PAL.C.T MINI SHELL
# S390-specific system calls
%(arch == "s390" %?
# FIXME: the getresgid16/getresuid16 probes could be combined with
# their "generic" versions in tapset/syscalls.stp.
# getresgid __________________________________________________
# long sys32_getresgid16(u16 __user *rgid, u16 __user *egid, u16 __user *sgid)
#
probe syscall.getresgid16 = kernel.function("sys32_getresgid16") ?
{
name = "getresgid"
rgid_uaddr = @choose_defined($rgidp, $rgid)
egid_uaddr = @choose_defined($egidp, $egid)
sgid_uaddr = @choose_defined($sgidp, $sgid)
argstr = sprintf("%p, %p, %p", @choose_defined($rgidp, $rgid),
@choose_defined($egidp, $egid),
@choose_defined($sgidp, $sgid))
}
probe syscall.getresgid16.return = kernel.function("sys32_getresgid16").return ?
{
name = "getresgid"
retstr = return_str(1, $return)
}
# getresuid __________________________________________________
# long sys32_getresuid16(u16 __user *ruid, u16 __user *euid, u16 __user *suid)
#
probe syscall.getresuid16 = kernel.function("sys32_getresuid16") ?
{
name = "getresuid"
ruid_uaddr = @choose_defined($ruidp, $ruid)
euid_uaddr = @choose_defined($euidp, $euid)
suid_uaddr = @choose_defined($suidp, $suid)
argstr = sprintf("%p, %p, %p", @choose_defined($ruidp, $ruid),
@choose_defined($euidp, $euid),
@choose_defined($suidp, $suid))
}
probe syscall.getresuid16.return = kernel.function("sys32_getresuid16").return ?
{
name = "getresuid"
retstr = return_str(1, $return)
}
%( systemtap_v < "2.7" %?
# sys32_ipc() is just a syscall multiplexer (similar to
# sys_socketcall()). So, we don't really need to probe it, since we'll
# be probing what sys32_ipc() will call (semget, msgsnd, msgrcv,
# shmat, etc.).
# ipc _________________________________________________
# long sys32_ipc(u32 call, int first, int second, int third, u32 ptr)
#
probe syscall.ipc = kernel.function("sys32_ipc") ?
{
name = "ipc"
argstr = sprintf("%d, %d, %d, %d, %p", $call, $first, $second, $third, $ptr)
}
probe syscall.ipc.return = kernel.function("sys32_ipc").return ?
{
name = "ipc"
retstr = return_str(1, $return)
}
%)
# In kernels < 2.6.33, mmap()/mmap2() was handled by arch-specific
# code. In kernels >= 2.6.33, the arch-specific code just calls
# generic sys_mmap_pgoff().
%( kernel_v < "2.6.33" %?
# mmap _________________________________________________
# long old_mmap(struct mmap_arg_struct __user *arg)
# long old32_mmap(struct mmap_arg_struct_emu31 __user *arg)
#
probe syscall.mmap = __syscall.mmap ?, __syscall.mmap32 ?
{
name = "mmap"
argstr = sprintf("%p, %u, %s, %s, %d, %d", start, len,
_mprotect_prot_str(prot), _mmap_flags(flags),
fd, offset)
}
probe __syscall.mmap = kernel.function("old_mmap") ?,
kernel.function("SyS_s390_old_mmap") ?
{
start = user_long(&@cast($arg, "mmap_arg_struct")->addr)
len = user_ulong(&@cast($arg, "mmap_arg_struct")->len)
prot = user_long(&@cast($arg, "mmap_arg_struct")->prot)
flags = user_long(&@cast($arg, "mmap_arg_struct")->flags)
fd = user_long(&@cast($arg, "mmap_arg_struct")->fd)
offset = user_long(&@cast($arg, "mmap_arg_struct")->offset)
}
probe __syscall.mmap32 = kernel.function("old32_mmap")
{
start = user_int(&@cast($arg, "mmap_arg_struct_emu31")->addr)
len = user_uint32(&@cast($arg, "mmap_arg_struct_emu31")->len)
prot = user_int(&@cast($arg, "mmap_arg_struct_emu31")->prot)
flags = user_int(&@cast($arg, "mmap_arg_struct_emu31")->flags)
fd = user_int(&@cast($arg, "mmap_arg_struct_emu31")->fd)
offset = user_int(&@cast($arg, "mmap_arg_struct_emu31")->offset)
}
probe syscall.mmap.return = kernel.function("old_mmap").return ?,
kernel.function("old32_mmap").return ?,
kernel.function("SyS_s390_old_mmap").return ?
{
name = "mmap"
retstr = return_str(2, $return)
}
# mmap2 _________________________________________________
#
# long sys_mmap2(struct mmap_arg_struct __user *arg)
# long sys32_mmap2(struct mmap_arg_struct_emu31 __user *arg)
#
probe syscall.mmap2 = __syscall.mmap2 ?, __syscall.mmap2_32 ?
{
name = "mmap2"
argstr = sprintf("%p, %u, %s, %s, %d, %d", start, length,
_mprotect_prot_str(prot), _mmap_flags(flags),
fd, pgoffset)
}
probe __syscall.mmap2 = kernel.function("sys_mmap2")
{
start = user_long(&@cast($arg, "mmap_arg_struct")->addr)
length = user_ulong(&@cast($arg, "mmap_arg_struct")->len)
prot = user_long(&@cast($arg, "mmap_arg_struct")->prot)
flags = user_long(&@cast($arg, "mmap_arg_struct")->flags)
fd = user_long(&@cast($arg, "mmap_arg_struct")->fd)
pgoffset = user_long(&@cast($arg, "mmap_arg_struct")->offset)
}
probe __syscall.mmap2_32 = kernel.function("sys32_mmap2")
{
start = user_int(&@cast($arg, "mmap_arg_struct_emu31")->addr)
length = user_uint32(&@cast($arg, "mmap_arg_struct_emu31")->len)
prot = user_int(&@cast($arg, "mmap_arg_struct_emu31")->prot)
flags = user_int(&@cast($arg, "mmap_arg_struct_emu31")->flags)
fd = user_int(&@cast($arg, "mmap_arg_struct_emu31")->fd)
pgoffset = user_int(&@cast($arg, "mmap_arg_struct_emu31")->offset)
}
probe syscall.mmap2.return = kernel.function("sys_mmap2").return ?,
kernel.function("sys32_mmap2").return ?
{
name = "mmap2"
retstr = return_str(2, $return)
}
%)
%( CONFIG_GENERIC_SIGALTSTACK == "n" || kernel_v < "3.8" %?
# sigaltstack ________________________________________________
# asmlinkage long
# sys_sigaltstack(const stack_t __user * uss, stack_t __user *uoss)
#
# NOTE: args vary between archs.
probe syscall.sigaltstack = kernel.function("sys_sigaltstack")
{
name = "sigaltstack"
uss_uaddr = $uss
uoss_uaddr = $uoss
%(systemtap_v < "2.3" %?
regs = %{ /* pure */ _stp_current_pt_regs() %}
%)
argstr = sprintf("%s, %p", _stp_sigaltstack_u($uss), $uoss)
}
probe syscall.sigaltstack.return = kernel.function("sys_sigaltstack").return
{
name = "sigaltstack"
retstr = return_str(1, $return)
}
# sys32_sigaltstack ________________________________________________
# asmlinkage long
# sys32_sigaltstack(const stack_t32 __user *uss, stack_t32 __user *uoss)
#
# NOTE: args vary between archs.
probe syscall.sys32_sigaltstack = kernel.function("sys32_sigaltstack") ?
{
name = "sigaltstack"
uss_uaddr = $uss
uoss_uaddr = $uoss
argstr = sprintf("%s, %p", _stp_compat_sigaltstack_u($uss), $uoss)
}
probe syscall.sys32_sigaltstack.return = kernel.function("sys32_sigaltstack").return ?
{
name = "sigaltstack"
retstr = return_str(1, $return)
}
%)
# sysctl _____________________________________________________
#
# long sys32_sysctl(struct __sysctl_args32 __user *args)
#
probe syscall.sysctl32 = kernel.function("sys32_sysctl") ?
{
name = "sysctl"
argstr = sprintf("%p", $args)
}
probe syscall.sysctl32.return = kernel.function("sys32_sysctl").return ?
{
name = "sysctl"
retstr = return_str(1, $return)
}
# ftruncate64 _________________________________________________
#
# COMPAT_SYSCALL_DEFINE3(s390_ftruncate64, unsigned int, fd, u32, high,
# u32, low)
#
probe syscall.compat_ftruncate64 = kernel.function("sys32_ftruncate64").call ?
{
name = "ftruncate"
fd = __int32($fd)
length = (($high << 32) | $low)
argstr = sprintf("%d, %d", fd, length)
}
probe syscall.compat_ftruncate64.return =
kernel.function("sys32_ftruncate64").return ?
{
name = "ftruncate"
retstr = return_str(1, $return)
}
# truncate64 __________________________________________________
#
# COMPAT_SYSCALL_DEFINE3(s390_truncate64, const char __user *, path,
# u32, high, u32, low)
#
probe syscall.compat_truncate64 = kernel.function("sys32_truncate64").call ?
{
name = "truncate"
path_uaddr = $path
path = user_string_quoted(path_uaddr)
length = (($high << 32) | $low)
argstr = sprintf("%s, %d", user_string_quoted(path_uaddr), length)
}
probe syscall.compat_truncate64.return =
kernel.function("sys32_truncate64").return ?
{
name = "truncate"
retstr = return_str(1, $return)
}
# readahead __________________________________________________
#
# asmlinkage ssize_t
# compat_ssize_t sys32_readahead(int fd, u32 offhi, u32 offlo, s32 count)
#
probe syscall.compat_readahead = kernel.function("sys32_readahead") ?
{
name = "readahead"
fd = __int32($fd)
offset = (($offhi << 32) | $offlo)
count = __uint32($count)
argstr = sprintf("%d, %d, %u", fd, offset, count)
}
probe syscall.compat_readahead.return = kernel.function("sys32_readahead").return ?
{
name = "readahead"
retstr = return_str(1, $return)
}
# fadvise64 _______________________________________________________
#
# The following kernel commit:
#
# commit 5383d2c8b3ee61a762043818d7c07bbc0049b031
# Author: Heiko Carstens <heiko.carstens@de.ibm.com>
# Date: Wed Feb 26 14:40:43 2014 +0100
#
# s390/compat: convert to COMPAT_SYSCALL_DEFINEx part 7
#
# changed sys32_fadvise64 from:
#
# asmlinkage long
# sys32_fadvise64(int fd, loff_t offset, size_t len, int advise)
#
# to:
#
# COMPAT_SYSCALL_DEFINE5(s390_fadvise64, int, fd, u32, high, u32, low,
# compat_size_t, len, int, advise)
probe syscall.compat_fadvise64 = kernel.function("sys32_fadvise64").call ?
{
name = "fadvise64"
fd = __int32($fd)
if (@defined($offset)) {
offset = $offset
}
else {
offset = (($high << 32) | $low)
}
len = __int32($len)
advice = __int32($advise)
argstr = sprintf("%d, %d, %d, %s", fd, offset, len,
_fadvice_advice_str(advice))
}
probe syscall.compat_fadvise64.return =
kernel.function("sys32_fadvise64").return ?
{
name = "fadvise64"
retstr = return_str(1, $return)
}
# fadvise64_64 __________________________________________________
#
# COMPAT_SYSCALL_DEFINE1(s390_fadvise64_64,
# struct fadvise64_64_args __user *, args)
# struct fadvise64_64_args {
# int fd;
# long long offset;
# long long len;
# int advice;
#};
probe syscall.compat_fadvise64_64 = kernel.function("sys32_fadvise64_64").call ?
{
name = "fadvise64"
fd = user_int(&$args->fd)
offset = user_int64(&$args->offset)
len = user_int64(&$args->len)
advice = user_int(&$args->advice)
argstr = sprintf("%d, %d, %d, %s", fd, offset, len,
_fadvice_advice_str(advice))
}
probe syscall.compat_fadvise64_64.return =
kernel.function("sys32_fadvise64_64").return ?
{
name = "fadvise64"
retstr = return_str(1, $return)
}
# fallocate __________________________________________________
#
# SYSCALL_DEFINE4(fallocate, int, fd, int, mode, loff_t, offset, loff_t, len)
# asmlinkage long sys32_fallocate(int fd, int mode, unsigned offset_lo,
# unsigned offset_hi, unsigned len_lo,
# unsigned len_hi)
#
# We've got a problem here on RHEL6 (2.6.32-504.el6.s390x) and RHEL7
# (3.10.0-229.el7.s390x). Normally we'd probe the "compat" version of
# the function here. However, on those kernels, the compat wrapper
# for fallocate (sys_fallocate_wrapper) is in assembly language, which
# stap can't find.
#
# So, we'll probe the "real" syscall here.
probe syscall.compat_fallocate = kernel.function("sys_fallocate").call ?
{
name = "fallocate"
fd = __int32($fd)
mode = __uint32($mode)
mode_str = _stp_fallocate_mode_str(mode)
offset = $offset
len = $len
argstr = sprintf("%d, %s, %#x, %u", fd, mode_str, offset, len)
}
probe syscall.compat_fallocate.return =
kernel.function("sys_fallocate").return ?
{
name = "fallocate"
retstr = returnstr(1)
}
%( kernel_v < "3.7" %?
# execve _____________________________________________________
#
# In kernels < 3.7, sys_execve() was in arch-specific code (and had
# varying arguments). It was just a wrapper around generic
# do_execve(), but the wrapper could error out before calling
# do_execve(). So, we'll have to handle it in arch-specific tapset
# code to catch all calls.
#
# The following kernel commit (first appearing in 2.6.32):
#
# commit 3e86a8c617413e344143839c514e9b0c1713065c
# Author: Heiko Carstens <heiko.carstens@de.ibm.com>
# Date: Tue Sep 22 22:58:42 2009 +0200
#
# [S390] Convert sys_execve to function with parameters.
#
# Use function parameters instead of accessing the pt_regs structure
# to get the parameters.
#
# Changed the function from:
#
# asmlinkage long sys_execve(struct pt_regs regs)
#
# To:
#
# SYSCALL_DEFINE3(execve, char __user *, name, char __user * __user *, argv,
# char __user * __user *, envp)
probe syscall.execve = kernel.function("sys_execve").call
{
name = "execve"
%( kernel_v < "2.6.32" %?
# The fact that the struct is passed in instead of a pointer
# confuses things.
__regs = &@cast(ulong_arg(1), "pt_regs", "kernel<asm/ptrace.h>")
filename = user_string_quoted(__regs->orig_gpr2)
args = __get_argv(__regs->gprs[3], 0)
env_str = __count_envp(__regs->gprs[4])
%:
filename = user_string_quoted(@choose_defined($name, $filename))
args = __get_argv($argv, 0)
env_str = __count_envp($envp)
%)
argstr = sprintf("%s, %s, %s", filename, args, env_str)
}
probe syscall.execve.return = kernel.function("sys_execve").return
{
name = "execve"
retstr = return_str(1, $return)
}
# execve _____________________________________________________
#
# asmlinkage long sys32_execve(struct pt_regs regs)
# asmlinkage long sys32_execve(char __user *name, compat_uptr_t __user *argv,
# compat_uptr_t __user *envp)
probe syscall.compat_execve = kernel.function("sys32_execve").call ?
{
name = "execve"
%( kernel_v < "2.6.32" %?
# The fact that the struct is passed in instead of a pointer
# confuses things.
__regs = &@cast(ulong_arg(1), "pt_regs", "kernel<asm/ptrace.h>")
filename = user_string_quoted(__regs->orig_gpr2 & 0x7fffffff)
args = __get_compat_argv(__regs->gprs[3] & 0x7fffffff, 0)
env_str = __count_compat_envp(__regs->gprs[4] & 0x7fffffff)
%:
filename = user_string_quoted(@choose_defined($name, $filename))
args = __get_compat_argv($argv, 0)
env_str = __count_compat_envp($envp)
%)
argstr = sprintf("%s, %s, %s", filename, args, env_str)
}
probe syscall.compat_execve.return = kernel.function("sys32_execve").return ?
{
name = "execve"
retstr = return_str(1, $return)
}
%)
# lookup_dcookie _____________________________________________
# long sys_lookup_dcookie(u64 cookie64, char __user * buf, size_t len)
# there is compat_SyS_lookup_dcookie on thel7, but not on older distros,
# in this case probing for sys_lookup_dcookie seems safe
probe syscall.compat_lookup_dcookie = kernel.function("sys_lookup_dcookie").call ?
{
name = "lookup_dcookie"
cookie = $cookie64
buffer_uaddr = $buf
len = __ulong($len)
argstr = sprintf("%#lx, %p, %#x", $cookie64, $buf, $len)
}
probe syscall.compat_lookup_dcookie.return = kernel.function("sys_lookup_dcookie").return ?
{
name = "lookup_dcookie"
retstr = return_str(1, $return)
}
%)
y~or5J ={Eeu磝Qk ᯘG{?+]ן?wM3X^歌>{7پK>on\jy R g/=fOroNVv~Y+ NGuÝHWyw[eQʨSb> >}Gmx[o[<{Ϯ_qF vM IENDB`