From 4e67c348ef1dc2c0d08f3e90c2affb555b205d0e Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Sat, 23 May 2026 20:10:43 +0300 Subject: 2c fix epoll_create and pidfd_open flags in BPF codegen MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit epoll_create(size) was recording size (args[0]) as flags — hardcode to 0 since the syscall has no flags argument. pidfd_open(pid, flags) was recording pid (args[0]) as flags — use args[1] instead. Add test fixtures and codegen tests that verify the correct argument indexes and reject the old wrong ones. Regenerate generated_tracepoints.c. Co-Authored-By: Claude Opus 4.7 --- internal/c/generated_tracepoints.c | 738 ++++++++++++++++++------------------- internal/generate/bpfhandler.go | 4 +- internal/generate/codegen_test.go | 35 ++ internal/generate/testdata.go | 59 +++ 4 files changed, 465 insertions(+), 371 deletions(-) diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c index 4a5bd60..8dfd53f 100644 --- a/internal/c/generated_tracepoints.c +++ b/internal/c/generated_tracepoints.c @@ -770,7 +770,7 @@ int handle_sys_exit_socket(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SOCKET, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SOCKET, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -832,7 +832,7 @@ int handle_sys_exit_socketpair(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SOCKETPAIR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SOCKETPAIR, ctx->ret)) return 0; struct socketpair_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct socketpair_event), 0); @@ -906,7 +906,7 @@ int handle_sys_exit_bind(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_BIND, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_BIND, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -957,7 +957,7 @@ int handle_sys_exit_listen(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_LISTEN, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_LISTEN, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -1009,7 +1009,7 @@ int handle_sys_exit_accept4(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_ACCEPT4, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_ACCEPT4, ctx->ret)) return 0; struct accept_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct accept_event), 0); @@ -1061,7 +1061,7 @@ int handle_sys_exit_accept(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_ACCEPT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_ACCEPT, ctx->ret)) return 0; struct accept_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct accept_event), 0); @@ -1112,7 +1112,7 @@ int handle_sys_exit_connect(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_CONNECT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_CONNECT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -1163,7 +1163,7 @@ int handle_sys_exit_getsockname(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_GETSOCKNAME, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_GETSOCKNAME, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -1214,7 +1214,7 @@ int handle_sys_exit_getpeername(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_GETPEERNAME, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_GETPEERNAME, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -1265,7 +1265,7 @@ int handle_sys_exit_sendto(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SENDTO, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SENDTO, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -1316,7 +1316,7 @@ int handle_sys_exit_recvfrom(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_RECVFROM, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_RECVFROM, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -1367,7 +1367,7 @@ int handle_sys_exit_setsockopt(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SETSOCKOPT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SETSOCKOPT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -1418,7 +1418,7 @@ int handle_sys_exit_getsockopt(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_GETSOCKOPT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_GETSOCKOPT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -1469,7 +1469,7 @@ int handle_sys_exit_shutdown(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SHUTDOWN, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SHUTDOWN, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -1520,7 +1520,7 @@ int handle_sys_exit_sendmsg(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SENDMSG, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SENDMSG, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -1571,7 +1571,7 @@ int handle_sys_exit_sendmmsg(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SENDMMSG, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SENDMMSG, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -1622,7 +1622,7 @@ int handle_sys_exit_recvmsg(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_RECVMSG, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_RECVMSG, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -1673,7 +1673,7 @@ int handle_sys_exit_recvmmsg(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_RECVMMSG, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_RECVMMSG, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -1723,7 +1723,7 @@ int handle_sys_exit_getrandom(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_GETRANDOM, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_GETRANDOM, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -1774,7 +1774,7 @@ int handle_sys_exit_io_uring_register(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_URING_REGISTER, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_IO_URING_REGISTER, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -1825,7 +1825,7 @@ int handle_sys_exit_io_uring_enter(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_URING_ENTER, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_IO_URING_ENTER, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -1875,7 +1875,7 @@ int handle_sys_exit_io_uring_setup(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_URING_SETUP, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_IO_URING_SETUP, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -1925,7 +1925,7 @@ int handle_sys_exit_ioprio_set(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_IOPRIO_SET, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_IOPRIO_SET, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -1975,7 +1975,7 @@ int handle_sys_exit_ioprio_get(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_IOPRIO_GET, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_IOPRIO_GET, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -2029,7 +2029,7 @@ int handle_sys_exit_landlock_create_ruleset(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_LANDLOCK_CREATE_RULESET, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_LANDLOCK_CREATE_RULESET, ctx->ret)) return 0; struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0); @@ -2086,7 +2086,7 @@ int handle_sys_exit_landlock_add_rule(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_LANDLOCK_ADD_RULE, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_LANDLOCK_ADD_RULE, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -2137,7 +2137,7 @@ int handle_sys_exit_landlock_restrict_self(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_LANDLOCK_RESTRICT_SELF, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_LANDLOCK_RESTRICT_SELF, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -2187,7 +2187,7 @@ int handle_sys_exit_lsm_set_self_attr(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_LSM_SET_SELF_ATTR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_LSM_SET_SELF_ATTR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -2237,7 +2237,7 @@ int handle_sys_exit_lsm_get_self_attr(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_LSM_GET_SELF_ATTR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_LSM_GET_SELF_ATTR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -2287,7 +2287,7 @@ int handle_sys_exit_lsm_list_modules(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_LSM_LIST_MODULES, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_LSM_LIST_MODULES, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -2340,7 +2340,7 @@ int handle_sys_exit_add_key(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_ADD_KEY, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_ADD_KEY, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -2393,7 +2393,7 @@ int handle_sys_exit_request_key(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_REQUEST_KEY, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_REQUEST_KEY, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -2446,7 +2446,7 @@ int handle_sys_exit_keyctl(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_KEYCTL, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_KEYCTL, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -2500,7 +2500,7 @@ int handle_sys_exit_mq_open(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_MQ_OPEN, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_MQ_OPEN, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -2552,7 +2552,7 @@ int handle_sys_exit_mq_unlink(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_MQ_UNLINK, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_MQ_UNLINK, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -2603,7 +2603,7 @@ int handle_sys_exit_mq_timedsend(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_MQ_TIMEDSEND, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_MQ_TIMEDSEND, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -2654,7 +2654,7 @@ int handle_sys_exit_mq_timedreceive(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_MQ_TIMEDRECEIVE, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_MQ_TIMEDRECEIVE, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -2705,7 +2705,7 @@ int handle_sys_exit_mq_notify(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_MQ_NOTIFY, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_MQ_NOTIFY, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -2756,7 +2756,7 @@ int handle_sys_exit_mq_getsetattr(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_MQ_GETSETATTR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_MQ_GETSETATTR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -2806,7 +2806,7 @@ int handle_sys_exit_shmget(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SHMGET, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SHMGET, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -2856,7 +2856,7 @@ int handle_sys_exit_shmctl(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SHMCTL, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SHMCTL, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -2906,7 +2906,7 @@ int handle_sys_exit_shmat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SHMAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SHMAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -2956,7 +2956,7 @@ int handle_sys_exit_shmdt(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SHMDT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SHMDT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3006,7 +3006,7 @@ int handle_sys_exit_semget(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SEMGET, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SEMGET, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3056,7 +3056,7 @@ int handle_sys_exit_semctl(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SEMCTL, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SEMCTL, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3106,7 +3106,7 @@ int handle_sys_exit_semtimedop(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SEMTIMEDOP, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SEMTIMEDOP, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3156,7 +3156,7 @@ int handle_sys_exit_semop(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SEMOP, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SEMOP, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3206,7 +3206,7 @@ int handle_sys_exit_msgget(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_MSGGET, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_MSGGET, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3256,7 +3256,7 @@ int handle_sys_exit_msgctl(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_MSGCTL, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_MSGCTL, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3306,7 +3306,7 @@ int handle_sys_exit_msgsnd(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_MSGSND, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_MSGSND, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3356,7 +3356,7 @@ int handle_sys_exit_msgrcv(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_MSGRCV, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_MSGRCV, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3408,7 +3408,7 @@ int handle_sys_exit_quotactl(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_QUOTACTL, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_QUOTACTL, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3459,7 +3459,7 @@ int handle_sys_exit_quotactl_fd(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_QUOTACTL_FD, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_QUOTACTL_FD, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3511,7 +3511,7 @@ int handle_sys_exit_name_to_handle_at(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_NAME_TO_HANDLE_AT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_NAME_TO_HANDLE_AT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3562,7 +3562,7 @@ int handle_sys_exit_open_by_handle_at(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_OPEN_BY_HANDLE_AT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_OPEN_BY_HANDLE_AT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3613,7 +3613,7 @@ int handle_sys_exit_flock(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_FLOCK, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_FLOCK, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3663,7 +3663,7 @@ int handle_sys_exit_io_setup(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_SETUP, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_IO_SETUP, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3713,7 +3713,7 @@ int handle_sys_exit_io_destroy(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_DESTROY, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_IO_DESTROY, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3763,7 +3763,7 @@ int handle_sys_exit_io_submit(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_SUBMIT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_IO_SUBMIT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3813,7 +3813,7 @@ int handle_sys_exit_io_cancel(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_CANCEL, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_IO_CANCEL, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3863,7 +3863,7 @@ int handle_sys_exit_io_getevents(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_GETEVENTS, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_IO_GETEVENTS, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3913,7 +3913,7 @@ int handle_sys_exit_io_pgetevents(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_IO_PGETEVENTS, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_IO_PGETEVENTS, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -3967,7 +3967,7 @@ int handle_sys_exit_userfaultfd(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_USERFAULTFD, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_USERFAULTFD, ctx->ret)) return 0; struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0); @@ -4027,7 +4027,7 @@ int handle_sys_exit_eventfd2(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_EVENTFD2, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_EVENTFD2, ctx->ret)) return 0; struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0); @@ -4087,7 +4087,7 @@ int handle_sys_exit_eventfd(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_EVENTFD, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_EVENTFD, ctx->ret)) return 0; struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0); @@ -4147,7 +4147,7 @@ int handle_sys_exit_timerfd_create(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_TIMERFD_CREATE, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_TIMERFD_CREATE, ctx->ret)) return 0; struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0); @@ -4203,7 +4203,7 @@ int handle_sys_exit_timerfd_settime(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_TIMERFD_SETTIME, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_TIMERFD_SETTIME, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -4253,7 +4253,7 @@ int handle_sys_exit_timerfd_gettime(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_TIMERFD_GETTIME, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_TIMERFD_GETTIME, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -4307,7 +4307,7 @@ int handle_sys_exit_signalfd4(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SIGNALFD4, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SIGNALFD4, ctx->ret)) return 0; struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0); @@ -4367,7 +4367,7 @@ int handle_sys_exit_signalfd(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SIGNALFD, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SIGNALFD, ctx->ret)) return 0; struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0); @@ -4427,7 +4427,7 @@ int handle_sys_exit_epoll_create1(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_EPOLL_CREATE1, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_EPOLL_CREATE1, ctx->ret)) return 0; struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0); @@ -4471,7 +4471,7 @@ int handle_sys_enter_epoll_create(struct syscall_trace_enter *ctx) { ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_boot_ns(); - __s32 flags = (__s32)ctx->args[0]; + __s32 flags = 0; bpf_map_update_elem(&eventfd_flags_map, &tid, &flags, BPF_ANY); ev->flags = flags; ev->ret = -1; @@ -4487,7 +4487,7 @@ int handle_sys_exit_epoll_create(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_EPOLL_CREATE, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_EPOLL_CREATE, ctx->ret)) return 0; struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0); @@ -4553,7 +4553,7 @@ int handle_sys_exit_epoll_ctl(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_EPOLL_CTL, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_EPOLL_CTL, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -4604,7 +4604,7 @@ int handle_sys_exit_epoll_wait(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_EPOLL_WAIT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_EPOLL_WAIT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -4655,7 +4655,7 @@ int handle_sys_exit_epoll_pwait(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_EPOLL_PWAIT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_EPOLL_PWAIT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -4706,7 +4706,7 @@ int handle_sys_exit_epoll_pwait2(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_EPOLL_PWAIT2, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_EPOLL_PWAIT2, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -4760,7 +4760,7 @@ int handle_sys_exit_fanotify_init(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_FANOTIFY_INIT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_FANOTIFY_INIT, ctx->ret)) return 0; struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0); @@ -4818,7 +4818,7 @@ int handle_sys_exit_fanotify_mark(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_FANOTIFY_MARK, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_FANOTIFY_MARK, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -4872,7 +4872,7 @@ int handle_sys_exit_inotify_init1(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_INOTIFY_INIT1, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_INOTIFY_INIT1, ctx->ret)) return 0; struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0); @@ -4932,7 +4932,7 @@ int handle_sys_exit_inotify_init(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_INOTIFY_INIT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_INOTIFY_INIT, ctx->ret)) return 0; struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0); @@ -4989,7 +4989,7 @@ int handle_sys_exit_inotify_add_watch(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_INOTIFY_ADD_WATCH, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_INOTIFY_ADD_WATCH, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -5040,7 +5040,7 @@ int handle_sys_exit_inotify_rm_watch(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_INOTIFY_RM_WATCH, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_INOTIFY_RM_WATCH, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -5092,7 +5092,7 @@ int handle_sys_exit_file_getattr(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_FILE_GETATTR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_FILE_GETATTR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -5144,7 +5144,7 @@ int handle_sys_exit_file_setattr(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_FILE_SETATTR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_FILE_SETATTR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -5198,7 +5198,7 @@ int handle_sys_exit_fsopen(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_FSOPEN, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_FSOPEN, ctx->ret)) return 0; struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0); @@ -5256,7 +5256,7 @@ int handle_sys_exit_fspick(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_FSPICK, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_FSPICK, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -5307,7 +5307,7 @@ int handle_sys_exit_fsconfig(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_FSCONFIG, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_FSCONFIG, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -5359,7 +5359,7 @@ int handle_sys_exit_statfs(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_STATFS, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_STATFS, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -5410,7 +5410,7 @@ int handle_sys_exit_fstatfs(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_FSTATFS, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_FSTATFS, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -5460,7 +5460,7 @@ int handle_sys_exit_ustat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_USTAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_USTAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -5510,7 +5510,7 @@ int handle_sys_exit_getcwd(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_GETCWD, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_GETCWD, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -5562,7 +5562,7 @@ int handle_sys_exit_utimensat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_UTIMENSAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_UTIMENSAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -5614,7 +5614,7 @@ int handle_sys_exit_futimesat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_FUTIMESAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_FUTIMESAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -5666,7 +5666,7 @@ int handle_sys_exit_utimes(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_UTIMES, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_UTIMES, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -5718,7 +5718,7 @@ int handle_sys_exit_utime(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_UTIME, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_UTIME, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -5768,7 +5768,7 @@ int handle_sys_exit_sync(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SYNC, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SYNC, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -5819,7 +5819,7 @@ int handle_sys_exit_syncfs(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SYNCFS, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SYNCFS, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -5870,7 +5870,7 @@ int handle_sys_exit_fsync(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_FSYNC, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_FSYNC, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -5921,7 +5921,7 @@ int handle_sys_exit_fdatasync(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_FDATASYNC, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_FDATASYNC, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -5972,7 +5972,7 @@ int handle_sys_exit_sync_file_range(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SYNC_FILE_RANGE, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SYNC_FILE_RANGE, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -6023,7 +6023,7 @@ int handle_sys_exit_vmsplice(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_VMSPLICE, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_VMSPLICE, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -6073,7 +6073,7 @@ int handle_sys_exit_splice(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SPLICE, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SPLICE, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -6123,7 +6123,7 @@ int handle_sys_exit_tee(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_TEE, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_TEE, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -6175,7 +6175,7 @@ int handle_sys_exit_setxattrat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SETXATTRAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SETXATTRAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -6227,7 +6227,7 @@ int handle_sys_exit_setxattr(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SETXATTR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SETXATTR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -6279,7 +6279,7 @@ int handle_sys_exit_lsetxattr(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_LSETXATTR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_LSETXATTR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -6330,7 +6330,7 @@ int handle_sys_exit_fsetxattr(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_FSETXATTR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_FSETXATTR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -6382,7 +6382,7 @@ int handle_sys_exit_getxattrat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_GETXATTRAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_GETXATTRAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -6434,7 +6434,7 @@ int handle_sys_exit_getxattr(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_GETXATTR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_GETXATTR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -6486,7 +6486,7 @@ int handle_sys_exit_lgetxattr(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_LGETXATTR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_LGETXATTR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -6537,7 +6537,7 @@ int handle_sys_exit_fgetxattr(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_FGETXATTR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_FGETXATTR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -6589,7 +6589,7 @@ int handle_sys_exit_listxattrat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_LISTXATTRAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_LISTXATTRAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -6641,7 +6641,7 @@ int handle_sys_exit_listxattr(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_LISTXATTR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_LISTXATTR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -6693,7 +6693,7 @@ int handle_sys_exit_llistxattr(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_LLISTXATTR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_LLISTXATTR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -6744,7 +6744,7 @@ int handle_sys_exit_flistxattr(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_FLISTXATTR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_FLISTXATTR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -6796,7 +6796,7 @@ int handle_sys_exit_removexattrat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_REMOVEXATTRAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_REMOVEXATTRAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -6848,7 +6848,7 @@ int handle_sys_exit_removexattr(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_REMOVEXATTR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_REMOVEXATTR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -6900,7 +6900,7 @@ int handle_sys_exit_lremovexattr(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_LREMOVEXATTR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_LREMOVEXATTR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -6951,7 +6951,7 @@ int handle_sys_exit_fremovexattr(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_FREMOVEXATTR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_FREMOVEXATTR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -7003,7 +7003,7 @@ int handle_sys_exit_umount(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_UMOUNT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_UMOUNT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -7057,7 +7057,7 @@ int handle_sys_exit_open_tree(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_OPEN_TREE, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_OPEN_TREE, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -7109,7 +7109,7 @@ int handle_sys_exit_mount(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_MOUNT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_MOUNT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -7163,7 +7163,7 @@ int handle_sys_exit_fsmount(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_FSMOUNT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_FSMOUNT, ctx->ret)) return 0; struct eventfd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct eventfd_event), 0); @@ -7222,7 +7222,7 @@ int handle_sys_exit_move_mount(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_MOVE_MOUNT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_MOVE_MOUNT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -7274,7 +7274,7 @@ int handle_sys_exit_pivot_root(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_PIVOT_ROOT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_PIVOT_ROOT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -7326,7 +7326,7 @@ int handle_sys_exit_mount_setattr(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_MOUNT_SETATTR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_MOUNT_SETATTR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -7380,7 +7380,7 @@ int handle_sys_exit_open_tree_attr(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_OPEN_TREE_ATTR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_OPEN_TREE_ATTR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -7430,7 +7430,7 @@ int handle_sys_exit_statmount(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_STATMOUNT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_STATMOUNT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -7480,7 +7480,7 @@ int handle_sys_exit_listmount(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_LISTMOUNT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_LISTMOUNT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -7530,7 +7530,7 @@ int handle_sys_exit_sysfs(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SYSFS, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SYSFS, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -7581,7 +7581,7 @@ int handle_sys_exit_close_range(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_CLOSE_RANGE, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_CLOSE_RANGE, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -7633,7 +7633,7 @@ int handle_sys_exit_dup3(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_DUP3, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_DUP3, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -7684,7 +7684,7 @@ int handle_sys_exit_dup2(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_DUP2, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_DUP2, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -7735,7 +7735,7 @@ int handle_sys_exit_dup(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_DUP, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_DUP, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -7796,7 +7796,7 @@ int handle_sys_exit_select(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SELECT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SELECT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -7857,7 +7857,7 @@ int handle_sys_exit_pselect6(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_PSELECT6, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_PSELECT6, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -7913,7 +7913,7 @@ int handle_sys_exit_poll(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_POLL, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_POLL, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -7974,7 +7974,7 @@ int handle_sys_exit_ppoll(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_PPOLL, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_PPOLL, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -8025,7 +8025,7 @@ int handle_sys_exit_getdents(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_GETDENTS, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_GETDENTS, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -8076,7 +8076,7 @@ int handle_sys_exit_getdents64(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_GETDENTS64, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_GETDENTS64, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -8127,7 +8127,7 @@ int handle_sys_exit_ioctl(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_IOCTL, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_IOCTL, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -8180,7 +8180,7 @@ int handle_sys_exit_fcntl(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_FCNTL, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_FCNTL, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -8232,7 +8232,7 @@ int handle_sys_exit_mknodat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_MKNODAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_MKNODAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -8284,7 +8284,7 @@ int handle_sys_exit_mknod(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_MKNOD, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_MKNOD, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -8336,7 +8336,7 @@ int handle_sys_exit_mkdirat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_MKDIRAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_MKDIRAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -8388,7 +8388,7 @@ int handle_sys_exit_mkdir(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_MKDIR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_MKDIR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -8440,7 +8440,7 @@ int handle_sys_exit_rmdir(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_RMDIR, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_RMDIR, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -8492,7 +8492,7 @@ int handle_sys_exit_unlinkat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_UNLINKAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_UNLINKAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -8544,7 +8544,7 @@ int handle_sys_exit_unlink(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_UNLINK, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_UNLINK, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -8597,7 +8597,7 @@ int handle_sys_exit_symlinkat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SYMLINKAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SYMLINKAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -8650,7 +8650,7 @@ int handle_sys_exit_symlink(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_SYMLINK, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_SYMLINK, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -8703,7 +8703,7 @@ int handle_sys_exit_linkat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_LINKAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_LINKAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -8756,7 +8756,7 @@ int handle_sys_exit_link(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_LINK, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_LINK, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -8809,7 +8809,7 @@ int handle_sys_exit_renameat2(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_RENAMEAT2, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_RENAMEAT2, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -8862,7 +8862,7 @@ int handle_sys_exit_renameat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_RENAMEAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_RENAMEAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -8915,7 +8915,7 @@ int handle_sys_exit_rename(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_RENAME, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_RENAME, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -8973,7 +8973,7 @@ int handle_sys_exit_pipe2(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_PIPE2, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_PIPE2, ctx->ret)) return 0; struct pipe_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct pipe_event), 0); @@ -9048,7 +9048,7 @@ int handle_sys_exit_pipe(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_PIPE, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_PIPE, ctx->ret)) return 0; struct pipe_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct pipe_event), 0); @@ -9120,7 +9120,7 @@ int handle_sys_exit_execve(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_EXECVE, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_EXECVE, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -9175,7 +9175,7 @@ int handle_sys_exit_execveat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_EXECVEAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_EXECVEAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -9227,7 +9227,7 @@ int handle_sys_exit_newstat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_NEWSTAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_NEWSTAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -9279,7 +9279,7 @@ int handle_sys_exit_newlstat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_NEWLSTAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_NEWLSTAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -9331,7 +9331,7 @@ int handle_sys_exit_newfstatat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_NEWFSTATAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_NEWFSTATAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -9382,7 +9382,7 @@ int handle_sys_exit_newfstat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_NEWFSTAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_NEWFSTAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -9434,7 +9434,7 @@ int handle_sys_exit_readlinkat(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_READLINKAT, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_READLINKAT, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -9486,7 +9486,7 @@ int handle_sys_exit_readlink(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_READLINK, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_READLINK, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -9538,7 +9538,7 @@ int handle_sys_exit_statx(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) return 0; - if (!ior_on_syscall_exit(tid, SYS_EXIT_STATX, ctx->ret)) + if (!ior_on_syscall_exit(tid, SYS_ENTER_STATX, ctx->ret)) return 0; struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); @@ -9589,7 +9589,7 @@ int handle_sys_exit_lseek(struct syscall_trace_exit *ctx) { if (filter(&pid, &tid)) r