Sindbad~EG File Manager

# restart_syscall ____________________________________________
#
# asmlinkage long
# sys_restart_syscall(void)
#

@define _SYSCALL_RESTART_SYSCALL_NAME
%(
	name = "restart_syscall"
%)

@define _SYSCALL_RESTART_SYSCALL_ARGSTR
%(
	argstr = ""
%)

probe syscall.restart_syscall = dw_syscall.restart_syscall !,
                                nd_syscall.restart_syscall {}
probe syscall.restart_syscall.return = dw_syscall.restart_syscall.return !,
                                       nd_syscall.restart_syscall.return {}

# dw_restart_syscall _____________________________________________________

probe dw_syscall.restart_syscall = kernel.function("sys_restart_syscall").call
{
	@_SYSCALL_RESTART_SYSCALL_NAME
	@_SYSCALL_RESTART_SYSCALL_ARGSTR
}
probe dw_syscall.restart_syscall.return = kernel.function("sys_restart_syscall").return
{
	@_SYSCALL_RESTART_SYSCALL_NAME
	@SYSC_RETVALSTR($return)
}

# nd_restart_syscall _____________________________________________________

probe nd_syscall.restart_syscall = nd1_syscall.restart_syscall!, nd2_syscall.restart_syscall!, tp_syscall.restart_syscall
  { }

probe nd1_syscall.restart_syscall = kprobe.function("sys_restart_syscall")
{
	@_SYSCALL_RESTART_SYSCALL_NAME
	@_SYSCALL_RESTART_SYSCALL_ARGSTR
}

/* kernel 4.17+ */
probe nd2_syscall.restart_syscall = kprobe.function(@arch_syscall0_prefix "sys_restart_syscall") ?
{
	@_SYSCALL_RESTART_SYSCALL_NAME
	@_SYSCALL_RESTART_SYSCALL_ARGSTR
}

/* kernel 3.5+, but undesirable because it affects all syscalls */
probe tp_syscall.restart_syscall = kernel.trace("sys_enter")
{
	@__syscall_compat_gate(@const("__NR_restart_syscall"), @const("__NR_compat_restart_syscall"))
	@_SYSCALL_RESTART_SYSCALL_NAME
	@_SYSCALL_RESTART_SYSCALL_ARGSTR
}

probe nd_syscall.restart_syscall.return = nd1_syscall.restart_syscall.return!, nd2_syscall.restart_syscall.return!, tp_syscall.restart_syscall.return
  { }
  
probe nd1_syscall.restart_syscall.return = kprobe.function("sys_restart_syscall").return
{
	@_SYSCALL_RESTART_SYSCALL_NAME
	@SYSC_RETVALSTR(returnval())
}

/* kernel 4.17+ */
probe nd2_syscall.restart_syscall.return = kprobe.function(@arch_syscall0_prefix "sys_restart_syscall").return ?
{
	@_SYSCALL_RESTART_SYSCALL_NAME
	@SYSC_RETVALSTR(returnval())
}
 
/* kernel 3.5+, but undesirable because it affects all syscalls */
probe tp_syscall.restart_syscall.return = kernel.trace("sys_exit")
{
	__set_syscall_pt_regs($regs)
	@__syscall_compat_gate(@const("__NR_restart_syscall"), @const("__NR_compat_restart_syscall"))
	@_SYSCALL_RESTART_SYSCALL_NAME
	@SYSC_RETVALSTR($ret)
}