events: include 32bit syscalls in syscall event range (#2218)

This fixes a bug where 32 bit syscalls were out of range for the
sys_enter/exit tail call indexes, which caused a crash when tracing them.

Author: NDStrahilevitz

cmd/tracee-ebpf/main.go

@@ -423,7 +423,6 @@ func printList() {
 	b.WriteString("System Calls: " + titleHeaderPadFirst + "Sets:" + titleHeaderPadSecond + "Arguments:\n")
 	b.WriteString("____________  " + titleHeaderPadFirst + "____ " + titleHeaderPadSecond + "_________" + "\n\n")
 	printEventGroup(&b, 0, events.MaxSyscallID)
-	printEventGroup(&b, events.Unique32BitSyscallsStartID, events.Unique32BitSyscallsEndID)
 	b.WriteString("\n\nOther Events: " + titleHeaderPadFirst + "Sets:" + titleHeaderPadSecond + "Arguments:\n")
 	b.WriteString("____________  " + titleHeaderPadFirst + "____ " + titleHeaderPadSecond + "_________\n\n")
 	printEventGroup(&b, events.SysEnter, events.MaxCommonID)
@@ -441,7 +440,7 @@ func printEventGroup(b *strings.Builder, firstEventID, lastEventID events.ID) {
 			continue
 		}
 		if event.Sets != nil {
-			eventSets := fmt.Sprintf("%-22s %-40s %s\n", event.Name, fmt.Sprintf("%v", event.Sets), getFormattedEventParams(i))
+			eventSets := fmt.Sprintf("%-28s %-40s %s\n", event.Name, fmt.Sprintf("%v", event.Sets), getFormattedEventParams(i))
 			b.WriteString(eventSets)
 		} else {
 			b.WriteString(event.Name + "\n")

pkg/events/amd64.go

@@ -343,37 +343,33 @@ const (
 	IoPgetevents        ID = 333
 	Rseq                ID = 334
 	// 335 through 423 are unassigned to sync up with generic numbers
-	PidfdSendSignal       ID = 424
-	IoUringSetup          ID = 425
-	IoUringEnter          ID = 426
-	IoUringRegister       ID = 427
-	OpenTree              ID = 428
-	MoveMount             ID = 429
-	Fsopen                ID = 430
-	Fsconfig              ID = 431
-	Fsmount               ID = 432
-	Fspick                ID = 433
-	PidfdOpen             ID = 434
-	Clone3                ID = 435
-	CloseRange            ID = 436
-	Openat2               ID = 437
-	PidfdGetfd            ID = 438
-	Faccessat2            ID = 439
-	ProcessMadvise        ID = 440
-	EpollPwait2           ID = 441
-	MountSetatt           ID = 442
-	QuotactlFd            ID = 443
-	LandlockCreateRuleset ID = 444
-	LandlockAddRule       ID = 445
-	LandloclRestrictSet   ID = 446
-	MemfdSecret           ID = 447
-	ProcessMrelease       ID = 448
-	MaxSyscallID          ID = 449
-)
-
-// Set of events IDs for 32bit syscalls which have no parallel 64bit syscall
-const (
-	Waitpid ID = iota + Unique32BitSyscallsStartID
+	PidfdSendSignal ID = iota + 89 // iota = 335 here 335 + 89 = 424
+	IoUringSetup
+	IoUringEnter
+	IoUringRegister
+	OpenTree
+	MoveMount
+	Fsopen
+	Fsconfig
+	Fsmount
+	Fspick
+	PidfdOpen
+	Clone3
+	CloseRange
+	Openat2
+	PidfdGetfd
+	Faccessat2
+	ProcessMadvise
+	EpollPwait2
+	MountSetatt
+	QuotactlFd
+	LandlockCreateRuleset
+	LandlockAddRule
+	LandloclRestrictSet
+	MemfdSecret
+	ProcessMrelease
+	// Set of events IDs for 32bit syscalls which have no parallel 64bit syscall
+	Waitpid
 	Oldfstat
 	Break
 	Oldstat
@@ -459,7 +455,7 @@ const (
 	RtSigtimedwaitTime32
 	FutexTime32
 	SchedRrGetInterval32
-	Unique32BitSyscallsEndID
+	MaxSyscallID
 )
 
 // x86 32bit syscall numbers

pkg/events/arm64.go

@@ -348,11 +348,9 @@ const (
 	MemfdSecret              ID = 447
 	ProcessMrelease          ID = 448
 	MaxSyscallID             ID = 449
+	// TODO: Compile list of unique 32bit syscalls for arm64
 )
 
-// TODO: There isnt a Unique32BitSyscalls list for arm64
-const Unique32BitSyscallsEndID ID = Unique32BitSyscallsStartID
-
 // following syscalls are undefined on arm64
 const (
 	Open ID = iota + 10000

pkg/events/events.go

@@ -170,8 +170,6 @@ const (
 	MaxUserSpace
 )
 
-const Unique32BitSyscallsStartID = 3000
-
 // Capture meta-events
 const (
 	CaptureFileWrite ID = iota + 4000