Lines Matching defs:sys_enter

131 		const char *sys_enter,
150 			struct evsel *sys_enter,
1480 		struct bpf_program *sys_enter,
1487 	 * sys_exit with the pathname in sys_enter.
1885  * first having received a sys_enter ("poll" issued before tracing session
1886  * starts, lost sys_enter exit due to ring buffer overflow).
2127 			 * /sys/kernel/tracing/events/syscalls/sys_enter*
2744 	 * For now with BPF raw_augmented we hook into raw_syscalls:sys_enter
2748 	 * sc->args_size but always after the full raw_syscalls:sys_enter payload,
2816 	 * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible
2821 	 * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly
2825 	if (evsel != trace->syscalls.events.sys_enter)
3047 	 * sys_enter + sys_exit and other tracepoint events.
3528 		if (is_valid_tracepoint("raw_syscalls:sys_enter"))
3529 			rec_argv[j++] = "raw_syscalls:sys_enter,raw_syscalls:sys_exit";
3530 		else if (is_valid_tracepoint("syscalls:sys_enter"))
3531 			rec_argv[j++] = "syscalls:sys_enter,syscalls:sys_exit";
3662 	struct evsel *sys_enter, *sys_exit;
3664 	sys_enter = perf_evsel__raw_syscall_newtp("sys_enter", trace__sys_enter);
3665 	if (sys_enter == NULL)
3668 	if (perf_evsel__init_sc_tp_ptr_field(sys_enter, args))
3678 	evsel__config_callchain(sys_enter, &trace->opts, &callchain_param);
3681 	evlist__add(evlist, sys_enter);
3693 	trace->syscalls.events.sys_enter = sys_enter;
3703 	evsel__delete_priv(sys_enter);
3718 	if (!evsel__append_tp_filter(trace->syscalls.events.sys_enter, filter)) {
3793 	sc->bpf_prog.sys_enter = trace__find_syscall_bpf_prog(trace, sc, sc->fmt ? sc->fmt->bpf_prog_name.sys_enter : NULL, "enter");
3800 	return sc ? bpf_program__fd(sc->bpf_prog.sys_enter) : bpf_program__fd(unaugmented_prog);
3916 		    pair->bpf_prog.sys_enter == unaugmented_prog)
3970 		pair_prog = pair->bpf_prog.sys_enter;
3972 		 * If the pair isn't enabled, then its bpf_prog.sys_enter will not
3981 			pair_prog = trace__find_syscall_bpf_prog(trace, pair, pair->fmt ? pair->fmt->bpf_prog_name.sys_enter : NULL, "enter");
3986 		pr_debug("Reusing \"%s\" BPF sys_enter augmenter for \"%s\"\n", pair->name,
4071 		if (sc == NULL || sc->bpf_prog.sys_enter == NULL)
4075 		 * For now we're just reusing the sys_enter prog, and if it
4078 		if (sc->bpf_prog.sys_enter != unaugmented_prog)
4089 		sc->bpf_prog.sys_enter = pair_prog;
4092 		 * Update the BPF_MAP_TYPE_PROG_SHARED for raw_syscalls:sys_enter
4095 		prog_fd = bpf_program__fd(sc->bpf_prog.sys_enter);
4113 	if (trace->syscalls.events.sys_enter)
4743 	evsel = evlist__find_tracepoint_by_name(session->evlist, "raw_syscalls:sys_enter");
4744 	trace->syscalls.events.sys_enter = evsel;
4747 		evsel = evlist__find_tracepoint_by_name(session->evlist, "syscalls:sys_enter");
4752 		pr_err("Error during initialize raw_syscalls:sys_enter event\n");
5648 	 * combining raw_syscalls:sys_enter with raw_syscalls:sys_exit.
5650 	 * We'll switch to look at two BPF maps, one for sys_enter and the
5665 			    strstr(evsel__name(evsel), "syscalls:sys_enter")) {
5673 				 * that we get from syscalls:sys_enter tracefs format file.
5677 				 * Now we do the same for the *syscalls:sys_enter event so that
5696 				 * raw_syscalls:sys_enter and there we get all
5701 				 * always after the full raw_syscalls:sys_enter