summaryrefslogtreecommitdiff
path: root/internal
diff options
context:
space:
mode:
Diffstat (limited to 'internal')
-rw-r--r--internal/c/generated_tracepoints.c738
-rw-r--r--internal/generate/bpfhandler.go4
-rw-r--r--internal/generate/codegen_test.go35
-rw-r--r--internal/generate/testdata.go59
4 files changed, 465 insertions, 371 deletions
diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c
index 4a5bd60..8dfd53f 100644
--- a/internal/c/generated_tracepoints.c
+++ b/internal/c/generated_tracepoints.c
@@ -770,7 +770,7 @@ int handle_sys_exit_socket(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_SOCKET, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_SOCKET, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -832,7 +832,7 @@ int handle_sys_exit_socketpair(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_SOCKETPAIR, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_SOCKETPAIR, ctx->ret))
return 0;
struct socketpair_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct socketpair_event), 0);
@@ -906,7 +906,7 @@ int handle_sys_exit_bind(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_BIND, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_BIND, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -957,7 +957,7 @@ int handle_sys_exit_listen(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_LISTEN, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_LISTEN, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -1009,7 +1009,7 @@ int handle_sys_exit_accept4(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_ACCEPT4, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_ACCEPT4, ctx->ret))
return 0;
struct accept_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct accept_event), 0);
@@ -1061,7 +1061,7 @@ int handle_sys_exit_accept(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_ACCEPT, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_ACCEPT, ctx->ret))
return 0;
struct accept_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct accept_event), 0);
@@ -1112,7 +1112,7 @@ int handle_sys_exit_connect(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_CONNECT, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_CONNECT, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -1163,7 +1163,7 @@ int handle_sys_exit_getsockname(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_GETSOCKNAME, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_GETSOCKNAME, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -1214,7 +1214,7 @@ int handle_sys_exit_getpeername(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_GETPEERNAME, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_GETPEERNAME, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -1265,7 +1265,7 @@ int handle_sys_exit_sendto(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_SENDTO, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_SENDTO, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -1316,7 +1316,7 @@ int handle_sys_exit_recvfrom(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_RECVFROM, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_RECVFROM, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -1367,7 +1367,7 @@ int handle_sys_exit_setsockopt(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_SETSOCKOPT, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_SETSOCKOPT, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -1418,7 +1418,7 @@ int handle_sys_exit_getsockopt(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_GETSOCKOPT, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_GETSOCKOPT, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -1469,7 +1469,7 @@ int handle_sys_exit_shutdown(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_SHUTDOWN, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_SHUTDOWN, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -1520,7 +1520,7 @@ int handle_sys_exit_sendmsg(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_SENDMSG, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_SENDMSG, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -1571,7 +1571,7 @@ int handle_sys_exit_sendmmsg(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_SENDMMSG, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_SENDMMSG, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -1622,7 +1622,7 @@ int handle_sys_exit_recvmsg(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_RECVMSG, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_RECVMSG, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -1673,7 +1673,7 @@ int handle_sys_exit_recvmmsg(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_RECVMMSG, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_RECVMMSG, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -1723,7 +1723,7 @@ int handle_sys_exit_getrandom(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_GETRANDOM, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_GETRANDOM, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -1774,7 +1774,7 @@ int handle_sys_exit_io_uring_register(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_URING_REGISTER, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_IO_URING_REGISTER, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -1825,7 +1825,7 @@ int handle_sys_exit_io_uring_enter(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_URING_ENTER, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_IO_URING_ENTER, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -1875,7 +1875,7 @@ int handle_sys_exit_io_uring_setup(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_URING_SETUP, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_IO_URING_SETUP, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -1925,7 +1925,7 @@ int handle_sys_exit_ioprio_set(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_IOPRIO_SET, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_IOPRIO_SET, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -1975,7 +1975,7 @@ int handle_sys_exit_ioprio_get(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_IOPRIO_GET, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_IOPRIO_GET, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -2029,7 +2029,7 @@ int handle_sys_exit_landlock_create_ruleset(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_LANDLOCK_CREATE_RULESET, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_LANDLOCK_CREATE_RULESET, ctx->ret))
return 0;
struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0);
@@ -2086,7 +2086,7 @@ int handle_sys_exit_landlock_add_rule(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_LANDLOCK_ADD_RULE, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_LANDLOCK_ADD_RULE, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -2137,7 +2137,7 @@ int handle_sys_exit_landlock_restrict_self(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_LANDLOCK_RESTRICT_SELF, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_LANDLOCK_RESTRICT_SELF, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -2187,7 +2187,7 @@ int handle_sys_exit_lsm_set_self_attr(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_LSM_SET_SELF_ATTR, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_LSM_SET_SELF_ATTR, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -2237,7 +2237,7 @@ int handle_sys_exit_lsm_get_self_attr(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_LSM_GET_SELF_ATTR, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_LSM_GET_SELF_ATTR, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -2287,7 +2287,7 @@ int handle_sys_exit_lsm_list_modules(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_LSM_LIST_MODULES, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_LSM_LIST_MODULES, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -2340,7 +2340,7 @@ int handle_sys_exit_add_key(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_ADD_KEY, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_ADD_KEY, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -2393,7 +2393,7 @@ int handle_sys_exit_request_key(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_REQUEST_KEY, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_REQUEST_KEY, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -2446,7 +2446,7 @@ int handle_sys_exit_keyctl(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_KEYCTL, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_KEYCTL, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -2500,7 +2500,7 @@ int handle_sys_exit_mq_open(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_MQ_OPEN, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_MQ_OPEN, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -2552,7 +2552,7 @@ int handle_sys_exit_mq_unlink(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_MQ_UNLINK, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_MQ_UNLINK, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -2603,7 +2603,7 @@ int handle_sys_exit_mq_timedsend(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_MQ_TIMEDSEND, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_MQ_TIMEDSEND, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -2654,7 +2654,7 @@ int handle_sys_exit_mq_timedreceive(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_MQ_TIMEDRECEIVE, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_MQ_TIMEDRECEIVE, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -2705,7 +2705,7 @@ int handle_sys_exit_mq_notify(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_MQ_NOTIFY, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_MQ_NOTIFY, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -2756,7 +2756,7 @@ int handle_sys_exit_mq_getsetattr(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_MQ_GETSETATTR, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_MQ_GETSETATTR, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -2806,7 +2806,7 @@ int handle_sys_exit_shmget(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_SHMGET, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_SHMGET, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -2856,7 +2856,7 @@ int handle_sys_exit_shmctl(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_SHMCTL, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_SHMCTL, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -2906,7 +2906,7 @@ int handle_sys_exit_shmat(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_SHMAT, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_SHMAT, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -2956,7 +2956,7 @@ int handle_sys_exit_shmdt(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_SHMDT, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_SHMDT, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3006,7 +3006,7 @@ int handle_sys_exit_semget(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_SEMGET, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_SEMGET, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3056,7 +3056,7 @@ int handle_sys_exit_semctl(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_SEMCTL, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_SEMCTL, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3106,7 +3106,7 @@ int handle_sys_exit_semtimedop(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_SEMTIMEDOP, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_SEMTIMEDOP, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3156,7 +3156,7 @@ int handle_sys_exit_semop(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_SEMOP, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_SEMOP, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3206,7 +3206,7 @@ int handle_sys_exit_msgget(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_MSGGET, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_MSGGET, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3256,7 +3256,7 @@ int handle_sys_exit_msgctl(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_MSGCTL, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_MSGCTL, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3306,7 +3306,7 @@ int handle_sys_exit_msgsnd(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_MSGSND, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_MSGSND, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3356,7 +3356,7 @@ int handle_sys_exit_msgrcv(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_MSGRCV, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_MSGRCV, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3408,7 +3408,7 @@ int handle_sys_exit_quotactl(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_QUOTACTL, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_QUOTACTL, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3459,7 +3459,7 @@ int handle_sys_exit_quotactl_fd(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_QUOTACTL_FD, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_QUOTACTL_FD, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3511,7 +3511,7 @@ int handle_sys_exit_name_to_handle_at(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_NAME_TO_HANDLE_AT, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_NAME_TO_HANDLE_AT, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3562,7 +3562,7 @@ int handle_sys_exit_open_by_handle_at(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_OPEN_BY_HANDLE_AT, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_OPEN_BY_HANDLE_AT, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3613,7 +3613,7 @@ int handle_sys_exit_flock(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_FLOCK, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_FLOCK, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3663,7 +3663,7 @@ int handle_sys_exit_io_setup(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_SETUP, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_IO_SETUP, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3713,7 +3713,7 @@ int handle_sys_exit_io_destroy(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_DESTROY, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_IO_DESTROY, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3763,7 +3763,7 @@ int handle_sys_exit_io_submit(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_SUBMIT, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_IO_SUBMIT, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3813,7 +3813,7 @@ int handle_sys_exit_io_cancel(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_CANCEL, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_IO_CANCEL, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3863,7 +3863,7 @@ int handle_sys_exit_io_getevents(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_GETEVENTS, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_IO_GETEVENTS, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3913,7 +3913,7 @@ int handle_sys_exit_io_pgetevents(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_PGETEVENTS, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_IO_PGETEVENTS, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -3967,7 +3967,7 @@ int handle_sys_exit_userfaultfd(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_USERFAULTFD, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_USERFAULTFD, ctx->ret))
return 0;
struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0);
@@ -4027,7 +4027,7 @@ int handle_sys_exit_eventfd2(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_EVENTFD2, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_EVENTFD2, ctx->ret))
return 0;
struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0);
@@ -4087,7 +4087,7 @@ int handle_sys_exit_eventfd(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_EVENTFD, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_EVENTFD, ctx->ret))
return 0;
struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0);
@@ -4147,7 +4147,7 @@ int handle_sys_exit_timerfd_create(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_TIMERFD_CREATE, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_TIMERFD_CREATE, ctx->ret))
return 0;
struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0);
@@ -4203,7 +4203,7 @@ int handle_sys_exit_timerfd_settime(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_TIMERFD_SETTIME, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_TIMERFD_SETTIME, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -4253,7 +4253,7 @@ int handle_sys_exit_timerfd_gettime(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_TIMERFD_GETTIME, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_TIMERFD_GETTIME, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -4307,7 +4307,7 @@ int handle_sys_exit_signalfd4(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_SIGNALFD4, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_SIGNALFD4, ctx->ret))
return 0;
struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0);
@@ -4367,7 +4367,7 @@ int handle_sys_exit_signalfd(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_SIGNALFD, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_SIGNALFD, ctx->ret))
return 0;
struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0);
@@ -4427,7 +4427,7 @@ int handle_sys_exit_epoll_create1(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_EPOLL_CREATE1, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_EPOLL_CREATE1, ctx->ret))
return 0;
struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0);
@@ -4471,7 +4471,7 @@ int handle_sys_enter_epoll_create(struct syscall_trace_enter *ctx) {
ev->pid = pid;
ev->tid = tid;
ev->time = bpf_ktime_get_boot_ns();
- __s32 flags = (__s32)ctx->args[0];
+ __s32 flags = 0;
bpf_map_update_elem(&eventfd_flags_map, &tid, &flags, BPF_ANY);
ev->flags = flags;
ev->ret = -1;
@@ -4487,7 +4487,7 @@ int handle_sys_exit_epoll_create(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_EPOLL_CREATE, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_EPOLL_CREATE, ctx->ret))
return 0;
struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0);
@@ -4553,7 +4553,7 @@ int handle_sys_exit_epoll_ctl(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_EPOLL_CTL, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_EPOLL_CTL, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -4604,7 +4604,7 @@ int handle_sys_exit_epoll_wait(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_EPOLL_WAIT, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_EPOLL_WAIT, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -4655,7 +4655,7 @@ int handle_sys_exit_epoll_pwait(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_EPOLL_PWAIT, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_EPOLL_PWAIT, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -4706,7 +4706,7 @@ int handle_sys_exit_epoll_pwait2(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_EPOLL_PWAIT2, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_EPOLL_PWAIT2, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -4760,7 +4760,7 @@ int handle_sys_exit_fanotify_init(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_FANOTIFY_INIT, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_FANOTIFY_INIT, ctx->ret))
return 0;
struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0);
@@ -4818,7 +4818,7 @@ int handle_sys_exit_fanotify_mark(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_FANOTIFY_MARK, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_FANOTIFY_MARK, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -4872,7 +4872,7 @@ int handle_sys_exit_inotify_init1(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_INOTIFY_INIT1, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_INOTIFY_INIT1, ctx->ret))
return 0;
struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0);
@@ -4932,7 +4932,7 @@ int handle_sys_exit_inotify_init(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_INOTIFY_INIT, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_INOTIFY_INIT, ctx->ret))
return 0;
struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0);
@@ -4989,7 +4989,7 @@ int handle_sys_exit_inotify_add_watch(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_INOTIFY_ADD_WATCH, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_INOTIFY_ADD_WATCH, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -5040,7 +5040,7 @@ int handle_sys_exit_inotify_rm_watch(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_INOTIFY_RM_WATCH, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_INOTIFY_RM_WATCH, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -5092,7 +5092,7 @@ int handle_sys_exit_file_getattr(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_FILE_GETATTR, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_FILE_GETATTR, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -5144,7 +5144,7 @@ int handle_sys_exit_file_setattr(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_FILE_SETATTR, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_FILE_SETATTR, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -5198,7 +5198,7 @@ int handle_sys_exit_fsopen(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_FSOPEN, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_FSOPEN, ctx->ret))
return 0;
struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0);
@@ -5256,7 +5256,7 @@ int handle_sys_exit_fspick(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_FSPICK, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_FSPICK, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -5307,7 +5307,7 @@ int handle_sys_exit_fsconfig(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_FSCONFIG, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_FSCONFIG, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -5359,7 +5359,7 @@ int handle_sys_exit_statfs(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_STATFS, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_STATFS, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -5410,7 +5410,7 @@ int handle_sys_exit_fstatfs(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_FSTATFS, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_FSTATFS, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -5460,7 +5460,7 @@ int handle_sys_exit_ustat(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_USTAT, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_USTAT, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -5510,7 +5510,7 @@ int handle_sys_exit_getcwd(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_GETCWD, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_GETCWD, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -5562,7 +5562,7 @@ int handle_sys_exit_utimensat(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_UTIMENSAT, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_UTIMENSAT, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -5614,7 +5614,7 @@ int handle_sys_exit_futimesat(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_FUTIMESAT, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_FUTIMESAT, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -5666,7 +5666,7 @@ int handle_sys_exit_utimes(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_UTIMES, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_UTIMES, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -5718,7 +5718,7 @@ int handle_sys_exit_utime(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_UTIME, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_UTIME, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -5768,7 +5768,7 @@ int handle_sys_exit_sync(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_SYNC, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_SYNC, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -5819,7 +5819,7 @@ int handle_sys_exit_syncfs(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;
- if (!ior_on_syscall_exit(tid, SYS_EXIT_SYNCFS, ctx->ret))
+ if (!ior_on_syscall_exit(tid, SYS_ENTER_SYNCFS, ctx->ret))
return 0;
struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0);
@@ -5870,7 +5870,7 @@ int handle_sys_exit_fsync(struct syscall_trace_exit *ctx) {
if (filter(&pid, &tid))
return 0;