# S390-specific system calls %(arch == "s390" %? # getresgid __________________________________________________ # long sys32_getresgid16(u16 __user *rgid, u16 __user *egid, u16 __user *sgid) # probe syscall.getresgid16 = kernel.function("sys32_getresgid16") ? { name = "getresgid" argstr = sprintf("%p, %p, %p", $rgid, $egid, $sgid) } probe syscall.getresgid16.return = kernel.function("sys32_getresgid16").return ? { name = "getresgid" retstr = returnstr(1) } # getresuid __________________________________________________ # long sys32_getresuid16(u16 __user *ruid, u16 __user *euid, u16 __user *suid) # probe syscall.getresuid16 = kernel.function("sys32_getresuid16") ? { name = "getresuid" argstr = sprintf("%p, %p, %p", $ruid, $euid, $suid) } probe syscall.getresuid16.return = kernel.function("sys32_getresuid16").return ? { name = "getresuid" retstr = returnstr(1) } # ipc _________________________________________________ # long sys32_ipc(u32 call, int first, int second, int third, u32 ptr) # probe syscall.ipc = kernel.function("sys32_ipc") ? { name = "ipc" argstr = sprintf("%d, %d, %d, %d, %p", $call, $first, $second, $third, $ptr) } probe syscall.ipc.return = kernel.function("sys_ipc").return ? { name = "ipc" retstr = returnstr(1) } # mmap _________________________________________________ # long old_mmap(struct mmap_arg_struct __user *arg) # long old32_mmap(struct mmap_arg_struct_emu31 __user *arg) # probe syscall.mmap = kernel.function("old_mmap") ?, kernel.function("old32_mmap") ?, kernel.function("SyS_s390_old_mmap") ? { name = "mmap" if ((probefunc() == "old_mmap") || (probefunc() == "SyS_s390_old_mmap")) argstr = get_mmap_args($arg) else argstr = get_32mmap_args($arg) } probe syscall.mmap.return = kernel.function("old_mmap").return ?, kernel.function("old32_mmap").return ?, kernel.function("SyS_s390_old_mmap").return ? { name = "mmap" retstr = returnstr(2) } # mmap2 _________________________________________________ # # long sys_mmap2(struct mmap_arg_struct __user *arg) # long sys32_mmap2(struct mmap_arg_struct_emu31 __user *arg) # probe syscall.mmap2 = kernel.function("sys_mmap2") ?, kernel.function("sys32_mmap2") ?, kernel.function("SyS_mmap2") ? { name = "mmap2" if ((probefunc() == "sys_mmap2") || (probefunc() == "SyS_mmap2")) argstr = get_mmap_args($arg) else argstr = get_32mmap_args($arg) } probe syscall.mmap2.return = kernel.function("sys_mmap2").return ?, kernel.function("sys32_mmap2").return ?, kernel.function("SyS_mmap2").return ? { name = "mmap2" retstr = returnstr(2) } # sysctl _____________________________________________________ # # long sys32_sysctl(struct __sysctl_args32 __user *args) # probe syscall.sysctl32 = kernel.function("sys32_sysctl") ? { name = "sysctl" argstr = sprintf("%p", $args) } probe syscall.sysctl32.return = kernel.function("sys32_sysctl").return ? { name = "sysctl" retstr = returnstr(1) } /* compat */ function get_32mmap_args:string (args:long) %{ /* pure */ struct mmap_arg_struct_emu31 { u32 addr; u32 len; u32 prot; u32 flags; u32 fd; u32 offset; }a; char proto[60]; char flags[256]; if(_stp_copy_from_user((char *)&a, (char *)THIS->args, sizeof(a))== 0){ /* _mprotect_prot_str */ proto[0] = '\0'; if(a.prot){ if(a.prot & 1) strcat (proto, "PROT_READ|"); if(a.prot & 2) strcat (proto, "PROT_WRITE|"); if(a.prot & 4) strcat (proto, "PROT_EXEC|"); } else { strcat (proto, "PROT_NONE"); } if (proto[0] != '\0') proto[strlen(proto)-1] = '\0'; /* _mmap_flags */ flags[0]='\0'; if (a.flags & 1) strcat (flags, "MAP_SHARED|"); if (a.flags & 2) strcat (flags, "MAP_PRIVATE|"); if (a.flags & 0x10) strcat (flags, "MAP_FIXED|"); if (a.flags & 0x20) strcat (flags, "MAP_ANONYMOUS|"); if (a.flags & 0x100) strcat (flags, "MAP_GROWSDOWN|"); if (a.flags & 0x800) strcat (flags, "MAP_DENYWRITE|"); if (a.flags & 0x1000) strcat (flags, "MAP_EXECUTABLE|"); if (a.flags & 0x2000) strcat (flags, "MAP_LOCKED|"); if (a.flags & 0x4000) strcat (flags, "MAP_NORESERVE|"); if (a.flags & 0x8000) strcat (flags, "MAP_POPULATE|"); if (a.flags & 0x10000) strcat (flags, "MAP_NONBLOCK|"); if (flags[0] != '\0') flags[strlen(flags)-1] = '\0'; sprintf(THIS->__retvalue,"0x%x, %d, %s, %s, %d, %d", a.addr, a.len, proto, flags, a.fd, a.offset); }else{ strlcpy (THIS->__retvalue, "UNKNOWN", MAXSTRINGLEN); } %} %)