kernel/trace/trace_syscalls.c
Source file repositories/reference/linux-study-clean/kernel/trace/trace_syscalls.c
File Facts
- System
- Linux kernel
- Corpus path
kernel/trace/trace_syscalls.c- Extension
.c- Size
- 41398 bytes
- Lines
- 1684
- Domain
- Core OS
- Bucket
- Scheduler, Processes, Timers, Sync, And Syscalls
- Inferred role
- Core OS: syscall or user/kernel boundary
- Status
- core implementation candidate
Why This File Exists
Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.
- Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.
- Defines or participates in a user/kernel boundary; inspect argument validation, copy_from_user/copy_to_user, credentials, and dispatch target.
- Touches user memory; correctness depends on fault-safe copying and privilege boundary handling.
- Uses kernel synchronization; read lock ordering, sleepability, and interrupt context assumptions before translating.
- Allocates kernel memory; connect allocation flags and lifetime to context constraints.
- Defines or uses C structs; map object ownership, embedded links, reference counts, and lock ownership.
Dependency Surface
trace/syscall.htrace/events/syscalls.hlinux/kernel_stat.hlinux/syscalls.hlinux/slab.hlinux/kernel.hlinux/module.hlinux/ftrace.hlinux/perf_event.hlinux/xarray.hasm/syscall.htrace_output.htrace.h
Detected Declarations
struct syscall_user_bufferstruct syscall_argsstruct syscall_tp_tstruct syscall_tp_tfunction syscall_get_enter_fieldsfunction arch_syscall_match_sym_namefunction arch_trace_is_compat_syscallfunction trace_get_syscall_nrfunction find_syscall_metafunction get_dynamic_len_ptrfunction sys_enter_openat_printfunction print_syscall_enterfunction print_syscall_exitfunction sys_enter_openat_print_fmtfunction __set_enter_print_fmtfunction set_syscall_print_fmtfunction free_syscall_print_fmtfunction syscall_enter_define_fieldsfunction syscall_fault_buffer_enablefunction rcu_free_syscall_bufferfunction syscall_fault_buffer_disablefunction syscall_copy_userfunction syscall_copy_user_arrayfunction syscall_get_datafunction syscall_put_datafunction ftrace_syscall_enterfunction ftrace_syscall_exitfunction reg_event_syscall_enterfunction unreg_event_syscall_enterfunction reg_event_syscall_exitfunction unreg_event_syscall_exitfunction check_faultable_syscallfunction init_syscall_tracefunction arch_syscall_addrfunction init_ftrace_syscallsfunction perf_call_bpf_enterfunction perf_syscall_enterfunction perf_sysenter_enablefunction perf_sysenter_disablefunction perf_call_bpf_exitfunction perf_syscall_exitfunction perf_sysexit_enablefunction perf_sysexit_disablefunction syscall_enter_registerfunction syscall_exit_register
Annotated Snippet
struct syscall_user_buffer {
struct trace_user_buf_info buf;
struct rcu_head rcu;
};
static struct syscall_user_buffer *syscall_buffer;
static int syscall_fault_buffer_enable(void)
{
struct syscall_user_buffer *sbuf;
int ret;
lockdep_assert_held(&syscall_trace_lock);
if (syscall_buffer) {
trace_user_fault_get(&syscall_buffer->buf);
return 0;
}
sbuf = kmalloc_obj(*sbuf);
if (!sbuf)
return -ENOMEM;
ret = trace_user_fault_init(&sbuf->buf, SYSCALL_FAULT_BUF_SZ);
if (ret < 0) {
kfree(sbuf);
return ret;
}
WRITE_ONCE(syscall_buffer, sbuf);
return 0;
}
static void rcu_free_syscall_buffer(struct rcu_head *rcu)
{
struct syscall_user_buffer *sbuf =
container_of(rcu, struct syscall_user_buffer, rcu);
trace_user_fault_destroy(&sbuf->buf);
kfree(sbuf);
}
static void syscall_fault_buffer_disable(void)
{
struct syscall_user_buffer *sbuf = syscall_buffer;
lockdep_assert_held(&syscall_trace_lock);
if (trace_user_fault_put(&sbuf->buf))
return;
WRITE_ONCE(syscall_buffer, NULL);
call_rcu_tasks_trace(&sbuf->rcu, rcu_free_syscall_buffer);
}
struct syscall_args {
char *ptr_array[SYSCALL_FAULT_MAX_CNT];
int read[SYSCALL_FAULT_MAX_CNT];
int uargs;
};
static int syscall_copy_user(char *buf, const char __user *ptr,
size_t size, void *data)
{
struct syscall_args *args = data;
int ret;
for (int i = 0; i < args->uargs; i++, buf += SYSCALL_FAULT_ARG_SZ) {
ptr = (char __user *)args->ptr_array[i];
ret = strncpy_from_user(buf, ptr, size);
args->read[i] = ret;
}
return 0;
}
static int syscall_copy_user_array(char *buf, const char __user *ptr,
size_t size, void *data)
{
struct syscall_args *args = data;
int ret;
for (int i = 0; i < args->uargs; i++, buf += SYSCALL_FAULT_ARG_SZ) {
ptr = (char __user *)args->ptr_array[i];
ret = __copy_from_user(buf, ptr, size);
args->read[i] = ret ? -1 : size;
}
return 0;
}
Annotation
- Immediate include surface: `trace/syscall.h`, `trace/events/syscalls.h`, `linux/kernel_stat.h`, `linux/syscalls.h`, `linux/slab.h`, `linux/kernel.h`, `linux/module.h`, `linux/ftrace.h`.
- Detected declarations: `struct syscall_user_buffer`, `struct syscall_args`, `struct syscall_tp_t`, `struct syscall_tp_t`, `function syscall_get_enter_fields`, `function arch_syscall_match_sym_name`, `function arch_trace_is_compat_syscall`, `function trace_get_syscall_nr`, `function find_syscall_meta`, `function get_dynamic_len_ptr`.
- Atlas domain: Core OS / Scheduler, Processes, Timers, Sync, And Syscalls.
- Implementation status: core implementation candidate.
- This snippet crosses the user/kernel memory boundary; validate fault handling and access checks before translating the pattern.
- Synchronization appears in or near this file; preserve lock ordering, sleepability, and interrupt-context constraints.
Implementation Notes
- This generated page is the file-by-file coverage layer; curated subsystem chapters should link here when they synthesize a multi-file control flow.
- Core OS pages should be promoted from atlas-only to deep-reviewed when they explain data structures, invariants, locking, lifecycle, and C implementation snippets.
- Driver-family pages are intentionally pattern-oriented unless they are part of the selected PCIe/NVMe representative device path.