Sindbad~EG File Manager

# clock_nanosleep ____________________________________________
# long sys_clock_nanosleep(clockid_t which_clock,
#                     int flags,
#                     const struct timespec __user *rqtp,
#                     struct timespec __user *rmtp)
#

@define _SYSCALL_CLOCK_NANOSLEEP_NAME
%(
	name = "clock_nanosleep"
%)

@define _SYSCALL_CLOCK_NANOSLEEP_ARGSTR
%(
	argstr = sprintf("%s, %s, %s, %p", clk_id_str, flags_str,
	                 req_str, rem_uaddr)
%)

@define _SYSCALL_CLOCK_NANOSLEEP_REGARGS
%(
	clk_id = int_arg(1)
	clk_id_str = _get_wc_str(clk_id)
	flags = int_arg(2)
%(systemtap_v <= "2.6" %?
	flag_str = _stp_clock_nanosleep_flags_str(flags)
%)
	flags_str = _stp_clock_nanosleep_flags_str(flags)
	req_uaddr = pointer_arg(3)
	rem_uaddr = pointer_arg(4)
%)

@define _SYSCALL_CLOCK_NANOSLEEP_REGARGS_STORE
%(
        if (@probewrite(clk_id))
          set_int_arg(1, clk_id)

	if (@probewrite(flags))
	  set_int_arg(2, flags)

	if (@probewrite(req_uaddr))
	  set_pointer_arg(3, req_uaddr)

	if (@probewrite(rem_uaddr))
	  set_pointer_arg(4, rem_uaddr)
%)

probe syscall.clock_nanosleep = dw_syscall.clock_nanosleep !, nd_syscall.clock_nanosleep {}
probe syscall.clock_nanosleep.return = dw_syscall.clock_nanosleep.return !, nd_syscall.clock_nanosleep.return {}

# dw_clock_nanosleep _____________________________________________________

probe dw_syscall.clock_nanosleep = kernel.function("sys_clock_nanosleep").call
{
	@__syscall_gate(@const("__NR_clock_nanosleep"))
	@_SYSCALL_CLOCK_NANOSLEEP_NAME
	clk_id = __int32($which_clock)
	clk_id_str = _get_wc_str(__int32($which_clock))
	flags = __int32($flags)
%(systemtap_v <= "2.6" %?
	flag_str = _stp_clock_nanosleep_flags_str(__int32($flags))
%)
	flags_str = _stp_clock_nanosleep_flags_str(__int32($flags))
	req_uaddr = $rqtp
	req_str = _struct_timespec_u(req_uaddr, 1)
	rem_uaddr = $rmtp
	@_SYSCALL_CLOCK_NANOSLEEP_ARGSTR
}
probe dw_syscall.clock_nanosleep.return =
	kernel.function("sys_clock_nanosleep").return
{
	@__syscall_gate(@const("__NR_clock_nanosleep"))
	@_SYSCALL_CLOCK_NANOSLEEP_NAME
	@SYSC_RETVALSTR($return)
}

# nd_clock_nanosleep _____________________________________________________

probe nd_syscall.clock_nanosleep = nd1_syscall.clock_nanosleep!, nd2_syscall.clock_nanosleep!, tp_syscall.clock_nanosleep
  { }

probe nd1_syscall.clock_nanosleep = kprobe.function("sys_clock_nanosleep").call
{
	@__syscall_gate(@const("__NR_clock_nanosleep"))
	@_SYSCALL_CLOCK_NANOSLEEP_NAME
	asmlinkage()
	@_SYSCALL_CLOCK_NANOSLEEP_REGARGS
	req_str = _struct_timespec_u(req_uaddr, 1)
	@_SYSCALL_CLOCK_NANOSLEEP_ARGSTR
}

/* kernel 4.17+ */
probe nd2_syscall.clock_nanosleep = kprobe.function(@arch_syscall_prefix "sys_clock_nanosleep").call
{
	__set_syscall_pt_regs(pointer_arg(1))
	@_SYSCALL_CLOCK_NANOSLEEP_NAME
	@_SYSCALL_CLOCK_NANOSLEEP_REGARGS
	req_str = _struct_timespec_u(req_uaddr, 1)
	@_SYSCALL_CLOCK_NANOSLEEP_ARGSTR
},
{
        %( @_IS_SREG_KERNEL %? @_SYSCALL_CLOCK_NANOSLEEP_REGARGS_STORE %)
}

/* kernel 3.5+, but undesirable because it affects all syscalls */
probe tp_syscall.clock_nanosleep = kernel.trace("sys_enter")
{
	__set_syscall_pt_regs($regs)
	@__syscall_gate(@const("__NR_clock_nanosleep"))
	@_SYSCALL_CLOCK_NANOSLEEP_NAME
	@_SYSCALL_CLOCK_NANOSLEEP_REGARGS
	req_str = _struct_timespec_u(req_uaddr, 1)
	@_SYSCALL_CLOCK_NANOSLEEP_ARGSTR
},
{
        %( @_IS_SREG_KERNEL %? @_SYSCALL_CLOCK_NANOSLEEP_REGARGS_STORE %)
}

probe nd_syscall.clock_nanosleep.return = nd1_syscall.clock_nanosleep.return!, nd2_syscall.clock_nanosleep.return!, tp_syscall.clock_nanosleep.return
  { }

probe nd1_syscall.clock_nanosleep.return =
	kprobe.function("sys_clock_nanosleep").return ?
{
	@__syscall_gate(@const("__NR_clock_nanosleep"))
	@_SYSCALL_CLOCK_NANOSLEEP_NAME
	@SYSC_RETVALSTR(returnval())
}

/* kernel 4.17+ */
probe nd2_syscall.clock_nanosleep.return =
	kprobe.function(@arch_syscall_prefix "sys_clock_nanosleep").return ?
{
	@_SYSCALL_CLOCK_NANOSLEEP_NAME
	@SYSC_RETVALSTR(returnval())
}

/* kernel 3.5+, but undesirable because it affects all syscalls */
probe tp_syscall.clock_nanosleep.return = kernel.trace("sys_exit")
{
	__set_syscall_pt_regs($regs)
	@__syscall_gate(@const("__NR_clock_nanosleep"))
	@_SYSCALL_CLOCK_NANOSLEEP_NAME
	@SYSC_RETVALSTR($ret)
}

# compat_clock_nanosleep ________________________________________
#
# long compat_clock_nanosleep(clockid_t which_clock, int flags,
#			struct compat_timespec __user *rqtp,
#			struct compat_timespec __user *rmtp)
#

probe syscall.compat_clock_nanosleep = dw_syscall.compat_clock_nanosleep !,
                                       nd_syscall.compat_clock_nanosleep ? {}
probe syscall.compat_clock_nanosleep.return = dw_syscall.compat_clock_nanosleep.return !,
                                              nd_syscall.compat_clock_nanosleep.return ? {}

# dw_compat_clock_nanosleep _____________________________________________________

probe dw_syscall.compat_clock_nanosleep =
	kernel.function("compat_clock_nanosleep").call ?,
	kernel.function("compat_sys_clock_nanosleep").call ?
{
	@_SYSCALL_CLOCK_NANOSLEEP_NAME
	clk_id = __int32($which_clock)
	clk_id_str = _get_wc_str(__int32($which_clock))
	flags = __int32($flags)
%(systemtap_v <= "2.6" %?
	flag_str = _stp_clock_nanosleep_flags_str(__int32($flags))
%)
	flags_str = _stp_clock_nanosleep_flags_str(__int32($flags))
	req_uaddr = @__pointer($rqtp)
	req_str = _struct_compat_timespec_u(req_uaddr, 1)
	rem_uaddr = $rmtp
	@_SYSCALL_CLOCK_NANOSLEEP_ARGSTR
}
probe dw_syscall.compat_clock_nanosleep.return =
	kernel.function("compat_clock_nanosleep").return ?,
	kernel.function("compat_sys_clock_nanosleep").return ?
{
	@_SYSCALL_CLOCK_NANOSLEEP_NAME
	@SYSC_RETVALSTR($return)
}

# nd_compat_clock_nanosleep _____________________________________________________

probe nd_syscall.compat_clock_nanosleep = nd1_syscall.compat_clock_nanosleep!, nd2_syscall.compat_clock_nanosleep!, tp_syscall.compat_clock_nanosleep
  { }

probe nd1_syscall.compat_clock_nanosleep =
	kprobe.function("compat_clock_nanosleep").call ?,
	kprobe.function("compat_sys_clock_nanosleep").call ?
{
	@_SYSCALL_CLOCK_NANOSLEEP_NAME
	asmlinkage()
	@_SYSCALL_CLOCK_NANOSLEEP_REGARGS
	req_str = _struct_compat_timespec_u(req_uaddr, 1)
	@_SYSCALL_CLOCK_NANOSLEEP_ARGSTR
}

/* kernel 4.17+ */
probe nd2_syscall.compat_clock_nanosleep =
	kprobe.function(@arch_syscall_prefix "compat_sys_clock_nanosleep") ?
{
	__set_syscall_pt_regs(pointer_arg(1))
	@_SYSCALL_CLOCK_NANOSLEEP_NAME
	@_SYSCALL_CLOCK_NANOSLEEP_REGARGS
	req_str = _struct_compat_timespec_u(req_uaddr, 1)
	@_SYSCALL_CLOCK_NANOSLEEP_ARGSTR
},
{
        %( @_IS_SREG_KERNEL %? @_SYSCALL_CLOCK_NANOSLEEP_REGARGS_STORE %)
}

/* kernel 3.5+, but undesirable because it affects all syscalls */
probe tp_syscall.compat_clock_nanosleep = kernel.trace("sys_enter")
{
	__set_syscall_pt_regs($regs)
	@__compat_syscall_gate(@const("__NR_compat_clock_nanosleep"))
	@_SYSCALL_CLOCK_NANOSLEEP_NAME
	@_SYSCALL_CLOCK_NANOSLEEP_REGARGS
	req_str = _struct_compat_timespec_u(req_uaddr, 1)
	@_SYSCALL_CLOCK_NANOSLEEP_ARGSTR
},
{
        %( @_IS_SREG_KERNEL %? @_SYSCALL_CLOCK_NANOSLEEP_REGARGS_STORE %)
}

probe nd_syscall.compat_clock_nanosleep.return = nd1_syscall.compat_clock_nanosleep.return!, nd2_syscall.compat_clock_nanosleep.return!, tp_syscall.compat_clock_nanosleep.return
  { }
  
probe nd1_syscall.compat_clock_nanosleep.return =
	kprobe.function("compat_clock_nanosleep").return ?,
	kprobe.function("compat_sys_clock_nanosleep").return ?
{
	@_SYSCALL_CLOCK_NANOSLEEP_NAME
	@SYSC_RETVALSTR(returnval())
}

/* kernel 4.17+ */
probe nd2_syscall.compat_clock_nanosleep.return = 
	kprobe.function(@arch_syscall_prefix "compat_sys_clock_nanosleep").return ?
{
	@_SYSCALL_CLOCK_NANOSLEEP_NAME
	@SYSC_RETVALSTR(returnval())
}
 
/* kernel 3.5+, but undesirable because it affects all syscalls */
probe tp_syscall.compat_clock_nanosleep.return = kernel.trace("sys_exit")
{
	__set_syscall_pt_regs($regs)
	@__compat_syscall_gate(@const("__NR_compat_clock_nanosleep"))
	@_SYSCALL_CLOCK_NANOSLEEP_NAME
	@SYSC_RETVALSTR($ret)
}