Sindbad~EG File Manager

# io_cancel __________________________________________________
# long sys_io_cancel(aio_context_t ctx_id,
#               struct iocb __user *iocb,
#               struct io_event __user *result)

@define _SYSCALL_IO_CANCEL_NAME
%(
	name = "io_cancel"
%)

@define _SYSCALL_IO_CANCEL_ARGSTR
%(
	argstr = sprintf("%u, %p, %p", ctx_id, iocb_uaddr, result_uaddr)
%)

@define _SYSCALL_IO_CANCEL_REGARGS
%(
	ctx_id = ulong_arg(1)
	iocb_uaddr = pointer_arg(2)
	result_uaddr = pointer_arg(3)
%)

@define _SYSCALL_IO_CANCEL_REGARGS_STORE
%(
        if (@probewrite(ctx_id))
          set_ulong_arg(1, ctx_id)

	if (@probewrite(iocb_uaddr))
	  set_pointer_arg(2, iocb_uaddr)

	if (@probewrite(result_uaddr))
	  set_pointer_arg(3, result_uaddr)
%)

probe syscall.io_cancel = dw_syscall.io_cancel !, nd_syscall.io_cancel ? {}
probe syscall.io_cancel.return = dw_syscall.io_cancel.return !, nd_syscall.io_cancel.return ? {}

# dw_io_cancel __________________________________________________
# long sys_io_cancel(aio_context_t ctx_id,
#		struct iocb __user *iocb,
#		struct io_event __user *result)
probe dw_syscall.io_cancel = kernel.function("sys_io_cancel").call
{
	@_SYSCALL_IO_CANCEL_NAME
	ctx_id = @__compat_ulong($ctx_id)
	iocb_uaddr = $iocb
	result_uaddr = $result
	@_SYSCALL_IO_CANCEL_ARGSTR
}
probe dw_syscall.io_cancel.return = kernel.function("sys_io_cancel").return
{
	@_SYSCALL_IO_CANCEL_NAME
	@SYSC_RETVALSTR($return)
}

# nd_io_cancel __________________________________________________
# long sys_io_cancel(aio_context_t ctx_id,
#		struct iocb __user *iocb,
#		struct io_event __user *result)
#
#
probe nd_syscall.io_cancel = nd1_syscall.io_cancel!, nd2_syscall.io_cancel!, tp_syscall.io_cancel
  { }

probe nd1_syscall.io_cancel = kprobe.function("sys_io_cancel") ?
{
	@_SYSCALL_IO_CANCEL_NAME
	asmlinkage()
	@_SYSCALL_IO_CANCEL_REGARGS
	@_SYSCALL_IO_CANCEL_ARGSTR
}

/* kernel 4.17+ */
probe nd2_syscall.io_cancel = kprobe.function(@arch_syscall_prefix "sys_io_cancel")
{
	__set_syscall_pt_regs(pointer_arg(1))
	@_SYSCALL_IO_CANCEL_NAME
	@_SYSCALL_IO_CANCEL_REGARGS
	@_SYSCALL_IO_CANCEL_ARGSTR
},
{
        %( @_IS_SREG_KERNEL %? @_SYSCALL_IO_CANCEL_REGARGS_STORE %)
}

/* kernel 3.5+, but undesirable because it affects all syscalls */
probe tp_syscall.io_cancel = kernel.trace("sys_enter")
{
	__set_syscall_pt_regs($regs)
	@__syscall_compat_gate(@const("__NR_io_cancel"), @const("__NR_compat_io_cancel"))
	@_SYSCALL_IO_CANCEL_NAME
	@_SYSCALL_IO_CANCEL_REGARGS
	@_SYSCALL_IO_CANCEL_ARGSTR
},
{
        %( @_IS_SREG_KERNEL %? @_SYSCALL_IO_CANCEL_REGARGS_STORE %)
}

probe nd_syscall.io_cancel.return = nd1_syscall.io_cancel.return!, nd2_syscall.io_cancel.return!, tp_syscall.io_cancel.return
  { }
  
probe nd1_syscall.io_cancel.return = kprobe.function("sys_io_cancel").return ?
{
	@_SYSCALL_IO_CANCEL_NAME
	@SYSC_RETVALSTR(returnval())
}

/* kernel 4.17+ */
probe nd2_syscall.io_cancel.return = kprobe.function(@arch_syscall_prefix "sys_io_cancel").return
{
	@_SYSCALL_IO_CANCEL_NAME
	@SYSC_RETVALSTR(returnval())
}
 
/* kernel 3.5+, but undesirable because it affects all syscalls */
probe tp_syscall.io_cancel.return = kernel.trace("sys_exit")
{
	__set_syscall_pt_regs($regs)
	@__syscall_compat_gate(@const("__NR_io_cancel"), @const("__NR_compat_io_cancel"))
	@_SYSCALL_IO_CANCEL_NAME
	@SYSC_RETVALSTR($ret)
}