STRUCT SYSCALL(9)

💅 NAME 💅

struct syscall — okay so this is the struct that holds everything perf's trace tooling needs to know about one single syscall, and the manpage straight-up left the description blank so we're gonna vibe with the fields themselves ✨

🦋 SYNOPSIS 🦋

struct syscall {
    int e_machine;
    int id;
    struct tep_event    *tp_format;
    int nr_args;
    int args_size;
    struct {
      struct bpf_program *sys_enter, *sys_exit;
    } bpf_prog;
    bool is_exit;
    bool is_open;
    bool nonexistent;
    bool use_btf;
    struct tep_format_field *args;
    const char          *name;
    const struct syscall_fmt  *fmt;
    struct syscall_arg_fmt *arg_fmt;
 };

Like, look at her. The anonymous nested struct for bpf_prog holding *sys_enter and *sys_exit? Main character energy fr fr 🔥

🎀 Members 🎀

Heads up bestie — the page only spells out some of these fields, so I'm not gonna make up lore for the rest. Here's exactly what we got:

• e_machine — the ELF machine that's associated with the entry. iykyk 🧚
• id — the id value that comes from the tracepoint; it's the system call number.
• args_size — the sum of the sizes of the syscall arguments. Anything after that is augmented stuff, like the pathname for openat, etc. 💖
• is_exit — is this "exit" or "exit_group"? 👀
• is_open — is this "open" or "openat"? It exists so you can associate the fd returned in sys_exit with the pathname in sys_enter. iconic.
• nonexistent — name lookup failed. It's literally just a hole in the syscall table, syscall id not allocated. 💀

Quick vibe check: tp_format, nr_args, bpf_prog, use_btf, args, name, fmt and arg_fmt are all chillin' in the synopsis, but the manpage doesn't document them here — so no invented facts from me, periodt. 🙈

🌈 SEE ALSO 🌈

• Kernel file ./tools/perf/builtin-trace.c
• trace__fprintf_cpu(9)

That's the whole page, bestie — slay 🫶 This lil beauty comes from ./tools/perf and is dated October 2026, so go forth and trace those syscalls 💜✨