path: root/tapset/x86_64/syscalls.stp

# fstat ______________________________________________________
# long sys_fstat(unsigned int fd,struct __old_kernel_stat __user * statbuf)
probe syscall.fstat = kernel.function("sys_fstat") {
	name = "fstat"
	filedes = $fd
	buf_uaddr = $statbuf
	argstr = sprintf("%d, [0x%p]", filedes, buf_uaddr)
}
probe syscall.fstat.return = kernel.function("sys_fstat").return {
	name = "fstat"
	retstr = returnstr(1)
}

# getegid16 __________________________________________________
# long sys_getegid16(void)
probe syscall.getegid16 = kernel.function("sys_getegid16") {
	name = "getegid16"
}
probe syscall.getegid16.return = kernel.function("sys_getegid16").return {
	name = "getegid16"
	retstr = returnstr(1)
}

# geteuid16 __________________________________________________
# long sys_geteuid16(void)
probe syscall.geteuid16 = kernel.function("sys_geteuid16") {
	name = "geteuid16"
}
probe syscall.geteuid16.return = kernel.function("sys_geteuid16").return {
	name = "geteuid16"
	retstr = returnstr(1)
}

# getgid16 ___________________________________________________
# long sys_getgid16(void)
probe syscall.getgid16 = kernel.function("sys_getgid16") {
	name = "getgid16"
}
probe syscall.getgid16.return = kernel.function("sys_getgid16").return {
	name = "getgid16"
	retstr = returnstr(1)
}

# getgroups16 ________________________________________________
# long sys_getgroups16(int gidsetsize, old_gid_t __user *grouplist)
probe syscall.getgroups16 = kernel.function("sys_getgroups16") {
	name = "getgroups16"
	size = $gidsetsize
	list_uaddr = $grouplist
	argstr = sprintf("%d, [0x%p]", size, list_uaddr)
}
probe syscall.getgroups16.return = kernel.function("sys_getgroups16").return {
	name = "getgroups16"
	retstr = returnstr(1)
}

# getuid16 ___________________________________________________
# long sys_getuid16(void)
probe syscall.getuid16 = kernel.function("sys_getuid16") {
	name = "getuid16"
}
probe syscall.getuid16.return = kernel.function("sys_getuid16").return {
	name = "getuid16"
	retstr = returnstr(1)
}

# lstat ______________________________________________________
# long sys_lstat(char __user * filename, struct __old_kernel_stat __user * statbuf)
probe syscall.lstat = kernel.function("sys_lstat") {
	name = "lstat"
	file_name = user_string($filename)
	buf_uaddr = $statbuf
	argstr = sprintf("%s, [0x%p]", file_name, buf_uaddr) 
}
probe syscall.lstat.return = kernel.function("sys_lstat").return {
	name = "lstat.return"
	retstr = returnstr(1)
}


# setgroups16 ________________________________________________
#
# asmlinkage long
# sys_setgroups16(int gidsetsize,
#		     old_gid_t __user *grouplist)
#
probe syscall.setgroups16 = kernel.function("sys_setgroups16") {
	name = "setgroups16"
	size = $gidsetsize
	list_uaddr = $grouplist
	argstr = ""
}
probe syscall.setgroups16.return = kernel.function("sys_setgroups16").return {
	name = "setgroups16"
	retstr = returnstr(1)
}

# stat _______________________________________________________
#
# asmlinkage long
# sys_stat(char __user * filename,
#	    struct __old_stat __user * statbuf)
#
probe syscall.stat = kernel.function("sys_stat") {
	name = "stat"
	filename_uaddr = $filename
	filename = user_string($filename)
	buf_uaddr = $statbuf
	argstr = sprintf("%s, [0x%p]", filename, buf_uaddr)
}
probe syscall.stat.return = kernel.function("sys_stat").return {
	name = "stat"
	retstr = returnstr(1)
}

# acct _______________________________________________________
# long sys_acct(const char __user *name)
probe syscall.acct = kernel.function("sys_acct") {
	name = "acct"
        filename = user_string($name)
	argstr = filename
}
probe syscall.acct.return = kernel.function("sys_acct").return {
	name = "acct"
	retstr = returnstr(1)
}

# add_key ____________________________________________________
# long sys_add_key(const char __user *_type,
#             const char __user *_description,
#             const void __user *_payload,
#             size_t plen,
#             key_serial_t ringid)
probe syscall.add_key = kernel.function("sys_add_key") {
	name = "add_key"
	type_uaddr = $_type
	description_auddr = $_description
	payload_uaddr = $_payload
	plen = $plen
	ringid = $ringid
	argstr = "add_key"
}
probe syscall.add_key.return = kernel.function("sys_add_key").return {
	name = "add_key"
	retstr = returnstr(1)
}

# quotactl ___________________________________________________
#
# asmlinkage long
# sys_quotactl(unsigned int cmd,
#		  const char __user *special,
#		  qid_t id,
#		  void __user *addr)
#
probe syscall.quotactl = kernel.function("sys_quotactl") {
	name = "quotactl"
	cmd = $cmd
	cmd_str = _quotactl_cmd_str($cmd)
	special_str = user_string($special)
	id = $id
	addr_uaddr = $addr
	argstr = sprintf("%s, %s, 0x%p, [0x%p]", cmd_str, special_str,
				id, addr_uaddr)
}
probe syscall.quotactl.return = kernel.function("sys_quotactl").return {
	name = "quotactl"
	retstr = returnstr(1)
}
# request_key ________________________________________________
#
# asmlinkage long
# sys_request_key(const char __user *_type,
#		     const char __user *_description,
#		     const char __user *_callout_info,
#		     key_serial_t destringid)
#
probe syscall.request_key = kernel.function("sys_request_key") {
	name = "request_key"
	type_uaddr = $_type
	description_uaddr = $_description
	callout_info_uaddr = $_callout_info
	destringid = $destringid
	argstr = sprintf("[0x%p], [0x%p], [0x%p], 0x%p", type_uaddr,
			description_uaddr, callout_info_uaddr, destringid)
}
probe syscall.request_key.return = kernel.function("sys_request_key").return {
	name = "request_key"
	retstr = returnstr(1)
}

#
# OLD STUFF here, need more works
#
# arch_prctl _________________________________________________
/*
 * long sys_arch_prctl(int code,
 *                     unsigned long addr)
 */
probe kernel.syscall.arch_prctl =
	kernel.function("sys_arch_prctl") {
	name = "arch_prctl"
	code = $code
	addr = $addr
	argstr = sprintf("%d, 0x%p", $code, $addr)
}
probe kernel.syscall.arch_prctl.return =
   kernel.function("sys_arch_prctl").return {
	name = "arch_prctl"
	retstr = returnstr(1)
}
# get_mempolicy ______________________________________________
/*
 * asmlinkage long
 * sys_get_mempolicy(int __user *policy,
 *                   unsigned long __user *nmask,
 *                   unsigned long maxnode,
 *                   unsigned long addr,
 *                   unsigned long flags)
 */
probe kernel.syscall.get_mempolicy =
	kernel.function("sys_get_mempolicy") {
	name = "get_mempolicy"
	policy_uaddr = $policy
	nmask_uaddr = $nmask
	maxnode = $maxnode
	addr = $addr
	flags = $flags
	argstr = sprintf("[0x%p], [0x%p], %d, 0x%p, %d", policy_uaddr,
			nmask_uaddr, $maxnode, $addr, $flags)
}
probe kernel.syscall.get_mempolicy.return =
	kernel.function("sys_get_mempolicy").return {
	name = "get_mempolicy"
	retstr = returnstr(1)
}
# iopl _______________________________________________________
/*
 * asmlinkage long
 * sys_iopl(unsigned long unused)
 */
probe kernel.syscall.iopl = kernel.function("sys_iopl") {
	name = "iopl"
	level = $level
	argstr = sprint($level)	
}
probe kernel.syscall.iopl.return = kernel.function("sys_iopl").return {
	name = "iopl"
	retstr = returnstr(1)
}
# mbind ______________________________________________________
/*
 * asmlinkage long
 * sys_mbind(unsigned long start,
 *           unsigned long len,
 *           unsigned long mode,
 *           unsigned long __user *nmask,
 *           unsigned long maxnode,
 *           unsigned flags)
 */
probe kernel.syscall.mbind = kernel.function("sys_mbind") {
	name = "mbind"
	start = $start
	len = $len
	mode = $mode
	nmask_uaddr = $nmask
	maxnode = $maxnode
	flags = $flags
	argstr = sprintf("%d, %d, %d, [0x%p], %d, %d", $start, $len, $mode,
				nmask_uaddr, $maxnode, $flags)
}
probe kernel.syscall.mbind.return = kernel.function("sys_mbind").return {
	name = "mbind"
	retstr = returnstr(1)
}
# mmap _______________________________________________________
/*
 * long
 * sys_mmap(unsigned long addr,
 *          unsigned long len,
 *          unsigned long prot,
 *          unsigned long flags,
 *          unsigned long fd,
 *          unsigned long off)
 */
probe kernel.syscall.mmap = kernel.function("sys_mmap") {
	name = "mmap"
	addr = $addr
	len = $len
	prot = $prot
	flags = $flags
	fd = $fd
	off = $off
	argstr = sprintf("0x%p, %d, %d, %d, %d, %d", $addr, $len,
				$prot, $flags, $fd, $off)
}
probe kernel.syscall.mmap.return = kernel.function("sys_mmap").return {
	name = "mmap"
	retstr = returnstr(2)
}
# rt_sigreturn _______________________________________________
/*
 * asmlinkage int
 * sys_rt_sigreturn(unsigned long __unused)
 */
probe kernel.syscall.rt_sigreturn = kernel.function("sys_rt_sigreturn") {
	name = "rt_sigreturn"
	regs = $regs
	argstr = ""
}
probe kernel.syscall.rt_sigreturn.return =
	kernel.function("sys_rt_sigreturn").return {
	name = "rt_sigreturn"
	retstr = returnstr(1)
}
# sched_setaffinity __________________________________________
/*
 * asmlinkage long
 * sys_sched_setaffinity(pid_t pid,
 *                       unsigned int len,
 *                       unsigned long __user *user_mask_ptr)
 */
probe kernel.syscall.sched_setaffinity =
	kernel.function("sys_sched_setaffinity") {
	name = "sched_setaffinity"
	pid = $pid
	len = $len
	/*
	 * doesnt like $len on x86_64 ????
	 */
	mask_uaddr = $user_mask_ptr
	argstr = sprintf("%d, %d, [0x%p]", $pid, $len, mask_uaddr)
}
probe kernel.syscall.sched_setaffinity.return =
	kernel.function("sys_sched_setaffinity").return {
	name = "sched_setaffinity"
	retstr = returnstr(1)
}
# set_mempolicy ______________________________________________
/*
 * asmlinkage long
 * sys_set_mempolicy(int mode,
 *                   unsigned long __user *nmask,
 *                   unsigned long maxnode)
 */
probe kernel.syscall.set_mempolicy = kernel.function("sys_set_mempolicy") {
	name = "set_mempolicy"
	mode = $mode
	nmask_uaddr = $nmask
	maxnode = $maxnode
	argstr = sprintf("%d, [0x%p], %d", $mode, nmask_uaddr, $maxnode)
}
probe kernel.syscall.set_mempolicy.return =
   kernel.function("sys_set_mempolicy").return {
	name = "set_mempolicy"
	retstr = returnstr(1)
}
# sigaltstack ________________________________________________
/*
 * asmlinkage int
 * sys_sigaltstack(unsigned long ebx)
 */
probe kernel.syscall.sigaltstack = kernel.function("sys_sigaltstack") {
	name = "sigaltstack"
	uss_uaddr = $uss
	uoss_uaddr = $uoss
	regs_uaddr = $regs
	argstr = sprintf("[0x%p], [0x%p]", uss_uaddr, uoss_uaddr)
}
probe kernel.syscall.sigaltstack.return =
	kernel.function("sys_sigaltstack").return {
	name = "sigaltstack"
	retstr = returnstr(1)
}
# time64 _____________________________________________________
/*
 * asmlinkage long
 * sys_time64(long __user * tloc)
 */
probe kernel.syscall.time64 = kernel.function("sys_time64") {
	name = "time64"
	t_uaddr = $tloc
	argstr = sprintf("[0x%p]", t_uaddr)
}
probe kernel.syscall.time64.return = kernel.function("sys_time64").return {
	name = "time64"
	retstr = returnstr(1)
}
# tux ________________________________________________________
/*
 * asmlinkage long
 * sys_tux (unsigned int action,
 *          user_req_t *u_info)
 */
probe kernel.syscall.tux = kernel.function("sys_tux") {
	name = "tux"
	action = $action
	u_info_uaddr = $u_info
	argstr = sprintf("%d, [0x%p]", $action, u_info_uaddr)
}
probe kernel.syscall.tux.return = kernel.function("sys_tux").return {
	name = "tux"
	retstr = returnstr(1)
}
# umask ______________________________________________________
/*
 * asmlinkage long
 * sys_umask(int mask)
 */
probe kernel.syscall.umask = kernel.function("sys_umask") {
	name = "umask"
	/*
	 * doesnt like $mask on x86_64 ????
	 */
	argstr = sprint($mask)
}
probe kernel.syscall.umask.return = kernel.function("sys_umask").return {
	name = "umask"
	retstr = returnstr(1)
}