Commit | Line | Data |
---|---|---|
63728b02 MD |
1 | #undef TRACE_SYSTEM |
2 | #define TRACE_SYSTEM syscalls_unknown | |
3 | ||
4 | #if !defined(_TRACE_SYSCALLS_UNKNOWN_H) || defined(TRACE_HEADER_MULTI_READ) | |
5 | #define _TRACE_SYSCALLS_UNKNOWN_H | |
6 | ||
7 | #include <linux/tracepoint.h> | |
8 | #include <linux/syscalls.h> | |
9 | ||
10 | #define UNKNOWN_SYSCALL_NRARGS 6 | |
11 | ||
12 | TRACE_EVENT(sys_unknown, | |
13 | TP_PROTO(unsigned int id, unsigned long *args), | |
14 | TP_ARGS(id, args), | |
15 | TP_STRUCT__entry( | |
16 | __field(unsigned int, id) | |
17 | __array(unsigned long, args, UNKNOWN_SYSCALL_NRARGS) | |
18 | ), | |
19 | TP_fast_assign( | |
20 | tp_assign(id, id) | |
21 | tp_memcpy(args, args, UNKNOWN_SYSCALL_NRARGS * sizeof(*args)) | |
22 | ), | |
23 | TP_printk() | |
24 | ) | |
b76dc1a0 MD |
25 | TRACE_EVENT(compat_sys_unknown, |
26 | TP_PROTO(unsigned int id, unsigned long *args), | |
27 | TP_ARGS(id, args), | |
28 | TP_STRUCT__entry( | |
29 | __field(unsigned int, id) | |
30 | __array(unsigned long, args, UNKNOWN_SYSCALL_NRARGS) | |
31 | ), | |
32 | TP_fast_assign( | |
33 | tp_assign(id, id) | |
34 | tp_memcpy(args, args, UNKNOWN_SYSCALL_NRARGS * sizeof(*args)) | |
35 | ), | |
36 | TP_printk() | |
37 | ) | |
63728b02 MD |
38 | /* |
39 | * This is going to hook on sys_exit in the kernel. | |
40 | * We change the name so we don't clash with the sys_exit syscall entry | |
41 | * event. | |
42 | */ | |
43 | TRACE_EVENT(exit_syscall, | |
45913693 MD |
44 | TP_PROTO(struct pt_regs *regs, long ret), |
45 | TP_ARGS(regs, ret), | |
63728b02 | 46 | TP_STRUCT__entry( |
45913693 | 47 | __field(long, ret) |
63728b02 MD |
48 | ), |
49 | TP_fast_assign( | |
45913693 | 50 | tp_assign(ret, ret) |
63728b02 MD |
51 | ), |
52 | TP_printk() | |
53 | ) | |
54 | ||
55 | #endif /* _TRACE_SYSCALLS_UNKNOWN_H */ | |
56 | ||
57 | /* This part must be outside protection */ | |
58 | #include "../../../probes/define_trace.h" |