instrumentation/syscalls/headers/syscalls_unknown.h

   1 #undef TRACE_SYSTEM
   2 #define TRACE_SYSTEM syscalls_unknown
   3
   4 #if !defined(_TRACE_SYSCALLS_UNKNOWN_H) || defined(TRACE_HEADER_MULTI_READ)
   5 #define _TRACE_SYSCALLS_UNKNOWN_H
   6
   7 #include <linux/tracepoint.h>
   8 #include <linux/syscalls.h>
   9
  10 #define UNKNOWN_SYSCALL_NRARGS  6
  11
  12 TRACE_EVENT(sys_unknown,
  13         TP_PROTO(unsigned int id, unsigned long *args),
  14         TP_ARGS(id, args),
  15         TP_STRUCT__entry(
  16                 __field(unsigned int, id)
  17                 __array(unsigned long, args, UNKNOWN_SYSCALL_NRARGS)
  18         ),
  19         TP_fast_assign(
  20                 tp_assign(id, id)
  21                 tp_memcpy(args, args, UNKNOWN_SYSCALL_NRARGS * sizeof(*args))
  22         ),
  23         TP_printk()
  24 )
  25 /*
  26  * This is going to hook on sys_exit in the kernel.
  27  * We change the name so we don't clash with the sys_exit syscall entry
  28  * event.
  29  */
  30 TRACE_EVENT(exit_syscall,
  31         TP_PROTO(long errno),
  32         TP_ARGS(errno),
  33         TP_STRUCT__entry(
  34                 __field(long, errno)
  35         ),
  36         TP_fast_assign(
  37                 tp_assign(errno, errno)
  38         ),
  39         TP_printk()
  40 )
  41
  42 #endif /*  _TRACE_SYSCALLS_UNKNOWN_H */
  43
  44 /* This part must be outside protection */
  45 #include "../../../probes/define_trace.h"