Syscall filtering: apply to syscall exit

[lttng-modules.git] / instrumentation / syscalls / headers / syscalls_unknown.h

diff --git a/instrumentation/syscalls/headers/syscalls_unknown.h b/instrumentation/syscalls/headers/syscalls_unknown.h
index 4582d03d731f15a0de2cab611d541fd4f50e5da8..a2723c5b5944fce59e59f575374620f9ddda4020 100644 (file)
--- a/instrumentation/syscalls/headers/syscalls_unknown.h
+++ b/instrumentation/syscalls/headers/syscalls_unknown.h
@@ -6,7 +6,10 @@
 
 #define UNKNOWN_SYSCALL_NRARGS 6
 
-TRACE_EVENT(sys_unknown,
+#undef TP_PROBE_CB
+#define TP_PROBE_CB(_template)          &syscall_entry_probe
+
+TRACE_EVENT(syscall_enter_unknown,
        TP_PROTO(unsigned int id, unsigned long *args),
        TP_ARGS(id, args),
        TP_STRUCT__entry(
@@ -19,7 +22,7 @@ TRACE_EVENT(sys_unknown,
        ),
        TP_printk()
 )
-TRACE_EVENT(compat_sys_unknown,
+TRACE_EVENT(compat_syscall_enter_unknown,
        TP_PROTO(unsigned int id, unsigned long *args),
        TP_ARGS(id, args),
        TP_STRUCT__entry(
@@ -32,23 +35,40 @@ TRACE_EVENT(compat_sys_unknown,
        ),
        TP_printk()
 )
-/* 
- * This is going to hook on sys_exit in the kernel.
- * We change the name so we don't clash with the sys_exit syscall entry
- * event.
- */
-TRACE_EVENT(exit_syscall,
-       TP_PROTO(struct pt_regs *regs, long ret),
-       TP_ARGS(regs, ret),
+
+#undef TP_PROBE_CB
+#define TP_PROBE_CB(_template)          &syscall_exit_probe
+
+TRACE_EVENT(syscall_exit_unknown,
+       TP_PROTO(unsigned int id, long ret, unsigned long *args),
+       TP_ARGS(id, ret, args),
        TP_STRUCT__entry(
+               __field(unsigned int, id)
                __field(long, ret)
+               __array(unsigned long, args, UNKNOWN_SYSCALL_NRARGS)
        ),
        TP_fast_assign(
+               tp_assign(id, id)
                tp_assign(ret, ret)
+               tp_memcpy(args, args, UNKNOWN_SYSCALL_NRARGS * sizeof(*args))
+       ),
+       TP_printk()
+)
+TRACE_EVENT(compat_syscall_exit_unknown,
+       TP_PROTO(unsigned int id, long ret, unsigned long *args),
+       TP_ARGS(id, ret, args),
+       TP_STRUCT__entry(
+               __field(unsigned int, id)
+               __field(long, ret)
+               __array(unsigned long, args, UNKNOWN_SYSCALL_NRARGS)
+       ),
+       TP_fast_assign(
+               tp_assign(id, id)
+               tp_assign(ret, ret)
+               tp_memcpy(args, args, UNKNOWN_SYSCALL_NRARGS * sizeof(*args))
        ),
        TP_printk()
 )
-
 #endif /*  _TRACE_SYSCALLS_UNKNOWN_H */
 
 /* This part must be outside protection */