Lines Matching defs:augmented
132 *augmented;
1194 * args_size: sum of the sizes of the syscall arguments, anything after that is augmented stuff: pathname for openat, etc.
1474 struct augmented_arg *augmented_arg = arg->augmented.args;
1477 * So that the next arg with a payload can consume its augmented arg, i.e. for rename* syscalls
1482 arg->augmented.args = ((void *)arg->augmented.args) + consumed;
1483 arg->augmented.size -= consumed;
1493 if (arg->augmented.args)
1996 .augmented = {
2312 * this breaks syscall__augmented_args() check for augmented args, as we calculate
2316 * thinking that the extra 2 u64 args are the augmented filename, so just check
2317 * here and avoid using augmented syscalls when the evsel is the raw_syscalls one.
2691 .augmented = {
2789 if (evsel == trace->syscalls.events.augmented) {
3555 evlist__remove(trace->evlist, trace->syscalls.events.augmented);
3556 evsel__delete(trace->syscalls.events.augmented);
3557 trace->syscalls.events.augmented = NULL;
3616 if (evsel == trace->syscalls.events.augmented ||
4914 trace.syscalls.events.augmented = evsel;
4918 pr_err("ERROR: raw_syscalls:sys_enter not found in the augmented BPF object\n");
5037 if (trace.syscalls.events.augmented) {
5046 if (trace.syscalls.events.augmented->priv == NULL &&
5048 struct evsel *augmented = trace.syscalls.events.augmented;
5049 if (evsel__init_augmented_syscall_tp(augmented, evsel) ||
5050 evsel__init_augmented_syscall_tp_args(augmented))
5057 augmented->handler = trace__sys_enter;