List of System calls and corresponding kernel routines

[Prasanna S Panchamukhi <prasanna at in dot ibm dot com>]

Hi,

As per Frank's suggestion, I have listed most of the system calls and
corresponding kernel routine below. Currently I am writting a kernel module
using runtime to insert probes on system calls entry point and exit point.

Thanks
Prasanna

Syscall providers:

Below are the set of system calls and corresponding kernel routines.
If a user wants to trace time() system call, he needs to place a probe on
sys_time() routine. Also note that some of the system calls internally
call the same kernel routine, for example fork(), clone(), vfork() system
calls internally call the same kernel routine do_fork(). Users can collect 
useful data such as function arguments, return values etc from the probe 
handler as shown in the example below.

Probe handler:

The example below shows the probe handler to trace fork()/clone()/vfork() 
system call. Here the handler logs the function arguments.


global entry_time, my_clone_flags, my_stack_start, my_regs, my_stack_stize
global my_parent_tidptr, my_child_tidptr, fork_times[MAX_SYSCALL]

probe kernel.syscall("fork") {
	thread->entry_time = $timestamp; 		# "macro" variable
	thread->my_clone_flags = $clone_flags; 		# function argument
	thread->my_stack_start = $stack_start;		# function argument
	thread->my_regs = $regs; 			# function argument
	thread->my_stack_size = $stack_size; 		# function argument
	thread->my_parent_tidptr= $parent_tidptr; 	# function argument
	thread->my_child_tidptr= $child_tidptr;		# function argument

	trace ("my_clone_flags = " . string(thread->clone_flags) .
		"my_stack_start = " . string(thread->my_stack_start),
		"my_regs = " . string(thread->regs),
		"my_stack_size = " . string(thread->my_stack_size),
		"my_parent_tidptr = " . string(thread->my_parent_tidptr),
		"my_child_tidptr = " . string(thread->my_child_tidptr));
}

Similarly you can log return value as shown in the example below.

global retvalue
probe kernel.syscall("fork").return {
	if (thread->entry_time) {
		fork_times[$syscall_name]	# variable from provider alias
			+= $timestamp - thread->entry_time
	}
	retvalue = $regs->eax;			# return handler argument
	trace ("syscall " . $syscall_name .
		" return value = " .
		hexstring (retvalue));  	# function pseudo-argument
}

Above examples are only for demo purpose.
More examples will be posted once the transilator is complete.
The transilator will eventually generate the kernel module which can
put probes on the entry point of do_fork and exit point of do_fork.

System call		: Corresponding kernel routine
=-=-=-=-=-=-		 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

time			: sys_time
stime			: sys_stime
gettimeofday		: sys_gettimeofday
settimeofday		: sys_settimeofday
adjtimex		: sys_adjtimex
times			: sys_times
gettid			: sys_gettid
nanosleep		: sys_nanosleep
alarm			: sys_alarm
getpid			: sys_getpid
getppid			: sys_getppid
getuid			: sys_getuid
geteuid			: sys_geteuid
getgid			: sys_gid
getegid			: sys_getegid
getresuid		: sys_getresuid
getresgid		: sys_retresgid
getpgid			: sys_getpgid
getpgrp			: sys_getpgrp
getsid			: sys_getsid
getgroups		: sys_getgroups
setregid		: sys_setregid
setgid			: sys_setgid
setreuid		: sys_setreuid
setuid			: sys_setuid
setresuid		: sys_setresuid
setresgid		: sys_setresgid
setfsuid		: sys_setfsuid
setfsgid		: sys_setfsgid
setpgid			: sys_setpgid
setsid			: sys_setsid
setgroups		: sys_setgroups
acct			: sys_acct
capget			: sys_capget
capset			: sys_capset
personality		: sys_personality
sigpending		: do_sigpending
sigprocmask		: sys_sigprocmask
getitimer		: sys_getitimer
setitimer		: sys_setitimer
timer_create		: sys_timer_create
timer_gettime		: sys_timer_gettime
timer_getoverrun	: sys_timer_getoverrun
timer_settime		: sys_timer_settime
timer_delete		: sys_timer_delete
clock_settime		: sys_clock_settime
clock_gettime		: sys_clock_gettime
clock_getres		: sys_clock_getres
clock_nanosleep		: sys_clock_nanosleep
nice			: sys_nice
sched_setscheduler	: do_sched_setscheduler
sched_setparam		: do_sched_setscheduler
sched_getscheduler	: sys_sched_getscheduler
sched_getparam		: sys_sched_getparam
sched_setaffinity	: sys_sched_setaffinity
sched_getaffinity	: sys_sched_getaffinity
sched_yield		: sys_sched_yield
sched_get_priority_max	: sys_sched_get_priority_max
sched_get_priority_min	: sys_sched_get_priority_min
sched_rr_get_interval	: sys_sched_rr_get_interval
setpriority		: sys_setpriority
getpriority		: sys_getpriority
shutdown		: sys_shutdown
reboot			: sys_reboot
restart_syscall		: sys_restart_syscall
exit			: do_exit
exit_group		: do_group_exit
wait4			: sys_wait4
waitid			: sys_waitid
waitpid			: sys_wait4
set_tid_address		: sys_set_tid_address
futex			: sys_futex
init_module		: sys_init_module
delete_module		: sys_delete_module
rt_sigprocmask		: sys_rt_sigprocmask
rt_sigpending		: do_sigpending
rt_sigtimedwait		: sys_rt_sigtimedwait
kill			: sys_kill
tgkill			: sys_tgkill
tkill			: sys_tkill
rt_sigqueueinfo		: sys_rt_sigqueueinfo
sgetmask		: sys_sgetmask
ssetmask		: sys_ssetmask
signal			: sys_signal
pause			: sys_pause
sync			: do_sync
fsync			: sys_fsync
fdatasync		: sys_fdatasync
bdflush			: sys_bdflush
mount			: sys_mount
umount			: sys_umount
oldumount		: sys_umount
truncate		: do_sys_truncate
ftruncate		: do_sys_ftrancate
stat			: sys_stat
statfs			: sys_statfs
statfs64		: sys_statfs64
fstatfs			: sys_fstatfs
fstatfs64		: sys_fstatfs64
lstat			: sys_lstat
fstat			: sys_fstat
newstat			: sys_newstat
newlstat		: sys_newlstat
newfstat		: sys_newfstat
ustat			: sys_ustat
stat64			: sys_stat64
fstat64			: sys_fstat64
lstat64			: sys_lstat64
truncate64		: do_sys_truncate
ftruncate64		: do_sys_ftruncate
setxattr		: sys_setxattr
lsetxattr		: sys_lsetxattr
fsetxattr		: sys_fsetxattr
getxattr		: sys_getxattr
lgetxattr		: sys_lgetxattr
fgetxattr		: sys_fgetxattr
listxattr		: sys_listxattr
llistxattr		: sys_llistxattr
flistxattr		: sys_flistxattr
removexattr		: sys_removexattr
lremovexattr		: sys_lremovexattr
fremovexattr		: sys_fremovexattr
brk			: sys_brk
mprotect		: sys_mprotect
mremap			: sys_mremap
remap_file_pages	: sys_remap_file_pages
msync			: sys_msync
fadvise64		: sys_fadvise64_64
fadvise64_64		: sys_fadvise64_64
munmap			: sys_munmap
mlock			: sys_mlock
munlock			: sys_munlock
mlockall		: sys_mlockall
munlockall		: sys_munlockall
madvise			: sys_madvise
mincore			: sys_mincore
pivot_root		: sys_pivot_root
chroot			: sys_chroot
mknod			: sys_mknod
link			: sys_link
symlink			: sys_symlink
unlink			: sys_unlink
rename			: sys_rename
chmod			: sys_chmod
fchmod			: sys_fchmod
fcntl			: sys_fcntl
fcntl64			: sys_fcntl64
dup			: sys_dup
dup2			: sys_dup2
ioperm			: sys_ioperm
ioctl			: sys_ioctl
flock			: sys_flock
io_setup		: sys_io_setup
io_destroy		: sys_io_destroy
io_getevents		: sys_io_getevents
io_submit		: sys_io_submit
io_cancel		: sys_io_cancel
sendfile		: sys_sendfile
sendfile64		: sys_sendfile64
readlink		: sys_readlink
creat			: sys_open
open			: sys_open
close			: sys_close
access			: sys_access
vhangup			: sys_vhangup
chown			: sys_chown
lchown			: sys_lchown
fchown			: sys_fchown
chown16			: sys_chown
lchown16		: sys_lchown
fchown16		: sys_fchown
setregid16		: sys_setregid
setgid16		: sys_setgid
setreuid16		: sys_setreuid
setuid16		: sys_setuid
setresuid16		: sys_setresuid
getresuid16		: sys_getresuid
setresgid16		: sys_setresgid
getresgid16		: sys_getresgid
setfsuid16		: sys_setfsuid
setfsgid16		: sys_setfsgid
getgroups16		: sys_getgroups16
setgroups16		: sys_setgroups16
getuid16		: sys_getuid16
geteuid16		: sys_geteuid16
getgid16		: sys_getgid16
getegid16		: sys_getegid16
utime			: sys_utime
utimes			: sys_utimes
lseek			: sys_lseek
llseek			: sys_llseek
read			: sys_read
readahead		: sys_readahead
readv			: sys_readv
write			: sys_write
writev			: sys_writev
pread64			: sys_pread64
pwrite64		: sys_pwrite64
getcwd			: sys_getcwd
mkdir			: sys_mkdir
chdir			: sys_chdir
fchdir			: sys_fchdir
rmdir			: sys_rmdir
lookup_dcookie		: sys_lookup_dcookie
quotactl		: sys_quotactl
getdents		: sys_getdents
getdents64		: sys_getdents64
setsockopt		: sys_setsockopt
getsockopt		: sys_getsockopt
bind			: sys_bind
connect			: sys_connect
accept			: sys_accept
getsockname		: sys_getsockname
getpeername		: sys_getpeername
send			: sys_sendto
sendto			: sys_sendto
sendmsg			: sys_sendmsg
recv			: sys_recvfrom
recvfrom		: sys_recvfrom
recvmsg			: sys_recvmsg
socket			: sys_socket
socketpair		: sys_socketpair
socketcall		: sys_socketcall
listen			: sys_listen
poll			: sys_poll
select			: sys_select
epoll_create		: sys_epoll_create
epoll_ctl		: sys_epoll_ctl
epoll_wait		: sys_epoll_wait
gethostname		: sys_gethostname
sethostname		: sys_sethostname
setdomainname		: sys_setdomainname
newuname		: sys_newuname
getrlimit		: sys_getrlimit
old_getrlimit		: sys_old_getrlimit
setrlimit		: sys_setrlimit
getrusage		: sys_getrusage
umask			: sys_umask
msgget			: sys_msgget
msgsnd			: sys_msgsnd
msgrcv			: sys_msgrcv
msgctl			: sys_msgctl
semget			: sys_semget
semop			: sys_semtimedop
semctl			: sys_semctl
semtimedop		: sys_semtimedop
shmat			: sys_shmat
shmget			: sys_shmget
shmdt			: sys_shmdt
shmctl			: sys_shmctl
mq_open			: sys_mq_open
mq_unlink		: sys_mq_unlink
mq_timedsend		: sys_mq_timedsend
mq_timedreceive		: sys_mq_timedreceive
mq_notify		: sys_mq_notify
mq_getsetattr		: sys_mq_getsetattr
pciconfig_iobase	: sys_pciconfig_iobase
pciconfig_read		: sys_pciconfig_read
pciconfig_write		: sys_pciconfig_write
prctl			: sys_prctl
swapon			: sys_swapon
swapoff			: sys_swapoff
sysctl			: sys_sysctl
sysinfo			: sys_sysinfo
sysfs			: sys_sysfs
nfsservctl		: sys_nfsservctl
syslog			: do_syslog
uselib			: sys_uselib
add_key			: sys_add_key
request_key		: sys_request_key
keyctl			: sys_keyctl
modify_ldt		: sys_modify_ldt
mmap2			: do_mmap2
execve			: sys_execve
clone			: do_fork
fork			: do_fork
vfork			: do_fork
pipe			: sys_pipe
ptrace			: sys_ptrace
iopl			: sys_iopl
rt_sigaction		: sys_rt_sigaction
-- 

Prasanna S Panchamukhi
Linux Technology Center
India Software Labs, IBM Bangalore
Ph: 91-80-25044636
<prasanna@in.ibm.com>