# eventfd _____________________________________________________
# long sys_eventfd(unsigned int count)
-#
-# FIXME: doesn't handle sys_eventfd2()
-probe nd_syscall.eventfd = kprobe.function("sys_eventfd") ?
+# SYSCALL_DEFINE2(eventfd2, unsigned int, count, int, flags)
+probe nd_syscall.eventfd = __nd_syscall.eventfd2 !,
+ __nd_syscall.eventfd ?
+{
+}
+probe __nd_syscall.eventfd2 = kprobe.function("sys_eventfd2")
+{
+ asmlinkage()
+ flags = int_arg(2)
+ if (flags == 0) {
+ name = "eventfd"
+ argstr = sprint(uint_arg(1))
+ } else {
+ name = "eventfd2"
+ argstr = sprintf("%d, %s", uint_arg(1),
+ _eventfd2_flag_str(flags))
+ }
+}
+probe __nd_syscall.eventfd = kprobe.function("sys_eventfd")
{
name = "eventfd"
// argstr = sprint($count)
flags = 0
argstr = sprint(uint_arg(1))
}
-probe nd_syscall.eventfd.return = kprobe.function("sys_eventfd").return ?
+probe nd_syscall.eventfd.return = __nd_syscall.eventfd2.return !,
+ __nd_syscall.eventfd.return ?
+{
+}
+probe __nd_syscall.eventfd2.return = kprobe.function("sys_eventfd2").return
{
+ flags = @entry(__asmlinkage_int_arg(2))
+ name = flags == 0 ? "eventfd" : "eventfd2"
+ retstr = returnstr(1)
+}
+probe __nd_syscall.eventfd.return = kprobe.function("sys_eventfd").return
+{
+ flags = 0
name = "eventfd"
retstr = returnstr(1)
}