instrumentation/syscalls/headers/syscalls_unknown.h

   1 #if !defined(_TRACE_SYSCALLS_UNKNOWN_H) || defined(TRACE_HEADER_MULTI_READ)
   2 #define _TRACE_SYSCALLS_UNKNOWN_H
   3
   4 #include <linux/tracepoint.h>
   5 #include <linux/syscalls.h>
   6
   7 #define UNKNOWN_SYSCALL_NRARGS  6
   8
   9 TRACE_EVENT(sys_unknown,
  10         TP_PROTO(unsigned int id, unsigned long *args),
  11         TP_ARGS(id, args),
  12         TP_STRUCT__entry(
  13                 __field(unsigned int, id)
  14                 __array(unsigned long, args, UNKNOWN_SYSCALL_NRARGS)
  15         ),
  16         TP_fast_assign(
  17                 tp_assign(id, id)
  18                 tp_memcpy(args, args, UNKNOWN_SYSCALL_NRARGS * sizeof(*args))
  19         ),
  20         TP_printk()
  21 )
  22 TRACE_EVENT(compat_sys_unknown,
  23         TP_PROTO(unsigned int id, unsigned long *args),
  24         TP_ARGS(id, args),
  25         TP_STRUCT__entry(
  26                 __field(unsigned int, id)
  27                 __array(unsigned long, args, UNKNOWN_SYSCALL_NRARGS)
  28         ),
  29         TP_fast_assign(
  30                 tp_assign(id, id)
  31                 tp_memcpy(args, args, UNKNOWN_SYSCALL_NRARGS * sizeof(*args))
  32         ),
  33         TP_printk()
  34 )
  35 /*
  36  * This is going to hook on sys_exit in the kernel.
  37  * We change the name so we don't clash with the sys_exit syscall entry
  38  * event.
  39  */
  40 TRACE_EVENT(exit_syscall,
  41         TP_PROTO(struct pt_regs *regs, long ret),
  42         TP_ARGS(regs, ret),
  43         TP_STRUCT__entry(
  44                 __field(long, ret)
  45         ),
  46         TP_fast_assign(
  47                 tp_assign(ret, ret)
  48         ),
  49         TP_printk()
  50 )
  51
  52 #endif /*  _TRACE_SYSCALLS_UNKNOWN_H */
  53
  54 /* This part must be outside protection */
  55 #include "../../../probes/define_trace.h"