Server : Apache System : Linux server2.corals.io 4.18.0-348.2.1.el8_5.x86_64 #1 SMP Mon Nov 15 09:17:08 EST 2021 x86_64 User : corals ( 1002) PHP Version : 7.4.33 Disable Function : exec,passthru,shell_exec,system Directory : /opt/rh/gcc-toolset-11/root/usr/share/systemtap/tapset/linux/ |
# pipe _______________________________________________________
#
# asmlinkage int sys_pipe(unsigned long __user * fildes)
# asmlinkage long sys_ia64_pipe (void)
# SYSCALL_DEFINE2(pipe2, int __user *, fildes, int, flags)
# pipe2() was added to Linux in version 2.6.27.
probe syscall.pipe = dw_syscall.pipe !, nd_syscall.pipe ? {}
probe syscall.pipe.return = dw_syscall.pipe.return !, nd_syscall.pipe.return ? {}
# dw_pipe _____________________________________________________
probe dw_syscall.pipe = __syscall.pipe2 ?, __syscall.ia64_pipe ?, __syscall.pipe
{
}
probe __syscall.pipe2 = kernel.function("sys_pipe2").call ?
{
@__syscall_compat_gate(@const("__NR_pipe2"), @const("__NR_compat_pipe2"))
name = "pipe2"
flags = __int32($flags)
flag_str = _sys_pipe2_flag_str(flags);
fildes_uaddr = $fildes
if (fildes_uaddr == 0) {
pipe0 = 0;
pipe1 = 0;
argstr = "NULL"
} else {
/*
* Why use @cast here? Why not just:
*
* pipe0 = user_int(&$fildes[0]);
* pipe1 = user_int(&$fildes[1]);
*
* The answer is syscall wrappers
* (CONFIG_SYSCALL_WRAPPERS). On ppc (for example),
* SyS_foo has all "long" arguments, and then the
* inline SYSC_foo has the real argument types. The
* @cast makes sure we're dealing with the "final"
* type.
*/
pipe0 = user_int(&@cast($fildes, "int")[0])
pipe1 = user_int(&@cast($fildes, "int")[1])
argstr = sprintf("[%d, %d], %s", pipe0, pipe1, flag_str);
}
}
probe __syscall.ia64_pipe = kernel.function("sys_ia64_pipe").call ?
{
name = "pipe"
flags = 0
flag_str = ""
fildes_uaddr = 0
pipe0 = 0;
pipe1 = 0;
argstr = "[0, 0]";
}
probe __syscall.pipe = kernel.function("sys_pipe").call
{
name = "pipe"
flags = 0
flag_str = ""
fildes_uaddr = $fildes
if (fildes_uaddr == 0) {
pipe0 = 0;
pipe1 = 0;
argstr = "NULL"
} else {
/*
* Why use @cast here? Why not just:
*
* pipe0 = user_int(&$fildes[0]);
* pipe1 = user_int(&$fildes[1]);
*
* The answer is syscall wrappers
* (CONFIG_SYSCALL_WRAPPERS). On ppc (for example),
* SyS_foo has all "long" arguments, and then the
* inline SYSC_foo has the real argument types. The
* @cast makes sure we're dealing with the "final"
* type.
*/
pipe0 = user_int(&@cast($fildes, "int")[0])
pipe1 = user_int(&@cast($fildes, "int")[1])
argstr = sprintf("[%d, %d]", pipe0, pipe1);
}
}
probe dw_syscall.pipe.return = __syscall.pipe2.return ?,
__syscall.ia64_pipe.return ?,
__syscall.pipe.return
{
}
probe __syscall.pipe2.return = kernel.function("sys_pipe2").return ?
{
@__syscall_compat_gate(@const("__NR_pipe2"), @const("__NR_compat_pipe2"))
name = "pipe2"
fildes_uaddr = @entry($fildes)
if (fildes_uaddr == 0) {
pipe0 = 0;
pipe1 = 0;
} else {
/*
* See comment in dw_syscall.pipe about why @cast is used
* here.
*/
pipe0 = user_int(&@cast(@entry($fildes), "int")[0])
pipe1 = user_int(&@cast(@entry($fildes), "int")[1])
}
@SYSC_RETVALSTR($return)
}
probe __syscall.ia64_pipe.return = kernel.function("sys_ia64_pipe").return ?
{
name = "pipe"
fildes_uaddr = 0;
pipe0 = _ia64_pipe0();
pipe1 = _ia64_pipe1();
@SYSC_RETVALSTR($return)
if (pipe0 >= 0) { retstr = "0" }
}
probe __syscall.pipe.return = kernel.function("sys_pipe").return
{
name = "pipe"
fildes_uaddr = @entry($fildes)
if (fildes_uaddr == 0) {
pipe0 = 0;
pipe1 = 0;
} else {
/*
* See comment in dw_syscall.pipe about why @cast is used
* here.
*/
pipe0 = user_int(&@cast(@entry($fildes), "int")[0])
pipe1 = user_int(&@cast(@entry($fildes), "int")[1])
}
@SYSC_RETVALSTR($return)
}
# nd_pipe _____________________________________________________
probe nd_syscall.pipe = nd1_syscall.pipe!, nd2_syscall.pipe!, tp_syscall.pipe
{ }
probe nd1_syscall.pipe = __nd1_syscall.pipe2 ?, __nd1_syscall.ia64_pipe ?,
__nd1_syscall.pipe
{
}
probe __nd1_syscall.pipe2 = kprobe.function("sys_pipe2") ?
{
@__syscall_compat_gate(@const("__NR_pipe2"), @const("__NR_compat_pipe2"))
%( arch != "powerpc" %? asmlinkage() %)
name = "pipe2";
flags = int_arg(2)
flag_str = _sys_pipe2_flag_str(flags);
fildes_uaddr = pointer_arg(1)
if (fildes_uaddr == 0) {
pipe0 = 0;
pipe1 = 0;
argstr = "NULL"
} else {
pipe0 = _fildes_index_u(fildes_uaddr, 0)
pipe1 = _fildes_index_u(fildes_uaddr, 1)
argstr = sprintf("[%d, %d], %s", pipe0, pipe1, flag_str);
}
}
probe __nd1_syscall.ia64_pipe = kprobe.function("sys_ia64_pipe").call ?
{
name = "pipe"
flags = 0
flag_str = ""
fildes_uaddr = 0
pipe0 = 0;
pipe1 = 0;
argstr = "[0, 0]";
}
probe __nd1_syscall.pipe = kprobe.function("sys_pipe")
{
name = "pipe"
flags = 0
flag_str = ""
%( arch != "powerpc" %? asmlinkage() %)
fildes_uaddr = pointer_arg(1)
if (fildes_uaddr == 0) {
pipe0 = 0;
pipe1 = 0;
argstr = "NULL"
} else {
pipe0 = _fildes_index_u(fildes_uaddr, 0)
pipe1 = _fildes_index_u(fildes_uaddr, 1)
argstr = sprintf("[%d, %d]", pipe0, pipe1);
}
}
/* kernel 4.17+ */
probe nd2_syscall.pipe = __nd2_syscall.pipe2 ?, __nd2_syscall.pipe
{
}
probe __nd2_syscall.pipe2 = kprobe.function(@arch_syscall_prefix "sys_pipe2") ?
{
__set_syscall_pt_regs(pointer_arg(1))
name = "pipe2";
flags = int_arg(2)
flag_str = _sys_pipe2_flag_str(flags);
fildes_uaddr = pointer_arg(1)
if (fildes_uaddr == 0) {
pipe0 = 0;
pipe1 = 0;
argstr = "NULL"
} else {
pipe0 = _fildes_index_u(fildes_uaddr, 0)
pipe1 = _fildes_index_u(fildes_uaddr, 1)
argstr = sprintf("[%d, %d], %s", pipe0, pipe1, flag_str);
}
},
{
%( @_IS_SREG_KERNEL %?
if (@probewrite(fildes_uaddr))
set_pointer_arg(1, fildes_uaddr)
if (@probewrite(flags))
set_int_arg(2, flags)
%)
}
probe __nd2_syscall.pipe = kprobe.function(@arch_syscall_prefix "sys_pipe")
{
__set_syscall_pt_regs(pointer_arg(1))
name = "pipe"
flags = 0
flag_str = ""
fildes_uaddr = pointer_arg(1)
if (fildes_uaddr == 0) {
pipe0 = 0;
pipe1 = 0;
argstr = "NULL"
} else {
pipe0 = _fildes_index_u(fildes_uaddr, 0)
pipe1 = _fildes_index_u(fildes_uaddr, 1)
argstr = sprintf("[%d, %d]", pipe0, pipe1);
}
},
{
%( @_IS_SREG_KERNEL %?
if (@probewrite(fildes_uaddr))
set_pointer_arg(1, fildes_uaddr)
%)
}
/* kernel 3.5+, but undesirable because it affects all syscalls */
probe tp_syscall.pipe = __tp_syscall.pipe2 ?, __tp_syscall.pipe
{
}
probe __tp_syscall.pipe2 = kernel.trace("sys_enter")
{
__set_syscall_pt_regs($regs)
@__syscall_compat_gate(@const("__NR_pipe2"), @const("__NR_compat_pipe2"))
name = "pipe2";
flags = int_arg(2)
flag_str = _sys_pipe2_flag_str(flags);
fildes_uaddr = pointer_arg(1)
if (fildes_uaddr == 0) {
pipe0 = 0;
pipe1 = 0;
argstr = "NULL"
} else {
pipe0 = _fildes_index_u(fildes_uaddr, 0)
pipe1 = _fildes_index_u(fildes_uaddr, 1)
argstr = sprintf("[%d, %d], %s", pipe0, pipe1, flag_str);
}
},
{
%( @_IS_SREG_KERNEL %?
if (@probewrite(fildes_uaddr))
set_pointer_arg(1, fildes_uaddr)
if (@probewrite(flags))
set_int_arg(2, flags)
%)
}
probe __tp_syscall.pipe = kernel.trace("sys_enter")
{
__set_syscall_pt_regs($regs)
@__syscall_compat_gate(@const("__NR_pipe"), @const("__NR_compat_pipe"))
name = "pipe"
flags = 0
flag_str = ""
fildes_uaddr = pointer_arg(1)
if (fildes_uaddr == 0) {
pipe0 = 0;
pipe1 = 0;
argstr = "NULL"
} else {
pipe0 = _fildes_index_u(fildes_uaddr, 0)
pipe1 = _fildes_index_u(fildes_uaddr, 1)
argstr = sprintf("[%d, %d]", pipe0, pipe1);
}
},
{
%( @_IS_SREG_KERNEL %?
if (@probewrite(fildes_uaddr))
set_pointer_arg(1, fildes_uaddr)
%)
}
probe nd_syscall.pipe.return = nd1_syscall.pipe.return!, nd2_syscall.pipe.return!, tp_syscall.pipe.return
{ }
probe nd1_syscall.pipe.return = __nd1_syscall.pipe2.return ?,
__nd1_syscall.ia64_pipe.return ?,
__nd1_syscall.pipe.return
{
}
probe __nd1_syscall.pipe2.return = kprobe.function("sys_pipe2").return ?
{
@__syscall_compat_gate(@const("__NR_pipe2"), @const("__NR_compat_pipe2"))
name = "pipe2";
fildes_uaddr = @entry(pointer_arg(1))
if (fildes_uaddr == 0) {
pipe0 = 0;
pipe1 = 0;
} else {
pipe0 = _fildes_index_u(fildes_uaddr, 0)
pipe1 = _fildes_index_u(fildes_uaddr, 1)
}
@SYSC_RETVALSTR(returnval())
}
probe __nd1_syscall.ia64_pipe.return = kprobe.function("sys_ia64_pipe").return ?
{
name = "pipe"
fildes_uaddr = 0;
pipe0 = _ia64_pipe0();
pipe1 = _ia64_pipe1();
@SYSC_RETVALSTR(returnval())
if (pipe0 >= 0) { retstr = "0" }
}
probe __nd1_syscall.pipe.return = kprobe.function("sys_pipe").return
{
name = "pipe"
fildes_uaddr = @entry(%( arch != "powerpc" %? __asmlinkage_int_arg(1)
%: int_arg(1) %))
if (fildes_uaddr == 0) {
pipe0 = 0;
pipe1 = 0;
} else {
pipe0 = _fildes_index_u(fildes_uaddr, 0)
pipe1 = _fildes_index_u(fildes_uaddr, 1)
}
@SYSC_RETVALSTR(returnval())
}
/* kernel 4.17+ */
probe nd2_syscall.pipe.return = __nd2_syscall.pipe2.return ?,
__nd2_syscall.pipe.return
{
}
probe __nd2_syscall.pipe2.return = kprobe.function(@arch_syscall_prefix "sys_pipe2").return ?
{
name = "pipe2";
__set_syscall_pt_regs(@entry(pointer_arg(1)))
fildes_uaddr = pointer_arg(1)
if (fildes_uaddr == 0) {
pipe0 = 0;
pipe1 = 0;
} else {
pipe0 = _fildes_index_u(fildes_uaddr, 0)
pipe1 = _fildes_index_u(fildes_uaddr, 1)
}
@SYSC_RETVALSTR(returnval())
}
probe __nd2_syscall.pipe.return = kprobe.function(@arch_syscall_prefix "sys_pipe").return
{
name = "pipe"
__set_syscall_pt_regs(@entry(pointer_arg(1)))
fildes_uaddr = int_arg(1)
if (fildes_uaddr == 0) {
pipe0 = 0;
pipe1 = 0;
} else {
pipe0 = _fildes_index_u(fildes_uaddr, 0)
pipe1 = _fildes_index_u(fildes_uaddr, 1)
}
@SYSC_RETVALSTR(returnval())
}
/* kernel 3.5+, but undesirable because it affects all syscalls */
probe tp_syscall.pipe.return = __tp_syscall.pipe2.return ?,
__tp_syscall.pipe.return
{
}
probe __tp_syscall.pipe2.return = kernel.trace("sys_exit")
{
__set_syscall_pt_regs($regs)
@__syscall_compat_gate(@const("__NR_pipe2"), @const("__NR_compat_pipe2"))
name = "pipe2";
fildes_uaddr = pointer_arg(1)
if (fildes_uaddr == 0) {
pipe0 = 0;
pipe1 = 0;
} else {
pipe0 = _fildes_index_u(fildes_uaddr, 0)
pipe1 = _fildes_index_u(fildes_uaddr, 1)
}
@SYSC_RETVALSTR($ret)
}
probe __tp_syscall.pipe.return = kernel.trace("sys_exit")
{
__set_syscall_pt_regs($regs)
@__syscall_compat_gate(@const("__NR_pipe"), @const("__NR_compat_pipe"))
name = "pipe"
fildes_uaddr = int_arg(1)
if (fildes_uaddr == 0) {
pipe0 = 0;
pipe1 = 0;
} else {
pipe0 = _fildes_index_u(fildes_uaddr, 0)
pipe1 = _fildes_index_u(fildes_uaddr, 1)
}
@SYSC_RETVALSTR($ret)
}