Function do_open 

fn do_open(
    r: &Req<'_>,
    dirfd: i32,
    path: &[u8],
    path_addr: u64,
    flags: i64,
    mode: i64,
) -> Result<Outcome, i32>

open/creat/openat: open in the supervisor and inject the descriptor.

path_addr is where the path string lives in the tracee, for the in-place rewrite an O_PATH open needs without ptrace.