BPF_LINK_UPDATE}, + {"BPF_LINK_GET_FD_BY_ID", PPM_BPF_LINK_GET_FD_BY_ID}, + {"BPF_LINK_GET_NEXT_ID", PPM_BPF_LINK_GET_NEXT_ID}, + {"BPF_ENABLE_STATS", PPM_BPF_ENABLE_STATS}, + {"BPF_ITER_CREATE", PPM_BPF_ITER_CREATE}, + {"BPF_LINK_DETACH", PPM_BPF_LINK_DETACH}, + {"BPF_PROG_BIND_MAP", PPM_BPF_PROG_BIND_MAP}, {0,0}, }; \ No newline at end of file diff --git a/driver/ppm_events_public.h b/driver/ppm_events_public.h index 7246d6e153..27a994a421 100644 --- a/driver/ppm_events_public.h +++ b/driver/ppm_events_public.h @@ -808,12 +808,43 @@ or GPL2.txt for full copies of the license. /* * bpf_commands */ -#define PPM_BPF_MAP_CREATE (0<<1) -#define PPM_BPF_MAP_LOOKUP_ELEM (1<<1) -#define PPM_BPF_MAP_UPDATE_ELEM (1<<2) -#define PPM_BPF_MAP_DELETE_ELEM (1<<3) -#define PPM_BPF_MAP_GET_NEXT_KEY (1<<4) -#define PPM_BPF_PROG_LOAD (1<<5) +#define PPM_BPF_MAP_CREATE 0 +#define PPM_BPF_MAP_LOOKUP_ELEM 1 +#define PPM_BPF_MAP_UPDATE_ELEM 2 +#define PPM_BPF_MAP_DELETE_ELEM 3 +#define PPM_BPF_MAP_GET_NEXT_KEY 4 +#define PPM_BPF_PROG_LOAD 5 +#define PPM_BPF_OBJ_PIN 6 +#define PPM_BPF_OBJ_GET 7 +#define PPM_BPF_PROG_ATTACH 8 +#define PPM_BPF_PROG_DETACH 9 +#define PPM_BPF_PROG_TEST_RUN 10 +#define PPM_BPF_PROG_RUN PPM_BPF_PROG_TEST_RUN +#define PPM_BPF_PROG_GET_NEXT_ID 11 +#define PPM_BPF_MAP_GET_NEXT_ID 12 +#define PPM_BPF_PROG_GET_FD_BY_ID 13 +#define PPM_BPF_MAP_GET_FD_BY_ID 14 +#define PPM_BPF_OBJ_GET_INFO_BY_FD 15 +#define PPM_BPF_PROG_QUERY 16 +#define PPM_BPF_RAW_TRACEPOINT_OPEN 17 +#define PPM_BPF_BTF_LOAD 18 +#define PPM_BPF_BTF_GET_FD_BY_ID 19 +#define PPM_BPF_TASK_FD_QUERY 20 +#define PPM_BPF_MAP_LOOKUP_AND_DELETE_ELEM 21 +#define PPM_BPF_MAP_FREEZE 22 +#define PPM_BPF_BTF_GET_NEXT_ID 23 +#define PPM_BPF_MAP_LOOKUP_BATCH 24 +#define PPM_BPF_MAP_LOOKUP_AND_DELETE_BATCH 25 +#define PPM_BPF_MAP_UPDATE_BATCH 26 +#define PPM_BPF_MAP_DELETE_BATCH 27 +#define PPM_BPF_LINK_CREATE 28 +#define PPM_BPF_LINK_UPDATE 29 +#define PPM_BPF_LINK_GET_FD_BY_ID 30 +#define PPM_BPF_LINK_GET_NEXT_ID 31 +#define PPM_BPF_ENABLE_STATS 32 +#define PPM_BPF_ITER_CREATE 33 +#define PPM_BPF_LINK_DETACH 34 +#define PPM_BPF_PROG_BIND_MAP 35 /* * Get/set the timerslack as used by poll/select/nanosleep diff --git a/driver/ppm_flag_helpers.h b/driver/ppm_flag_helpers.h index 13a62e1deb..f0cac04de8 100644 --- a/driver/ppm_flag_helpers.h +++ b/driver/ppm_flag_helpers.h @@ -2223,33 +2223,14 @@ static __always_inline uint32_t mknod_mode_to_scap(uint32_t modes) } static __always_inline uint32_t bpf_cmd_to_scap (unsigned long cmd){ - switch (cmd) - { -#ifdef BPF_MAP_CREATE - case BPF_MAP_CREATE: - return PPM_BPF_MAP_CREATE; -#endif -#ifdef BPF_MAP_LOOKUP_ELEM - case BPF_MAP_LOOKUP_ELEM: - return PPM_BPF_MAP_LOOKUP_ELEM; -#endif -#ifdef BPF_MAP_UPDATE_ELEM - case BPF_MAP_UPDATE_ELEM: - return PPM_BPF_MAP_UPDATE_ELEM; -#endif -#ifdef BPF_MAP_DELETE_ELEM - case BPF_MAP_DELETE_ELEM: - return PPM_BPF_MAP_DELETE_ELEM; -#endif -#ifdef BPF_MAP_GET_NEXT_KEY - case BPF_MAP_GET_NEXT_KEY: - return PPM_BPF_MAP_GET_NEXT_KEY; -#endif -#ifdef BPF_PROG_LOAD - case BPF_PROG_LOAD: - return PPM_BPF_PROG_LOAD; -#endif - } + /* + * bpf opcodes are defined via enum in uapi/linux/bpf.h. + * It is userspace API (thus stable) and arch-independent. + * Therefore we map them 1:1; if any unmapped flag arrives, + * we will just print its value to userspace without mapping it to a string flag. + * We then need to append new flags to both flags_table and ppm_events_public PPM_ flags. + */ + return cmd; } #endif /* PPM_FLAG_HELPERS_H_ */ \ No newline at end of file