PR20333/acct

diff --git a/tapset/linux/nd_syscalls.stp b/tapset/linux/nd_syscalls.stp
index 7ccdb8f6d8ffb69ad75969d7fa04bd8d6e48fa5b..ab1f71221f01727a0286d4e28adcd44b31896f09 100644 (file)
--- a/tapset/linux/nd_syscalls.stp
+++ b/tapset/linux/nd_syscalls.stp
@@ -1,19 +1,4 @@
 
-# acct _______________________________________________________
-# long sys_acct(const char __user *name)
-probe nd_syscall.acct = kprobe.function("sys_acct") ?
-{
-       name = "acct"
-       asmlinkage()
-       filename = user_string_quoted(pointer_arg(1))
-       argstr = user_string_quoted(pointer_arg(1))
-}
-probe nd_syscall.acct.return = kprobe.function("sys_acct").return ?
-{
-       name = "acct"
-       retstr = returnstr(1)
-}
-
 # add_key ____________________________________________________
 # long sys_add_key(const char __user *_type,
 #             const char __user *_description,

diff --git a/tapset/linux/sysc_acct.stp b/tapset/linux/sysc_acct.stp
new file mode 100644 (file)
index 0000000..73598ed
--- /dev/null
+++ b/tapset/linux/sysc_acct.stp
@@ -0,0 +1,44 @@
+# acct _______________________________________________________
+# long sys_acct(const char __user *name)
+
+@define _SYSCALL_ACCT_NAME
+%(
+       name = "acct"
+%)
+
+@define _SYSCALL_ACCT_ARGSTR
+%(
+       argstr = filename
+%)
+
+probe syscall.acct = dw_syscall.acct !, nd_syscall.acct {}
+probe syscall.acct.return = dw_syscall.acct.return !, nd_syscall.acct.return {}
+
+# dw_acct _____________________________________________________
+
+probe dw_syscall.acct = kernel.function("sys_acct").call ?
+{
+       @_SYSCALL_ACCT_NAME
+       filename = user_string_quoted($name)
+       @_SYSCALL_ACCT_ARGSTR
+}
+probe dw_syscall.acct.return = kernel.function("sys_acct").return ?
+{
+       @_SYSCALL_ACCT_NAME
+       retstr = return_str(1, $return)
+}
+
+# nd_acct _____________________________________________________
+
+probe nd_syscall.acct = kprobe.function("sys_acct") ?
+{
+       @_SYSCALL_ACCT_NAME
+       asmlinkage()
+       filename = user_string_quoted(pointer_arg(1))
+       @_SYSCALL_ACCT_ARGSTR
+}
+probe nd_syscall.acct.return = kprobe.function("sys_acct").return ?
+{
+       @_SYSCALL_ACCT_NAME
+       retstr = returnstr(1)
+}

diff --git a/tapset/linux/syscalls.stp b/tapset/linux/syscalls.stp
index fbafbbdb43d1b788c90556621e6ce78b7ca54b68..722adbd028a5b59b6c9f4b88f1785e1d6800f8af 100644 (file)
--- a/tapset/linux/syscalls.stp
+++ b/tapset/linux/syscalls.stp
@@ -1,18 +1,4 @@
 
-# acct _______________________________________________________
-# long sys_acct(const char __user *name)
-probe syscall.acct = kernel.function("sys_acct").call ?
-{
-       name = "acct"
-       filename = user_string_quoted($name)
-       argstr = user_string_quoted($name)
-}
-probe syscall.acct.return = kernel.function("sys_acct").return ?
-{
-       name = "acct"
-       retstr = return_str(1, $return)
-}
-
 # add_key ____________________________________________________
 # long sys_add_key(const char __user *_type,
 #             const char __user *_description,