feat: add `PPME_SYSCALL_SEMOP_E` params to `PPME_SYSCALL_SEMOP_X` #2489

ekoops · 2025-06-20T07:57:19Z

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:

This PR is part of #2427.

It:

adds PPME_SYSCALL_SEMOP_E parameters to PPME_SYSCALL_SEMOP_X event definition and aligns all 3 kernel drivers to it.
adds new rules to scap file converter table to convert events in old scap files to the new layout.
adds/updates semop-related drivers, scap converter and sinsp parser tests to account the new layout.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

ekoops · 2025-06-20T07:57:33Z

/milestone 0.22.0

poiana · 2025-06-20T07:57:39Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [ekoops]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

codecov · 2025-06-20T08:07:20Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 78.08%. Comparing base (da77c77) to head (96811ef).
Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2489      +/-   ##
==========================================
+ Coverage   78.06%   78.08%   +0.01%     
==========================================
  Files         261      262       +1     
  Lines       31260    31282      +22     
  Branches     4645     4645              
==========================================
+ Hits        24404    24426      +22     
  Misses       6856     6856

Flag	Coverage Δ
libsinsp	`78.08% <100.00%> (+0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Add `PPME_SYSCALL_SEMOP_E` parameters to `PPME_SYSCALL_SEMOP_X` event definition and aligns all 3 kernel drivers to it. Add new rules to scap file converter table to convert events in old scap files to the new layout. Add/update semop-related drivers, scap converter and sinsp parser tests to account the new layout. Signed-off-by: Leonardo Di Giovanna <[email protected]>

github-actions · 2025-06-20T08:43:21Z

Perf diff from master - unit tests

     5.50%     +0.44%  [.] sinsp_evt::get_type
     5.34%     -0.36%  [.] sinsp_thread_manager::find_thread
     7.44%     -0.29%  [.] sinsp::next
     1.65%     -0.27%  [.] user_group_updater::~user_group_updater
     0.93%     +0.26%  [.] user_group_updater::user_group_updater
     0.93%     +0.22%  [.] libsinsp::sinsp_suppress::process_event
     1.58%     -0.22%  [.] scap_event_decode_params
     0.46%     +0.21%  [.] scap_next
     3.85%     +0.21%  [.] next_event_from_file
     3.07%     -0.18%  [.] gzfile_read

Heap diff from master - unit tests

peak heap memory consumption: -704B
peak RSS (including heaptrack overhead): 0B
total memory leaked: -2.89M

Heap diff from master - scap file

peak heap memory consumption: -114B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            +0.0303         +0.0303           143           147           143           147
BM_sinsp_split_median                                          +0.0318         +0.0318           143           147           143           147
BM_sinsp_split_stddev                                          +2.3891         +2.3911             0             1             0             1
BM_sinsp_split_cv                                              +2.2893         +2.2913             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  +0.0654         +0.0654            57            61            57            61
BM_sinsp_concatenate_paths_relative_path_median                +0.0710         +0.0710            57            61            57            61
BM_sinsp_concatenate_paths_relative_path_stddev                +2.6470         +2.6459             0             1             0             1
BM_sinsp_concatenate_paths_relative_path_cv                    +2.4232         +2.4222             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     -0.0012         -0.0012            24            24            24            24
BM_sinsp_concatenate_paths_empty_path_median                   -0.0007         -0.0007            24            24            24            24
BM_sinsp_concatenate_paths_empty_path_stddev                   -0.4148         -0.4166             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_cv                       -0.4142         -0.4159             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  -0.0128         -0.0128            58            58            58            58
BM_sinsp_concatenate_paths_absolute_path_median                -0.0264         -0.0264            59            57            59            57
BM_sinsp_concatenate_paths_absolute_path_stddev                +0.3213         +0.3206             1             1             1             1
BM_sinsp_concatenate_paths_absolute_path_cv                    +0.3385         +0.3377             0             0             0             0

github-actions · 2025-06-20T09:01:45Z

X64 kernel testing matrix

KERNEL	CMAKE-CONFIGURE	KMOD BUILD	KMOD SCAP-OPEN	BPF-PROBE BUILD	BPF-PROBE SCAP-OPEN	MODERN-BPF SCAP-OPEN
amazonlinux2-4.19	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2-5.10	🟢	🟢	🟢	🟢	🟢	🟢
amazonlinux2-5.15	🟢	🟢	🟢	🟢	🟢	🟢
amazonlinux2-5.4	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2022-5.15	🟢	🟢	🟢	🟢	🟢	🟢
amazonlinux2023-6.1	🟢	🟢	🟢	🟢	🟢	🟢
archlinux-6.0	🟢	🟢	🟢	🟢	🟢	🟢
archlinux-6.7	🟢	🟢	🟢	🟢	🟢	🟢
centos-3.10	🟢	🟢	🟢	🟡	🟡	🟡
centos-4.18	🟢	🟢	🟢	🟢	🟢	🟢
centos-5.14	🟢	🟢	🟢	🟢	🟢	🟢
fedora-5.17	🟢	🟢	🟢	🟢	🟢	🟢
fedora-5.8	🟢	🟢	🟢	🟢	🟢	🟢
fedora-6.2	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-3.10	🟢	🟢	🟢	🟡	🟡	🟡
oraclelinux-4.14	🟢	🟢	🟢	🟢	🟢	🟡
oraclelinux-5.15	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-5.4	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-4.15	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-5.8	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-6.5	🟢	🟢	🟢	🟢	🟢	🟢

ARM64 kernel testing matrix

KERNEL	CMAKE-CONFIGURE	KMOD BUILD	KMOD SCAP-OPEN	BPF-PROBE BUILD	BPF-PROBE SCAP-OPEN	MODERN-BPF SCAP-OPEN
amazonlinux2-5.4	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2022-5.15	🟢	🟢	🟢	🟢	🟢	🟢
fedora-6.2	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-4.14	🟢	🟢	🟢	🟡	🟡	🟡
oraclelinux-5.15	🟢	🟢	🟢	🟢	🟢	🟢
ubuntu-6.5	🟢	🟢	🟢	🟢	🟢	🟢

poiana · 2025-06-20T09:06:10Z

LGTM label has been added.

Details

Git tree hash: 7dda7935ba624fd45a782ad10cf6f4b04f0469bd

github-project-automation bot added this to Falco Roadmap Jun 20, 2025

github-project-automation bot moved this to Todo in Falco Roadmap Jun 20, 2025

poiana added release-note-none kind/test PRs increasing the test coverage without fixing any failing test dco-signoff: yes kind/feature New feature or request area/driver-kmod area/driver-bpf area/driver-modern-bpf area/libscap-engine-savefile area/libscap area/tests labels Jun 20, 2025

poiana added this to the 0.22.0 milestone Jun 20, 2025

poiana added the size/L label Jun 20, 2025

poiana added the approved label Jun 20, 2025

poiana requested review from LucaGuerra and hbrueckner June 20, 2025 07:57

ekoops mentioned this pull request Jun 20, 2025

[Tracking] Extend syscall exit events with syscall enter events parameters #2427

Closed

ekoops force-pushed the ekoops/convert-semop branch from f4c4710 to 96811ef Compare June 20, 2025 08:08

gnosek approved these changes Jun 20, 2025

View reviewed changes

poiana assigned gnosek Jun 20, 2025

poiana added the lgtm label Jun 20, 2025

jasondellaluce approved these changes Jun 20, 2025

View reviewed changes

poiana assigned jasondellaluce Jun 20, 2025

github-project-automation bot moved this from Todo to In progress in Falco Roadmap Jun 20, 2025

poiana merged commit 2f1bd46 into master Jun 20, 2025
58 of 60 checks passed

poiana deleted the ekoops/convert-semop branch June 20, 2025 09:12

github-project-automation bot moved this from In progress to Done in Falco Roadmap Jun 20, 2025

leogr modified the milestones: 0.22.0, 9.0.0+driver Oct 16, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: add `PPME_SYSCALL_SEMOP_E` params to `PPME_SYSCALL_SEMOP_X` #2489

feat: add `PPME_SYSCALL_SEMOP_E` params to `PPME_SYSCALL_SEMOP_X` #2489

Uh oh!

ekoops commented Jun 20, 2025

Uh oh!

ekoops commented Jun 20, 2025

Uh oh!

poiana commented Jun 20, 2025

Uh oh!

codecov bot commented Jun 20, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Jun 20, 2025

Uh oh!

github-actions bot commented Jun 20, 2025

Uh oh!

poiana commented Jun 20, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

feat: add PPME_SYSCALL_SEMOP_E params to PPME_SYSCALL_SEMOP_X #2489

feat: add PPME_SYSCALL_SEMOP_E params to PPME_SYSCALL_SEMOP_X #2489

Uh oh!

Conversation

ekoops commented Jun 20, 2025

Uh oh!

ekoops commented Jun 20, 2025

Uh oh!

poiana commented Jun 20, 2025

Uh oh!

codecov bot commented Jun 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Jun 20, 2025

Perf diff from master - unit tests

Heap diff from master - unit tests

Heap diff from master - scap file

Benchmarks diff from master

Uh oh!

github-actions bot commented Jun 20, 2025

X64 kernel testing matrix

ARM64 kernel testing matrix

Uh oh!

poiana commented Jun 20, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

feat: add `PPME_SYSCALL_SEMOP_E` params to `PPME_SYSCALL_SEMOP_X` #2489

feat: add `PPME_SYSCALL_SEMOP_E` params to `PPME_SYSCALL_SEMOP_X` #2489

codecov bot commented Jun 20, 2025 •

edited

Loading