| 1 | #undef TRACE_SYSTEM |
| 2 | #define TRACE_SYSTEM syscalls_unknown |
| 3 | |
| 4 | #if !defined(_TRACE_SYSCALLS_UNKNOWN_H) || defined(TRACE_HEADER_MULTI_READ) |
| 5 | #define _TRACE_SYSCALLS_UNKNOWN_H |
| 6 | |
| 7 | #include <linux/tracepoint.h> |
| 8 | #include <linux/syscalls.h> |
| 9 | |
| 10 | #define UNKNOWN_SYSCALL_NRARGS 6 |
| 11 | |
| 12 | TRACE_EVENT(sys_unknown, |
| 13 | TP_PROTO(unsigned int id, unsigned long *args), |
| 14 | TP_ARGS(id, args), |
| 15 | TP_STRUCT__entry( |
| 16 | __field(unsigned int, id) |
| 17 | __array(unsigned long, args, UNKNOWN_SYSCALL_NRARGS) |
| 18 | ), |
| 19 | TP_fast_assign( |
| 20 | tp_assign(id, id) |
| 21 | tp_memcpy(args, args, UNKNOWN_SYSCALL_NRARGS * sizeof(*args)) |
| 22 | ), |
| 23 | TP_printk() |
| 24 | ) |
| 25 | /* |
| 26 | * This is going to hook on sys_exit in the kernel. |
| 27 | * We change the name so we don't clash with the sys_exit syscall entry |
| 28 | * event. |
| 29 | */ |
| 30 | TRACE_EVENT(exit_syscall, |
| 31 | TP_PROTO(struct pt_regs *regs, long ret), |
| 32 | TP_ARGS(regs, ret), |
| 33 | TP_STRUCT__entry( |
| 34 | __field(long, ret) |
| 35 | ), |
| 36 | TP_fast_assign( |
| 37 | tp_assign(ret, ret) |
| 38 | ), |
| 39 | TP_printk() |
| 40 | ) |
| 41 | |
| 42 | #endif /* _TRACE_SYSCALLS_UNKNOWN_H */ |
| 43 | |
| 44 | /* This part must be outside protection */ |
| 45 | #include "../../../probes/define_trace.h" |