# accept _____________________________________________________
# long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
# int __user *upeer_addrlen)
-probe syscall.accept = kernel.function("sys_accept") ? {
+probe syscall.accept = kernel.function("SyS_accept") !,
+ kernel.function("sys_accept") ? {
name = "accept"
sockfd = $fd
addr_uaddr = $upeer_sockaddr
addrlen_uaddr = $upeer_addrlen
argstr = sprintf("%d, %p, %p", $fd, $upeer_sockaddr, $upeer_addrlen)
}
-probe syscall.accept.return = kernel.function("sys_accept").return ? {
+probe syscall.accept.return = kernel.function("SyS_accept").return !,
+ kernel.function("sys_accept").return ? {
name = "accept"
retstr = returnstr(1)
}
# access _____________________________________________________
# long sys_access(const char __user * filename, int mode)
-probe syscall.access = kernel.function("sys_access") {
+probe syscall.access = kernel.function("SyS_access") !,
+ kernel.function("sys_access") {
name = "access"
pathname = user_string($filename)
mode = $mode
mode_str = _access_mode_str($mode)
argstr = sprintf("%s, %s", user_string_quoted($filename), mode_str)
}
-probe syscall.access.return = kernel.function("sys_access").return {
+probe syscall.access.return = kernel.function("SyS_access").return !,
+ kernel.function("sys_access").return {
name = "access"
retstr = returnstr(1)
}
# size_t plen,
# key_serial_t ringid)
#
-probe syscall.add_key = kernel.function("sys_add_key") ? {
+probe syscall.add_key = kernel.function("SyS_add_key") !,
+ kernel.function("sys_add_key") ? {
name = "add_key"
type_uaddr = $_type
description_auddr = $_description
text_strn(user_string($_payload),syscall_string_trunc,1),
$plen, $ringid)
}
-probe syscall.add_key.return = kernel.function("sys_add_key").return ? {
+probe syscall.add_key.return = kernel.function("SyS_add_key").return !,
+ kernel.function("sys_add_key").return ? {
name = "add_key"
retstr = returnstr(1)
}
# adjtimex ___________________________________________________
# long sys_adjtimex(struct timex __user *txc_p)
-probe syscall.adjtimex = kernel.function("sys_adjtimex") {
+probe syscall.adjtimex = kernel.function("SyS_adjtimex") !,
+ kernel.function("sys_adjtimex") {
name = "adjtimex"
/*
*/
argstr = sprintf("%p", $txc_p)
}
-probe syscall.adjtimex.return = kernel.function("sys_adjtimex").return {
+probe syscall.adjtimex.return = kernel.function("SyS_adjtimex").return !,
+ kernel.function("sys_adjtimex").return {
name = "adjtimex"
retstr = _adjtimex_return_str($return)
}
# long sys32_alarm(unsigned int seconds)
#
probe syscall.alarm =
- kernel.function("sys_alarm") ?,
- kernel.function("sys32_alarm") ?
+ kernel.function("sys32_alarm") ?,
+ kernel.function("SyS_alarm") !,
+ kernel.function("sys_alarm") ?
{
name = "alarm"
seconds = $seconds
argstr = sprint($seconds)
}
probe syscall.alarm.return =
- kernel.function("sys_alarm").return ?,
- kernel.function("sys32_alarm").return ?
+ kernel.function("sys32_alarm").return ?,
+ kernel.function("SyS_alarm").return !,
+ kernel.function("sys_alarm").return ?
{
name = "alarm"
retstr = returnstr(1)
# bdflush ____________________________________________________
# long sys_bdflush(int func,long data)
-probe syscall.bdflush = kernel.function("sys_bdflush") ? {
+probe syscall.bdflush = kernel.function("SyS_bdflush") !,
+ kernel.function("sys_bdflush") ? {
name = "bdflush"
func = $func
data = $data
data_str = sprintf("%d", $data)
argstr = sprintf("%d, %s",func, data_str)
}
-probe syscall.bdflush.return = kernel.function("sys_bdflush").return ? {
+probe syscall.bdflush.return = kernel.function("SyS_bdflush").return !,
+ kernel.function("sys_bdflush").return ? {
name = "bdflush"
retstr = returnstr(1)
}
# bind _______________________________________________________
# long sys_bind(int fd, struct sockaddr __user *umyaddr, int addrlen)
-probe syscall.bind = kernel.function("sys_bind") ? {
+probe syscall.bind = kernel.function("SyS_bind") !,
+ kernel.function("sys_bind") ? {
name = "bind"
sockfd = $fd
my_addr_uaddr = $umyaddr
addrlen = $addrlen
argstr = sprintf("%d, %s, %d", $fd, _struct_sockaddr_u($umyaddr,$addrlen),$addrlen)
}
-probe syscall.bind.return = kernel.function("sys_bind").return ? {
+probe syscall.bind.return = kernel.function("SyS_bind").return !,
+ kernel.function("sys_bind").return ? {
name = "bind"
retstr = returnstr(1)
}
# brk ________________________________________________________
# unsigned long sys_brk(unsigned long brk)
probe syscall.brk =
- kernel.function("sys_brk"),
- kernel.function("ia64_brk") ?
+ kernel.function("ia64_brk") ?,
+ kernel.function("SyS_brk") !,
+ kernel.function("sys_brk")
{
name = "brk"
brk = $brk
argstr = sprintf("%p", brk)
}
probe syscall.brk.return =
- kernel.function("sys_brk").return,
- kernel.function("ia64_brk").return ?
+ kernel.function("ia64_brk").return ?,
+ kernel.function("SyS_brk").return !,
+ kernel.function("sys_brk").return
{
name = "brk"
retstr = returnstr(1)
* functions to export.
*/
# long sys_capget(cap_user_header_t header, cap_user_data_t dataptr)
-probe syscall.capget = kernel.function("sys_capget") {
+probe syscall.capget = kernel.function("SyS_capget") !,
+ kernel.function("sys_capget") {
name = "capget"
header_uaddr = $header
data_uaddr = $dataptr
argstr = sprintf("%p, %p", $header, $dataptr)
}
-probe syscall.capget.return = kernel.function("sys_capget").return {
+probe syscall.capget.return = kernel.function("SyS_capget").return !,
+ kernel.function("sys_capget").return {
name = "capget"
retstr = returnstr(1)
}
* functions to export.
*/
# long sys_capset(cap_user_header_t header, const cap_user_data_t data)
-probe syscall.capset = kernel.function("sys_capset") {
+probe syscall.capset = kernel.function("SyS_capset") !,
+ kernel.function("sys_capset") {
name = "capset"
header_uaddr = $header
data_uaddr = $data
argstr = sprintf("%p, %p", $header, $data)
}
-probe syscall.capset.return = kernel.function("sys_capset").return {
+probe syscall.capset.return = kernel.function("SyS_capset").return !,
+ kernel.function("sys_capset").return {
name = "capset"
retstr = returnstr(1)
}
# chdir ______________________________________________________
# long sys_chdir(const char __user * filename)
-probe syscall.chdir = kernel.function("sys_chdir") {
+probe syscall.chdir = kernel.function("SyS_chdir") !,
+ kernel.function("sys_chdir") {
name = "chdir"
path = user_string($filename)
argstr = user_string_quoted($filename)
}
-probe syscall.chdir.return = kernel.function("sys_chdir").return {
+probe syscall.chdir.return = kernel.function("SyS_chdir").return !,
+ kernel.function("sys_chdir").return {
name = "chdir"
retstr = returnstr(1)
}
# chmod ______________________________________________________
# long sys_chmod(const char __user * filename, mode_t mode)
-probe syscall.chmod = kernel.function("sys_chmod") {
+probe syscall.chmod = kernel.function("SyS_chmod") !,
+ kernel.function("sys_chmod") {
name = "chmod"
path = user_string($filename)
mode = $mode
argstr = sprintf("%s, %#o", user_string_quoted($filename), mode)
}
-probe syscall.chmod.return = kernel.function("sys_chmod").return {
+probe syscall.chmod.return = kernel.function("SyS_chmod").return !,
+ kernel.function("sys_chmod").return {
name = "chmod"
retstr = returnstr(1)
}
# chown ______________________________________________________
# long sys_chown(const char __user * filename, uid_t user, gid_t group)
-probe syscall.chown = kernel.function("sys_chown") {
+probe syscall.chown = kernel.function("SyS_chown") !,
+ kernel.function("sys_chown") {
name = "chown"
path = user_string($filename)
owner = __int32($user)
group = __int32($group)
argstr = sprintf("%s, %d, %d",user_string_quoted($filename), owner, group)
}
-probe syscall.chown.return = kernel.function("sys_chown").return {
+probe syscall.chown.return = kernel.function("SyS_chown").return !,
+ kernel.function("sys_chown").return {
name = "chown"
retstr = returnstr(1)
}
# chroot _____________________________________________________
# long sys_chroot(const char __user * filename)
-probe syscall.chroot = kernel.function("sys_chroot") {
+probe syscall.chroot = kernel.function("SyS_chroot") !,
+ kernel.function("sys_chroot") {
name = "chroot"
path = user_string($filename)
argstr = user_string_quoted($filename)
}
-probe syscall.chroot.return = kernel.function("sys_chroot").return {
+probe syscall.chroot.return = kernel.function("SyS_chroot").return !,
+ kernel.function("sys_chroot").return {
name = "chroot"
retstr = returnstr(1)
}
# long compat_clock_getres(clockid_t which_clock, struct compat_timespec __user *tp)
#
probe syscall.clock_getres =
- kernel.function("sys_clock_getres"),
- kernel.function("compat_clock_getres") ?
+ kernel.function("compat_clock_getres") ?,
+ kernel.function("SyS_clock_getres") !,
+ kernel.function("sys_clock_getres")
{
name = "clock_getres"
clk_id = $which_clock
argstr = sprintf("%s, %p", _get_wc_str($which_clock), $tp)
}
probe syscall.clock_getres.return =
- kernel.function("sys_clock_getres").return,
- kernel.function("compat_clock_getres").return ?
+ kernel.function("compat_clock_getres").return ?,
+ kernel.function("SyS_clock_getres").return !,
+ kernel.function("sys_clock_getres").return
{
name = "clock_getres"
retstr = returnstr(1)
# long sys_clock_gettime(clockid_t which_clock, struct timespec __user *tp)
#
probe syscall.clock_gettime =
+ kernel.function("SyS_clock_gettime") !,
kernel.function("sys_clock_gettime")
{
name = "clock_gettime"
clk_id_str = _get_wc_str($which_clock)
argstr = sprintf("%s, %p", _get_wc_str($which_clock), $tp)
}
-probe syscall.clock_gettime.return = kernel.function("sys_clock_gettime").return
+probe syscall.clock_gettime.return =
+ kernel.function("SyS_clock_gettime").return !,
+ kernel.function("sys_clock_gettime").return
{
name = "clock_gettime"
retstr = returnstr(1)
# const struct timespec __user *rqtp,
# struct timespec __user *rmtp)
#
-probe syscall.clock_nanosleep = kernel.function("sys_clock_nanosleep") {
+probe syscall.clock_nanosleep = kernel.function("SyS_clock_nanosleep") !,
+ kernel.function("sys_clock_nanosleep") {
name = "clock_nanosleep"
if ($flags == 1)
flag_str = "TIMER_ABSTIME"
argstr = sprintf("%s, %s, %s, %p", _get_wc_str($which_clock), flag_str,
_struct_timespec_u($rqtp,1), $rmtp)
}
-probe syscall.clock_nanosleep.return = kernel.function("sys_clock_nanosleep").return {
+probe syscall.clock_nanosleep.return =
+ kernel.function("SyS_clock_nanosleep").return !,
+ kernel.function("sys_clock_nanosleep").return {
name = "clock_nanosleep"
retstr = returnstr(1)
}
# long sys_clock_settime(clockid_t which_clock,
# const struct timespec __user *tp)
#
-probe syscall.clock_settime = kernel.function("sys_clock_settime") {
+probe syscall.clock_settime = kernel.function("SyS_clock_settime") !,
+ kernel.function("sys_clock_settime") {
name = "clock_settime"
clk_id = $which_clock
clk_id_str = _get_wc_str($which_clock)
tp_uaddr = $tp
argstr = sprintf("%s, %s", clk_id_str, _struct_timespec_u($tp,1))
}
-probe syscall.clock_settime.return = kernel.function("sys_clock_settime").return {
+probe syscall.clock_settime.return = kernel.function("SyS_clock_settime").return !,
+ kernel.function("sys_clock_settime").return {
name = "clock_settime"
retstr = returnstr(1)
}
# close ______________________________________________________
# long sys_close(unsigned int fd)
-probe syscall.close = kernel.function("sys_close") {
+probe syscall.close = kernel.function("SyS_close") !,
+ kernel.function("sys_close") {
name = "close"
fd = $fd
argstr = sprint(fd)
}
-probe syscall.close.return = kernel.function("sys_close").return {
+probe syscall.close.return = kernel.function("SyS_close").return !,
+ kernel.function("sys_close").return {
name = "close"
retstr = returnstr(1)
}
# connect ____________________________________________________
# long sys_connect(int fd, struct sockaddr __user *uservaddr, int addrlen)
-probe syscall.connect = kernel.function("sys_connect") ? {
+probe syscall.connect = kernel.function("SyS_connect") !,
+ kernel.function("sys_connect") ? {
name = "connect"
sockfd = $fd
serv_addr_uaddr = $uservaddr
addrlen = $addrlen
argstr = sprintf("%d, %s, %d", $fd, _struct_sockaddr_u($uservaddr,$addrlen),$addrlen)
}
-probe syscall.connect.return = kernel.function("sys_connect").return ? {
+probe syscall.connect.return = kernel.function("SyS_connect").return !,
+ kernel.function("sys_connect").return ? {
name = "connect"
retstr = returnstr(1)
}
# creat
# long sys_creat(const char __user * pathname, int mode)
-probe syscall.creat = kernel.function("sys_creat") ?
+probe syscall.creat = kernel.function("SyS_creat") !,
+ kernel.function("sys_creat") ?
{
name = "creat"
mode = $mode
pathname = user_string($pathname)
argstr = sprintf("%s, %#o", user_string_quoted($pathname), $mode)
}
-probe syscall.creat.return = kernel.function("sys_creat").return ?
+probe syscall.creat.return = kernel.function("SyS_creat").return !,
+ kernel.function("sys_creat").return ?
{
name = "creat"
retstr = returnstr(1)
# delete_module ______________________________________________
# long sys_delete_module(const char __user *name_user, unsigned int flags)
-probe syscall.delete_module = kernel.function("sys_delete_module") ? {
+probe syscall.delete_module = kernel.function("SyS_delete_module") !,
+ kernel.function("sys_delete_module") ? {
name = "delete_module"
name_user = user_string($name_user)
flags = $flags
argstr = sprintf("%s, %s", user_string_quoted($name_user), _module_flags_str($flags))
}
-probe syscall.delete_module.return = kernel.function("sys_delete_module").return ? {
+probe syscall.delete_module.return = kernel.function("SyS_delete_module").return !,
+ kernel.function("sys_delete_module").return ? {
name = "delete_module"
retstr = returnstr(1)
}
# dup ________________________________________________________
# long sys_dup(unsigned int fildes)
-probe syscall.dup = kernel.function("sys_dup") {
+probe syscall.dup = kernel.function("SyS_dup") !,
+ kernel.function("sys_dup") {
name = "dup"
oldfd = $fildes
argstr = sprint($fildes)
}
-probe syscall.dup.return = kernel.function("sys_dup").return {
+probe syscall.dup.return = kernel.function("SyS_dup").return !,
+ kernel.function("sys_dup").return {
name = "dup"
retstr = returnstr(1)
}
# dup2 _______________________________________________________
# long sys_dup2(unsigned int oldfd, unsigned int newfd)
-probe syscall.dup2 = kernel.function("sys_dup2") {
+probe syscall.dup2 = kernel.function("SyS_dup2") !,
+ kernel.function("sys_dup2") {
name = "dup2"
oldfd = $oldfd
newfd = $newfd
argstr = sprintf("%d, %d", $oldfd, $newfd)
}
-probe syscall.dup2.return = kernel.function("sys_dup2").return {
+probe syscall.dup2.return = kernel.function("SyS_dup2").return !,
+ kernel.function("sys_dup2").return {
name = "dup2"
retstr = returnstr(1)
}
# epoll_create _______________________________________________
# long sys_epoll_create(int size)
-probe syscall.epoll_create = kernel.function("sys_epoll_create") ? {
+probe syscall.epoll_create = kernel.function("SyS_epoll_create") !,
+ kernel.function("sys_epoll_create") ? {
name = "epoll_create"
size = $size
argstr = sprint($size)
}
-probe syscall.epoll_create.return = kernel.function("sys_epoll_create").return ? {
+probe syscall.epoll_create.return =
+ kernel.function("SyS_epoll_create").return !,
+ kernel.function("sys_epoll_create").return ? {
name = "epoll_create"
retstr = returnstr(1)
}
# struct compat_epoll_event __user *event)
#
probe syscall.epoll_ctl =
- kernel.function("sys_epoll_ctl") ?,
- kernel.function("compat_sys_epoll_ctl") ?
+ kernel.function("compat_sys_epoll_ctl") ?,
+ kernel.function("SyS_epoll_ctl") !,
+ kernel.function("sys_epoll_ctl") ?
{
name = "epoll_ctl"
epfd = $epfd
argstr = sprintf("%d, %s, %d, %p", $epfd, _opoll_op_str($op), $fd, $event)
}
probe syscall.epoll_ctl.return =
- kernel.function("sys_epoll_ctl").return ?,
- kernel.function("compat_sys_epoll_ctl").return ?
+ kernel.function("compat_sys_epoll_ctl").return ?,
+ kernel.function("SyS_epoll_ctl").return !,
+ kernel.function("sys_epoll_ctl").return ?
{
name = "epoll_ctl"
retstr = returnstr(1)
# compat_size_t sigsetsize)
#
probe syscall.epoll_pwait =
- kernel.function("sys_epoll_pwait") ?,
- kernel.function("compat_sys_epoll_pwait") ?
+ kernel.function("compat_sys_epoll_pwait") ?,
+ kernel.function("SyS_epoll_pwait") !,
+ kernel.function("sys_epoll_pwait") ?
{
name = "epoll_pwait"
argstr = sprintf("%d, %p, %d, %d, %p, %d",
$epfd, $events, $maxevents, $timeout, $sigmask, $sigsetsize)
}
probe syscall.epoll_pwait.return =
- kernel.function("sys_epoll_pwait").return ?,
- kernel.function("compat_sys_epoll_pwait").return ?
+ kernel.function("compat_sys_epoll_pwait").return ?,
+ kernel.function("SyS_epoll_pwait").return !,
+ kernel.function("sys_epoll_pwait").return ?
{
name = "epoll_pwait"
retstr = returnstr(1)
# int maxevents, int timeout)
#
probe syscall.epoll_wait =
- kernel.function("sys_epoll_wait") ?,
- kernel.function("compat_sys_epoll_wait") ?
+ kernel.function("compat_sys_epoll_wait") ?,
+ kernel.function("SyS_epoll_wait") !,
+ kernel.function("sys_epoll_wait") ?
{
name = "epoll_wait"
epfd = $epfd
argstr = sprintf("%d, %p, %d, %d", $epfd, $events, $maxevents, $timeout)
}
probe syscall.epoll_wait.return =
- kernel.function("sys_epoll_wait").return ?,
- kernel.function("compat_sys_epoll_wait").return ?
+ kernel.function("compat_sys_epoll_wait").return ?,
+ kernel.function("SyS_epoll_wait").return !,
+ kernel.function("sys_epoll_wait").return ?
{
name = "epoll_wait"
retstr = returnstr(1)
# eventfd _____________________________________________________
# long sys_eventfd(unsigned int count)
#
-probe syscall.eventfd = kernel.function("sys_eventfd") ? {
+probe syscall.eventfd = kernel.function("SyS_eventfd") !,
+ kernel.function("sys_eventfd") ? {
name = "eventfd"
argstr = sprint($count)
}
-probe syscall.eventfd.return = kernel.function("sys_eventfd").return ? {
+probe syscall.eventfd.return = kernel.function("SyS_eventfd").return !,
+ kernel.function("sys_eventfd").return ? {
name = "eventfd"
retstr = returnstr(1)
}
# exit_group _________________________________________________
# void sys_exit_group(int error_code)
#
-probe syscall.exit_group = kernel.function("sys_exit_group") {
+probe syscall.exit_group = kernel.function("SyS_exit_group") !,
+ kernel.function("sys_exit_group") {
name = "exit_group"
status = $error_code
argstr = sprint($error_code)
# faccessat __________________________________________________
# new function with 2.6.16
# long sys_faccessat(int dfd, const char __user *filename, int mode)
-probe syscall.faccessat = kernel.function("sys_faccessat") ? {
+probe syscall.faccessat = kernel.function("SyS_faccessat") !,
+ kernel.function("sys_faccessat") ? {
name = "faccessat"
dfd = $dfd
dfd_str = _dfd_str($dfd)
mode_str = _access_mode_str($mode)
argstr = sprintf("%s, %s, %s", dfd_str, user_string_quoted($filename), mode_str)
}
-probe syscall.faccessat.return = kernel.function("sys_faccessat").return ? {
+probe syscall.faccessat.return = kernel.function("SyS_faccessat").return !,
+ kernel.function("sys_faccessat").return ? {
name = "faccessat"
retstr = returnstr(1)
}
# fadvise64 __________________________________________________
# long sys_fadvise64(int fd, loff_t offset, size_t len, int advice)
#
-probe syscall.fadvise64 = kernel.function("sys_fadvise64") ? {
+probe syscall.fadvise64 = kernel.function("SyS_fadvise64") !,
+ kernel.function("sys_fadvise64") ? {
name = "fadvise64"
fs = $fd
offset = $offset
advice = $advice
argstr = sprintf("%d, %d, %d, %s", $fd, $offset, $len, _fadvice_advice_str($advice))
}
-probe syscall.fadvise64.return = kernel.function("sys_fadvise64").return ? {
+probe syscall.fadvise64.return = kernel.function("SyS_fadvise64").return !,
+ kernel.function("sys_fadvise64").return ? {
name = "fadvise64"
retstr = returnstr(1)
}
# fadvise64_64 _______________________________________________
# long sys_fadvise64_64(int fd, loff_t offset, loff_t len, int advice)
#
-probe syscall.fadvise64_64 = kernel.function("sys_fadvise64_64") {
+probe syscall.fadvise64_64 = kernel.function("SyS_fadvise64_64") !,
+ kernel.function("sys_fadvise64_64") ? {
name = "fadvise64_64"
fs = $fd
offset = $offset
advice = $advice
argstr = sprintf("%d, %d, %d, %s", $fd, $offset, $len, _fadvice_advice_str($advice))
}
-probe syscall.fadvise64_64.return = kernel.function("sys_fadvise64_64").return {
+probe syscall.fadvise64_64.return = kernel.function("SyS_fadvise64_64").return !,
+ kernel.function("sys_fadvise64_64").return ? {
name = "fadvise64_64"
retstr = returnstr(1)
}
# fadvise64 __________________________________________________
# long sys_fadvise64(int fd, loff_t offset, size_t len, int advice)
#
-probe syscall.fadvise64 = kernel.function("sys_fadvise64") {
+probe syscall.fadvise64 = kernel.function("SyS_fadvise64") !,
+ kernel.function("sys_fadvise64") {
name = "fadvise64"
fs = 0
offset = 0
advice = 0
argstr = ""
}
-probe syscall.fadvise64.return = kernel.function("sys_fadvise64").return {
+probe syscall.fadvise64.return = kernel.function("SyS_fadvise64").return !,
+ kernel.function("sys_fadvise64").return {
name = "fadvise64"
retstr = returnstr(1)
}
# fadvise64_64 _______________________________________________
# long sys_fadvise64_64(int fd, loff_t offset, loff_t len, int advice)
#
-probe syscall.fadvise64_64 = kernel.function("sys_fadvise64_64") {
+probe syscall.fadvise64_64 = kernel.function("SyS_fadvise64_64") !,
+ kernel.function("sys_fadvise64_64") {
name = "fadvise64_64"
fs = 0
offset = 0
advice = 0
argstr = ""
}
-probe syscall.fadvise64_64.return = kernel.function("sys_fadvise64_64").return {
+probe syscall.fadvise64_64.return = kernel.function("SyS_fadvise64_64").return !,
+ kernel.function("sys_fadvise64_64").return {
name = "fadvise64_64"
retstr = returnstr(1)
}
# fchdir _____________________________________________________
# long sys_fchdir(unsigned int fd)
-probe syscall.fchdir = kernel.function("sys_fchdir") {
+probe syscall.fchdir = kernel.function("SyS_fchdir") !,
+ kernel.function("sys_fchdir") {
name = "fchdir"
fd = $fd
argstr = sprint($fd)
}
-probe syscall.fchdir.return = kernel.function("sys_fchdir").return {
+probe syscall.fchdir.return = kernel.function("SyS_fchdir").return !,
+ kernel.function("sys_fchdir").return {
name = "fchdir"
retstr = returnstr(1)
}
# fchmod _____________________________________________________
# long sys_fchmod(unsigned int fd, mode_t mode)
-probe syscall.fchmod = kernel.function("sys_fchmod") {
+probe syscall.fchmod = kernel.function("SyS_fchmod") !,
+ kernel.function("sys_fchmod") {
name = "fchmod"
fildes = $fd
mode = $mode
argstr = sprintf("%d, %#o", $fd, $mode)
}
-probe syscall.fchmod.return = kernel.function("sys_fchmod").return {
+probe syscall.fchmod.return = kernel.function("SyS_fchmod").return !,
+ kernel.function("sys_fchmod").return {
name = "fchmod"
retstr = returnstr(1)
}
# new function with 2.6.16
# long sys_fchmodat(int dfd, const char __user *filename,
# mode_t mode)
-probe syscall.fchmodat = kernel.function("sys_fchmodat") ? {
+probe syscall.fchmodat = kernel.function("SyS_fchmodat") !,
+ kernel.function("sys_fchmodat") ? {
name = "fchmodat"
dfd = $dfd
dfd_str = _dfd_str($dfd)
mode = $mode
argstr = sprintf("%s, %s, %#o", dfd_str, user_string_quoted($filename), $mode)
}
-probe syscall.fchmodat.return = kernel.function("sys_fchmodat").return ? {
+probe syscall.fchmodat.return = kernel.function("SyS_fchmodat").return !,
+ kernel.function("sys_fchmodat").return ? {
name = "fchmodat"
retstr = returnstr(1)
}
# fchown _____________________________________________________
# long sys_fchown(unsigned int fd, uid_t user, gid_t group)
-probe syscall.fchown = kernel.function("sys_fchown") {
+probe syscall.fchown = kernel.function("SyS_fchown") !,
+ kernel.function("sys_fchown") {
name = "fchown"
fd = $fd
owner = __int32($user)
group = __int32($group)
argstr = sprintf("%d, %d, %d", $fd, owner, group)
}
-probe syscall.fchown.return = kernel.function("sys_fchown").return {
+probe syscall.fchown.return = kernel.function("SyS_fchown").return !,
+ kernel.function("sys_fchown").return {
name = "fchown"
retstr = returnstr(1)
}
# new function with 2.6.16
# long sys_fchownat(int dfd, const char __user *filename,
# uid_t user, gid_t group, int flag)
-probe syscall.fchownat = kernel.function("sys_fchownat") ? {
+probe syscall.fchownat = kernel.function("SyS_fchownat") !,
+ kernel.function("sys_fchownat") ? {
name = "fchownat"
dfd = $dfd
dfd_str = _dfd_str($dfd)
argstr = sprintf("%s, %s, %d, %d, %s",
dfd_str, user_string_quoted($filename), user, group, flag_str)
}
-probe syscall.fchownat.return = kernel.function("sys_fchownat").return ? {
+probe syscall.fchownat.return = kernel.function("SyS_fchownat").return !,
+ kernel.function("sys_fchownat").return ? {
name = "fchownat"
retstr = returnstr(1)
}
# long compat_sys_fcntl(unsigned int fd, unsigned int cmd, unsigned long arg)
#
probe syscall.fcntl =
- kernel.function("sys_fcntl") ?,
- kernel.function("sys_fcntl64") ?,
kernel.function("compat_sys_fcntl") ?,
- kernel.function("compat_sys_fcntl64") ?
+ kernel.function("compat_sys_fcntl64") ?,
+ kernel.function("sys_fcntl64") ?,
+ kernel.function("SyS_fcntl") !,
+ kernel.function("sys_fcntl") ?
{
name = "fcntl"
fd = $fd
argstr = sprintf("%d, %s, %p", $fd, _fcntl_cmd_str($cmd), $arg)
}
probe syscall.fcntl.return =
- kernel.function("sys_fcntl").return ?,
- kernel.function("sys_fcntl64").return ?,
kernel.function("compat_sys_fcntl").return ?,
- kernel.function("compat_sys_fcntl64").return ?
+ kernel.function("compat_sys_fcntl64").return ?,
+ kernel.function("sys_fcntl64").return ?,
+ kernel.function("SyS_fcntl").return !,
+ kernel.function("sys_fcntl").return ?
{
name = "fcntl"
retstr = returnstr(1)
# fdatasync __________________________________________________
# long sys_fdatasync(unsigned int fd)
-probe syscall.fdatasync = kernel.function("sys_fdatasync") {
+probe syscall.fdatasync = kernel.function("SyS_fdatasync") !,
+ kernel.function("sys_fdatasync") {
name = "fdatasync"
fd = $fd
argstr = sprint(fd)
}
-probe syscall.fdatasync.return = kernel.function("sys_fdatasync").return {
+probe syscall.fdatasync.return = kernel.function("SyS_fdatasync").return !,
+ kernel.function("sys_fdatasync").return {
name = "fdatasync"
retstr = returnstr(1)
}
# fgetxattr __________________________________________________
# ssize_t sys_fgetxattr(int fd, char __user *name,
# void __user *value, size_t size)
-probe syscall.fgetxattr = kernel.function("sys_fgetxattr") {
+probe syscall.fgetxattr = kernel.function("SyS_fgetxattr") !,
+ kernel.function("sys_fgetxattr") {
name = "fgetxattr"
filedes = $fd
#FIXME
size = $size
argstr = sprintf("%d, %s, %p, %d", filedes, user_string_quoted($name), value_uaddr, size)
}
-probe syscall.fgetxattr.return = kernel.function("sys_fgetxattr").return {
+probe syscall.fgetxattr.return = kernel.function("SyS_fgetxattr").return !,
+ kernel.function("sys_fgetxattr").return {
name = "fgetxattr"
retstr = returnstr(1)
}
# flistxattr _________________________________________________
# ssize_t sys_flistxattr(int fd, char __user *list, size_t size)
-probe syscall.flistxattr = kernel.function("sys_flistxattr") {
+probe syscall.flistxattr = kernel.function("SyS_flistxattr") !,
+ kernel.function("sys_flistxattr") {
name = "flistxattr"
filedes = $fd
list_uaddr = $list
size = $size
argstr = sprintf("%d, %p, %d", filedes, list_uaddr, size)
}
-probe syscall.flistxattr.return = kernel.function("sys_flistxattr").return {
+probe syscall.flistxattr.return = kernel.function("SyS_flistxattr").return !,
+ kernel.function("sys_flistxattr").return {
name = "flistxattr"
retstr = returnstr(1)
}
# flock ______________________________________________________
# long sys_flock(unsigned int fd, unsigned int cmd)
-probe syscall.flock = kernel.function("sys_flock") {
+probe syscall.flock = kernel.function("SyS_flock") !,
+ kernel.function("sys_flock") {
name = "flock"
fd = $fd
operation = $cmd
argstr = sprintf("%d, %s", fd, _flock_cmd_str(operation))
}
-probe syscall.flock.return = kernel.function("sys_flock").return {
+probe syscall.flock.return = kernel.function("SyS_flock").return !,
+ kernel.function("sys_flock").return {
name = "flock"
retstr = returnstr(1)
}
}
# fremovexattr _______________________________________________
# long sys_fremovexattr(int fd, char __user *name)
-probe syscall.fremovexattr = kernel.function("sys_fremovexattr") {
+probe syscall.fremovexattr = kernel.function("SyS_fremovexattr") !,
+ kernel.function("sys_fremovexattr") {
name = "fremovexattr"
filedes = $fd
name_uaddr = $name
argstr = sprintf("FIXME PLEASE")
}
-probe syscall.fremovexattr.return = kernel.function("sys_fremovexattr").return {
+probe syscall.fremovexattr.return = kernel.function("SyS_fremovexattr").return !,
+ kernel.function("sys_fremovexattr").return {
name = "fremovexattr"
retstr = returnstr(1)
}
* size_t size,
* int flags)
*/
-probe syscall.fsetxattr = kernel.function("sys_fsetxattr") {
+probe syscall.fsetxattr = kernel.function("SyS_fsetxattr") !,
+ kernel.function("sys_fsetxattr") {
name = "fsetxattr"
filedes = $fd
# FIXME
flags = $flags
argstr = sprintf("%d, %s, %p, %d, %p", filedes, user_string_quoted($name), value_uaddr, size, flags)
}
-probe syscall.fsetxattr.return = kernel.function("sys_fsetxattr").return {
+probe syscall.fsetxattr.return = kernel.function("SyS_fsetxattr").return !,
+ kernel.function("sys_fsetxattr").return {
name = "fsetxattr"
retstr = returnstr(1)
}
#
probe syscall.fstat =
kernel.function("sys_fstat") ?,
+ kernel.function("SyS_fstat64") ?,
kernel.function("sys_fstat64") ?,
kernel.function("sys32_fstat64") ?,
+ kernel.function("SyS_newfstat") ?,
kernel.function("sys_newfstat") ?,
kernel.function("sys_oabi_fstat64") ?,
kernel.function("compat_sys_newfstat") ?
}
probe syscall.fstat.return =
kernel.function("sys_fstat").return ?,
+ kernel.function("SyS_fstat64").return ?,
kernel.function("sys_fstat64").return ?,
kernel.function("sys32_fstat64").return ?,
+ kernel.function("SyS_newfstat").return ?,
kernel.function("sys_newfstat").return ?,
kernel.function("sys_oabi_fstat64").return ?,
kernel.function("compat_sys_newfstat").return ?
# long sys_fstatat64(int dfd, char __user *filename, struct stat64 __user *statbuf, int flag)
# long compat_sys_newfstatat(unsigned int dfd, char __user *filename, struct compat_stat __user *statbuf, int flag)
probe syscall.fstatat =
+ kernel.function("SyS_fstatat64") ?,
kernel.function("sys_fstatat64") ?,
+ kernel.function("SyS_newfstatat") ?,
kernel.function("sys_newfstatat") ?,
kernel.function("compat_sys_newfstatat") ?,
kernel.function("sys32_fstatat64") ?
argstr = sprintf("%s, %s, %p, %s", _dfd_str($dfd), user_string_quoted($filename), $statbuf, _at_flag_str($flag))
}
probe syscall.fstatat.return =
+ kernel.function("SyS_fstatat64").return ?,
kernel.function("sys_fstatat64").return ?,
+ kernel.function("SyS_newfstatat").return ?,
kernel.function("sys_newfstatat").return ?,
kernel.function("compat_sys_newfstatat").return ?,
kernel.function("sys32_fstatat64").return ?
# long compat_sys_fstatfs(unsigned int fd, struct compat_statfs __user *buf)
#
probe syscall.fstatfs =
- kernel.function("sys_fstatfs"),
- kernel.function("compat_sys_fstatfs") ?
+ kernel.function("compat_sys_fstatfs") ?,
+ kernel.function("SyS_fstatfs") !,
+ kernel.function("sys_fstatfs")
{
name = "fstatfs"
fd = $fd
argstr = sprintf("%d, %p", $fd, $buf)
}
probe syscall.fstatfs.return =
- kernel.function("sys_fstatfs").return,
- kernel.function("compat_sys_fstatfs").return ?
+ kernel.function("compat_sys_fstatfs").return ?,
+ kernel.function("SyS_fstatfs").return !,
+ kernel.function("sys_fstatfs").return
{
name = "fstatfs"
retstr = returnstr(1)
# long compat_sys_fstatfs64(unsigned int fd, compat_size_t sz, struct compat_statfs64 __user *buf)
#
probe syscall.fstatfs64 =
- kernel.function("sys_fstatfs64") ?,
- kernel.function("compat_sys_fstatfs64") ?
+ kernel.function("compat_sys_fstatfs64") ?,
+ kernel.function("SyS_fstatfs64") !,
+ kernel.function("sys_fstatfs64") ?
{
name = "fstatfs"
fd = $fd
argstr = sprintf("%d, %d, %p", $fd, $sz, $buf)
}
probe syscall.fstatfs64.return =
- kernel.function("sys_fstatfs64").return ?,
- kernel.function("compat_sys_fstatfs64").return ?
+ kernel.function("compat_sys_fstatfs64").return ?,
+ kernel.function("SyS_fstatfs64").return !,
+ kernel.function("sys_fstatfs64").return ?
{
name = "fstatfs"
retstr = returnstr(1)
# fsync ______________________________________________________
# long sys_fsync(unsigned int fd)
-probe syscall.fsync = kernel.function("sys_fsync") {
+probe syscall.fsync = kernel.function("SyS_fsync") !,
+ kernel.function("sys_fsync") {
name = "fsync"
fd = $fd
argstr = sprint(fd)
}
-probe syscall.fsync.return = kernel.function("sys_fsync").return {
+probe syscall.fsync.return = kernel.function("SyS_fsync").return !,
+ kernel.function("sys_fsync").return {
name = "fsync"
retstr = returnstr(1)
}
# ftruncate __________________________________________________
# long sys_ftruncate(unsigned int fd, unsigned long length)
-probe syscall.ftruncate = kernel.function("sys_ftruncate") {
+probe syscall.ftruncate = kernel.function("SyS_ftruncate") !,
+ kernel.function("sys_ftruncate") {
name = "ftruncate"
fd = $fd
length = $length
argstr = sprintf("%d, %d", fd, length)
}
-probe syscall.ftruncate.return = kernel.function("sys_ftruncate").return {
+probe syscall.ftruncate.return = kernel.function("SyS_ftruncate").return !,
+ kernel.function("sys_ftruncate").return {
name = "ftruncate"
retstr = returnstr(1)
}
# struct compat_timespec __user *utime, u32 __user *uaddr2,
# u32 val3)
#
-probe syscall.futex = kernel.function("sys_futex") ? {
+probe syscall.futex = kernel.function("SyS_futex") !,
+ kernel.function("sys_futex") ? {
name = "futex"
futex_uaddr = $uaddr
op = $op
argstr = sprintf("%p, %s, %d", $uaddr, _futex_op_str($op),
$val)
}
-probe syscall.futex.return = kernel.function("sys_futex").return ? {
+probe syscall.futex.return = kernel.function("SyS_futex").return !,
+ kernel.function("sys_futex").return ? {
name = "futex"
retstr = returnstr(1)
}
# long compat_sys_futimesat(unsigned int dfd, char __user *filename, struct compat_timeval __user *t)
#
-probe syscall.futimesat = kernel.function("sys_futimesat") ? {
+probe syscall.futimesat = kernel.function("SyS_futimesat") !,
+ kernel.function("sys_futimesat") ? {
name = "futimesat"
dirfd = $dfd
filename_uaddr = $filename
argstr = sprintf("%s, %s, %s", _dfd_str($dfd), user_string_quoted($filename),
_struct_compat_timeval_u($t, 2))
}
-probe syscall.futimesat.return = kernel.function("sys_futimesat").return ? {
+probe syscall.futimesat.return = kernel.function("SyS_futimesat").return !,
+ kernel.function("sys_futimesat").return ? {
name = "futimesat"
retstr = returnstr(1)
}
# getcwd _____________________________________________________
# long sys_getcwd(char __user *buf, unsigned long size)
-probe syscall.getcwd = kernel.function("sys_getcwd") {
+probe syscall.getcwd = kernel.function("SyS_getcwd") !,
+ kernel.function("sys_getcwd") {
name = "getcwd"
buf_uaddr = $buf
size = $size
argstr = sprintf("%p, %d", buf_uaddr, size)
}
-probe syscall.getcwd.return = kernel.function("sys_getcwd").return {
+probe syscall.getcwd.return = kernel.function("SyS_getcwd").return !,
+ kernel.function("sys_getcwd").return {
name = "getcwd"
retstr = returnstr(1)
}
# long compat_sys_getdents64(unsigned int fd, struct linux_dirent64 __user * dirent, unsigned int count)
#
probe syscall.getdents =
+ kernel.function("SyS_getdents") ?,
kernel.function("sys_getdents") ?,
+ kernel.function("SyS_getdents64") ?,
kernel.function("sys_getdents64") ?,
kernel.function("compat_sys_getdents") ?,
kernel.function("compat_sys_getdents64") ?
argstr = sprintf("%d, %p, %d", $fd, $dirent, $count)
}
probe syscall.getdents.return =
+ kernel.function("SyS_getdents").return ?,
kernel.function("sys_getdents").return ?,
+ kernel.function("SyS_getdents64").return ?,
kernel.function("sys_getdents64").return ?,
kernel.function("compat_sys_getdents").return ?,
kernel.function("compat_sys_getdents64").return ?
# long sys32_getgroups16(int gidsetsize, u16 __user *grouplist)
#
probe syscall.getgroups =
- kernel.function("sys_getgroups") ?,
kernel.function("sys_getgroups16") ?,
- kernel.function("sys32_getgroups16") ?
+ kernel.function("sys32_getgroups16") ?,
+ kernel.function("SyS_getgroups") !,
+ kernel.function("sys_getgroups") ?
{
name = "getgroups"
size = $gidsetsize
argstr = sprintf("%d, %p", $gidsetsize, $grouplist)
}
probe syscall.getgroups.return =
- kernel.function("sys_getgroups").return ?,
kernel.function("sys_getgroups16").return ?,
- kernel.function("sys32_getgroups16").return ?
+ kernel.function("sys32_getgroups16").return ?,
+ kernel.function("SyS_getgroups").return !,
+ kernel.function("sys_getgroups").return ?
{
name = "getgroups"
retstr = returnstr(1)
# gethostname ________________________________________________
# long sys_gethostname(char __user *name, int len)
-probe syscall.gethostname = kernel.function("sys_gethostname") ? {
+probe syscall.gethostname = kernel.function("SyS_gethostname") !,
+ kernel.function("sys_gethostname") ? {
name = "gethostname"
name_uaddr = $name
len = $len
argstr = sprintf ("%p, %d", name_uaddr, len)
}
-probe syscall.gethostname.return = kernel.function("sys_gethostname").return ? {
+probe syscall.gethostname.return = kernel.function("SyS_gethostname").return !,
+ kernel.function("sys_gethostname").return ? {
name = "gethostname"
retstr = returnstr(1)
}
# getitimer __________________________________________________
# sys_getitimer(int which, struct itimerval __user *value)
#
-probe syscall.getitimer = kernel.function("sys_getitimer") {
+probe syscall.getitimer = kernel.function("SyS_getitimer") !,
+ kernel.function("sys_getitimer") {
name = "getitimer"
which = $which
value_uaddr = $value
argstr = sprintf("%s, %p", _itimer_which_str($which), $value)
}
-probe syscall.getitimer.return = kernel.function("sys_getitimer").return {
+probe syscall.getitimer.return = kernel.function("SyS_getitimer").return !,
+ kernel.function("sys_getitimer").return {
name = "getitimer"
retstr = returnstr(1)
}
# compat_ulong_t addr, compat_ulong_t flags)
#
probe syscall.get_mempolicy =
- kernel.function("sys_get_mempolicy") ?,
- kernel.function("compat_sys_get_mempolicy") ?
+ kernel.function("compat_sys_get_mempolicy") ?,
+ kernel.function("SyS_get_mempolicy") !,
+ kernel.function("sys_get_mempolicy") ?
{
name = "get_mempolicy"
policy_uaddr = $policy
$nmask, $maxnode, $addr, $flags)
}
probe syscall.get_mempolicy.return =
- kernel.function("sys_get_mempolicy").return ?,
- kernel.function("compat_sys_get_mempolicy").return ?
+ kernel.function("compat_sys_get_mempolicy").return ?,
+ kernel.function("SyS_get_mempolicy").return !,
+ kernel.function("sys_get_mempolicy").return ?
{
name = "get_mempolicy"
retstr = returnstr(1)
# getpeername ________________________________________________
# long sys_getpeername(int fd, struct sockaddr __user *usockaddr, int __user *usockaddr_len)
#
-probe syscall.getpeername = kernel.function("sys_getpeername") ? {
+probe syscall.getpeername = kernel.function("SyS_getpeername") !,
+ kernel.function("sys_getpeername") ? {
name = "getpeername"
s = $fd
name_uaddr = $usockaddr
namelen_uaddr = $usockaddr_len
argstr = sprintf("%d, %p, %p", $fd, $usockaddr, $usockaddr_len)
}
-probe syscall.getpeername.return = kernel.function("sys_getpeername").return ? {
+probe syscall.getpeername.return = kernel.function("SyS_getpeername").return !,
+ kernel.function("sys_getpeername").return ? {
name = "getpeername"
retstr = returnstr(1)
}
# getpgid ____________________________________________________
# long sys_getpgid(pid_t pid)
-probe syscall.getpgid = kernel.function("sys_getpgid") {
+probe syscall.getpgid = kernel.function("SyS_getpgid") !,
+ kernel.function("sys_getpgid") {
name = "getpgid"
pid = $pid
argstr = sprintf("%d", $pid)
}
-probe syscall.getpgid.return = kernel.function("sys_getpgid").return {
+probe syscall.getpgid.return = kernel.function("SyS_getpgid").return !,
+ kernel.function("sys_getpgid").return {
name = "getpgid"
retstr = returnstr(1)
}
# getpriority ________________________________________________
# long sys_getpriority(int which, int who)
-probe syscall.getpriority = kernel.function("sys_getpriority") {
+probe syscall.getpriority = kernel.function("SyS_getpriority") !,
+ kernel.function("sys_getpriority") {
name = "getpriority"
which = $which
who = $who
argstr = sprintf("%s, %d", _priority_which_str(which), who)
}
-probe syscall.getpriority.return = kernel.function("sys_getpriority").return {
+probe syscall.getpriority.return = kernel.function("SyS_getpriority").return !,
+ kernel.function("sys_getpriority").return {
name = "getpriority"
retstr = returnstr(1)
}
# old_uid_t __user *sgid)
probe syscall.getresgid =
kernel.function("sys_getresgid16") ?,
- kernel.function("sys_getresgid")
+ kernel.function("SyS_getresgid") !,
+ kernel.function("sys_getresgid")
{
name = "getresgid"
rgid_uaddr = $rgid
}
probe syscall.getresgid.return =
kernel.function("sys_getresgid16").return ?,
+ kernel.function("SyS_getresgid").return !,
kernel.function("sys_getresgid").return
{
name = "getresgid"
# uid_t __user *suid)
probe syscall.getresuid =
kernel.function("sys_getresuid16") ?,
+ kernel.function("SyS_getresuid") !,
kernel.function("sys_getresuid")
{
name = "getresuid"
}
probe syscall.getresuid.return =
kernel.function("sys_getresuid16").return ?,
- kernel.function("sys_getresuid").return
+ kernel.function("SyS_getresuid").return !,
+ kernel.function("sys_getresuid").return
{
name = "getresuid"
retstr = returnstr(1)
# long sys_getrlimit(unsigned int resource, struct rlimit __user *rlim)
# long sys_old_getrlimit(unsigned int resource, struct rlimit __user *rlim)
# long compat_sys_getrlimit (unsigned int resource, struct compat_rlimit __user *rlim)
-probe syscall.getrlimit = kernel.function("sys_getrlimit"),
+probe syscall.getrlimit = kernel.function("SyS_getrlimit") ?,
+ kernel.function("sys_getrlimit") ?,
+ kernel.function("SyS_old_getrlimit") ?,
kernel.function("sys_old_getrlimit") ?,
kernel.function("compat_sys_getrlimit") ?
{
rlim_uaddr = $rlim
argstr = sprintf("%s, %p", _rlimit_resource_str($resource), $rlim)
}
-probe syscall.getrlimit.return = kernel.function("sys_getrlimit").return,
+probe syscall.getrlimit.return = kernel.function("SyS_getrlimit").return ?,
+ kernel.function("sys_getrlimit").return ?,
+ kernel.function("SyS_old_getrlimit").return ?,
kernel.function("sys_old_getrlimit").return ?,
kernel.function("compat_sys_getrlimit").return ?
{
# getrusage __________________________________________________
# long sys_getrusage(int who, struct rusage __user *ru)
-probe syscall.getrusage = kernel.function("sys_getrusage") {
+probe syscall.getrusage = kernel.function("SyS_getrusage") !,
+ kernel.function("sys_getrusage") {
name = "getrusage"
who = $who
if($who==-2)
usage_uaddr = $ru
argstr = sprintf("%s, %p", who_str, usage_uaddr)
}
-probe syscall.getrusage.return = kernel.function("sys_getrusage").return {
+probe syscall.getrusage.return = kernel.function("SyS_getrusage").return !,
+ kernel.function("sys_getrusage").return {
name = "getrusage"
retstr = returnstr(1)
}
# getsid _____________________________________________________
# long sys_getsid(pid_t pid)
-probe syscall.getsid = kernel.function("sys_getsid") {
+probe syscall.getsid = kernel.function("SyS_getsid") !,
+ kernel.function("sys_getsid") {
name = "getsid"
pid = $pid
argstr = sprint(pid)
}
-probe syscall.getsid.return = kernel.function("sys_getsid").return {
+probe syscall.getsid.return = kernel.function("SyS_getsid").return !,
+ kernel.function("sys_getsid").return {
name = "getsid"
retstr = returnstr(1)
}
# long sys_getsockname(int fd,
# struct sockaddr __user *usockaddr,
# int __user *usockaddr_len)
-probe syscall.getsockname = kernel.function("sys_getsockname") ? {
+probe syscall.getsockname = kernel.function("SyS_getsockname") !,
+ kernel.function("sys_getsockname") ? {
name = "getsockname"
s = $fd
name_uaddr = $usockaddr
namelen_uaddr = $usockaddr_len
argstr = sprintf("%d, %p, %p", $fd, $usockaddr, $usockaddr_len)
}
-probe syscall.getsockname.return = kernel.function("sys_getsockname").return ? {
+probe syscall.getsockname.return = kernel.function("SyS_getsockname").return !,
+ kernel.function("sys_getsockname").return ? {
name = "getsockname"
retstr = returnstr(1)
}
# int __user *optlen)
#
probe syscall.getsockopt =
- kernel.function("sys_getsockopt") ?,
- kernel.function("compat_sys_getsockopt") ?
+ kernel.function("compat_sys_getsockopt") ?,
+ kernel.function("SyS_getsockopt") !,
+ kernel.function("sys_getsockopt") ?
{
name = "getsockopt"
fd = $fd
_sockopt_optname_str($optname), $optval, $optlen)
}
probe syscall.getsockopt.return =
- kernel.function("sys_getsockopt").return ?,
- kernel.function("compat_sys_getsockopt").return ?
+ kernel.function("compat_sys_getsockopt").return ?,
+ kernel.function("SyS_getsockopt").return !,
+ kernel.function("sys_getsockopt").return ?
{
name = "getsockopt"
retstr = returnstr(1)
# long compat_sys_gettimeofday(struct compat_timeval __user *tv,
# struct timezone __user *tz)
probe syscall.gettimeofday =
- kernel.function("sys_gettimeofday"),
+ kernel.function("compat_sys_gettimeofday") ?,
kernel.function("sys32_gettimeofday") ?,
- kernel.function("compat_sys_gettimeofday") ?
+ kernel.function("SyS_gettimeofday") !,
+ kernel.function("sys_gettimeofday")
{
name = "gettimeofday"
tv_uaddr = $tv
}
probe syscall.gettimeofday.return =
- kernel.function("sys_gettimeofday").return,
+ kernel.function("compat_sys_gettimeofday").return ?,
kernel.function("sys32_gettimeofday").return ?,
- kernel.function("compat_sys_gettimeofday").return ?
+ kernel.function("SyS_gettimeofday").return !,
+ kernel.function("sys_gettimeofday").return
{
name = "gettimeofday"
retstr = returnstr(1)
# getxattr ___________________________________________________
# ssize_t sys_getxattr(char __user *path, char __user *name,
# void __user *value, size_t size)
-probe syscall.getxattr = kernel.function("sys_getxattr") {
+probe syscall.getxattr = kernel.function("SyS_getxattr") !,
+ kernel.function("sys_getxattr") {
name = "getxattr"
%( kernel_v >= "2.6.27" %?
path = user_string($pathname)
user_string_quoted($name),
value_uaddr, size)
}
-probe syscall.getxattr.return = kernel.function("sys_getxattr").return {
+probe syscall.getxattr.return = kernel.function("SyS_getxattr").return !,
+ kernel.function("sys_getxattr").return {
name = "getxattr"
retstr = returnstr(1)
}
# unsigned long len,
# const char __user *uargs)
#
-probe syscall.init_module = kernel.function("sys_init_module") ? {
+probe syscall.init_module = kernel.function("SyS_init_module") !,
+ kernel.function("sys_init_module") ? {
name = "init_module"
umod_uaddr = $umod
len = $len
uargs = user_string($uargs)
argstr = sprintf("%p, %d, %s", $umod, $len, user_string_quoted($uargs))
}
-probe syscall.init_module.return = kernel.function("sys_init_module").return ? {
+probe syscall.init_module.return = kernel.function("SyS_init_module").return !,
+ kernel.function("sys_init_module").return ? {
name = "init_module"
retstr = returnstr(1)
}
#
# long sys_inotify_add_watch(int fd, const char __user *path, u32 mask)
#
-probe syscall.inotify_add_watch = kernel.function("sys_inotify_add_watch") ? {
+probe syscall.inotify_add_watch = kernel.function("SyS_inotify_add_watch") !,
+ kernel.function("sys_inotify_add_watch") ? {
name = "inotify_add_watch"
fd = $fd
mask = $mask
%)
}
-probe syscall.inotify_add_watch.return = kernel.function("sys_inotify_add_watch").return ? {
+probe syscall.inotify_add_watch.return = kernel.function("SyS_inotify_add_watch").return !,
+ kernel.function("sys_inotify_add_watch").return ? {
name = "inotify_add_watch"
retstr = returnstr(1)
}
#
# long sys_inotify_rm_watch(int fd, u32 wd)
#
-probe syscall.inotify_rm_watch = kernel.function("sys_inotify_rm_watch") ? {
+probe syscall.inotify_rm_watch = kernel.function("SyS_inotify_rm_watch") !,
+ kernel.function("sys_inotify_rm_watch") ? {
name = "inotify_rm_watch"
fd = $fd
wd = $wd
argstr = sprintf("%d, %d", $fd, $wd)
}
-probe syscall.inotify_rm_watch.return = kernel.function("sys_inotify_rm_watch").return ? {
+probe syscall.inotify_rm_watch.return = kernel.function("SyS_inotify_rm_watch").return !,
+ kernel.function("sys_inotify_rm_watch").return ? {
name = "inotify_rm_watch"
retstr = returnstr(1)
}
# long sys_io_cancel(aio_context_t ctx_id,
# struct iocb __user *iocb,
# struct io_event __user *result)
-probe syscall.io_cancel = kernel.function("sys_io_cancel") {
+probe syscall.io_cancel = kernel.function("SyS_io_cancel") !,
+ kernel.function("sys_io_cancel") {
name = "io_cancel"
ctx_id = $ctx_id
iocb_uaddr = $iocb
result_uaddr = $result
argstr = sprintf("%d, %p, %p", ctx_id, iocb_uaddr, result_uaddr)
}
-probe syscall.io_cancel.return = kernel.function("sys_io_cancel").return {
+probe syscall.io_cancel.return = kernel.function("SyS_io_cancel").return !,
+ kernel.function("sys_io_cancel").return {
name = "io_cancel"
retstr = returnstr(1)
}
# long compat_sys_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg)
#
probe syscall.ioctl =
- kernel.function("sys_ioctl") ?,
- kernel.function("compat_sys_ioctl") ?
+ kernel.function("compat_sys_ioctl") ?,
+ kernel.function("SyS_ioctl") !,
+ kernel.function("sys_ioctl") ?
{
name = "ioctl"
fd = $fd
argstr = sprintf("%d, %d, %p", $fd, $cmd, $arg)
}
probe syscall.ioctl.return =
- kernel.function("sys_ioctl").return ?,
- kernel.function("compat_sys_ioctl").return ?
+ kernel.function("compat_sys_ioctl").return ?,
+ kernel.function("SyS_ioctl").return !,
+ kernel.function("sys_ioctl").return ?
{
name = "ioctl"
retstr = returnstr(1)
# io_destroy _________________________________________________
# long sys_io_destroy(aio_context_t ctx)
-probe syscall.io_destroy = kernel.function("sys_io_destroy") {
+probe syscall.io_destroy = kernel.function("SyS_io_destroy") !,
+ kernel.function("sys_io_destroy") {
name = "io_destroy"
ctx = $ctx
argstr = sprintf("%d", ctx)
}
-probe syscall.io_destroy.return = kernel.function("sys_io_destroy").return {
+probe syscall.io_destroy.return = kernel.function("SyS_io_destroy").return !,
+ kernel.function("sys_io_destroy").return {
name = "io_destroy"
retstr = returnstr(1)
}
# struct compat_timespec __user *timeout)
#
probe syscall.io_getevents =
- kernel.function("sys_io_getevents") ?,
- kernel.function("compat_sys_io_getevents") ?
+ kernel.function("compat_sys_io_getevents") ?,
+ kernel.function("SyS_io_getevents") !,
+ kernel.function("sys_io_getevents") ?
{
name = "io_getevents"
ctx_id = $ctx_id
$nr, $events, $timeout, timestr)
}
probe syscall.io_getevents.return =
- kernel.function("sys_io_getevents").return ?,
- kernel.function("compat_sys_io_getevents").return ?
+ kernel.function("compat_sys_io_getevents").return ?,
+ kernel.function("SyS_io_getevents").return !,
+ kernel.function("sys_io_getevents").return ?
{
name = "io_getevents"
retstr = returnstr(1)
# io_setup ___________________________________________________
# long sys_io_setup(unsigned nr_events, aio_context_t __user *ctxp)
#
-probe syscall.io_setup = kernel.function("sys_io_setup") {
+probe syscall.io_setup = kernel.function("SyS_io_setup") !,
+ kernel.function("sys_io_setup") {
name = "io_setup"
maxevents = $nr_events
ctxp_uaddr = $ctxp
argstr = sprintf("%d, %p", $nr_events, $ctxp)
}
-probe syscall.io_setup.return = kernel.function("sys_io_setup").return {
+probe syscall.io_setup.return = kernel.function("SyS_io_setup").return !,
+ kernel.function("sys_io_setup").return {
name = "io_setup"
retstr = returnstr(1)
}
# io_submit __________________________________________________
# long sys_io_submit(aio_context_t ctx_id, long nr, struct iocb __user * __user *iocbpp)
#
-probe syscall.io_submit = kernel.function("sys_io_submit") {
+probe syscall.io_submit = kernel.function("SyS_io_submit") !,
+ kernel.function("sys_io_submit") {
name = "io_submit"
ctx_id = $ctx_id
nr = $nr
iocbpp_uaddr = $iocbpp
argstr = sprintf("%d, %d, %p", $ctx_id, $nr, $iocbpp)
}
-probe syscall.io_submit.return = kernel.function("sys_io_submit").return {
+probe syscall.io_submit.return = kernel.function("SyS_io_submit").return !,
+ kernel.function("sys_io_submit").return {
name = "io_submit"
retstr = returnstr(1)
}
# ioprio_get _________________________________________________
# long sys_ioprio_get(int which, int who)
#
-probe syscall.ioprio_get = kernel.function("sys_ioprio_get") ? {
+probe syscall.ioprio_get = kernel.function("SyS_ioprio_get") !,
+ kernel.function("sys_ioprio_get") ? {
name = "ioprio_get"
which = $which
who = $who
argstr = sprintf("%d, %d", $which, $who)
}
-probe syscall.ioprio_get.return = kernel.function("sys_ioprio_get").return ? {
+probe syscall.ioprio_get.return = kernel.function("SyS_ioprio_get").return !,
+ kernel.function("sys_ioprio_get").return ? {
name = "ioprio_get"
retstr = returnstr(1)
}
# ioprio_set _________________________________________________
# long sys_ioprio_set(int which, int who, int ioprio)
#
-probe syscall.ioprio_set = kernel.function("sys_ioprio_set") ? {
+probe syscall.ioprio_set = kernel.function("SyS_ioprio_set") !,
+ kernel.function("sys_ioprio_set") ? {
name = "ioprio_set"
which = $which
who = $who
ioprio = $ioprio
argstr = sprintf("%d, %d, %d", $which, $who, $ioprio)
}
-probe syscall.ioprio_set.return = kernel.function("sys_ioprio_set").return ? {
+probe syscall.ioprio_set.return = kernel.function("SyS_ioprio_set").return !,
+ kernel.function("sys_ioprio_set").return ? {
name = "ioprio_set"
retstr = returnstr(1)
}
# unsigned long flags)
#
probe syscall.kexec_load =
- kernel.function("sys_kexec_load") ?,
- kernel.function("compat_sys_kexec_load") ?
+ kernel.function("compat_sys_kexec_load") ?,
+ kernel.function("SyS_kexec_load") !,
+ kernel.function("sys_kexec_load") ?
{
name = "kexec_load"
entry = $entry
argstr = sprintf("%p, %d, %p, %d", $entry, $nr_segments, $segments, $flags)
}
probe syscall.kexec_load.return =
- kernel.function("sys_kexec_load").return ?,
- kernel.function("compat_sys_kexec_load").return ?
+ kernel.function("compat_sys_kexec_load").return ?,
+ kernel.function("SyS_kexec_load").return !,
+ kernel.function("sys_kexec_load").return ?
{
name = "kexec_load"
retstr = returnstr(1)
# long compat_sys_keyctl(u32 option, u32 arg2, u32 arg3, u32 arg4, u32 arg5)
#
probe syscall.keyctl =
- kernel.function("sys_keyctl") ?,
- kernel.function("compat_sys_keyctl") ?
+ kernel.function("compat_sys_keyctl") ?,
+ kernel.function("SyS_keyctl") !,
+ kernel.function("sys_keyctl") ?
{
name = "keyctl"
argstr = sprintf("%d, ...", $option)
}
probe syscall.keyctl.return =
- kernel.function("sys_keyctl").return ?,
- kernel.function("compat_sys_keyctl").return ?
+ kernel.function("compat_sys_keyctl").return ?,
+ kernel.function("SyS_keyctl").return !,
+ kernel.function("sys_keyctl").return ?
{
name = "keyctl"
retstr = returnstr(1)
# kill _______________________________________________________
# long sys_kill(int pid, int sig)
-probe syscall.kill = kernel.function("sys_kill") {
+probe syscall.kill = kernel.function("SyS_kill") !,
+ kernel.function("sys_kill") {
name = "kill"
pid = $pid
sig = $sig
argstr = sprintf("%d, %s", $pid, _signal_name($sig))
}
-probe syscall.kill.return = kernel.function("sys_kill").return {
+probe syscall.kill.return = kernel.function("SyS_kill").return !,
+ kernel.function("sys_kill").return {
name = "kill"
retstr = returnstr(1)
}
# lchown _____________________________________________________
# long sys_lchown(const char __user * filename, uid_t user, gid_t group)
#
-probe syscall.lchown = kernel.function("sys_lchown") {
+probe syscall.lchown = kernel.function("SyS_lchown") !,
+ kernel.function("sys_lchown") {
name = "lchown"
path = user_string($filename)
owner = __int32($user)
group = __int32($group)
argstr = sprintf("%s, %d, %d",user_string_quoted($filename), owner, group)
}
-probe syscall.lchown.return = kernel.function("sys_lchown").return {
+probe syscall.lchown.return = kernel.function("SyS_lchown").return !,
+ kernel.function("sys_lchown").return {
name = "lchown"
retstr = returnstr(1)
}
# void __user *value,
# size_t size)
#
-probe syscall.lgetxattr = kernel.function("sys_lgetxattr") {
+probe syscall.lgetxattr = kernel.function("SyS_lgetxattr") !,
+ kernel.function("sys_lgetxattr") {
name = "lgetxattr"
%( kernel_v >= "2.6.27" %?
path = user_string($pathname)
user_string_quoted($name),
value_uaddr, size)
}
-probe syscall.lgetxattr.return = kernel.function("sys_lgetxattr").return {
+probe syscall.lgetxattr.return = kernel.function("SyS_lgetxattr").return !,
+ kernel.function("sys_lgetxattr").return {
name = "lgetxattr"
retstr = returnstr(1)
}
# link _______________________________________________________
# long sys_link(const char __user * oldname,
# const char __user * newname)
-probe syscall.link = kernel.function("sys_link") {
+probe syscall.link = kernel.function("SyS_link") !,
+ kernel.function("sys_link") {
name = "link"
oldpath = user_string($oldname)
newpath = user_string($newname)
user_string_quoted($oldname),
user_string_quoted($newname))
}
-probe syscall.link.return = kernel.function("sys_link").return {
+probe syscall.link.return = kernel.function("SyS_link").return !,
+ kernel.function("sys_link").return {
name = "link"
retstr = returnstr(1)
}
# new function with 2.6.16
# long sys_linkat(int olddfd, const char __user *oldname,
# int newdfd, const char __user *newname, int flags)
-probe syscall.linkat = kernel.function("sys_linkat") ? {
+probe syscall.linkat = kernel.function("SyS_linkat") !,
+ kernel.function("sys_linkat") ? {
name = "linkat"
olddfd = $olddfd
olddfd_str = _dfd_str($olddfd)
newdfd_str, user_string_quoted($newname),
flags_str)
}
-probe syscall.linkat.return = kernel.function("sys_linkat").return ? {
+probe syscall.linkat.return = kernel.function("SyS_linkat").return !,
+ kernel.function("sys_linkat").return ? {
name = "linkat"
retstr = returnstr(1)
}
# listen _____________________________________________________
# long sys_listen(int fd, int backlog)
-probe syscall.listen = kernel.function("sys_listen") ? {
+probe syscall.listen = kernel.function("SyS_listen") !,
+ kernel.function("sys_listen") ? {
name = "listen"
sockfd = $fd
backlog = $backlog
argstr = sprintf("%d, %d", $fd, $backlog)
}
-probe syscall.listen.return = kernel.function("sys_listen").return ? {
+probe syscall.listen.return = kernel.function("SyS_listen").return !,
+ kernel.function("sys_listen").return ? {
name = "listen"
retstr = returnstr(1)
}
# listxattr __________________________________________________
# ssize_t sys_listxattr(char __user *path, char __user *list, size_t size)
#
-probe syscall.listxattr = kernel.function("sys_listxattr") {
+probe syscall.listxattr = kernel.function("SyS_listxattr") !,
+ kernel.function("sys_listxattr") {
name = "listxattr"
list_uaddr = $list
size = $size
argstr = sprintf("%s, %p, %d", user_string_quoted($path), $list, $size)
%)
}
-probe syscall.listxattr.return = kernel.function("sys_listxattr").return {
+probe syscall.listxattr.return = kernel.function("SyS_listxattr").return !,
+ kernel.function("sys_listxattr").return {
name = "listxattr"
retstr = returnstr(1)
}
# llistxattr _________________________________________________
# ssize_t sys_llistxattr(char __user *path, char __user *list, size_t size)
#
-probe syscall.llistxattr = kernel.function("sys_llistxattr") {
+probe syscall.llistxattr = kernel.function("SyS_llistxattr") !,
+ kernel.function("sys_llistxattr") {
name = "llistxattr"
list_uaddr = $list
size = $size
argstr = sprintf("%s, %p, %d", user_string_quoted($path), $list, $size)
%)
}
-probe syscall.llistxattr.return = kernel.function("sys_llistxattr").return {
+probe syscall.llistxattr.return = kernel.function("SyS_llistxattr").return !,
+ kernel.function("sys_llistxattr").return {
name = "llistxattr"
retstr = returnstr(1)
}
# unsigned long offset_low,
# loff_t __user * result,
# unsigned int origin)
-probe syscall.llseek = kernel.function("sys_llseek") ? {
+probe syscall.llseek = kernel.function("SyS_llseek") !,
+ kernel.function("sys_llseek") ? {
name = "llseek"
fd = $fd
offset_high = $offset_high
argstr = sprintf("%d, 0x%x, 0x%x, %p, %s", $fd, $offset_high,
$offset_low, $result, whence_str)
}
-probe syscall.llseek.return = kernel.function("sys_llseek").return ? {
+probe syscall.llseek.return = kernel.function("SyS_llseek").return !,
+ kernel.function("sys_llseek").return ? {
name = "llseek"
retstr = returnstr(1)
}
# lookup_dcookie _____________________________________________
# long sys_lookup_dcookie(u64 cookie64, char __user * buf, size_t len)
#
-probe syscall.lookup_dcookie = kernel.function("sys_lookup_dcookie") ? {
+probe syscall.lookup_dcookie = kernel.function("SyS_lookup_dcookie") !,
+ kernel.function("sys_lookup_dcookie") ? {
name = "lookup_dcookie"
cookie = $cookie64
buffer_uaddr = $buf
len = $len
argstr = sprintf("%d, %p, %d", $cookie64, $buf, $len)
}
-probe syscall.lookup_dcookie.return = kernel.function("sys_lookup_dcookie").return ? {
+probe syscall.lookup_dcookie.return = kernel.function("SyS_lookup_dcookie").return !,
+ kernel.function("sys_lookup_dcookie").return ? {
name = "lookup_dcookie"
retstr = returnstr(1)
}
# lremovexattr _______________________________________________
# long sys_lremovexattr(char __user *path, char __user *name)
#
-probe syscall.lremovexattr = kernel.function("sys_lremovexattr") {
+probe syscall.lremovexattr = kernel.function("SyS_lremovexattr") !,
+ kernel.function("sys_lremovexattr") {
name = "lremovexattr"
name_uaddr = $name
name2 = user_string($name)
argstr = sprintf("%s, %s", user_string_quoted($path), user_string_quoted($name))
%)
}
-probe syscall.lremovexattr.return = kernel.function("sys_lremovexattr").return {
+probe syscall.lremovexattr.return = kernel.function("SyS_lremovexattr").return !,
+ kernel.function("sys_lremovexattr").return {
name = "lremovexattr"
retstr = returnstr(1)
}
# lseek ______________________________________________________
# off_t sys_lseek(unsigned int fd, off_t offset, unsigned int origin)
-probe syscall.lseek = kernel.function("sys_lseek") {
+probe syscall.lseek = kernel.function("SyS_lseek") !,
+ kernel.function("sys_lseek") {
name = "lseek"
fildes = $fd
# offset = __int32($offset)
whence_str = _seek_whence_str($origin)
argstr = sprintf("%d, %d, %s", $fd, offset, whence_str)
}
-probe syscall.lseek.return = kernel.function("sys_lseek").return {
+probe syscall.lseek.return = kernel.function("SyS_lseek").return !,
+ kernel.function("sys_lseek").return {
name = "lseek"
retstr = returnstr(1)
}
# size_t size,
# int flags)
#
-probe syscall.lsetxattr = kernel.function("sys_lsetxattr") {
+probe syscall.lsetxattr = kernel.function("SyS_lsetxattr") !,
+ kernel.function("sys_lsetxattr") {
name = "lsetxattr"
%( kernel_v >= "2.6.27" %?
path_uaddr = $pathname
user_string_quoted($name),
value_uaddr, $size, $flags)
}
-probe syscall.lsetxattr.return = kernel.function("sys_lsetxattr").return {
+probe syscall.lsetxattr.return = kernel.function("SyS_lsetxattr").return !,
+ kernel.function("sys_lsetxattr").return {
name = "lsetxattr"
retstr = returnstr(1)
}
#
probe syscall.lstat =
kernel.function("sys_lstat") ?,
+ kernel.function("SyS_newlstat") ?,
kernel.function("sys_newlstat") ?,
kernel.function("compat_sys_newlstat") ?,
kernel.function("sys32_lstat64") ?,
+ kernel.function("SyS_lstat64") ?,
kernel.function("sys_lstat64") ?,
kernel.function("sys_oabi_lstat64") ?
{
}
probe syscall.lstat.return =
kernel.function("sys_lstat").return ?,
+ kernel.function("SyS_newlstat").return ?,
kernel.function("sys_newlstat").return ?,
kernel.function("compat_sys_newlstat").return ?,
kernel.function("sys32_lstat64").return ?,
+ kernel.function("SyS_lstat64").return ?,
kernel.function("sys_lstat64").return ?,
kernel.function("sys_oabi_lstat64").return ?
{
# madvise ____________________________________________________
# long sys_madvise(unsigned long start, size_t len_in, int behavior)
#
-probe syscall.madvise = kernel.function("sys_madvise") ? {
+probe syscall.madvise = kernel.function("SyS_madvise") !,
+ kernel.function("sys_madvise") ? {
name = "madvise"
start = $start
length = $len_in
advice_str = _madvice_advice_str($behavior)
argstr = sprintf("%p, %d, %s", $start, $len_in, _madvice_advice_str($behavior))
}
-probe syscall.madvise.return = kernel.function("sys_madvise").return ? {
+probe syscall.madvise.return = kernel.function("SyS_madvise").return !,
+ kernel.function("sys_madvise").return ? {
name = "madvise"
retstr = returnstr(1)
}
# compat_ulong_t flags)
#
probe syscall.mbind =
- kernel.function("sys_mbind") ?,
- kernel.function("compat_sys_mbind") ?
+ kernel.function("compat_sys_mbind") ?,
+ kernel.function("SyS_mbind") !,
+ kernel.function("sys_mbind") ?
{
name = "mbind"
start = $start
$nmask, $maxnode, $flags)
}
probe syscall.mbind.return =
- kernel.function("sys_mbind").return ?,
- kernel.function("compat_sys_mbind").return ?
+ kernel.function("compat_sys_mbind").return ?,
+ kernel.function("SyS_mbind").return !,
+ kernel.function("sys_mbind").return ?
{
name = "mbind"
retstr = returnstr(1)
# long sys_migrate_pages(pid_t pid, unsigned long maxnode,
# const unsigned long __user *old_nodes,
# const unsigned long __user *new_nodes)
-probe syscall.migrate_pages = kernel.function("sys_migrate_pages") ? {
+probe syscall.migrate_pages = kernel.function("SyS_migrate_pages") !,
+ kernel.function("sys_migrate_pages") ? {
name = "migrate_pages"
argstr = sprintf("%d, %d, %p, %p", $pid, $maxnode, $old_nodes, $new_nodes)
}
-probe syscall.migrate_pages.return = kernel.function("sys_migrate_pages").return ? {
+probe syscall.migrate_pages.return = kernel.function("SyS_migrate_pages").return !,
+ kernel.function("sys_migrate_pages").return ? {
name = "migrate_pages"
retstr = returnstr(1)
}
# mincore ____________________________________________________
# long sys_mincore(unsigned long start, size_t len, unsigned char __user * vec)
#
-probe syscall.mincore = kernel.function("sys_mincore") ? {
+probe syscall.mincore = kernel.function("SyS_mincore") !,
+ kernel.function("sys_mincore") ? {
name = "mincore"
start = $start
length = $len
vec_uaddr = $vec
argstr = sprintf("%p, %d, %p", $start, $len, $vec)
}
-probe syscall.mincore.return = kernel.function("sys_mincore").return ? {
+probe syscall.mincore.return = kernel.function("SyS_mincore").return !,
+ kernel.function("sys_mincore").return ? {
name = "mincore"
retstr = returnstr(1)
}
# mkdir ______________________________________________________
# long sys_mkdir(const char __user * pathname, int mode)
-probe syscall.mkdir = kernel.function("sys_mkdir") {
+probe syscall.mkdir = kernel.function("SyS_mkdir") !,
+ kernel.function("sys_mkdir") {
name = "mkdir"
pathname_uaddr = $pathname
pathname = user_string($pathname)
mode = $mode
argstr = sprintf("%s, %#o", user_string_quoted($pathname), $mode)
}
-probe syscall.mkdir.return = kernel.function("sys_mkdir").return {
+probe syscall.mkdir.return = kernel.function("SyS_mkdir").return !,
+ kernel.function("sys_mkdir").return {
name = "mkdir"
retstr = returnstr(1)
}
# mkdirat ____________________________________________________
# new function with 2.6.16
# long sys_mkdirat(int dfd, const char __user *pathname, int mode)
-probe syscall.mkdirat = kernel.function("sys_mkdirat") ? {
+probe syscall.mkdirat = kernel.function("SyS_mkdirat") !,
+ kernel.function("sys_mkdirat") ? {
name = "mkdirat"
dirfd = $dfd
pathname = user_string($pathname)
mode = $mode
argstr = sprintf("%s, %s, %#o", _dfd_str($dfd), user_string_quoted($pathname), $mode)
}
-probe syscall.mkdirat.return = kernel.function("sys_mkdirat").return ? {
+probe syscall.mkdirat.return = kernel.function("SyS_mkdirat").return !,
+ kernel.function("sys_mkdirat").return ? {
name = "mkdirat"
retstr = returnstr(1)
}
# mknod
# long sys_mknod(const char __user * filename, int mode, unsigned dev)
-probe syscall.mknod = kernel.function("sys_mknod") {
+probe syscall.mknod = kernel.function("SyS_mknod") !,
+ kernel.function("sys_mknod") {
name = "mknod"
pathname = user_string($filename)
mode = $mode
argstr = sprintf("%s, %s, %p", user_string_quoted($filename), _mknod_mode_str($mode), dev)
}
-probe syscall.mknod.return = kernel.function("sys_mknod").return {
+probe syscall.mknod.return = kernel.function("SyS_mknod").return !,
+ kernel.function("sys_mknod").return {
name = "mknod"
retstr = returnstr(1)
}
# new function with 2.6.16
# long sys_mknodat(int dfd, const char __user *filename,
# int mode, unsigned dev)
-probe syscall.mknodat = kernel.function("sys_mknodat") ? {
+probe syscall.mknodat = kernel.function("SyS_mknodat") !,
+ kernel.function("sys_mknodat") ? {
name = "mknodat"
dfd = $dfd
dfd_str = _dfd_str($dfd)
argstr = sprintf("%s, %s, %s, %p",
dfd_str, user_string_quoted($filename), mode_str, $dev)
}
-probe syscall.mknodat.return = kernel.function("sys_mknodat").return ? {
+probe syscall.mknodat.return = kernel.function("SyS_mknodat").return !,
+ kernel.function("sys_mknodat").return ? {
name = "mknodat"
retstr = returnstr(1)
}
#
# long sys_mlock(unsigned long start, size_t len)
#
-probe syscall.mlock = kernel.function("sys_mlock") ? {
+probe syscall.mlock = kernel.function("SyS_mlock") !,
+ kernel.function("sys_mlock") ? {
name = "mlock"
addr = $start
len = $len
argstr = sprintf("%p, %d", $start, $len)
}
-probe syscall.mlock.return = kernel.function("sys_mlock").return ? {
+probe syscall.mlock.return = kernel.function("SyS_mlock").return !,
+ kernel.function("sys_mlock").return ? {
name = "mlock"
retstr = returnstr(1)
}
#
# long sys_mlockall(int flags)
#
-probe syscall.mlockall = kernel.function("sys_mlockall") ? {
+probe syscall.mlockall = kernel.function("SyS_mlockall") !,
+ kernel.function("sys_mlockall") ? {
name = "mlockall"
flags = $flags
argstr = _mlockall_flags_str($flags)
}
-probe syscall.mlockall.return = kernel.function("sys_mlockall").return ? {
+probe syscall.mlockall.return = kernel.function("SyS_mlockall").return !,
+ kernel.function("sys_mlockall").return ? {
name = "mlockall"
retstr = returnstr(1)
}
# int flags)
#
probe syscall.move_pages =
- kernel.function("sys_move_pages") ?,
- kernel.function("compat_sys_move_pages") ?
+ kernel.function("compat_sys_move_pages") ?,
+ kernel.function("SyS_move_pages") !,
+ kernel.function("sys_move_pages") ?
{
name = "move_pages"
argstr = sprintf("%d, %d, %p, %p, 0x%x", $pid, $nr_pages, $nodes, $status, $flags)
}
probe syscall.move_pages.return =
- kernel.function("sys_move_pages").return ?,
- kernel.function("compat_sys_move_pages").return ?
+ kernel.function("compat_sys_move_pages").return ?,
+ kernel.function("SyS_move_pages").return !,
+ kernel.function("sys_move_pages").return ?
{
name = "move_pages"
retstr = returnstr(1)
# unsigned long flags,
# void __user * data)
probe syscall.mount =
- kernel.function("sys_mount"),
- kernel.function("compat_sys_mount") ?
+ kernel.function("compat_sys_mount") ?,
+ kernel.function("SyS_mount") !,
+ kernel.function("sys_mount")
{
name = "mount"
source = user_string($dev_name)
mountflags_str, data)
}
probe syscall.mount.return =
- kernel.function("sys_mount").return,
- kernel.function("compat_sys_mount").return ?
+ kernel.function("compat_sys_mount").return ?,
+ kernel.function("SyS_mount").return !,
+ kernel.function("sys_mount").return
{
name = "mount"
retstr = returnstr(1)
# mprotect ___________________________________________________
# long sys_mprotect(unsigned long start, size_t len, unsigned long prot)
#
-probe syscall.mprotect = kernel.function("sys_mprotect") ? {
+probe syscall.mprotect = kernel.function("SyS_mprotect") !,
+ kernel.function("sys_mprotect") ? {
name = "mprotect"
addr = $start
len = $len
prot_str = _mprotect_prot_str($prot)
argstr = sprintf("%p, %d, %s", $start, $len, _mprotect_prot_str($prot))
}
-probe syscall.mprotect.return = kernel.function("sys_mprotect").return ? {
+probe syscall.mprotect.return = kernel.function("SyS_mprotect").return !,
+ kernel.function("sys_mprotect").return ? {
name = "mprotect"
retstr = returnstr(1)
}
# struct compat_mq_attr __user *u_omqstat)
#
probe syscall.mq_getsetattr =
- kernel.function("sys_mq_getsetattr") ?,
- kernel.function("compat_sys_mq_getsetattr") ?
+ kernel.function("compat_sys_mq_getsetattr") ?,
+ kernel.function("SyS_mq_getsetattr") !,
+ kernel.function("sys_mq_getsetattr") ?
{
name = "mq_getsetattr"
mqdes = $mqdes
argstr = sprintf("%d, %p, %p", $mqdes, $u_mqstat, $u_omqstat)
}
probe syscall.mq_getsetattr.return =
- kernel.function("sys_mq_getsetattr").return ?,
- kernel.function("compat_sys_mq_getsetattr").return ?
+ kernel.function("compat_sys_mq_getsetattr").return ?,
+ kernel.function("SyS_mq_getsetattr").return !,
+ kernel.function("sys_mq_getsetattr").return ?
{
name = "mq_getsetattr"
retstr = returnstr(1)
# long compat_sys_mq_notify(mqd_t mqdes, const struct compat_sigevent __user *u_notification)
#
probe syscall.mq_notify =
- kernel.function("sys_mq_notify") ?,
- kernel.function("compat_sys_mq_notify") ?
+ kernel.function("compat_sys_mq_notify") ?,
+ kernel.function("SyS_mq_notify") !,
+ kernel.function("sys_mq_notify") ?
{
name = "mq_notify"
mqdes = $mqdes
argstr = sprintf("%d, %p", $mqdes, $u_notification)
}
probe syscall.mq_notify.return =
- kernel.function("sys_mq_notify").return ?,
- kernel.function("compat_sys_mq_notify").return ?
+ kernel.function("compat_sys_mq_notify").return ?,
+ kernel.function("SyS_mq_notify").return !,
+ kernel.function("sys_mq_notify").return ?
{
name = "mq_notify"
retstr = returnstr(1)
# struct compat_mq_attr __user *u_attr)
#
probe syscall.mq_open =
- kernel.function("sys_mq_open") ?,
- kernel.function("compat_sys_mq_open") ?
+ kernel.function("compat_sys_mq_open") ?,
+ kernel.function("SyS_mq_open") !,
+ kernel.function("sys_mq_open") ?
{
name = "mq_open"
name_uaddr = $u_name
argstr = sprintf("%s, %s", user_string_quoted($u_name), _sys_open_flag_str($oflag))
}
probe syscall.mq_open.return =
- kernel.function("sys_mq_open").return ?,
- kernel.function("compat_sys_mq_open").return ?
+ kernel.function("compat_sys_mq_open").return ?,
+ kernel.function("SyS_mq_open").return !,
+ kernel.function("sys_mq_open").return ?
{
name = "mq_open"
retstr = returnstr(1)
# const struct compat_timespec __user *u_abs_timeout)
#
probe syscall.mq_timedreceive =
- kernel.function("sys_mq_timedreceive") ?,
- kernel.function("compat_sys_mq_timedreceive") ?
+ kernel.function("compat_sys_mq_timedreceive") ?,
+ kernel.function("SyS_mq_timedreceive") !,
+ kernel.function("sys_mq_timedreceive") ?
{
name = "mq_timedreceive"
mqdes = $mqdes
$u_msg_prio, $u_abs_timeout)
}
probe syscall.mq_timedreceive.return =
- kernel.function("sys_mq_timedreceive").return ?,
- kernel.function("compat_sys_mq_timedreceive").return ?
+ kernel.function("compat_sys_mq_timedreceive").return ?,
+ kernel.function("SyS_mq_timedreceive").return !,
+ kernel.function("sys_mq_timedreceive").return ?
{
name = "mq_timedreceive"
retstr = returnstr(1)
# const struct compat_timespec __user *u_abs_timeout)
#
probe syscall.mq_timedsend =
- kernel.function("sys_mq_timedsend") ?,
- kernel.function("compat_sys_mq_timedsend") ?
+ kernel.function("compat_sys_mq_timedsend") ?,
+ kernel.function("SyS_mq_timedsend") !,
+ kernel.function("sys_mq_timedsend") ?
{
name = "mq_timedsend"
mqdes = $mqdes
$msg_prio, $u_abs_timeout)
}
probe syscall.mq_timedsend.return =
- kernel.function("sys_mq_timedsend").return ?,
- kernel.function("compat_sys_mq_timedsend").return ?
+ kernel.function("compat_sys_mq_timedsend").return ?,
+ kernel.function("SyS_mq_timedsend").return !,
+ kernel.function("sys_mq_timedsend").return ?
{
name = "mq_timedsend"
retstr = returnstr(1)
# mq_unlink __________________________________________________
# long sys_mq_unlink(const char __user *u_name)
#
-probe syscall.mq_unlink = kernel.function("sys_mq_unlink") ? {
+probe syscall.mq_unlink = kernel.function("SyS_mq_unlink") !,
+ kernel.function("sys_mq_unlink") ? {
name = "mq_unlink"
u_name_uaddr = $u_name
u_name = user_string($u_name)
argstr = user_string_quoted($u_name)
}
-probe syscall.mq_unlink.return = kernel.function("sys_mq_unlink").return ? {
+probe syscall.mq_unlink.return = kernel.function("SyS_mq_unlink").return !,
+ kernel.function("sys_mq_unlink").return ? {
name = "mq_unlink"
retstr = returnstr(1)
}
# unsigned long new_addr)
#
probe syscall.mremap =
- kernel.function("sys_mremap") ?,
- kernel.function("ia64_mremap") ?
+ kernel.function("ia64_mremap") ?,
+ kernel.function("SyS_mremap") !,
+ kernel.function("sys_mremap") ?
{
name = "mremap"
old_address = $addr
_mremap_flags($flags), $new_addr)
}
probe syscall.mremap.return =
- kernel.function("sys_mremap").return ?,
- kernel.function("ia64_mremap").return ?
+ kernel.function("ia64_mremap").return ?,
+ kernel.function("SyS_mremap").return !,
+ kernel.function("sys_mremap").return ?
{
name = "mremap"
retstr = returnstr(2)
# msgctl _____________________________________________________
# long sys_msgctl (int msqid, int cmd, struct msqid_ds __user *buf)
#
-probe syscall.msgctl = kernel.function("sys_msgctl") ? {
+probe syscall.msgctl = kernel.function("SyS_msgctl") !,
+ kernel.function("sys_msgctl") ? {
name = "msgctl"
msqid = $msqid
cmd = $cmd
buf_uaddr = $buf
argstr = sprintf("%d, %d, %p", $msqid, $cmd, $buf)
}
-probe syscall.msgctl.return = kernel.function("sys_msgctl").return ? {
+probe syscall.msgctl.return = kernel.function("SyS_msgctl").return !,
+ kernel.function("sys_msgctl").return ? {
name = "msgctl"
retstr = returnstr(1)
}
# msgget _____________________________________________________
# long sys_msgget (key_t key, int msgflg)
#
-probe syscall.msgget = kernel.function("sys_msgget") ? {
+probe syscall.msgget = kernel.function("SyS_msgget") !,
+ kernel.function("sys_msgget") ? {
name = "msgget"
key = $key
msgflg = $msgflg
msgflg_str = _sys_open_flag_str($msgflg)
argstr = sprintf("%d, %s", $key, _sys_open_flag_str($msgflg))
}
-probe syscall.msgget.return = kernel.function("sys_msgget").return ? {
+probe syscall.msgget.return = kernel.function("SyS_msgget").return !,
+ kernel.function("sys_msgget").return ? {
name = "msgget"
retstr = returnstr(1)
}
# long msgtyp,
# int msgflg)
#
-probe syscall.msgrcv = kernel.function("sys_msgrcv") ? {
+probe syscall.msgrcv = kernel.function("SyS_msgrcv") !,
+ kernel.function("sys_msgrcv") ? {
name = "msgrcv"
msqid = $msqid
msgp_uaddr = $msgp
msgflg = $msgflg
argstr = sprintf("%d, %p, %d, %d, %d", $msqid, $msgp, $msgsz, $msgtyp, $msgflg)
}
-probe syscall.msgrcv.return = kernel.function("sys_msgrcv").return ? {
+probe syscall.msgrcv.return = kernel.function("SyS_msgrcv").return !,
+ kernel.function("sys_msgrcv").return ? {
name = "msgrcv"
retstr = returnstr(1)
}
# size_t msgsz,
# int msgflg)
#
-probe syscall.msgsnd = kernel.function("sys_msgsnd") ? {
+probe syscall.msgsnd = kernel.function("SyS_msgsnd") !,
+ kernel.function("sys_msgsnd") ? {
name = "msgsnd"
msqid = $msqid
msgp_uaddr = $msgp
msgflg = $msgflg
argstr = sprintf("%d, %p, %d, %d", $msqid, $msgp, $msgsz, $msgflg)
}
-probe syscall.msgsnd.return = kernel.function("sys_msgsnd").return ? {
+probe syscall.msgsnd.return = kernel.function("SyS_msgsnd").return !,
+ kernel.function("sys_msgsnd").return ? {
name = "msgsnd"
retstr = returnstr(1)
}
# msync ______________________________________________________
# long sys_msync(unsigned long start, size_t len, int flags)
-probe syscall.msync = kernel.function("sys_msync") ? {
+probe syscall.msync = kernel.function("SyS_msync") !,
+ kernel.function("sys_msync") ? {
name = "msync"
start = $start
length = $len
flags = $flags
argstr = sprintf("%p, %d, %s",start, length, _msync_flag_str(flags))
}
-probe syscall.msync.return = kernel.function("sys_msync").return ? {
+probe syscall.msync.return = kernel.function("SyS_msync").return !,
+ kernel.function("sys_msync").return ? {
name = "msync"
retstr = returnstr(1)
}
# munlock ____________________________________________________
# long sys_munlock(unsigned long start, size_t len)
-probe syscall.munlock = kernel.function("sys_munlock") ? {
+probe syscall.munlock = kernel.function("SyS_munlock") !,
+ kernel.function("sys_munlock") ? {
name = "munlock"
addr = $start
len = $len
argstr = sprintf("%p, %d", addr, len)
}
-probe syscall.munlock.return = kernel.function("sys_munlock").return ? {
+probe syscall.munlock.return = kernel.function("SyS_munlock").return !,
+ kernel.function("sys_munlock").return ? {
name = "munlock"
retstr = returnstr(1)
}
# munmap _____________________________________________________
# long sys_munmap(unsigned long addr, size_t len)
-probe syscall.munmap = kernel.function("sys_munmap") {
+probe syscall.munmap = kernel.function("SyS_munmap") !,
+ kernel.function("sys_munmap") {
name = "munmap"
start = $addr
length = $len
argstr = sprintf("%p, %d", start, length)
}
-probe syscall.munmap.return = kernel.function("sys_munmap").return {
+probe syscall.munmap.return = kernel.function("SyS_munmap").return !,
+ kernel.function("sys_munmap").return {
name = "munmap"
retstr = returnstr(1)
}
# long compat_sys_nanosleep(struct compat_timespec __user *rqtp,
# struct compat_timespec __user *rmtp)
#
-probe syscall.nanosleep = kernel.function("sys_nanosleep") {
+probe syscall.nanosleep = kernel.function("SyS_nanosleep") !,
+ kernel.function("sys_nanosleep") {
name = "nanosleep"
req_uaddr = $rqtp
rem_uaddr = $rmtp
argstr = sprintf("%s, %p", _struct_timespec_u($rqtp,1), $rmtp)
}
-probe syscall.nanosleep.return = kernel.function("sys_nanosleep").return {
+probe syscall.nanosleep.return = kernel.function("SyS_nanosleep").return !,
+ kernel.function("sys_nanosleep").return {
name = "nanosleep"
retstr = returnstr(1)
}
# nice _______________________________________________________
# long sys_nice(int increment)
#
-probe syscall.nice = kernel.function("sys_nice") ? {
+probe syscall.nice = kernel.function("SyS_nice") !,
+ kernel.function("sys_nice") ? {
name = "nice"
inc = $increment
argstr = sprintf("%d", $increment)
}
-probe syscall.nice.return = kernel.function("sys_nice").return ? {
+probe syscall.nice.return = kernel.function("SyS_nice").return !,
+ kernel.function("sys_nice").return ? {
name = "nice"
retstr = returnstr(1)
}
# (obsolete) long sys32_open(const char * filename, int flags, int mode)
#
probe syscall.open =
- kernel.function("sys_open") ?,
kernel.function("compat_sys_open") ?,
- kernel.function("sys32_open") ?
+ kernel.function("sys32_open") ?,
+ kernel.function("SyS_open") !,
+ kernel.function("sys_open") ?
{
name = "open"
filename = user_string($filename)
_sys_open_flag_str($flags))
}
probe syscall.open.return =
- kernel.function("sys_open").return ?,
kernel.function("compat_sys_open").return ?,
- kernel.function("sys32_open").return ?
+ kernel.function("sys32_open").return ?,
+ kernel.function("SyS_open").return !,
+ kernel.function("sys_open").return ?
{
name = "open"
retstr = returnstr(1)
# long compat_sys_openat(unsigned int dfd, const char __user *filename, int flags, int mode)
#
probe syscall.openat =
- kernel.function("sys_openat") ?,
- kernel.function("compat_sys_openat") ?
+ kernel.function("compat_sys_openat") ?,
+ kernel.function("SyS_openat") !,
+ kernel.function("sys_openat") ?
{
name = "openat"
filename = user_string($filename)
_sys_open_flag_str($flags))
}
probe syscall.openat.return =
- kernel.function("sys_openat").return ?,
- kernel.function("compat_sys_openat").return ?
+ kernel.function("compat_sys_openat").return ?,
+ kernel.function("SyS_openat").return !,
+ kernel.function("sys_openat").return ?
{
name = "openat"
retstr = returnstr(1)
# asmlinkage long
# sys_personality(u_long personality)
#
-probe syscall.personality = kernel.function("sys_personality") {
+probe syscall.personality = kernel.function("SyS_personality") !,
+ kernel.function("sys_personality") {
name = "personality"
persona = $personality
argstr = sprintf("%p", persona);
}
-probe syscall.personality.return = kernel.function("sys_personality").return {
+probe syscall.personality.return = kernel.function("SyS_personality").return !,
+ kernel.function("sys_personality").return {
name = "personality"
retstr = returnstr(1)
}
#
%(arch == "x86_64" %?
# x86_64 gcc 4.1 problem
-probe syscall.pipe = kernel.function("sys_pipe") {
+probe syscall.pipe = kernel.function("SyS_pipe") !,
+ kernel.function("sys_pipe") {
name = "pipe"
argstr = ""
}
%:
-probe syscall.pipe = kernel.function("sys_pipe") {
+probe syscall.pipe = kernel.function("SyS_pipe") !,
+ kernel.function("sys_pipe") {
name = "pipe"
%( arch == "ia64" %?
# ia64 just returns value directly, no fildes argument
%)
}
%)
-probe syscall.pipe.return = kernel.function("sys_pipe").return {
+probe syscall.pipe.return = kernel.function("SyS_pipe").return !,
+ kernel.function("sys_pipe").return {
name = "pipe"
retstr = returnstr(1)
}
#
# long sys_pivot_root(const char __user *new_root, const char __user *put_old)
#
-probe syscall.pivot_root = kernel.function("sys_pivot_root") {
+probe syscall.pivot_root = kernel.function("SyS_pivot_root") !,
+ kernel.function("sys_pivot_root") {
name = "pivot_root"
new_root_str = user_string($new_root)
old_root_str = user_string($put_old)
argstr = sprintf("%s, %s", user_string_quoted($new_root),
user_string_quoted($put_old))
}
-probe syscall.pivot_root.return = kernel.function("sys_pivot_root").return {
+probe syscall.pivot_root.return = kernel.function("SyS_pivot_root").return !,
+ kernel.function("sys_pivot_root").return {
name = "pivot_root"
retstr = returnstr(1)
}
#
# long sys_poll(struct pollfd __user * ufds, unsigned int nfds, long timeout)
#
-probe syscall.poll = kernel.function("sys_poll") {
+probe syscall.poll = kernel.function("SyS_poll") !,
+ kernel.function("sys_poll") {
name = "poll"
ufds_uaddr = $ufds
nfds = $nfds
%)
argstr = sprintf("%p, %d, %d", $ufds, $nfds, timeout)
}
-probe syscall.poll.return = kernel.function("sys_poll").return {
+probe syscall.poll.return = kernel.function("SyS_poll").return !,
+ kernel.function("sys_poll").return {
name = "poll"
retstr = returnstr(1)
}
# struct timespec __user *tsp, const sigset_t __user *sigmask,
# size_t sigsetsize)
#
-probe syscall.ppoll = kernel.function("sys_ppoll") ? {
+probe syscall.ppoll = kernel.function("SyS_ppoll") !,
+ kernel.function("sys_ppoll") ? {
name = "ppoll"
argstr = sprintf("%p, %d, %s, %p, %d",
$ufds,
$sigmask,
$sigsetsize)
}
-probe syscall.ppoll.return = kernel.function("sys_ppoll").return ? {
+probe syscall.ppoll.return = kernel.function("SyS_ppoll").return !,
+ kernel.function("sys_ppoll").return ? {
name = "ppoll"
retstr = returnstr(1)
}
# unsigned long arg4,
# unsigned long arg5)
#
-probe syscall.prctl = kernel.function("sys_prctl") {
+probe syscall.prctl = kernel.function("SyS_prctl") !,
+ kernel.function("sys_prctl") {
name = "prctl"
option = $option
arg2 = $arg2
argstr = sprintf("%p, %p, %p, %p, %p", option, arg2, arg3,
arg4, arg5)
}
-probe syscall.prctl.return = kernel.function("sys_prctl").return {
+probe syscall.prctl.return = kernel.function("SyS_prctl").return !,
+ kernel.function("sys_prctl").return {
name = "prctl"
retstr = returnstr(1)
}
# size_t count,
# loff_t pos)
#
-probe syscall.pread = kernel.function("sys_pread64") {
+probe syscall.pread = kernel.function("SyS_pread64") !,
+ kernel.function("sys_pread64") {
name = "pread"
fd = $fd
buf_uaddr = $buf
offset = $pos
argstr = sprintf("%d, %p, %d, %d", $fd, $buf, $count, $pos)
}
-probe syscall.pread.return = kernel.function("sys_pread64").return {
+probe syscall.pread.return = kernel.function("SyS_pread64").return !,
+ kernel.function("sys_pread64").return {
name = "pread"
retstr = returnstr(1)
}
# long sys_pselect6(int n, fd_set __user *inp, fd_set __user *outp,
# fd_set __user *exp, struct timespec __user *tsp, void __user *sig)
#
-probe syscall.pselect6 = kernel.function("sys_pselect6") ? {
+probe syscall.pselect6 = kernel.function("SyS_pselect6") !,
+ kernel.function("sys_pselect6") ? {
name = "pselect6"
argstr = sprintf("%d, %p, %p, %p, %s, %p", $n, $inp, $outp, $exp,
_struct_timespec_u($tsp,1), $sig)
}
-probe syscall.pselect6.return = kernel.function("sys_pselect6").return ? {
+probe syscall.pselect6.return = kernel.function("SyS_pselect6").return !,
+ kernel.function("sys_pselect6").return ? {
name = "pselect6"
retstr = returnstr(1)
}
# long addr,
# long data)
#
-probe syscall.ptrace = kernel.function("sys_ptrace") ? {
+probe syscall.ptrace = kernel.function("SyS_ptrace") !,
+ kernel.function("sys_ptrace") ? {
name = "ptrace"
request = $request
pid = $pid
data = $data
argstr = sprintf("%d, %d, %p, %p", request, pid, addr, data)
}
-probe syscall.ptrace.return = kernel.function("sys_ptrace").return ? {
+probe syscall.ptrace.return = kernel.function("SyS_ptrace").return !,
+ kernel.function("sys_ptrace").return ? {
name = "ptrace"
retstr = returnstr(1)
}
# size_t count,
# loff_t pos)
#
-probe syscall.pwrite = kernel.function("sys_pwrite64") {
+probe syscall.pwrite = kernel.function("SyS_pwrite64") !,
+ kernel.function("sys_pwrite64") {
name = "pwrite"
fd = $fd
buf_uaddr = $buf
text_strn(user_string($buf),syscall_string_trunc,1),
$count, $pos)
}
-probe syscall.pwrite.return = kernel.function("sys_pwrite64").return {
+probe syscall.pwrite.return = kernel.function("SyS_pwrite64").return !,
+ kernel.function("sys_pwrite64").return {
name = "pwrite"
retstr = returnstr(1)
}
# qid_t id,
# void __user *addr)
#
-probe syscall.quotactl = kernel.function("sys_quotactl") ? {
+probe syscall.quotactl = kernel.function("SyS_quotactl") !,
+ kernel.function("sys_quotactl") ? {
name = "quotactl"
cmd = $cmd
cmd_str = _quotactl_cmd_str($cmd)
addr_uaddr = $addr
argstr = sprintf("%s, %s, %d, %p", cmd_str, special_str, $id, $addr)
}
-probe syscall.quotactl.return = kernel.function("sys_quotactl").return ? {
+probe syscall.quotactl.return = kernel.function("SyS_quotactl").return !,
+ kernel.function("sys_quotactl").return ? {
name = "quotactl"
retstr = returnstr(1)
}
# read _______________________________________________________
# ssize_t sys_read(unsigned int fd, char __user * buf, size_t count)
-probe syscall.read = kernel.function("sys_read") {
+probe syscall.read = kernel.function("SyS_read") !,
+ kernel.function("sys_read") {
name = "read"
fd = $fd
buf_uaddr = $buf
count = $count
argstr = sprintf("%d, %p, %d", $fd, $buf, $count)
}
-probe syscall.read.return = kernel.function("sys_read").return {
+probe syscall.read.return = kernel.function("SyS_read").return !,
+ kernel.function("sys_read").return {
name = "read"
retstr = returnstr(1)
}
# loff_t offset,
# size_t count)
#
-probe syscall.readahead = kernel.function("sys_readahead") {
+probe syscall.readahead = kernel.function("SyS_readahead") !,
+ kernel.function("sys_readahead") {
name = "readahead"
fd = $fd
offset = $offset
count = $count
argstr = sprintf("%d, %p, %p", fd, offset, count)
}
-probe syscall.readahead.return = kernel.function("sys_readahead").return {
+probe syscall.readahead.return = kernel.function("SyS_readahead").return !,
+ kernel.function("sys_readahead").return {
name = "readahead"
retstr = returnstr(1)
}
# char __user * buf,
# int bufsiz)
#
-probe syscall.readlink = kernel.function("sys_readlink") {
+probe syscall.readlink = kernel.function("SyS_readlink") !,
+ kernel.function("sys_readlink") {
name = "readlink"
path = user_string($path)
buf_uaddr = $buf
argstr = sprintf("%s, %p, %d", user_string_quoted($path),
$buf, $bufsiz)
}
-probe syscall.readlink.return = kernel.function("sys_readlink").return {
+probe syscall.readlink.return = kernel.function("SyS_readlink").return !,
+ kernel.function("sys_readlink").return {
name = "readlink"
retstr = returnstr(1)
}
# char __user * buf,
# int bufsiz)
#
-probe syscall.readlinkat = kernel.function("sys_readlinkat") ? {
+probe syscall.readlinkat = kernel.function("SyS_readlinkat") !,
+ kernel.function("sys_readlinkat") ? {
name = "readlinkat"
dfd = $dfd
buf_uaddr = $buf
%)
}
-probe syscall.readlinkat.return = kernel.function("sys_readlinkat").return ? {
+probe syscall.readlinkat.return = kernel.function("SyS_readlinkat").return !,
+ kernel.function("sys_readlinkat").return ? {
name = "readlinkat"
retstr = returnstr(1)
}
# unsigned long vlen)
#
probe syscall.readv =
- kernel.function("sys_readv"),
- kernel.function("compat_sys_readv") ?
+ kernel.function("compat_sys_readv") ?,
+ kernel.function("SyS_readv") !,
+ kernel.function("sys_readv")
{
name = "readv"
vector_uaddr = $vec
%)
}
probe syscall.readv.return =
- kernel.function("sys_readv").return,
- kernel.function("compat_sys_readv").return ?
+ kernel.function("compat_sys_readv").return ?,
+ kernel.function("SyS_readv").return !,
+ kernel.function("sys_readv").return
{
name = "readv"
retstr = returnstr(1)
# unsigned int cmd,
# void __user * arg)
#
-probe syscall.reboot = kernel.function("sys_reboot") {
+probe syscall.reboot = kernel.function("SyS_reboot") !,
+ kernel.function("sys_reboot") {
name = "reboot"
magic = $magic1
magic_str = _reboot_magic_str($magic1)
argstr = sprintf("%s, %s, %s, %p", magic_str, magic2_str,
flag_str, $arg)
}
-probe syscall.reboot.return = kernel.function("sys_reboot").return {
+probe syscall.reboot.return = kernel.function("SyS_reboot").return !,
+ kernel.function("sys_reboot").return {
name = "reboot"
retstr = returnstr(1)
}
# struct sockaddr __user *addr,
# int __user *addr_len)
#
-probe syscall.recvfrom = kernel.function("sys_recvfrom") ? {
+probe syscall.recvfrom = kernel.function("SyS_recvfrom") !,
+ kernel.function("sys_recvfrom") ? {
name = "recvfrom"
s = $fd
buf_uaddr = $ubuf
argstr = sprintf("%d, %p, %d, %s, %p, %p",
$fd, $ubuf, $size, _recvflags_str($flags), $addr, $addr_len)
}
-probe syscall.recvfrom.return = kernel.function("sys_recvfrom").return ? {
+probe syscall.recvfrom.return = kernel.function("SyS_recvfrom").return !,
+ kernel.function("sys_recvfrom").return ? {
name = "recvfrom"
retstr = returnstr(1)
}
# struct msghdr __user *msg,
# unsigned int flags)
#
-probe syscall.recvmsg = kernel.function("sys_recvmsg") ? {
+probe syscall.recvmsg = kernel.function("SyS_recvmsg") !,
+ kernel.function("sys_recvmsg") ? {
name = "recvmsg"
s = $fd
msg_uaddr = $msg
flags_str = _recvflags_str($flags)
argstr = sprintf("%d, %p, %s", $fd, $msg, _recvflags_str($flags))
}
-probe syscall.recvmsg.return = kernel.function("sys_recvmsg").return ? {
+probe syscall.recvmsg.return = kernel.function("SyS_recvmsg").return !,
+ kernel.function("sys_recvmsg").return ? {
name = "recvmsg"
retstr = returnstr(1)
}
# unsigned long pgoff,
# unsigned long flags)
#
-probe syscall.remap_file_pages = kernel.function("sys_remap_file_pages") ? {
+probe syscall.remap_file_pages = kernel.function("SyS_remap_file_pages") !,
+ kernel.function("sys_remap_file_pages") ? {
name = "remap_file_pages"
start = $start
size = $size
pgoff, flags)
}
probe syscall.remap_file_pages.return =
+ kernel.function("SyS_remap_file_pages").return !,
kernel.function("sys_remap_file_pages").return ? {
name = "remap_file_pages"
retstr = returnstr(1)
# sys_removexattr(char __user *path,
# char __user *name)
#
-probe syscall.removexattr = kernel.function("sys_removexattr") {
+probe syscall.removexattr = kernel.function("SyS_removexattr") !,
+ kernel.function("sys_removexattr") {
name = "removexattr"
name_str = user_string($name)
%( kernel_v >= "2.6.27" %?
%)
}
-probe syscall.removexattr.return = kernel.function("sys_removexattr").return {
+probe syscall.removexattr.return = kernel.function("SyS_removexattr").return !,
+ kernel.function("sys_removexattr").return {
name = "removexattr"
retstr = returnstr(1)
}
# sys_rename(const char __user * oldname,
# const char __user * newname)
#
-probe syscall.rename = kernel.function("sys_rename") {
+probe syscall.rename = kernel.function("SyS_rename") !,
+ kernel.function("sys_rename") {
name = "rename"
oldpath = user_string($oldname)
newpath = user_string($newname)
argstr = sprintf("%s, %s", user_string_quoted($oldname),
user_string_quoted($newname))
}
-probe syscall.rename.return = kernel.function("sys_rename").return {
+probe syscall.rename.return = kernel.function("SyS_rename").return !,
+ kernel.function("sys_rename").return {
name = "rename"
retstr = returnstr(1)
}
# new function with 2.6.16
# long sys_renameat(int olddfd, const char __user *oldname,
# int newdfd, const char __user *newname)
-probe syscall.renameat = kernel.function("sys_renameat") ? {
+probe syscall.renameat = kernel.function("SyS_renameat") !,
+ kernel.function("sys_renameat") ? {
name = "renameat"
olddfd = $olddfd
olddfd_str = _dfd_str($olddfd)
olddfd_str, user_string_quoted($oldname),
newdfd_str, user_string_quoted($newname))
}
-probe syscall.renameat.return = kernel.function("sys_renameat").return ? {
+probe syscall.renameat.return = kernel.function("SyS_renameat").return !,
+ kernel.function("sys_renameat").return ? {
name = "renameat"
retstr = returnstr(1)
}
# key_serial_t destringid)
# compat_sys_request_key() calls sys_request_key, so don't need probe there.
#
-probe syscall.request_key = kernel.function("sys_request_key") ? {
+probe syscall.request_key = kernel.function("SyS_request_key") !,
+ kernel.function("sys_request_key") ? {
name = "request_key"
type_uaddr = $_type
description_uaddr = $_description
destringid = $destringid
argstr = sprintf("%p, %p, %p, %p", $_type, $_description, $_callout_info, $destringid)
}
-probe syscall.request_key.return = kernel.function("sys_request_key").return ? {
+probe syscall.request_key.return = kernel.function("SyS_request_key").return !,
+ kernel.function("sys_request_key").return ? {
name = "request_key"
retstr = returnstr(1)
}
# asmlinkage long
# sys_rmdir(const char __user * pathname)
#
-probe syscall.rmdir = kernel.function("sys_rmdir") {
+probe syscall.rmdir = kernel.function("SyS_rmdir") !,
+ kernel.function("sys_rmdir") {
name = "rmdir"
pathname = user_string($pathname)
argstr = user_string_quoted($pathname)
}
-probe syscall.rmdir.return = kernel.function("sys_rmdir").return {
+probe syscall.rmdir.return = kernel.function("SyS_rmdir").return !,
+ kernel.function("sys_rmdir").return {
name = "rmdir"
retstr = returnstr(1)
}
# struct sigaction __user *oact,
# size_t sigsetsize)
#
-probe syscall.rt_sigaction = kernel.function("sys_rt_sigaction") ? {
+probe syscall.rt_sigaction = kernel.function("SyS_rt_sigaction") !,
+ kernel.function("sys_rt_sigaction") ? {
name = "rt_sigaction"
sig = $sig
act_uaddr = $act
argstr = sprintf("%s, {%s}, %p, %d", _signal_name($sig),
_struct_sigaction_u($act), $oact, $sigsetsize)
}
-probe syscall.rt_sigaction.return = kernel.function("sys_rt_sigaction").return ? {
+probe syscall.rt_sigaction.return =
+ kernel.function("SyS_rt_sigaction").return !,
+ kernel.function("sys_rt_sigaction").return ? {
name = "rt_sigaction"
retstr = returnstr(1)
}
#
# long sys_rt_sigpending(sigset_t __user *set, size_t sigsetsize)
#
-probe syscall.rt_sigpending = kernel.function("sys_rt_sigpending") ? {
+probe syscall.rt_sigpending = kernel.function("SyS_rt_sigpending") !,
+ kernel.function("sys_rt_sigpending") ? {
name = "rt_sigpending"
set_uaddr = $set
sigsetsize = $sigsetsize
argstr = sprintf("%p, %d", $set, $sigsetsize)
}
-probe syscall.rt_sigpending.return = kernel.function("sys_rt_sigpending").return ? {
+probe syscall.rt_sigpending.return =
+ kernel.function("SyS_rt_sigpending").return !,
+ kernel.function("sys_rt_sigpending").return ? {
name = "rt_sigpending"
retstr = returnstr(1)
}
probe syscall.rt_sigprocmask =
kernel.function("sys32_rt_sigprocmask") ?,
kernel.function("compat_sys_rt_sigprocmask") ?,
+ kernel.function("SyS_rt_sigprocmask") !,
kernel.function("sys_rt_sigprocmask") ?
{
name = "rt_sigprocmask"
probe syscall.rt_sigprocmask.return =
kernel.function("sys32_rt_sigprocmask").return ?,
kernel.function("compat_sys_rt_sigprocmask").return ?,
+ kernel.function("SyS_rt_sigprocmask").return !,
kernel.function("sys_rt_sigprocmask").return ?
{
name = "rt_sigprocmask"
#
# long sys_rt_sigqueueinfo(int pid, int sig,siginfo_t __user *uinfo)
#
-probe syscall.rt_sigqueueinfo = kernel.function("sys_rt_sigqueueinfo") {
+probe syscall.rt_sigqueueinfo = kernel.function("SyS_rt_sigqueueinfo") !,
+ kernel.function("sys_rt_sigqueueinfo") {
name = "rt_sigqueueinfo"
pid = $pid
sig = $sig
argstr = sprintf("%d, %s, %p", $pid, _signal_name($sig), $uinfo)
}
probe syscall.rt_sigqueueinfo.return =
+ kernel.function("SyS_rt_sigqueueinfo").return !,
kernel.function("sys_rt_sigqueueinfo").return {
name = "rt_sigqueueinfo"
retstr = returnstr(1)
# sys_rt_sigsuspend(struct pt_regs regs)
#
probe syscall.rt_sigsuspend =
- kernel.function("sys_rt_sigsuspend") ?,
kernel.function("compat_sys_rt_sigsuspend") ?,
- kernel.function("ia64_rt_sigsuspend") ?
+ kernel.function("ia64_rt_sigsuspend") ?,
+ kernel.function("SyS_rt_sigsuspend") !,
+ kernel.function("sys_rt_sigsuspend") ?
{
name = "rt_sigsuspend"
argstr = ""
}
probe syscall.rt_sigsuspend.return =
- kernel.function("sys_rt_sigsuspend").return ?,
kernel.function("compat_sys_rt_sigsuspend").return ?,
- kernel.function("ia64_rt_sigsuspend").return ?
+ kernel.function("ia64_rt_sigsuspend").return ?,
+ kernel.function("SyS_rt_sigsuspend").return !,
+ kernel.function("sys_rt_sigsuspend").return ?
{
name = "rt_sigsuspend"
retstr = returnstr(1)
# struct compat_timespec __user *uts, compat_size_t sigsetsize)
#
probe syscall.rt_sigtimedwait =
- kernel.function("sys_rt_sigtimedwait"),
- kernel.function("compat_sys_rt_sigtimedwait") ?
+ kernel.function("compat_sys_rt_sigtimedwait") ?,
+ kernel.function("SyS_rt_sigtimedwait") !,
+ kernel.function("sys_rt_sigtimedwait")
{
name = "rt_sigtimedwait"
uthese_uaddr = $uthese
argstr = sprintf("%p, %p, %p, %d", $uthese, $uinfo, $uts, $sigsetsize)
}
probe syscall.rt_sigtimedwait.return =
- kernel.function("sys_rt_sigtimedwait").return,
- kernel.function("compat_sys_rt_sigtimedwait").return ?
+ kernel.function("compat_sys_rt_sigtimedwait").return ?,
+ kernel.function("SyS_rt_sigtimedwait").return !,
+ kernel.function("sys_rt_sigtimedwait").return
{
name = "rt_sigtimedwait"
retstr = returnstr(1)
# unsigned int len,
# unsigned long __user *user_mask_ptr)
#
-probe syscall.sched_getaffinity = kernel.function("sys_sched_getaffinity") {
+probe syscall.sched_getaffinity = kernel.function("SyS_sched_getaffinity") !,
+ kernel.function("sys_sched_getaffinity") {
name = "sched_getaffinity"
pid = $pid
len = $len
argstr = sprintf("%d, %p, %p", pid, len, mask_uaddr)
}
probe syscall.sched_getaffinity.return =
+ kernel.function("SyS_sched_getaffinity").return !,
kernel.function("sys_sched_getaffinity").return {
name = "sched_getaffinity"
retstr = returnstr(1)
# sys_sched_getparam(pid_t pid,
# struct sched_param __user *param)
#
-probe syscall.sched_getparam = kernel.function("sys_sched_getparam") {
+probe syscall.sched_getparam = kernel.function("SyS_sched_getparam") !,
+ kernel.function("sys_sched_getparam") {
name = "sched_getparam"
pid = $pid
p_uaddr = $param
argstr = sprintf("%d, %p", pid, p_uaddr)
}
probe syscall.sched_getparam.return =
+ kernel.function("SyS_sched_getparam").return !,
kernel.function("sys_sched_getparam").return {
name = "sched_getparam"
retstr = returnstr(1)
# sys_sched_get_priority_max(int policy)
#
probe syscall.sched_get_priority_max =
+ kernel.function("SyS_sched_get_priority_max") !,
kernel.function("sys_sched_get_priority_max") {
name = "sched_get_priority_max"
policy = $policy
argstr = sprint(policy)
}
probe syscall.sched_get_priority_max.return =
+ kernel.function("SyS_sched_get_priority_max").return !,
kernel.function("sys_sched_get_priority_max").return {
name = "sched_get_priority_max"
retstr = returnstr(1)
# sys_sched_get_priority_min(int policy)
#
probe syscall.sched_get_priority_min =
+ kernel.function("SyS_sched_get_priority_min") !,
kernel.function("sys_sched_get_priority_min") {
name = "sched_get_priority_min"
policy = $policy
argstr = sprint(policy)
}
probe syscall.sched_get_priority_min.return =
+ kernel.function("SyS_sched_get_priority_min").return !,
kernel.function("sys_sched_get_priority_min").return {
name = "sched_get_priority_min"
retstr = returnstr(1)
#
# long sys_sched_getscheduler(pid_t pid)
#
-probe syscall.sched_getscheduler = kernel.function("sys_sched_getscheduler") {
+probe syscall.sched_getscheduler = kernel.function("SyS_sched_getscheduler") !,
+ kernel.function("sys_sched_getscheduler") {
name = "sched_getscheduler"
pid = $pid
argstr = sprint($pid)
}
-probe syscall.sched_getscheduler.return = kernel.function("sys_sched_getscheduler").return {
+probe syscall.sched_getscheduler.return = kernel.function("SyS_sched_getscheduler").return !,
+ kernel.function("sys_sched_getscheduler").return {
name = "sched_getscheduler"
retstr = returnstr(1)
}
#
# long sys_sched_rr_get_interval(pid_t pid, struct timespec __user *interval)
#
-probe syscall.sched_rr_get_interval = kernel.function("sys_sched_rr_get_interval") {
+probe syscall.sched_rr_get_interval = kernel.function("SyS_sched_rr_get_interval") !,
+ kernel.function("sys_sched_rr_get_interval") {
name = "sched_rr_get_interval"
pid = $pid
tp_uaddr = $interval
argstr = sprintf("%d, %s", $pid, _struct_timespec_u($interval,1))
}
-probe syscall.sched_rr_get_interval.return = kernel.function("sys_sched_rr_get_interval").return {
+probe syscall.sched_rr_get_interval.return = kernel.function("SyS_sched_rr_get_interval").return !,
+ kernel.function("sys_sched_rr_get_interval").return {
name = "sched_rr_get_interval"
retstr = returnstr(1)
}
# FIXME: why the problem with x86_64?
#
%( arch != "x86_64" %?
-probe syscall.sched_setaffinity = kernel.function("sys_sched_setaffinity") {
+probe syscall.sched_setaffinity = kernel.function("SyS_sched_setaffinity") !,
+ kernel.function("sys_sched_setaffinity") {
name = "sched_setaffinity"
pid = $pid
len = $len
argstr = sprintf("%d, %d, %p", $pid, $len, $user_mask_ptr)
}
%:
-probe syscall.sched_setaffinity = kernel.function("sys_sched_setaffinity") {
+probe syscall.sched_setaffinity = kernel.function("SyS_sched_setaffinity") !,
+ kernel.function("sys_sched_setaffinity") {
name = "sched_setaffinity"
pid = $pid
len = 0
argstr = sprintf("%d, <unknown>, %p", $pid, $user_mask_ptr)
}
%)
-probe syscall.sched_setaffinity.return = kernel.function("sys_sched_setaffinity").return {
+probe syscall.sched_setaffinity.return = kernel.function("SyS_sched_setaffinity").return !,
+ kernel.function("sys_sched_setaffinity").return {
name = "sched_setaffinity"
retstr = returnstr(1)
}
#
# long sys_sched_setparam(pid_t pid, struct sched_param __user *param)
#
-probe syscall.sched_setparam = kernel.function("sys_sched_setparam") ? {
+probe syscall.sched_setparam = kernel.function("SyS_sched_setparam") !,
+ kernel.function("sys_sched_setparam") ? {
name = "sched_setparam"
pid = $pid
p_uaddr = $param
argstr = sprintf("%d, %p", $pid, $param)
}
-probe syscall.sched_setparam.return = kernel.function("sys_sched_setparam").return ? {
+probe syscall.sched_setparam.return =
+ kernel.function("SyS_sched_setparam").return !,
+ kernel.function("sys_sched_setparam").return ? {
name = "sched_setparam"
retstr = returnstr(1)
}
#
# long sys_sched_setscheduler(pid_t pid, int policy, struct sched_param __user *param)
#
-probe syscall.sched_setscheduler = kernel.function("sys_sched_setscheduler") ? {
+probe syscall.sched_setscheduler =
+ kernel.function("SyS_sched_setscheduler") !,
+ kernel.function("sys_sched_setscheduler") ? {
name = "sched_setscheduler"
pid = $pid
policy = $policy
p_uaddr = $param
argstr = sprintf("%d, %s, %p", $pid, policy_str, $param)
}
-probe syscall.sched_setscheduler.return = kernel.function("sys_sched_setscheduler").return ? {
+probe syscall.sched_setscheduler.return =
+ kernel.function("SyS_sched_setscheduler").return !,
+ kernel.function("sys_sched_setscheduler").return ? {
name = "sched_setscheduler"
retstr = returnstr(1)
}
# fd_set __user *exp,
# struct timeval __user *tvp)
#
-probe syscall.select = kernel.function("sys_select") {
+probe syscall.select = kernel.function("SyS_select") !,
+ kernel.function("sys_select") {
name = "select"
n = $n
readfds_uaddr = $inp
argstr = sprintf("%d, %p, %p, %p, %s", $n, $inp, $outp, $exp,
_struct_timeval_u($tvp, 1))
}
-probe syscall.select.return = kernel.function("sys_select").return {
+probe syscall.select.return = kernel.function("SyS_select").return !,
+ kernel.function("sys_select").return {
name = "select"
retstr = returnstr(1)
}
# int cmd,
# union semun arg)
#
-probe syscall.semctl = kernel.function("sys_semctl") ? {
+probe syscall.semctl = kernel.function("SyS_semctl") !,
+ kernel.function("sys_semctl") ? {
name = "semctl"
semid = $semid
semnum = $semnum
*/
argstr = sprintf("%d, %d, %s", $semid, $semnum, _semctl_cmd($cmd))
}
-probe syscall.semctl.return = kernel.function("sys_semctl").return ? {
+probe syscall.semctl.return = kernel.function("SyS_semctl").return !,
+ kernel.function("sys_semctl").return ? {
name = "semctl"
retstr = returnstr(1)
}
# semget _____________________________________________________
# long sys_semget (key_t key, int nsems, int semflg)
#
-probe syscall.semget = kernel.function("sys_semget") ? {
+probe syscall.semget = kernel.function("SyS_semget") !,
+ kernel.function("sys_semget") ? {
name = "semget"
key = $key
nsems = $nsems
semflg = $semflg
argstr = sprintf("%d, %d, %s", $key, $nsems, __sem_flags($semflg))
}
-probe syscall.semget.return = kernel.function("sys_semget").return ? {
+probe syscall.semget.return = kernel.function("SyS_semget").return !,
+ kernel.function("sys_semget").return ? {
name = "semget"
retstr = returnstr(1)
}
# struct sembuf __user *tsops,
# unsigned nsops)
#
-probe syscall.semop = kernel.function("sys_semtimedop") ? {
+probe syscall.semop = kernel.function("SyS_semtimedop") !,
+ kernel.function("sys_semtimedop") ? {
name = "semop"
semid = $semid
tsops_uaddr = $tsops
nsops = $nsops
argstr = sprintf("%d, %p, %d", $semid, $tsops, $nsops)
}
-probe syscall.semop.return = kernel.function("sys_semtimedop").return ? {
+probe syscall.semop.return = kernel.function("SyS_semtimedop").return !,
+ kernel.function("sys_semtimedop").return ? {
name = "semop"
retstr = returnstr(1)
}
# unsigned nsops,
# const struct timespec __user *timeout)
#
-probe syscall.semtimedop = kernel.function("sys_semtimedop") ? {
+probe syscall.semtimedop = kernel.function("SyS_semtimedop") !,
+ kernel.function("sys_semtimedop") ? {
name = "semtimedop"
semid = $semid
sops_uaddr = $tsops
argstr = sprintf("%d, %p, %d, %s", $semid, $tsops, $nsops,
_struct_timespec_u($timeout,1))
}
-probe syscall.semtimedop.return = kernel.function("sys_semtimedop").return ? {
+probe syscall.semtimedop.return = kernel.function("SyS_semtimedop").return !,
+ kernel.function("sys_semtimedop").return ? {
name = "semtimedop"
retstr = returnstr(1)
}
# size_t len,
# unsigned flags)
#
-probe syscall.send = kernel.function("sys_send") ? {
+probe syscall.send = kernel.function("SyS_send") !,
+ kernel.function("sys_send") ? {
name = "send"
s = $fd
buf_uaddr = $buff
flags_str = _sendflags_str($flags)
argstr = sprintf("%d, %p, %d, %s", $fd, $buff, $len, flags_str)
}
-probe syscall.send.return = kernel.function("sys_send").return ? {
+probe syscall.send.return = kernel.function("SyS_send").return !,
+ kernel.function("sys_send").return ? {
name = "send"
retstr = returnstr(1)
}
# size_t count)
#
probe syscall.sendfile =
+ kernel.function("SyS_sendfile") ?,
kernel.function("sys_sendfile") ?,
+ kernel.function("SyS_sendfile64") ?,
kernel.function("sys_sendfile64") ?
{
name = "sendfile"
$count)
}
probe syscall.sendfile.return =
+ kernel.function("SyS_sendfile").return ?,
kernel.function("sys_sendfile").return ?,
+ kernel.function("SyS_sendfile64").return ?,
kernel.function("sys_sendfile64").return ?
{
name = "sendfile"
#
# long sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags)
#
-probe syscall.sendmsg = kernel.function("sys_sendmsg") ? {
+probe syscall.sendmsg = kernel.function("SyS_sendmsg") !,
+ kernel.function("sys_sendmsg") ? {
name = "sendmsg"
s = $fd
msg_uaddr = $msg
flags_str = _sendflags_str($flags)
argstr = sprintf("%d, %p, %s", $fd, $msg, _sendflags_str($flags))
}
-probe syscall.sendmsg.return = kernel.function("sys_sendmsg").return ? {
+probe syscall.sendmsg.return = kernel.function("SyS_sendmsg").return !,
+ kernel.function("sys_sendmsg").return ? {
name = "sendmsg"
retstr = returnstr(1)
}
# struct sockaddr __user *addr,
# int addr_len)
#
-probe syscall.sendto = kernel.function("sys_sendto") ? {
+probe syscall.sendto = kernel.function("SyS_sendto") !,
+ kernel.function("sys_sendto") ? {
name = "sendto"
s = $fd
buf_uaddr = $buff
argstr = sprintf("%d, %p, %d, %s, %s, %d", $fd, $buff,
$len, flags_str, _struct_sockaddr_u($addr,$addr_len), $addr_len)
}
-probe syscall.sendto.return = kernel.function("sys_sendto").return ? {
+probe syscall.sendto.return = kernel.function("SyS_sendto").return !,
+ kernel.function("sys_sendto").return ? {
name = "sendto"
retstr = returnstr(1)
}
# sys_setdomainname(char __user *name,
# int len)
#
-probe syscall.setdomainname = kernel.function("sys_setdomainname") {
+probe syscall.setdomainname = kernel.function("SyS_setdomainname") !,
+ kernel.function("sys_setdomainname") {
name = "setdomainname"
hostname_uaddr = $name
len = $len
argstr = sprintf("%p, %d", $name, $len)
}
probe syscall.setdomainname.return =
+ kernel.function("SyS_setdomainname").return !,
kernel.function("sys_setdomainname").return {
name = "setdomainname"
retstr = returnstr(1)
# long sys_setfsgid16(old_gid_t gid)
#
probe syscall.setfsgid =
- kernel.function("sys_setfsgid") ?,
- kernel.function("sys_setfsgid16") ?
+ kernel.function("sys_setfsgid16") ?,
+ kernel.function("SyS_setfsgid") !,
+ kernel.function("sys_setfsgid") ?
{
name = "setfsgid"
fsgid = $gid
argstr = sprint($gid)
}
probe syscall.setfsgid.return =
- kernel.function("sys_setfsgid").return ?,
- kernel.function("sys_setfsgid16").return ?
+ kernel.function("sys_setfsgid16").return ?,
+ kernel.function("SyS_setfsgid").return !,
+ kernel.function("sys_setfsgid").return ?
{
name = "setfsgid"
retstr = returnstr(1)
# long sys_setfsuid16(old_uid_t uid)
#
probe syscall.setfsuid =
- kernel.function("sys_setfsuid") ?,
- kernel.function("sys_setfsuid16") ?
+ kernel.function("sys_setfsuid16") ?,
+ kernel.function("SyS_setfsuid") !,
+ kernel.function("sys_setfsuid") ?
{
name = "setfsuid"
fsuid = $uid
argstr = sprint($uid)
}
probe syscall.setfsuid.return =
- kernel.function("sys_setfsuid").return ?,
- kernel.function("sys_setfsuid16").return ?
+ kernel.function("sys_setfsuid16").return ?,
+ kernel.function("SyS_setfsuid").return !,
+ kernel.function("sys_setfsuid").return ?
{
name = "setfsuid"
retstr = returnstr(1)
# long sys_setgid16(old_gid_t gid)
#
probe syscall.setgid =
- kernel.function("sys_setgid") ?,
- kernel.function("sys_setgid16") ?
+ kernel.function("sys_setgid16") ?,
+ kernel.function("SyS_setgid") !,
+ kernel.function("sys_setgid") ?
{
name = "setgid"
gid = $gid
argstr = sprint($gid)
}
probe syscall.setgid.return =
- kernel.function("sys_setgid").return ?,
- kernel.function("sys_setgid16").return ?
+ kernel.function("sys_setgid16").return ?,
+ kernel.function("SyS_setgid").return !,
+ kernel.function("sys_setgid").return ?
{
name = "setgid"
retstr = returnstr(1)
# long sys32_setgroups16(int gidsetsize, u16 __user *grouplist)
#
probe syscall.setgroups =
- kernel.function("sys_setgroups") ?,
kernel.function("sys_setgroups16") ?,
- kernel.function("sys32_setgroups16") ?
+ kernel.function("sys32_setgroups16") ?,
+ kernel.function("SyS_setgroups") !,
+ kernel.function("sys_setgroups") ?
{
name = "setgroups"
size = $gidsetsize
argstr = sprintf("%d, %p", $gidsetsize, $grouplist)
}
probe syscall.setgroups.return =
- kernel.function("sys_setgroups").return ?,
kernel.function("sys_setgroups16").return ?,
- kernel.function("sys32_setgroups16").return ?
+ kernel.function("sys32_setgroups16").return ?,
+ kernel.function("SyS_setgroups").return !,
+ kernel.function("sys_setgroups").return ?
{
name = "setgroups"
retstr = returnstr(1)
# sys_sethostname(char __user *name,
# int len)
#
-probe syscall.sethostname = kernel.function("sys_sethostname") {
+probe syscall.sethostname = kernel.function("SyS_sethostname") !,
+ kernel.function("sys_sethostname") {
name = "sethostname"
hostname_uaddr = $name
name_str = user_string($name)
len = $len
argstr = sprintf("%s, %d", user_string_quoted($name), $len)
}
-probe syscall.sethostname.return = kernel.function("sys_sethostname").return {
+probe syscall.sethostname.return = kernel.function("SyS_sethostname").return !,
+ kernel.function("sys_sethostname").return {
name = "sethostname"
retstr = returnstr(1)
}
# struct itimerval __user *value,
# struct itimerval __user *ovalue)
#
-probe syscall.setitimer = kernel.function("sys_setitimer") {
+probe syscall.setitimer = kernel.function("SyS_setitimer") !,
+ kernel.function("sys_setitimer") {
name = "setitimer"
which = $which
value_uaddr = $value
argstr = sprintf("%s, %s, %p", _itimer_which_str($which),
_struct_itimerval_u($value), $ovalue)
}
-probe syscall.setitimer.return = kernel.function("sys_setitimer").return {
+probe syscall.setitimer.return = kernel.function("SyS_setitimer").return !,
+ kernel.function("sys_setitimer").return {
name = "setitimer"
retstr = returnstr(1)
}
# unsigned long maxnode)
#
probe syscall.set_mempolicy =
- kernel.function("sys_set_mempolicy") ?,
- kernel.function("compat_sys_set_mempolicy") ?
+ kernel.function("compat_sys_set_mempolicy") ?,
+ kernel.function("SyS_set_mempolicy") !,
+ kernel.function("sys_set_mempolicy") ?
{
name = "set_mempolicy"
mode = $mode
argstr = sprintf("%d, %p, %d", $mode, $nmask, $maxnode)
}
probe syscall.set_mempolicy.return =
- kernel.function("sys_set_mempolicy").return ?,
- kernel.function("compat_sys_set_mempolicy").return ?
+ kernel.function("compat_sys_set_mempolicy").return ?,
+ kernel.function("SyS_set_mempolicy").return !,
+ kernel.function("sys_set_mempolicy").return ?
{
name = "set_mempolicy"
retstr = returnstr(1)
# sys_setpgid(pid_t pid,
# pid_t pgid)
#
-probe syscall.setpgid = kernel.function("sys_setpgid") {
+probe syscall.setpgid = kernel.function("SyS_setpgid") !,
+ kernel.function("sys_setpgid") {
name = "setpgid"
pid = $pid
pgid = $pgid
argstr = sprintf("%d, %d", $pid, $pgid)
}
-probe syscall.setpgid.return = kernel.function("sys_setpgid").return {
+probe syscall.setpgid.return = kernel.function("SyS_setpgid").return !,
+ kernel.function("sys_setpgid").return {
name = "setpgid"
retstr = returnstr(1)
}
# int who,
# int niceval)
#
-probe syscall.setpriority = kernel.function("sys_setpriority") {
+probe syscall.setpriority = kernel.function("SyS_setpriority") !,
+ kernel.function("sys_setpriority") {
name = "setpriority"
which = $which
which_str = _priority_which_str($which)
prio = $niceval
argstr = sprintf("%s, %d, %d", which_str, $who, $niceval)
}
-probe syscall.setpriority.return = kernel.function("sys_setpriority").return {
+probe syscall.setpriority.return = kernel.function("SyS_setpriority").return !,
+ kernel.function("sys_setpriority").return {
name = "setpriority"
retstr = returnstr(1)
}
# setregid ___________________________________________________
# long sys_setregid(gid_t rgid, gid_t egid)
#
-probe syscall.setregid = kernel.function("sys_setregid") {
+probe syscall.setregid = kernel.function("SyS_setregid") !,
+ kernel.function("sys_setregid") {
name = "setregid"
rgid = __int32($rgid)
egid = __int32($egid)
argstr = sprintf("%d, %d", rgid, egid)
}
-probe syscall.setregid.return = kernel.function("sys_setregid").return {
+probe syscall.setregid.return = kernel.function("SyS_setregid").return !,
+ kernel.function("sys_setregid").return {
name = "setregid"
retstr = returnstr(1)
}
# setresgid __________________________________________________
# long sys_setresgid(gid_t rgid, gid_t egid, gid_t sgid)
#
-probe syscall.setresgid = kernel.function("sys_setresgid") {
+probe syscall.setresgid = kernel.function("SyS_setresgid") !,
+ kernel.function("sys_setresgid") {
name = "setresgid"
rgid = __int32($rgid)
egid = __int32($egid)
sgid = __int32($sgid)
argstr = sprintf("%d, %d, %d", rgid, egid, sgid)
}
-probe syscall.setresgid.return = kernel.function("sys_setresgid").return {
+probe syscall.setresgid.return = kernel.function("SyS_setresgid").return !,
+ kernel.function("sys_setresgid").return {
name = "setresgid"
retstr = returnstr(1)
}
#
# long sys_setresuid(uid_t ruid, uid_t euid, uid_t suid)
#
-probe syscall.setresuid = kernel.function("sys_setresuid") {
+probe syscall.setresuid = kernel.function("SyS_setresuid") !,
+ kernel.function("sys_setresuid") {
name = "setresuid"
ruid = __int32($ruid)
euid = __int32($euid)
suid = __int32($suid)
argstr = sprintf("%d, %d, %d", ruid, euid, suid)
}
-probe syscall.setresuid.return = kernel.function("sys_setresuid").return {
+probe syscall.setresuid.return = kernel.function("SyS_setresuid").return !,
+ kernel.function("sys_setresuid").return {
name = "setresuid"
retstr = returnstr(1)
}
# setreuid ___________________________________________________
# long sys_setreuid(uid_t ruid, uid_t euid)
#
-probe syscall.setreuid = kernel.function("sys_setreuid") {
+probe syscall.setreuid = kernel.function("SyS_setreuid") !,
+ kernel.function("sys_setreuid") {
name = "setreuid"
ruid = __int32($ruid)
euid = __int32($euid)
argstr = sprintf("%d, %d", ruid, euid)
}
-probe syscall.setreuid.return = kernel.function("sys_setreuid").return {
+probe syscall.setreuid.return = kernel.function("SyS_setreuid").return !,
+ kernel.function("sys_setreuid").return {
name = "setreuid"
retstr = returnstr(1)
}
# sys_setrlimit(unsigned int resource,
# struct rlimit __user *rlim)
#
-probe syscall.setrlimit = kernel.function("sys_setrlimit") {
+probe syscall.setrlimit = kernel.function("SyS_setrlimit") !,
+ kernel.function("sys_setrlimit") {
name = "setrlimit"
resource = $resource
rlim_uaddr = $rlim
argstr = sprintf("%s, %s", _rlimit_resource_str($resource),
_struct_rlimit_u($rlim))
}
-probe syscall.setrlimit.return = kernel.function("sys_setrlimit").return {
+probe syscall.setrlimit.return = kernel.function("SyS_setrlimit").return !,
+ kernel.function("sys_setrlimit").return {
name = "setrlimit"
retstr = returnstr(1)
}
# int optlen)
#
probe syscall.setsockopt =
- kernel.function("sys_setsockopt") ?,
- kernel.function("compat_sys_setsockopt") ?
+ kernel.function("compat_sys_setsockopt") ?,
+ kernel.function("SyS_setsockopt") !,
+ kernel.function("sys_setsockopt") ?
{
name = "setsockopt"
fd = $fd
optname_str, $optval, $optlen)
}
probe syscall.setsockopt.return =
- kernel.function("sys_setsockopt").return ?,
- kernel.function("compat_sys_setsockopt").return ?
+ kernel.function("compat_sys_setsockopt").return ?,
+ kernel.function("SyS_setsockopt").return !,
+ kernel.function("sys_setsockopt").return ?
{
name = "setsockopt"
retstr = returnstr(1)
# asmlinkage long
# sys_set_tid_address(int __user *tidptr)
#
-probe syscall.set_tid_address = kernel.function("sys_set_tid_address") {
+probe syscall.set_tid_address = kernel.function("SyS_set_tid_address") !,
+ kernel.function("sys_set_tid_address") {
name = "set_tid_address"
tidptr_uaddr = $tidptr
argstr = sprintf("%p", tidptr_uaddr)
}
probe syscall.set_tid_address.return =
+ kernel.function("SyS_set_tid_address").return !,
kernel.function("sys_set_tid_address").return {
name = "set_tid_address"
retstr = returnstr(1)
# long sys_settimeofday(struct timeval __user *tv,
# struct timezone __user *tz)
#
-probe syscall.settimeofday = kernel.function("sys_settimeofday") {
+probe syscall.settimeofday = kernel.function("SyS_settimeofday") !,
+ kernel.function("sys_settimeofday") {
name = "settimeofday"
tv_uaddr = $tv
tz_uaddr = $tz
argstr = sprintf("%s, %s", _struct_timeval_u($tv, 1), _struct_timezone_u($tz))
}
-probe syscall.settimeofday.return = kernel.function("sys_settimeofday").return {
+probe syscall.settimeofday.return = kernel.function("SyS_settimeofday").return !,
+ kernel.function("sys_settimeofday").return {
name = "settimeofday"
retstr = returnstr(1)
}
#
probe syscall.setuid =
kernel.function("sys_setuid16") ?,
+ kernel.function("SyS_setuid") !,
kernel.function("sys_setuid")
{
name = "setuid"
}
probe syscall.setuid.return =
kernel.function("sys_setuid16").return ?,
+ kernel.function("SyS_setuid").return !,
kernel.function("sys_setuid").return
{
name = "setuid"
# size_t size,
# int flags)
#
-probe syscall.setxattr = kernel.function("sys_setxattr") {
+probe syscall.setxattr = kernel.function("SyS_setxattr") !,
+ kernel.function("sys_setxattr") {
name = "setxattr"
%( kernel_v >= "2.6.27" %?
path_uaddr = $pathname
user_string_quoted($name),
value_uaddr, $size, $flags)
}
-probe syscall.setxattr.return = kernel.function("sys_setxattr").return {
+probe syscall.setxattr.return = kernel.function("SyS_setxattr").return !,
+ kernel.function("sys_setxattr").return {
name = "setxattr"
retstr = returnstr(1)
}
#
# long sys_shmat(int shmid, char __user *shmaddr, int shmflg)
#
-probe syscall.shmat = kernel.function("sys_shmat") ? {
+probe syscall.shmat = kernel.function("SyS_shmat") !,
+ kernel.function("sys_shmat") ? {
name = "shmat"
shmid = $shmid
shmaddr_uaddr = $shmaddr
shmflg = $shmflg
argstr = sprintf("%d, %p, %s", $shmid, $shmaddr, _shmat_flags_str($shmflg))
}
-probe syscall.shmat.return = kernel.function("sys_shmat").return ? {
+probe syscall.shmat.return = kernel.function("SyS_shmat").return !,
+ kernel.function("sys_shmat").return ? {
name = "shmat"
retstr = returnstr(1)
}
# int cmd,
# struct shmid_ds __user *buf)
#
-probe syscall.shmctl = kernel.function("sys_shmctl") ? {
+probe syscall.shmctl = kernel.function("SyS_shmctl") !,
+ kernel.function("sys_shmctl") ? {
name = "shmctl"
shmid = $shmid
cmd = $cmd
buf_uaddr = $buf
argstr = sprintf("%d, %s, %p", $shmid, _semctl_cmd($cmd), $buf)
}
-probe syscall.shmctl.return = kernel.function("sys_shmctl").return ? {
+probe syscall.shmctl.return = kernel.function("SyS_shmctl").return !,
+ kernel.function("sys_shmctl").return ? {
name = "shmctl"
retstr = returnstr(1)
}
#
# long sys_shmdt(char __user *shmaddr)
#
-probe syscall.shmdt = kernel.function("sys_shmdt") ? {
+probe syscall.shmdt = kernel.function("SyS_shmdt") !,
+ kernel.function("sys_shmdt") ? {
name = "shmdt"
shmaddr_uaddr = $shmaddr
argstr = sprintf("%p", $shmaddr)
}
-probe syscall.shmdt.return = kernel.function("sys_shmdt").return ? {
+probe syscall.shmdt.return = kernel.function("SyS_shmdt").return !,
+ kernel.function("sys_shmdt").return ? {
name = "shmdt"
retstr = returnstr(1)
}
# size_t size,
# int shmflg)
#
-probe syscall.shmget = kernel.function("sys_shmget") ? {
+probe syscall.shmget = kernel.function("SyS_shmget") !,
+ kernel.function("sys_shmget") ? {
name = "shmget"
key = $key
size = $size
shmflg = $shmflg
argstr = sprintf("%d, %d, %d", $key, $size, $shmflg)
}
-probe syscall.shmget.return = kernel.function("sys_shmget").return ? {
+probe syscall.shmget.return = kernel.function("SyS_shmget").return !,
+ kernel.function("sys_shmget").return ? {
name = "shmget"
retstr = returnstr(1)
}
#
# long sys_shutdown(int fd, int how)
#
-probe syscall.shutdown = kernel.function("sys_shutdown") ? {
+probe syscall.shutdown = kernel.function("SyS_shutdown") !,
+ kernel.function("sys_shutdown") ? {
name = "shutdown"
s = $fd
how = $how
how_str = _shutdown_how_str($how)
argstr = sprintf("%d, %s", $fd, how_str)
}
-probe syscall.shutdown.return = kernel.function("sys_shutdown").return ? {
+probe syscall.shutdown.return = kernel.function("SyS_shutdown").return !,
+ kernel.function("sys_shutdown").return ? {
name = "shutdown"
retstr = returnstr(1)
}
# signal _____________________________________________________
# unsigned long sys_signal(int sig, __sighandler_t handler)
#
-probe syscall.signal = kernel.function("sys_signal") ? {
+probe syscall.signal = kernel.function("SyS_signal") !,
+ kernel.function("sys_signal") ? {
name = "signal"
sig = $sig
handler = $handler
argstr = sprintf("%s, %s", _signal_name($sig), _sighandler_str($handler))
}
-probe syscall.signal.return = kernel.function("sys_signal").return ? {
+probe syscall.signal.return = kernel.function("SyS_signal").return !,
+ kernel.function("sys_signal").return ? {
name = "signal"
retstr = returnstr(1)
}
# long compat_sys_signalfd(int ufd, const compat_sigset_t __user *sigmask,
# compat_size_t sigsetsize)
#
-probe syscall.signalfd = kernel.function("sys_signalfd") ? {
+probe syscall.signalfd = kernel.function("SyS_signalfd") !,
+ kernel.function("sys_signalfd") ? {
name = "signalfd"
argstr = sprintf("%d, %p, %d", $ufd, $user_mask, $sizemask)
}
-probe syscall.signalfd.return = kernel.function("sys_signalfd").return ? {
+probe syscall.signalfd.return = kernel.function("SyS_signalfd").return !,
+ kernel.function("sys_signalfd").return ? {
name = "signalfd"
retstr = returnstr(1)
}
# sigpending _________________________________________________
# long sys_sigpending(old_sigset_t __user *set)
#
-probe syscall.sigpending = kernel.function("sys_sigpending") ? {
+probe syscall.sigpending = kernel.function("SyS_sigpending") !,
+ kernel.function("sys_sigpending") ? {
name = "sigpending"
argstr = sprintf("%p", $set)
}
-probe syscall.sigpending.return = kernel.function("sys_sigpending").return ? {
+probe syscall.sigpending.return = kernel.function("SyS_sigpending").return !,
+ kernel.function("sys_sigpending").return ? {
name = "sigpending"
retstr = returnstr(1)
}
# sigprocmask ________________________________________________
# long sys_sigprocmask(int how, old_sigset_t __user *set, old_sigset_t __user *oset)
#
-probe syscall.sigprocmask = kernel.function("sys_sigprocmask") ?
+probe syscall.sigprocmask = kernel.function("SyS_sigprocmask") !,
+ kernel.function("sys_sigprocmask") ?
{
name = "sigprocmask"
how = $how
oldset_uaddr = $oset
argstr = sprintf("%s, %p, %p", how_str, $set, $oset)
}
-probe syscall.sigprocmask.return = kernel.function("sys_sigprocmask").return ?
+probe syscall.sigprocmask.return = kernel.function("SyS_sigprocmask").return !,
+ kernel.function("sys_sigprocmask").return ?
{
name = "sigprocmask"
retstr = returnstr(1)
# socket _____________________________________________________
# long sys_socket(int family, int type, int protocol)
#
-probe syscall.socket = kernel.function("sys_socket") ? {
+probe syscall.socket = kernel.function("SyS_socket") !,
+ kernel.function("sys_socket") ? {
name = "socket"
family = $family
type = $type
_sock_type_str($type),
$protocol)
}
-probe syscall.socket.return = kernel.function("sys_socket").return ? {
+probe syscall.socket.return = kernel.function("SyS_socket").return !,
+ kernel.function("sys_socket").return ? {
name = "socket"
retstr = returnstr(1)
}
# int protocol,
# int __user *usockvec)
#
-probe syscall.socketpair = kernel.function("sys_socketpair") ? {
+probe syscall.socketpair = kernel.function("SyS_socketpair") !,
+ kernel.function("sys_socketpair") ? {
name = "socketpair"
family = $family
type = $type
_sock_type_str($type),
$protocol, sv_uaddr)
}
-probe syscall.socketpair.return = kernel.function("sys_socketpair").return ? {
+probe syscall.socketpair.return = kernel.function("SyS_socketpair").return !,
+ kernel.function("sys_socketpair").return ? {
name = "socketpair"
retstr = returnstr(1)
}
# int fd_out, loff_t __user *off_out,
# size_t len, unsigned int flags)
#
-probe syscall.splice = kernel.function("sys_splice") ? {
+probe syscall.splice = kernel.function("SyS_splice") !,
+ kernel.function("sys_splice") ? {
name = "splice"
argstr = sprintf("%d, %p, %d, %p, %d, 0x%x",
$fd_in, $off_in, $fd_out, $off_out, $len, $flags)
}
-probe syscall.splice.return = kernel.function("sys_splice").return ? {
+probe syscall.splice.return = kernel.function("SyS_splice").return !,
+ kernel.function("sys_splice").return ? {
name = "splice"
retstr = returnstr(1)
}
#
# long sys_ssetmask(int newmask)
#
-probe syscall.ssetmask = kernel.function("sys_ssetmask") ? {
+probe syscall.ssetmask = kernel.function("SyS_ssetmask") !,
+ kernel.function("sys_ssetmask") ? {
name = "ssetmask"
newmask = $newmask
argstr = sprint($newmask)
}
-probe syscall.ssetmask.return = kernel.function("sys_ssetmask").return ? {
+probe syscall.ssetmask.return = kernel.function("SyS_ssetmask").return !,
+ kernel.function("sys_ssetmask").return ? {
name = "ssetmask"
retstr = returnstr(1)
}
# long compat_sys_newstat(char __user * filename, struct compat_stat __user *statbuf)
probe syscall.stat =
kernel.function("sys_stat") ?,
+ kernel.function("SyS_newstat") ?,
kernel.function("sys_newstat") ?,
kernel.function("sys32_stat64") ?,
+ kernel.function("SyS_stat64") ?,
kernel.function("sys_stat64") ?,
kernel.function("sys_oabi_stat64") ?,
kernel.function("compat_sys_newstat") ?
}
probe syscall.stat.return =
kernel.function("sys_stat").return ?,
+ kernel.function("SyS_newstat").return ?,
kernel.function("sys_newstat").return ?,
kernel.function("sys32_stat64").return ?,
+ kernel.function("SyS_stat64").return ?,
kernel.function("sys_stat64").return ?,
kernel.function("sys_oabi_stat64").return ?,
kernel.function("compat_sys_newstat").return ?
# long compat_sys_statfs(const char __user *path, struct compat_statfs __user *buf)
#
probe syscall.statfs =
- kernel.function("sys_statfs"),
- kernel.function("compat_sys_statfs") ?
+ kernel.function("compat_sys_statfs") ?,
+ kernel.function("SyS_statfs") !,
+ kernel.function("sys_statfs") ?
{
name = "statfs"
buf_uaddr = $buf
}
probe syscall.statfs.return =
- kernel.function("sys_statfs").return,
- kernel.function("compat_sys_statfs").return ?
+ kernel.function("compat_sys_statfs").return ?,
+ kernel.function("SyS_statfs").return !,
+ kernel.function("sys_statfs").return ?
{
name = "statfs"
retstr = returnstr(1)
# long compat_sys_statfs64(const char __user *path, compat_size_t sz, struct compat_statfs64 __user *buf)
#
probe syscall.statfs64 =
- kernel.function("sys_statfs64") ?,
- kernel.function("compat_sys_statfs64") ?
+ kernel.function("compat_sys_statfs64") ?,
+ kernel.function("SyS_statfs64") !,
+ kernel.function("sys_statfs64") ?
{
name = "statfs"
sz = $sz
}
probe syscall.statfs64.return =
- kernel.function("sys_statfs64").return ?,
- kernel.function("compat_sys_statfs64").return ?
+ kernel.function("compat_sys_statfs64").return ?,
+ kernel.function("SyS_statfs64").return !,
+ kernel.function("sys_statfs64").return ?
{
name = "statfs"
retstr = returnstr(1)
# long compat_sys_stime(compat_time_t __user *tptr)
#
probe syscall.stime =
- kernel.function("sys_stime") ?,
- kernel.function("compat_sys_stime") ?
+ kernel.function("compat_sys_stime") ?,
+ kernel.function("SyS_stime") !,
+ kernel.function("sys_stime") ?
{
name = "stime"
t_uaddr = $tptr
argstr = sprintf("%p", $tptr)
}
probe syscall.stime.return =
- kernel.function("sys_stime").return ?,
- kernel.function("compat_sys_stime").return ?
+ kernel.function("compat_sys_stime").return ?,
+ kernel.function("SyS_stime").return !,
+ kernel.function("sys_stime").return ?
{
name = "stime"
retstr = returnstr(1)
# asmlinkage long
# sys_swapoff(const char __user * specialfile)
#
-probe syscall.swapoff = kernel.function("sys_swapoff")? {
+probe syscall.swapoff = kernel.function("SyS_swapoff") !,
+ kernel.function("sys_swapoff") ? {
name = "swapoff"
path = user_string($specialfile)
argstr = user_string_quoted($specialfile)
}
-probe syscall.swapoff.return = kernel.function("sys_swapoff").return ? {
+probe syscall.swapoff.return = kernel.function("SyS_swapoff").return !,
+ kernel.function("sys_swapoff").return ? {
name = "swapoff"
retstr = returnstr(1)
}
# sys_swapon(const char __user * specialfile,
# int swap_flags)
#
-probe syscall.swapon = kernel.function("sys_swapon") ? {
+probe syscall.swapon = kernel.function("SyS_swapon") !,
+ kernel.function("sys_swapon") ? {
name = "swapon"
path = user_string($specialfile)
swapflags = $swap_flags
argstr = sprintf("%s, %d", user_string_quoted($specialfile), swapflags)
}
-probe syscall.swapon.return = kernel.function("sys_swapon").return ? {
+probe syscall.swapon.return = kernel.function("SyS_swapon").return !,
+ kernel.function("sys_swapon").return ? {
name = "swapon"
retstr = returnstr(1)
}
# symlink ____________________________________________________
# long sys_symlink(const char __user * oldname,
# const char __user * newname)
-probe syscall.symlink = kernel.function("sys_symlink") {
+probe syscall.symlink = kernel.function("SyS_symlink") !,
+ kernel.function("sys_symlink") {
name = "symlink"
oldpath = user_string($oldname)
newpath = user_string($newname)
argstr = sprintf("%s, %s", user_string_quoted($oldname),
user_string_quoted($newname))
}
-probe syscall.symlink.return = kernel.function("sys_symlink").return {
+probe syscall.symlink.return = kernel.function("SyS_symlink").return !,
+ kernel.function("sys_symlink").return {
name = "symlink"
retstr = returnstr(1)
}
# new function with 2.6.16
# long sys_symlinkat(const char __user *oldname, int newdfd,
# const char __user *newname)
-probe syscall.symlinkat = kernel.function("sys_symlinkat") ? {
+probe syscall.symlinkat = kernel.function("SyS_symlinkat") !,
+ kernel.function("sys_symlinkat") ? {
name = "symlinkat"
oldname = $oldname
oldname_str = user_string($oldname)
argstr = sprintf("%s, %s, %s", user_string_quoted($oldname),
newdfd_str, user_string_quoted($newname))
}
-probe syscall.symlinkat.return = kernel.function("sys_symlinkat").return ? {
+probe syscall.symlinkat.return = kernel.function("SyS_symlinkat").return !,
+ kernel.function("sys_symlinkat").return ? {
name = "symlinkat"
retstr = returnstr(1)
}
# long sys_sysctl(struct __sysctl_args __user *args)
#
probe syscall.sysctl =
- kernel.function("sys_sysctl") ?,
- kernel.function("compat_sys_sysctl") ?
+ kernel.function("compat_sys_sysctl") ?,
+ kernel.function("SyS_sysctl") !,
+ kernel.function("sys_sysctl") ?
{
name = "sysctl"
argstr = sprintf("%p", $args)
}
probe syscall.sysctl.return =
- kernel.function("sys_sysctl").return ?,
- kernel.function("compat_sys_sysctl").return ?
+ kernel.function("compat_sys_sysctl").return ?,
+ kernel.function("SyS_sysctl").return !,
+ kernel.function("sys_sysctl").return ?
{
name = "sysctl"
retstr = returnstr(1)
# unsigned long arg1,
# unsigned long arg2)
#
-probe syscall.sysfs = kernel.function("sys_sysfs") {
+probe syscall.sysfs = kernel.function("SyS_sysfs") !,
+ kernel.function("sys_sysfs") {
name = "sysfs"
option = $option
arg1 = $arg1
else
argstr = sprintf("%d, %d, %d", $option, $arg1, $arg2)
}
-probe syscall.sysfs.return = kernel.function("sys_sysfs").return {
+probe syscall.sysfs.return = kernel.function("SyS_sysfs").return !,
+ kernel.function("sys_sysfs").return {
name = "sysfs"
retstr = returnstr(1)
}
# long sys_sysinfo(struct sysinfo __user *info)
# long compat_sys_sysinfo(struct compat_sysinfo __user *info)
probe syscall.sysinfo =
- kernel.function("sys_sysinfo"),
- kernel.function("compat_sys_sysinfo") ?
+ kernel.function("compat_sys_sysinfo") ?,
+ kernel.function("SyS_sysinfo") !,
+ kernel.function("sys_sysinfo")
{
name = "sysinfo"
info_uaddr = $info
argstr = sprintf("%p", $info)
}
probe syscall.sysinfo.return =
- kernel.function("sys_sysinfo").return,
- kernel.function("compat_sys_sysinfo").return ?
+ kernel.function("compat_sys_sysinfo").return ?,
+ kernel.function("SyS_sysinfo").return !,
+ kernel.function("sys_sysinfo").return
{
name = "sysinfo"
retstr = returnstr(1)
#
# long sys_syslog(int type, char __user * buf, int len)
#
-probe syscall.syslog = kernel.function("sys_syslog") {
+probe syscall.syslog = kernel.function("SyS_syslog") !,
+ kernel.function("sys_syslog") {
name = "syslog"
type = $type
bufp_uaddr = $buf
len = $len
argstr = sprintf("%d, %p, %d", $type, $buf, $len)
}
-probe syscall.syslog.return = kernel.function("sys_syslog").return {
+probe syscall.syslog.return = kernel.function("SyS_syslog").return !,
+ kernel.function("sys_syslog").return {
name = "syslog"
retstr = returnstr(1)
}
#
# long sys_tee(int fdin, int fdout, size_t len, unsigned int flags)
#
-probe syscall.tee = kernel.function("sys_tee") ? {
+probe syscall.tee = kernel.function("SyS_tee") !,
+ kernel.function("sys_tee") ? {
name = "tee"
argstr = sprintf("%d, %d, %d, 0x%x", $fdin, $fdout, $len, $flags)
}
-probe syscall.tee.return = kernel.function("sys_tee").return ? {
+probe syscall.tee.return = kernel.function("SyS_tee").return !,
+ kernel.function("sys_tee").return ? {
name = "tee"
retstr = returnstr(1)
}
# int pid,
# int sig)
#
-probe syscall.tgkill = kernel.function("sys_tgkill") {
+probe syscall.tgkill = kernel.function("SyS_tgkill") !,
+ kernel.function("sys_tgkill") {
name = "tgkill"
tgid = $tgid
pid = $pid
sig = $sig
argstr = sprintf("%d, %d, %s", $tgid, $pid, _signal_name($sig))
}
-probe syscall.tgkill.return = kernel.function("sys_tgkill").return {
+probe syscall.tgkill.return = kernel.function("SyS_tgkill").return !,
+ kernel.function("sys_tgkill").return {
name = "tgkill"
retstr = returnstr(1)
}
# long compat_sys_time(compat_time_t __user * tloc)
#
probe syscall.time =
- kernel.function("sys_time")?,
kernel.function("sys32_time") ?,
kernel.function("sys_time64") ?,
- kernel.function("compat_sys_time") ?
+ kernel.function("compat_sys_time") ?,
+ kernel.function("SyS_time") !,
+ kernel.function("sys_time") ?
{
name = "time"
t_uaddr = $tloc
argstr = sprintf("%p", $tloc)
}
probe syscall.time.return =
- kernel.function("sys_time").return?,
kernel.function("sys32_time").return ?,
kernel.function("sys_time64").return ?,
- kernel.function("compat_sys_time").return ?
+ kernel.function("compat_sys_time").return ?,
+ kernel.function("SyS_time").return !,
+ kernel.function("sys_time").return ?
{
name = "time"
retstr = returnstr(1)
# struct sigevent __user *timer_event_spec,
# timer_t __user * created_timer_id)
#
-probe syscall.timer_create = kernel.function("sys_timer_create") {
+probe syscall.timer_create = kernel.function("SyS_timer_create") !,
+ kernel.function("sys_timer_create") {
name = "timer_create"
clockid = $which_clock
clockid_str = _get_wc_str($which_clock)
argstr = sprintf("%s, %p, %p", clockid_str, $timer_event_spec, $created_timer_id)
}
probe syscall.timer_create.return =
+ kernel.function("SyS_timer_create").return !,
kernel.function("sys_timer_create").return {
name = "timer_create"
retstr = returnstr(1)
#
# long sys_timer_delete(timer_t timer_id)
#
-probe syscall.timer_delete = kernel.function("sys_timer_delete") {
+probe syscall.timer_delete = kernel.function("SyS_timer_delete") !,
+ kernel.function("sys_timer_delete") {
name = "timer_delete"
timerid = $timer_id
argstr = sprint($timer_id)
}
-probe syscall.timer_delete.return = kernel.function("sys_timer_delete").return {
+probe syscall.timer_delete.return = kernel.function("SyS_timer_delete").return !,
+ kernel.function("sys_timer_delete").return {
name = "timer_delete"
retstr = returnstr(1)
}
#
# long sys_timer_getoverrun(timer_t timer_id)
#
-probe syscall.timer_getoverrun = kernel.function("sys_timer_getoverrun") {
+probe syscall.timer_getoverrun = kernel.function("SyS_timer_getoverrun") !,
+ kernel.function("sys_timer_getoverrun") {
name = "timer_getoverrun"
timerid = $timer_id
argstr = sprint($timer_id)
}
probe syscall.timer_getoverrun.return =
+ kernel.function("SyS_timer_getoverrun").return !,
kernel.function("sys_timer_getoverrun").return {
name = "timer_getoverrun"
retstr = returnstr(1)
# long sys_timer_gettime(timer_t timer_id,
# struct itimerspec __user *setting)
#
-probe syscall.timer_gettime = kernel.function("sys_timer_gettime") {
+probe syscall.timer_gettime = kernel.function("SyS_timer_gettime") !,
+ kernel.function("sys_timer_gettime") {
name = "timer_gettime"
timerid = $timer_id
value_uaddr = $setting
argstr = sprintf("%d, %p", $timer_id, $setting)
}
probe syscall.timer_gettime.return =
+ kernel.function("SyS_timer_gettime").return !,
kernel.function("sys_timer_gettime").return {
name = "timer_gettime"
retstr = returnstr(1)
# const struct itimerspec __user *new_setting,
# struct itimerspec __user *old_setting)
#
-probe syscall.timer_settime = kernel.function("sys_timer_settime") {
+probe syscall.timer_settime = kernel.function("SyS_timer_settime") !,
+ kernel.function("sys_timer_settime") {
name = "timer_settime"
timerid = $timer_id
flags = $flags
$old_setting)
}
probe syscall.timer_settime.return =
+ kernel.function("SyS_timer_settime").return !,
kernel.function("sys_timer_settime").return {
name = "timer_settime"
retstr = returnstr(1)
# long sys_times(struct tms __user * tbuf)
# long compat_sys_times(struct compat_tms __user *tbuf)
probe syscall.times =
- kernel.function("sys_times") ?,
- kernel.function("compat_sys_times") ?
+ kernel.function("compat_sys_times") ?,
+ kernel.function("SyS_times") !,
+ kernel.function("sys_times") ?
{
name = "times"
argstr = sprintf("%p", $tbuf)
}
probe syscall.times.return =
- kernel.function("sys_times").return ?,
- kernel.function("compat_sys_times").return ?
+ kernel.function("compat_sys_times").return ?,
+ kernel.function("SyS_times").return !,
+ kernel.function("sys_times").return ?
{
name = "times"
retstr = returnstr(1)
# sys_tkill(int pid,
# int sig)
#
-probe syscall.tkill = kernel.function("sys_tkill") {
+probe syscall.tkill = kernel.function("SyS_tkill") !,
+ kernel.function("sys_tkill") {
name = "tkill"
pid = $pid
sig = $sig
argstr = sprintf("%d, %s", $pid, _signal_name($sig))
}
-probe syscall.tkill.return = kernel.function("sys_tkill").return {
+probe syscall.tkill.return = kernel.function("SyS_tkill").return !,
+ kernel.function("sys_tkill").return {
name = "tkill"
retstr = returnstr(1)
}
# sys_truncate(const char __user * path, unsigned long length)
# sys_truncate64(const char __user * path, loff_t length)
#
-probe syscall.truncate = kernel.function("sys_truncate")?, kernel.function("sys_truncate64") ? {
+probe syscall.truncate = kernel.function("SyS_truncate") !,
+ kernel.function("sys_truncate") ?,
+ kernel.function("sys_truncate64") ? {
name = "truncate"
path_uaddr = $path
path = user_string($path)
length = $length
argstr = sprintf("%s, %d", user_string_quoted($path), $length)
}
-probe syscall.truncate.return = kernel.function("sys_truncate").return ?, kernel.function("sys_truncate64").return ? {
+probe syscall.truncate.return = kernel.function("SyS_truncate").return !,
+ kernel.function("sys_truncate").return ?,
+ kernel.function("sys_truncate64").return ? {
name = "truncate"
retstr = returnstr(1)
}
# umask ______________________________________________________
# long sys_umask(int mask)
#
-probe syscall.umask = kernel.function("sys_umask") {
+probe syscall.umask = kernel.function("SyS_umask") !,
+ kernel.function("sys_umask") {
name = "umask"
mask = $mask
argstr = sprintf("%#o", $mask)
}
-probe syscall.umask.return = kernel.function("sys_umask").return {
+probe syscall.umask.return = kernel.function("SyS_umask").return !,
+ kernel.function("sys_umask").return {
name = "umask"
retstr = returnstr(3)
}
# umount _____________________________________________________
# long sys_umount(char __user * name, int flags)
#
-probe syscall.umount = kernel.function("sys_umount") {
+probe syscall.umount = kernel.function("SyS_umount") !,
+ kernel.function("sys_umount") {
name = "umount"
target = user_string($name)
flags = $flags
flags_str = _umountflags_str($flags)
argstr = sprintf("%s, %s", user_string_quoted($name), flags_str)
}
-probe syscall.umount.return = kernel.function("sys_umount").return {
+probe syscall.umount.return = kernel.function("SyS_umount").return !,
+ kernel.function("sys_umount").return {
name = "umount"
retstr = returnstr(1)
}
kernel.function("sys_olduname") ?,
kernel.function("sys32_olduname") ?,
kernel.function("sys32_uname") ?,
+ kernel.function("SyS_newuname") !,
kernel.function("sys_newuname") ?
{
name = "uname"
kernel.function("sys_olduname").return ?,
kernel.function("sys32_olduname").return ?,
kernel.function("sys32_uname").return ?,
+ kernel.function("SyS_newuname").return !,
kernel.function("sys_newuname").return ?
{
name = "uname"
# unlink _____________________________________________________
# long sys_unlink(const char __user * pathname)
#
-probe syscall.unlink = kernel.function("sys_unlink") {
+probe syscall.unlink = kernel.function("SyS_unlink") !,
+ kernel.function("sys_unlink") {
name = "unlink"
pathname_uaddr = $pathname
pathname = user_string($pathname)
argstr = user_string_quoted($pathname)
}
-probe syscall.unlink.return = kernel.function("sys_unlink").return {
+probe syscall.unlink.return = kernel.function("SyS_unlink").return !,
+ kernel.function("sys_unlink").return {
name = "unlink"
retstr = returnstr(1)
}
# new function with 2.6.16
# long sys_unlinkat(int dfd, const char __user *pathname,
# int flag)
-probe syscall.unlinkat = kernel.function("sys_unlinkat") ? {
+probe syscall.unlinkat = kernel.function("SyS_unlinkat") !,
+ kernel.function("sys_unlinkat") ? {
name = "unlinkat"
dfd = $dfd
dfd_str = _dfd_str($dfd)
flag_str = _at_flag_str($flag)
argstr = sprintf("%s, %s, %s", dfd_str, user_string_quoted($pathname), flag_str)
}
-probe syscall.unlinkat.return = kernel.function("sys_unlinkat").return ? {
+probe syscall.unlinkat.return = kernel.function("SyS_unlinkat").return !,
+ kernel.function("sys_unlinkat").return ? {
name = "unlinkat"
retstr = returnstr(1)
}
# unshare ____________________________________________________
# new function with 2.6.16
# long sys_unshare(unsigned long unshare_flags)
-probe syscall.unshare = kernel.function("sys_unshare") ? {
+probe syscall.unshare = kernel.function("SyS_unshare") !,
+ kernel.function("sys_unshare") ? {
name = "unshare"
unshare_flags = $unshare_flags
argstr = __fork_flags(unshare_flags)
}
-probe syscall.unshare.return = kernel.function("sys_unshare").return ? {
+probe syscall.unshare.return = kernel.function("SyS_unshare").return !,
+ kernel.function("sys_unshare").return ? {
name = "unshare"
retstr = returnstr(1)
}
# asmlinkage long
# sys_uselib(const char __user * library)
#
-probe syscall.uselib = kernel.function("sys_uselib") {
+probe syscall.uselib = kernel.function("SyS_uselib") !,
+ kernel.function("sys_uselib") {
name = "uselib"
library_uaddr = $library
library = user_string($library)
argstr = user_string_quoted($library)
}
-probe syscall.uselib.return = kernel.function("sys_uselib").return {
+probe syscall.uselib.return = kernel.function("SyS_uselib").return !,
+ kernel.function("sys_uselib").return {
name = "uselib"
retstr = returnstr(1)
}
# ustat ______________________________________________________
# long sys_ustat(unsigned dev, struct ustat __user * ubuf)
#
-probe syscall.ustat = kernel.function("sys_ustat") {
+probe syscall.ustat = kernel.function("SyS_ustat") !,
+ kernel.function("sys_ustat") {
name = "ustat"
dev = $dev
ubuf_uaddr = $ubuf
}
probe syscall.ustat.return =
- kernel.function("sys_ustat").return,
+ kernel.function("SyS_ustat").return ?,
+ kernel.function("sys_ustat").return?,
kernel.function("sys32_ustat").return ?
{
name = "ustat"
# utime ______________________________________________________
# long sys_utime(char __user * filename, struct utimbuf __user * times)
-probe syscall.utime = kernel.function("sys_utime") ? {
+probe syscall.utime = kernel.function("SyS_utime") !,
+ kernel.function("sys_utime") ? {
name = "utime"
filename_uaddr = $filename
filename = user_string($filename)
argstr = sprintf("%s, [%s, %s]", user_string_quoted($filename),
ctime(actime), ctime(modtime))
}
-probe syscall.utime.return = kernel.function("sys_utime").return ? {
+probe syscall.utime.return = kernel.function("SyS_utime").return !,
+ kernel.function("sys_utime").return ? {
name = "utime"
retstr = returnstr(1)
}
#
# long sys_utimes(char __user * filename, struct timeval __user * utimes)
#
-probe syscall.utimes = kernel.function("sys_utimes") {
+probe syscall.utimes = kernel.function("SyS_utimes") !,
+ kernel.function("sys_utimes") {
name = "utimes"
filename_uaddr = $filename
filename = user_string($filename)
argstr = sprintf("%s, %s", user_string_quoted($filename),
_struct_timeval_u($utimes, 2))
}
-probe syscall.utimes.return = kernel.function("sys_utimes").return {
+probe syscall.utimes.return = kernel.function("SyS_utimes").return !,
+ kernel.function("sys_utimes").return {
name = "utimes"
retstr = returnstr(1)
}
# long sys_utimensat(int dfd, char __user *filename, struct timespec __user *utimes, int flags)
# long compat_sys_utimensat(unsigned int dfd, char __user *filename, struct compat_timespec __user *t, int flags)
#
-probe syscall.utimensat = kernel.function("sys_utimensat") ? {
+probe syscall.utimensat = kernel.function("SyS_utimensat") !,
+ kernel.function("sys_utimensat") ? {
name = "utimensat"
argstr = sprintf("%s, %s, %s, %s", _dfd_str($dfd), user_string_quoted($filename), _struct_timespec_u($utimes,2),
_at_flag_str($flags))
argstr = sprintf("%s, %s, %s, %s", _dfd_str($dfd), user_string_quoted($filename), _struct_compat_timespec_u($t,2),
_at_flag_str($flags))
}
-probe syscall.utimensat.return = kernel.function("sys_utimensat").return ? {
+probe syscall.utimensat.return = kernel.function("SyS_utimensat").return !,
+ kernel.function("sys_utimensat").return ? {
name = "utimensat"
retstr = returnstr(1)
}
# long compat_sys_vmsplice(int fd, const struct compat_iovec __user *iov32,
# unsigned int nr_segs, unsigned int flags)
#
-probe syscall.vmsplice = kernel.function("sys_vmsplice") ? {
+probe syscall.vmsplice = kernel.function("SyS_vmsplice") !,
+ kernel.function("sys_vmsplice") ? {
name = "vmsplice"
argstr = sprintf("%d, %p, %d, 0x%x", $fd, $iov, $nr_segs, $flags)
}
name = "vmsplice"
argstr = sprintf("%d, %p, %d, 0x%x", $fd, $iov32, $nr_segs, $flags)
}
-probe syscall.vmsplice.return = kernel.function("sys_vmsplice").return ? {
+probe syscall.vmsplice.return = kernel.function("SyS_vmsplice").return !,
+ kernel.function("sys_vmsplice").return ? {
name = "vmsplice"
retstr = returnstr(1)
}
# int options,
# struct rusage __user *ru)
#
-probe syscall.wait4 = kernel.function("sys_wait4") {
+probe syscall.wait4 = kernel.function("SyS_wait4") !,
+ kernel.function("sys_wait4") {
name = "wait4"
pid = %( kernel_vr >= "2.6.25" %? $upid %: $pid%)
status_uaddr = $stat_addr
%( kernel_vr >= "2.6.25" %? $upid %: $pid%),
$stat_addr,_wait4_opt_str($options), $ru)
}
-probe syscall.wait4.return = kernel.function("sys_wait4").return {
+probe syscall.wait4.return = kernel.function("SyS_wait4").return !,
+ kernel.function("sys_wait4").return {
name = "wait4"
retstr = returnstr(1)
}
# int options,
# struct rusage __user *ru)
#
-probe syscall.waitid = kernel.function("sys_waitid") {
+probe syscall.waitid = kernel.function("SyS_waitid") !,
+ kernel.function("sys_waitid") {
name = "waitid"
pid = %( kernel_vr >= "2.6.25" %? $upid %: $pid%)
which = $which
%( kernel_vr >= "2.6.25" %? $upid %: $pid%), $infop,
_waitid_opt_str($options), $ru)
}
-probe syscall.waitid.return = kernel.function("sys_waitid").return {
+probe syscall.waitid.return = kernel.function("SyS_waitid").return !,
+ kernel.function("sys_waitid").return {
name = "waitid"
retstr = returnstr(1)
}
# int options,
# struct rusage __user *ru)
#
-probe syscall.waitpid = kernel.function("sys_wait4") {
+probe syscall.waitpid = kernel.function("SyS_wait4") !,
+ kernel.function("sys_wait4") {
name = "waitpid"
pid = $pid
status_uaddr = $stat_addr
argstr = sprintf("%d, %p, %s, %p", $pid, $stat_addr,
options_str, $ru)
}
-probe syscall.waitpid.return = kernel.function("sys_wait4").return {
+probe syscall.waitpid.return = kernel.function("SyS_wait4").return !,
+ kernel.function("sys_wait4").return {
name = "waitpid"
retstr = returnstr(1)
}
# const char __user * buf,
# size_t count)
#
-probe syscall.write = kernel.function("sys_write") {
+probe syscall.write = kernel.function("SyS_write") !,
+ kernel.function("sys_write") {
name = "write"
fd = $fd
buf_uaddr = $buf
count = $count
argstr = sprintf("%d, %s, %d", $fd, text_strn(user_string($buf),syscall_string_trunc,1), $count)
}
-probe syscall.write.return = kernel.function("sys_write").return {
+probe syscall.write.return = kernel.function("SyS_write").return !,
+ kernel.function("sys_write").return {
name = "write"
retstr = returnstr(1)
}
# unsigned long vlen)
#
probe syscall.writev =
- kernel.function("sys_writev"),
- kernel.function("compat_sys_writev") ?
+ kernel.function("compat_sys_writev") ?,
+ kernel.function("SyS_writev") !,
+ kernel.function("sys_writev")
{
name = "writev"
vector_uaddr = $vec
%)
}
probe syscall.writev.return =
- kernel.function("sys_writev").return,
- kernel.function("compat_sys_writev").return ?
+ kernel.function("compat_sys_writev").return ?,
+ kernel.function("SyS_writev").return !,
+ kernel.function("sys_writev").return
{
name = "writev"
retstr = returnstr(1)
git://sourceware.org / systemtap.git / commitdiff