feat: add PPME_SYSCALL_LLSEEK_E params to PPME_SYSCALL_LLSEEK_X

[ekoops]

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:

This PR is part of #2427.

It adds enter events parameters to PPM_SYSCALL_LLSEEK_X event definition and aligns all three kernel drivers to the new definition. Moreover, it adds parsing tests for poll events.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

[ekoops]

/milestone 0.22.0

Kernel Testing CI run: https://github.com/falcosecurity/libs/actions/runs/15553704715

[github-actions]

Perf diff from master - unit tests

     1.96%     +0.46%  [.] sinsp_thread_manager::get_thread_ref
     1.93%     -0.44%  [.] can_query_os_for_thread_info
     0.50%     +0.37%  [.] sinsp_evt::get_direction
     4.85%     +0.34%  [.] sinsp_parser::reset
     2.42%     +0.32%  [.] gzfile_read
    26.51%     +0.29%  [.] sinsp_thread_manager::create_thread_dependencies
     2.21%     -0.25%  [.] is_conversion_needed
     1.04%     -0.19%  [.] sinsp_parser::event_cleanup
     0.80%     -0.19%  [.] convert_event
     1.37%     +0.18%  [.] std::_Hashtable<long, std::pair<long const, std::shared_ptr<sinsp_threadinfo> >, std::allocator<std::pair<long const, std::shared_ptr<sinsp_threadinfo> > >, std::__detail::_Select1st, std::equal_to<long>, std::hash<long>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::_M_find_before_node

Heap diff from master - unit tests

peak heap memory consumption: -1.30K
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Heap diff from master - scap file

peak heap memory consumption: -118B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            +0.0013         +0.0014           147           147           147           147
BM_sinsp_split_median                                          -0.0042         -0.0041           147           146           147           146
BM_sinsp_split_stddev                                          +1.4808         +1.4835             1             2             1             2
BM_sinsp_split_cv                                              +1.4776         +1.4801             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  -0.0757         -0.0756            63            58            63            58
BM_sinsp_concatenate_paths_relative_path_median                -0.0760         -0.0759            63            58            63            58
BM_sinsp_concatenate_paths_relative_path_stddev                +0.5266         +0.5256             1             1             1             1
BM_sinsp_concatenate_paths_relative_path_cv                    +0.6517         +0.6504             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     +0.0121         +0.0122            23            24            23            24
BM_sinsp_concatenate_paths_empty_path_median                   +0.0099         +0.0101            24            24            24            24
BM_sinsp_concatenate_paths_empty_path_stddev                   -0.2362         -0.2368             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_cv                       -0.2453         -0.2460             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  +0.0071         +0.0072            58            58            58            58
BM_sinsp_concatenate_paths_absolute_path_median                +0.0090         +0.0091            58            58            58            58
BM_sinsp_concatenate_paths_absolute_path_stddev                +2.0745         +2.0671             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_cv                    +2.0529         +2.0452             0             0             0             0

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 77.82%. Comparing base (fb382de) to head (6d8d613).
Report is 2 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2461      +/-   ##
==========================================
+ Coverage   77.80%   77.82%   +0.01%     
==========================================
  Files         245      247       +2     
  Lines       30971    30994      +23     
  Branches     4661     4661              
==========================================
+ Hits        24098    24121      +23     
  Misses       6873     6873              

Flag	Coverage Δ
libsinsp	77.82% <100.00%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[FedeDP]

/approve

[poiana]

LGTM label has been added.

Details

Git tree hash: d0411bb31ea8c839f24fa0b1ad11df1505a4e341

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops, FedeDP

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [FedeDP,ekoops]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ekoops]

Kernel Testing CI re-run: https://github.com/falcosecurity/libs/actions/runs/15554769741

[ekoops]

arm64:

KERNEL	CMAKE-CONFIGURE	KMOD BUILD	KMOD SCAP-OPEN	BPF-PROBE BUILD	BPF-PROBE SCAP-OPEN	MODERN-BPF SCAP-OPEN
amazonlinux2-5.4	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2022-5.15	🟢	🟢	🟢	🟢	🟢	🟢
fedora-6.2	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-4.14	🟢	🟢	🟢	🟡	🟡	🟡
oraclelinux-5.15	🟢	🟢	🟢	🟢	🟢	🟢
ubuntu-6.5	🟢	🟢	🟢	🟢	🟢	🟢

amd64:

KERNEL	CMAKE-CONFIGURE	KMOD BUILD	KMOD SCAP-OPEN	BPF-PROBE BUILD	BPF-PROBE SCAP-OPEN	MODERN-BPF SCAP-OPEN
amazonlinux2-4.19	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2-5.10	🟢	🟢	🟢	🟢	🟢	🟢
amazonlinux2-5.15	🟢	🟢	🟢	🟢	🟢	🟢
amazonlinux2-5.4	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2022-5.15	🟢	🟢	🟢	🟢	🟢	🟢
amazonlinux2023-6.1	🟢	🟢	🟢	🟢	🟢	🟢
archlinux-6.0	🟢	🟢	🟢	🟢	🟢	🟢
archlinux-6.7	🟢	🟢	🟢	🟢	🟢	🟢
centos-3.10	🟢	🟢	🟢	🟡	🟡	🟡
centos-4.18	🟢	🟢	🟢	🟢	🟢	🟢
centos-5.14	🟢	🟢	🟢	🟢	🟢	🟢
fedora-5.17	🟢	🟢	🟢	🟢	🟢	🟢
fedora-5.8	🟢	🟢	🟢	🟢	🟢	🟢
fedora-6.2	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-3.10	🟢	🟢	🟢	🟡	🟡	🟡
oraclelinux-4.14	🟢	🟢	🟢	🟢	🟢	🟡
oraclelinux-5.15	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-5.4	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-4.15	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-5.8	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-6.5	🟢	🟢	🟢	🟢	🟢	🟢