diff options
Diffstat (limited to 'tapset')
| -rw-r--r-- | tapset/syscalls.stp | 698 | ||||
| -rw-r--r-- | tapset/syscalls2.stp | 710 |
2 files changed, 704 insertions, 704 deletions
diff --git a/tapset/syscalls.stp b/tapset/syscalls.stp index 0886deeb..825842a6 100644 --- a/tapset/syscalls.stp +++ b/tapset/syscalls.stp @@ -28,8 +28,8 @@ # accept _____________________________________________________ # long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr, # int __user *upeer_addrlen) -probe syscall.accept = kernel.function("SyS_accept") !, - kernel.function("sys_accept") ? +probe syscall.accept = kernel.function("SyS_accept").call !, + kernel.function("sys_accept").call ? { name = "accept" sockfd = $fd @@ -46,8 +46,8 @@ probe syscall.accept.return = kernel.function("SyS_accept").return !, # access _____________________________________________________ # long sys_access(const char __user * filename, int mode) -probe syscall.access = kernel.function("SyS_access") !, - kernel.function("sys_access") +probe syscall.access = kernel.function("SyS_access").call !, + kernel.function("sys_access").call { name = "access" pathname = user_string($filename) @@ -64,7 +64,7 @@ probe syscall.access.return = kernel.function("SyS_access").return !, # acct _______________________________________________________ # long sys_acct(const char __user *name) -probe syscall.acct = kernel.function("sys_acct") ? +probe syscall.acct = kernel.function("sys_acct").call ? { name = "acct" filename = user_string($name) @@ -83,8 +83,8 @@ probe syscall.acct.return = kernel.function("sys_acct").return ? # size_t plen, # key_serial_t ringid) # -probe syscall.add_key = kernel.function("SyS_add_key") !, - kernel.function("sys_add_key") ? +probe syscall.add_key = kernel.function("SyS_add_key").call !, + kernel.function("sys_add_key").call ? { name = "add_key" type_uaddr = $_type @@ -107,8 +107,8 @@ probe syscall.add_key.return = kernel.function("SyS_add_key").return !, # adjtimex ___________________________________________________ # long sys_adjtimex(struct timex __user *txc_p) -probe syscall.adjtimex = kernel.function("SyS_adjtimex") !, - kernel.function("sys_adjtimex") +probe syscall.adjtimex = kernel.function("SyS_adjtimex").call !, + kernel.function("sys_adjtimex").call { name = "adjtimex" @@ -134,7 +134,7 @@ probe syscall.adjtimex.return = kernel.function("SyS_adjtimex").return !, retstr = _adjtimex_return_str($return) } # long compat_sys_adjtimex(struct compat_timex __user *utp) -probe syscall.compat_adjtimex = kernel.function("compat_sys_adjtimex") ? +probe syscall.compat_adjtimex = kernel.function("compat_sys_adjtimex").call ? { name = "compat_adjtimex" argstr = sprintf("%p", $utp) @@ -149,9 +149,9 @@ probe syscall.compat_adjtimex.return = kernel.function("compat_sys_adjtimex").re # unsigned long sys_alarm (unsigned int seconds) # long sys32_alarm(unsigned int seconds) # -probe syscall.alarm = kernel.function("sys32_alarm") ?, - kernel.function("SyS_alarm") !, - kernel.function("sys_alarm") ? +probe syscall.alarm = kernel.function("sys32_alarm").call ?, + kernel.function("SyS_alarm").call !, + kernel.function("sys_alarm").call ? { name = "alarm" seconds = $seconds @@ -167,8 +167,8 @@ probe syscall.alarm.return = kernel.function("sys32_alarm").return ?, # bdflush ____________________________________________________ # long sys_bdflush(int func, long data) -probe syscall.bdflush = kernel.function("SyS_bdflush") !, - kernel.function("sys_bdflush") ? +probe syscall.bdflush = kernel.function("SyS_bdflush").call !, + kernel.function("sys_bdflush").call ? { name = "bdflush" func = $func @@ -188,8 +188,8 @@ probe syscall.bdflush.return = kernel.function("SyS_bdflush").return !, # bind _______________________________________________________ # long sys_bind(int fd, struct sockaddr __user *umyaddr, int addrlen) -probe syscall.bind = kernel.function("SyS_bind") !, - kernel.function("sys_bind") ? +probe syscall.bind = kernel.function("SyS_bind").call !, + kernel.function("sys_bind").call ? { name = "bind" sockfd = $fd @@ -206,9 +206,9 @@ probe syscall.bind.return = kernel.function("SyS_bind").return !, # brk ________________________________________________________ # unsigned long sys_brk(unsigned long brk) -probe syscall.brk = kernel.function("ia64_brk") ?, - kernel.function("SyS_brk") !, - kernel.function("sys_brk") +probe syscall.brk = kernel.function("ia64_brk").call ?, + kernel.function("SyS_brk").call !, + kernel.function("sys_brk").call { name = "brk" brk = $brk @@ -235,8 +235,8 @@ probe syscall.brk.return = kernel.function("ia64_brk").return ?, * functions to export. */ # long sys_capget(cap_user_header_t header, cap_user_data_t dataptr) -probe syscall.capget = kernel.function("SyS_capget") !, - kernel.function("sys_capget") +probe syscall.capget = kernel.function("SyS_capget").call !, + kernel.function("sys_capget").call { name = "capget" header_uaddr = $header @@ -262,8 +262,8 @@ probe syscall.capget.return = kernel.function("SyS_capget").return !, * functions to export. */ # long sys_capset(cap_user_header_t header, const cap_user_data_t data) -probe syscall.capset = kernel.function("SyS_capset") !, - kernel.function("sys_capset") +probe syscall.capset = kernel.function("SyS_capset").call !, + kernel.function("sys_capset").call { name = "capset" header_uaddr = $header @@ -279,8 +279,8 @@ probe syscall.capset.return = kernel.function("SyS_capset").return !, # chdir ______________________________________________________ # long sys_chdir(const char __user * filename) -probe syscall.chdir = kernel.function("SyS_chdir") !, - kernel.function("sys_chdir") +probe syscall.chdir = kernel.function("SyS_chdir").call !, + kernel.function("sys_chdir").call { name = "chdir" path = user_string($filename) @@ -295,8 +295,8 @@ probe syscall.chdir.return = kernel.function("SyS_chdir").return !, # chmod ______________________________________________________ # long sys_chmod(const char __user * filename, mode_t mode) -probe syscall.chmod = kernel.function("SyS_chmod") !, - kernel.function("sys_chmod") +probe syscall.chmod = kernel.function("SyS_chmod").call !, + kernel.function("sys_chmod").call { name = "chmod" path = user_string($filename) @@ -312,8 +312,8 @@ probe syscall.chmod.return = kernel.function("SyS_chmod").return !, # chown ______________________________________________________ # long sys_chown(const char __user * filename, uid_t user, gid_t group) -probe syscall.chown = kernel.function("SyS_chown") !, - kernel.function("sys_chown") +probe syscall.chown = kernel.function("SyS_chown").call !, + kernel.function("sys_chown").call { name = "chown" path = user_string($filename) @@ -331,7 +331,7 @@ probe syscall.chown.return = kernel.function("SyS_chown").return !, # long sys_chown16(const char __user * filename, old_uid_t user, # old_gid_t group) # -probe syscall.chown16 = kernel.function("sys_chown16") ? +probe syscall.chown16 = kernel.function("sys_chown16").call ? { name = "chown16" path = user_string($filename) @@ -347,8 +347,8 @@ probe syscall.chown16.return = kernel.function("sys_chown16").return ? # chroot _____________________________________________________ # long sys_chroot(const char __user * filename) -probe syscall.chroot = kernel.function("SyS_chroot") !, - kernel.function("sys_chroot") +probe syscall.chroot = kernel.function("SyS_chroot").call !, + kernel.function("sys_chroot").call { name = "chroot" path = user_string($filename) @@ -365,9 +365,9 @@ probe syscall.chroot.return = kernel.function("SyS_chroot").return !, # long sys_clock_getres(clockid_t which_clock, struct timespec __user *tp) # long compat_clock_getres(clockid_t which_clock, struct compat_timespec __user *tp) # -probe syscall.clock_getres = kernel.function("compat_clock_getres") ?, - kernel.function("SyS_clock_getres") !, - kernel.function("sys_clock_getres") +probe syscall.clock_getres = kernel.function("compat_clock_getres").call ?, + kernel.function("SyS_clock_getres").call !, + kernel.function("sys_clock_getres").call { name = "clock_getres" clk_id = $which_clock @@ -386,8 +386,8 @@ probe syscall.clock_getres.return = kernel.function("compat_clock_getres").retur # clock_gettime ______________________________________________ # long sys_clock_gettime(clockid_t which_clock, struct timespec __user *tp) # -probe syscall.clock_gettime = kernel.function("SyS_clock_gettime") !, - kernel.function("sys_clock_gettime") +probe syscall.clock_gettime = kernel.function("SyS_clock_gettime").call !, + kernel.function("sys_clock_gettime").call { name = "clock_gettime" clk_id = $which_clock @@ -407,8 +407,8 @@ probe syscall.clock_gettime.return = kernel.function("SyS_clock_gettime").return # const struct timespec __user *rqtp, # struct timespec __user *rmtp) # -probe syscall.clock_nanosleep = kernel.function("SyS_clock_nanosleep") !, - kernel.function("sys_clock_nanosleep") +probe syscall.clock_nanosleep = kernel.function("SyS_clock_nanosleep").call !, + kernel.function("sys_clock_nanosleep").call { name = "clock_nanosleep" if ($flags == 1) @@ -430,8 +430,8 @@ probe syscall.clock_nanosleep.return = kernel.function("SyS_clock_nanosleep").re # struct compat_timespec __user *rqtp, # struct compat_timespec __user *rmtp) # -probe syscall.compat_clock_nanosleep = kernel.function("compat_clock_nanosleep") ?, - kernel.function("compat_sys_clock_nanosleep") ? +probe syscall.compat_clock_nanosleep = kernel.function("compat_clock_nanosleep").call ?, + kernel.function("compat_sys_clock_nanosleep").call ? { name = "compat_clock_nanosleep" if ($flags == 1) @@ -452,8 +452,8 @@ probe syscall.compat_clock_nanosleep.return = kernel.function("compat_clock_nano # long sys_clock_settime(clockid_t which_clock, # const struct timespec __user *tp) # -probe syscall.clock_settime = kernel.function("SyS_clock_settime") !, - kernel.function("sys_clock_settime") +probe syscall.clock_settime = kernel.function("SyS_clock_settime").call !, + kernel.function("sys_clock_settime").call { name = "clock_settime" clk_id = $which_clock @@ -470,8 +470,8 @@ probe syscall.clock_settime.return = kernel.function("SyS_clock_settime").return # close ______________________________________________________ # long sys_close(unsigned int fd) -probe syscall.close = kernel.function("SyS_close") !, - kernel.function("sys_close") +probe syscall.close = kernel.function("SyS_close").call !, + kernel.function("sys_close").call { name = "close" fd = $fd @@ -485,8 +485,8 @@ probe syscall.close.return = kernel.function("SyS_close").return !, } # connect ____________________________________________________ # long sys_connect(int fd, struct sockaddr __user *uservaddr, int addrlen) -probe syscall.connect = kernel.function("SyS_connect") !, - kernel.function("sys_connect") ? +probe syscall.connect = kernel.function("SyS_connect").call !, + kernel.function("sys_connect").call ? { name = "connect" sockfd = $fd @@ -503,8 +503,8 @@ probe syscall.connect.return = kernel.function("SyS_connect").return !, # creat # long sys_creat(const char __user * pathname, int mode) -probe syscall.creat = kernel.function("SyS_creat") !, - kernel.function("sys_creat") ? +probe syscall.creat = kernel.function("SyS_creat").call !, + kernel.function("sys_creat").call ? { name = "creat" mode = $mode @@ -520,8 +520,8 @@ probe syscall.creat.return = kernel.function("SyS_creat").return !, # delete_module ______________________________________________ # long sys_delete_module(const char __user *name_user, unsigned int flags) -probe syscall.delete_module = kernel.function("SyS_delete_module") !, - kernel.function("sys_delete_module") ? +probe syscall.delete_module = kernel.function("SyS_delete_module").call !, + kernel.function("sys_delete_module").call ? { name = "delete_module" name_user = user_string($name_user) @@ -537,8 +537,8 @@ probe syscall.delete_module.return = kernel.function("SyS_delete_module").return # dup ________________________________________________________ # long sys_dup(unsigned int fildes) -probe syscall.dup = kernel.function("SyS_dup") !, - kernel.function("sys_dup") +probe syscall.dup = kernel.function("SyS_dup").call !, + kernel.function("sys_dup").call { name = "dup" oldfd = $fildes @@ -553,8 +553,8 @@ probe syscall.dup.return = kernel.function("SyS_dup").return !, # dup2 _______________________________________________________ # long sys_dup2(unsigned int oldfd, unsigned int newfd) -probe syscall.dup2 = kernel.function("SyS_dup2") !, - kernel.function("sys_dup2") +probe syscall.dup2 = kernel.function("SyS_dup2").call !, + kernel.function("sys_dup2").call { name = "dup2" oldfd = $oldfd @@ -570,8 +570,8 @@ probe syscall.dup2.return = kernel.function("SyS_dup2").return !, # epoll_create _______________________________________________ # long sys_epoll_create(int size) -probe syscall.epoll_create = kernel.function("SyS_epoll_create") !, - kernel.function("sys_epoll_create") ? +probe syscall.epoll_create = kernel.function("SyS_epoll_create").call !, + kernel.function("sys_epoll_create").call ? { name = "epoll_create" size = $size @@ -590,9 +590,9 @@ probe syscall.epoll_create.return = kernel.function("SyS_epoll_create").return ! # long compat_sys_epoll_ctl(int epfd, int op, int fd, # struct compat_epoll_event __user *event) # -probe syscall.epoll_ctl = kernel.function("compat_sys_epoll_ctl") ?, - kernel.function("SyS_epoll_ctl") !, - kernel.function("sys_epoll_ctl") ? +probe syscall.epoll_ctl = kernel.function("compat_sys_epoll_ctl").call ?, + kernel.function("SyS_epoll_ctl").call !, + kernel.function("sys_epoll_ctl").call ? { name = "epoll_ctl" epfd = $epfd @@ -621,9 +621,9 @@ probe syscall.epoll_ctl.return = kernel.function("compat_sys_epoll_ctl").return # const compat_sigset_t __user *sigmask, # compat_size_t sigsetsize) # -probe syscall.epoll_pwait = kernel.function("compat_sys_epoll_pwait") ?, - kernel.function("SyS_epoll_pwait") !, - kernel.function("sys_epoll_pwait") ? +probe syscall.epoll_pwait = kernel.function("compat_sys_epoll_pwait").call ?, + kernel.function("SyS_epoll_pwait").call !, + kernel.function("sys_epoll_pwait").call ? { name = "epoll_pwait" argstr = sprintf("%d, %p, %d, %d, %p, %d", @@ -645,9 +645,9 @@ probe syscall.epoll_pwait.return = kernel.function("compat_sys_epoll_pwait").ret # struct compat_epoll_event __user *events, # int maxevents, int timeout) # -probe syscall.epoll_wait = kernel.function("compat_sys_epoll_wait") ?, - kernel.function("SyS_epoll_wait") !, - kernel.function("sys_epoll_wait") ? +probe syscall.epoll_wait = kernel.function("compat_sys_epoll_wait").call ?, + kernel.function("SyS_epoll_wait").call !, + kernel.function("sys_epoll_wait").call ? { name = "epoll_wait" epfd = $epfd @@ -667,8 +667,8 @@ probe syscall.epoll_wait.return = kernel.function("compat_sys_epoll_wait").retur # eventfd _____________________________________________________ # long sys_eventfd(unsigned int count) # -probe syscall.eventfd = kernel.function("SyS_eventfd") !, - kernel.function("sys_eventfd") ? +probe syscall.eventfd = kernel.function("SyS_eventfd").call !, + kernel.function("sys_eventfd").call ? { name = "eventfd" argstr = sprint($count) @@ -687,7 +687,7 @@ probe syscall.eventfd.return = kernel.function("SyS_eventfd").return !, # char __user *__user *argv, # char __user *__user *envp, # struct pt_regs * regs) -probe syscall.execve = kernel.function("do_execve") +probe syscall.execve = kernel.function("do_execve").call { name = "execve" filename = kernel_string($filename) @@ -705,7 +705,7 @@ probe syscall.execve.return = kernel.function("do_execve").return # compat_uptr_t __user *argv, # compat_uptr_t __user *envp, # struct pt_regs * regs) -probe syscall.compat_execve = kernel.function("compat_do_execve") ? +probe syscall.compat_execve = kernel.function("compat_do_execve").call ? { name = "compat_execve" filename = kernel_string($filename) @@ -720,7 +720,7 @@ probe syscall.compat_execve.return = kernel.function("compat_do_execve").return # exit _______________________________________________________ # long sys_exit(int error_code) -probe syscall.exit = kernel.function("do_exit") +probe syscall.exit = kernel.function("do_exit").call { name = "exit" status = $code @@ -732,8 +732,8 @@ probe syscall.exit = kernel.function("do_exit") # exit_group _________________________________________________ # void sys_exit_group(int error_code) # -probe syscall.exit_group = kernel.function("SyS_exit_group") !, - kernel.function("sys_exit_group") +probe syscall.exit_group = kernel.function("SyS_exit_group").call !, + kernel.function("sys_exit_group").call { name = "exit_group" status = $error_code @@ -745,8 +745,8 @@ probe syscall.exit_group = kernel.function("SyS_exit_group") !, # faccessat __________________________________________________ # new function with 2.6.16 # long sys_faccessat(int dfd, const char __user *filename, int mode) -probe syscall.faccessat = kernel.function("SyS_faccessat") !, - kernel.function("sys_faccessat") ? +probe syscall.faccessat = kernel.function("SyS_faccessat").call !, + kernel.function("sys_faccessat").call ? { name = "faccessat" dirfd = $dfd @@ -767,8 +767,8 @@ probe syscall.faccessat.return = kernel.function("SyS_faccessat").return !, # fadvise64 __________________________________________________ # long sys_fadvise64(int fd, loff_t offset, size_t len, int advice) # -probe syscall.fadvise64 = kernel.function("SyS_fadvise64") !, - kernel.function("sys_fadvise64") ? +probe syscall.fadvise64 = kernel.function("SyS_fadvise64").call !, + kernel.function("sys_fadvise64").call ? { name = "fadvise64" fd = $fd @@ -787,8 +787,8 @@ probe syscall.fadvise64.return = kernel.function("SyS_fadvise64").return !, # fadvise64_64 _______________________________________________ # long sys_fadvise64_64(int fd, loff_t offset, loff_t len, int advice) # -probe syscall.fadvise64_64 = kernel.function("SyS_fadvise64_64") !, - kernel.function("sys_fadvise64_64") ? +probe syscall.fadvise64_64 = kernel.function("SyS_fadvise64_64").call !, + kernel.function("sys_fadvise64_64").call ? { name = "fadvise64_64" fd = $fd @@ -809,8 +809,8 @@ probe syscall.fadvise64_64.return = kernel.function("SyS_fadvise64_64").return ! # fadvise64 __________________________________________________ # long sys_fadvise64(int fd, loff_t offset, size_t len, int advice) # -probe syscall.fadvise64 = kernel.function("SyS_fadvise64") !, - kernel.function("sys_fadvise64") +probe syscall.fadvise64 = kernel.function("SyS_fadvise64").call !, + kernel.function("sys_fadvise64").call { name = "fadvise64" fd = 0 @@ -829,8 +829,8 @@ probe syscall.fadvise64.return = kernel.function("SyS_fadvise64").return !, # fadvise64_64 _______________________________________________ # long sys_fadvise64_64(int fd, loff_t offset, loff_t len, int advice) # -probe syscall.fadvise64_64 = kernel.function("SyS_fadvise64_64") !, - kernel.function("sys_fadvise64_64") +probe syscall.fadvise64_64 = kernel.function("SyS_fadvise64_64").call !, + kernel.function("sys_fadvise64_64").call { name = "fadvise64_64" fd = 0 @@ -849,8 +849,8 @@ probe syscall.fadvise64_64.return = kernel.function("SyS_fadvise64_64").return ! # fchdir _____________________________________________________ # long sys_fchdir(unsigned int fd) -probe syscall.fchdir = kernel.function("SyS_fchdir") !, - kernel.function("sys_fchdir") +probe syscall.fchdir = kernel.function("SyS_fchdir").call !, + kernel.function("sys_fchdir").call { name = "fchdir" fd = $fd @@ -865,8 +865,8 @@ probe syscall.fchdir.return = kernel.function("SyS_fchdir").return !, # fchmod _____________________________________________________ # long sys_fchmod(unsigned int fd, mode_t mode) -probe syscall.fchmod = kernel.function("SyS_fchmod") !, - kernel.function("sys_fchmod") +probe syscall.fchmod = kernel.function("SyS_fchmod").call !, + kernel.function("sys_fchmod").call { name = "fchmod" fildes = $fd @@ -884,8 +884,8 @@ probe syscall.fchmod.return = kernel.function("SyS_fchmod").return !, # new function with 2.6.16 # long sys_fchmodat(int dfd, const char __user *filename, # mode_t mode) -probe syscall.fchmodat = kernel.function("SyS_fchmodat") !, - kernel.function("sys_fchmodat") ? +probe syscall.fchmodat = kernel.function("SyS_fchmodat").call !, + kernel.function("sys_fchmodat").call ? { name = "fchmodat" dirfd = $dfd @@ -903,8 +903,8 @@ probe syscall.fchmodat.return = kernel.function("SyS_fchmodat").return !, # fchown _____________________________________________________ # long sys_fchown(unsigned int fd, uid_t user, gid_t group) -probe syscall.fchown = kernel.function("SyS_fchown") !, - kernel.function("sys_fchown") +probe syscall.fchown = kernel.function("SyS_fchown").call !, + kernel.function("sys_fchown").call { name = "fchown" fd = $fd @@ -921,7 +921,7 @@ probe syscall.fchown.return = kernel.function("SyS_fchown").return !, # fchown16 ___________________________________________________ # long sys_fchown16(unsigned int fd, old_uid_t user, old_gid_t group) -probe syscall.fchown16 = kernel.function("sys_fchown16") ? +probe syscall.fchown16 = kernel.function("sys_fchown16").call ? { name = "fchown16" fd = $fd @@ -939,8 +939,8 @@ probe syscall.fchown16.return = kernel.function("sys_fchown16").return ? # new function with 2.6.16 # long sys_fchownat(int dfd, const char __user *filename, # uid_t user, gid_t group, int flag) -probe syscall.fchownat = kernel.function("SyS_fchownat") !, - kernel.function("sys_fchownat") ? +probe syscall.fchownat = kernel.function("SyS_fchownat").call !, + kernel.function("sys_fchownat").call ? { name = "fchownat" dirfd = $dfd @@ -966,11 +966,11 @@ probe syscall.fchownat.return = kernel.function("SyS_fchownat").return !, # long compat_sys_fcntl64(unsigned int fd, unsigned int cmd, unsigned long arg) # long compat_sys_fcntl(unsigned int fd, unsigned int cmd, unsigned long arg) # -probe syscall.fcntl = kernel.function("compat_sys_fcntl") ?, - kernel.function("compat_sys_fcntl64") ?, - kernel.function("sys_fcntl64") ?, - kernel.function("SyS_fcntl") !, - kernel.function("sys_fcntl") ? +probe syscall.fcntl = kernel.function("compat_sys_fcntl").call ?, + kernel.function("compat_sys_fcntl64").call ?, + kernel.function("sys_fcntl64").call ?, + kernel.function("SyS_fcntl").call !, + kernel.function("sys_fcntl").call ? { name = "fcntl" fd = $fd @@ -991,8 +991,8 @@ probe syscall.fcntl.return = kernel.function("compat_sys_fcntl").return ?, # fdatasync __________________________________________________ # long sys_fdatasync(unsigned int fd) -probe syscall.fdatasync = kernel.function("SyS_fdatasync") !, - kernel.function("sys_fdatasync") +probe syscall.fdatasync = kernel.function("SyS_fdatasync").call !, + kernel.function("sys_fdatasync").call { name = "fdatasync" fd = $fd @@ -1008,8 +1008,8 @@ probe syscall.fdatasync.return = kernel.function("SyS_fdatasync").return !, # fgetxattr __________________________________________________ # ssize_t sys_fgetxattr(int fd, char __user *name, # void __user *value, size_t size) -probe syscall.fgetxattr = kernel.function("SyS_fgetxattr") !, - kernel.function("sys_fgetxattr") +probe syscall.fgetxattr = kernel.function("SyS_fgetxattr").call !, + kernel.function("sys_fgetxattr").call { name = "fgetxattr" filedes = $fd @@ -1027,8 +1027,8 @@ probe syscall.fgetxattr.return = kernel.function("SyS_fgetxattr").return !, } # flistxattr _________________________________________________ # ssize_t sys_flistxattr(int fd, char __user *list, size_t size) -probe syscall.flistxattr = kernel.function("SyS_flistxattr") !, - kernel.function("sys_flistxattr") +probe syscall.flistxattr = kernel.function("SyS_flistxattr").call !, + kernel.function("sys_flistxattr").call { name = "flistxattr" filedes = $fd @@ -1045,8 +1045,8 @@ probe syscall.flistxattr.return = kernel.function("SyS_flistxattr").return !, # flock ______________________________________________________ # long sys_flock(unsigned int fd, unsigned int cmd) -probe syscall.flock = kernel.function("SyS_flock") !, - kernel.function("sys_flock") +probe syscall.flock = kernel.function("SyS_flock").call !, + kernel.function("sys_flock").call { name = "flock" fd = $fd @@ -1100,7 +1100,7 @@ CATCH_DEREF_FAULT(); # unsigned long stack_size, # int __user *parent_tidptr, # int __user *child_tidptr) -probe syscall.fork = kernel.function("do_fork") +probe syscall.fork = kernel.function("do_fork").call { clone_flags = $clone_flags stack_start = $stack_start @@ -1128,8 +1128,8 @@ probe syscall.fork.return = kernel.function("do_fork").return } # fremovexattr _______________________________________________ # long sys_fremovexattr(int fd, char __user *name) -probe syscall.fremovexattr = kernel.function("SyS_fremovexattr") !, - kernel.function("sys_fremovexattr") +probe syscall.fremovexattr = kernel.function("SyS_fremovexattr").call !, + kernel.function("sys_fremovexattr").call { name = "fremovexattr" filedes = $fd @@ -1152,8 +1152,8 @@ probe syscall.fremovexattr.return = kernel.function("SyS_fremovexattr").return ! * size_t size, * int flags) */ -probe syscall.fsetxattr = kernel.function("SyS_fsetxattr") !, - kernel.function("sys_fsetxattr") +probe syscall.fsetxattr = kernel.function("SyS_fsetxattr").call !, + kernel.function("sys_fsetxattr").call { name = "fsetxattr" filedes = $fd @@ -1180,14 +1180,14 @@ probe syscall.fsetxattr.return = kernel.function("SyS_fsetxattr").return !, # struct oldabi_stat64 __user * statbuf) # long compat_sys_newfstat(unsigned int fd, struct compat_stat __user * statbuf) # -probe syscall.fstat = kernel.function("sys_fstat") ?, - kernel.function("SyS_fstat64") ?, - kernel.function("sys_fstat64") ?, - kernel.function("sys32_fstat64") ?, - kernel.function("SyS_newfstat") ?, - kernel.function("sys_newfstat") ?, - kernel.function("sys_oabi_fstat64") ?, - kernel.function("compat_sys_newfstat") ? +probe syscall.fstat = kernel.function("sys_fstat").call ?, + kernel.function("SyS_fstat64").call ?, + kernel.function("sys_fstat64").call ?, + kernel.function("sys32_fstat64").call ?, + kernel.function("SyS_newfstat").call ?, + kernel.function("sys_newfstat").call ?, + kernel.function("sys_oabi_fstat64").call ?, + kernel.function("compat_sys_newfstat").call ? { name = "fstat" filedes = $fd @@ -1212,12 +1212,12 @@ probe syscall.fstat.return = kernel.function("sys_fstat").return ?, # long sys_newfstatat(int dfd, char __user *filename, struct stat __user *statbuf, int flag) # long sys_fstatat64(int dfd, char __user *filename, struct stat64 __user *statbuf, int flag) # long compat_sys_newfstatat(unsigned int dfd, char __user *filename, struct compat_stat __user *statbuf, int flag) -probe syscall.fstatat = kernel.function("SyS_fstatat64") ?, - kernel.function("sys_fstatat64") ?, - kernel.function("SyS_newfstatat") ?, - kernel.function("sys_newfstatat") ?, - kernel.function("compat_sys_newfstatat") ?, - kernel.function("sys32_fstatat64") ? +probe syscall.fstatat = kernel.function("SyS_fstatat64").call ?, + kernel.function("sys_fstatat64").call ?, + kernel.function("SyS_newfstatat").call ?, + kernel.function("sys_newfstatat").call ?, + kernel.function("compat_sys_newfstatat").call ?, + kernel.function("sys32_fstatat64").call ? { name = "fstatat" dirfd = $dfd @@ -1240,9 +1240,9 @@ probe syscall.fstatat.return = kernel.function("SyS_fstatat64").return ?, # long sys_fstatfs(unsigned int fd, struct statfs __user * buf) # long compat_sys_fstatfs(unsigned int fd, struct compat_statfs __user *buf) # -probe syscall.fstatfs = kernel.function("compat_sys_fstatfs") ?, - kernel.function("SyS_fstatfs") !, - kernel.function("sys_fstatfs") +probe syscall.fstatfs = kernel.function("compat_sys_fstatfs").call ?, + kernel.function("SyS_fstatfs").call !, + kernel.function("sys_fstatfs").call { name = "fstatfs" fd = $fd @@ -1261,9 +1261,9 @@ probe syscall.fstatfs.return = kernel.function("compat_sys_fstatfs").return ?, # long sys_fstatfs64(unsigned int fd, size_t sz, struct statfs64 __user *buf) # long compat_sys_fstatfs64(unsigned int fd, compat_size_t sz, struct compat_statfs64 __user *buf) # -probe syscall.fstatfs64 = kernel.function("compat_sys_fstatfs64") ?, - kernel.function("SyS_fstatfs64") !, - kernel.function("sys_fstatfs64") ? +probe syscall.fstatfs64 = kernel.function("compat_sys_fstatfs64").call ?, + kernel.function("SyS_fstatfs64").call !, + kernel.function("sys_fstatfs64").call ? { name = "fstatfs" fd = $fd @@ -1281,8 +1281,8 @@ probe syscall.fstatfs64.return = kernel.function("compat_sys_fstatfs64").return # fsync ______________________________________________________ # long sys_fsync(unsigned int fd) -probe syscall.fsync = kernel.function("SyS_fsync") !, - kernel.function("sys_fsync") +probe syscall.fsync = kernel.function("SyS_fsync").call !, + kernel.function("sys_fsync").call { name = "fsync" fd = $fd @@ -1296,8 +1296,8 @@ probe syscall.fsync.return = kernel.function("SyS_fsync").return !, } # ftruncate __________________________________________________ # long sys_ftruncate(unsigned int fd, unsigned long length) -probe syscall.ftruncate = kernel.function("SyS_ftruncate") !, - kernel.function("sys_ftruncate") +probe syscall.ftruncate = kernel.function("SyS_ftruncate").call !, + kernel.function("sys_ftruncate").call { name = "ftruncate" fd = $fd @@ -1313,7 +1313,7 @@ probe syscall.ftruncate.return = kernel.function("SyS_ftruncate").return !, # ftruncate64 ________________________________________________ # long sys_ftruncate64(unsigned int fd, loff_t length) -probe syscall.ftruncate64 = kernel.function("sys_ftruncate64") ? +probe syscall.ftruncate64 = kernel.function("sys_ftruncate64").call ? { name = "ftruncate" fd = $fd @@ -1337,8 +1337,8 @@ probe syscall.ftruncate64.return = kernel.function("sys_ftruncate64").return ? # struct compat_timespec __user *utime, u32 __user *uaddr2, # u32 val3) # -probe syscall.futex = kernel.function("SyS_futex") !, - kernel.function("sys_futex") ? +probe syscall.futex = kernel.function("SyS_futex").call !, + kernel.function("sys_futex").call ? { name = "futex" futex_uaddr = $uaddr @@ -1360,7 +1360,7 @@ probe syscall.futex.return = kernel.function("SyS_futex").return !, name = "futex" retstr = returnstr(1) } -probe syscall.compat_futex = kernel.function("compat_sys_futex") ? +probe syscall.compat_futex = kernel.function("compat_sys_futex").call ? { name = "futex" futex_uaddr = $uaddr @@ -1388,8 +1388,8 @@ probe syscall.compat_futex.return = kernel.function("compat_sys_futex").return ? # long compat_sys_futimesat(unsigned int dfd, char __user *filename, struct compat_timeval __user *t) # -probe syscall.futimesat = kernel.function("SyS_futimesat") !, - kernel.function("sys_futimesat") ? +probe syscall.futimesat = kernel.function("SyS_futimesat").call !, + kernel.function("sys_futimesat").call ? { name = "futimesat" dirfd = $dfd @@ -1399,7 +1399,7 @@ probe syscall.futimesat = kernel.function("SyS_futimesat") !, argstr = sprintf("%s, %s, %s", _dfd_str($dfd), user_string_quoted($filename), _struct_timeval_u($utimes, 2)) } -probe syscall.compat_futimesat = kernel.function("compat_sys_futimesat") ? +probe syscall.compat_futimesat = kernel.function("compat_sys_futimesat").call ? { name = "futimesat" dirfd = $dfd @@ -1423,8 +1423,8 @@ probe syscall.compat_futimesat.return = kernel.function("compat_sys_futimesat"). # getcwd _____________________________________________________ # long sys_getcwd(char __user *buf, unsigned long size) -probe syscall.getcwd = kernel.function("SyS_getcwd") !, - kernel.function("sys_getcwd") +probe syscall.getcwd = kernel.function("SyS_getcwd").call !, + kernel.function("sys_getcwd").call { name = "getcwd" buf_uaddr = $buf @@ -1444,12 +1444,12 @@ probe syscall.getcwd.return = kernel.function("SyS_getcwd").return !, # long sys_getdents64(unsigned int fd, struct linux_dirent64 __user * dirent, unsigned int count) # long compat_sys_getdents64(unsigned int fd, struct linux_dirent64 __user * dirent, unsigned int count) # -probe syscall.getdents = kernel.function("SyS_getdents") ?, - kernel.function("sys_getdents") ?, - kernel.function("SyS_getdents64") ?, - kernel.function("sys_getdents64") ?, - kernel.function("compat_sys_getdents") ?, - kernel.function("compat_sys_getdents64") ? +probe syscall.getdents = kernel.function("SyS_getdents").call ?, + kernel.function("sys_getdents").call ?, + kernel.function("SyS_getdents64").call ?, + kernel.function("sys_getdents64").call ?, + kernel.function("compat_sys_getdents").call ?, + kernel.function("compat_sys_getdents64").call ? { name = "getdents" fd = $fd @@ -1473,9 +1473,9 @@ probe syscall.getdents.return = kernel.function("SyS_getdents").return ?, # long sys_getegid16(void) # long sys32_getegid16(void) # -probe syscall.getegid = kernel.function("sys_getegid16") ?, - kernel.function("sys32_getegid16") ?, - kernel.function("sys_getegid") +probe syscall.getegid = kernel.function("sys_getegid16").call ?, + kernel.function("sys32_getegid16").call ?, + kernel.function("sys_getegid").call { name = "getegid" argstr = "" @@ -1492,9 +1492,9 @@ probe syscall.getegid.return = kernel.function("sys_getegid16").return ?, # long sys_geteuid(void) # long sys32_geteuid16(void) # -probe syscall.geteuid = kernel.function("sys_geteuid16") ?, - kernel.function("sys32_geteuid16") ?, - kernel.function("sys_geteuid") +probe syscall.geteuid = kernel.function("sys_geteuid16").call ?, + kernel.function("sys32_geteuid16").call ?, + kernel.function("sys_geteuid").call { name = "geteuid" argstr = "" @@ -1511,9 +1511,9 @@ probe syscall.geteuid.return = kernel.function("sys_geteuid16").return ?, # long sys_getgid(void) # long sys32_getgid16(void) # -probe syscall.getgid = kernel.function("sys_getgid16") ?, - kernel.function("sys32_getgid16") ?, - kernel.function("sys_getgid") +probe syscall.getgid = kernel.function("sys_getgid16").call ?, + kernel.function("sys32_getgid16").call ?, + kernel.function("sys_getgid").call { name = "getgid" argstr = "" @@ -1531,10 +1531,10 @@ probe syscall.getgid.return = kernel.function("sys_getgid16").return ?, # long sys_getgroups16(int gidsetsize, old_gid_t __user *grouplist) # long sys32_getgroups16(int gidsetsize, u16 __user *grouplist) # -probe syscall.getgroups = kernel.function("sys_getgroups16") ?, - kernel.function("sys32_getgroups16") ?, - kernel.function("SyS_getgroups") !, - kernel.function("sys_getgroups") ? +probe syscall.getgroups = kernel.function("sys_getgroups16").call ?, + kernel.function("sys32_getgroups16").call ?, + kernel.function("SyS_getgroups").call !, + kernel.function("sys_getgroups").call ? { name = "getgroups" size = $gidsetsize @@ -1552,8 +1552,8 @@ probe syscall.getgroups.return = kernel.function("sys_getgroups16").return ?, # gethostname ________________________________________________ # long sys_gethostname(char __user *name, int len) -probe syscall.gethostname = kernel.function("SyS_gethostname") !, - kernel.function("sys_gethostname") ? +probe syscall.gethostname = kernel.function("SyS_gethostname").call !, + kernel.function("sys_gethostname").call ? { name = "gethostname" name_uaddr = $name @@ -1570,8 +1570,8 @@ probe syscall.gethostname.return = kernel.function("SyS_gethostname").return !, # getitimer __________________________________________________ # sys_getitimer(int which, struct itimerval __user *value) # -probe syscall.getitimer = kernel.function("SyS_getitimer") !, - kernel.function("sys_getitimer") +probe syscall.getitimer = kernel.function("SyS_getitimer").call !, + kernel.function("sys_getitimer").call { name = "getitimer" which = $which @@ -1585,7 +1585,7 @@ probe syscall.getitimer.return = kernel.function("SyS_getitimer").return !, retstr = returnstr(1) } # long compat_sys_getitimer(int which, struct compat_itimerval __user *it -probe syscall.compat_getitimer = kernel.function("compat_sys_getitimer") ? +probe syscall.compat_getitimer = kernel.function("compat_sys_getitimer").call ? { name = "getitimer" which = $which @@ -1609,9 +1609,9 @@ probe syscall.compat_getitimer.return = kernel.function("compat_sys_getitimer"). # compat_ulong_t maxnode, # compat_ulong_t addr, compat_ulong_t flags) # -probe syscall.get_mempolicy = kernel.function("compat_sys_get_mempolicy") ?, - kernel.function("SyS_get_mempolicy") !, - kernel.function("sys_get_mempolicy") ? +probe syscall.get_mempolicy = kernel.function("compat_sys_get_mempolicy").call ?, + kernel.function("SyS_get_mempolicy").call !, + kernel.function("sys_get_mempolicy").call ? { name = "get_mempolicy" policy_uaddr = $policy @@ -1633,8 +1633,8 @@ probe syscall.get_mempolicy.return = kernel.function("compat_sys_get_mempolicy") # getpeername ________________________________________________ # long sys_getpeername(int fd, struct sockaddr __user *usockaddr, int __user *usockaddr_len) # -probe syscall.getpeername = kernel.function("SyS_getpeername") !, - kernel.function("sys_getpeername") ? +probe syscall.getpeername = kernel.function("SyS_getpeername").call !, + kernel.function("sys_getpeername").call ? { name = "getpeername" s = $fd @@ -1651,8 +1651,8 @@ probe syscall.getpeername.return = kernel.function("SyS_getpeername").return !, # getpgid ____________________________________________________ # long sys_getpgid(pid_t pid) -probe syscall.getpgid = kernel.function("SyS_getpgid") !, - kernel.function("sys_getpgid") +probe syscall.getpgid = kernel.function("SyS_getpgid").call !, + kernel.function("sys_getpgid").call { name = "getpgid" pid = $pid @@ -1667,7 +1667,7 @@ probe syscall.getpgid.return = kernel.function("SyS_getpgid").return !, # getpgrp ____________________________________________________ # long sys_getpgrp(void) -probe syscall.getpgrp = kernel.function("sys_getpgrp") ? +probe syscall.getpgrp = kernel.function("sys_getpgrp").call ? { name = "getpgrp" argstr = "" @@ -1680,7 +1680,7 @@ probe syscall.getpgrp.return = kernel.function("sys_getpgrp").return ? # getpid _____________________________________________________ # long sys_getpid(void) -probe syscall.getpid = kernel.function("sys_getpid") +probe syscall.getpid = kernel.function("sys_getpid").call { name = "getpid" argstr = "" @@ -1693,7 +1693,7 @@ probe syscall.getpid.return = kernel.function("sys_getpid").return # getppid ____________________________________________________ # long sys_getppid(void) -probe syscall.getppid = kernel.function("sys_getppid") +probe syscall.getppid = kernel.function("sys_getppid").call { name = "getppid" argstr = "" @@ -1706,8 +1706,8 @@ probe syscall.getppid.return = kernel.function("sys_getppid").return # getpriority ________________________________________________ # long sys_getpriority(int which, int who) -probe syscall.getpriority = kernel.function("SyS_getpriority") !, - kernel.function("sys_getpriority") +probe syscall.getpriority = kernel.function("SyS_getpriority").call !, + kernel.function("sys_getpriority").call { name = "getpriority" which = $which @@ -1728,9 +1728,9 @@ probe syscall.getpriority.return = kernel.function("SyS_getpriority").return !, # long sys_getresgid16(old_uid_t __user *rgid, # old_uid_t __user *egid, # old_uid_t __user *sgid) -probe syscall.getresgid = kernel.function("sys_getresgid16") ?, - kernel.function("SyS_getresgid") !, - kernel.function("sys_getresgid") +probe syscall.getresgid = kernel.function("sys_getresgid16").call ?, + kernel.function("SyS_getresgid").call !, + kernel.function("sys_getresgid").call { name = "getresgid" rgid_uaddr = $rgid @@ -1750,9 +1750,9 @@ probe syscall.getresgid.return = kernel.function("sys_getresgid16").return ?, # long sys_getresuid(uid_t __user *ruid, # uid_t __user *euid, # uid_t __user *suid) -probe syscall.getresuid = kernel.function("sys_getresuid16") ?, - kernel.function("SyS_getresuid") !, - kernel.function("sys_getresuid") +probe syscall.getresuid = kernel.function("sys_getresuid16").call ?, + kernel.function("SyS_getresuid").call !, + kernel.function("sys_getresuid").call { name = "getresuid" ruid_uaddr = $ruid @@ -1772,11 +1772,11 @@ probe syscall.getresuid.return = kernel.function("sys_getresuid16").return ?, # long sys_getrlimit(unsigned int resource, struct rlimit __user *rlim) # long sys_old_getrlimit(unsigned int resource, struct rlimit __user *rlim) # long compat_sys_getrlimit (unsigned int resource, struct compat_rlimit __user *rlim) -probe syscall.getrlimit = kernel.function("SyS_getrlimit") ?, - kernel.function("sys_getrlimit") ?, - kernel.function("SyS_old_getrlimit") ?, - kernel.function("sys_old_getrlimit") ?, - kernel.function("compat_sys_getrlimit") ? +probe syscall.getrlimit = kernel.function("SyS_getrlimit").call ?, + kernel.function("sys_getrlimit").call ?, + kernel.function("SyS_old_getrlimit").call ?, + kernel.function("sys_old_getrlimit").call ?, + kernel.function("compat_sys_getrlimit").call ? { name = "getrlimit" resource = $resource @@ -1795,8 +1795,8 @@ probe syscall.getrlimit.return = kernel.function("SyS_getrlimit").return ?, # getrusage __________________________________________________ # long sys_getrusage(int who, struct rusage __user *ru) -probe syscall.getrusage = kernel.function("SyS_getrusage") !, - kernel.function("sys_getrusage") +probe syscall.getrusage = kernel.function("SyS_getrusage").call !, + kernel.function("sys_getrusage").call { name = "getrusage" who = $who @@ -1817,8 +1817,8 @@ probe syscall.getrusage.return = kernel.function("SyS_getrusage").return !, # getsid _____________________________________________________ # long sys_getsid(pid_t pid) -probe syscall.getsid = kernel.function("SyS_getsid") !, - kernel.function("sys_getsid") +probe syscall.getsid = kernel.function("SyS_getsid").call !, + kernel.function("sys_getsid").call { name = "getsid" pid = $pid @@ -1835,8 +1835,8 @@ probe syscall.getsid.return = kernel.function("SyS_getsid").return !, # long sys_getsockname(int fd, # struct sockaddr __user *usockaddr, # int __user *usockaddr_len) -probe syscall.getsockname = kernel.function("SyS_getsockname") !, - kernel.function("sys_getsockname") ? +probe syscall.getsockname = kernel.function("SyS_getsockname").call !, + kernel.function("sys_getsockname").call ? { name = "getsockname" s = $fd @@ -1858,9 +1858,9 @@ probe syscall.getsockname.return = kernel.function("SyS_getsockname").return !, # char __user *optval, # int __user *optlen) # -probe syscall.getsockopt = kernel.function("compat_sys_getsockopt") ?, - kernel.function("SyS_getsockopt") !, - kernel.function("sys_getsockopt") ? +probe syscall.getsockopt = kernel.function("compat_sys_getsockopt").call ?, + kernel.function("SyS_getsockopt").call !, + kernel.function("sys_getsockopt").call ? { name = "getsockopt" fd = $fd @@ -1883,7 +1883,7 @@ probe syscall.getsockopt.return = kernel.function("compat_sys_getsockopt").retur # gettid _____________________________________________________ # long sys_gettid(void) -probe syscall.gettid = kernel.function("sys_gettid") +probe syscall.gettid = kernel.function("sys_gettid").call { name = "gettid" argstr = "" @@ -1901,10 +1901,10 @@ probe syscall.gettid.return = kernel.function("sys_gettid").return # struct timezone __user *tz) # long compat_sys_gettimeofday(struct compat_timeval __user *tv, # struct timezone __user *tz) -probe syscall.gettimeofday = kernel.function("compat_sys_gettimeofday") ?, - kernel.function("sys32_gettimeofday") ?, - kernel.function("SyS_gettimeofday") !, - kernel.function("sys_gettimeofday") +probe syscall.gettimeofday = kernel.function("compat_sys_gettimeofday").call ?, + kernel.function("sys32_gettimeofday").call ?, + kernel.function("SyS_gettimeofday").call !, + kernel.function("sys_gettimeofday").call { name = "gettimeofday" tv_uaddr = $tv @@ -1926,9 +1926,9 @@ probe syscall.gettimeofday.return = kernel.function("compat_sys_gettimeofday").r # long sys_getuid16(void) # long sys32_getuid16(void) # -probe syscall.getuid = kernel.function("sys_getuid16") ?, - kernel.function("sys32_getuid16") ?, - kernel.function("sys_getuid") +probe syscall.getuid = kernel.function("sys_getuid16").call ?, + kernel.function("sys32_getuid16").call ?, + kernel.function("sys_getuid").call { name = "getuid" argstr = "" @@ -1944,8 +1944,8 @@ probe syscall.getuid.return = kernel.function("sys_getuid16").return ?, # getxattr ___________________________________________________ # ssize_t sys_getxattr(char __user *path, char __user *name, # void __user *value, size_t size) -probe syscall.getxattr = kernel.function("SyS_getxattr") !, - kernel.function("sys_getxattr") +probe syscall.getxattr = kernel.function("SyS_getxattr").call !, + kernel.function("sys_getxattr").call { name = "getxattr" %( kernel_v >= "2.6.27" %? @@ -1978,8 +1978,8 @@ probe syscall.getxattr.return = kernel.function("SyS_getxattr").return !, # unsigned long len, # const char __user *uargs) # -probe syscall.init_module = kernel.function("SyS_init_module") !, - kernel.function("sys_init_module") ? +probe syscall.init_module = kernel.function("SyS_init_module").call !, + kernel.function("sys_init_module").call ? { name = "init_module" umod_uaddr = $umod @@ -1998,8 +1998,8 @@ probe syscall.init_module.return = kernel.function("SyS_init_module").return !, # # long sys_inotify_add_watch(int fd, const char __user *path, u32 mask) # -probe syscall.inotify_add_watch = kernel.function("SyS_inotify_add_watch") !, - kernel.function("sys_inotify_add_watch") ? +probe syscall.inotify_add_watch = kernel.function("SyS_inotify_add_watch").call !, + kernel.function("sys_inotify_add_watch").call ? { name = "inotify_add_watch" fd = $fd @@ -2026,7 +2026,7 @@ probe syscall.inotify_add_watch.return = kernel.function("SyS_inotify_add_watch" # # long sys_inotify_init(void) # -probe syscall.inotify_init = kernel.function("sys_inotify_init") ? +probe syscall.inotify_init = kernel.function("sys_inotify_init").call ? { name = "inotify_init" argstr = "" @@ -2041,8 +2041,8 @@ probe syscall.inotify_init.return = kernel.function("sys_inotify_init").return ? # # long sys_inotify_rm_watch(int fd, u32 wd) # -probe syscall.inotify_rm_watch = kernel.function("SyS_inotify_rm_watch") !, - kernel.function("sys_inotify_rm_watch") ? +probe syscall.inotify_rm_watch = kernel.function("SyS_inotify_rm_watch").call !, + kernel.function("sys_inotify_rm_watch").call ? { name = "inotify_rm_watch" fd = $fd @@ -2060,8 +2060,8 @@ probe syscall.inotify_rm_watch.return = kernel.function("SyS_inotify_rm_watch"). # long sys_io_cancel(aio_context_t ctx_id, # struct iocb __user *iocb, # struct io_event __user *result) -probe syscall.io_cancel = kernel.function("SyS_io_cancel") !, - kernel.function("sys_io_cancel") +probe syscall.io_cancel = kernel.function("SyS_io_cancel").call !, + kernel.function("sys_io_cancel").call { name = "io_cancel" ctx_id = $ctx_id @@ -2080,9 +2080,9 @@ probe syscall.io_cancel.return = kernel.function("SyS_io_cancel").return !, # long sys_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg) # long compat_sys_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg) # -probe syscall.ioctl = kernel.function("compat_sys_ioctl") ?, - kernel.function("SyS_ioctl") !, - kernel.function("sys_ioctl") ? +probe syscall.ioctl = kernel.function("compat_sys_ioctl").call ?, + kernel.function("SyS_ioctl").call !, + kernel.function("sys_ioctl").call ? { name = "ioctl" fd = $fd @@ -2100,8 +2100,8 @@ probe syscall.ioctl.return = kernel.function("compat_sys_ioctl").return ?, # io_destroy _________________________________________________ # long sys_io_destroy(aio_context_t ctx) -probe syscall.io_destroy = kernel.function("SyS_io_destroy") !, - kernel.function("sys_io_destroy") +probe syscall.io_destroy = kernel.function("SyS_io_destroy").call !, + kernel.function("sys_io_destroy").call { name = "io_destroy" ctx = $ctx @@ -2126,9 +2126,9 @@ probe syscall.io_destroy.return = kernel.function("SyS_io_destroy").return !, # struct io_event __user *events, # struct compat_timespec __user *timeout) # -probe syscall.io_getevents = kernel.function("compat_sys_io_getevents") ?, - kernel.function("SyS_io_getevents") !, - kernel.function("sys_io_getevents") ? +probe syscall.io_getevents = kernel.function("compat_sys_io_getevents").call ?, + kernel.function("SyS_io_getevents").call !, + kernel.function("sys_io_getevents").call ? { name = "io_getevents" ctx_id = $ctx_id @@ -2151,7 +2151,7 @@ probe syscall.io_getevents.return = kernel.function("compat_sys_io_getevents").r # ioperm _____________________________________________________ # long sys_ioperm(unsigned long from, unsigned long num, int turn_on) # -probe syscall.ioperm = kernel.function("sys_ioperm") ? +probe syscall.ioperm = kernel.function("sys_ioperm").call ? { name = "ioperm" from = $from @@ -2168,8 +2168,8 @@ probe syscall.ioperm.return = kernel.function("sys_ioperm").return ? # io_setup ___________________________________________________ # long sys_io_setup(unsigned nr_events, aio_context_t __user *ctxp) # -probe syscall.io_setup = kernel.function("SyS_io_setup") !, - kernel.function("sys_io_setup") +probe syscall.io_setup = kernel.function("SyS_io_setup").call !, + kernel.function("sys_io_setup").call { name = "io_setup" maxevents = $nr_events @@ -2185,7 +2185,7 @@ probe syscall.io_setup.return = kernel.function("SyS_io_setup").return !, } # long compat_sys_io_setup(unsigned nr_reqs, u32 __user *ctx32p) # -probe syscall.compat_io_setup = kernel.function("compat_sys_io_setup") ? +probe syscall.compat_io_setup = kernel.function("compat_sys_io_setup").call ? { name = "io_setup" maxevents = $nr_reqs @@ -2202,8 +2202,8 @@ probe syscall.compat_io_setup.return = kernel.function("compat_sys_io_setup").re # io_submit __________________________________________________ # long sys_io_submit(aio_context_t ctx_id, long nr, struct iocb __user * __user *iocbpp) # -probe syscall.io_submit = kernel.function("SyS_io_submit") !, - kernel.function("sys_io_submit") +probe syscall.io_submit = kernel.function("SyS_io_submit").call !, + kernel.function("sys_io_submit").call { name = "io_submit" ctx_id = $ctx_id @@ -2219,7 +2219,7 @@ probe syscall.io_submit.return = kernel.function("SyS_io_submit").return !, } # long compat_sys_io_submit(aio_context_t ctx_id, int nr, u32 __user *iocb) # -probe syscall.compat_io_submit = kernel.function("compat_sys_io_submit") ? +probe syscall.compat_io_submit = kernel.function("compat_sys_io_submit").call ? { name = "io_submit" ctx_id = $ctx_id @@ -2236,8 +2236,8 @@ probe syscall.compat_io_submit.return = kernel.function("compat_sys_io_submit"). # ioprio_get _________________________________________________ # long sys_ioprio_get(int which, int who) # -probe syscall.ioprio_get = kernel.function("SyS_ioprio_get") !, - kernel.function("sys_ioprio_get") ? +probe syscall.ioprio_get = kernel.function("SyS_ioprio_get").call !, + kernel.function("sys_ioprio_get").call ? { name = "ioprio_get" which = $which @@ -2254,8 +2254,8 @@ probe syscall.ioprio_get.return = kernel.function("SyS_ioprio_get").return !, # ioprio_set _________________________________________________ # long sys_ioprio_set(int which, int who, int ioprio) # -probe syscall.ioprio_set = kernel.function("SyS_ioprio_set") !, - kernel.function("sys_ioprio_set") ? +probe syscall.ioprio_set = kernel.function("SyS_ioprio_set").call !, + kernel.function("sys_ioprio_set").call ? { name = "ioprio_set" which = $which @@ -2280,9 +2280,9 @@ probe syscall.ioprio_set.return = kernel.function("SyS_ioprio_set").return !, # struct compat_kexec_segment __user *segments, # unsigned long flags) # -probe syscall.kexec_load = kernel.function("compat_sys_kexec_load") ?, - kernel.function("SyS_kexec_load") !, - kernel.function("sys_kexec_load") ? +probe syscall.kexec_load = kernel.function("compat_sys_kexec_load").call ?, + kernel.function("SyS_kexec_load").call !, + kernel.function("sys_kexec_load").call ? { name = "kexec_load" entry = $entry @@ -2307,9 +2307,9 @@ probe syscall.kexec_load.return = kernel.function("compat_sys_kexec_load").retur # unsigned long arg5) # long compat_sys_keyctl(u32 option, u32 arg2, u32 arg3, u32 arg4, u32 arg5) # -probe syscall.keyctl = kernel.function("compat_sys_keyctl") ?, - kernel.function("SyS_keyctl") !, - kernel.function("sys_keyctl") ? +probe syscall.keyctl = kernel.function("compat_sys_keyctl").call ?, + kernel.function("SyS_keyctl").call !, + kernel.function("sys_keyctl").call ? { name = "keyctl" argstr = sprintf("%d, ...", $option) @@ -2325,8 +2325,8 @@ probe syscall.keyctl.return = kernel.function("compat_sys_keyctl").return ?, # kill _______________________________________________________ # long sys_kill(int pid, int sig) -probe syscall.kill = kernel.function("SyS_kill") !, - kernel.function("sys_kill") +probe syscall.kill = kernel.function("SyS_kill").call !, + kernel.function("sys_kill").call { name = "kill" pid = $pid @@ -2343,8 +2343,8 @@ probe syscall.kill.return = kernel.function("SyS_kill").return !, # lchown _____________________________________________________ # long sys_lchown(const char __user * filename, uid_t user, gid_t group) # -probe syscall.lchown = kernel.function("SyS_lchown") !, - kernel.function("sys_lchown") +probe syscall.lchown = kernel.function("SyS_lchown").call !, + kernel.function("sys_lchown").call { name = "lchown" path = user_string($filename) @@ -2363,7 +2363,7 @@ probe syscall.lchown.return = kernel.function("SyS_lchown").return !, # long sys_lchown16(const char __user * filename, old_uid_t user, # old_gid_t group) # -probe syscall.lchown16 = kernel.function("sys_lchown16") ? +probe syscall.lchown16 = kernel.function("sys_lchown16").call ? { name = "lchown16" path = user_string($filename) @@ -2383,8 +2383,8 @@ probe syscall.lchown16.return = kernel.function("sys_lchown16").return ? # void __user *value, # size_t size) # -probe syscall.lgetxattr = kernel.function("SyS_lgetxattr") !, - kernel.function("sys_lgetxattr") +probe syscall.lgetxattr = kernel.function("SyS_lgetxattr").call !, + kernel.function("sys_lgetxattr").call { name = "lgetxattr" %( kernel_v >= "2.6.27" %? @@ -2415,8 +2415,8 @@ probe syscall.lgetxattr.return = kernel.function("SyS_lgetxattr").return !, # link _______________________________________________________ # long sys_link(const char __user * oldname, # const char __user * newname) -probe syscall.link = kernel.function("SyS_link") !, - kernel.function("sys_link") +probe syscall.link = kernel.function("SyS_link").call !, + kernel.function("sys_link").call { name = "link" oldpath = user_string($oldname) @@ -2436,8 +2436,8 @@ probe syscall.link.return = kernel.function("SyS_link").return !, # new function with 2.6.16 # long sys_linkat(int olddfd, const char __user *oldname, # int newdfd, const char __user *newname, int flags) -probe syscall.linkat = kernel.function("SyS_linkat") !, - kernel.function("sys_linkat") ? +probe syscall.linkat = kernel.function("SyS_linkat").call !, + kernel.function("sys_linkat").call ? { name = "linkat" olddirfd = $olddfd @@ -2462,8 +2462,8 @@ probe syscall.linkat.return = kernel.function("SyS_linkat").return !, # listen _____________________________________________________ # long sys_listen(int fd, int backlog) -probe syscall.listen = kernel.function("SyS_listen") !, - kernel.function("sys_listen") ? +probe syscall.listen = kernel.function("SyS_listen").call !, + kernel.function("sys_listen").call ? { name = "listen" sockfd = $fd @@ -2480,8 +2480,8 @@ probe syscall.listen.return = kernel.function("SyS_listen").return !, # listxattr __________________________________________________ # ssize_t sys_listxattr(char __user *path, char __user *list, size_t size) # -probe syscall.listxattr = kernel.function("SyS_listxattr") !, - kernel.function("sys_listxattr") +probe syscall.listxattr = kernel.function("SyS_listxattr").call !, + kernel.function("sys_listxattr").call { name = "listxattr" list_uaddr = $list @@ -2506,8 +2506,8 @@ probe syscall.listxattr.return = kernel.function("SyS_listxattr").return !, # llistxattr _________________________________________________ # ssize_t sys_llistxattr(char __user *path, char __user *list, size_t size) # -probe syscall.llistxattr = kernel.function("SyS_llistxattr") !, - kernel.function("sys_llistxattr") +probe syscall.llistxattr = kernel.function("SyS_llistxattr").call !, + kernel.function("sys_llistxattr").call { name = "llistxattr" list_uaddr = $list @@ -2535,8 +2535,8 @@ probe syscall.llistxattr.return = kernel.function("SyS_llistxattr").return !, # unsigned long offset_low, # loff_t __user * result, # unsigned int origin) -probe syscall.llseek = kernel.function("SyS_llseek") !, - kernel.function("sys_llseek") ? +probe syscall.llseek = kernel.function("SyS_llseek").call !, + kernel.function("sys_llseek").call ? { name = "llseek" fd = $fd @@ -2558,8 +2558,8 @@ probe syscall.llseek.return = kernel.function("SyS_llseek").return !, # lookup_dcookie _____________________________________________ # long sys_lookup_dcookie(u64 cookie64, char __user * buf, size_t len) # -probe syscall.lookup_dcookie = kernel.function("SyS_lookup_dcookie") !, - kernel.function("sys_lookup_dcookie") ? +probe syscall.lookup_dcookie = kernel.function("SyS_lookup_dcookie").call !, + kernel.function("sys_lookup_dcookie").call ? { name = "lookup_dcookie" cookie = $cookie64 @@ -2577,8 +2577,8 @@ probe syscall.lookup_dcookie.return = kernel.function("SyS_lookup_dcookie").retu # lremovexattr _______________________________________________ # long sys_lremovexattr(char __user *path, char __user *name) # -probe syscall.lremovexattr = kernel.function("SyS_lremovexattr") !, - kernel.function("sys_lremovexattr") +probe syscall.lremovexattr = kernel.function("SyS_lremovexattr").call !, + kernel.function("sys_lremovexattr").call { name = "lremovexattr" name_uaddr = $name @@ -2602,8 +2602,8 @@ probe syscall.lremovexattr.return = kernel.function("SyS_lremovexattr").return ! # lseek ______________________________________________________ # off_t sys_lseek(unsigned int fd, off_t offset, unsigned int origin) -probe syscall.lseek = kernel.function("SyS_lseek") !, - kernel.function("sys_lseek") +probe syscall.lseek = kernel.function("SyS_lseek").call !, + kernel.function("sys_lseek").call { name = "lseek" fildes = $fd @@ -2627,8 +2627,8 @@ probe syscall.lseek.return = kernel.function("SyS_lseek").return !, # size_t size, # int flags) # -probe syscall.lsetxattr = kernel.function("SyS_lsetxattr") !, - kernel.function("sys_lsetxattr") +probe syscall.lsetxattr = kernel.function("SyS_lsetxattr").call !, + kernel.function("sys_lsetxattr").call { name = "lsetxattr" %( kernel_v >= "2.6.27" %? @@ -2668,14 +2668,14 @@ probe syscall.lsetxattr.return = kernel.function("SyS_lsetxattr").return !, # long sys_oabi_lstat64(char __user * filename, # struct oldabi_stat64 __user * statbuf) # -probe syscall.lstat = kernel.function("sys_lstat") ?, - kernel.function("SyS_newlstat") ?, - kernel.function("sys_newlstat") ?, - kernel.function("compat_sys_newlstat") ?, - kernel.function("sys32_lstat64") ?, - kernel.function("SyS_lstat64") ?, - kernel.function("sys_lstat64") ?, - kernel.function("sys_oabi_lstat64") ? +probe syscall.lstat = kernel.function("sys_lstat").call ?, + kernel.function("SyS_newlstat").call ?, + kernel.function("sys_newlstat").call ?, + kernel.function("compat_sys_newlstat").call ?, + kernel.function("sys32_lstat64").call ?, + kernel.function("SyS_lstat64").call ?, + kernel.function("sys_lstat64").call ?, + kernel.function("sys_oabi_lstat64").call ? { name = "lstat" path = user_string($filename) @@ -2698,8 +2698,8 @@ probe syscall.lstat.return = kernel.function("sys_lstat").return ?, # madvise ____________________________________________________ # long sys_madvise(unsigned long start, size_t len_in, int behavior) # -probe syscall.madvise = kernel.function("SyS_madvise") !, - kernel.function("sys_madvise") ? +probe syscall.madvise = kernel.function("SyS_madvise").call !, + kernel.function("sys_madvise").call ? { name = "madvise" start = $start @@ -2730,9 +2730,9 @@ probe syscall.madvise.return = kernel.function("SyS_madvise").return !, # compat_ulong_t maxnode, # compat_ulong_t flags) # -probe syscall.mbind = kernel.function("compat_sys_mbind") ?, - kernel.function("SyS_mbind") !, - kernel.function("sys_mbind") ? +probe syscall.mbind = kernel.function("compat_sys_mbind").call ?, + kernel.function("SyS_mbind").call !, + kernel.function("sys_mbind").call ? { name = "mbind" start = $start @@ -2756,8 +2756,8 @@ probe syscall.mbind.return = kernel.function("compat_sys_mbind").return ?, # long sys_migrate_pages(pid_t pid, unsigned long maxnode, # const unsigned long __user *old_nodes, # const unsigned long __user *new_nodes) -probe syscall.migrate_pages = kernel.function("SyS_migrate_pages") !, - kernel.function("sys_migrate_pages") ? +probe syscall.migrate_pages = kernel.function("SyS_migrate_pages").call !, + kernel.function("sys_migrate_pages").call ? { name = "migrate_pages" argstr = sprintf("%d, %d, %p, %p", $pid, $maxnode, $old_nodes, $new_nodes) @@ -2772,8 +2772,8 @@ probe syscall.migrate_pages.return = kernel.function("SyS_migrate_pages").return # mincore ____________________________________________________ # long sys_mincore(unsigned long start, size_t len, unsigned char __user * vec) # -probe syscall.mincore = kernel.function("SyS_mincore") !, - kernel.function("sys_mincore") ? +probe syscall.mincore = kernel.function("SyS_mincore").call !, + kernel.function("sys_mincore").call ? { name = "mincore" start = $start @@ -2790,8 +2790,8 @@ probe syscall.mincore.return = kernel.function("SyS_mincore").return !, # mkdir ______________________________________________________ # long sys_mkdir(const char __user * pathname, int mode) -probe syscall.mkdir = kernel.function("SyS_mkdir") !, - kernel.function("sys_mkdir") +probe syscall.mkdir = kernel.function("SyS_mkdir").call !, + kernel.function("sys_mkdir").call { name = "mkdir" pathname_uaddr = $pathname @@ -2809,8 +2809,8 @@ probe syscall.mkdir.return = kernel.function("SyS_mkdir").return !, # mkdirat ____________________________________________________ # new function with 2.6.16 # long sys_mkdirat(int dfd, const char __user *pathname, int mode) -probe syscall.mkdirat = kernel.function("SyS_mkdirat") !, - kernel.function("sys_mkdirat") ? +probe syscall.mkdirat = kernel.function("SyS_mkdirat").call !, + kernel.function("sys_mkdirat").call ? { name = "mkdirat" dirfd = $dfd @@ -2827,8 +2827,8 @@ probe syscall.mkdirat.return = kernel.function("SyS_mkdirat").return !, # mknod # long sys_mknod(const char __user * filename, int mode, unsigned dev) -probe syscall.mknod = kernel.function("SyS_mknod") !, - kernel.function("sys_mknod") +probe syscall.mknod = kernel.function("SyS_mknod").call !, + kernel.function("sys_mknod").call { name = "mknod" pathname = user_string($filename) @@ -2848,8 +2848,8 @@ probe syscall.mknod.return = kernel.function("SyS_mknod").return !, # new function with 2.6.16 # long sys_mknodat(int dfd, const char __user *filename, # int mode, unsigned dev) -probe syscall.mknodat = kernel.function("SyS_mknodat") !, - kernel.function("sys_mknodat") ? +probe syscall.mknodat = kernel.function("SyS_mknodat").call !, + kernel.function("sys_mknodat").call ? { name = "mknodat" dirfd = $dfd @@ -2872,8 +2872,8 @@ probe syscall.mknodat.return = kernel.function("SyS_mknodat").return !, # # long sys_mlock(unsigned long start, size_t len) # -probe syscall.mlock = kernel.function("SyS_mlock") !, - kernel.function("sys_mlock") ? +probe syscall.mlock = kernel.function("SyS_mlock").call !, + kernel.function("sys_mlock").call ? { name = "mlock" addr = $start @@ -2890,8 +2890,8 @@ probe syscall.mlock.return = kernel.function("SyS_mlock").return !, # # long sys_mlockall(int flags) # -probe syscall.mlockall = kernel.function("SyS_mlockall") !, - kernel.function("sys_mlockall") ? +probe syscall.mlockall = kernel.function("SyS_mlockall").call !, + kernel.function("sys_mlockall").call ? { name = "mlockall" flags = $flags @@ -2907,7 +2907,7 @@ probe syscall.mlockall.return = kernel.function("SyS_mlockall").return !, # modify_ldt _________________________________________________ # int sys_modify_ldt(int func, void __user *ptr, unsigned long bytecount) # -probe syscall.modify_ldt = kernel.function("sys_modify_ldt") ? +probe syscall.modify_ldt = kernel.function("sys_modify_ldt").call ? { name = "modify_ldt" func = $func @@ -2934,9 +2934,9 @@ probe syscall.modify_ldt.return = kernel.function("sys_modify_ldt").return ? # int __user *status, # int flags) # -probe syscall.move_pages = kernel.function("compat_sys_move_pages") ?, - kernel.function("SyS_move_pages") !, - kernel.function("sys_move_pages") ? +probe syscall.move_pages = kernel.function("compat_sys_move_pages").call ?, + kernel.function("SyS_move_pages").call !, + kernel.function("sys_move_pages").call ? { name = "move_pages" argstr = sprintf("%d, %d, %p, %p, 0x%x", $pid, $nr_pages, $nodes, $status, $flags) @@ -2960,9 +2960,9 @@ probe syscall.move_pages.return = kernel.function("compat_sys_move_pages").retur # char __user * type, # unsigned long flags, # void __user * data) -probe syscall.mount = kernel.function("compat_sys_mount") ?, - kernel.function("SyS_mount") !, - kernel.function("sys_mount") +probe syscall.mount = kernel.function("compat_sys_mount").call ?, + kernel.function("SyS_mount").call !, + kernel.function("sys_mount").call { name = "mount" source = user_string($dev_name) @@ -2988,8 +2988,8 @@ probe syscall.mount.return = kernel.function("compat_sys_mount").return ?, # mprotect ___________________________________________________ # long sys_mprotect(unsigned long start, size_t len, unsigned long prot) # -probe syscall.mprotect = kernel.function("SyS_mprotect") !, - kernel.function("sys_mprotect") ? +probe syscall.mprotect = kernel.function("SyS_mprotect").call !, + kernel.function("sys_mprotect").call ? { name = "mprotect" addr = $start @@ -3013,9 +3013,9 @@ probe syscall.mprotect.return = kernel.function("SyS_mprotect").return !, # const struct compat_mq_attr __user *u_mqstat, # struct compat_mq_attr __user *u_omqstat) # -probe syscall.mq_getsetattr = kernel.function("compat_sys_mq_getsetattr") ?, - kernel.function("SyS_mq_getsetattr") !, - kernel.function("sys_mq_getsetattr") ? +probe syscall.mq_getsetattr = kernel.function("compat_sys_mq_getsetattr").call ?, + kernel.function("SyS_mq_getsetattr").call !, + kernel.function("sys_mq_getsetattr").call ? { name = "mq_getsetattr" mqdes = $mqdes @@ -3035,9 +3035,9 @@ probe syscall.mq_getsetattr.return = kernel.function("compat_sys_mq_getsetattr") # long sys_mq_notify(mqd_t mqdes, const struct sigevent __user *u_notification) # long compat_sys_mq_notify(mqd_t mqdes, const struct compat_sigevent __user *u_notification) # -probe syscall.mq_notify = kernel.function("compat_sys_mq_notify") ?, - kernel.function("SyS_mq_notify") !, - kernel.function("sys_mq_notify") ? +probe syscall.mq_notify = kernel.function("compat_sys_mq_notify").call ?, + kernel.function("SyS_mq_notify").call !, + kernel.function("sys_mq_notify").call ? { name = "mq_notify" mqdes = $mqdes @@ -3061,9 +3061,9 @@ probe syscall.mq_notify.return = kernel.function("compat_sys_mq_notify").return # int oflag, compat_mode_t mode, # struct compat_mq_attr __user *u_attr) # -probe syscall.mq_open = kernel.function("compat_sys_mq_open") ?, - kernel.function("SyS_mq_open") !, - kernel.function("sys_mq_open") ? +probe syscall.mq_open = kernel.function("compat_sys_mq_open").call ?, + kernel.function("SyS_mq_open").call !, + kernel.function("sys_mq_open").call ? { name = "mq_open" name_uaddr = $u_name @@ -3096,9 +3096,9 @@ probe syscall.mq_open.return = kernel.function("compat_sys_mq_open").return ?, # size_t msg_len, unsigned int __user *u_msg_prio, # const struct compat_timespec __user *u_abs_timeout) # -probe syscall.mq_timedreceive = kernel.function("compat_sys_mq_timedreceive") ?, - kernel.function("SyS_mq_timedreceive") !, - kernel.function("sys_mq_timedreceive") ? +probe syscall.mq_timedreceive = kernel.function("compat_sys_mq_timedreceive").call ?, + kernel.function("SyS_mq_timedreceive").call !, + kernel.function("sys_mq_timedreceive").call ? { name = "mq_timedreceive" mqdes = $mqdes @@ -3128,9 +3128,9 @@ probe syscall.mq_timedreceive.return = kernel.function("compat_sys_mq_timedrecei # size_t msg_len, unsigned int msg_prio, # const struct compat_timespec __user *u_abs_timeout) # -probe syscall.mq_timedsend = kernel.function("compat_sys_mq_timedsend") ?, - kernel.function("SyS_mq_timedsend") !, - kernel.function("sys_mq_timedsend") ? +probe syscall.mq_timedsend = kernel.function("compat_sys_mq_timedsend").call ?, + kernel.function("SyS_mq_timedsend").call !, + kernel.function("sys_mq_timedsend").call ? { name = "mq_timedsend" mqdes = $mqdes @@ -3152,8 +3152,8 @@ probe syscall.mq_timedsend.return = kernel.function("compat_sys_mq_timedsend").r # mq_unlink __________________________________________________ # long sys_mq_unlink(const char __user *u_name) # -probe syscall.mq_unlink = kernel.function("SyS_mq_unlink") !, - kernel.function("sys_mq_unlink") ? +probe syscall.mq_unlink = kernel.function("SyS_mq_unlink").call !, + kernel.function("sys_mq_unlink").call ? { name = "mq_unlink" u_name_uaddr = $u_name @@ -3174,9 +3174,9 @@ probe syscall.mq_unlink.return = kernel.function("SyS_mq_unlink").return !, # unsigned long flags, # unsigned long new_addr) # -probe syscall.mremap = kernel.function("ia64_mremap") ?, - kernel.function("SyS_mremap") !, - kernel.function("sys_mremap") ? +probe syscall.mremap = kernel.function("ia64_mremap").call ?, + kernel.function("SyS_mremap").call !, + kernel.function("sys_mremap").call ? { name = "mremap" old_address = $addr @@ -3198,8 +3198,8 @@ probe syscall.mremap.return = kernel.function("ia64_mremap").return ?, # msgctl _____________________________________________________ # long sys_msgctl (int msqid, int cmd, struct msqid_ds __user *buf) # -probe syscall.msgctl = kernel.function("SyS_msgctl") !, - kernel.function("sys_msgctl") ? +probe syscall.msgctl = kernel.function("SyS_msgctl").call !, + kernel.function("sys_msgctl").call ? { name = "msgctl" msqid = $msqid @@ -3217,7 +3217,7 @@ probe syscall.msgctl.return = kernel.function("SyS_msgctl").return !, # # long compat_sys_msgctl(int first, int second, void __user *uptr) # -probe syscall.compat_sys_msgctl = kernel.function("compat_sys_msgctl") ? +probe syscall.compat_sys_msgctl = kernel.function("compat_sys_msgctl").call ? { name = "compat_sys_msgctl" argstr = sprintf("%d, %d, %p", $first, $second, $uptr) @@ -3231,8 +3231,8 @@ probe syscall.compat_sys_msgctl.return = kernel.function("compat_sys_msgctl").re # msgget _____________________________________________________ # long sys_msgget (key_t key, int msgflg) # -probe syscall.msgget = kernel.function("SyS_msgget") !, - kernel.function("sys_msgget") ? +probe syscall.msgget = kernel.function("SyS_msgget").call !, + kernel.function("sys_msgget").call ? { name = "msgget" key = $key @@ -3254,8 +3254,8 @@ probe syscall.msgget.return = kernel.function("SyS_msgget").return !, # long msgtyp, # int msgflg) # -probe syscall.msgrcv = kernel.function("SyS_msgrcv") !, - kernel.function("sys_msgrcv") ? +probe syscall.msgrcv = kernel.function("SyS_msgrcv").call !, + kernel.function("sys_msgrcv").call ? { name = "msgrcv" msqid = $msqid @@ -3276,7 +3276,7 @@ probe syscall.msgrcv.return = kernel.function("SyS_msgrcv").return !, # long compat_sys_msgrcv(int first, int second, int msgtyp, int third, # int version, void __user *uptr) # -probe syscall.compat_sys_msgrcv = kernel.function("compat_sys_msgrcv") ? +probe syscall.compat_sys_msgrcv = kernel.function("compat_sys_msgrcv").call ? { name = "compat_sys_msgrcv" argstr = sprintf("%d, %d, %d, %p", $first, $second, $third, $uptr) @@ -3293,8 +3293,8 @@ probe syscall.compat_sys_msgrcv.return = kernel.function("compat_sys_msgrcv").re # size_t msgsz, # int msgflg) # -probe syscall.msgsnd = kernel.function("SyS_msgsnd") !, - kernel.function("sys_msgsnd") ? +probe syscall.msgsnd = kernel.function("SyS_msgsnd").call !, + kernel.function("sys_msgsnd").call ? { name = "msgsnd" msqid = $msqid @@ -3313,7 +3313,7 @@ probe syscall.msgsnd.return = kernel.function("SyS_msgsnd").return !, # # long compat_sys_msgsnd(int first, int second, int third, void __user *uptr) # -probe syscall.compat_sys_msgsnd = kernel.function("compat_sys_msgsnd") ? +probe syscall.compat_sys_msgsnd = kernel.function("compat_sys_msgsnd").call ? { name = "compat_sys_msgsnd" argstr = sprintf("%d, %d, %d, %p", $first, $second, $third, $uptr) @@ -3326,8 +3326,8 @@ probe syscall.compat_sys_msgsnd.return = kernel.function("compat_sys_msgsnd").re # msync ______________________________________________________ # long sys_msync(unsigned long start, size_t len, int flags) -probe syscall.msync = kernel.function("SyS_msync") !, - kernel.function("sys_msync") ? +probe syscall.msync = kernel.function("SyS_msync").call !, + kernel.function("sys_msync").call ? { name = "msync" start = $start @@ -3344,8 +3344,8 @@ probe syscall.msync.return = kernel.function("SyS_msync").return !, # munlock ____________________________________________________ # long sys_munlock(unsigned long start, size_t len) -probe syscall.munlock = kernel.function("SyS_munlock") !, - kernel.function("sys_munlock") ? +probe syscall.munlock = kernel.function("SyS_munlock").call !, + kernel.function("sys_munlock").call ? { name = "munlock" addr = $start @@ -3361,7 +3361,7 @@ probe syscall.munlock.return = kernel.function("SyS_munlock").return !, # munlockall _________________________________________________ # long sys_munlockall(void) -probe syscall.munlockall = kernel.function("sys_munlockall") ? +probe syscall.munlockall = kernel.function("sys_munlockall").call ? { name = "munlockall" argstr = "" @@ -3374,8 +3374,8 @@ probe syscall.munlockall.return = kernel.function("sys_munlockall").return ? # munmap _____________________________________________________ # long sys_munmap(unsigned long addr, size_t len) -probe syscall.munmap = kernel.function("SyS_munmap") !, - kernel.function("sys_munmap") +probe syscall.munmap = kernel.function("SyS_munmap").call !, + kernel.function("sys_munmap").call { name = "munmap" start = $addr diff --git a/tapset/syscalls2.stp b/tapset/syscalls2.stp index e2be10fc..5e97aef5 100644 --- a/tapset/syscalls2.stp +++ b/tapset/syscalls2.stp @@ -28,8 +28,8 @@ # long compat_sys_nanosleep(struct compat_timespec __user *rqtp, # struct compat_timespec __user *rmtp) # -probe syscall.nanosleep = kernel.function("SyS_nanosleep") !, - kernel.function("sys_nanosleep") +probe syscall.nanosleep = kernel.function("SyS_nanosleep").call !, + kernel.function("sys_nanosleep").call { name = "nanosleep" req_uaddr = $rqtp @@ -42,7 +42,7 @@ probe syscall.nanosleep.return = kernel.function("SyS_nanosleep").return !, name = "nanosleep" retstr = returnstr(1) } -probe syscall.compat_nanosleep = kernel.function("compat_sys_nanosleep") ? +probe syscall.compat_nanosleep = kernel.function("compat_sys_nanosleep").call ? { name = "nanosleep" req_uaddr = $rqtp @@ -61,8 +61,8 @@ probe syscall.compat_nanosleep.return = kernel.function("compat_sys_nanosleep"). # long compat_sys_nfsservctl(int cmd, struct compat_nfsctl_arg __user *arg, # union compat_nfsctl_res __user *res) # -probe syscall.nfsservctl = kernel.function("sys_nfsservctl") ?, - kernel.function("compat_sys_nfsservctl") ? +probe syscall.nfsservctl = kernel.function("sys_nfsservctl").call ?, + kernel.function("compat_sys_nfsservctl").call ? { name = "nfsservctl" cmd = $cmd @@ -80,8 +80,8 @@ probe syscall.nfsservctl.return = kernel.function("sys_nfsservctl").return ?, # nice _______________________________________________________ # long sys_nice(int increment) # -probe syscall.nice = kernel.function("SyS_nice") !, - kernel.function("sys_nice") ? +probe syscall.nice = kernel.function("SyS_nice").call !, + kernel.function("sys_nice").call ? { name = "nice" inc = $increment @@ -98,7 +98,7 @@ probe syscall.nice.return = kernel.function("SyS_nice").return !, # # long sys_ni_syscall(void) # -probe syscall.ni_syscall = kernel.function("sys_ni_syscall") +probe syscall.ni_syscall = kernel.function("sys_ni_syscall").call { name = "ni_syscall" argstr = "" @@ -113,10 +113,10 @@ probe syscall.ni_syscall.return = kernel.function("sys_ni_syscall").return # long sys_open(const char __user * filename, int flags, int mode) # (obsolete) long sys32_open(const char * filename, int flags, int mode) # -probe syscall.open = kernel.function("compat_sys_open") ?, - kernel.function("sys32_open") ?, - kernel.function("SyS_open") !, - kernel.function("sys_open") ? +probe syscall.open = kernel.function("compat_sys_open").call ?, + kernel.function("sys32_open").call ?, + kernel.function("SyS_open").call !, + kernel.function("sys_open").call ? { name = "open" filename = user_string($filename) @@ -142,9 +142,9 @@ probe syscall.open.return = kernel.function("compat_sys_open").return ?, # long sys_openat(int dfd, const char __user *filename, int flags, int mode) # long compat_sys_openat(unsigned int dfd, const char __user *filename, int flags, int mode) # -probe syscall.openat = kernel.function("compat_sys_openat") ?, - kernel.function("SyS_openat") !, - kernel.function("sys_openat") ? +probe syscall.openat = kernel.function("compat_sys_openat").call ?, + kernel.function("SyS_openat").call !, + kernel.function("sys_openat").call ? { name = "openat" filename = user_string($filename) @@ -171,9 +171,9 @@ probe syscall.openat.return = kernel.function("compat_sys_openat").return ?, # # sys_pause(void) # -probe syscall.pause = kernel.function("sys_pause") ?, - kernel.function("sys32_pause") ?, - kernel.function("compat_sys_pause") ? +probe syscall.pause = kernel.function("sys_pause").call ?, + kernel.function("sys32_pause").call ?, + kernel.function("compat_sys_pause").call ? { name = "pause" argstr = "" @@ -194,7 +194,7 @@ probe syscall.pause.return = kernel.function("sys_pause").return ?, # unsigned long dfn) # # -#probe syscall.pciconfig_iobase = kernel.function("sys_pciconfig_iobase") +#probe syscall.pciconfig_iobase = kernel.function("sys_pciconfig_iobase").call #{ # name = "pciconfig_iobase" # which = $which @@ -218,7 +218,7 @@ probe syscall.pause.return = kernel.function("sys_pause").return ?, # { return 0; } # # -#probe syscall.pciconfig_read = kernel.function("sys_pciconfig_read") +#probe syscall.pciconfig_read = kernel.function("sys_pciconfig_read").call #{ # name = "pciconfig_read" # bus = $bus @@ -244,7 +244,7 @@ probe syscall.pause.return = kernel.function("sys_pause").return ?, # unsigned char *buf) # # -#probe syscall.pciconfig_write = kernel.function("sys_pciconfig_write") +#probe syscall.pciconfig_write = kernel.function("sys_pciconfig_write").call #{ # name = "pciconfig_write" # bus = $bus @@ -265,8 +265,8 @@ probe syscall.pause.return = kernel.function("sys_pause").return ?, # asmlinkage long # sys_personality(u_long personality) # -probe syscall.personality = kernel.function("SyS_personality") !, - kernel.function("sys_personality") +probe syscall.personality = kernel.function("SyS_personality").call !, + kernel.function("sys_personality").call { name = "personality" persona = $personality @@ -285,15 +285,15 @@ probe syscall.personality.return = kernel.function("SyS_personality").return !, # %(arch == "x86_64" %? # x86_64 gcc 4.1 problem -probe syscall.pipe = kernel.function("SyS_pipe") !, - kernel.function("sys_pipe") +probe syscall.pipe = kernel.function("SyS_pipe").call !, + kernel.function("sys_pipe").call { name = "pipe" argstr = "" } %: -probe syscall.pipe = kernel.function("SyS_pipe") !, - kernel.function("sys_pipe") +probe syscall.pipe = kernel.function("SyS_pipe").call !, + kernel.function("sys_pipe").call { name = "pipe" %( arch == "ia64" %? @@ -316,8 +316,8 @@ probe syscall.pipe.return = kernel.function("SyS_pipe").return !, # # long sys_pivot_root(const char __user *new_root, const char __user *put_old) # -probe syscall.pivot_root = kernel.function("SyS_pivot_root") !, - kernel.function("sys_pivot_root") +probe syscall.pivot_root = kernel.function("SyS_pivot_root").call !, + kernel.function("sys_pivot_root").call { name = "pivot_root" new_root_str = user_string($new_root) @@ -336,8 +336,8 @@ probe syscall.pivot_root.return = kernel.function("SyS_pivot_root").return !, # # long sys_poll(struct pollfd __user * ufds, unsigned int nfds, long timeout) # -probe syscall.poll = kernel.function("SyS_poll") !, - kernel.function("sys_poll") +probe syscall.poll = kernel.function("SyS_poll").call !, + kernel.function("sys_poll").call { name = "poll" ufds_uaddr = $ufds @@ -362,8 +362,8 @@ probe syscall.poll.return = kernel.function("SyS_poll").return !, # struct timespec __user *tsp, const sigset_t __user *sigmask, # size_t sigsetsize) # -probe syscall.ppoll = kernel.function("SyS_ppoll") !, - kernel.function("sys_ppoll") ? +probe syscall.ppoll = kernel.function("SyS_ppoll").call !, + kernel.function("sys_ppoll").call ? { name = "ppoll" argstr = sprintf("%p, %d, %s, %p, %d", @@ -383,7 +383,7 @@ probe syscall.ppoll.return = kernel.function("SyS_ppoll").return !, # unsigned int nfds, struct compat_timespec __user *tsp, # const compat_sigset_t __user *sigmask, compat_size_t sigsetsize) # -probe syscall.compat_ppoll = kernel.function("compat_sys_ppoll") ? +probe syscall.compat_ppoll = kernel.function("compat_sys_ppoll").call ? { name = "ppoll" argstr = sprintf("%p, %d, %s, %p, %d", @@ -408,8 +408,8 @@ probe syscall.compat_ppoll.return = kernel.function("compat_sys_ppoll").return ? # unsigned long arg4, # unsigned long arg5) # -probe syscall.prctl = kernel.function("SyS_prctl") !, - kernel.function("sys_prctl") +probe syscall.prctl = kernel.function("SyS_prctl").call !, + kernel.function("sys_prctl").call { name = "prctl" option = $option @@ -433,8 +433,8 @@ probe syscall.prctl.return = kernel.function("SyS_prctl").return !, # size_t count, # loff_t pos) # -probe syscall.pread = kernel.function("SyS_pread64") !, - kernel.function("sys_pread64") +probe syscall.pread = kernel.function("SyS_pread64").call !, + kernel.function("sys_pread64").call { name = "pread" fd = $fd @@ -455,8 +455,8 @@ probe syscall.pread.return = kernel.function("SyS_pread64").return !, # long sys_pselect6(int n, fd_set __user *inp, fd_set __user *outp, # fd_set __user *exp, struct timespec __user *tsp, void __user *sig) # -probe syscall.pselect6 = kernel.function("SyS_pselect6") !, - kernel.function("sys_pselect6") ? +probe syscall.pselect6 = kernel.function("SyS_pselect6").call !, + kernel.function("sys_pselect6").call ? { name = "pselect6" argstr = sprintf("%d, %p, %p, %p, %s, %p", $n, $inp, $outp, $exp, @@ -468,7 +468,7 @@ probe syscall.pselect6.return = kernel.function("SyS_pselect6").return !, name = "pselect6" retstr = returnstr(1) } -probe syscall.compat_pselect6 = kernel.function("compat_sys_pselect6") ? +probe syscall.compat_pselect6 = kernel.function("compat_sys_pselect6").call ? { name = "pselect6" argstr = sprintf("%d, %p, %p, %p, %s, %p", $n, $inp, $outp, $exp, @@ -486,7 +486,7 @@ probe syscall.compat_pselect6.return = kernel.function("compat_sys_pselect6").re # fd_set __user *exp, struct timespec __user *tsp, # const sigset_t __user *sigmask, size_t sigsetsize) # -probe syscall.pselect7 = kernel.function("sys_pselect7") ? +probe syscall.pselect7 = kernel.function("sys_pselect7").call ? { name = "pselect7" argstr = sprintf("%d, %p, %p, %p, %s, %p, %d", $n, $inp, $outp, $exp, @@ -497,7 +497,7 @@ probe syscall.pselect7.return = kernel.function("sys_pselect7").return ? name = "pselect7" retstr = returnstr(1) } -probe syscall.compat_pselect7a = kernel.function("compat_sys_pselect7") ? +probe syscall.compat_pselect7a = kernel.function("compat_sys_pselect7").call ? { name = "pselect7" argstr = sprintf("%d, %p, %p, %p, %s, %p, %d", $n, $inp, $outp, $exp, @@ -516,8 +516,8 @@ probe syscall.compat_pselect7.return = kernel.function("compat_sys_pselect7").re # long addr, # long data) # -probe syscall.ptrace = kernel.function("SyS_ptrace") !, - kernel.function("sys_ptrace") ? +probe syscall.ptrace = kernel.function("SyS_ptrace").call !, + kernel.function("sys_ptrace").call ? { name = "ptrace" request = $request @@ -540,8 +540,8 @@ probe syscall.ptrace.return = kernel.function("SyS_ptrace").return !, # size_t count, # loff_t pos) # -probe syscall.pwrite = kernel.function("SyS_pwrite64") !, - kernel.function("sys_pwrite64") +probe syscall.pwrite = kernel.function("SyS_pwrite64").call !, + kernel.function("sys_pwrite64").call { name = "pwrite" fd = $fd @@ -560,7 +560,7 @@ probe syscall.pwrite.return = kernel.function("SyS_pwrite64").return !, } # long sys32_pwrite64(unsigned int fd, const char __user *ubuf, # size_t count, u32 poshi, u32 poslo) -probe syscall.pwrite32 = kernel.function("sys32_pwrite64") ? +probe syscall.pwrite32 = kernel.function("sys32_pwrite64").call ? { name = "pwrite" fd = $fd @@ -592,8 +592,8 @@ probe syscall.pwrite32.return = kernel.function("sys32_pwrite64").return ? # qid_t id, # void __user *addr) # -probe syscall.quotactl = kernel.function("SyS_quotactl") !, - kernel.function("sys_quotactl") ? +probe syscall.quotactl = kernel.function("SyS_quotactl").call !, + kernel.function("sys_quotactl").call ? { name = "quotactl" cmd = $cmd @@ -614,8 +614,8 @@ probe syscall.quotactl.return = kernel.function("SyS_quotactl").return !, # read _______________________________________________________ # ssize_t sys_read(unsigned int fd, char __user * buf, size_t count) -probe syscall.read = kernel.function("SyS_read") !, - kernel.function("sys_read") +probe syscall.read = kernel.function("SyS_read").call !, + kernel.function("sys_read").call { name = "read" fd = $fd @@ -637,8 +637,8 @@ probe syscall.read.return = kernel.function("SyS_read").return !, # loff_t offset, # size_t count) # -probe syscall.readahead = kernel.function("SyS_readahead") !, - kernel.function("sys_readahead") +probe syscall.readahead = kernel.function("SyS_readahead").call !, + kernel.function("sys_readahead").call { name = "readahead" fd = $fd @@ -658,8 +658,8 @@ probe syscall.readahead.return = kernel.function("SyS_readahead").return !, # long compat_sys_old_readdir(unsigned int fd, struct compat_old_linux_dirent __user *dirent, unsigned int count) # int old32_readdir(unsigned int fd, struct old_linux_dirent32 *dirent, unsigned int count) # -probe syscall.readdir = kernel.function("compat_sys_old_readdir") ?, - kernel.function("old32_readdir") ? +probe syscall.readdir = kernel.function("compat_sys_old_readdir").call ?, + kernel.function("old32_readdir").call ? { name = "readdir" argstr = sprintf("%d, %p, %d", $fd, $dirent, $count) @@ -677,8 +677,8 @@ probe syscall.readdir.return = kernel.function("compat_sys_old_readdir").return # char __user * buf, # int bufsiz) # -probe syscall.readlink = kernel.function("SyS_readlink") !, - kernel.function("sys_readlink") +probe syscall.readlink = kernel.function("SyS_readlink").call !, + kernel.function("sys_readlink").call { name = "readlink" path = user_string($path) @@ -700,8 +700,8 @@ probe syscall.readlink.return = kernel.function("SyS_readlink").return !, # char __user * buf, # int bufsiz) # -probe syscall.readlinkat = kernel.function("SyS_readlinkat") !, - kernel.function("sys_readlinkat") ? +probe syscall.readlinkat = kernel.function("SyS_readlinkat").call !, + kernel.function("sys_readlinkat").call ? { name = "readlinkat" dfd = $dfd @@ -732,9 +732,9 @@ probe syscall.readlinkat.return = kernel.function("SyS_readlinkat").return !, # const struct compat_iovec __user *vec, # unsigned long vlen) # -probe syscall.readv = kernel.function("compat_sys_readv") ?, - kernel.function("SyS_readv") !, - kernel.function("sys_readv") +probe syscall.readv = kernel.function("compat_sys_readv").call ?, + kernel.function("SyS_readv").call !, + kernel.function("sys_readv").call { name = "readv" vector_uaddr = $vec @@ -762,8 +762,8 @@ probe syscall.readv.return = kernel.function("compat_sys_readv").return ?, # unsigned int cmd, # void __user * arg) # -probe syscall.reboot = kernel.function("SyS_reboot") !, - kernel.function("sys_reboot") +probe syscall.reboot = kernel.function("SyS_reboot").call !, + kernel.function("sys_reboot").call { name = "reboot" magic = $magic1 @@ -787,7 +787,7 @@ probe syscall.reboot.return = kernel.function("SyS_reboot").return !, # # long sys_recv(int fd, void __user *ubuf, size_t size, unsigned flags) # -probe syscall.recv = kernel.function("sys_recv") ? +probe syscall.recv = kernel.function("sys_recv").call ? { name = "recv" s = $fd @@ -812,8 +812,8 @@ probe syscall.recv.return = kernel.function("sys_recv").return ? # struct sockaddr __user *addr, # int __user *addr_len) # -probe syscall.recvfrom = kernel.function("SyS_recvfrom") !, - kernel.function("sys_recvfrom") ? +probe syscall.recvfrom = kernel.function("SyS_recvfrom").call !, + kernel.function("sys_recvfrom").call ? { name = "recvfrom" s = $fd @@ -839,8 +839,8 @@ probe syscall.recvfrom.return = kernel.function("SyS_recvfrom").return !, # struct msghdr __user *msg, # unsigned int flags) # -probe syscall.recvmsg = kernel.function("SyS_recvmsg") !, - kernel.function("sys_recvmsg") ? +probe syscall.recvmsg = kernel.function("SyS_recvmsg").call !, + kernel.function("sys_recvmsg").call ? { name = "recvmsg" s = $fd @@ -861,7 +861,7 @@ probe syscall.recvmsg.return = kernel.function("SyS_recvmsg").return !, # struct compat_msghdr __user *msg, # unsigned int flags) # -probe syscall.compat_sys_recvmsg = kernel.function("compat_sys_recvmsg") ? +probe syscall.compat_sys_recvmsg = kernel.function("compat_sys_recvmsg").call ? { name = "compat_sys_recvmsg" s = $fd @@ -883,8 +883,8 @@ probe syscall.compat_sys_recvmsg.return = kernel.function("compat_sys_recvmsg"). # unsigned long pgoff, # unsigned long flags) # -probe syscall.remap_file_pages = kernel.function("SyS_remap_file_pages") !, - kernel.function("sys_remap_file_pages") ? +probe syscall.remap_file_pages = kernel.function("SyS_remap_file_pages").call !, + kernel.function("sys_remap_file_pages").call ? { name = "remap_file_pages" start = $start @@ -912,8 +912,8 @@ probe syscall.remap_file_pages.return = kernel.function("SyS_remap_file_pages"). # sys_removexattr(char __user *path, # char __user *name) # -probe syscall.removexattr = kernel.function("SyS_removexattr") !, - kernel.function("sys_removexattr") +probe syscall.removexattr = kernel.function("SyS_removexattr").call !, + kernel.function("sys_removexattr").call { name = "removexattr" name_str = user_string($name) @@ -940,8 +940,8 @@ probe syscall.removexattr.return = kernel.function("SyS_removexattr").return !, # sys_rename(const char __user * oldname, # const char __user * newname) # -probe syscall.rename = kernel.function("SyS_rename") !, - kernel.function("sys_rename") +probe syscall.rename = kernel.function("SyS_rename").call !, + kernel.function("sys_rename").call { name = "rename" oldpath = user_string($oldname) @@ -960,8 +960,8 @@ probe syscall.rename.return = kernel.function("SyS_rename").return !, # new function with 2.6.16 # long sys_renameat(int olddfd, const char __user *oldname, # int newdfd, const char __user *newname) -probe syscall.renameat = kernel.function("SyS_renameat") !, - kernel.function("sys_renameat") ? +probe syscall.renameat = kernel.function("SyS_renameat").call !, + kernel.function("sys_renameat").call ? { name = "renameat" olddfd = $olddfd @@ -991,8 +991,8 @@ probe syscall.renameat.return = kernel.function("SyS_renameat").return !, # key_serial_t destringid) # compat_sys_request_key() calls sys_request_key, so don't need probe there. # -probe syscall.request_key = kernel.function("SyS_request_key") !, - kernel.function("sys_request_key") ? +probe syscall.request_key = kernel.function("SyS_request_key").call !, + kernel.function("sys_request_key").call ? { name = "request_key" type_uaddr = $_type @@ -1013,7 +1013,7 @@ probe syscall.request_key.return = kernel.function("SyS_request_key").return !, # asmlinkage long # sys_restart_syscall(void) # -probe syscall.restart_syscall = kernel.function("sys_restart_syscall") +probe syscall.restart_syscall = kernel.function("sys_restart_syscall").call { name = "restart_syscall" argstr = "" @@ -1028,8 +1028,8 @@ probe syscall.restart_syscall.return = kernel.function("sys_restart_syscall").re # asmlinkage long # sys_rmdir(const char __user * pathname) # -probe syscall.rmdir = kernel.function("SyS_rmdir") !, - kernel.function("sys_rmdir") +probe syscall.rmdir = kernel.function("SyS_rmdir").call !, + kernel.function("sys_rmdir").call { name = "rmdir" pathname = user_string($pathname) @@ -1049,8 +1049,8 @@ probe syscall.rmdir.return = kernel.function("SyS_rmdir").return !, # struct sigaction __user *oact, # size_t sigsetsize) # -probe syscall.rt_sigaction = kernel.function("SyS_rt_sigaction") !, - kernel.function("sys_rt_sigaction") ? +probe syscall.rt_sigaction = kernel.function("SyS_rt_sigaction").call !, + kernel.function("sys_rt_sigaction").call ? { name = "rt_sigaction" sig = $sig @@ -1078,8 +1078,8 @@ probe syscall.rt_sigaction.return = kernel.function("SyS_rt_sigaction").return ! # struct sigaction32 __user *oact, # size_t sigsetsize) -probe syscall.rt_sigaction32 = kernel.function("sys32_rt_sigaction") ?, - kernel.function("compat_sys_rt_sigaction") ? +probe syscall.rt_sigaction32 = kernel.function("sys32_rt_sigaction").call ?, + kernel.function("compat_sys_rt_sigaction").call ? { name = "rt_sigaction" sig = $sig @@ -1100,8 +1100,8 @@ probe syscall.rt_sigaction32.return = kernel.function("sys32_rt_sigaction").retu # # long sys_rt_sigpending(sigset_t __user *set, size_t sigsetsize) # -probe syscall.rt_sigpending = kernel.function("SyS_rt_sigpending") !, - kernel.function("sys_rt_sigpending") ? +probe syscall.rt_sigpending = kernel.function("SyS_rt_sigpending").call !, + kernel.function("sys_rt_sigpending").call ? { name = "rt_sigpending" set_uaddr = $set @@ -1120,10 +1120,10 @@ probe syscall.rt_sigpending.return = kernel.function("SyS_rt_sigpending").return # long compat_sys_rt_sigprocmask(int how, compat_sigset_t __user *set, compat_sigset_t __user *oset, compat_size_t sigsetsize) # long sys_rt_sigprocmask(int how, sigset_t __user *set, sigset_t __user *oset, size_t sigsetsize) # -probe syscall.rt_sigprocmask = kernel.function("sys32_rt_sigprocmask") ?, - kernel.function("compat_sys_rt_sigprocmask") ?, - kernel.function("SyS_rt_sigprocmask") !, - kernel.function("sys_rt_sigprocmask") ? +probe syscall.rt_sigprocmask = kernel.function("sys32_rt_sigprocmask").call ?, + kernel.function("compat_sys_rt_sigprocmask").call ?, + kernel.function("SyS_rt_sigprocmask").call !, + kernel.function("sys_rt_sigprocmask").call ? { name = "rt_sigprocmask" how = $how @@ -1146,8 +1146,8 @@ probe syscall.rt_sigprocmask.return = kernel.function("sys32_rt_sigprocmask").re # # long sys_rt_sigqueueinfo(int pid, int sig, siginfo_t __user *uinfo) # -probe syscall.rt_sigqueueinfo = kernel.function("SyS_rt_sigqueueinfo") !, - kernel.function("sys_rt_sigqueueinfo") +probe syscall.rt_sigqueueinfo = kernel.function("SyS_rt_sigqueueinfo").call !, + kernel.function("sys_rt_sigqueueinfo").call { name = "rt_sigqueueinfo" pid = $pid @@ -1165,8 +1165,8 @@ probe syscall.rt_sigqueueinfo.return = kernel.function("SyS_rt_sigqueueinfo").re # rt_sigreturn _______________________________________________ # int sys_rt_sigreturn(unsigned long __unused) # -probe syscall.rt_sigreturn = kernel.function("sys_rt_sigreturn") ?, - kernel.function("sys32_rt_sigreturn") ? +probe syscall.rt_sigreturn = kernel.function("sys_rt_sigreturn").call ?, + kernel.function("sys32_rt_sigreturn").call ? { name = "rt_sigreturn" argstr = "" @@ -1182,10 +1182,10 @@ probe syscall.rt_sigreturn.return = kernel.function("sys_rt_sigreturn").return ? # # sys_rt_sigsuspend(struct pt_regs regs) # -probe syscall.rt_sigsuspend = kernel.function("compat_sys_rt_sigsuspend") ?, - kernel.function("ia64_rt_sigsuspend") ?, - kernel.function("SyS_rt_sigsuspend") !, - kernel.function("sys_rt_sigsuspend") ? +probe syscall.rt_sigsuspend = kernel.function("compat_sys_rt_sigsuspend").call ?, + kernel.function("ia64_rt_sigsuspend").call ?, + kernel.function("SyS_rt_sigsuspend").call !, + kernel.function("sys_rt_sigsuspend").call ? { name = "rt_sigsuspend" argstr = "" @@ -1209,9 +1209,9 @@ probe syscall.rt_sigsuspend.return = kernel.function("compat_sys_rt_sigsuspend") # struct compat_siginfo __user *uinfo, # struct compat_timespec __user *uts, compat_size_t sigsetsize) # -probe syscall.rt_sigtimedwait = kernel.function("compat_sys_rt_sigtimedwait") ?, - kernel.function("SyS_rt_sigtimedwait") !, - kernel.function("sys_rt_sigtimedwait") +probe syscall.rt_sigtimedwait = kernel.function("compat_sys_rt_sigtimedwait").call ?, + kernel.function("SyS_rt_sigtimedwait").call !, + kernel.function("sys_rt_sigtimedwait").call { name = "rt_sigtimedwait" uthese_uaddr = $uthese @@ -1235,8 +1235,8 @@ probe syscall.rt_sigtimedwait.return = kernel.function("compat_sys_rt_sigtimedwa # unsigned int len, # unsigned long __user *user_mask_ptr) # -probe syscall.sched_getaffinity = kernel.function("SyS_sched_getaffinity") !, - kernel.function("sys_sched_getaffinity") +probe syscall.sched_getaffinity = kernel.function("SyS_sched_getaffinity").call !, + kernel.function("sys_sched_getaffinity").call { name = "sched_getaffinity" pid = $pid @@ -1256,8 +1256,8 @@ probe syscall.sched_getaffinity.return = kernel.function("SyS_sched_getaffinity" # sys_sched_getparam(pid_t pid, # struct sched_param __user *param) # -probe syscall.sched_getparam = kernel.function("SyS_sched_getparam") !, - kernel.function("sys_sched_getparam") +probe syscall.sched_getparam = kernel.function("SyS_sched_getparam").call !, + kernel.function("sys_sched_getparam").call { name = "sched_getparam" pid = $pid @@ -1275,8 +1275,8 @@ probe syscall.sched_getparam.return = kernel.function("SyS_sched_getparam").retu # asmlinkage long # sys_sched_get_priority_max(int policy) # -probe syscall.sched_get_priority_max = kernel.function("SyS_sched_get_priority_max") !, - kernel.function("sys_sched_get_priority_max") +probe syscall.sched_get_priority_max = kernel.function("SyS_sched_get_priority_max").call !, + kernel.function("sys_sched_get_priority_max").call { name = "sched_get_priority_max" policy = $policy @@ -1293,8 +1293,8 @@ probe syscall.sched_get_priority_max.return = kernel.function("SyS_sched_get_pri # asmlinkage long # sys_sched_get_priority_min(int policy) # -probe syscall.sched_get_priority_min = kernel.function("SyS_sched_get_priority_min") !, - kernel.function("sys_sched_get_priority_min") +probe syscall.sched_get_priority_min = kernel.function("SyS_sched_get_priority_min").call !, + kernel.function("sys_sched_get_priority_min").call { name = "sched_get_priority_min" policy = $policy @@ -1310,8 +1310,8 @@ probe syscall.sched_get_priority_min.return = kernel.function("SyS_sched_get_pri # # long sys_sched_getscheduler(pid_t pid) # -probe syscall.sched_getscheduler = kernel.function("SyS_sched_getscheduler") !, - kernel.function("sys_sched_getscheduler") +probe syscall.sched_getscheduler = kernel.function("SyS_sched_getscheduler").call !, + kernel.function("sys_sched_getscheduler").call { name = "sched_getscheduler" pid = $pid @@ -1327,8 +1327,8 @@ probe syscall.sched_getscheduler.return = kernel.function("SyS_sched_getschedule # # long sys_sched_rr_get_interval(pid_t pid, struct timespec __user *interval) # -probe syscall.sched_rr_get_interval = kernel.function("SyS_sched_rr_get_interval") !, - kernel.function("sys_sched_rr_get_interval") +probe syscall.sched_rr_get_interval = kernel.function("SyS_sched_rr_get_interval").call !, + kernel.function("sys_sched_rr_get_interval").call { name = "sched_rr_get_interval" pid = $pid @@ -1349,8 +1349,8 @@ probe syscall.sched_rr_get_interval.return = kernel.function("SyS_sched_rr_get_i # FIXME: why the problem with x86_64? # %( arch != "x86_64" %? -probe syscall.sched_setaffinity = kernel.function("SyS_sched_setaffinity") !, - kernel.function("sys_sched_setaffinity") +probe syscall.sched_setaffinity = kernel.function("SyS_sched_setaffinity").call !, + kernel.function("sys_sched_setaffinity").call { name = "sched_setaffinity" pid = $pid @@ -1359,8 +1359,8 @@ probe syscall.sched_setaffinity = kernel.function("SyS_sched_setaffinity") !, argstr = sprintf("%d, %d, %p", $pid, $len, $user_mask_ptr) } %: -probe syscall.sched_setaffinity = kernel.function("SyS_sched_setaffinity") !, - kernel.function("sys_sched_setaffinity") +probe syscall.sched_setaffinity = kernel.function("SyS_sched_setaffinity").call !, + kernel.function("sys_sched_setaffinity").call { name = "sched_setaffinity" pid = $pid @@ -1380,8 +1380,8 @@ probe syscall.sched_setaffinity.return = kernel.function("SyS_sched_setaffinity" # # long sys_sched_setparam(pid_t pid, struct sched_param __user *param) # -probe syscall.sched_setparam = kernel.function("SyS_sched_setparam") !, - kernel.function("sys_sched_setparam") ? +probe syscall.sched_setparam = kernel.function("SyS_sched_setparam").call !, + kernel.function("sys_sched_setparam").call ? { name = "sched_setparam" pid = $pid @@ -1399,8 +1399,8 @@ probe syscall.sched_setparam.return = kernel.function("SyS_sched_setparam").retu # # long sys_sched_setscheduler(pid_t pid, int policy, struct sched_param __user *param) # -probe syscall.sched_setscheduler = kernel.function("SyS_sched_setscheduler") !, - kernel.function("sys_sched_setscheduler") ? +probe syscall.sched_setscheduler = kernel.function("SyS_sched_setscheduler").call !, + kernel.function("sys_sched_setscheduler").call ? { name = "sched_setscheduler" pid = $pid @@ -1419,7 +1419,7 @@ probe syscall.sched_setscheduler.return = kernel.function("SyS_sched_setschedule # sched_yield ________________________________________________ # long sys_sched_yield(void) # -probe syscall.sched_yield = kernel.function("sys_sched_yield") +probe syscall.sched_yield = kernel.function("sys_sched_yield").call { name = "sched_yield" argstr = "" @@ -1437,8 +1437,8 @@ probe syscall.sched_yield.return = kernel.function("sys_sched_yield").return # fd_set __user *exp, # struct timeval __user *tvp) # -probe syscall.select = kernel.function("SyS_select") !, - kernel.function("sys_select") +probe syscall.select = kernel.function("SyS_select").call !, + kernel.function("sys_select").call { name = "select" n = $n @@ -1461,7 +1461,7 @@ probe syscall.select.return = kernel.function("SyS_select").return !, # compat_ulong_t __user *exp, # struct compat_timeval __user *tvp) # -probe syscall.compat_select = kernel.function("compat_sys_select") ? +probe syscall.compat_select = kernel.function("compat_sys_select").call ? { name = "select" n = $n @@ -1484,8 +1484,8 @@ probe syscall.compat_select.return = kernel.function("compat_sys_select").return # int cmd, # union semun arg) # -probe syscall.semctl = kernel.function("SyS_semctl") !, - kernel.function("sys_semctl") ? +probe syscall.semctl = kernel.function("SyS_semctl").call !, + kernel.function("sys_semctl").call ? { name = "semctl" semid = $semid @@ -1507,7 +1507,7 @@ probe syscall.semctl.return = kernel.function("SyS_semctl").return !, # # long compat_sys_semctl(int first, int second, int third, void __user *uptr) # -probe syscall.compat_sys_semctl = kernel.function("compat_sys_semctl") ? +probe syscall.compat_sys_semctl = kernel.function("compat_sys_semctl").call ? { name = "compat_sys_semctl" argstr = sprintf("%d, %d, %d, %p", $first, $second, $third, $uptr) @@ -1521,8 +1521,8 @@ probe syscall.compat_sys_semctl.return = kernel.function("compat_sys_semctl").re # semget _____________________________________________________ # long sys_semget (key_t key, int nsems, int semflg) # -probe syscall.semget = kernel.function("SyS_semget") !, - kernel.function("sys_semget") ? +probe syscall.semget = kernel.function("SyS_semget").call !, + kernel.function("sys_semget").call ? { name = "semget" key = $key @@ -1543,8 +1543,8 @@ probe syscall.semget.return = kernel.function("SyS_semget").return !, # struct sembuf __user *tsops, # unsigned nsops) # -probe syscall.semop = kernel.function("SyS_semtimedop") !, - kernel.function("sys_semtimedop") ? +probe syscall.semop = kernel.function("SyS_semtimedop").call !, + kernel.function("sys_semtimedop").call ? { name = "semop" semid = $semid @@ -1566,8 +1566,8 @@ probe syscall.semop.return = kernel.function("SyS_semtimedop").return !, # unsigned nsops, # const struct timespec __user *timeout) # -probe syscall.semtimedop = kernel.function("SyS_semtimedop") !, - kernel.function("sys_semtimedop") ? +probe syscall.semtimedop = kernel.function("SyS_semtimedop").call !, + kernel.function("sys_semtimedop").call ? { name = "semtimedop" semid = $semid @@ -1588,7 +1588,7 @@ probe syscall.semtimedop.return = kernel.function("SyS_semtimedop").return !, # long compat_sys_semtimedop(int semid, struct sembuf __user *tsems, # unsigned nsops, const struct compat_timespec __user *timeout) # -probe syscall.compat_sys_semtimedop = kernel.function("compat_sys_semtimedop") ? +probe syscall.compat_sys_semtimedop = kernel.function("compat_sys_semtimedop").call ? { name = "compat_sys_semtimedop" semid = $semid @@ -1611,8 +1611,8 @@ probe syscall.compat_sys_semtimedop.return = kernel.function("compat_sys_semtime # size_t len, # unsigned flags) # -probe syscall.send = kernel.function("SyS_send") !, - kernel.function("sys_send") ? +probe syscall.send = kernel.function("SyS_send").call !, + kernel.function("sys_send").call ? { name = "send" s = $fd @@ -1636,10 +1636,10 @@ probe syscall.send.return = kernel.function("SyS_send").return !, # off_t __user *offset, # size_t count) # -probe syscall.sendfile = kernel.function("SyS_sendfile") ?, - kernel.function("sys_sendfile") ?, - kernel.function("SyS_sendfile64") ?, - kernel.function("sys_sendfile64") ? +probe syscall.sendfile = kernel.function("SyS_sendfile").call ?, + kernel.function("sys_sendfile").call ?, + kernel.function("SyS_sendfile64").call ?, + kernel.function("sys_sendfile64").call ? { name = "sendfile" out_fd = $out_fd @@ -1662,8 +1662,8 @@ probe syscall.sendfile.return = kernel.function("SyS_sendfile").return ?, # # long sys_sendmsg(int fd, struct msghdr __user *msg, unsigned flags) # -probe syscall.sendmsg = kernel.function("SyS_sendmsg") !, - kernel.function("sys_sendmsg") ? +probe syscall.sendmsg = kernel.function("SyS_sendmsg").call !, + kernel.function("sys_sendmsg").call ? { name = "sendmsg" s = $fd @@ -1682,7 +1682,7 @@ probe syscall.sendmsg.return = kernel.function("SyS_sendmsg").return !, # # long compat_sys_sendmsg(int fd, struct compat_msghdr __user *msg, unsigned flags) # -probe syscall.compat_sys_sendmsg = kernel.function("compat_sys_sendmsg") ? +probe syscall.compat_sys_sendmsg = kernel.function("compat_sys_sendmsg").call ? { name = "compat_sys_sendmsg" s = $fd @@ -1705,8 +1705,8 @@ probe syscall.compat_sys_sendmsg.return = kernel.function("compat_sys_sendmsg"). # struct sockaddr __user *addr, # int addr_len) # -probe syscall.sendto = kernel.function("SyS_sendto") !, - kernel.function("sys_sendto") ? +probe syscall.sendto = kernel.function("SyS_sendto").call !, + kernel.function("sys_sendto").call ? { name = "sendto" s = $fd @@ -1732,8 +1732,8 @@ probe syscall.sendto.return = kernel.function("SyS_sendto").return !, # sys_setdomainname(char __user *name, # int len) # -probe syscall.setdomainname = kernel.function("SyS_setdomainname") !, - kernel.function("sys_setdomainname") +probe syscall.setdomainname = kernel.function("SyS_setdomainname").call !, + kernel.function("sys_setdomainname").call { name = "setdomainname" hostname_uaddr = $name @@ -1751,9 +1751,9 @@ probe syscall.setdomainname.return = kernel.function("SyS_setdomainname").return # long sys_setfsgid(gid_t gid) # long sys_setfsgid16(old_gid_t gid) # -probe syscall.setfsgid = kernel.function("sys_setfsgid16") ?, - kernel.function("SyS_setfsgid") !, - kernel.function("sys_setfsgid") ? +probe syscall.setfsgid = kernel.function("sys_setfsgid16").call ?, + kernel.function("SyS_setfsgid").call !, + kernel.function("sys_setfsgid").call ? { name = "setfsgid" fsgid = $gid @@ -1771,9 +1771,9 @@ probe syscall.setfsgid.return = kernel.function("sys_setfsgid16").return ?, # long sys_setfsuid(uid_t uid) # long sys_setfsuid16(old_uid_t uid) # -probe syscall.setfsuid = kernel.function("sys_setfsuid16") ?, - kernel.function("SyS_setfsuid") !, - kernel.function("sys_setfsuid") ? +probe syscall.setfsuid = kernel.function("sys_setfsuid16").call ?, + kernel.function("SyS_setfsuid").call !, + kernel.function("sys_setfsuid").call ? { name = "setfsuid" fsuid = $uid @@ -1792,9 +1792,9 @@ probe syscall.setfsuid.return = kernel.function("sys_setfsuid16").return ?, # long sys_setgid(gid_t gid) # long sys_setgid16(old_gid_t gid) # -probe syscall.setgid = kernel.function("sys_setgid16") ?, - kernel.function("SyS_setgid") !, - kernel.function("sys_setgid") ? +probe syscall.setgid = kernel.function("sys_setgid16").call ?, + kernel.function("SyS_setgid").call !, + kernel.function("sys_setgid").call ? { name = "setgid" gid = $gid @@ -1814,10 +1814,10 @@ probe syscall.setgid.return = kernel.function("sys_setgid16").return ?, # long sys_setgroups16(int gidsetsize, old_gid_t __user *grouplist) # long sys32_setgroups16(int gidsetsize, u16 __user *grouplist) # -probe syscall.setgroups = kernel.function("sys_setgroups16") ?, - kernel.function("sys32_setgroups16") ?, - kernel.function("SyS_setgroups") !, - kernel.function("sys_setgroups") ? +probe syscall.setgroups = kernel.function("sys_setgroups16").call ?, + kernel.function("sys32_setgroups16").call ?, + kernel.function("SyS_setgroups").call !, + kernel.function("sys_setgroups").call ? { name = "setgroups" size = $gidsetsize @@ -1839,8 +1839,8 @@ probe syscall.setgroups.return = kernel.function("sys_setgroups16").return ?, # sys_sethostname(char __user *name, # int len) # -probe syscall.sethostname = kernel.function("SyS_sethostname") !, - kernel.function("sys_sethostname") +probe syscall.sethostname = kernel.function("SyS_sethostname").call !, + kernel.function("sys_sethostname").call { name = "sethostname" hostname_uaddr = $name @@ -1860,8 +1860,8 @@ probe syscall.sethostname.return = kernel.function("SyS_sethostname").return !, # struct itimerval __user *value, # struct itimerval __user *ovalue) # -probe syscall.setitimer = kernel.function("SyS_setitimer") !, - kernel.function("sys_setitimer") +probe syscall.setitimer = kernel.function("SyS_setitimer").call !, + kernel.function("sys_setitimer").call { name = "setitimer" which = $which @@ -1881,7 +1881,7 @@ probe syscall.setitimer.return = kernel.function("SyS_setitimer").return !, # struct compat_itimerval __user *in, # struct compat_itimerval __user *out) # -probe syscall.compat_setitimer = kernel.function("compat_sys_setitimer") ? +probe syscall.compat_setitimer = kernel.function("compat_sys_setitimer").call ? { name = "setitimer" which = $which @@ -1901,9 +1901,9 @@ probe syscall.compat_setitimer.return = kernel.function("compat_sys_setitimer"). # unsigned long __user *nmask, # unsigned long maxnode) # -probe syscall.set_mempolicy = kernel.function("compat_sys_set_mempolicy") ?, - kernel.function("SyS_set_mempolicy") !, - kernel.function("sys_set_mempolicy") ? +probe syscall.set_mempolicy = kernel.function("compat_sys_set_mempolicy").call ?, + kernel.function("SyS_set_mempolicy").call !, + kernel.function("sys_set_mempolicy").call ? { name = "set_mempolicy" mode = $mode @@ -1925,8 +1925,8 @@ probe syscall.set_mempolicy.return = kernel.function("compat_sys_set_mempolicy") # sys_setpgid(pid_t pid, # pid_t pgid) # -probe syscall.setpgid = kernel.function("SyS_setpgid") !, - kernel.function("sys_setpgid") +probe syscall.setpgid = kernel.function("SyS_setpgid").call !, + kernel.function("sys_setpgid").call { name = "setpgid" pid = $pid @@ -1946,8 +1946,8 @@ probe syscall.setpgid.return = kernel.function("SyS_setpgid").return !, # int who, # int niceval) # -probe syscall.setpriority = kernel.function("SyS_setpriority") !, - kernel.function("sys_setpriority") +probe syscall.setpriority = kernel.function("SyS_setpriority").call !, + kernel.function("sys_setpriority").call { name = "setpriority" which = $which @@ -1966,8 +1966,8 @@ probe syscall.setpriority.return = kernel.function("SyS_setpriority").return !, # setregid ___________________________________________________ # long sys_setregid(gid_t rgid, gid_t egid) # -probe syscall.setregid = kernel.function("SyS_setregid") !, - kernel.function("sys_setregid") +probe syscall.setregid = kernel.function("SyS_setregid").call !, + kernel.function("sys_setregid").call { name = "setregid" rgid = __int32($rgid) @@ -1983,7 +1983,7 @@ probe syscall.setregid.return = kernel.function("SyS_setregid").return !, # setregid16 _________________________________________________ # long sys_setregid16(old_gid_t rgid, old_gid_t egid) # -probe syscall.setregid16 = kernel.function("sys_setregid16") ? +probe syscall.setregid16 = kernel.function("sys_setregid16").call ? { name = "setregid" rgid = __short($rgid) @@ -1998,8 +1998,8 @@ probe syscall.setregid16.return = kernel.function("sys_setregid16").return ? # setresgid __________________________________________________ # long sys_setresgid(gid_t rgid, gid_t egid, gid_t sgid) # -probe syscall.setresgid = kernel.function("SyS_setresgid") !, - kernel.function("sys_setresgid") +probe syscall.setresgid = kernel.function("SyS_setresgid").call !, + kernel.function("sys_setresgid").call { name = "setresgid" rgid = __int32($rgid) @@ -2019,7 +2019,7 @@ probe syscall.setresgid.return = kernel.function("SyS_setresgid").return !, # old_gid_t egid, # old_gid_t sgid) # -probe syscall.setresgid16 = kernel.function("sys_setresgid16") ? +probe syscall.setresgid16 = kernel.function("sys_setresgid16").call ? { name = "setresgid" rgid = __short($rgid) @@ -2037,8 +2037,8 @@ probe syscall.setresgid16.return = kernel.function("sys_setresgid16").return ? # # long sys_setresuid(uid_t ruid, uid_t euid, uid_t suid) # -probe syscall.setresuid = kernel.function("SyS_setresuid") !, - kernel.function("sys_setresuid") +probe syscall.setresuid = kernel.function("SyS_setresuid").call !, + kernel.function("sys_setresuid").call { name = "setresuid" ruid = __int32($ruid) @@ -2057,7 +2057,7 @@ probe syscall.setresuid.return = kernel.function("SyS_setresuid").return !, # # long sys_setresuid16(old_uid_t ruid, old_uid_t euid, old_uid_t suid) # -probe syscall.setresuid16 = kernel.function("sys_setresuid16") ? +probe syscall.setresuid16 = kernel.function("sys_setresuid16").call ? { name = "setresuid" ruid = __short($ruid) @@ -2074,8 +2074,8 @@ probe syscall.setresuid16.return = kernel.function("sys_setresuid16").return ? # setreuid ___________________________________________________ # long sys_setreuid(uid_t ruid, uid_t euid) # -probe syscall.setreuid = kernel.function("SyS_setreuid") !, - kernel.function("sys_setreuid") +probe syscall.setreuid = kernel.function("SyS_setreuid").call !, + kernel.function("sys_setreuid").call { name = "setreuid" ruid = __int32($ruid) @@ -2091,7 +2091,7 @@ probe syscall.setreuid.return = kernel.function("SyS_setreuid").return !, # setreuid16 _________________________________________________ # long sys_setreuid16(old_uid_t ruid, old_uid_t euid) # -probe syscall.setreuid16 = kernel.function("sys_setreuid16") ? +probe syscall.setreuid16 = kernel.function("sys_setreuid16").call ? { name = "setreuid" ruid = __short($ruid) @@ -2109,8 +2109,8 @@ probe syscall.setreuid16.return = kernel.function("sys_setreuid16").return ? # sys_setrlimit(unsigned int resource, # struct rlimit __user *rlim) # -probe syscall.setrlimit = kernel.function("SyS_setrlimit") !, - kernel.function("sys_setrlimit") +probe syscall.setrlimit = kernel.function("SyS_setrlimit").call !, + kernel.function("sys_setrlimit").call { name = "setrlimit" resource = $resource @@ -2128,7 +2128,7 @@ probe syscall.setrlimit.return = kernel.function("SyS_setrlimit").return !, # # long sys_setsid(void) # -probe syscall.setsid = kernel.function("sys_setsid") +probe syscall.setsid = kernel.function("sys_setsid").call { name = "setsid" argstr = "" @@ -2147,9 +2147,9 @@ probe syscall.setsid.return = kernel.function("sys_setsid").return # char __user *optval, # int optlen) # -probe syscall.setsockopt = kernel.function("compat_sys_setsockopt") ?, - kernel.function("SyS_setsockopt") !, - kernel.function("sys_setsockopt") ? +probe syscall.setsockopt = kernel.function("compat_sys_setsockopt").call ?, + kernel.function("SyS_setsockopt").call !, + kernel.function("sys_setsockopt").call ? { name = "setsockopt" fd = $fd @@ -2175,8 +2175,8 @@ probe syscall.setsockopt.return = kernel.function("compat_sys_setsockopt").retur # asmlinkage long # sys_set_tid_address(int __user *tidptr) # -probe syscall.set_tid_address = kernel.function("SyS_set_tid_address") !, - kernel.function("sys_set_tid_address") +probe syscall.set_tid_address = kernel.function("SyS_set_tid_address").call !, + kernel.function("sys_set_tid_address").call { name = "set_tid_address" tidptr_uaddr = $tidptr @@ -2193,8 +2193,8 @@ probe syscall.set_tid_address.return = kernel.function("SyS_set_tid_address").re # long sys_settimeofday(struct timeval __user *tv, # struct timezone __user *tz) # -probe syscall.settimeofday = kernel.function("SyS_settimeofday") !, - kernel.function("sys_settimeofday") +probe syscall.settimeofday = kernel.function("SyS_settimeofday").call !, + kernel.function("sys_settimeofday").call { name = "settimeofday" tv_uaddr = $tv @@ -2211,8 +2211,8 @@ probe syscall.settimeofday.return = kernel.function("SyS_settimeofday").return ! # long sys32_settimeofday(struct compat_timeval __user *tv, struct timezone __user *tz) # long compat_sys_settimeofday(struct compat_timeval __user *tv, struct timezone __user *tz) # -probe syscall.settimeofday32 = kernel.function("sys32_settimeofday") ?, - kernel.function("compat_sys_settimeofday") ? +probe syscall.settimeofday32 = kernel.function("sys32_settimeofday").call ?, + kernel.function("compat_sys_settimeofday").call ? { name = "settimeofday" tv_uaddr = $tv @@ -2231,9 +2231,9 @@ probe syscall.settimeofday32.return = kernel.function("sys32_settimeofday").retu # long sys_setuid(uid_t uid) # long sys_setuid16(old_uid_t uid) # -probe syscall.setuid = kernel.function("sys_setuid16") ?, - kernel.function("SyS_setuid") !, - kernel.function("sys_setuid") +probe syscall.setuid = kernel.function("sys_setuid16").call ?, + kernel.function("SyS_setuid").call !, + kernel.function("sys_setuid").call { name = "setuid" uid = $uid @@ -2254,8 +2254,8 @@ probe syscall.setuid.return = kernel.function("sys_setuid16").return ?, # size_t size, # int flags) # -probe syscall.setxattr = kernel.function("SyS_setxattr") !, - kernel.function("sys_setxattr") +probe syscall.setxattr = kernel.function("SyS_setxattr").call !, + kernel.function("sys_setxattr").call { name = "setxattr" %( kernel_v >= "2.6.27" %? @@ -2289,7 +2289,7 @@ probe syscall.setxattr.return = kernel.function("SyS_setxattr").return !, # # sys_sgetmask(void) # -probe syscall.sgetmask = kernel.function("sys_sgetmask") ? +probe syscall.sgetmask = kernel.function("sys_sgetmask").call ? { name = "sgetmask" argstr = "" @@ -2304,8 +2304,8 @@ probe syscall.sgetmask.return = kernel.function("sys_sgetmask").return ? # # long sys_shmat(int shmid, char __user *shmaddr, int shmflg) # -probe syscall.shmat = kernel.function("SyS_shmat") !, - kernel.function("sys_shmat") ? +probe syscall.shmat = kernel.function("SyS_shmat").call !, + kernel.function("sys_shmat").call ? { name = "shmat" shmid = $shmid @@ -2324,7 +2324,7 @@ probe syscall.shmat.return = kernel.function("SyS_shmat").return !, # long compat_sys_shmat(int first, int second, compat_uptr_t third, # int version, void __user *uptr) # -probe syscall.compat_sys_shmat = kernel.function("compat_sys_shmat") ? +probe syscall.compat_sys_shmat = kernel.function("compat_sys_shmat").call ? { name = "compat_sys_shmat" first = $first @@ -2345,8 +2345,8 @@ probe syscall.compat_sys_shmat.return = kernel.function("compat_sys_shmat").retu # int cmd, # struct shmid_ds __user *buf) # -probe syscall.shmctl = kernel.function("SyS_shmctl") !, - kernel.function("sys_shmctl") ? +probe syscall.shmctl = kernel.function("SyS_shmctl").call !, + kernel.function("sys_shmctl").call ? { name = "shmctl" shmid = $shmid @@ -2364,7 +2364,7 @@ probe syscall.shmctl.return = kernel.function("SyS_shmctl").return !, # # long compat_sys_shmctl(int first, int second, void __user *uptr) # -probe syscall.compat_sys_shmctl = kernel.function("compat_sys_shmctl") ? +probe syscall.compat_sys_shmctl = kernel.function("compat_sys_shmctl").call ? { name = "compat_sys_shmctl" first = $first @@ -2382,8 +2382,8 @@ probe syscall.compat_sys_shmctl.return = kernel.function("compat_sys_shmctl").re # # long sys_shmdt(char __user *shmaddr) # -probe syscall.shmdt = kernel.function("SyS_shmdt") !, - kernel.function("sys_shmdt") ? +probe syscall.shmdt = kernel.function("SyS_shmdt").call !, + kernel.function("sys_shmdt").call ? { name = "shmdt" shmaddr_uaddr = $shmaddr @@ -2402,8 +2402,8 @@ probe syscall.shmdt.return = kernel.function("SyS_shmdt").return !, # size_t size, # int shmflg) # -probe syscall.shmget = kernel.function("SyS_shmget") !, - kernel.function("sys_shmget") ? +probe syscall.shmget = kernel.function("SyS_shmget").call !, + kernel.function("sys_shmget").call ? { name = "shmget" key = $key @@ -2422,8 +2422,8 @@ probe syscall.shmget.return = kernel.function("SyS_shmget").return !, # # long sys_shutdown(int fd, int how) # -probe syscall.shutdown = kernel.function("SyS_shutdown") !, - kernel.function("sys_shutdown") ? +probe syscall.shutdown = kernel.function("SyS_shutdown").call !, + kernel.function("sys_shutdown").call ? { name = "shutdown" s = $fd @@ -2442,7 +2442,7 @@ probe syscall.shutdown.return = kernel.function("SyS_shutdown").return !, # sys_sigaction(int sig, const struct old_sigaction __user *act, struct old_sigaction __user *oact) # sys32_sigaction(int sig, struct old_sigaction32 __user *act, struct old_sigaction32 __user *oact) # -probe syscall.sigaction = kernel.function("sys_sigaction") ? +probe syscall.sigaction = kernel.function("sys_sigaction").call ? { name = "sigaction" sig = $sig @@ -2455,7 +2455,7 @@ probe syscall.sigaction.return = kernel.function("sys_sigaction").return ? name = "sigaction" retstr = returnstr(1) } -probe syscall.sigaction32 = kernel.function("sys32_sigaction") ? +probe syscall.sigaction32 = kernel.function("sys32_sigaction").call ? { name = "sigaction" sig = $sig @@ -2472,8 +2472,8 @@ probe syscall.sigaction32.return = kernel.function("sys32_sigaction").return ? # signal _____________________________________________________ # unsigned long sys_signal(int sig, __sighandler_t handler) # -probe syscall.signal = kernel.function("SyS_signal") !, - kernel.function("sys_signal") ? +probe syscall.signal = kernel.function("SyS_signal").call !, + kernel.function("sys_signal").call ? { name = "signal" sig = $sig @@ -2493,8 +2493,8 @@ probe syscall.signal.return = kernel.function("SyS_signal").return !, # long compat_sys_signalfd(int ufd, const compat_sigset_t __user *sigmask, # compat_size_t sigsetsize) # -probe syscall.signalfd = kernel.function("SyS_signalfd") !, - kernel.function("sys_signalfd") ? +probe syscall.signalfd = kernel.function("SyS_signalfd").call !, + kernel.function("sys_signalfd").call ? { name = "signalfd" argstr = sprintf("%d, %p, %d", $ufd, $user_mask, $sizemask) @@ -2505,7 +2505,7 @@ probe syscall.signalfd.return = kernel.function("SyS_signalfd").return !, name = "signalfd" retstr = returnstr(1) } -probe syscall.compat_signalfd = kernel.function("compat_sys_signalfd") ? +probe syscall.compat_signalfd = kernel.function("compat_sys_signalfd").call ? { name = "compat_signalfd" argstr = sprintf("%d, %p, %d", $ufd, $sigmask, $sigsetsize) @@ -2519,8 +2519,8 @@ probe syscall.compat_signalfd.return = kernel.function("compat_sys_signalfd").re # sigpending _________________________________________________ # long sys_sigpending(old_sigset_t __user *set) # -probe syscall.sigpending = kernel.function("SyS_sigpending") !, - kernel.function("sys_sigpending") ? +probe syscall.sigpending = kernel.function("SyS_sigpending").call !, + kernel.function("sys_sigpending").call ? { name = "sigpending" argstr = sprintf("%p", $set) @@ -2535,8 +2535,8 @@ probe syscall.sigpending.return = kernel.function("SyS_sigpending").return !, # sigprocmask ________________________________________________ # long sys_sigprocmask(int how, old_sigset_t __user *set, old_sigset_t __user *oset) # -probe syscall.sigprocmask = kernel.function("SyS_sigprocmask") !, - kernel.function("sys_sigprocmask") ? +probe syscall.sigprocmask = kernel.function("SyS_sigprocmask").call !, + kernel.function("sys_sigprocmask").call ? { name = "sigprocmask" how = $how @@ -2555,8 +2555,8 @@ probe syscall.sigprocmask.return = kernel.function("SyS_sigprocmask").return !, # sigreturn __________________________________________________ # int sys_sigreturn(unsigned long __unused) # -probe syscall.sigreturn = kernel.function("sys_sigreturn") ?, - kernel.function("sys32_sigreturn") ? +probe syscall.sigreturn = kernel.function("sys_sigreturn").call ?, + kernel.function("sys32_sigreturn").call ? { name = "sigreturn" argstr = "" @@ -2570,8 +2570,8 @@ probe syscall.sigreturn.return = kernel.function("sys_sigreturn").return ?, # sigsuspend _________________________________________________ # -probe syscall.sigsuspend = kernel.function("sys_sigsuspend") ?, - kernel.function("sys32_sigsuspend") ? +probe syscall.sigsuspend = kernel.function("sys_sigsuspend").call ?, + kernel.function("sys32_sigsuspend").call ? { name = "sigsuspend" argstr = "" @@ -2586,8 +2586,8 @@ probe syscall.sigsuspend.return = kernel.function("sys_sigsuspend").return ?, # socket _____________________________________________________ # long sys_socket(int family, int type, int protocol) # -probe syscall.socket = kernel.function("SyS_socket") !, - kernel.function("sys_socket") ? +probe syscall.socket = kernel.function("SyS_socket").call !, + kernel.function("sys_socket").call ? { name = "socket" family = $family @@ -2609,7 +2609,7 @@ probe syscall.socket.return = kernel.function("SyS_socket").return !, # # long sys_socketcall(int call, unsigned long __user *args) # -#probe syscall.socketcall = kernel.function("sys_socketcall") ? +#probe syscall.socketcall = kernel.function("sys_socketcall").call ? #{ # name = "socketcall" # call = $call @@ -2628,8 +2628,8 @@ probe syscall.socket.return = kernel.function("SyS_socket").return !, # int protocol, # int __user *usockvec) # -probe syscall.socketpair = kernel.function("SyS_socketpair") !, - kernel.function("sys_socketpair") ? +probe syscall.socketpair = kernel.function("SyS_socketpair").call !, + kernel.function("sys_socketpair").call ? { name = "socketpair" family = $family @@ -2654,8 +2654,8 @@ probe syscall.socketpair.return = kernel.function("SyS_socketpair").return !, # int fd_out, loff_t __user *off_out, # size_t len, unsigned int flags) # -probe syscall.splice = kernel.function("SyS_splice") !, - kernel.function("sys_splice") ? +probe syscall.splice = kernel.function("SyS_splice").call !, + kernel.function("sys_splice").call ? { name = "splice" argstr = sprintf("%d, %p, %d, %p, %d, 0x%x", @@ -2672,8 +2672,8 @@ probe syscall.splice.return = kernel.function("SyS_splice").return !, # # long sys_ssetmask(int newmask) # -probe syscall.ssetmask = kernel.function("SyS_ssetmask") !, - kernel.function("sys_ssetmask") ? +probe syscall.ssetmask = kernel.function("SyS_ssetmask").call !, + kernel.function("sys_ssetmask").call ? { name = "ssetmask" newmask = $newmask @@ -2692,14 +2692,14 @@ probe syscall.ssetmask.return = kernel.function("SyS_ssetmask").return !, # long sys_stat64(char __user * filename, struct stat64 __user * statbuf) # long sys_oabi_stat64(char __user * filename, struct oldabi_stat64 __user * statbuf) # long compat_sys_newstat(char __user * filename, struct compat_stat __user *statbuf) -probe syscall.stat = kernel.function("sys_stat") ?, - kernel.function("SyS_newstat") ?, - kernel.function("sys_newstat") ?, - kernel.function("sys32_stat64") ?, - kernel.function("SyS_stat64") ?, - kernel.function("sys_stat64") ?, - kernel.function("sys_oabi_stat64") ?, - kernel.function("compat_sys_newstat") ? +probe syscall.stat = kernel.function("sys_stat").call ?, + kernel.function("SyS_newstat").call ?, + kernel.function("sys_newstat").call ?, + kernel.function("sys32_stat64").call ?, + kernel.function("SyS_stat64").call ?, + kernel.function("sys_stat64").call ?, + kernel.function("sys_oabi_stat64").call ?, + kernel.function("compat_sys_newstat").call ? { name = "stat" filename_uaddr = $filename @@ -2724,9 +2724,9 @@ probe syscall.stat.return = kernel.function("sys_stat").return ?, # long sys_statfs(const char __user * path, struct statfs __user * buf) # long compat_sys_statfs(const char __user *path, struct compat_statfs __user *buf) # -probe syscall.statfs = kernel.function("compat_sys_statfs") ?, - kernel.function("SyS_statfs") !, - kernel.function("sys_statfs") ? +probe syscall.statfs = kernel.function("compat_sys_statfs").call ?, + kernel.function("SyS_statfs").call !, + kernel.function("sys_statfs").call ? { name = "statfs" buf_uaddr = $buf @@ -2752,9 +2752,9 @@ probe syscall.statfs.return = kernel.function("compat_sys_statfs").return ?, # long sys_statfs64(const char __user *path, size_t sz, struct statfs64 __user *buf) # long compat_sys_statfs64(const char __user *path, compat_size_t sz, struct compat_statfs64 __user *buf) # -probe syscall.statfs64 = kernel.function("compat_sys_statfs64") ?, - kernel.function("SyS_statfs64") !, - kernel.function("sys_statfs64") ? +probe syscall.statfs64 = kernel.function("compat_sys_statfs64").call ?, + kernel.function("SyS_statfs64").call !, + kernel.function("sys_statfs64").call ? { name = "statfs" sz = $sz @@ -2781,9 +2781,9 @@ probe syscall.statfs64.return = kernel.function("compat_sys_statfs64").return ?, # long sys_stime(time_t __user *tptr) # long compat_sys_stime(compat_time_t __user *tptr) # -probe syscall.stime = kernel.function("compat_sys_stime") ?, - kernel.function("SyS_stime") !, - kernel.function("sys_stime") ? +probe syscall.stime = kernel.function("compat_sys_stime").call ?, + kernel.function("SyS_stime").call !, + kernel.function("sys_stime").call ? { name = "stime" t_uaddr = $tptr @@ -2803,8 +2803,8 @@ probe syscall.stime.return = kernel.function("compat_sys_stime").return ?, # asmlinkage long # sys_swapoff(const char __user * specialfile) # -probe syscall.swapoff = kernel.function("SyS_swapoff") !, - kernel.function("sys_swapoff") ? +probe syscall.swapoff = kernel.function("SyS_swapoff").call !, + kernel.function("sys_swapoff").call ? { name = "swapoff" path = user_string($specialfile) @@ -2822,8 +2822,8 @@ probe syscall.swapoff.return = kernel.function("SyS_swapoff").return !, # sys_swapon(const char __user * specialfile, # int swap_flags) # -probe syscall.swapon = kernel.function("SyS_swapon") !, - kernel.function("sys_swapon") ? +probe syscall.swapon = kernel.function("SyS_swapon").call !, + kernel.function("sys_swapon").call ? { name = "swapon" path = user_string($specialfile) @@ -2840,8 +2840,8 @@ probe syscall.swapon.return = kernel.function("SyS_swapon").return !, # symlink ____________________________________________________ # long sys_symlink(const char __user * oldname, # const char __user * newname) -probe syscall.symlink = kernel.function("SyS_symlink") !, - kernel.function("sys_symlink") +probe syscall.symlink = kernel.function("SyS_symlink").call !, + kernel.function("sys_symlink").call { name = "symlink" oldpath = user_string($oldname) @@ -2860,8 +2860,8 @@ probe syscall.symlink.return = kernel.function("SyS_symlink").return !, # new function with 2.6.16 # long sys_symlinkat(const char __user *oldname, int newdfd, # const char __user *newname) -probe syscall.symlinkat = kernel.function("SyS_symlinkat") !, - kernel.function("sys_symlinkat") ? +probe syscall.symlinkat = kernel.function("SyS_symlinkat").call !, + kernel.function("sys_symlinkat").call ? { name = "symlinkat" oldname = $oldname @@ -2884,7 +2884,7 @@ probe syscall.symlinkat.return = kernel.function("SyS_symlinkat").return !, # # sys_sync(void) # -probe syscall.sync = kernel.function("sys_sync") +probe syscall.sync = kernel.function("sys_sync").call { name = "sync" argstr = "" @@ -2899,9 +2899,9 @@ probe syscall.sync.return = kernel.function("sys_sync").return # # long sys_sysctl(struct __sysctl_args __user *args) # -probe syscall.sysctl = kernel.function("compat_sys_sysctl") ?, - kernel.function("SyS_sysctl") !, - kernel.function("sys_sysctl") ? +probe syscall.sysctl = kernel.function("compat_sys_sysctl").call ?, + kernel.function("SyS_sysctl").call !, + kernel.function("sys_sysctl").call ? { name = "sysctl" argstr = sprintf("%p", $args) @@ -2921,8 +2921,8 @@ probe syscall.sysctl.return = kernel.function("compat_sys_sysctl").return ?, # unsigned long arg1, # unsigned long arg2) # -probe syscall.sysfs = kernel.function("SyS_sysfs") !, - kernel.function("sys_sysfs") +probe syscall.sysfs = kernel.function("SyS_sysfs").call !, + kernel.function("sys_sysfs").call { name = "sysfs" option = $option @@ -2947,9 +2947,9 @@ probe syscall.sysfs.return = kernel.function("SyS_sysfs").return !, # # long sys_sysinfo(struct sysinfo __user *info) # long compat_sys_sysinfo(struct compat_sysinfo __user *info) -probe syscall.sysinfo = kernel.function("compat_sys_sysinfo") ?, - kernel.function("SyS_sysinfo") !, - kernel.function("sys_sysinfo") +probe syscall.sysinfo = kernel.function("compat_sys_sysinfo").call ?, + kernel.function("SyS_sysinfo").call !, + kernel.function("sys_sysinfo").call { name = "sysinfo" info_uaddr = $info @@ -2967,8 +2967,8 @@ probe syscall.sysinfo.return = kernel.function("compat_sys_sysinfo").return ?, # # long sys_syslog(int type, char __user * buf, int len) # -probe syscall.syslog = kernel.function("SyS_syslog") !, - kernel.function("sys_syslog") +probe syscall.syslog = kernel.function("SyS_syslog").call !, + kernel.function("sys_syslog").call { name = "syslog" type = $type @@ -2987,8 +2987,8 @@ probe syscall.syslog.return = kernel.function("SyS_syslog").return !, # # long sys_tee(int fdin, int fdout, size_t len, unsigned int flags) # -probe syscall.tee = kernel.function("SyS_tee") !, - kernel.function("sys_tee") ? +probe syscall.tee = kernel.function("SyS_tee").call !, + kernel.function("sys_tee").call ? { name = "tee" argstr = sprintf("%d, %d, %d, 0x%x", $fdin, $fdout, $len, $flags) @@ -3007,8 +3007,8 @@ probe syscall.tee.return = kernel.function("SyS_tee").return !, # int pid, # int sig) # -probe syscall.tgkill = kernel.function("SyS_tgkill") !, - kernel.function("sys_tgkill") +probe syscall.tgkill = kernel.function("SyS_tgkill").call !, + kernel.function("sys_tgkill").call { name = "tgkill" tgid = $tgid @@ -3029,11 +3029,11 @@ probe syscall.tgkill.return = kernel.function("SyS_tgkill").return !, # long sys32_time(compat_time_t __user * tloc) # long compat_sys_time(compat_time_t __user * tloc) # -probe syscall.time = kernel.function("sys32_time") ?, - kernel.function("sys_time64") ?, - kernel.function("compat_sys_time") ?, - kernel.function("SyS_time") !, - kernel.function("sys_time") ? +probe syscall.time = kernel.function("sys32_time").call ?, + kernel.function("sys_time64").call ?, + kernel.function("compat_sys_time").call ?, + kernel.function("SyS_time").call !, + kernel.function("sys_time").call ? { name = "time" t_uaddr = $tloc @@ -3055,8 +3055,8 @@ probe syscall.time.return = kernel.function("sys32_time").return ?, # struct sigevent __user *timer_event_spec, # timer_t __user * created_timer_id) # -probe syscall.timer_create = kernel.function("SyS_timer_create") !, - kernel.function("sys_timer_create") +probe syscall.timer_create = kernel.function("SyS_timer_create").call !, + kernel.function("sys_timer_create").call { name = "timer_create" clockid = $which_clock @@ -3076,8 +3076,8 @@ probe syscall.timer_create.return = kernel.function("SyS_timer_create").return ! # # long sys_timer_delete(timer_t timer_id) # -probe syscall.timer_delete = kernel.function("SyS_timer_delete") !, - kernel.function("sys_timer_delete") +probe syscall.timer_delete = kernel.function("SyS_timer_delete").call !, + kernel.function("sys_timer_delete").call { name = "timer_delete" timerid = $timer_id @@ -3094,8 +3094,8 @@ probe syscall.timer_delete.return = kernel.function("SyS_timer_delete").return ! # # long sys_timer_getoverrun(timer_t timer_id) # -probe syscall.timer_getoverrun = kernel.function("SyS_timer_getoverrun") !, - kernel.function("sys_timer_getoverrun") +probe syscall.timer_getoverrun = kernel.function("SyS_timer_getoverrun").call !, + kernel.function("sys_timer_getoverrun").call { name = "timer_getoverrun" timerid = $timer_id @@ -3113,8 +3113,8 @@ probe syscall.timer_getoverrun.return = kernel.function("SyS_timer_getoverrun"). # long sys_timer_gettime(timer_t timer_id, # struct itimerspec __user *setting) # -probe syscall.timer_gettime = kernel.function("SyS_timer_gettime") !, - kernel.function("sys_timer_gettime") +probe syscall.timer_gettime = kernel.function("SyS_timer_gettime").call !, + kernel.function("sys_timer_gettime").call { name = "timer_gettime" timerid = $timer_id @@ -3135,8 +3135,8 @@ probe syscall.timer_gettime.return = kernel.function("SyS_timer_gettime").return # const struct itimerspec __user *new_setting, # struct itimerspec __user *old_setting) # -probe syscall.timer_settime = kernel.function("SyS_timer_settime") !, - kernel.function("sys_timer_settime") +probe syscall.timer_settime = kernel.function("SyS_timer_settime").call !, + kernel.function("sys_timer_settime").call { name = "timer_settime" timerid = $timer_id @@ -3161,8 +3161,8 @@ probe syscall.timer_settime.return = kernel.function("SyS_timer_settime").return # long compat_sys_timerfd(int ufd, int clockid, int flags, # const struct compat_itimerspec __user *utmr) # -probe syscall.timerfd = kernel.function("sys_timerfd") ?, - kernel.function("compat_sys_timerfd") ? +probe syscall.timerfd = kernel.function("sys_timerfd").call ?, + kernel.function("compat_sys_timerfd").call ? { name = "timerfd" argstr = sprintf("%d, %d, 0x%x", $ufd, $clockid, $flags) @@ -3178,9 +3178,9 @@ probe syscall.timerfd.return = kernel.function("sys_timerfd").return ?, # # long sys_times(struct tms __user * tbuf) # long compat_sys_times(struct compat_tms __user *tbuf) -probe syscall.times = kernel.function("compat_sys_times") ?, - kernel.function("SyS_times") !, - kernel.function("sys_times") ? +probe syscall.times = kernel.function("compat_sys_times").call ?, + kernel.function("SyS_times").call !, + kernel.function("sys_times").call ? { name = "times" argstr = sprintf("%p", $tbuf) @@ -3199,8 +3199,8 @@ probe syscall.times.return = kernel.function("compat_sys_times").return ?, # sys_tkill(int pid, # int sig) # -probe syscall.tkill = kernel.function("SyS_tkill") !, - kernel.function("sys_tkill") +probe syscall.tkill = kernel.function("SyS_tkill").call !, + kernel.function("sys_tkill").call { name = "tkill" pid = $pid @@ -3219,9 +3219,9 @@ probe syscall.tkill.return = kernel.function("SyS_tkill").return !, # sys_truncate(const char __user * path, unsigned long length) # sys_truncate64(const char __user * path, loff_t length) # -probe syscall.truncate = kernel.function("SyS_truncate") !, - kernel.function("sys_truncate") ?, - kernel.function("sys_truncate64") ? +probe syscall.truncate = kernel.function("SyS_truncate").call !, + kernel.function("sys_truncate").call ?, + kernel.function("sys_truncate64").call ? { name = "truncate" path_uaddr = $path @@ -3240,7 +3240,7 @@ probe syscall.truncate.return = kernel.function("SyS_truncate").return !, # tux ________________________________________________________ # long sys_tux (unsigned int action, user_req_t *u_info) # -probe syscall.tux = kernel.function("sys_tux") ? +probe syscall.tux = kernel.function("sys_tux").call ? { name = "tux" action = $action @@ -3256,8 +3256,8 @@ probe syscall.tux.return = kernel.function("sys_tux").return ? # umask ______________________________________________________ # long sys_umask(int mask) # -probe syscall.umask = kernel.function("SyS_umask") !, - kernel.function("sys_umask") +probe syscall.umask = kernel.function("SyS_umask").call !, + kernel.function("sys_umask").call { name = "umask" mask = $mask @@ -3273,8 +3273,8 @@ probe syscall.umask.return = kernel.function("SyS_umask").return !, # umount _____________________________________________________ # long sys_umount(char __user * name, int flags) # -probe syscall.umount = kernel.function("SyS_umount") !, - kernel.function("sys_umount") +probe syscall.umount = kernel.function("SyS_umount").call !, + kernel.function("sys_umount").call { name = "umount" target = user_string($name) @@ -3296,12 +3296,12 @@ probe syscall.umount.return = kernel.function("SyS_umount").return !, # int sys32_olduname(struct oldold_utsname __user * name) # long sys32_uname(struct old_utsname __user * name) # -probe syscall.uname = kernel.function("sys_uname") ?, - kernel.function("sys_olduname") ?, - kernel.function("sys32_olduname") ?, - kernel.function("sys32_uname") ?, - kernel.function("SyS_newuname") !, - kernel.function("sys_newuname") ? +probe syscall.uname = kernel.function("sys_uname").call ?, + kernel.function("sys_olduname").call ?, + kernel.function("sys32_olduname").call ?, + kernel.function("sys32_uname").call ?, + kernel.function("SyS_newuname").call !, + kernel.function("sys_newuname").call ? { name = "uname" argstr = sprintf("%p", $name) @@ -3321,8 +3321,8 @@ probe syscall.uname.return = kernel.function("sys_uname").return ?, # unlink _____________________________________________________ # long sys_unlink(const char __user * pathname) # -probe syscall.unlink = kernel.function("SyS_unlink") !, - kernel.function("sys_unlink") +probe syscall.unlink = kernel.function("SyS_unlink").call !, + kernel.function("sys_unlink").call { name = "unlink" pathname_uaddr = $pathname @@ -3340,8 +3340,8 @@ probe syscall.unlink.return = kernel.function("SyS_unlink").return !, # new function with 2.6.16 # long sys_unlinkat(int dfd, const char __user *pathname, # int flag) -probe syscall.unlinkat = kernel.function("SyS_unlinkat") !, - kernel.function("sys_unlinkat") ? +probe syscall.unlinkat = kernel.function("SyS_unlinkat").call !, + kernel.function("sys_unlinkat").call ? { name = "unlinkat" dfd = $dfd @@ -3362,8 +3362,8 @@ probe syscall.unlinkat.return = kernel.function("SyS_unlinkat").return !, # unshare ____________________________________________________ # new function with 2.6.16 # long sys_unshare(unsigned long unshare_flags) -probe syscall.unshare = kernel.function("SyS_unshare") !, - kernel.function("sys_unshare") ? +probe syscall.unshare = kernel.function("SyS_unshare").call !, + kernel.function("sys_unshare").call ? { name = "unshare" unshare_flags = $unshare_flags @@ -3381,8 +3381,8 @@ probe syscall.unshare.return = kernel.function("SyS_unshare").return !, # asmlinkage long # sys_uselib(const char __user * library) # -probe syscall.uselib = kernel.function("SyS_uselib") !, - kernel.function("sys_uselib") +probe syscall.uselib = kernel.function("SyS_uselib").call !, + kernel.function("sys_uselib").call { name = "uselib" library_uaddr = $library @@ -3398,8 +3398,8 @@ probe syscall.uselib.return = kernel.function("SyS_uselib").return !, # ustat ______________________________________________________ # long sys_ustat(unsigned dev, struct ustat __user * ubuf) # -probe syscall.ustat = kernel.function("SyS_ustat") !, - kernel.function("sys_ustat") +probe syscall.ustat = kernel.function("SyS_ustat").call !, + kernel.function("sys_ustat").call { name = "ustat" dev = $dev @@ -3408,7 +3408,7 @@ probe syscall.ustat = kernel.function("SyS_ustat") !, } #long sys32_ustat(unsigned dev, struct ustat32 __user *u32p) -probe syscall.ustat32 = kernel.function("sys32_ustat") ? +probe syscall.ustat32 = kernel.function("sys32_ustat").call ? { name = "ustat" dev = $dev @@ -3417,7 +3417,7 @@ probe syscall.ustat32 = kernel.function("sys32_ustat") ? # Since 2.6.30 sys32_ustat is compat_sys_ustat # Note that last argument changed name. #long compat_sys_ustat(unsigned dev, struct compat_ustat __user *u) -probe syscall.ustat32 = kernel.function("compat_sys_ustat") ? +probe syscall.ustat32 = kernel.function("compat_sys_ustat").call ? { name = "ustat" dev = $dev @@ -3435,8 +3435,8 @@ probe syscall.ustat.return = kernel.function("SyS_ustat").return ?, # utime ______________________________________________________ # long sys_utime(char __user * filename, struct utimbuf __user * times) -probe syscall.utime = kernel.function("SyS_utime") !, - kernel.function("sys_utime") ? +probe syscall.utime = kernel.function("SyS_utime").call !, + kernel.function("sys_utime").call ? { name = "utime" filename_uaddr = $filename @@ -3455,7 +3455,7 @@ probe syscall.utime.return = kernel.function("SyS_utime").return !, } # long compat_sys_utime(char __user *filename, struct compat_utimbuf __user *t) -probe syscall.compat_utime = kernel.function("compat_sys_utime") ? +probe syscall.compat_utime = kernel.function("compat_sys_utime").call ? { name = "utime" filename_uaddr = $filename @@ -3476,8 +3476,8 @@ probe syscall.compat_utime.return = kernel.function("compat_sys_utime").return ? # # long sys_utimes(char __user * filename, struct timeval __user * utimes) # -probe syscall.utimes = kernel.function("SyS_utimes") !, - kernel.function("sys_utimes") +probe syscall.utimes = kernel.function("SyS_utimes").call !, + kernel.function("sys_utimes").call { name = "utimes" filename_uaddr = $filename @@ -3496,7 +3496,7 @@ probe syscall.utimes.return = kernel.function("SyS_utimes").return !, # # long compat_sys_utimes(char __user *filename, struct compat_timeval __user *t) # -probe syscall.compat_sys_utimes = kernel.function("compat_sys_utimes") ? +probe syscall.compat_sys_utimes = kernel.function("compat_sys_utimes").call ? { name = "utimes" filename = user_string($filename) @@ -3513,14 +3513,14 @@ probe syscall.compat_sys_utimes.return = kernel.function("compat_sys_utimes").re # long sys_utimensat(int dfd, char __user *filename, struct timespec __user *utimes, int flags) # long compat_sys_utimensat(unsigned int dfd, char __user *filename, struct compat_timespec __user *t, int flags) # -probe syscall.utimensat = kernel.function("SyS_utimensat") !, - kernel.function("sys_utimensat") ? +probe syscall.utimensat = kernel.function("SyS_utimensat").call !, + kernel.function("sys_utimensat").call ? { name = "utimensat" argstr = sprintf("%s, %s, %s, %s", _dfd_str($dfd), user_string_quoted($filename), _struct_timespec_u($utimes, 2), _at_flag_str($flags)) } -probe syscall.compat_utimensat = kernel.function("compat_sys_utimensat") ? +probe syscall.compat_utimensat = kernel.function("compat_sys_utimensat").call ? { name = "utimensat" argstr = sprintf("%s, %s, %s, %s", _dfd_str($dfd), user_string_quoted($filename), _struct_compat_timespec_u($t, 2), @@ -3543,7 +3543,7 @@ probe syscall.compat_utimensat.return = kernel.function("compat_sys_utimensat") # asmlinkage long # sys_vhangup(void) # -probe syscall.vhangup = kernel.function("sys_vhangup") +probe syscall.vhangup = kernel.function("sys_vhangup").call { name = "vhangup" argstr = "" @@ -3561,13 +3561,13 @@ probe syscall.vhangup.return = kernel.function("sys_vhangup").return # long compat_sys_vmsplice(int fd, const struct compat_iovec __user *iov32, # unsigned int nr_segs, unsigned int flags) # -probe syscall.vmsplice = kernel.function("SyS_vmsplice") !, - kernel.function("sys_vmsplice") ? +probe syscall.vmsplice = kernel.function("SyS_vmsplice").call !, + kernel.function("sys_vmsplice").call ? { name = "vmsplice" argstr = sprintf("%d, %p, %d, 0x%x", $fd, $iov, $nr_segs, $flags) } -probe syscall.compat_vmsplice = kernel.function("compat_sys_vmsplice") ? +probe syscall.compat_vmsplice = kernel.function("compat_sys_vmsplice").call ? { name = "vmsplice" argstr = sprintf("%d, %p, %d, 0x%x", $fd, $iov32, $nr_segs, $flags) @@ -3591,8 +3591,8 @@ probe syscall.compat_vmsplice.return = kernel.function("compat_sys_vmsplice").re # int options, # struct rusage __user *ru) # -probe syscall.wait4 = kernel.function("SyS_wait4") !, - kernel.function("sys_wait4") +probe syscall.wait4 = kernel.function("SyS_wait4").call !, + kernel.function("sys_wait4").call { name = "wait4" pid = %( kernel_vr >= "2.6.25" %? $upid %: $pid%) @@ -3618,8 +3618,8 @@ probe syscall.wait4.return = kernel.function("SyS_wait4").return !, # int options, # struct rusage __user *ru) # -probe syscall.waitid = kernel.function("SyS_waitid") !, - kernel.function("sys_waitid") +probe syscall.waitid = kernel.function("SyS_waitid").call !, + kernel.function("sys_waitid").call { name = "waitid" pid = %( kernel_vr >= "2.6.25" %? $upid %: $pid%) @@ -3647,8 +3647,8 @@ probe syscall.waitid.return = kernel.function("SyS_waitid").return !, # int options, # struct rusage __user *ru) # -probe syscall.waitpid = kernel.function("SyS_wait4") !, - kernel.function("sys_wait4") +probe syscall.waitpid = kernel.function("SyS_wait4").call !, + kernel.function("sys_wait4").call { name = "waitpid" pid = $pid @@ -3673,8 +3673,8 @@ probe syscall.waitpid.return = kernel.function("SyS_wait4").return !, # const char __user * buf, # size_t count) # -probe syscall.write = kernel.function("SyS_write") !, - kernel.function("sys_write") +probe syscall.write = kernel.function("SyS_write").call !, + kernel.function("sys_write").call { name = "write" fd = $fd @@ -3698,9 +3698,9 @@ probe syscall.write.return = kernel.function("SyS_write").return !, # const struct compat_iovec __user *vec, # unsigned long vlen) # -probe syscall.writev = kernel.function("compat_sys_writev") ?, - kernel.function("SyS_writev") !, - kernel.function("sys_writev") +probe syscall.writev = kernel.function("compat_sys_writev").call ?, + kernel.function("SyS_writev").call !, + kernel.function("sys_writev").call { name = "writev" vector_uaddr = $vec |