Lines Matching refs:sys_enter
118 const char *sys_enter,
134 struct evsel *sys_enter,
1211 * is_open: is this "open" or "openat"? To associate the fd returned in sys_exit with the pathname in sys_enter.
1220 struct bpf_program *sys_enter,
1554 * first having received a sys_enter ("poll" issued before tracing session
1555 * starts, lost sys_enter exit due to ring buffer overflow).
1763 * /sys/kernel/tracing/events/syscalls/sys_enter*
2298 * For now with BPF raw_augmented we hook into raw_syscalls:sys_enter
2302 * sc->args_size but always after the full raw_syscalls:sys_enter payload,
2363 * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible
2368 * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly
2372 if (evsel != trace->syscalls.events.sys_enter)
2597 * sys_enter + sys_exit and other tracepoint events.
3077 if (is_valid_tracepoint("raw_syscalls:sys_enter"))
3078 rec_argv[j++] = "raw_syscalls:sys_enter,raw_syscalls:sys_exit";
3079 else if (is_valid_tracepoint("syscalls:sys_enter"))
3080 rec_argv[j++] = "syscalls:sys_enter,syscalls:sys_exit";
3210 struct evsel *sys_enter, *sys_exit;
3212 sys_enter = perf_evsel__raw_syscall_newtp("sys_enter", trace__sys_enter);
3213 if (sys_enter == NULL)
3216 if (perf_evsel__init_sc_tp_ptr_field(sys_enter, args))
3226 evsel__config_callchain(sys_enter, &trace->opts, &callchain_param);
3229 evlist__add(evlist, sys_enter);
3241 trace->syscalls.events.sys_enter = sys_enter;
3251 evsel__delete_priv(sys_enter);
3266 if (!evsel__append_tp_filter(trace->syscalls.events.sys_enter, filter)) {
3339 sc->bpf_prog.sys_enter = trace__find_syscall_bpf_prog(trace, sc, sc->fmt ? sc->fmt->bpf_prog_name.sys_enter : NULL, "enter");
3346 return sc ? bpf_program__fd(sc->bpf_prog.sys_enter) : bpf_program__fd(trace->skel->progs.syscall_unaugmented);
3377 pair->bpf_prog.sys_enter == trace->skel->progs.syscall_unaugmented)
3431 pair_prog = pair->bpf_prog.sys_enter;
3433 * If the pair isn't enabled, then its bpf_prog.sys_enter will not
3442 pair_prog = trace__find_syscall_bpf_prog(trace, pair, pair->fmt ? pair->fmt->bpf_prog_name.sys_enter : NULL, "enter");
3447 pr_debug("Reusing \"%s\" BPF sys_enter augmenter for \"%s\"\n", pair->name, sc->name);
3514 if (sc == NULL || sc->bpf_prog.sys_enter == NULL)
3518 * For now we're just reusing the sys_enter prog, and if it
3521 if (sc->bpf_prog.sys_enter != trace->skel->progs.syscall_unaugmented)
3532 sc->bpf_prog.sys_enter = pair_prog;
3535 * Update the BPF_MAP_TYPE_PROG_SHARED for raw_syscalls:sys_enter
3538 prog_fd = bpf_program__fd(sc->bpf_prog.sys_enter);
3550 if (trace->syscalls.events.sys_enter)
3932 if (trace->skel && trace->skel->progs.sys_enter)
4161 evsel = evlist__find_tracepoint_by_name(session->evlist, "raw_syscalls:sys_enter");
4162 trace->syscalls.events.sys_enter = evsel;
4165 evsel = evlist__find_tracepoint_by_name(session->evlist, "syscalls:sys_enter");
4170 pr_err("Error during initialize raw_syscalls:sys_enter event\n");
4874 * Disable attaching the BPF programs except for sys_enter and
4880 if (prog != trace.skel->progs.sys_enter && prog != trace.skel->progs.sys_exit)
4950 * combining raw_syscalls:sys_enter with raw_syscalls:sys_exit.
4952 * We'll switch to look at two BPF maps, one for sys_enter and the
4967 strstr(evsel__name(evsel), "syscalls:sys_enter")) {
4975 * that we get from syscalls:sys_enter tracefs format file.
4979 * Now we do the same for the *syscalls:sys_enter event so that
4998 * raw_syscalls:sys_enter and there we get all
5003 * always after the full raw_syscalls:sys_enter