FM / bpf

/usr/share/systemtap/tapset/bpf

Name	Size	Mode	Actions
aux_syscalls.stp	909	0644	edit dl rm
compatdefs.stp	203	0644	edit dl rm
context.stp	6039	0644	edit dl rm
conversions.stp	4727	0644	edit dl rm
exit.stp	2583	0644	edit dl rm
logging.stp	1463	0644	edit dl rm
syscalls.stpm	213	0644	edit dl rm
syscall_any.stp	1569	0644	edit dl rm
syscall_num_arm.stp	38588	0644	edit dl rm
syscall_num_arm64.stp	86596	0644	edit dl rm
syscall_num_mips.stp	110534	0644	edit dl rm
syscall_num_powerpc.stp	71086	0644	edit dl rm
syscall_num_riscv.stp	48422	0644	edit dl rm
syscall_num_s390.stp	68068	0644	edit dl rm
syscall_num_x86_64.stp	65658	0644	edit dl rm
syscall_table.stp	1491	0644	edit dl rm
target.stp	1403	0644	edit dl rm
task.stp	583	0644	edit dl rm
time.stp	539	0644	edit dl rm
timestamp_gtod.stp	2178	0644	edit dl rm
uconversions.stp	8014	0644	edit dl rm

Edit: /usr/share/systemtap/tapset/bpf/syscall_table.stp (1491B)

function syscall_name(num) {
  //%( CONFIG_COMPAT == "y" %?
  //    if (@__compat_task)
  //        return __syscall_32_num2name[num]
  //%)
%( CONFIG_64BIT == "y" %?
    return __syscall_64_num2name[num]
%:
    return __syscall_32_num2name[num]
%)
}

# Systemtap is benevolent when an associative array is being queried for an
# unexisting key.  If we call e.g. __syscall_64_name2num["unexisting_syscall"],
# the result is zero.  But at the same time zero is a valid syscall number, so
# we really need to return some other value in this case to indicate that
# syscall with given name doesn't exist.  Let's use following
# @return_sanitized macro.
#
# The other way round, when evaluating e.g. __syscall_64_num2name[-123], stap
# is benevolent too - we'll get an empty string.  But that is sufficiently
# unique, so we are good at this front.

@define return_sanitized(indexable, key)
%(
    if (@key in @indexable)
        return @indexable[@key]
    else
        return -1
%)

function syscall_num(name) {
%( CONFIG_COMPAT == "y" %?
    if (@__compat_task)
        @return_sanitized(__syscall_32_name2num, name)
%)
%( CONFIG_64BIT == "y" %?
    @return_sanitized(__syscall_64_name2num, name)
%:
    @return_sanitized(__syscall_32_name2num, name)
%)
}

# This is syscall_table tapset providing namely syscall_name() and syscall_num() # functions. It uses architecture specific data contained in other arch # specific tapsets. Helper scripts/dump-syscalls.sh is used to generate those. function syscall_name(num) { //%( CONFIG_COMPAT == "y" %? // if (@__compat_task) // return __syscall_32_num2name[num] //%) %( CONFIG_64BIT == "y" %? return __syscall_64_num2name[num] %: return __syscall_32_num2name[num] %) } # Systemtap is benevolent when an associative array is being queried for an # unexisting key. If we call e.g. __syscall_64_name2num["unexisting_syscall"], # the result is zero. But at the same time zero is a valid syscall number, so # we really need to return some other value in this case to indicate that # syscall with given name doesn't exist. Let's use following # @return_sanitized macro. # # The other way round, when evaluating e.g. __syscall_64_num2name[-123], stap # is benevolent too - we'll get an empty string. But that is sufficiently # unique, so we are good at this front. @define return_sanitized(indexable, key) %( if (@key in @indexable) return @indexable[@key] else return -1 %) function syscall_num(name) { %( CONFIG_COMPAT == "y" %? if (@__compat_task) @return_sanitized(__syscall_32_name2num, name) %) %( CONFIG_64BIT == "y" %? @return_sanitized(__syscall_64_name2num, name) %: @return_sanitized(__syscall_32_name2num, name) %) }