Chapter 35. syscalls

Following is an overview of available syscall probes and convenience variables they offer. By default, each syscall probe has name and argstr convenience variables, which are not included in the overview in order to keep it short. Non dwarf-based nd_syscall probes are supposed to have the same convenience variables.

Table 35.1. Syscalls list

syscallparams
accept addr_uaddr, addrlen_uaddr, sockfd
accept4 addr_uaddr, addrlen_uaddr, flags, flags_str, sockfd
access mode, mode_str, pathname
acct filename
add_key description_uaddr, payload_uaddr, plen, ringid, type_uaddr
adjtimex buf_str, buf_uaddr
alarm seconds
arch_prctl addr, code, code_str
bdflush data, data_str, func
bind addrlen, my_addr_uaddr, sockfd, uaddr_af, uaddr_ip, uaddr_ip_port, uaddr_ipv6_flowinfo, uaddr_ipv6_scope_id
bpf attr_uaddr, cmd, cmd_str, size
brk brk
capget data_uaddr, header_uaddr
capset data_uaddr, header_uaddr
chdir path
chmod mode, path
chown group, owner, path
chown16 group, owner, path
chroot path
clock_adjtime clk_id, clk_id_str, tx_uaddr
clock_getres clk_id, clk_id_str, res_uaddr
clock_gettime clk_id, clk_id_str, tp_uaddr
clock_nanosleep clk_id, clk_id_str, flags, flags_str, rem_uaddr, req_uaddr
clock_settime clk_id, clk_id_str, tp_uaddr
clone child_tid_uaddr, clone_flags, parent_tid_uaddr, stack_start
close fd
compat_adjtimex buf_str, buf_uaddr
compat_clock_nanosleep clk_id, clk_id_str, flags, flags_str, rem_uaddr, req_uaddr
compat_execve args, env_str, filename
compat_execveat args, dirfd, dirfd_str, env_str, filename, flags, flags_str
compat_fadvise64 advice, fd, len, offset
compat_fadvise64_64 advice, fd, len, offset
compat_fallocate fd, len, mode, offset
compat_ftruncate64 fd, length
compat_futex futex_uaddr, op, uaddr2_uaddr, utime_uaddr, val3, val
compat_futimesat dirfd, dirfd_str, filename, filename_uaddr, tvp_uaddr
compat_getitimer value_uaddr, which
compat_lookup_dcookie buffer_uaddr, cookie, len
compat_nanosleep rem_uaddr, req_uaddr
compat_ppoll
compat_pselect6
compat_readahead count, fd, offset
compat_recvmmsg flags, flags_str, mmsg_uaddr, s, timeout_uaddr, vlen
compat_rt_sigprocmask how, how_str, oldset_uaddr, set_uaddr
compat_select exceptfds_uaddr, n, readfds_uaddr, timeout_uaddr, writefds_uaddr
compat_setitimer ovalue_uaddr, value_uaddr, which
compat_signalfd flags
compat_sys_msgctl buf_uaddr, cmd, cmd_str, msqid
compat_sys_msgrcv msgflg, msgflg_str, msgp_uaddr, msgsz, msgtyp, msqid
compat_sys_msgsnd msgflg, msgflg_str, msgp_uaddr, msgsz, msqid
compat_sys_recvmsg flags, flags_str, msg_uaddr, s
compat_sys_semctl arg, cmd, cmdstr, semid, semnum
compat_sys_semtimedop nsops, semid, sops_uaddr, timeout_uaddr
compat_sys_sendmsg flags, flags_str, msg_uaddr, s
compat_sys_shmat shmaddr_uaddr, shmflg, shmid
compat_sys_shmctl buf_uaddr, cmd, cmd_str, shmid
compat_sys_utimes filename
compat_truncate64 length, path, path_uaddr
compat_utime actime, buf_uaddr, filename, filename_uaddr, modtime
compat_utimensat dfd, dfd_str, filename, filename_uaddr, flags, flags_str, tsp_uaddr
compat_vmsplice fd, flags, flags_str, iov, nr_segs
connect addrlen, serv_addr_uaddr, sockfd, uaddr_af, uaddr_ip, uaddr_ip_port, uaddr_ipv6_flowinfo, uaddr_ipv6_scope_id
creat mode, pathname
delete_module flags, flags_str, name_user
dup oldfd
dup2 flags, newfd, oldfd
dup3 flags, newfd, oldfd
epoll_create flags, size
epoll_ctl epfd, event_uaddr, fd, op, op_str
epoll_pwait epfd, events_uaddr, maxevents, sigmask_uaddr, sigsetsize, timeout
epoll_wait epfd, events_uaddr, maxevents, timeout
eventfd count, flags, flags_str
execve args, env_str, filename
execveat args, dirfd, dirfd_str, env_str, filename, flags, flags_str
exit status
exit_group status
faccessat dirfd, dirfd_str, mode, mode_str, pathname
fadvise64 advice, fd, len, offset
fadvise64_64 advice, fd, len, offset
fallocate fd, len, mode, mode_str, offset
fanotify_init event_f_flags, event_f_flags_str, flags, flags_str
fanotify_mark dirfd, dirfd_str, fanotify_fd, flags, flags_str, mask, mask_str, pathname
fchdir fd
fchmod fildes, mode
fchmodat dirfd, dirfd_str, mode, pathname
fchown fd, group, owner
fchown16 fd, group, owner
fchownat dirfd, dirfd_str, flags, flags_str, group, owner, pathname
fcntl arg, cmd, cmd_str, fd
fdatasync fd
fgetxattr filedes, name_str, size, value_uaddr
finit_module fd, flags, flags_str, uargs
flistxattr filedes, list_uaddr, size
flock fd, operation
fork
fremovexattr filedes, name_str, name_uaddr
fsetxattr filedes, flags, flags_str, name_str, name_uaddr, size, value_str, value_uaddr
fstat buf_uaddr, filedes
fstatat buf_uaddr, dirfd, dirfd_str, flags, flags_str, path
fstatfs buf_uaddr, fd
fstatfs64 buf_uaddr, fd, sz
fsync fd
ftruncate fd, length
futex futex_uaddr, op, uaddr2_uaddr, utime_uaddr, val3, val
futimesat dirfd, dirfd_str, filename, filename_uaddr, tvp_uaddr
get_mempolicy addr, flags, flags_str, maxnode, nmask_uaddr, policy_uaddr
get_robust_list len_uaddr, list_head_uaddr, pid
get_thread_area u_info_uaddr
getcpu cpu_uaddr, node_uaddr, tcache_uaddr
getcwd buf_uaddr, size
getdents count, dirp_uaddr, fd
getegid
geteuid
getgid
getgroups list_uaddr, size
gethostname len, name_uaddr
getitimer value_uaddr, which
getpeername name_uaddr, namelen_uaddr, s
getpgid pid
getpgrp
getpid
getppid
getpriority which, who
getrandom buf, count, flags, flags_str
getresgid egid_uaddr, rgid_uaddr, sgid_uaddr
getresuid euid_uaddr, ruid_uaddr, suid_uaddr
getrlimit resource, rlim_uaddr
getrusage usage_uaddr, who, who_str
getsid pid
getsockname name_uaddr, namelen_uaddr, s
getsockopt fd, level, level_str, optlen_uaddr, optname, optname_str, optval_uaddr
gettid
gettimeofday tv_uaddr, tz_uaddr
getuid
getxattr name_str, path, size, value_uaddr
init_module len, uargs, umod_uaddr
inotify_add_watch fd, mask, path, path_uaddr
inotify_init flags
inotify_rm_watch fd, wd
io_cancel ctx_id, iocb_uaddr, result_uaddr
io_destroy ctx
io_getevents ctx_id, events_uaddr, min_nr, nr, timeout_uaddr, timestr
io_setup ctxp_uaddr, maxevents
io_submit ctx_id, iocbpp_uaddr, nr
ioctl argp, fd, request
ioperm from, num, turn_on
iopl level
ioprio_get which, which_str, who
ioprio_set ioprio, ioprio_str, which, which_str, who
kcmp idx1, idx2, pid1, pid2, type, type_str
kexec_file_load cmdline, cmdline_len, flags, flags_str, initrd_fd, kernel_fd
kexec_load entry, flags, flags_str, nr_segments, segments_uaddr
keyctl arg2, arg3, arg4, arg5, option
kill pid, sig
lchown group, owner, path
lchown16 group, owner, path
lgetxattr name_str, path, size, value_uaddr
link newpath, oldpath
linkat flags, flags_str, newdirfd, newdirfd_str, newpath, olddirfd, olddirfd_str, oldpath
listen backlog, sockfd
listxattr list_uaddr, path, path_uaddr, size
llistxattr list_uaddr, path, path_uaddr, size
llseek fd, offset_high, offset_low, result_uaddr, whence, whence_str
lookup_dcookie buffer_uaddr, cookie, len
lremovexattr name_str, name_uaddr, path, path_uaddr
lseek fildes, offset, whence, whence_str
lsetxattr flags, flags_str, name_str, name_uaddr, path, path_uaddr, size, value_str, value_uaddr
lstat buf_uaddr, path
madvise advice, advice_str, length, start
mbind flags, flags_str, len, maxnode, mode, mode_str, nmask_uaddr, start
memfd_create flags, flags_str, uname
migrate_pages maxnode, new_nodes, old_nodes, pid
mincore length, start, vec_uaddr
mkdir mode, pathname, pathname_uaddr
mkdirat dirfd, dirfd_str, mode, pathname
mknod dev, mode, pathname
mknodat dev, dirfd, dirfd_str, mode, mode_str, pathname
mlock addr, len
mlockall flags
mmap2 fd, flags, length, pgoffset, prot, start
modify_ldt bytecount, func, ptr_uaddr
mount data, filesystemtype, mountflags, mountflags_str, source, target
move_pages flags, flags_str, nodes, nr_pages, pages, pid, status
mprotect addr, len, prot, prot_str
mq_getsetattr mqdes, u_mqstat_uaddr, u_omqstat_uaddr
mq_notify mqdes, notification_uaddr
mq_open filename, mode, name_uaddr, oflag, u_attr_uaddr
mq_timedreceive abs_timeout_uaddr, mqdes, msg_len, msg_prio_uaddr, msg_ptr_uaddr
mq_timedsend abs_timeout_uaddr, mqdes, msg_len, msg_prio, msg_ptr_uaddr
mq_unlink u_name, u_name_uaddr
mremap flags, new_address, new_size, old_address, old_size
msgctl buf_uaddr, cmd, cmd_str, msqid
msgget key, key_str, msgflg, msgflg_str
msgrcv msgflg, msgflg_str, msgp_uaddr, msgsz, msgtyp, msqid
msgsnd msgflg, msgflg_str, msgp_uaddr, msgsz, msqid
msync flags, length, start
munlock addr, len
munlockall
munmap length, start
name_to_handle_at dfd, dfd_str, flags, flags_str, handle_uaddr, mnt_id_uaddr, pathname
nanosleep rem_uaddr, req_uaddr
ni_syscall
nice inc
open filename, flags, mode
open_by_handle_at flags, flags_str, handle_uaddr, mount_dfd, mount_dfd_str
openat dfd, dfd_str, filename, flags, mode
pause
perf_event_open attr_uaddr, cpu, flags, flags_str, group_fd, pid
personality persona
pipe fildes_uaddr, flag_str, flags, pipe0, pipe1
pivot_root new_root_str, old_root_str
poll nfds, timeout, ufds_uaddr
ppoll
prctl arg2, arg3, arg4, arg5, option
pread buf_uaddr, count, fd, offset
preadv count, fd, offset, vector_uaddr
prlimit64 new_rlim_uaddr, old_rlim_uaddr, pid, resource
process_vm_readv flags, liovcnt, local_iov_uaddr, pid, remote_iov_uaddr, riovcnt
process_vm_writev flags, liovcnt, local_iov_uaddr, pid, remote_iov_uaddr, riovcnt
pselect6
ptrace addr, data, pid, request
pwrite buf_uaddr, count, fd, offset
pwritev count, fd, offset, vector_uaddr
quotactl addr_uaddr, cmd, cmd_str, id, special, special_str
read buf_uaddr, count, fd
readahead count, fd, offset
readdir count, dirent, fd
readlink buf_uaddr, bufsiz, path
readlinkat buf_uaddr, bufsiz, dfd, dfd_str, path
readv count, fd, vector_uaddr
reboot arg_uaddr, flag, flag_str, magic2, magic2_str, magic, magic_str
recv buf_uaddr, flags, flags_str, len, s
recvfrom addr_uaddr, addrlen_uaddr, buf_uaddr, flags, flags_str, len, s
recvmmsg flags, flags_str, mmsg_uaddr, s, timeout_uaddr, vlen
recvmsg flags, flags_str, msg_uaddr, s
remap_file_pages flags, pgoff, prot, size, start
removexattr name_str, path
rename newpath, oldpath
renameat newdfd, newdfd_str, newname, newname_str, olddfd, olddfd_str, oldname, oldname_str
renameat2 flags, flags_str, newdfd, newdfd_str, newname, newname_str, olddfd, olddfd_str, oldname, oldname_str
request_key callout_info_uaddr, description_uaddr, destringid, type_uaddr
restart_syscall
rmdir pathname
rt_sigaction act_uaddr, oact_uaddr, sig, sigsetsize
rt_sigaction32 act_uaddr, oact_uaddr, sig, sigsetsize
rt_sigpending set_uaddr, sigsetsize
rt_sigprocmask how, how_str, oldset_uaddr, set_uaddr
rt_sigqueueinfo pid, sig, uinfo_uaddr
rt_sigreturn
rt_sigsuspend set_uaddr, sigsetsize
rt_sigtimedwait sigsetsize, uinfo_uaddr, uthese_uaddr, uts_uaddr
rt_tgsigqueueinfo sig, tgid, tid, uinfo_uaddr
sched_get_priority_max policy
sched_get_priority_min policy
sched_getaffinity len, mask_uaddr, pid
sched_getattr flags, pid, sched_attr_str, sched_attr_uaddr, size
sched_getparam p_uaddr, pid
sched_getscheduler pid
sched_rr_get_interval pid, tp_uaddr
sched_setaffinity len, mask_uaddr, pid
sched_setattr flags, pid, sched_attr_str, sched_attr_uaddr
sched_setparam p_uaddr, pid
sched_setscheduler p_uaddr, pid, policy, policy_str
sched_yield
seccomp flags, flags_str, op, op_str, uargs, uargs_uaddr
select exceptfds_uaddr, n, readfds_uaddr, timeout_uaddr, writefds_uaddr
semctl arg, cmd, cmdstr, semid, semnum
semget key, key_str, nsems, semflg, semflg_str
semop nsops, semid, sops_uaddr
semtimedop nsops, semid, sops_uaddr, timeout_uaddr
send buf_uaddr, flags, flags_str, len, s
sendfile count, in_fd, offset_uaddr, out_fd
sendmmsg flags, flags_str, mmsg_uaddr, s, vlen
sendmsg flags, flags_str, msg_uaddr, s
sendto buf_uaddr, flags, flags_str, len, s, to_uaddr, tolen
set_mempolicy maxnode, mode, mode_str, nmask_uaddr
set_robust_list len, list_head_uaddr
set_thread_area u_info_uaddr
set_tid_address tidptr_uaddr
setdomainname domainname_str, domainname_uaddr, len
setfsgid fsgid
setfsuid fsuid
setgid gid
setgroups list_uaddr, size
sethostname hostname_uaddr, len, name_str
setitimer ovalue_uaddr, value_uaddr, which
setns fd, nstype
setpgid pgid, pid
setpriority prio, which, which_str, who
setregid egid, rgid
setregid16 egid, rgid
setresgid egid, rgid, sgid
setresgid16 egid, rgid, sgid
setresuid euid, ruid, suid
setresuid16 euid, ruid, suid
setreuid euid, ruid
setreuid16 euid, ruid
setrlimit resource, rlim_uaddr
setsid
setsockopt fd, level, level_str, optlen, optname, optname_str, optval_uaddr
settimeofday tv_uaddr, tz_uaddr
settimeofday32 tv_uaddr, tz_uaddr
setuid uid
setxattr flags, flags_str, name_str, name_uaddr, path, path_uaddr, size, value_str, value_uaddr
sgetmask
shmat shmaddr_uaddr, shmflg, shmid
shmctl buf_uaddr, cmd, cmd_str, shmid
shmdt shmaddr_uaddr
shmget key, shmflg, shmflg_str, size
shutdown how, how_str, s
sigaction32 act_uaddr, oact_uaddr, sig
sigaltstack uoss_uaddr, uss_uaddr
signal handler, sig
signalfd flags
sigpending
sigprocmask how, how_str, oldset_uaddr, set_uaddr
sigreturn
sigsuspend mask
socket family, protocol, type
socketpair family, protocol, sv_uaddr, type
splice fd_in, fd_out, flags, flags_str, len, off_in, off_out
ssetmask newmask, newmask_str
stat buf_uaddr, filename, filename_uaddr
statfs buf_uaddr, path
statfs64 buf_uaddr, path, sz
stime t_uaddr
swapoff path
swapon path, swapflags, swapflags_str
symlink newpath, oldpath
symlinkat newdfd, newdfd_str, newname, newname_str, oldname, oldname_str
sync
sync_file_range fd, flags, flags_str, nbytes, offset
syncfs fd
sysctl
sysfs arg1, arg2, option
sysinfo info_uaddr
syslog bufp_uaddr, len, type
tee fdin, fdout, flags, len
tgkill pid, sig, tgid
time t_uaddr
timer_create clockid, clockid_str, evp_uaddr, timerid_uaddr
timer_delete timerid
timer_getoverrun timerid
timer_gettime timerid, value_uaddr
timer_settime flags, ovalue_uaddr, timerid, value_uaddr
timerfd_create clockid, clockid_str, flags, flags_str
timerfd_gettime fd, value_uaddr
timerfd_settime fd, flags, flags_str, ovalue_uaddr, value_uaddr
times buf_uaddr
tkill pid, sig
truncate length, path, path_uaddr
umask mask
umount flags, flags_str, target
uname
unlink pathname, pathname_uaddr
unlinkat dfd, dfd_str, flag, flag_str, pathname, pathname_str
unshare unshare_flags
ustat dev, ubuf_uaddr
ustat32 dev, ubuf_uaddr
utime actime, buf_uaddr, filename, filename_uaddr, modtime
utimensat dfd, dfd_str, filename, filename_uaddr, flags, flags_str, tsp_uaddr
utimes filename, filename_uaddr, tvp_uaddr
vfork
vhangup
vmsplice fd, flags, flags_str, iov, nr_segs
wait4 options, options_str, pid, rusage_uaddr, status_uaddr
waitid infop_uaddr, options, options_str, pid, rusage_uaddr, which, which_str
waitpid options, options_str, pid, status_uaddr
write buf_uaddr, count, fd
writev count, fd, vector_uaddr