diff options
| -rw-r--r-- | tapset/nd_syscalls2.stp | 15 | ||||
| -rw-r--r-- | tapset/syscalls2.stp | 12 |
2 files changed, 25 insertions, 2 deletions
diff --git a/tapset/nd_syscalls2.stp b/tapset/nd_syscalls2.stp index 6e50d256..8b604f94 100644 --- a/tapset/nd_syscalls2.stp +++ b/tapset/nd_syscalls2.stp @@ -4134,10 +4134,23 @@ probe nd_syscall.ustat32 = kprobe.function("sys32_ustat") ? dev = uint_arg(1) argstr = sprintf("%d, %p", dev, pointer_arg(2)) } +# Since 2.6.30 sys32_ustat is called compat_sys_ustat and is now asmlinkage. +#asmlinkage long compat_sys_ustat(unsigned dev, struct compat_ustat __user *u) +probe nd_syscall.ustat32 = kprobe.function("compat_sys_ustat") ? +{ + name = "ustat" + // dev = $dev + // argstr = sprintf("%d, %p", $dev, $u) + // asmlinkage + asmlinkage() + dev = uint_arg(1) + argstr = sprintf("%d, %p", dev, pointer_arg(2)) +} probe nd_syscall.ustat.return = kprobe.function("SyS_ustat").return ?, kprobe.function("sys_ustat").return ?, - kprobe.function("sys32_ustat").return ? + kprobe.function("sys32_ustat").return ?, + kprobe.function("compat_sys_ustat").return ? { name = "ustat" retstr = returnstr(1) diff --git a/tapset/syscalls2.stp b/tapset/syscalls2.stp index defc50a0..e2be10fc 100644 --- a/tapset/syscalls2.stp +++ b/tapset/syscalls2.stp @@ -3414,10 +3414,20 @@ probe syscall.ustat32 = kernel.function("sys32_ustat") ? dev = $dev argstr = sprintf("%d, %p", $dev, $u32p) } +# Since 2.6.30 sys32_ustat is compat_sys_ustat +# Note that last argument changed name. +#long compat_sys_ustat(unsigned dev, struct compat_ustat __user *u) +probe syscall.ustat32 = kernel.function("compat_sys_ustat") ? +{ + name = "ustat" + dev = $dev + argstr = sprintf("%d, %p", $dev, $u) +} probe syscall.ustat.return = kernel.function("SyS_ustat").return ?, kernel.function("sys_ustat").return ?, - kernel.function("sys32_ustat").return ? + kernel.function("sys32_ustat").return ?, + kernel.function("compat_sys_ustat").return ? { name = "ustat" retstr = returnstr(1) |