-
-# fstat ______________________________________________________
-# long sys_fstat(unsigned int fd,struct __old_kernel_stat __user * statbuf)
-probe syscall.fstat = kernel.function("sys_fstat") {
- name = "fstat"
- filedes = $fd
- buf_uaddr = $statbuf
- argstr = sprintf("%d, [%p]", filedes, buf_uaddr)
-}
-probe syscall.fstat.return = kernel.function("sys_fstat").return {
- name = "fstat"
- retstr = returnstr(1)
-}
-
# getegid16 __________________________________________________
# long sys_getegid16(void)
probe syscall.getegid16 = kernel.function("sys_getegid16") {
retstr = returnstr(1)
}
-# mmap2
-# long sys_mmap2(unsigned long addr, unsigned long len,
-# unsigned long prot, unsigned long flags,
-# unsigned long fd, unsigned long pgoff)
-probe syscall.mmap2 = kernel.function("sys_mmap2") {
- name = "mmap2"
- start = $addr
- length = $len
- prot = $prot
- flags = $flags
- fd = $fd
- pgoffset = $pgoff
- argstr = sprintf("%p, %d, %s, %s, %d, %p", start,
- length, _mprotect_prot_str(prot), _mmap_flags(flags),
- fd, pgoffset)
-}
-probe syscall.mmap2.return = kernel.function("sys_mmap2").return {
- name = "mmap2"
- retstr = returnstr(2)
-}
-
# setgroups16 ________________________________________________
#
# asmlinkage long
name = "fcntl64"
retstr = returnstr(1)
}
-# fstat64 ____________________________________________________
-# long sys_fstat64(unsigned long fd,
-# struct stat64 __user * statbuf)
-probe syscall.fstat64 = kernel.function("sys_fstat64") {
- name = "fstat64"
- fd = $fd
- buf_uaddr = $statbuf
- argstr = sprintf("%d, [%p]", $fd, $statbuf)
-}
-probe syscall.fstat64.return = kernel.function("sys_fstat64").return {
- name = "fstat64"
- retstr = returnstr(1)
-}
# get_thread_area ____________________________________________
/*
* asmlinkage int
# long sys_lstat64(char __user * filename,
# struct stat64 __user * statbuf)
probe syscall.lstat64 = kernel.function("sys_lstat64") {
- name = "lstat64"
+ name = "lstat"
filename = user_string($filename)
buf_uaddr = $statbuf
argstr = sprintf("\"%s\", [%p]", filename, $statbuf)
}
probe syscall.lstat64.return = kernel.function("sys_lstat64").return {
- name = "lstat64"
+ name = "lstat"
retstr = returnstr(1)
}
# olduname ___________________________________________________
# long sys_stat64(char __user * filename,
# struct stat64 __user * statbuf)
probe syscall.stat64 = kernel.function("sys_stat64") {
- name = "stat64"
+ name = "stat"
filename = user_string($filename)
buf_uaddr = $statbuf
argstr = sprintf("\"%s\", [%p]", filename, $statbuf)
}
probe syscall.stat64.return = kernel.function("sys_stat64").return {
- name = "stat64"
- retstr = returnstr(1)
-}
-# truncate64 _________________________________________________
-#
-# asmlinkage long
-# sys_truncate64(const char __user * path,
-# loff_t length)
-#
-probe syscall.truncate64 = kernel.function("sys_truncate64") {
- name = "truncate64"
- path_uaddr = $path
- path = user_string($path)
- length = $length
- argstr = sprintf("%s, %d", path, $length)
-}
-probe syscall.truncate64.return = kernel.function("sys_truncate64").return {
- name = "truncate64"
+ name = "stat"
retstr = returnstr(1)
}
+
# umask ______________________________________________________
/*
* asmlinkage long
retstr = returnstr(1)
}
+# fstat ______________________________________________________
+# long sys_fstat(unsigned int fd, struct __old_kernel_stat __user * statbuf)
+# long sys_fstat64(unsigned long fd, struct stat64 __user * statbuf)!run
+probe syscall.fstat = kernel.function("sys_fstat") ?, kernel.function("sys_fstat64") ? {
+ name = "fstat"
+ filedes = $fd
+ buf_uaddr = $statbuf
+ argstr = sprintf("%d, [%p]", $fd, $statbuf)
+}
+probe syscall.fstat.return = kernel.function("sys_fstat").return ?, kernel.function("sys_fstat64").return ? {
+ name = "fstat"
+ retstr = returnstr(1)
+}
+
# fstatfs ____________________________________________________
# long sys_fstatfs(unsigned int fd, struct statfs __user * buf)
probe syscall.fstatfs = kernel.function("sys_fstatfs") {
# fstatfs64 __________________________________________________
# long sys_fstatfs64(unsigned int fd, size_t sz, struct statfs64 __user *buf)
probe syscall.fstatfs64 = kernel.function("sys_fstatfs64") {
- name = "fstatfs64"
+ name = "fstatfs"
fd = $fd
sz = $sz
buf_uaddr = $buf
argstr = sprintf("%d, %d, [%p]", fd, sz, buf_uaddr)
}
probe syscall.fstatfs64.return = kernel.function("sys_fstatfs64").return {
- name = "fstatfs64.return"
+ name = "fstatfs"
retstr = returnstr(1)
}
argstr = sprint(fd)
}
probe syscall.fsync.return = kernel.function("sys_fsync").return {
- name = "fsync.return"
+ name = "fsync"
retstr = returnstr(1)
}
# ftruncate __________________________________________________
# ftruncate64 ________________________________________________
# long sys_ftruncate64(unsigned int fd, loff_t length)
probe syscall.ftruncate64 = kernel.function("sys_ftruncate64") ? {
- name = "ftruncate64"
+ name = "ftruncate"
fd = $fd
length = $length
argstr = sprintf("%d, %d", fd, length)
}
probe syscall.ftruncate64.return = kernel.function("sys_ftruncate64").return ? {
- name = "ftruncate64"
+ name = "ftruncate"
retstr = returnstr(1)
}
$val)
}
probe syscall.futex.return = kernel.function("sys_futex").return {
- name = "futex.return"
+ name = "futex"
retstr = returnstr(1)
}
# struct linux_dirent64 __user * dirent,
# unsigned int count)
probe syscall.getdents64 = kernel.function("sys_getdents64") {
- name = "getdents64"
+ name = "getdents"
fd = $fd
dirp_uaddr = $dirent
count = $count
argstr = sprintf("%d, [%p], %d", fd, dirp_uaddr, count)
}
probe syscall.getdents64.return = kernel.function("sys_getdents64").return {
- name = "getdents64"
+ name = "getdents"
retstr = returnstr(1)
}
name = "mlockall"
retstr = returnstr(1)
}
+# mmap
+# long sys_mmap(unsigned long addr, unsigned long len,
+# unsigned long prot, unsigned long flags,
+# unsigned long fd, unsigned long off)
+probe syscall.mmap = kernel.function("sys_mmap") ? {
+ name = "mmap"
+ start = $addr
+ len = $len
+ prot = $prot
+ flags = $flags
+ fd = $fd
+ offset = $off
+ argstr = sprintf("%p, %d, %s, %s, %d, %d", $addr, $len,
+ _mprotect_prot_str($prot), _mmap_flags($flags), $fd, $off)
+}
+probe syscall.mmap.return = kernel.function("sys_mmap").return ? {
+ name = "mmap"
+ retstr = returnstr(2)
+}
+
+# mmap2
+# long sys_mmap2(unsigned long addr, unsigned long len,
+# unsigned long prot, unsigned long flags,
+# unsigned long fd, unsigned long pgoff)
+probe syscall.mmap2 = kernel.function("sys_mmap2") ? {
+ name = "mmap2"
+ start = $addr
+ length = $len
+ prot = $prot
+ flags = $flags
+ fd = $fd
+ pgoffset = $pgoff
+ argstr = sprintf("%p, %d, %s, %s, %d, %d", $addr,
+ $len, _mprotect_prot_str($prot), _mmap_flags($flags),
+ $fd, $pgoff)
+}
+probe syscall.mmap2.return = kernel.function("sys_mmap2").return ? {
+ name = "mmap2"
+ retstr = returnstr(2)
+}
# modify_ldt _________________________________________________
# struct stat __user * statbuf)
#
probe syscall.newfstat = kernel.function("sys_newfstat") {
- name = "newfstat"
+ name = "fstat"
fd = $fd
buf_uaddr = $statbuf
argstr = sprintf("%d, [%p]", fd, buf_uaddr)
}
probe syscall.newfstat.return = kernel.function("sys_newfstat").return {
- name = "newfstat"
+ name = "fstat"
retstr = returnstr(1)
}
# newlstat ___________________________________________________
#
-# asmlinkage long
-# sys_newlstat(char __user * filename,
+# long sys_newlstat(char __user * filename,
# struct stat __user * statbuf)
#
probe syscall.newlstat = kernel.function("sys_newlstat") {
- name = "newlstat"
+ name = "lstat"
pathname = user_string($filename)
buf_uaddr = $statbuf
argstr = sprintf("\"%s\", [%p]", pathname, buf_uaddr)
}
probe syscall.newlstat.return = kernel.function("sys_newlstat").return {
- name = "newlstat"
+ name = "lstat"
retstr = returnstr(1)
}
# newstat ____________________________________________________
#
-# asmlinkage long
-# sys_newstat(char __user * filename,
+# long sys_newstat(char __user * filename,
# struct stat __user * statbuf)
#
probe syscall.newstat = kernel.function("sys_newstat") {
- name = "newstat"
+ name = "stat"
pathname = user_string($filename)
buf_uaddr = $statbuf
argstr = sprintf("\"%s\", [%p]", pathname, buf_uaddr)
}
probe syscall.newstat.return = kernel.function("sys_newstat").return {
- name = "newstat"
+ name = "stat"
retstr = returnstr(1)
}
# newuname ___________________________________________________
#
-# asmlinkage long
-# sys_newuname(struct new_utsname __user * name)
+# long sys_newuname(struct new_utsname __user * name)
#
probe syscall.newuname = kernel.function("sys_newuname") {
- name = "newuname"
+ name = "uname"
name_uaddr = $name
argstr = sprintf("[%p]", name_uaddr)
}
probe syscall.newuname.return = kernel.function("sys_newuname").return {
- name = "newuname"
+ name = "uname"
retstr = returnstr(1)
}
# nfsservctl _________________________________________________
}
# sendfile ___________________________________________________
#
-# asmlinkage ssize_t
-# sys_sendfile(int out_fd,
+# ssize_t sys_sendfile[64](int out_fd,
# int in_fd,
# off_t __user *offset,
# size_t count)
#
-probe syscall.sendfile = kernel.function("sys_sendfile") {
+probe syscall.sendfile = kernel.function("sys_sendfile") ?, kernel.function("sys_sendfile64") ? {
name = "sendfile"
out_fd = $out_fd
in_fd = $in_fd
argstr = sprintf("%d, %d, [%p], %d", $out_fd, $in_fd, offset_uaddr,
$count)
}
-probe syscall.sendfile.return = kernel.function("sys_sendfile").return {
+probe syscall.sendfile.return = kernel.function("sys_sendfile").return ?, kernel.function("sys_sendfile64").return ? {
name = "sendfile"
retstr = returnstr(1)
}
-# sendfile64 _________________________________________________
-#
-# asmlinkage ssize_t
-# sys_sendfile64(int out_fd,
-# int in_fd,
-# loff_t __user *offset,
-# size_t count)
-#
-probe syscall.sendfile64 = kernel.function("sys_sendfile64") {
- name = "sendfile64"
- out_fd = $out_fd
- in_fd = $in_fd
- offset_uaddr = $offset
- count = $count
- argstr = sprintf("%d, %d, [%p], %d", $out_fd, $in_fd, offset_uaddr,
- $count)
-}
-probe syscall.sendfile64.return = kernel.function("sys_sendfile64").return {
- name = "sendfile64"
- retstr = returnstr(1)
-}
+
# sendmsg ____________________________________________________
#
# asmlinkage long
name = "tkill"
retstr = returnstr(1)
}
+
# truncate ___________________________________________________
#
# asmlinkage long
-# sys_truncate(const char __user * path,
-# unsigned long length)
+# sys_truncate(const char __user * path, unsigned long length)
+# sys_truncate64(const char __user * path, loff_t length)
#
-probe syscall.truncate = kernel.function("sys_truncate") {
+probe syscall.truncate = kernel.function("sys_truncate")?, kernel.function("sys_truncate64") ? {
name = "truncate"
path_uaddr = $path
path = user_string($path)
length = $length
argstr = sprintf("\"%s\", %d", path, $length)
}
-probe syscall.truncate.return = kernel.function("sys_truncate").return {
+probe syscall.truncate.return = kernel.function("sys_truncate").return ?, kernel.function("sys_truncate64") ? {
name = "truncate"
retstr = returnstr(1)
}
+
# umount _____________________________________________________
# long sys_umount(char __user * name, int flags)
#
-# fstat ______________________________________________________
-# long sys_fstat(unsigned int fd,struct __old_kernel_stat __user * statbuf)
-probe syscall.fstat = kernel.function("sys_fstat") {
- name = "fstat"
- filedes = $fd
- buf_uaddr = $statbuf
- argstr = sprintf("%d, [%p]", filedes, buf_uaddr)
-}
-probe syscall.fstat.return = kernel.function("sys_fstat").return {
- name = "fstat"
- retstr = returnstr(1)
-}
-
# getegid16 __________________________________________________
# long sys_getegid16(void)
probe syscall.getegid16 = kernel.function("sys_getegid16") {
argstr = sprintf("%s, [%p]", file_name, buf_uaddr)
}
probe syscall.lstat.return = kernel.function("sys_lstat").return {
- name = "lstat.return"
+ name = "lstat"
retstr = returnstr(1)
}
name = "mbind"
retstr = returnstr(1)
}
-# mmap _______________________________________________________
-/*
- * long
- * sys_mmap(unsigned long addr,
- * unsigned long len,
- * unsigned long prot,
- * unsigned long flags,
- * unsigned long fd,
- * unsigned long off)
- */
-probe kernel.syscall.mmap = kernel.function("sys_mmap") {
- name = "mmap"
- addr = $addr
- len = $len
- prot = $prot
- flags = $flags
- fd = $fd
- off = $off
- argstr = sprintf("%p, %d, %d, %d, %d, %d", $addr, $len,
- $prot, $flags, $fd, $off)
-}
-probe kernel.syscall.mmap.return = kernel.function("sys_mmap").return {
- name = "mmap"
- retstr = returnstr(2)
-}
+
# rt_sigreturn _______________________________________________
/*
* asmlinkage int
name = "time64"
retstr = returnstr(1)
}
-# truncate64 _________________________________________________
-#
-# asmlinkage long
-# sys_truncate64(const char __user * path,
-# loff_t length)
-#
-probe syscall.truncate64 = kernel.function("sys_truncate64") {
- name = "truncate64"
- path_uaddr = $path
- path = user_string($path)
- length = $length
- argstr = sprintf("%s, %d", path, $length)
-}
-probe syscall.truncate64.return = kernel.function("sys_truncate64").return {
- name = "truncate64"
- retstr = returnstr(1)
-}
# tux ________________________________________________________
/*
* asmlinkage long