diff --git a/bpf/lib/generic.h b/bpf/lib/generic.h index 38d6e4c3acc..d5790d9e375 100644 --- a/bpf/lib/generic.h +++ b/bpf/lib/generic.h @@ -62,15 +62,4 @@ static inline __attribute__((always_inline)) size_t generic_kprobe_common_size() return offsetof(struct msg_generic_kprobe, args); } -/* tracepoint args */ -struct sched_execve_args { - unsigned short common_type; - unsigned char common_flags; - unsigned char common_preempt_count; - int common_pid; - int filename; - int pid; - int old_pid; -}; - #endif // _GENERIC__ diff --git a/bpf/process/bpf_execve_event.c b/bpf/process/bpf_execve_event.c index 85600f8d80a..59612148bba 100644 --- a/bpf/process/bpf_execve_event.c +++ b/bpf/process/bpf_execve_event.c @@ -176,10 +176,10 @@ read_exe(struct task_struct *task, struct heap_exe *exe) #endif __attribute__((section("tracepoint/sys_execve"), used)) int -event_execve(struct sched_execve_args *ctx) +event_execve(struct trace_event_raw_sched_process_exec *ctx) { struct task_struct *task = (struct task_struct *)get_current_task(); - char *filename = (char *)ctx + (ctx->filename & 0xFFFF); + char *filename = (char *)ctx + (_(ctx->__data_loc_filename) & 0xFFFF); struct msg_execve_event *event; struct execve_map_value *parent; struct msg_process *p; @@ -241,7 +241,7 @@ event_execve(struct sched_execve_args *ctx) * has already been collected, then send it to the perf buffer. */ __attribute__((section("tracepoint/0"), used)) int -execve_send(struct sched_execve_args *ctx) +execve_send(void *ctx) { struct msg_execve_event *event; struct execve_map_value *curr;