Chapter 37. syscalls

Following is an overview of available syscall probes and convenience variables they offer. By default, each syscall probe has name and argstr convenience variables, which are not included in the overview in order to keep it short. Non dwarf-based nd_syscall probes are supposed to have the same convenience variables.

Table 37.1. Syscalls list

syscallparams
accept addr_uaddr, addrlen_uaddr, sockfd
accept4 addr_uaddr, addrlen_uaddr, flags, flags_str, sockfd
access mode, mode_str, pathname, pathname_unquoted
acct filename, filename_unquoted
add_key description_uaddr, payload_uaddr, plen, ringid, type_uaddr
adjtimex buf_str, buf_uaddr
alarm seconds
arch_prctl addr, code, code_str
bdflush data, data_str, func
bind addrlen, my_addr_uaddr, sockfd, uaddr_af, uaddr_ip, uaddr_ip_port, uaddr_ipv6_flowinfo, uaddr_ipv6_scope_id
bpf attr_uaddr, cmd, cmd_str, size
brk brk
capget data_uaddr, header_uaddr
capset data_uaddr, header_uaddr
chdir path, path_unquoted
chmod mode, path, path_unquoted
chown group, owner, path, path_unquoted
chown16 group, owner, path, path_unquoted
chroot path, path_unquoted
clock_adjtime clk_id, clk_id_str, tx_uaddr, tx_uaddr_str
clock_getres clk_id, clk_id_str, res_uaddr
clock_gettime clk_id, clk_id_str, tp_uaddr
clock_nanosleep clk_id, clk_id_str, flags, flags_str, rem_uaddr, req_str, req_uaddr
clock_settime clk_id, clk_id_str, tp_uaddr, tp_uaddr_str
clone $id, $regs, child_tid_uaddr, clone_flags, int, parent_tid_uaddr, pt_regs*, stack_start
close fd
compat_adjtimex $id, $regs, buf_str, buf_uaddr, int, pt_regs*
compat_clock_nanosleep $id, $regs, clk_id, clk_id_str, flags, flags_str, int, pt_regs*, rem_uaddr, req_str, req_uaddr
compat_execve args, env_str, filename
compat_execveat args, dirfd, dirfd_str, env_str, filename, flags, flags_str
compat_fadvise64 $id, $regs, advice, advice_str, fd, int, len, offset, pt_regs*
compat_fadvise64_64 $id, $regs, advice, advice_str, fd, int, len, offset, pt_regs*
compat_fallocate $id, $regs, fd, int, len, mode, mode_str, offset, pt_regs*
compat_ftruncate64 $id, $regs, fd, int, length, pt_regs*
compat_futex $id, $regs, futex_uaddr, int, op, pt_regs*, uaddr2_uaddr, utime_uaddr, val3, val
compat_futimesat $id, $regs, dirfd, dirfd_str, filename, filename_uaddr, filename_unquoted, int, pt_regs*, tvp_str, tvp_uaddr
compat_getitimer value_uaddr, which
compat_lookup_dcookie $id, $regs, buffer_uaddr, cookie, int, len, pt_regs*
compat_nanosleep $id, $regs, int, pt_regs*, rem_uaddr, req_str, req_uaddr
compat_ppoll $id, $regs, fds_uaddr, int, nfds, pt_regs*, sigmask, sigsetsize, tsp, tsp_str
compat_pselect6 $id, $regs, exceptfds, int, nfds, pt_regs*, readfds, sigmask, timeout, timeout_str, writefds
compat_readahead $id, $regs, count, fd, int, offset, pt_regs*
compat_recvmmsg $id, $regs, flags, flags_str, int, mmsg_uaddr, pt_regs*, s, timeout_str, timeout_uaddr, vlen
compat_select exceptfds_uaddr, n, readfds_uaddr, timeout_str, timeout_uaddr, writefds_uaddr
compat_setitimer ovalue_uaddr, value_str, value_uaddr, which, which_str
compat_signalfd flags
compat_sys_msgctl buf_uaddr, cmd, cmd_str, msqid
compat_sys_msgrcv msgflg, msgflg_str, msgp_uaddr, msgsz, msgtyp, msqid
compat_sys_msgsnd msgflg, msgflg_str, msgp_uaddr, msgsz, msqid
compat_sys_recvmsg flags, flags_str, msg_uaddr, s
compat_sys_semctl arg, cmd, cmdstr, semid, semnum
compat_sys_semtimedop nsops, semid, sops_uaddr, timeout_str, timeout_uaddr
compat_sys_sendmsg flags, flags_str, msg_uaddr, s
compat_sys_shmat shmaddr_uaddr, shmflg, shmflg_str, shmid
compat_sys_shmctl buf_uaddr, cmd, cmd_str, shmid
compat_sys_utimes $id, $regs, filename, filename_unquoted, int, pt_regs*, timeval, tvp_uaddr_str
compat_truncate64 $id, $regs, int, length, path, path_uaddr, path_unquoted, pt_regs*
compat_utime $id, $regs, actime, buf_uaddr, filename, filename_uaddr, filename_unquoted, int, modtime, pt_regs*
compat_utimensat $id, $regs, dfd, dfd_str, filename, filename_uaddr, filename_unquoted, flags, flags_str, int, pt_regs*, tsp_str, tsp_uaddr
compat_vmsplice $id, $regs, fd, flags, flags_str, int, iov, nr_segs, pt_regs*
connect addrlen, serv_addr_uaddr, sockfd, uaddr_af, uaddr_ip, uaddr_ip_port, uaddr_ipv6_flowinfo, uaddr_ipv6_scope_id
copy_file_range fd_in, fd_out, flags, len, off_in, off_out
creat mode, pathname, pathname_unquoted
delete_module flags, flags_str, name_user, name_user_unquoted
dup oldfd
dup2 flags, flags_str, newfd, oldfd
dup3 flags, flags_str, newfd, oldfd
epoll_create flags, size
epoll_ctl epfd, event_uaddr, fd, op, op_str
epoll_pwait epfd, events_uaddr, maxevents, sigmask_uaddr, sigsetsize, timeout
epoll_wait epfd, events_uaddr, maxevents, timeout
eventfd count, flags, flags_str
execve args, env_str, filename
execveat args, dirfd, dirfd_str, env_str, filename, flags, flags_str
exit status
exit_group status
faccessat dirfd, dirfd_str, mode, mode_str, pathname, pathname_unquoted
fadvise64 advice, advice_str, fd, len, offset
fadvise64_64 $id, $regs, advice, advice_str, fd, int, len, offset, pt_regs*
fallocate fd, len, mode, mode_str, offset
fanotify_init event_f_flags, event_f_flags_str, flags, flags_str
fanotify_mark dirfd, dirfd_str, fanotify_fd, flags, flags_str, mask, mask_str, pathname, pathname_unquoted
fchdir fd
fchmod fildes, mode
fchmodat dirfd, dirfd_str, mode, pathname, pathname_unquoted
fchown fd, group, owner
fchown16 fd, group, owner
fchownat dirfd, dirfd_str, flags, flags_str, group, owner, pathname, pathname_unquoted
fcntl arg, cmd, cmd_str, fd
fdatasync fd
fgetxattr filedes, name_str, name_str_unquoted, size, value_uaddr
finit_module fd, flags, flags_str, uargs, uargs_unquoted
flistxattr filedes, list_uaddr, size
flock fd, operation
fork
fremovexattr filedes, name_str, name_str_unquoted, name_uaddr
fsetxattr filedes, flags, flags_str, name_str, name_str_unquoted, name_uaddr, size, value_str, value_uaddr
fstat buf_uaddr, filedes
fstatat buf_uaddr, dirfd, dirfd_str, flags, flags_str, path, path_unquoted
fstatfs buf_uaddr, fd
fstatfs64 buf_uaddr, fd, sz
fsync fd
ftruncate fd, length
ftruncate64 $id, $regs, fd, int, length, pt_regs*
futex futex_uaddr, op, uaddr2_uaddr, utime_uaddr, val3, val
futimesat dirfd, dirfd_str, filename, filename_uaddr, filename_unquoted, tvp_str, tvp_uaddr
get_mempolicy addr, flags, flags_str, maxnode, nmask_uaddr, policy_uaddr
get_robust_list len_uaddr, list_head_uaddr, pid
get_thread_area u_info_str, u_info_uaddr
getcpu cpu_uaddr, node_uaddr, tcache_uaddr
getcwd buf_uaddr, size
getdents count, dirp_uaddr, fd
getegid
geteuid
getgid
getgroups list_uaddr, size
getitimer value_uaddr, which
getpeername name_uaddr, namelen_uaddr, s
getpgid pid
getpgrp
getpid
getppid
getpriority which, who
getrandom buf, buf_unquoted, count, flags, flags_str
getresgid egid_uaddr, rgid_uaddr, sgid_uaddr
getresuid euid_uaddr, ruid_uaddr, suid_uaddr
getrlimit resource, rlim_uaddr
getrusage usage_uaddr, who, who_str
getsid pid
getsockname name_uaddr, namelen_uaddr, s
getsockopt fd, level, level_str, optlen_uaddr, optname, optname_str, optval_uaddr
gettid
gettimeofday tv_uaddr, tz_uaddr
getuid
getxattr name_str, name_str_unquoted, path, path_unquoted, size, value_uaddr
init_module len, uargs, uargs_unquoted, umod_uaddr
inotify_add_watch fd, mask, mask_str, path, path_uaddr, path_unquoted
inotify_init flags
inotify_rm_watch fd, wd
io_cancel ctx_id, iocb_uaddr, result_uaddr
io_destroy ctx
io_getevents ctx_id, events_uaddr, min_nr, nr, timeout_uaddr, timestr
io_setup ctxp_uaddr, maxevents
io_submit ctx_id, iocbpp_uaddr, nr
ioctl argp, fd, request
ioperm from, num, turn_on
iopl level
ioprio_get which, which_str, who
ioprio_set ioprio, ioprio_str, which, which_str, who
kcmp idx1, idx2, pid1, pid2, type, type_str
kexec_file_load cmdline, cmdline_len, cmdline_unquoted, flags, flags_str, initrd_fd, kernel_fd
kexec_load entry, flags, flags_str, nr_segments, segments_uaddr
keyctl arg2, arg3, arg4, arg5, option
kill pid, sig, sig_name
lchown group, owner, path, path_unquoted
lchown16 group, owner, path, path_unquoted
lgetxattr name_str, name_str_unquoted, path, path_unquoted, size, value_uaddr
link newpath, newpath_unquoted, oldpath, oldpath_unquoted
linkat flags, flags_str, newdirfd, newdirfd_str, newpath, newpath_unquoted, olddirfd, olddirfd_str, oldpath, oldpath_unquoted
listen backlog, sockfd
listxattr list_uaddr, path, path_uaddr, path_unquoted, size
llistxattr list_uaddr, path, path_uaddr, path_unquoted, size
llseek fd, offset_high, offset_low, result_uaddr, whence, whence_str
lookup_dcookie $id, $regs, buffer_uaddr, cookie, int, len, pt_regs*
lremovexattr name_str, name_str_unquoted, name_uaddr, path, path_uaddr, path_unquoted
lseek fildes, offset, whence, whence_str
lsetxattr flags, flags_str, name_str, name_str_unquoted, name_uaddr, path, path_uaddr, path_unquoted, size, value_str, value_uaddr
lstat buf_uaddr, path, path_unquoted
madvise advice, advice_str, length, start
mbind flags, flags_str, len, maxnode, mode, mode_str, nmask_uaddr, start
membarrier cmd, cmd_str, flags
memfd_create flags, flags_str, uname, uname_unquoted
migrate_pages maxnode, new_nodes, old_nodes, pid
mincore length, start, vec_uaddr
mkdir mode, pathname, pathname_uaddr, pathname_unquoted
mkdirat dirfd, dirfd_str, mode, pahtname_unquoted, pathname
mknod dev, mode, mode_str, pathname, pathname_unquoted
mknodat dev, dirfd, dirfd_str, mode, mode_str, pathname, pathname_unquoted
mlock addr, len
mlock2 addr, flags, flags_str, len
mlockall flags, flags_str
mmap2 fd, flags, flags_str, length, pgoffset, prot, prot_str, start
modify_ldt bytecount, func, ptr_uaddr
mount data, data_unquoted, filesystemtype, filesystemtype_unquoted, mountflags, mountflags_str, source, source_unquoted, target, target_unquoted
move_pages flags, flags_str, nodes, nr_pages, pages, pid, status
mprotect addr, len, prot, prot_str
mq_getsetattr mqdes, u_mqstat_uaddr, u_omqstat_uaddr
mq_notify mqdes, notification_uaddr
mq_open filename, filename_unquoted, mode, name_uaddr, oflag, oflag_str, u_attr_uaddr
mq_timedreceive abs_timeout_uaddr, mqdes, msg_len, msg_prio_uaddr, msg_ptr_uaddr
mq_timedsend abs_timeout_uaddr, mqdes, msg_len, msg_prio, msg_ptr_uaddr
mq_unlink u_name, u_name_uaddr, u_name_unquoted
mremap flags, flags_str, new_address, new_size, old_address, old_size
msgctl buf_uaddr, cmd, cmd_str, msqid
msgget key, key_str, msgflg, msgflg_str
msgrcv msgflg, msgflg_str, msgp_uaddr, msgsz, msgtyp, msqid
msgsnd msgflg, msgflg_str, msgp_uaddr, msgsz, msqid
msync flags, flags_str, length, start
munlock addr, len
munlockall
munmap length, start
name_to_handle_at dfd, dfd_str, flags, flags_str, handle_uaddr, mnt_id_uaddr, pathname, pathname_unquoted
nanosleep rem_uaddr, req_str, req_uaddr
ni_syscall
nice inc
open filename, filename_unquoted, flags, flags_str, mode
open_by_handle_at flags, flags_str, handle_uaddr, mount_dfd, mount_dfd_str
openat dfd, dfd_str, filename, filename_unquoted, flags, flags_str, mode
pause
perf_event_open attr_uaddr, cpu, flags, flags_str, group_fd, pid
personality persona
pipe fildes_uaddr, flag_str, flags, pipe0, pipe1
pivot_root new_root_str, new_root_str_unquoted, old_root_str, old_root_str_unquoted
pkey_alloc flags, init_val, init_val_str
pkey_free pkey
pkey_mprotect addr, len, pkey, prot, prot_str
poll nfds, timeout, ufds_uaddr
ppoll fds_uaddr, nfds, sigmask, sigsetsize, tsp, tsp_str
prctl arg2, arg3, arg4, arg5, option
pread buf_uaddr, count, fd, offset
preadv count, fd, offset, vector_uaddr
preadv2 count, fd, flags, flags_str, offset, vector_uaddr
prlimit64 new_rlim_str, new_rlim_uaddr, old_rlim_uaddr, pid, resource, resource_str
process_vm_readv flags, liovcnt, local_iov_uaddr, pid, remote_iov_uaddr, riovcnt
process_vm_writev flags, liovcnt, local_iov_uaddr, pid, remote_iov_uaddr, riovcnt
pselect6 exceptfds, nfds, readfds, sigmask, timeout, timeout_str, writefds
ptrace addr, data, pid, request
pwrite buf_str, buf_uaddr, count, fd, offset
pwrite32 $id, $regs, buf_str, buf_uaddr, count, fd, int, offset, pt_regs*
pwritev count, fd, offset, vector_uaddr
pwritev2 count, fd, flags, flags_str, offset, vector_uaddr
quotactl addr_uaddr, cmd, cmd_str, id, special, special_str, special_str_unquoted
read buf_uaddr, count, fd
readahead count, fd, offset
readdir count, dirent, fd
readlink buf_uaddr, bufsiz, path, path_unquoted
readlinkat buf_uaddr, bufsiz, dfd, dfd_str, path, path_unquoted
readv count, fd, vector_uaddr
reboot arg_uaddr, flag, flag_str, magic2, magic2_str, magic, magic_str
recv buf_uaddr, flags, flags_str, len, s
recvfrom addr_uaddr, addrlen_uaddr, buf_uaddr, flags, flags_str, len, s
recvmmsg flags, flags_str, mmsg_uaddr, s, timeout_str, timeout_uaddr, vlen
recvmsg flags, flags_str, msg_uaddr, s
remap_file_pages flags, flags_str, pgoff, prot, prot_str, size, start
removexattr name_str, name_str_unquoted, path, path_unquoted
rename newpath, newpath_unquoted, oldpath, oldpath_unquoted
renameat newdfd, newdfd_str, newname, newname_str, newname_str_unquoted, olddfd, olddfd_str, oldname, oldname_str, oldname_str_unquoted
renameat2 flags, flags_str, newdfd, newdfd_str, newname, newname_str, newname_str_unquoted, olddfd, olddfd_str, oldname, oldname_str, oldname_str_unquoted
request_key callout_info_uaddr, description_str, description_str_unquoted, description_uaddr, destringid, type_str, type_str_unquoted, type_uaddr
restart_syscall
rmdir pathname, pathname_unquoted
rt_sigaction act_str, act_uaddr, oact_uaddr, sig, sig_str, sigsetsize
rt_sigaction32 act_str, act_uaddr, oact_uaddr, sig, sig_str, sigsetsize
rt_sigpending set_uaddr, sigsetsize
rt_sigprocmask how, how_str, oldset_uaddr, set_str, set_uaddr, sigsetsize
rt_sigqueueinfo pid, sig, sig_name, siginfo_str, uinfo_uaddr
rt_sigsuspend set_str, set_uaddr, sigsetsize
rt_sigtimedwait sigsetsize, uinfo_str, uinfo_uaddr, uthese_str, uthese_uaddr, uts_str, uts_uaddr
rt_tgsigqueueinfo sig, sig_str, tgid, tid, uinfo_str, uinfo_uaddr
sched_get_priority_max policy, policy_str
sched_get_priority_min policy, policy_str
sched_getaffinity len, mask_uaddr, pid
sched_getattr flags, pid, sched_attr_str, sched_attr_uaddr, size
sched_getparam p_uaddr, pid
sched_getscheduler pid
sched_rr_get_interval pid, tp_uaddr
sched_setaffinity len, mask_uaddr, pid
sched_setattr flags, pid, sched_attr_str, sched_attr_uaddr
sched_setparam p_uaddr, pid
sched_setscheduler p_uaddr, pid, policy, policy_str
sched_yield
seccomp flags, flags_str, op, op_str, uargs_uaddr
select exceptfds_uaddr, n, readfds_uaddr, timeout_str, timeout_uaddr, writefds_uaddr
semctl arg, cmd, cmdstr, semid, semnum
semget key, key_str, nsems, semflg, semflg_str
semop nsops, semid, sops_uaddr
semtimedop nsops, semid, sops_uaddr, timeout_str, timeout_uaddr
send buf, buf_uaddr, flags, flags_str, len, s
sendfile count, in_fd, offset_uaddr, out_fd
sendmmsg flags, flags_str, mmsg_uaddr, s, vlen
sendmsg flags, flags_str, msg_uaddr, s
sendto buf, buf_uaddr, flags, flags_str, len, s, to_str, to_uaddr, tolen
set_mempolicy maxnode, mode, mode_str, nmask_uaddr
set_robust_list len, list_head_uaddr
set_thread_area u_info_str, u_info_uaddr
set_tid_address tidptr_uaddr
setdomainname domainname_str, domainname_str_unquoted, domainname_uaddr, len
setfsgid fsgid
setfsuid fsuid
setgid gid
setgroups list_uaddr, size
sethostname hostname_uaddr, len, name_str, name_str_unquoted
setitimer ovalue_uaddr, value_str, value_uaddr, which, which_str
setns fd, nstype, nstype_str
setpgid pgid, pid
setpriority prio, which, which_str, who
setregid egid, rgid
setregid16 egid, rgid
setresgid egid, rgid, sgid
setresgid16 egid, rgid, sgid
setresuid euid, ruid, suid
setresuid16 euid, ruid, suid
setreuid euid, ruid
setreuid16 euid, ruid
setrlimit resource, resource_str, rlim_str, rlim_uaddr
setsid
setsockopt fd, level, level_str, optlen, optname, optname_str, optval_uaddr
settimeofday tv_str, tv_uaddr, tz_str, tz_uaddr
settimeofday32 tv_str, tv_uaddr, tz_str, tz_uaddr
setuid uid
setxattr flags, flags_str, name_str, name_str_unquoted, name_uaddr, path, path_uaddr, path_unquoted, size, value_str, value_uaddr
sgetmask
shmat shmaddr_uaddr, shmflg, shmflg_str, shmid
shmctl buf_uaddr, cmd, cmd_str, shmid
shmdt shmaddr_uaddr
shmget key, shmflg, shmflg_str, size
shutdown how, how_str, s
sigaction $id, $regs, act_str, act_uaddr, int, oact_uaddr, pt_regs*, sig, sig_str
sigaction32 act_str, act_uaddr, oact_uaddr, sig, sig_str
sigaltstack uoss_uaddr, uss_str, uss_uaddr
signal handler, handler_str, sig, sig_str
signalfd flags
sigpending set
sigprocmask how, how_str, oldset_uaddr, set_uaddr
sigsuspend mask, mask_str
socket family, family_str, protocol, protocol_str, type, type_str
socketpair family, family_str, protocol, protocol_str, sv_uaddr, type, type_str
splice fd_in, fd_out, flags, flags_str, len, off_in, off_out
ssetmask newmask, newmask_str
stat buf_uaddr, filename, filename_uaddr, filename_unquoted
statfs buf_uaddr, path, path_unquoted
statfs64 buf_uaddr, path, path_unquoted, sz
statx buf_uaddr, dfd, dfd_str, filename, filename_uaddr, filename_unquoted, flags, flags_str, mask, mask_str
stime t_uaddr
swapoff path, path_uaddr, path_unquoted
swapon path, path_uaddr, path_unquoted, swapflags, swapflags_str
symlink newpath, oldpath, oldpath_unquoted
symlinkat newdfd, newdfd_str, newname, newname_str, newname_str_unquoted, oldname, oldname_str, oldname_str_unquoted
sync
sync_file_range fd, flags, flags_str, nbytes, offset
syncfs fd
sysctl $id, $regs, args, int, pt_regs*
sysfs arg1, arg2, option
sysinfo info_str, info_uaddr
syslog bufp_uaddr, len, type
tee fdin, fdout, flags, len
tgkill pid, sig, sig_str, tgid
time t_uaddr
timer_create clockid, clockid_str, evp_uaddr, timerid_uaddr
timer_delete timerid
timer_getoverrun timerid
timer_gettime timerid, value_uaddr
timer_settime flags, ovalue_uaddr, timerid, value_str, value_uaddr
timerfd_create clockid, clockid_str, flags, flags_str
timerfd_gettime fd, value_uaddr
timerfd_settime fd, flags, flags_str, ovalue_uaddr, value_str, value_uaddr
times buf_str, buf_uaddr
tkill pid, sig, sig_str
truncate length, path, path_uaddr, path_unquoted
umask mask
umount flags, flags_str, target, target_unquoted
uname name_uaddr
unlink pathname, pathname_uaddr, pathname_unquoted
unlinkat dfd, dfd_str, flag, flag_str, pathname, pathname_str, pathname_str_unquoted
unshare unshare_flags, unshare_flags_str
uselib $id, $regs, int, library, library_uaddr, library_unquoted, pt_regs*
userfaultfd flags, flags_str
ustat dev, ubuf_uaddr
ustat32 dev, ubuf_uaddr
utime actime, buf_uaddr, filename, filename_uaddr, filename_unquoted, modtime
utimensat dfd, dfd_str, filename, filename_uaddr, filename_unquoted, flags, flags_str, tsp_str, tsp_uaddr
utimes filename, filename_uaddr, filename_unquoted, tvp_uaddr, tvp_uaddr_str
vfork
vhangup
vmsplice fd, flags, flags_str, iov, nr_segs
wait4 options, options_str, pid, rusage_uaddr, status_uaddr
waitid infop_uaddr, options, options_str, pid, rusage_uaddr, which, which_str
waitpid options, options_str, pid, status_uaddr
write buf_str, buf_uaddr, count, fd
writev count, fd, vector_uaddr