Lines Matching defs:syscalls
155 } syscalls;
351 * sc: for raw_syscalls:sys_{enter,exit} and syscalls:sys_{enter,exit}_SYSCALLNAME
375 * syscalls:sys_{enter,exit}_SYSCALL tracepoints
533 /* older kernel (e.g., RHEL6) use syscalls:{enter,exit} */
535 evsel = evsel__newtp("syscalls", direction);
1809 * So that the next arg with a payload can consume its augmented arg, i.e. for rename* syscalls
2142 * /sys/kernel/tracing/events/syscalls/sys_enter*
2202 sc->tp_format = trace_event__tp_format("syscalls", tp_name);
2206 sc->tp_format = trace_event__tp_format("syscalls", tp_name);
2309 pr_debug("Skipping unknown syscalls: ");
2448 * not needed for syscalls that always return a given type, say an fd.
2572 if (trace->syscalls.table) {
2573 struct syscall **sc_entry = bsearch(&key, trace->syscalls.table,
2574 trace->syscalls.table_size,
2575 sizeof(trace->syscalls.table[0]),
2586 tmp = reallocarray(trace->syscalls.table, trace->syscalls.table_size + 1,
2587 sizeof(trace->syscalls.table[0]));
2593 trace->syscalls.table = tmp;
2594 trace->syscalls.table[trace->syscalls.table_size++] = sc;
2595 qsort(trace->syscalls.table, trace->syscalls.table_size, sizeof(trace->syscalls.table[0]),
2771 * use syscalls:sys_enter_NAME, so that we reduce the kernel/userspace
2837 * syscall->args_size using each syscalls:sys_enter_NAME tracefs format file,
2841 * here and avoid using augmented syscalls when the evsel is the raw_syscalls one.
2843 if (evsel != trace->syscalls.events.sys_enter)
3338 if (evsel == trace->syscalls.events.bpf_output) {
3579 else if (is_valid_tracepoint("syscalls:sys_enter"))
3580 rec_argv[j++] = "syscalls:sys_enter,syscalls:sys_exit";
3582 pr_err("Neither raw_syscalls nor syscalls events exist.\n");
3744 trace->syscalls.events.sys_enter = sys_enter;
3745 trace->syscalls.events.sys_exit = sys_exit;
3769 if (!evsel__append_tp_filter(trace->syscalls.events.sys_enter, filter)) {
3770 sys_exit = trace->syscalls.events.sys_exit;
3811 scnprintf(default_prog_name, sizeof(default_prog_name), "tp/syscalls/sys_%s_%s", type, sc->name);
3816 scnprintf(default_prog_name, sizeof(default_prog_name), "tp/syscalls/sys_%s_%s", type, sc->fmt->alias);
3831 pr_debug("Couldn't find BPF prog \"%s\" to associate with syscalls:sys_%s_%s, not augmenting it\n",
3950 * We're only interested in syscalls that have a pointer:
4013 * more than what is common to the two syscalls.
4028 * For instance, we have "!syscalls:sys_enter_renameat" and that is
4089 * Now lets do a second pass looking for enabled syscalls without
4133 * Look at all the other syscalls for one that has a signature
4164 if (trace->syscalls.events.sys_enter)
4557 if (trace->syscalls.events.sys_exit) {
4559 trace->syscalls.events.sys_exit->filter);
4567 * syscalls opening a pathname and associating it with a descriptor or
4795 trace->syscalls.events.sys_enter = evsel;
4796 /* older kernels have syscalls tp versus raw_syscalls */
4798 evsel = evlist__find_tracepoint_by_name(session->evlist, "syscalls:sys_enter");
4808 trace->syscalls.events.sys_exit = evsel;
4810 evsel = evlist__find_tracepoint_by_name(session->evlist, "syscalls:sys_exit");
5187 if (strcmp(tp_format->system, "syscalls")) {
5220 * XXX: Hackish, just splitting the combined -e+--event (syscalls
5255 /* TODO: support for more than just perf binary machine type syscalls. */
5414 if (trace->syscalls.table) {
5415 for (size_t i = 0; i < trace->syscalls.table_size; i++)
5416 syscall__delete(trace->syscalls.table[i]);
5417 zfree(&trace->syscalls.table);
5469 OPT_CALLBACK(0, "expr", &trace, "expr", "list of syscalls/events to trace",
5497 "Show only syscalls that failed"),
5501 "Show all syscalls and summary with statistics"),
5509 OPT_BOOLEAN(0, "syscalls", &trace.trace_syscalls, "Trace syscalls"),
5657 trace.syscalls.events.bpf_output = evlist__last(trace.evlist);
5693 perror("failed to set syscalls:* tracepoint fields");
5702 * If we are augmenting syscalls, then combine what we put in the
5704 * syscalls:sys_exit_FOO tracepoints, i.e. just like we do without BPF,
5712 if (trace.syscalls.events.bpf_output) {
5721 if (trace.syscalls.events.bpf_output->priv == NULL &&
5722 strstr(evsel__name(evsel), "syscalls:sys_enter")) {
5723 struct evsel *augmented = trace.syscalls.events.bpf_output;
5730 * that we get from syscalls:sys_enter tracefs format file.
5734 * Now we do the same for the *syscalls:sys_enter event so that
5745 if (strstarts(evsel__name(evsel), "syscalls:sys_exit_")) {
5766 * syscalls:sys_enter_NAME, so that we reduce