FM / bpf

/usr/share/systemtap/tapset/bpf

Name	Size	Mode	Actions
aux_syscalls.stp	909	0644	edit dl rm
compatdefs.stp	203	0644	edit dl rm
context.stp	6039	0644	edit dl rm
conversions.stp	4727	0644	edit dl rm
exit.stp	2583	0644	edit dl rm
logging.stp	1463	0644	edit dl rm
syscalls.stpm	213	0644	edit dl rm
syscall_any.stp	1569	0644	edit dl rm
syscall_num_arm.stp	38588	0644	edit dl rm
syscall_num_arm64.stp	86596	0644	edit dl rm
syscall_num_mips.stp	110534	0644	edit dl rm
syscall_num_powerpc.stp	71086	0644	edit dl rm
syscall_num_riscv.stp	48422	0644	edit dl rm
syscall_num_s390.stp	68068	0644	edit dl rm
syscall_num_x86_64.stp	65658	0644	edit dl rm
syscall_table.stp	1491	0644	edit dl rm
target.stp	1403	0644	edit dl rm
task.stp	583	0644	edit dl rm
time.stp	539	0644	edit dl rm
timestamp_gtod.stp	2178	0644	edit dl rm
uconversions.stp	8014	0644	edit dl rm

Edit: /usr/share/systemtap/tapset/bpf/syscall_any.stp (1569B)

/**
 * equivalent to linux module syscall_any.return - Record exit from a syscall
 *
 * @syscall_nr: number of the syscall
 * @name: name of the syscall
 * @retval: return value of the syscall
 *
 * Context: The process performing the syscall
 *
 * The syscall_any.return probe point is designed to be a low overhead
 * that monitors all the syscalls returns via a kernel tracepoint.
 * Because of the breadth of syscalls it monitors it provides
 * no information about the syscall arguments, argstr string
 * representation of those arguments, or a string interpretation
 * of the return value (retval).
 *
 * This requires kernel 3.5+ and newer which have the
 * kernel.trace("sys_exit") probe point.
 */
probe syscall_any.return = kernel.trace("sys_exit")
{
	syscall_nr = _stp_bpf_syscall_get_nr($regs)
	name = syscall_name(_stp_bpf_syscall_get_nr($regs))
	retval = $ret
}

/** * equivalent to linux module syscall_any - Record entry into a syscall * * @syscall_nr: number of the syscall * @name: name of the syscall * * Context: The process performing the syscall * * The syscall_any probe point is designed to be a low overhead * that monitors all the syscalls entered via a kernel tracepoint. * Because of the breadth of syscalls it monitors it provides * no information about the syscall arguments or argstr string * representation of those arguments. * * This requires kernel 3.5+ and newer which have the * kernel.trace("sys_enter") probe point. */ probe syscall_any = kernel.trace("sys_enter") { syscall_nr = $id name = syscall_name($id) } /** * equivalent to linux module syscall_any.return - Record exit from a syscall * * @syscall_nr: number of the syscall * @name: name of the syscall * @retval: return value of the syscall * * Context: The process performing the syscall * * The syscall_any.return probe point is designed to be a low overhead * that monitors all the syscalls returns via a kernel tracepoint. * Because of the breadth of syscalls it monitors it provides * no information about the syscall arguments, argstr string * representation of those arguments, or a string interpretation * of the return value (retval). * * This requires kernel 3.5+ and newer which have the * kernel.trace("sys_exit") probe point. */ probe syscall_any.return = kernel.trace("sys_exit") { syscall_nr = _stp_bpf_syscall_get_nr($regs) name = syscall_name(_stp_bpf_syscall_get_nr($regs)) retval = $ret }