Skip to content

Conversation

@ywmei-brt1
Copy link

Fixes #4442

Description

This PR adds support for the int32_arr argument type in tracing policies. This feature is required for tracing syscalls like pipe2(int pipefd[2], int flags), where the kernel returns an array of integers (file descriptors) as an output parameter.

Key Changes:

  • API: Added Int32ListArg to the KprobeArgument protobuf definition and updated the corresponding CRDs.
  • BPF & Userspace: Implemented logic to handle int32_arr both in the BPF programs and the Go user-space agent. This includes support for returnCopy, allowing the capture of output arguments that are populated only when the function returns (kretprobe).
  • Testing: Added a unit test (TestGetArgInt32Arr) for parsing logic and a new E2E test (TestKprobePipe2Return) verifying that pipe2 calls are correctly intercepted and the file descriptors are captured.

Add support for Int32ListArg to the KprobeArgument in protobuf.
This allows capturing arrays of int32 from BPF kprobes.
Includes regenerated code, CRDs, and updated generated docs.

Fixes: cilium#4442
Signed-off-by: Yaowen Mei <[email protected]>
Implement parsing for int32_array arguments in both BPF
and userspace. This allows capturing array arguments
from syscalls like pipe2.

Fixes: cilium#4442
Signed-off-by: Yaowen Mei <[email protected]>
Add E2E tests and example tracing policies for int32_arr.

Signed-off-by: Yaowen Mei <[email protected]>
@ywmei-brt1 ywmei-brt1 requested a review from a team as a code owner December 22, 2025 18:45
@ywmei-brt1 ywmei-brt1 requested a review from tixxdz December 22, 2025 18:45
@netlify
Copy link

netlify bot commented Dec 22, 2025

Deploy Preview for tetragon ready!

Name Link
🔨 Latest commit 223e33b
🔍 Latest deploy log https://app.netlify.com/projects/tetragon/deploys/695be6d4c5c7bb00089f2501
😎 Deploy Preview https://deploy-preview-4456--tetragon.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Fix warnings from golangci-lint in int32_arr support:
- Avoid allocations in pipe2_test.go
- Remove empty block in args_linux.go
- Use require instead of assert in args_linux_test.go

Also capture updates to generated files and docs from make generate.

Signed-off-by: Yaowen Mei <[email protected]>
@ywmei-brt1 ywmei-brt1 force-pushed the pr/ywmei-brt1/support-int32-array branch from 223e33b to d37519b Compare January 5, 2026 18:36
@mtardy mtardy added the release-note/minor This PR introduces a minor user-visible change label Jan 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

release-note/minor This PR introduces a minor user-visible change

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support for int32_arr argument type to capture integer array (file descriptor array) output parameters

2 participants