Lines Matching refs:sys_enter
109 const char *sys_enter,
126 struct bpf_map *sys_enter,
130 struct evsel *sys_enter,
1193 * is_open: is this "open" or "openat"? To associate the fd returned in sys_exit with the pathname in sys_enter.
1202 struct bpf_program *sys_enter,
1518 * first having received a sys_enter ("poll" issued before tracing session
1519 * starts, lost sys_enter exit due to ring buffer overflow).
1717 * /sys/kernel/tracing/events/syscalls/sys_enter*
2253 * For now with BPF raw_augmented we hook into raw_syscalls:sys_enter
2257 * sc->args_size but always after the full raw_syscalls:sys_enter payload,
2310 * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible
2315 * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly
2319 if (evsel != trace->syscalls.events.sys_enter)
2540 * sys_enter + sys_exit and other tracepoint events.
3016 if (is_valid_tracepoint("raw_syscalls:sys_enter"))
3017 rec_argv[j++] = "raw_syscalls:sys_enter,raw_syscalls:sys_exit";
3018 else if (is_valid_tracepoint("syscalls:sys_enter"))
3019 rec_argv[j++] = "syscalls:sys_enter,syscalls:sys_exit";
3143 struct evsel *sys_enter, *sys_exit;
3145 sys_enter = perf_evsel__raw_syscall_newtp("sys_enter", trace__sys_enter);
3146 if (sys_enter == NULL)
3149 if (perf_evsel__init_sc_tp_ptr_field(sys_enter, args))
3159 evsel__config_callchain(sys_enter, &trace->opts, &callchain_param);
3162 evlist__add(evlist, sys_enter);
3174 trace->syscalls.events.sys_enter = sys_enter;
3184 evsel__delete_priv(sys_enter);
3199 if (!evsel__append_tp_filter(trace->syscalls.events.sys_enter, filter)) {
3229 trace->syscalls.prog_array.sys_enter = trace__find_bpf_map_by_name(trace, "syscalls_sys_enter");
3281 sc->bpf_prog.sys_enter = trace__find_syscall_bpf_prog(trace, sc, sc->fmt ? sc->fmt->bpf_prog_name.sys_enter : NULL, "enter");
3288 return sc ? bpf_program__fd(sc->bpf_prog.sys_enter) : bpf_program__fd(trace->syscalls.unaugmented_prog);
3393 pair->bpf_prog.sys_enter == trace->syscalls.unaugmented_prog)
3434 pair_prog = pair->bpf_prog.sys_enter;
3436 * If the pair isn't enabled, then its bpf_prog.sys_enter will not
3445 pair_prog = trace__find_syscall_bpf_prog(trace, pair, pair->fmt ? pair->fmt->bpf_prog_name.sys_enter : NULL, "enter");
3450 pr_debug("Reusing \"%s\" BPF sys_enter augmenter for \"%s\"\n", pair->name, sc->name);
3461 int map_enter_fd = bpf_map__fd(trace->syscalls.prog_array.sys_enter),
3517 if (sc == NULL || sc->bpf_prog.sys_enter == NULL)
3521 * For now we're just reusing the sys_enter prog, and if it
3524 if (sc->bpf_prog.sys_enter != trace->syscalls.unaugmented_prog)
3535 sc->bpf_prog.sys_enter = pair_prog;
3538 * Update the BPF_MAP_TYPE_PROG_SHARED for raw_syscalls:sys_enter
3541 prog_fd = bpf_program__fd(sc->bpf_prog.sys_enter);
3630 if (trace->syscalls.events.sys_enter)
4007 if (trace->syscalls.prog_array.sys_enter)
4239 "raw_syscalls:sys_enter");
4243 "syscalls:sys_enter");
4248 pr_err("Error during initialize raw_syscalls:sys_enter event\n");
4916 evsel = perf_evlist__find_tracepoint_by_name(trace.evlist, "raw_syscalls:sys_enter");
4918 pr_err("ERROR: raw_syscalls:sys_enter not found in the augmented BPF object\n");
4923 pr_err("ERROR: raw_syscalls:sys_enter not associated to a BPF object\n");
5030 * combining raw_syscalls:sys_enter with raw_syscalls:sys_exit.
5032 * We'll switch to look at two BPF maps, one for sys_enter and the
5047 strstr(evsel__name(evsel), "syscalls:sys_enter")) {
5055 * that we get from syscalls:sys_enter tracefs format file.
5059 * Now we do the same for the *syscalls:sys_enter event so that
5078 * raw_syscalls:sys_enter and there we get all
5083 * always after the full raw_syscalls:sys_enter