bpf & pipeline: changed ProcessorID size in Context

r21gh · Feb 3, 2022 · 99cdcee · 99cdcee
1 parent 0ba181b
commit 99cdcee
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/tracee-ebpf/tracee/events_pipeline.go b/tracee-ebpf/tracee/events_pipeline.go
@@ -23,7 +23,6 @@ const maxStackDepth int = 20
 type context struct {
 	Ts          uint64
 	CgroupID    uint64
-	ProcessorId uint64
 	Pid         uint32
 	Tid         uint32
 	Ppid        uint32
@@ -38,8 +37,9 @@ type context struct {
 	EventID     int32
 	Retval      int64
 	StackID     uint32
+	ProcessorId uint16
 	Argnum      uint8
-	_           [3]byte //padding
+	_           [1]byte //padding
 }
 
 // handleEvents is a high-level function that starts all operations related to events processing

diff --git a/tracee-ebpf/tracee/tracee.bpf.c b/tracee-ebpf/tracee/tracee.bpf.c
@@ -373,7 +373,6 @@ Copyright (C) Aqua Security inc.
 typedef struct event_context {
     u64 ts;                        // Timestamp
     u64 cgroup_id;
-    u64 processor_id;              // The ID of the processor which processed the event
     u32 pid;                       // PID as in the userspace term
     u32 tid;                       // TID as in the userspace term
     u32 ppid;                      // Parent PID as in the userspace term
@@ -388,6 +387,7 @@ typedef struct event_context {
     u32 eventid;
     s64 retval;
     u32 stack_id;
+    u16 processor_id;              // The ID of the processor which processed the event
     u8 argnum;
 } context_t;
 
@@ -1166,7 +1166,7 @@ static __always_inline int init_context(context_t *context, struct task_struct *
     // Clean Stack Trace ID
     context->stack_id = 0;
 
-    context->processor_id = bpf_get_smp_processor_id();
+    context->processor_id = (u16)bpf_get_smp_processor_id();
 
     return 0;
 }