| 1 | #if !defined(_TRACE_SYSCALLS_UNKNOWN_H) || defined(TRACE_HEADER_MULTI_READ) |
| 2 | #define _TRACE_SYSCALLS_UNKNOWN_H |
| 3 | |
| 4 | #include <linux/tracepoint.h> |
| 5 | #include <linux/syscalls.h> |
| 6 | |
| 7 | #define UNKNOWN_SYSCALL_NRARGS 6 |
| 8 | |
| 9 | TRACE_EVENT(sys_unknown, |
| 10 | TP_PROTO(unsigned int id, unsigned long *args), |
| 11 | TP_ARGS(id, args), |
| 12 | TP_STRUCT__entry( |
| 13 | __field(unsigned int, id) |
| 14 | __array(unsigned long, args, UNKNOWN_SYSCALL_NRARGS) |
| 15 | ), |
| 16 | TP_fast_assign( |
| 17 | tp_assign(id, id) |
| 18 | tp_memcpy(args, args, UNKNOWN_SYSCALL_NRARGS * sizeof(*args)) |
| 19 | ), |
| 20 | TP_printk() |
| 21 | ) |
| 22 | TRACE_EVENT(compat_sys_unknown, |
| 23 | TP_PROTO(unsigned int id, unsigned long *args), |
| 24 | TP_ARGS(id, args), |
| 25 | TP_STRUCT__entry( |
| 26 | __field(unsigned int, id) |
| 27 | __array(unsigned long, args, UNKNOWN_SYSCALL_NRARGS) |
| 28 | ), |
| 29 | TP_fast_assign( |
| 30 | tp_assign(id, id) |
| 31 | tp_memcpy(args, args, UNKNOWN_SYSCALL_NRARGS * sizeof(*args)) |
| 32 | ), |
| 33 | TP_printk() |
| 34 | ) |
| 35 | /* |
| 36 | * This is going to hook on sys_exit in the kernel. |
| 37 | * We change the name so we don't clash with the sys_exit syscall entry |
| 38 | * event. |
| 39 | */ |
| 40 | TRACE_EVENT(exit_syscall, |
| 41 | TP_PROTO(struct pt_regs *regs, long ret), |
| 42 | TP_ARGS(regs, ret), |
| 43 | TP_STRUCT__entry( |
| 44 | __field(long, ret) |
| 45 | ), |
| 46 | TP_fast_assign( |
| 47 | tp_assign(ret, ret) |
| 48 | ), |
| 49 | TP_printk() |
| 50 | ) |
| 51 | |
| 52 | #endif /* _TRACE_SYSCALLS_UNKNOWN_H */ |
| 53 | |
| 54 | /* This part must be outside protection */ |
| 55 | #include "../../../probes/define_trace.h" |