관리-도구
편집 파일: sysc_set_mempolicy.stp
# set_mempolicy ______________________________________________ # long sys_set_mempolicy(int mode, # unsigned long __user *nmask, # unsigned long maxnode) # @define _SYSCALL_SET_MEMPOLICY_NAME %( name = "set_mempolicy" %) @define _SYSCALL_SET_MEMPOLICY_ARGSTR %( argstr = sprintf("%s, %p, %u", mode_str, nmask_uaddr, maxnode) %) @define _SYSCALL_SET_MEMPOLICY_REGARGS %( mode = int_arg(1) mode_str = _mempolicy_mode_str(mode) nmask_uaddr = pointer_arg(2) maxnode = ulong_arg(3) %) probe syscall.set_mempolicy = dw_syscall.set_mempolicy !, nd_syscall.set_mempolicy ? {} probe syscall.set_mempolicy.return = dw_syscall.set_mempolicy.return !, nd_syscall.set_mempolicy.return ? {} # dw_set_mempolicy _____________________________________________________ probe dw_syscall.set_mempolicy = __syscall.set_mempolicy ?, kernel.function("compat_sys_set_mempolicy").call ? { @_SYSCALL_SET_MEMPOLICY_NAME mode = __int32($mode) mode_str = _mempolicy_mode_str(__int32($mode)) nmask_uaddr = $nmask maxnode = $maxnode @_SYSCALL_SET_MEMPOLICY_ARGSTR } probe __syscall.set_mempolicy = kernel.function("sys_set_mempolicy") ? { %( arch == "powerpc" %? @__syscall_gate_compat_simple %) } probe dw_syscall.set_mempolicy.return = __syscall.set_mempolicy.return ?, kernel.function("compat_sys_set_mempolicy").return ? { @_SYSCALL_SET_MEMPOLICY_NAME @SYSC_RETVALSTR($return) } probe __syscall.set_mempolicy.return = kernel.function("sys_set_mempolicy").return ? { %( arch == "powerpc" %? @__syscall_gate_compat_simple %) } # nd_set_mempolicy _____________________________________________________ probe nd_syscall.set_mempolicy = nd1_syscall.set_mempolicy!, nd2_syscall.set_mempolicy!, tp_syscall.set_mempolicy { } probe nd1_syscall.set_mempolicy = __nd1_syscall.set_mempolicy ?, kprobe.function("compat_sys_set_mempolicy") ? { @_SYSCALL_SET_MEMPOLICY_NAME asmlinkage() @_SYSCALL_SET_MEMPOLICY_REGARGS @_SYSCALL_SET_MEMPOLICY_ARGSTR } probe __nd1_syscall.set_mempolicy = kprobe.function("sys_set_mempolicy") ? { %( arch == "powerpc" %? asmlinkage() @__syscall_gate_compat_simple %) } /* kernel 4.17+ */ probe nd2_syscall.set_mempolicy = kprobe.function(@arch_syscall_prefix "sys_set_mempolicy") ? { __set_syscall_pt_regs(pointer_arg(1)) @_SYSCALL_SET_MEMPOLICY_NAME @_SYSCALL_SET_MEMPOLICY_REGARGS @_SYSCALL_SET_MEMPOLICY_ARGSTR } /* kernel 3.5+, but undesirable because it affects all syscalls */ probe tp_syscall.set_mempolicy = kernel.trace("sys_enter") { __set_syscall_pt_regs($regs) @__syscall_compat_gate(@const("__NR_set_mempolicy"), @const("__NR_compat_set_mempolicy")) @_SYSCALL_SET_MEMPOLICY_NAME @_SYSCALL_SET_MEMPOLICY_REGARGS @_SYSCALL_SET_MEMPOLICY_ARGSTR } probe nd_syscall.set_mempolicy.return = nd1_syscall.set_mempolicy.return!, nd2_syscall.set_mempolicy.return!, tp_syscall.set_mempolicy.return { } probe nd1_syscall.set_mempolicy.return = __nd1_syscall.set_mempolicy.return ?, kprobe.function("compat_sys_set_mempolicy").return ? { @_SYSCALL_SET_MEMPOLICY_NAME @SYSC_RETVALSTR(returnval()) } probe __nd1_syscall.set_mempolicy.return = kprobe.function("sys_set_mempolicy").return ? { %( arch == "powerpc" %? asmlinkage() @__syscall_gate_compat_simple %) } /* kernel 4.17+ */ probe nd2_syscall.set_mempolicy.return = kprobe.function(@arch_syscall_prefix "sys_set_mempolicy").return ? { @_SYSCALL_SET_MEMPOLICY_NAME @SYSC_RETVALSTR(returnval()) } /* kernel 3.5+, but undesirable because it affects all syscalls */ probe tp_syscall.set_mempolicy.return = kernel.trace("sys_exit") { __set_syscall_pt_regs($regs) @__syscall_compat_gate(@const("__NR_set_mempolicy"), @const("__NR_compat_set_mempolicy")) @_SYSCALL_SET_MEMPOLICY_NAME @SYSC_RETVALSTR($ret) }