From 89f861d778d8bf6e053d3ed6b60df2455dcb60fb Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Sat, 2 Mar 2024 14:52:23 +0200 Subject: can print old and newname --- internal/c/generated/tracepoints.c | 28 ++++++++++++++-------------- internal/c/generated/tracepoints.raku | 4 ++-- 2 files changed, 16 insertions(+), 16 deletions(-) (limited to 'internal/c') diff --git a/internal/c/generated/tracepoints.c b/internal/c/generated/tracepoints.c index e824de3..6e17c0c 100644 --- a/internal/c/generated/tracepoints.c +++ b/internal/c/generated/tracepoints.c @@ -692,8 +692,8 @@ int handle_sys_enter_rename(struct trace_event_raw_sys_enter *ctx) { ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; __builtin_memset(&(ev->oldname), 0, sizeof(ev->oldname) + sizeof(ev->newname)); - bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (const char*)ctx->args[0]); - bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (const char*)ctx->args[1]); + bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (void*)ctx->args[0]); + bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (void*)ctx->args[1]); bpf_ringbuf_submit(ev, 0); return 0; @@ -736,8 +736,8 @@ int handle_sys_enter_renameat(struct trace_event_raw_sys_enter *ctx) { ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; __builtin_memset(&(ev->oldname), 0, sizeof(ev->oldname) + sizeof(ev->newname)); - bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (const char*)ctx->args[0]); - bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (const char*)ctx->args[1]); + bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (void*)ctx->args[0]); + bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (void*)ctx->args[1]); bpf_ringbuf_submit(ev, 0); return 0; @@ -780,8 +780,8 @@ int handle_sys_enter_renameat2(struct trace_event_raw_sys_enter *ctx) { ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; __builtin_memset(&(ev->oldname), 0, sizeof(ev->oldname) + sizeof(ev->newname)); - bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (const char*)ctx->args[0]); - bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (const char*)ctx->args[1]); + bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (void*)ctx->args[0]); + bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (void*)ctx->args[1]); bpf_ringbuf_submit(ev, 0); return 0; @@ -824,8 +824,8 @@ int handle_sys_enter_link(struct trace_event_raw_sys_enter *ctx) { ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; __builtin_memset(&(ev->oldname), 0, sizeof(ev->oldname) + sizeof(ev->newname)); - bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (const char*)ctx->args[0]); - bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (const char*)ctx->args[1]); + bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (void*)ctx->args[0]); + bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (void*)ctx->args[1]); bpf_ringbuf_submit(ev, 0); return 0; @@ -868,8 +868,8 @@ int handle_sys_enter_linkat(struct trace_event_raw_sys_enter *ctx) { ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; __builtin_memset(&(ev->oldname), 0, sizeof(ev->oldname) + sizeof(ev->newname)); - bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (const char*)ctx->args[0]); - bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (const char*)ctx->args[1]); + bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (void*)ctx->args[0]); + bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (void*)ctx->args[1]); bpf_ringbuf_submit(ev, 0); return 0; @@ -912,8 +912,8 @@ int handle_sys_enter_symlink(struct trace_event_raw_sys_enter *ctx) { ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; __builtin_memset(&(ev->oldname), 0, sizeof(ev->oldname) + sizeof(ev->newname)); - bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (const char*)ctx->args[0]); - bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (const char*)ctx->args[1]); + bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (void*)ctx->args[0]); + bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (void*)ctx->args[1]); bpf_ringbuf_submit(ev, 0); return 0; @@ -956,8 +956,8 @@ int handle_sys_enter_symlinkat(struct trace_event_raw_sys_enter *ctx) { ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; __builtin_memset(&(ev->oldname), 0, sizeof(ev->oldname) + sizeof(ev->newname)); - bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (const char*)ctx->args[0]); - bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (const char*)ctx->args[1]); + bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (void*)ctx->args[0]); + bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (void*)ctx->args[1]); bpf_ringbuf_submit(ev, 0); return 0; diff --git a/internal/c/generated/tracepoints.raku b/internal/c/generated/tracepoints.raku index ef79ed6..6eb938b 100644 --- a/internal/c/generated/tracepoints.raku +++ b/internal/c/generated/tracepoints.raku @@ -71,8 +71,8 @@ class Format { elsif $!has-name { q:to/END/.trim-trailing; __builtin_memset(&(ev->oldname), 0, sizeof(ev->oldname) + sizeof(ev->newname)); - bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (const char*)ctx->args[0]); - bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (const char*)ctx->args[1]); + bpf_probe_read_user_str(ev->oldname, sizeof(ev->oldname), (void*)ctx->args[0]); + bpf_probe_read_user_str(ev->newname, sizeof(ev->newname), (void*)ctx->args[1]); END } else { '' }; -- cgit v1.2.3