155 	} syscalls;  member
339  * sc:	for raw_syscalls:sys_{enter,exit} and syscalls:sys_{enter,exit}_SYSCALLNAME
363  * syscalls:sys_{enter,exit}_SYSCALL tracepoints
521 	/* older kernel (e.g., RHEL6) use syscalls:{enter,exit} */  in perf_evsel__raw_syscall_newtp()
523 		evsel = evsel__newtp("syscalls", direction);  in perf_evsel__raw_syscall_newtp()
1816 	 * So that the next arg with a payload can consume its augmented arg, i.e. for rename* syscalls  in syscall_arg__scnprintf_augmented_string()
2106 			 * /sys/kernel/tracing/events/syscalls/sys_enter*  in syscall_arg_fmt__init_array()
2165 	sc->tp_format = trace_event__tp_format("syscalls", tp_name);  in syscall__read_info()
2169 		sc->tp_format = trace_event__tp_format("syscalls", tp_name);  in syscall__read_info()
2267 				pr_debug("Skipping unknown syscalls: ");  in trace__validate_ev_qualifier()
2406 	 * not needed for syscalls that always return a given type, say an fd.  in syscall__scnprintf_args()
2530 	if (trace->syscalls.table) {  in trace__find_syscall()
2531 		struct syscall **sc_entry = bsearch(&key, trace->syscalls.table,  in trace__find_syscall()
2532 						    trace->syscalls.table_size,  in trace__find_syscall()
2533 						    sizeof(trace->syscalls.table[0]),  in trace__find_syscall()
2544 	tmp = reallocarray(trace->syscalls.table, trace->syscalls.table_size + 1,  in trace__find_syscall()
2545 			   sizeof(trace->syscalls.table[0]));  in trace__find_syscall()
2551 	trace->syscalls.table = tmp;  in trace__find_syscall()
2552 	trace->syscalls.table[trace->syscalls.table_size++] = sc;  in trace__find_syscall()
2553 	qsort(trace->syscalls.table, trace->syscalls.table_size, sizeof(trace->syscalls.table[0]),  in trace__find_syscall()
2729 	 * use syscalls:sys_enter_NAME, so that we reduce the kernel/userspace  in syscall__augmented_args()
2794 	 * syscall->args_size using each syscalls:sys_enter_NAME tracefs format file,  in trace__sys_enter()
2798 	 * here and avoid using augmented syscalls when the evsel is the raw_syscalls one.  in trace__sys_enter()
2800 	if (evsel != trace->syscalls.events.sys_enter)  in trace__sys_enter()
3264 	if (evsel == trace->syscalls.events.bpf_output) {  in trace__event_handler()
3503 		else if (is_valid_tracepoint("syscalls:sys_enter"))  in trace__record()
3504 			rec_argv[j++] = "syscalls:sys_enter,syscalls:sys_exit";  in trace__record()
3506 			pr_err("Neither raw_syscalls nor syscalls events exist.\n");  in trace__record()
3666 	trace->syscalls.events.sys_enter = sys_enter;  in trace__add_syscall_newtp()
3667 	trace->syscalls.events.sys_exit  = sys_exit;  in trace__add_syscall_newtp()
3691 	if (!evsel__append_tp_filter(trace->syscalls.events.sys_enter, filter)) {  in trace__set_ev_qualifier_tp_filter()
3692 		sys_exit = trace->syscalls.events.sys_exit;  in trace__set_ev_qualifier_tp_filter()
3733 		scnprintf(default_prog_name, sizeof(default_prog_name), "tp/syscalls/sys_%s_%s", type, sc->name);  in trace__find_syscall_bpf_prog()
3738 …scnprintf(default_prog_name, sizeof(default_prog_name), "tp/syscalls/sys_%s_%s", type, sc->fmt->al…  in trace__find_syscall_bpf_prog()
3753 	pr_debug("Couldn't find BPF prog \"%s\" to associate with syscalls:sys_%s_%s, not augmenting it\n",  in trace__find_syscall_bpf_prog()
3872 	 * We're only interested in syscalls that have a pointer:  in trace__find_usable_bpf_prog_entry()
3935 		 * more than what is common to the two syscalls.  in trace__find_usable_bpf_prog_entry()
3950 		 * For instance, we have "!syscalls:sys_enter_renameat" and that is  in trace__find_usable_bpf_prog_entry()
4011 	 * Now lets do a second pass looking for enabled syscalls without  in trace__init_syscalls_bpf_prog_array_maps()
4055 		 * Look at all the other syscalls for one that has a signature  in trace__init_syscalls_bpf_prog_array_maps()
4086 	if (trace->syscalls.events.sys_enter)  in trace__set_ev_qualifier_filter()
4479 		if (trace->syscalls.events.sys_exit) {  in trace__run()
4481 				 trace->syscalls.events.sys_exit->filter);  in trace__run()
4489 	 * syscalls opening a pathname and associating it with a descriptor or  in trace__run()
4718 	trace->syscalls.events.sys_enter = evsel;  in trace__replay()
4719 	/* older kernels have syscalls tp versus raw_syscalls */  in trace__replay()
4721 		evsel = evlist__find_tracepoint_by_name(session->evlist, "syscalls:sys_enter");  in trace__replay()
4731 	trace->syscalls.events.sys_exit = evsel;  in trace__replay()
4733 		evsel = evlist__find_tracepoint_by_name(session->evlist, "syscalls:sys_exit");  in trace__replay()
5103 		if (strcmp(tp_format->system, "syscalls")) {  in evlist__set_syscall_tp_fields()
5136  * XXX: Hackish, just splitting the combined -e+--event (syscalls
5167 		/* TODO: support for more than just perf binary machine type syscalls. */  in trace__parse_events_option()
5320 	if (trace->syscalls.table) {  in trace__exit()
5321 		for (size_t i = 0; i < trace->syscalls.table_size; i++)  in trace__exit()
5322 			syscall__delete(trace->syscalls.table[i]);  in trace__exit()
5323 		zfree(&trace->syscalls.table);  in trace__exit()
5375 	OPT_CALLBACK(0, "expr", &trace, "expr", "list of syscalls/events to trace",  in cmd_trace()
5402 		    "Show only syscalls that failed"),  in cmd_trace()
5406 		    "Show all syscalls and summary with statistics"),  in cmd_trace()
5414 	OPT_BOOLEAN(0, "syscalls", &trace.trace_syscalls, "Trace syscalls"),  in cmd_trace()
5557 		trace.syscalls.events.bpf_output = evlist__last(trace.evlist);  in cmd_trace()
5593 			perror("failed to set syscalls:* tracepoint fields");  in cmd_trace()
5602 	 * If we are augmenting syscalls, then combine what we put in the  in cmd_trace()
5604 	 * syscalls:sys_exit_FOO tracepoints, i.e. just like we do without BPF,  in cmd_trace()
5612 	if (trace.syscalls.events.bpf_output) {  in cmd_trace()
5621 			if (trace.syscalls.events.bpf_output->priv == NULL &&  in cmd_trace()
5622 			    strstr(evsel__name(evsel), "syscalls:sys_enter")) {  in cmd_trace()
5623 				struct evsel *augmented = trace.syscalls.events.bpf_output;  in cmd_trace()
5630 				 * that we get from syscalls:sys_enter tracefs format file.  in cmd_trace()
5634 				 * Now we do the same for the *syscalls:sys_enter event so that  in cmd_trace()
5645 			if (strstarts(evsel__name(evsel), "syscalls:sys_exit_")) {  in cmd_trace()
5666 				 * syscalls:sys_enter_NAME, so that we reduce  in cmd_trace()