syscall tapset status

syscall tapset status

[Martin Hunt]

I am on vacation the next 3 weeks, starting today.  I will answer email
for the next few days, then I will only be reachable by cell phone.

The syscall tapset is complete for i386, but still needs better testing.
It is still incomplete for other architectures. While the kernel API is
mostly the same in theory, in reality, you end up with a lot of small
differences creating large headaches. I've been doing a lot of aliases
like this:

probe syscall.stat = 
		kernel.function("sys_stat") ?, 
		kernel.function("sys_newstat") ?,
		kernel.function("sys32_stat64") ?,
		kernel.function("sys_stat64") ?,
		kernel.function("compat_sys_newstat") ?
{
	name = "stat"
	filename_uaddr = $filename
	filename = user_string($filename)
	buf_uaddr = $statbuf
	argstr = sprintf("%s, %p", user_string_quoted($filename), buf_uaddr)
}

That works fine for cases like above, but when the related functions
pass in userspace pointers to different sized structs that need decoded,
then I create a separate alias for each.

Last week I started testing on x86_64 and got the existing syscall tests
running under 32 and 64-bit mode.  Next I plan to generate a complete
list of compat_sys_*, and sys32_* calls and implement any that are not
yet supported.

Martin