tools/perf/examples/bpf/sys_enter_openat.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * Hook into 'openat' syscall entry tracepoint
   4  *
   5  * Test it with:
   6  *
   7  * perf trace -e tools/perf/examples/bpf/sys_enter_openat.c cat /etc/passwd > /dev/null
   8  *
   9  * It'll catch some openat syscalls related to the dynamic linked and
  10  * the last one should be the one for '/etc/passwd'.
  11  *
  12  * The syscall_enter_openat_args can be used to get the syscall fields
  13  * and use them for filtering calls, i.e. use in expressions for
  14  * the return value.
  15  */
  16
  17 #include <bpf/bpf.h>
  18
  19 struct syscall_enter_openat_args {
  20         unsigned long long unused;
  21         long               syscall_nr;
  22         long               dfd;
  23         char               *filename_ptr;
  24         long               flags;
  25         long               mode;
  26 };
  27
  28 int syscall_enter(openat)(struct syscall_enter_openat_args *args)
  29 {
  30         return 1;
  31 }
  32
  33 license(GPL);