# lookup_dcookie _____________________________________________ # COMPAT_SYSCALL_DEFINE4(lookup_dcookie, u32, w0, u32, w1, char __user *, buf, # compat_size_t, len) # long ppc32_lookup_dcookie(u32 cookie_high, u32 cookie_low, char __user *buf, # size_t len) # @define _SYSCALL_COMPAT_LOOKUP_DCOOKIE_NAME %( name = "lookup_dcookie" %) @define _SYSCALL_COMPAT_LOOKUP_DCOOKIE_ARGSTR %( argstr = sprintf("%#lx, %p, %#x", cookie, buffer_uaddr, len) %) @define _SYSCALL_COMPAT_LOOKUP_DCOOKIE_REGARGS %( cookie = ((uint_arg(1) << 32) | uint_arg(2)) buffer_uaddr = pointer_arg(3) len = ulong_arg(4) %) probe syscall.compat_lookup_dcookie = dw_syscall.compat_lookup_dcookie !, nd_syscall.compat_lookup_dcookie ? {} probe syscall.compat_lookup_dcookie.return = dw_syscall.compat_lookup_dcookie.return !, nd_syscall.compat_lookup_dcookie.return ? {} # dw_compat_lookup_dcookie _____________________________________________________ probe dw_syscall.compat_lookup_dcookie = kernel.function("compat_sys_lookup_dcookie") ?, kernel.function("ppc32_lookup_dcookie") ? { @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_NAME cookie = (@choose_defined($w0, $cookie_high) << 32 | @choose_defined($w1, $cookie_low)) buffer_uaddr = $buf len = __ulong($len) @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_ARGSTR } probe dw_syscall.compat_lookup_dcookie.return = kernel.function("compat_sys_lookup_dcookie").return ?, kernel.function("ppc32_lookup_dcookie").return ? { @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_NAME @SYSC_RETVALSTR($return) } # nd_compat_lookup_dcookie _____________________________________________________ probe nd_syscall.compat_lookup_dcookie = nd1_syscall.compat_lookup_dcookie!, tp_syscall.compat_lookup_dcookie { } probe nd1_syscall.compat_lookup_dcookie = kprobe.function("compat_sys_lookup_dcookie") ?, kprobe.function("ppc32_lookup_dcookie") ? { @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_NAME asmlinkage() @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_REGARGS @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_ARGSTR } /* kernel 3.5+, but undesirable because it affects all syscalls */ probe tp_syscall.compat_lookup_dcookie = kernel.trace("sys_enter") { __set_syscall_pt_regs($regs) @__compat_syscall_gate(@const("__NR_lookup_dcookie")) @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_NAME @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_REGARGS @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_ARGSTR } probe nd_syscall.compat_lookup_dcookie.return = nd1_syscall.compat_lookup_dcookie.return!, tp_syscall.compat_lookup_dcookie.return { } probe nd1_syscall.compat_lookup_dcookie.return = kprobe.function("compat_sys_lookup_dcookie").return ?, kprobe.function("ppc32_lookup_dcookie").return ? { @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_NAME @SYSC_RETVALSTR(returnval()) } /* kernel 3.5+, but undesirable because it affects all syscalls */ probe tp_syscall.compat_lookup_dcookie.return = kernel.trace("sys_exit") { __set_syscall_pt_regs($regs) @__compat_syscall_gate(@const("__NR_lookup_dcookie")) @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_NAME @SYSC_RETVALSTR($ret) }