1 #if !defined(_TRACE_SYSCALLS_UNKNOWN_H) || defined(TRACE_HEADER_MULTI_READ)
2 #define _TRACE_SYSCALLS_UNKNOWN_H
4 #include <linux/tracepoint.h>
5 #include <linux/syscalls.h>
7 #define UNKNOWN_SYSCALL_NRARGS 6
9 TRACE_EVENT(sys_unknown,
10 TP_PROTO(unsigned int id, unsigned long *args),
13 __field(unsigned int, id)
14 __array(unsigned long, args, UNKNOWN_SYSCALL_NRARGS)
18 tp_memcpy(args, args, UNKNOWN_SYSCALL_NRARGS * sizeof(*args))
22 TRACE_EVENT(compat_sys_unknown,
23 TP_PROTO(unsigned int id, unsigned long *args),
26 __field(unsigned int, id)
27 __array(unsigned long, args, UNKNOWN_SYSCALL_NRARGS)
31 tp_memcpy(args, args, UNKNOWN_SYSCALL_NRARGS * sizeof(*args))
36 * This is going to hook on sys_exit in the kernel.
37 * We change the name so we don't clash with the sys_exit syscall entry
40 TRACE_EVENT(exit_syscall,
41 TP_PROTO(struct pt_regs *regs, long ret),
52 #endif /* _TRACE_SYSCALLS_UNKNOWN_H */
54 /* This part must be outside protection */
55 #include "../../../probes/define_trace.h"