}
# ftruncate __________________________________________________
# long sys_ftruncate(unsigned int fd, unsigned long length)
-probe nd_syscall.ftruncate = kprobe.function("sys_ftruncate") ?
+# COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_ulong_t, length)
+#
+probe nd_syscall.ftruncate = __nd_syscall.ftruncate,
+ __nd_syscall.compat_ftruncate ?
{
name = "ftruncate"
// fd = $fd
// length = $length
asmlinkage()
fd = int_arg(1)
- length = ulong_arg(2)
argstr = sprintf("%d, %d", fd, length)
}
-probe nd_syscall.ftruncate.return = kprobe.function("sys_ftruncate").return ?
+probe __nd_syscall.ftruncate = kprobe.function("sys_ftruncate").call
+{
+ asmlinkage()
+ length = ulong_arg(2)
+}
+probe __nd_syscall.compat_ftruncate =
+ kprobe.function("compat_sys_ftruncate").call
+{
+ asmlinkage()
+ length = uint_arg(2)
+}
+probe nd_syscall.ftruncate.return =
+ kprobe.function("sys_ftruncate").return,
+ kprobe.function("compat_sys_ftruncate").return ?
{
name = "ftruncate"
retstr = returnstr(1)
#
# sys_truncate(const char __user * path, unsigned long length)
# sys_truncate64(const char __user * path, loff_t length)
+# COMPAT_SYSCALL_DEFINE2(truncate, const char __user *, path,
+# compat_off_t, length)
#
-probe nd_syscall.truncate = __nd_syscall.truncate?, __nd_syscall.truncate64?
+probe nd_syscall.truncate = __nd_syscall.truncate ?,
+ __nd_syscall.truncate64 ?,
+ __nd_syscall.compat_truncate ?
{
name = "truncate"
// path_uaddr = $path
asmlinkage()
length = longlong_arg(2)
}
-probe nd_syscall.truncate.return = kprobe.function("sys_truncate").return ?,
- kprobe.function("sys_truncate64").return ?
+probe __nd_syscall.compat_truncate = kprobe.function("compat_sys_truncate")
+{
+ asmlinkage()
+ length = int_arg(2)
+}
+probe nd_syscall.truncate.return =
+ kprobe.function("sys_truncate").return ?,
+ kprobe.function("sys_truncate64").return ?,
+ kprobe.function("compat_sys_truncate").return ?
{
name = "truncate"
retstr = returnstr(1)
}
# ftruncate __________________________________________________
# long sys_ftruncate(unsigned int fd, unsigned long length)
-probe syscall.ftruncate = kernel.function("sys_ftruncate").call
+# COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_ulong_t, length)
+#
+probe syscall.ftruncate = kernel.function("sys_ftruncate").call,
+ kernel.function("compat_sys_ftruncate").call ?
{
name = "ftruncate"
fd = $fd
length = $length
argstr = sprintf("%d, %d", fd, length)
}
-probe syscall.ftruncate.return = kernel.function("sys_ftruncate").return
+probe syscall.ftruncate.return =
+ kernel.function("sys_ftruncate").return,
+ kernel.function("compat_sys_ftruncate").return ?
{
name = "ftruncate"
retstr = return_str(1, $return)
#
# sys_truncate(const char __user * path, unsigned long length)
# sys_truncate64(const char __user * path, loff_t length)
+# COMPAT_SYSCALL_DEFINE2(truncate, const char __user *, path,
+# compat_off_t, length)
#
probe syscall.truncate = kernel.function("sys_truncate").call ?,
- kernel.function("sys_truncate64").call ?
+ kernel.function("sys_truncate64").call ?,
+ kernel.function("compat_sys_truncate").call ?
{
name = "truncate"
path_uaddr = $path
argstr = sprintf("%s, %d", user_string_quoted($path), $length)
}
probe syscall.truncate.return = kernel.function("sys_truncate").return ?,
- kernel.function("sys_truncate64").return ?
+ kernel.function("sys_truncate64").return ?,
+ kernel.function("compat_sys_truncate").return ?
{
name = "truncate"
retstr = return_str(1, $return)