diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h index 265f74b213..2a986a988b 100644 --- a/driver/bpf/fillers.h +++ b/driver/bpf/fillers.h @@ -1610,10 +1610,7 @@ FILLER(sys_execveat_e, true) } res = bpf_push_s64_to_ring(data, (s64)fd); - if (res != PPM_SUCCESS) - { - return res; - } + CHECK_RES(res); /* * pathname @@ -6092,16 +6089,14 @@ FILLER(sys_copy_file_range_x, true) */ fdout = bpf_syscall_get_argument(data, 2); res = bpf_push_s64_to_ring(data, fdout); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * offout */ offout = bpf_syscall_get_argument(data, 3); res = bpf_push_u64_to_ring(data, offout); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return res; } @@ -6127,8 +6122,7 @@ FILLER(sys_capset_x, true) val = (unsigned long)cap.val; #endif res = bpf_push_u64_to_ring(data, capabilities_to_scap(val)); - if(unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); cap = _READ(cred->cap_permitted); #if LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0) @@ -6137,8 +6131,7 @@ FILLER(sys_capset_x, true) val = (unsigned long)cap.val; #endif res = bpf_push_u64_to_ring(data, capabilities_to_scap(val)); - if(unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); cap = _READ(cred->cap_effective); #if LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0) @@ -6407,34 +6400,22 @@ FILLER(sched_prog_exec, false) /* Parameter 2: exe (type: PT_CHARBUF) */ data->curarg_already_on_frame = true; res = __bpf_val_to_ring(data, 0, exe_len, PT_CHARBUF, -1, false, KERNEL); - if(res != PPM_SUCCESS) - { - return res; - } + CHECK_RES(res); /* Parameter 3: args (type: PT_CHARBUFARRAY) */ data->curarg_already_on_frame = true; res = __bpf_val_to_ring(data, 0, args_len - exe_len, PT_BYTEBUF, -1, false, KERNEL); - if(res != PPM_SUCCESS) - { - return res; - } + CHECK_RES(res); } else { /* Parameter 2: exe (type: PT_CHARBUF) */ res = bpf_push_empty_param(data); - if(res != PPM_SUCCESS) - { - return res; - } + CHECK_RES(res); /* Parameter 3: args (type: PT_CHARBUFARRAY) */ res = bpf_push_empty_param(data); - if(res != PPM_SUCCESS) - { - return res; - } + CHECK_RES(res); } /* Parameter 4: tid (type: PT_PID) */ @@ -6825,34 +6806,22 @@ FILLER(sched_prog_fork, false) /* Parameter 2: exe (type: PT_CHARBUF) */ data->curarg_already_on_frame = true; res = __bpf_val_to_ring(data, 0, exe_len, PT_CHARBUF, -1, false, KERNEL); - if(res != PPM_SUCCESS) - { - return res; - } + CHECK_RES(res); /* Parameter 3: args (type: PT_CHARBUFARRAY) */ data->curarg_already_on_frame = true; res = __bpf_val_to_ring(data, 0, args_len - exe_len, PT_BYTEBUF, -1, false, KERNEL); - if(res != PPM_SUCCESS) - { - return res; - } + CHECK_RES(res); } else { /* Parameter 2: exe (type: PT_CHARBUF) */ res = bpf_push_empty_param(data); - if(res != PPM_SUCCESS) - { - return res; - } + CHECK_RES(res); /* Parameter 3: args (type: PT_CHARBUFARRAY) */ res = bpf_push_empty_param(data); - if(res != PPM_SUCCESS) - { - return res; - } + CHECK_RES(res); } /* Parameter 4: tid (type: PT_PID) */ @@ -7010,8 +6979,7 @@ FILLER(sched_prog_fork_3, false) /* Parameter 19: vtid (type: PT_PID) */ pid_t vtid = bpf_task_pid_vnr(child); res = bpf_push_s64_to_ring(data, vtid); - if(res != PPM_SUCCESS) - return res; + CHECK_RES(res); /* Parameter 20: vpid (type: PT_PID) */ pid_t vpid = bpf_task_tgid_vnr(child); diff --git a/driver/ppm_events.c b/driver/ppm_events.c index b2cfd727e9..147400fcd5 100644 --- a/driver/ppm_events.c +++ b/driver/ppm_events.c @@ -1509,8 +1509,7 @@ int32_t parse_readv_writev_bufs(struct event_filler_arguments *args, const struc size = retval; res = val_to_ring(args, size, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } /* @@ -1585,12 +1584,10 @@ int32_t parse_readv_writev_bufs(struct event_filler_arguments *args, const struc bufsize, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } else { res = val_to_ring(args, 0, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } } @@ -1650,8 +1647,7 @@ int32_t compat_parse_readv_writev_bufs(struct event_filler_arguments *args, cons size = retval; res = val_to_ring(args, size, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } /* @@ -1718,12 +1714,10 @@ int32_t compat_parse_readv_writev_bufs(struct event_filler_arguments *args, cons bufsize, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } else { res = val_to_ring(args, 0, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } } @@ -1765,23 +1759,20 @@ int f_sys_autofill(struct event_filler_arguments *args) val = args->args[evinfo->autofill_args[j].id]; #endif res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } else if (evinfo->autofill_args[j].id == AF_ID_RETVAL) { /* * Return value */ retval = (int64_t)(long)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } else if (evinfo->autofill_args[j].id == AF_ID_USEDEFAULT) { /* * Default Value */ res = val_to_ring(args, evinfo->autofill_args[j].default_val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } else { ASSERT(false); } diff --git a/driver/ppm_fillers.c b/driver/ppm_fillers.c index 074ef3e5c3..ba08ee7885 100644 --- a/driver/ppm_fillers.c +++ b/driver/ppm_fillers.c @@ -196,22 +196,19 @@ int f_sys_generic(struct event_filler_arguments *args) * ID */ res = val_to_ring(args, sc_code, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); if (args->event_type == PPME_GENERIC_E) { /* * nativeID */ res = val_to_ring(args, args->syscall_id, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } } else { ASSERT(false); res = val_to_ring(args, (u64)"", 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } return add_sentinel(args); @@ -229,8 +226,7 @@ int f_sys_single(struct event_filler_arguments *args) syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -242,8 +238,7 @@ int f_sys_single_x(struct event_filler_arguments *args) retval = (int64_t)(long)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -359,8 +354,7 @@ int f_sys_open_e(struct event_filler_arguments *args) name[PPM_MAX_PATH_SIZE - 1] = '\0'; } res = val_to_ring(args, (int64_t)(long)name, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * Flags @@ -368,16 +362,14 @@ int f_sys_open_e(struct event_filler_arguments *args) */ syscall_get_arguments_deprecated(args, 1, 1, &flags); res = val_to_ring(args, open_flags_to_scap(flags), 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * mode */ syscall_get_arguments_deprecated(args, 2, 1, &modes); res = val_to_ring(args, open_modes_to_scap(flags, modes), 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -398,8 +390,7 @@ int f_sys_open_x(struct event_filler_arguments *args) */ retval = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* @@ -407,8 +398,7 @@ int f_sys_open_x(struct event_filler_arguments *args) */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * Flags @@ -419,16 +409,14 @@ int f_sys_open_x(struct event_filler_arguments *args) /* update scap flags if file is created */ get_fd_fmode_created(retval, &scap_flags); res = val_to_ring(args, scap_flags, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * mode */ syscall_get_arguments_deprecated(args, 2, 1, &modes); res = val_to_ring(args, open_modes_to_scap(flags, modes), 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); get_fd_dev_ino(retval, &dev, &ino); @@ -436,15 +424,13 @@ int f_sys_open_x(struct event_filler_arguments *args) * dev */ res = val_to_ring(args, dev, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * ino */ res = val_to_ring(args, ino, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -487,8 +473,7 @@ int f_sys_read_x(struct event_filler_arguments *args) */ retval = (int64_t)(long)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * data @@ -514,8 +499,7 @@ int f_sys_read_x(struct event_filler_arguments *args) */ args->enforce_snaplen = true; res = val_to_ring(args, val, bufsize, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -1015,8 +999,7 @@ int f_proc_startupdate(struct event_filler_arguments *args) */ retval = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); if (unlikely(retval < 0 && args->event_type != PPME_SYSCALL_EXECVE_19_X && @@ -1030,15 +1013,13 @@ int f_proc_startupdate(struct event_filler_arguments *args) * exe */ res = val_to_ring(args, (uint64_t)(long)args->str_storage, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * Args */ res = val_to_ring(args, (int64_t)(long)args->str_storage, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } else { if (likely(retval >= 0)) { @@ -1118,15 +1099,13 @@ int f_proc_startupdate(struct event_filler_arguments *args) * exe */ res = val_to_ring(args, (uint64_t)(long)args->str_storage, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * Args */ res = val_to_ring(args, (int64_t)(long)args->str_storage + exe_len, args_len - exe_len, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } @@ -1134,15 +1113,13 @@ int f_proc_startupdate(struct event_filler_arguments *args) * tid */ res = val_to_ring(args, (int64_t)current->pid, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * pid */ res = val_to_ring(args, (int64_t)current->tgid, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * ptid @@ -1158,16 +1135,14 @@ int f_proc_startupdate(struct event_filler_arguments *args) ptid = 0; res = val_to_ring(args, (int64_t)ptid, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * cwd, pushed empty to avoid breaking compatibility * with the older event format */ res = push_empty_param(args); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * fdlimit @@ -1177,22 +1152,19 @@ int f_proc_startupdate(struct event_filler_arguments *args) #else res = val_to_ring(args, (int64_t)0, 0, false, 0); #endif - if (res != PPM_SUCCESS) - return res; + CHECK_RES(res); /* * pgft_maj */ res = val_to_ring(args, current->maj_flt, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * pgft_min */ res = val_to_ring(args, current->min_flt, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); if (mm) { total_vm = mm->total_vm << (PAGE_SHIFT-10); @@ -1204,29 +1176,25 @@ int f_proc_startupdate(struct event_filler_arguments *args) * vm_size */ res = val_to_ring(args, total_vm, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * vm_rss */ res = val_to_ring(args, total_rss, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * vm_swap */ res = val_to_ring(args, swap, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * comm */ res = val_to_ring(args, (uint64_t)current->comm, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * cgroups @@ -1240,8 +1208,7 @@ int f_proc_startupdate(struct event_filler_arguments *args) #endif res = val_to_ring(args, (int64_t)(long)args->str_storage, STR_STORAGE_SIZE - available, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); if (args->event_type == PPME_SYSCALL_CLONE_20_X || args->event_type == PPME_SYSCALL_FORK_20_X || @@ -1303,22 +1270,19 @@ int f_proc_startupdate(struct event_filler_arguments *args) in_pidns = PPM_CL_CHILD_IN_PIDNS; #endif res = val_to_ring(args, (uint64_t)clone_flags_to_scap(val) | in_pidns, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * uid */ res = val_to_ring(args, euid, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * gid */ res = val_to_ring(args, egid, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * vtid @@ -1329,8 +1293,7 @@ int f_proc_startupdate(struct event_filler_arguments *args) /* Not relevant in old kernels */ res = val_to_ring(args, 0, 0, false, 0); #endif - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * vpid @@ -1341,8 +1304,7 @@ int f_proc_startupdate(struct event_filler_arguments *args) /* Not relevant in old kernels */ res = val_to_ring(args, 0, 0, false, 0); #endif - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * pid_namespace init task start_time monotonic time in ns @@ -1438,16 +1400,14 @@ int f_proc_startupdate(struct event_filler_arguments *args) * environ */ res = val_to_ring(args, (int64_t)(long)args->str_storage, env_len, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * tty */ tty_nr = ppm_get_tty(); res = val_to_ring(args, tty_nr, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * pgid @@ -1457,8 +1417,7 @@ int f_proc_startupdate(struct event_filler_arguments *args) #else res = val_to_ring(args, (int64_t)process_group(current), 0, false, 0); #endif - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * loginuid @@ -1471,8 +1430,7 @@ int f_proc_startupdate(struct event_filler_arguments *args) loginuid = audit_get_loginuid(current->audit_context); #endif res = val_to_ring(args, loginuid, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * exe_writable and exe_upper_layer flags @@ -1559,8 +1517,7 @@ int f_proc_startupdate(struct event_filler_arguments *args) * flags */ res = val_to_ring(args, flags, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * capabilities @@ -1635,10 +1592,7 @@ int f_sys_execve_e(struct event_filler_arguments *args) */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); return add_sentinel(args); } @@ -1661,20 +1615,14 @@ int f_sys_execveat_e(struct event_filler_arguments *args) } res = val_to_ring(args, (s64)fd, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* * pathname */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* * flags @@ -1683,10 +1631,7 @@ int f_sys_execveat_e(struct event_filler_arguments *args) flags = execveat_flags_to_scap(val); res = val_to_ring(args, flags, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); return add_sentinel(args); } @@ -1760,8 +1705,7 @@ int f_sys_socket_bind_x(struct event_filler_arguments *args) size, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -1781,8 +1725,7 @@ int f_sys_connect_e(struct event_filler_arguments *args) fd = (int)val; res = val_to_ring(args, fd, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); if (fd >= 0) { /* @@ -1822,8 +1765,7 @@ int f_sys_connect_e(struct event_filler_arguments *args) size, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -1895,12 +1837,10 @@ int f_sys_connect_x(struct event_filler_arguments *args) size, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); res = val_to_ring(args, fd, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -1922,8 +1862,7 @@ int f_sys_socketpair_x(struct event_filler_arguments *args) */ retval = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * If the call was successful, copy the FDs @@ -1947,12 +1886,10 @@ int f_sys_socketpair_x(struct event_filler_arguments *args) #endif res = val_to_ring(args, (s64)fds[0], 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); res = val_to_ring(args, (s64)fds[1], 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* get socket source and peer address */ sock = sockfd_lookup(fds[0], &err); @@ -1978,20 +1915,16 @@ int f_sys_socketpair_x(struct event_filler_arguments *args) } else { #endif /* UDIG */ res = val_to_ring(args, (s64)fds[0], 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); res = val_to_ring(args, (s64)fds[1], 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); res = val_to_ring(args, 0, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); res = val_to_ring(args, 0, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); #ifndef UDIG } #endif @@ -2291,8 +2224,7 @@ int f_sys_accept4_e(struct event_filler_arguments *args) */ /* res = val_to_ring(args, args->socketcall_args[3]); */ res = val_to_ring(args, 0, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -2315,8 +2247,7 @@ int f_sys_accept_x(struct event_filler_arguments *args) */ fd = syscall_get_return_value(current, args->regs); res = val_to_ring(args, (int64_t)fd, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); if (fd >= 0) { @@ -2356,31 +2287,26 @@ int f_sys_accept_x(struct event_filler_arguments *args) size, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } else { /* Parameter 2: tuple (type: PT_SOCKTUPLE) */ res = push_empty_param(args); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } /* Parameter 3: queuepct (type: PT_UINT8) */ res = val_to_ring(args, queuepct, 0, false, 0); - if (res != PPM_SUCCESS) - return res; + CHECK_RES(res); /* Parameter 4: queuelen (type: PT_UINT32) */ res = val_to_ring(args, ack_backlog, 0, false, 0); - if (res != PPM_SUCCESS) - return res; + CHECK_RES(res); /* Parameter 5: queuemax (type: PT_UINT32) */ res = val_to_ring(args, max_ack_backlog, 0, false, 0); - if (res != PPM_SUCCESS) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -2397,8 +2323,7 @@ int f_sys_send_e_common(struct event_filler_arguments *args, int *fd) syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); *fd = val; @@ -2408,8 +2333,7 @@ int f_sys_send_e_common(struct event_filler_arguments *args, int *fd) syscall_get_arguments_deprecated(args, 2, 1, &size); res = val_to_ring(args, size, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return PPM_SUCCESS; } @@ -2443,8 +2367,7 @@ int f_sys_sendto_e(struct event_filler_arguments *args) * Push the common params to the ring */ res = f_sys_send_e_common(args, &fd); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * Get the address @@ -2485,8 +2408,7 @@ int f_sys_sendto_e(struct event_filler_arguments *args) size, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -2543,8 +2465,7 @@ int f_sys_recv_x_common(struct event_filler_arguments *args, int64_t *retval) */ *retval = (int64_t)(long)syscall_get_return_value(current, args->regs); res = val_to_ring(args, *retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * data @@ -2620,8 +2541,7 @@ int f_sys_recvfrom_x(struct event_filler_arguments *args) * Push the common params to the ring */ res = f_sys_recv_x_common(args, &retval); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); if (retval >= 0) { /* @@ -2680,8 +2600,7 @@ int f_sys_recvfrom_x(struct event_filler_arguments *args) size, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -2720,8 +2639,7 @@ int f_sys_sendmsg_e(struct event_filler_arguments *args) fd = val; res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * Retrieve the message header @@ -2743,8 +2661,7 @@ int f_sys_sendmsg_e(struct event_filler_arguments *args) res = parse_readv_writev_bufs(args, iov, iovcnt, args->consumer->snaplen, PRB_FLAG_PUSH_SIZE | PRB_FLAG_IS_WRITE); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * tuple @@ -2765,8 +2682,7 @@ int f_sys_sendmsg_e(struct event_filler_arguments *args) res = compat_parse_readv_writev_bufs(args, compat_iov, iovcnt, args->consumer->snaplen, PRB_FLAG_PUSH_SIZE | PRB_FLAG_IS_WRITE); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * tuple @@ -2801,8 +2717,7 @@ int f_sys_sendmsg_e(struct event_filler_arguments *args) size, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -2855,8 +2770,7 @@ int f_sys_sendmsg_x(struct event_filler_arguments *args) iovcnt = mh.msg_iovlen; res = parse_readv_writev_bufs(args, iov, iovcnt, args->consumer->snaplen, PRB_FLAG_PUSH_DATA | PRB_FLAG_IS_WRITE); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); #ifdef CONFIG_COMPAT } else { if (unlikely(ppm_copy_from_user(&compat_mh, (const void __user *)compat_ptr(val), sizeof(compat_mh)))) @@ -2870,8 +2784,7 @@ int f_sys_sendmsg_x(struct event_filler_arguments *args) iovcnt = compat_mh.msg_iovlen; res = compat_parse_readv_writev_bufs(args, compat_iov, iovcnt, args->consumer->snaplen, PRB_FLAG_PUSH_DATA | PRB_FLAG_IS_WRITE); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } #endif @@ -3001,8 +2914,7 @@ int f_sys_recvmsg_x(struct event_filler_arguments *args) } #endif - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * tuple @@ -3046,9 +2958,7 @@ int f_sys_recvmsg_x(struct event_filler_arguments *args) size, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; - + CHECK_RES(res); return add_sentinel(args); } @@ -3069,16 +2979,14 @@ int f_sys_creat_e(struct event_filler_arguments *args) name[PPM_MAX_PATH_SIZE - 1] = '\0'; } res = val_to_ring(args, (int64_t)(long)name, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * mode */ syscall_get_arguments_deprecated(args, 1, 1, &modes); res = val_to_ring(args, open_modes_to_scap(O_CREAT, modes), 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -3097,24 +3005,20 @@ int f_sys_creat_x(struct event_filler_arguments *args) */ retval = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * name */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; - + CHECK_RES(res); /* * mode */ syscall_get_arguments_deprecated(args, 1, 1, &modes); res = val_to_ring(args, open_modes_to_scap(O_CREAT, modes), 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); get_fd_dev_ino(retval, &dev, &ino); @@ -3122,15 +3026,13 @@ int f_sys_creat_x(struct event_filler_arguments *args) * dev */ res = val_to_ring(args, dev, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * ino */ res = val_to_ring(args, ino, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -3336,24 +3238,21 @@ int f_sys_futex_e(struct event_filler_arguments *args) */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * op */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, (unsigned long)futex_op_to_scap(val), 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * val */ syscall_get_arguments_deprecated(args, 2, 1, &val); res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -3370,24 +3269,21 @@ int f_sys_lseek_e(struct event_filler_arguments *args) syscall_get_arguments_deprecated(args, 0, 1, &val); fd = (s32)val; res = val_to_ring(args, (s64)fd, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * offset */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * whence */ syscall_get_arguments_deprecated(args, 2, 1, &val); res = val_to_ring(args, lseek_whence_to_scap(val), 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -3407,8 +3303,7 @@ int f_sys_llseek_e(struct event_filler_arguments *args) syscall_get_arguments_deprecated(args, 0, 1, &val); fd = (s32)val; res = val_to_ring(args, (s64)fd, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * offset @@ -3418,16 +3313,14 @@ int f_sys_llseek_e(struct event_filler_arguments *args) syscall_get_arguments_deprecated(args, 2, 1, &ol); offset = (((uint64_t)oh) << 32) + ((uint64_t)ol); res = val_to_ring(args, offset, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * whence */ syscall_get_arguments_deprecated(args, 4, 1, &val); res = val_to_ring(args, lseek_whence_to_scap(val), 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -3514,16 +3407,14 @@ int f_sys_poll_e(struct event_filler_arguments *args) int res; res = poll_parse_fds(args, true); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * timeout */ syscall_get_arguments_deprecated(args, 2, 1, &val); res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -3606,12 +3497,10 @@ int f_sys_poll_x(struct event_filler_arguments *args) */ retval = (int64_t)(long)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); res = poll_parse_fds(args, false); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -3629,8 +3518,7 @@ int f_sys_mount_e(struct event_filler_arguments *args) if ((val & PPM_MS_MGC_MSK) == PPM_MS_MGC_VAL) val &= ~PPM_MS_MGC_MSK; res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -3653,8 +3541,7 @@ int f_sys_openat_e(struct event_filler_arguments *args) fd = PPM_AT_FDCWD; res = val_to_ring(args, (s64)fd, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * name @@ -3666,25 +3553,21 @@ int f_sys_openat_e(struct event_filler_arguments *args) name[PPM_MAX_PATH_SIZE - 1] = '\0'; } res = val_to_ring(args, (int64_t)(long)name, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - return res; - + CHECK_RES(res); /* * Flags * Note that we convert them into the ppm portable representation before pushing them to the ring */ syscall_get_arguments_deprecated(args, 2, 1, &flags); res = val_to_ring(args, open_flags_to_scap(flags), 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * mode */ syscall_get_arguments_deprecated(args, 3, 1, &modes); res = val_to_ring(args, open_modes_to_scap(flags, modes), 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -3704,8 +3587,7 @@ int f_sys_openat_x(struct event_filler_arguments *args) retval = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * dirfd @@ -3716,16 +3598,14 @@ int f_sys_openat_x(struct event_filler_arguments *args) fd = PPM_AT_FDCWD; res = val_to_ring(args, (s64)fd, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * name */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * Flags @@ -3736,33 +3616,25 @@ int f_sys_openat_x(struct event_filler_arguments *args) /* update scap flags if file is created */ get_fd_fmode_created(retval, &scap_flags); res = val_to_ring(args, scap_flags, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; - + CHECK_RES(res); /* * mode */ syscall_get_arguments_deprecated(args, 3, 1, &modes); res = val_to_ring(args, open_modes_to_scap(flags, modes), 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; - + CHECK_RES(res); get_fd_dev_ino(retval, &dev, &ino); /* * dev */ res = val_to_ring(args, dev, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; - + CHECK_RES(res); /* * ino */ res = val_to_ring(args, ino, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; - + CHECK_RES(res); return add_sentinel(args); } @@ -3810,8 +3682,7 @@ int f_sys_linkat_x(struct event_filler_arguments *args) retval = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * olddir @@ -3822,16 +3693,14 @@ int f_sys_linkat_x(struct event_filler_arguments *args) val = PPM_AT_FDCWD; res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * oldpath */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * newdir @@ -3842,16 +3711,14 @@ int f_sys_linkat_x(struct event_filler_arguments *args) val = PPM_AT_FDCWD; res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * newpath */ syscall_get_arguments_deprecated(args, 3, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * Flags @@ -3859,8 +3726,7 @@ int f_sys_linkat_x(struct event_filler_arguments *args) */ syscall_get_arguments_deprecated(args, 4, 1, &flags); res = val_to_ring(args, linkat_flags_to_scap(flags), 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -3879,16 +3745,14 @@ int f_sys_pread64_e(struct event_filler_arguments *args) syscall_get_arguments_deprecated(args, 0, 1, &val); fd = (s32)val; res = val_to_ring(args, (s64)fd, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * size */ syscall_get_arguments_deprecated(args, 2, 1, &size); res = val_to_ring(args, size, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * pos @@ -3914,8 +3778,7 @@ int f_sys_pread64_e(struct event_filler_arguments *args) #endif res = val_to_ring(args, pos64, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -4041,8 +3904,7 @@ int f_sys_readv_preadv_x(struct event_filler_arguments *args) */ retval = (int64_t)(long)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); if(retval > 0) { @@ -4135,8 +3997,7 @@ int f_sys_writev_pwritev_x(struct event_filler_arguments *args) */ retval = (int64_t)(long)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * data and size @@ -4255,8 +4116,7 @@ int f_sys_nanosleep_e(struct event_filler_arguments *args) syscall_get_arguments_deprecated(args, 0, 1, &val); res = timespec_parse(args, val); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -4275,8 +4135,7 @@ int f_sys_getrlimit_setrlimit_e(struct event_filler_arguments *args) ppm_resource = rlimit_resource_to_scap(val); res = val_to_ring(args, (uint64_t)ppm_resource, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -4298,8 +4157,7 @@ int f_sys_getrlimit_setrlrimit_x(struct event_filler_arguments *args) */ retval = (int64_t)(long)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * Copy the user structure and extract cur and max @@ -4331,15 +4189,13 @@ int f_sys_getrlimit_setrlrimit_x(struct event_filler_arguments *args) * cur */ res = val_to_ring(args, cur, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * max */ res = val_to_ring(args, max, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -4383,8 +4239,7 @@ int f_sys_prlimit_x(struct event_filler_arguments *args) */ retval = (int64_t)(long)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * Copy the user structure and extract cur and max @@ -4446,29 +4301,25 @@ int f_sys_prlimit_x(struct event_filler_arguments *args) * newcur */ res = val_to_ring(args, newcur, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * newmax */ res = val_to_ring(args, newmax, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * oldcur */ res = val_to_ring(args, oldcur, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * oldmax */ res = val_to_ring(args, oldmax, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -4492,22 +4343,19 @@ int f_sched_switch_e(struct event_filler_arguments *args) * next */ res = val_to_ring(args, args->sched_next->pid, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * pgft_maj */ res = val_to_ring(args, args->sched_prev->maj_flt, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * pgft_min */ res = val_to_ring(args, args->sched_prev->min_flt, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); mm = args->sched_prev->mm; if (mm) { @@ -4520,22 +4368,19 @@ int f_sched_switch_e(struct event_filler_arguments *args) * vm_size */ res = val_to_ring(args, total_vm, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * vm_rss */ res = val_to_ring(args, total_rss, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * vm_swap */ res = val_to_ring(args, swap, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); #if 0 /* @@ -4543,8 +4388,7 @@ int f_sched_switch_e(struct event_filler_arguments *args) */ steal = cputime64_to_clock_t(kcpustat_this_cpu->cpustat[CPUTIME_STEAL]); res = val_to_ring(args, steal, 0, false); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); #endif return add_sentinel(args); @@ -4559,8 +4403,7 @@ int f_sched_drop(struct event_filler_arguments *args) * ratio */ res = val_to_ring(args, args->consumer->sampling_ratio, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -4706,17 +4549,14 @@ int f_sys_ptrace_x(struct event_filler_arguments *args) */ retval = (int64_t)(long)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); if (retval < 0) { res = val_to_ring(args, 0, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); res = val_to_ring(args, 0, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -4728,12 +4568,10 @@ int f_sys_ptrace_x(struct event_filler_arguments *args) request = ptrace_requests_to_scap(val); res = parse_ptrace_addr(args, request); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); res = parse_ptrace_data(args, request); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -4751,8 +4589,7 @@ int f_sys_brk_munmap_mmap_x(struct event_filler_arguments *args) retval = (int64_t)(long)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); #ifndef UDIG if (mm) { @@ -4766,22 +4603,19 @@ int f_sys_brk_munmap_mmap_x(struct event_filler_arguments *args) * vm_size */ res = val_to_ring(args, total_vm, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * vm_rss */ res = val_to_ring(args, total_rss, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * vm_swap */ res = val_to_ring(args, swap, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -4797,32 +4631,28 @@ int f_sys_mmap_e(struct event_filler_arguments *args) */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * length */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * prot */ syscall_get_arguments_deprecated(args, 2, 1, &val); res = val_to_ring(args, prot_flags_to_scap(val), 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * flags */ syscall_get_arguments_deprecated(args, 3, 1, &val); res = val_to_ring(args, mmap_flags_to_scap(val), 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * fd @@ -4830,16 +4660,14 @@ int f_sys_mmap_e(struct event_filler_arguments *args) syscall_get_arguments_deprecated(args, 4, 1, &val); fd = (s32)val; res = val_to_ring(args, (s64)fd, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * offset/pgoffset */ syscall_get_arguments_deprecated(args, 5, 1, &val); res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -4854,24 +4682,21 @@ int f_sys_mprotect_e(struct event_filler_arguments *args) */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * length */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * prot */ syscall_get_arguments_deprecated(args, 2, 1, &val); res = val_to_ring(args, prot_flags_to_scap(val), 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -4883,8 +4708,7 @@ int f_sys_mprotect_x(struct event_filler_arguments *args) retval = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -4898,8 +4722,7 @@ int f_sys_renameat_x(struct event_filler_arguments *args) retval = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * olddirfd @@ -4910,16 +4733,14 @@ int f_sys_renameat_x(struct event_filler_arguments *args) fd = PPM_AT_FDCWD; res = val_to_ring(args, (s64)fd, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * oldpath */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * newdirfd @@ -4930,16 +4751,14 @@ int f_sys_renameat_x(struct event_filler_arguments *args) fd = PPM_AT_FDCWD; res = val_to_ring(args, (s64)fd, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * newpath */ syscall_get_arguments_deprecated(args, 3, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -4953,8 +4772,7 @@ int f_sys_renameat2_x(struct event_filler_arguments *args) retval = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * olddirfd @@ -4965,16 +4783,14 @@ int f_sys_renameat2_x(struct event_filler_arguments *args) fd = PPM_AT_FDCWD; res = val_to_ring(args, (s64)fd, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * oldpath */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * newdirfd @@ -4985,16 +4801,14 @@ int f_sys_renameat2_x(struct event_filler_arguments *args) fd = PPM_AT_FDCWD; res = val_to_ring(args, (s64)fd, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * newpath */ syscall_get_arguments_deprecated(args, 3, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* @@ -5002,8 +4816,7 @@ int f_sys_renameat2_x(struct event_filler_arguments *args) */ syscall_get_arguments_deprecated(args, 4, 1, &val); res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -5017,16 +4830,14 @@ int f_sys_symlinkat_x(struct event_filler_arguments *args) retval = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * oldpath */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * newdirfd @@ -5037,16 +4848,14 @@ int f_sys_symlinkat_x(struct event_filler_arguments *args) fd = PPM_AT_FDCWD; res = val_to_ring(args, (s64)fd, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * newpath */ syscall_get_arguments_deprecated(args, 2, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -5073,8 +4882,7 @@ int f_sys_openat2_e(struct event_filler_arguments *args) fd = PPM_AT_FDCWD; res = val_to_ring(args, (s64)fd, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * name @@ -5086,8 +4894,7 @@ int f_sys_openat2_e(struct event_filler_arguments *args) name[PPM_MAX_PATH_SIZE - 1] = '\0'; } res = val_to_ring(args, (int64_t)(long)name, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); #ifdef __NR_openat2 @@ -5112,24 +4919,21 @@ int f_sys_openat2_e(struct event_filler_arguments *args) * Note that we convert them into the ppm portable representation before pushing them to the ring */ res = val_to_ring(args, flags, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * mode (extracted from open_how structure) * Note that we convert them into the ppm portable representation before pushing them to the ring */ res = val_to_ring(args, mode, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * resolve (extracted from open_how structure) * Note that we convert them into the ppm portable representation before pushing them to the ring */ res = val_to_ring(args, resolve, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -5149,8 +4953,7 @@ int f_sys_openat2_x(struct event_filler_arguments *args) retval = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * dirfd @@ -5161,16 +4964,14 @@ int f_sys_openat2_x(struct event_filler_arguments *args) fd = PPM_AT_FDCWD; res = val_to_ring(args, (s64)fd, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * name */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); #ifdef __NR_openat2 @@ -5197,24 +4998,21 @@ int f_sys_openat2_x(struct event_filler_arguments *args) /* update flags if file is created */ get_fd_fmode_created(retval, &flags); res = val_to_ring(args, flags, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * mode (extracted from open_how structure) * Note that we convert them into the ppm portable representation before pushing them to the ring */ res = val_to_ring(args, mode, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * resolve (extracted from open_how structure) * Note that we convert them into the ppm portable representation before pushing them to the ring */ res = val_to_ring(args, resolve, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -5526,22 +5324,19 @@ int f_sys_mlock_x(struct event_filler_arguments *args) int64_t retval = (int64_t)syscall_get_return_value(current, args->regs); int res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * addr */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * len */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -5552,29 +5347,25 @@ int f_sys_mlock2_x(struct event_filler_arguments *args) int64_t retval = (int64_t)syscall_get_return_value(current, args->regs); int res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * addr */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * len */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * flags */ syscall_get_arguments_deprecated(args, 2, 1, &val); res = val_to_ring(args, mlock2_flags_to_scap(val), 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -5585,22 +5376,19 @@ int f_sys_munlock_x(struct event_filler_arguments *args) int64_t retval = (int64_t)syscall_get_return_value(current, args->regs); int res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * addr */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * len */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -5611,15 +5399,13 @@ int f_sys_mlockall_x(struct event_filler_arguments *args) int64_t retval = (int64_t)syscall_get_return_value(current, args->regs); int res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * flags */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, mlockall_flags_to_scap(val), 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -5628,8 +5414,7 @@ int f_sys_munlockall_x(struct event_filler_arguments *args) { int64_t retval = (int64_t)syscall_get_return_value(current, args->regs); int res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -5887,8 +5672,7 @@ int f_sys_dup_e(struct event_filler_arguments *args) */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -5901,16 +5685,14 @@ int f_sys_dup_x(struct event_filler_arguments *args) int64_t retval = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * oldfd */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -5925,8 +5707,7 @@ int f_sys_dup2_e(struct event_filler_arguments *args) */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -5939,24 +5720,21 @@ int f_sys_dup2_x(struct event_filler_arguments *args) int64_t retval = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * oldfd */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * newfd */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -5971,8 +5749,7 @@ int f_sys_dup3_e(struct event_filler_arguments *args) */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -5985,32 +5762,28 @@ int f_sys_dup3_x(struct event_filler_arguments *args) int64_t retval = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * oldfd */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * newfd */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, val, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * flags */ syscall_get_arguments_deprecated(args, 2, 1, &val); res = val_to_ring(args, dup3_flags_to_scap(val), 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -6257,8 +6030,7 @@ int f_sys_sendfile_x(struct event_filler_arguments *args) */ retval = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * offset @@ -6282,8 +6054,7 @@ int f_sys_sendfile_x(struct event_filler_arguments *args) } res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -6358,16 +6129,14 @@ int f_sys_quotactl_x(struct event_filler_arguments *args) */ retval = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * Add special */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * get addr @@ -6382,8 +6151,7 @@ int f_sys_quotactl_x(struct event_filler_arguments *args) else res = val_to_ring(args, 0, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* @@ -6397,64 +6165,50 @@ int f_sys_quotactl_x(struct event_filler_arguments *args) } if (dqblk.dqb_valid & QIF_BLIMITS) { res = val_to_ring(args, dqblk.dqb_bhardlimit, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); res = val_to_ring(args, dqblk.dqb_bsoftlimit, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } else { res = val_to_ring(args, 0, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); res = val_to_ring(args, 0, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } if (dqblk.dqb_valid & QIF_SPACE) { res = val_to_ring(args, dqblk.dqb_curspace, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } else { res = val_to_ring(args, 0, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } if (dqblk.dqb_valid & QIF_ILIMITS) { res = val_to_ring(args, dqblk.dqb_ihardlimit, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); res = val_to_ring(args, dqblk.dqb_isoftlimit, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } else { res = val_to_ring(args, 0, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); res = val_to_ring(args, 0, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } if (dqblk.dqb_valid & QIF_BTIME) { res = val_to_ring(args, dqblk.dqb_btime, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } else { res = val_to_ring(args, 0, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } if (dqblk.dqb_valid & QIF_ITIME) { res = val_to_ring(args, dqblk.dqb_itime, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } else { res = val_to_ring(args, 0, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } /* @@ -6469,32 +6223,26 @@ int f_sys_quotactl_x(struct event_filler_arguments *args) if (dqinfo.dqi_valid & IIF_BGRACE) { res = val_to_ring(args, dqinfo.dqi_bgrace, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } else { res = val_to_ring(args, 0, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } if (dqinfo.dqi_valid & IIF_IGRACE) { res = val_to_ring(args, dqinfo.dqi_igrace, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } else { res = val_to_ring(args, 0, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } if (dqinfo.dqi_valid & IIF_FLAGS) { res = val_to_ring(args, dqinfo.dqi_flags, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } else { res = val_to_ring(args, 0, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); } quota_fmt_out = PPM_QFMT_NOT_USED; @@ -6505,8 +6253,7 @@ int f_sys_quotactl_x(struct event_filler_arguments *args) quota_fmt_out = quotactl_fmt_to_scap(quota_fmt_out); } res = val_to_ring(args, quota_fmt_out, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -6519,15 +6266,13 @@ int f_sys_scapevent_e(struct event_filler_arguments *args) * event_type */ res = val_to_ring(args, (unsigned long)args->sched_prev, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * event_data */ res = val_to_ring(args, (unsigned long)args->sched_next, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -6544,8 +6289,7 @@ int f_sys_getresuid_and_gid_x(struct event_filler_arguments *args) */ retval = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * ruid @@ -6564,8 +6308,7 @@ int f_sys_getresuid_and_gid_x(struct event_filler_arguments *args) return PPM_FAILURE_INVALID_USER_MEMORY; res = val_to_ring(args, uid, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * euid @@ -6576,8 +6319,7 @@ int f_sys_getresuid_and_gid_x(struct event_filler_arguments *args) return PPM_FAILURE_INVALID_USER_MEMORY; res = val_to_ring(args, uid, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * suid @@ -6588,8 +6330,7 @@ int f_sys_getresuid_and_gid_x(struct event_filler_arguments *args) return PPM_FAILURE_INVALID_USER_MEMORY; res = val_to_ring(args, uid, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -6708,8 +6449,7 @@ int f_sys_unshare_e(struct event_filler_arguments *args) syscall_get_arguments_deprecated(args, 0, 1, &val); flags = clone_flags_to_scap(val); res = val_to_ring(args, flags, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -6723,22 +6463,19 @@ int f_sys_signaldeliver_e(struct event_filler_arguments *args) * source pid */ res = val_to_ring(args, args->spid, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * destination pid */ res = val_to_ring(args, args->dpid, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * signal number */ res = val_to_ring(args, args->signo, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -6750,16 +6487,13 @@ int f_sys_pagefault_e(struct event_filler_arguments *args) int res; res = val_to_ring(args, args->fault_data.address, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); res = val_to_ring(args, args->fault_data.regs->ip, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); res = val_to_ring(args, pf_flags_to_scap(args->fault_data.error_code), 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -6773,15 +6507,13 @@ int f_cpu_hotplug_e(struct event_filler_arguments *args) * cpu */ res = val_to_ring(args, (uint64_t)args->sched_prev, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * action */ res = val_to_ring(args, (uint64_t)args->sched_next, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -6869,24 +6601,21 @@ int f_sys_semget_e(struct event_filler_arguments *args) */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * nsems */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * semflg */ syscall_get_arguments_deprecated(args, 2, 1, &val); res = val_to_ring(args, semget_flags_to_scap(val), 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -6901,24 +6630,21 @@ int f_sys_semctl_e(struct event_filler_arguments *args) */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * semnum */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * cmd */ syscall_get_arguments_deprecated(args, 2, 1, &val); res = val_to_ring(args, semctl_cmd_to_scap(val), 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * optional argument semun/val @@ -6928,8 +6654,7 @@ int f_sys_semctl_e(struct event_filler_arguments *args) else val = 0; res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -6944,8 +6669,7 @@ int f_sys_access_e(struct event_filler_arguments *args) */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, access_flags_to_scap(val), 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -7024,8 +6748,7 @@ int f_sys_bpf_x(struct event_filler_arguments *args) */ fd = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, fd, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -7108,24 +6831,21 @@ int f_sys_chmod_x(struct event_filler_arguments *args) retval = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * filename */ syscall_get_arguments_deprecated(args, 0, 1, &val); res = val_to_ring(args, val, 0, true, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); /* * mode */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, chmod_mode_to_scap(val), 0, false, 0); - if (unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); return add_sentinel(args); } @@ -7310,8 +7030,7 @@ int f_sys_capset_x(struct event_filler_arguments *args) retval = (int64_t)syscall_get_return_value(current, args->regs); res = val_to_ring(args, retval, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - return res; + CHECK_RES(res); cred = get_current_cred(); #if LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0) @@ -7525,11 +7244,7 @@ int f_sched_prog_exec(struct event_filler_arguments *args) * performed, so the return value will be always 0. */ res = val_to_ring(args, 0, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } - + CHECK_RES(res); /* * The call always succeed so get `exe`, `args` from the current * process; put one \0-separated exe-args string into @@ -7577,31 +7292,19 @@ int f_sched_prog_exec(struct event_filler_arguments *args) /* Parameter 2: exe (type: PT_CHARBUF) */ res = val_to_ring(args, (uint64_t)(long)args->str_storage, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 3: args (type: PT_CHARBUFARRAY) */ res = val_to_ring(args, (int64_t)(long)args->str_storage + exe_len, args_len - exe_len, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 4: tid (type: PT_PID) */ res = val_to_ring(args, (int64_t)current->pid, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 5: pid (type: PT_PID) */ res = val_to_ring(args, (int64_t)current->tgid, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 6: ptid (type: PT_PID) */ if(current->real_parent) @@ -7610,41 +7313,26 @@ int f_sched_prog_exec(struct event_filler_arguments *args) } res = val_to_ring(args, (int64_t)ptid, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 7: cwd (type: PT_CHARBUF) * cwd, pushed empty to avoid breaking compatibility * with the older event format */ res = push_empty_param(args); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 8: fdlimit (type: PT_UINT64) */ res = val_to_ring(args, (int64_t)rlimit(RLIMIT_NOFILE), 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 9: pgft_maj (type: PT_UINT64) */ res = val_to_ring(args, current->maj_flt, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 10: pgft_min (type: PT_UINT64) */ res = val_to_ring(args, current->min_flt, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); if(mm) { @@ -7655,31 +7343,19 @@ int f_sched_prog_exec(struct event_filler_arguments *args) /* Parameter 11: vm_size (type: PT_UINT32) */ res = val_to_ring(args, total_vm, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 12: vm_rss (type: PT_UINT32) */ res = val_to_ring(args, total_rss, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 13: vm_swap (type: PT_UINT32) */ res = val_to_ring(args, swap, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 14: comm (type: PT_CHARBUF) */ res = val_to_ring(args, (uint64_t)current->comm, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); args->str_storage[0] = 0; #ifdef CONFIG_CGROUPS @@ -7691,10 +7367,7 @@ int f_sched_prog_exec(struct event_filler_arguments *args) /* Parameter 15: cgroups (type: PT_CHARBUFARRAY) */ res = val_to_ring(args, (int64_t)(long)args->str_storage, STR_STORAGE_SIZE - available, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); env_len = mm->env_end - mm->env_start; if(env_len > PAGE_SIZE) @@ -7716,25 +7389,16 @@ int f_sched_prog_exec(struct event_filler_arguments *args) /* Parameter 16: env (type: PT_CHARBUFARRAY) */ res = val_to_ring(args, (int64_t)(long)args->str_storage, env_len, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 17: tty (type: PT_UINT32) */ tty_nr = ppm_get_tty(); res = val_to_ring(args, tty_nr, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 18: pgid (type: PT_PID) */ res = val_to_ring(args, (int64_t)task_pgrp_nr_ns(current, task_active_pid_ns(current)), 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 19: loginuid (type: PT_UID) */ #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 5, 0) @@ -7743,10 +7407,7 @@ int f_sched_prog_exec(struct event_filler_arguments *args) loginuid = audit_get_loginuid(current); #endif res = val_to_ring(args, loginuid, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* `exe_writable` and `exe_upper_layer` flag logic */ exe_file = ppm_get_mm_exe_file(mm); @@ -7829,10 +7490,7 @@ int f_sched_prog_exec(struct event_filler_arguments *args) /* Parameter 20: flags (type: PT_FLAGS32) */ res = val_to_ring(args, flags, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* * capabilities @@ -7923,10 +7581,7 @@ int f_sched_prog_fork(struct event_filler_arguments *args) * event, so the return value will be always 0. */ res = val_to_ring(args, 0, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* * The call always succeed so get `exe`, `args` from the child @@ -7975,31 +7630,19 @@ int f_sched_prog_fork(struct event_filler_arguments *args) /* Parameter 2: exe (type: PT_CHARBUF) */ res = val_to_ring(args, (uint64_t)(long)args->str_storage, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 3: args (type: PT_CHARBUFARRAY) */ res = val_to_ring(args, (int64_t)(long)args->str_storage + exe_len, args_len - exe_len, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 4: tid (type: PT_PID) */ res = val_to_ring(args, (int64_t)child->pid, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 5: pid (type: PT_PID) */ res = val_to_ring(args, (int64_t)child->tgid, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 6: ptid (type: PT_PID) */ if(child->real_parent) @@ -8008,41 +7651,26 @@ int f_sched_prog_fork(struct event_filler_arguments *args) } res = val_to_ring(args, (int64_t)ptid, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 7: cwd (type: PT_CHARBUF) * cwd, pushed empty to avoid breaking compatibility * with the older event format */ res = push_empty_param(args); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 8: fdlimit (type: PT_UINT64) */ res = val_to_ring(args, (int64_t)rlimit(RLIMIT_NOFILE), 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 9: pgft_maj (type: PT_UINT64) */ res = val_to_ring(args, child->maj_flt, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 10: pgft_min (type: PT_UINT64) */ res = val_to_ring(args, child->min_flt, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); if(mm) { @@ -8053,31 +7681,19 @@ int f_sched_prog_fork(struct event_filler_arguments *args) /* Parameter 11: vm_size (type: PT_UINT32) */ res = val_to_ring(args, total_vm, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 12: vm_rss (type: PT_UINT32) */ res = val_to_ring(args, total_rss, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 13: vm_swap (type: PT_UINT32) */ res = val_to_ring(args, swap, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 14: comm (type: PT_CHARBUF) */ res = val_to_ring(args, (uint64_t)child->comm, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); args->str_storage[0] = 0; #ifdef CONFIG_CGROUPS @@ -8089,10 +7705,7 @@ int f_sched_prog_fork(struct event_filler_arguments *args) /* Parameter 15: cgroups (type: PT_CHARBUFARRAY) */ res = val_to_ring(args, (int64_t)(long)args->str_storage, STR_STORAGE_SIZE - available, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Since Linux 2.5.35, the flags mask must also include * CLONE_SIGHAND if CLONE_THREAD is specified (and note that, @@ -8125,38 +7738,23 @@ int f_sched_prog_fork(struct event_filler_arguments *args) /* Parameter 16: flags (type: PT_FLAGS32) */ res = val_to_ring(args, flags, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 17: uid (type: PT_UID) */ res = val_to_ring(args, euid, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 18: gid (type: PT_UINT32) */ res = val_to_ring(args, egid, 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 19: vtid (type: PT_PID) */ res = val_to_ring(args, task_pid_nr_ns(child, pidns), 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 20: vpid (type: PT_PID) */ res = val_to_ring(args, task_tgid_nr_ns(child, pidns), 0, false, 0); - if(unlikely(res != PPM_SUCCESS)) - { - return res; - } + CHECK_RES(res); /* Parameter 21: pid_namespace init task start_time monotonic time in ns (type: PT_UINT64) */ @@ -8293,24 +7891,24 @@ int f_sys_pidfd_getfd_x(struct event_filler_arguments *args) /* Parameter 1: ret (type: PT_FD) */ retval = (int64_t) syscall_get_return_value(current,args->regs); res = val_to_ring(args, retval, 0, false, 0); - CHECK_RES(res) + CHECK_RES(res); /* Parameter 2: pidfd (type: PT_FD) */ syscall_get_arguments_deprecated(args, 0, 1, &val); fd = (s32)val; res = val_to_ring(args, (s64)fd, 0, true, 0); - CHECK_RES(res) + CHECK_RES(res); /* Parameter 3: targetfd (type: PT_FD) */ syscall_get_arguments_deprecated(args, 1, 1, &val); fd = (s32)val; res = val_to_ring(args, (s64)fd, 0, true, 0); - CHECK_RES(res) + CHECK_RES(res); /* Parameter 4: flags (type: PT_FLAGS32) */ syscall_get_arguments_deprecated(args, 2, 1, &val); res = val_to_ring(args, val, 0, true, 0); - CHECK_RES(res) + CHECK_RES(res); return add_sentinel(args); } @@ -8325,18 +7923,18 @@ int f_sys_pidfd_open_x(struct event_filler_arguments *args) /* Parameter 1: ret (type: PT_FD) */ retval = (int64_t) syscall_get_return_value(current,args->regs); res = val_to_ring(args, retval, 0, false, 0); - CHECK_RES(res) + CHECK_RES(res); /* Parameter 2: pid (type: PT_PID) */ syscall_get_arguments_deprecated(args, 0, 1, &val); fd = (s32)val; res = val_to_ring(args, (s64)fd, 0, true, 0); - CHECK_RES(res) + CHECK_RES(res); /* Parameter 4: flags (type: PT_FLAGS32) */ syscall_get_arguments_deprecated(args, 1, 1, &val); res = val_to_ring(args, pidfd_open_flags_to_scap(val), 0, true, 0); - CHECK_RES(res) + CHECK_RES(res); return add_sentinel(args); } @@ -8351,7 +7949,7 @@ int f_sys_init_module_x(struct event_filler_arguments *args) /* Parameter 1: ret (type: PT_ERRNO) */ retval = (int64_t) syscall_get_return_value(current,args->regs); res = val_to_ring(args, retval, 0, false, 0); - CHECK_RES(res) + CHECK_RES(res); syscall_get_arguments_deprecated(args, 1, 1, &val); len = val; @@ -8383,13 +7981,13 @@ int f_sys_finit_module_x(struct event_filler_arguments *args) /* Parameter 1: ret (type: PT_ERRNO) */ retval = (int64_t) syscall_get_return_value(current,args->regs); res = val_to_ring(args, retval, 0, false, 0); - CHECK_RES(res) + CHECK_RES(res); /* Parameter 2: fd (type: PT_FD) */ syscall_get_arguments_deprecated(args, 0, 1, &val); fd = (s32)val; res = val_to_ring(args, (s64)fd, 0, true, 0); - CHECK_RES(res) + CHECK_RES(res); /* Parameter 3: uargs (type: PT_CHARBUF) */ syscall_get_arguments_deprecated(args, 1, 1, &val); @@ -8413,7 +8011,7 @@ int f_sys_mknod_x(struct event_filler_arguments *args) /* Parameter 1: ret (type: PT_ERRNO) */ retval = (int64_t) syscall_get_return_value(current,args->regs); res = val_to_ring(args, retval, 0, false, 0); - CHECK_RES(res) + CHECK_RES(res); /* Parameter 2: path (type: PT_CHARBUF) */ syscall_get_arguments_deprecated(args, 0, 1, &val);