tracehook_report_syscall_entry(9) suse man page | unix.com

TRACEHOOK_REPORT_SYS(9) 					 Kernel Internals					   TRACEHOOK_REPORT_SYS(9)

NAME
       tracehook_report_syscall_entry - task is about to attempt a system call

SYNOPSIS
       __must_check int tracehook_report_syscall_entry(struct pt_regs * regs);

ARGUMENTS
       regs
	   user register state of current task

DESCRIPTION
       This will be called if TIF_SYSCALL_TRACE has been set, when the current task has just entered the kernel for a system call. Full user
       register state is available here. Changing the values in regs can affect the system call number and arguments to be tried. It is safe to
       block here, preventing the system call from beginning.

       Returns zero normally, or nonzero if the calling arch code should abort the system call. That must prevent normal entry so no system call
       is made. If task ever returns to user mode after this, its register state is unspecified, but should be something harmless like an ENOSYS
       error return. It should preserve enough information so that syscall_rollback can work (see asm-generic/syscall.h).

       Called without locks, just after entering kernel mode.

Kernel Hackers Manual 2.6.					     July 2010						   TRACEHOOK_REPORT_SYS(9)