* is_exit: is this "exit" or "exit_group"?
* is_open: is this "open" or "openat"? To associate the fd returned in sys_exit with the pathname in sys_enter.
* args_size: sum of the sizes of the syscall arguments, anything after that is augmented stuff: pathname for openat, etc.
+ * nonexistent: Just a hole in the syscall table, syscall id not allocated
*/
struct syscall {
struct tep_event *tp_format;
} bpf_prog;
bool is_exit;
bool is_open;
+ bool nonexistent;
struct tep_format_field *args;
const char *name;
struct syscall_fmt *fmt;
struct syscall *sc;
const char *name = syscalltbl__name(trace->sctbl, id);
- if (name == NULL)
- return -EINVAL;
-
if (id > trace->syscalls.max) {
struct syscall *nsyscalls = realloc(trace->syscalls.table, (id + 1) * sizeof(*sc));
}
sc = trace->syscalls.table + id;
- sc->name = name;
+ if (sc->nonexistent)
+ return 0;
+ if (name == NULL) {
+ sc->nonexistent = true;
+ return 0;
+ }
+
+ sc->name = name;
sc->fmt = syscall_fmt__find(sc->name);
snprintf(tp_name, sizeof(tp_name), "sys_enter_%s", sc->name);
return NULL;
}
+ err = -EINVAL;
+
if ((id > trace->syscalls.max || trace->syscalls.table[id].name == NULL) &&
(err = trace__read_syscall_info(trace, id)) != 0)
goto out_cant_read;
- err = -EINVAL;
- if ((id > trace->syscalls.max || trace->syscalls.table[id].name == NULL))
+ if (id > trace->syscalls.max)
goto out_cant_read;
+ if (trace->syscalls.table[id].name == NULL) {
+ if (trace->syscalls.table[id].nonexistent)
+ return NULL;
+ goto out_cant_read;
+ }
+
return &trace->syscalls.table[id];
out_cant_read: