2 * This file is part of the Palacios Virtual Machine Monitor developed
3 * by the V3VEE Project with funding from the United States National
4 * Science Foundation and the Department of Energy.
6 * The V3VEE Project is a joint project between Northwestern University
7 * and the University of New Mexico. You can find out more at
10 * Copyright (c) 2011, Kyle C. Hale <kh@u.norhtwestern.edu>
11 * Copyright (c) 2011, The V3VEE Project <http://www.v3vee.org>
12 * All rights reserved.
14 * Author: Kyle C. Hale <kh@u.northwestern.edu>
16 * This is free software. You are permitted to use,
17 * redistribute, and modify it as specified in the file "V3VEE_LICENSE".
20 #include <palacios/vmm.h>
21 #include <palacios/vm_guest_mem.h>
22 #include <palacios/vm_guest.h>
23 #include <palacios/vmm_intr.h>
24 #include <palacios/vmm_decoder.h>
25 #include <palacios/vmm_string.h>
26 #include <palacios/vmm_shadow_paging.h>
27 #include <palacios/vmm_extensions.h>
28 #include <palacios/vmm_paging.h>
29 #include <palacios/vmcb.h>
30 #include <palacios/vmm_hypercall.h>
33 #include <gears/syscall_hijack.h>
34 #include <gears/sw_intr.h>
35 #include <gears/syscall_ref.h>
37 #ifdef V3_CONFIG_EXT_CODE_INJECT
38 #include <gears/code_inject.h>
39 #include <palacios/vmm_list.h>
40 extern struct v3_code_injects code_injects;
43 #ifndef V3_CONFIG_DEBUG_EXT_SYSCALL_HIJACK
45 #define PrintDebug(fmt, args...)
49 struct v3_syscall_hook {
50 int (*handler)(struct guest_info * core, uint_t syscall_nr, void * priv_data);
54 static struct v3_syscall_hook * syscall_hooks[512];
56 #if defined(V3_CONFIG_EXT_SELECTIVE_SYSCALL_EXIT) || defined(V3_CONFIG_EXT_SYSCALL_INSTR)
57 static struct v3_syscall_info syscall_info;
60 static void print_arg (struct guest_info * core, v3_reg_t reg, uint8_t argnum) {
65 PrintDebug("\t ARG%d: INT - %ld\n", argnum, (long) reg);
67 if (core->mem_mode == PHYSICAL_MEM) {
68 ret = v3_gpa_to_hva(core, get_addr_linear(core, reg, &(core->segments.ds)), &hva);
71 ret = v3_gva_to_hva(core, get_addr_linear(core, reg, &(core->segments.ds)), &hva);
74 PrintDebug("\t STR - ");
80 uint32_t c = max(MAX_CHARS, 4096 - (hva % 4096));
82 for (; i < c && *((char*)(hva + i)) != 0; i++) {
83 PrintDebug("%c", *((char*)(hva + i)));
89 static void print_syscall (uint8_t is64, struct guest_info * core) {
92 PrintDebug("Syscall #%ld: \"%s\"\n", (long)core->vm_regs.rax, get_linux_syscall_name64(core->vm_regs.rax));
94 PrintDebug("Syscall #%ld: \"%s\"\n", (long)core->vm_regs.rax, get_linux_syscall_name32(core->vm_regs.rax));
97 print_arg(core, core->vm_regs.rbx, 1);
98 print_arg(core, core->vm_regs.rcx, 2);
99 print_arg(core, core->vm_regs.rdx, 3);
103 int v3_syscall_handler (struct guest_info * core, uint8_t vector, void * priv_data) {
105 uint_t syscall_nr = (uint_t) core->vm_regs.rax;
106 int err = 0, ret = 0;
108 struct v3_syscall_hook * hook = syscall_hooks[syscall_nr];
110 #ifdef V3_CONFIG_EXT_SYSCALL_INSTR
111 // address originally written to LSTAR
113 core->rip = syscall_info.target_addr;
117 #ifdef V3_CONFIG_EXT_SYSCALL_PASSTHROUGH
118 if (v3_hook_passthrough_syscall(core, syscall_nr) == -1) {
119 PrintDebug("Error hooking passthrough syscall\n");
122 hook = syscall_hooks[syscall_nr];
126 * if this syscall isn't hooked, pop off a pending inject
129 #ifdef V3_CONFIG_EXT_CODE_INJECT
130 struct v3_code_injects * injects = &code_injects;
131 struct v3_code_inject_info * inject = NULL;
133 if (list_empty(&(injects->code_inject_list))) {
137 inject = (struct v3_code_inject_info*) list_first_entry(
138 &(injects->code_inject_list),
139 struct v3_code_inject_info,
142 if (inject == NULL) {
143 PrintError("Problem getting inject from inject list\n");
147 if (inject->in_progress)
150 // do the inject and don't fall over if there's an inject already in
152 if ((ret = v3_handle_guest_inject(core, (void*)inject)) == -1) {
153 PrintError("Could not run code injection: v3_syscall_handler\n");
164 err = hook->handler(core, syscall_nr, hook->priv_data);
166 PrintDebug("V3 Syscall Handler: Error in syscall hook\n");
170 #ifdef V3_CONFIG_EXT_CODE_INJECT
171 if (err == E_NEED_PF)
178 #ifdef V3_CONFIG_EXT_SELECTIVE_SYSCALL_EXIT
179 static int v3_handle_lstar_write (struct guest_info * core, uint_t msr, struct v3_msr src, void * priv_data) {
180 syscall_info.target_addr = (uint64_t) ((((uint64_t)src.hi) << 32) | src.lo);
182 PrintDebug("LSTAR Write: %p\n", (void*)syscall_info.target_addr);
183 core->msrs.lstar = syscall_info.target_addr;
188 // virtualize the lstar
189 static int v3_handle_lstar_read (struct guest_info * core, uint_t msr, struct v3_msr * dst, void * priv_data) {
190 PrintDebug("LSTAR Read\n");
191 dst->value = syscall_info.target_addr;
196 static int syscall_setup (struct guest_info * core, unsigned int hcall_id, void * priv_data) {
197 addr_t syscall_stub, syscall_map_gva, syscall_map_hva, ssa_gva, ssa_hva;
199 syscall_stub = (addr_t)core->vm_regs.rbx;
200 syscall_map_gva = (addr_t)core->vm_regs.rcx;
201 ssa_gva = (addr_t)core->vm_regs.rdx;
203 PrintDebug("syscall setup hypercall:\n");
204 PrintDebug("\t&syscall_stub (rbx): %p\n\t&syscall_map (rcx): %p\n", (void*)syscall_stub, (void*)syscall_map_gva);
205 PrintDebug("\t&ssa (rdx): %p\n", (void*)ssa_gva);
207 // the guest vitual address of the asm syscall handling routine
208 syscall_info.syscall_stub = syscall_stub;
211 // now get the hva of the system call map so we can manipulate it in the VMM
212 if (v3_gva_to_hva(core, get_addr_linear(core, syscall_map_gva, &(core->segments.ds)), &syscall_map_hva) == 1) {
213 PrintError("Problem translating gva to hva for syscall map\n");
217 if (v3_gva_to_hva(core, get_addr_linear(core, ssa_gva, &(core->segments.ds)), &ssa_hva) == 1) {
218 PrintError("Problem translating gva to hva for syscall map\n");
222 PrintDebug("\t&syscall_map (hva): %p\n", (void*) syscall_map_hva);
223 PrintDebug("\t&ssa (hva): %p\n", (void*) ssa_hva);
225 syscall_info.syscall_map = (uint8_t*)syscall_map_hva;
226 syscall_info.ssa = ssa_hva;
228 /* return the original syscall entry point */
229 core->vm_regs.rax = syscall_info.target_addr;
231 /* redirect syscalls henceforth */
232 core->msrs.lstar = syscall_stub;
237 static int syscall_cleanup (struct guest_info * core, unsigned int hcall_id, void * priv_data) {
239 core->msrs.lstar = syscall_info.target_addr;
240 PrintDebug("original syscall entry point restored\n");
245 static int sel_syscall_handle (struct guest_info * core, unsigned int hcall_id, void * priv_data) {
248 PrintDebug("caught a selectively exited syscall\n");
250 /* setup registers for handler routines. They should be in the same state
251 * as when the system call was originally invoked */
252 memcpy((void*)®s, (void*)&core->vm_regs, sizeof(struct v3_gprs));
253 memcpy((void*)&core->vm_regs, (void*)syscall_info.ssa, sizeof(struct v3_gprs));
255 //v3_print_guest_state(core);
256 v3_syscall_handler(core, 0, NULL);
258 memcpy((void*)syscall_info.ssa, (void*)&core->vm_regs, sizeof(struct v3_gprs));
259 memcpy((void*)&core->vm_regs, (void*)®s,sizeof(struct v3_gprs));
264 // TODO: make these three functions guest-dependent
265 int v3_syscall_on (void * ginfo, uint8_t syscall_nr) {
266 PrintDebug("Enabling exiting for syscall #%d\n", syscall_nr);
267 syscall_info.syscall_map[syscall_nr] = 1;
272 int v3_syscall_off (void * ginfo, uint8_t syscall_nr) {
273 PrintDebug("Disabling exiting for syscall #%d\n", syscall_nr);
274 syscall_info.syscall_map[syscall_nr] = 0;
279 int v3_syscall_stat (void * ginfo, uint8_t syscall_nr) {
280 return syscall_info.syscall_map[syscall_nr];
285 static int init_syscall_hijack (struct v3_vm_info * vm, v3_cfg_tree_t * cfg, void ** priv_data) {
287 #ifdef V3_CONFIG_EXT_SELECTIVE_SYSCALL_EXIT
288 v3_register_hypercall(vm, SYSCALL_HANDLE_HCALL, sel_syscall_handle, NULL);
289 v3_register_hypercall(vm, SYSCALL_SETUP_HCALL, syscall_setup, NULL);
290 v3_register_hypercall(vm, SYSCALL_CLEANUP_HCALL, syscall_cleanup, NULL);
298 #ifdef V3_CONFIG_EXT_SYSCALL_INSTR
299 static int v3_handle_lstar_write (struct guest_info * core, uint_t msr, struct v3_msr src, void * priv_data) {
300 PrintDebug("KCH: LSTAR Write\n");
301 //PrintDebug("\tvalue: 0x%x%x\n", src.hi, src.lo);
302 syscall_info.target_addr = (uint64_t) ((((uint64_t)src.hi) << 32) | src.lo);
304 // Set LSTAR value seen by hardware while the guest is running
305 PrintDebug("replacing with %lx\n", SYSCALL_MAGIC_ADDR);
306 core->msrs.lstar = SYSCALL_MAGIC_ADDR;
310 static int v3_handle_lstar_read (struct guest_info * core, uint_t msr, struct v3_msr * dst, void * priv_data) {
311 PrintDebug("KCH: LSTAR Read\n");
312 dst->value = syscall_info.target_addr;
318 static int init_syscall_hijack_core (struct guest_info * core, void * priv_data) {
320 #ifdef V3_CONFIG_EXT_SW_INTERRUPTS
321 v3_hook_swintr(core, SYSCALL_INT_VECTOR, v3_syscall_handler, NULL);
324 #if defined(V3_CONFIG_EXT_SYSCALL_INSTR) || defined(V3_CONFIG_EXT_SELECTIVE_SYSCALL_EXIT)
325 v3_hook_msr(core->vm_info, LSTAR_MSR,
326 &v3_handle_lstar_read,
327 &v3_handle_lstar_write,
334 static int deinit_syscall_hijack (struct v3_vm_info * vm, void * priv_data) {
339 static struct v3_extension_impl syscall_impl = {
340 .name = "syscall_intercept",
341 .init = init_syscall_hijack,
342 .deinit = deinit_syscall_hijack,
343 .core_init = init_syscall_hijack_core,
349 register_extension(&syscall_impl);
352 static inline struct v3_syscall_hook * get_syscall_hook (struct guest_info * core, uint_t syscall_nr) {
353 return syscall_hooks[syscall_nr];
357 int v3_hook_syscall (struct guest_info * core,
359 int (*handler)(struct guest_info * core, uint_t syscall_nr, void * priv_data),
362 struct v3_syscall_hook * hook = (struct v3_syscall_hook *)V3_Malloc(sizeof(struct v3_syscall_hook));
369 if (get_syscall_hook(core, syscall_nr) != NULL) {
370 PrintError("System Call #%d already hooked\n", syscall_nr);
374 hook->handler = handler;
375 hook->priv_data = priv_data;
377 syscall_hooks[syscall_nr] = hook;
379 PrintDebug("Hooked Syscall #%d\n", syscall_nr);
385 static int passthrough_syscall_handler (struct guest_info * core, uint_t syscall_nr, void * priv_data) {
386 print_syscall(core->cpu_mode == LONG, core);
391 int v3_hook_passthrough_syscall (struct guest_info * core, uint_t syscall_nr) {
393 int rc = v3_hook_syscall(core, syscall_nr, passthrough_syscall_handler, NULL);
396 PrintError("failed to hook syscall 0x%x for passthrough (guest=0x%p)\n", syscall_nr, (void *)core);
399 PrintDebug("hooked syscall 0x%x for passthrough (guest=0x%p)\n", syscall_nr, (void *)core);
403 /* shouldn't get here */
409 char * get_linux_syscall_name32 (uint_t syscall_nr) {
411 switch (syscall_nr) {
413 case 0: return "restart_syscall"; break;
414 case 1: return "exit"; break;
415 case 2: return "fork"; break;
416 case 3: return "read"; break;
417 case 4: return "write"; break;
418 case 5: return "open"; break;
419 case 6: return "close"; break;
420 case 7: return "waitpid"; break;
421 case 8: return "creat"; break;
422 case 9: return "link"; break;
423 case 10: return "unlink"; break;
424 case 11: return "execve"; break;
425 case 12: return "chdir"; break;
426 case 13: return "time"; break;
427 case 14: return "mknod"; break;
428 case 15: return "chmod"; break;
429 case 16: return "lchown"; break;
430 case 17: return "break"; break;
431 case 18: return "oldstat"; break;
432 case 19: return "lseek"; break;
433 case 20: return "getpid"; break;
434 case 21: return "mount"; break;
435 case 22: return "umount"; break;
436 case 23: return "setuid"; break;
437 case 24: return "getuid"; break;
438 case 25: return "stime"; break;
439 case 26: return "ptrace"; break;
440 case 27: return "alarm"; break;
441 case 28: return "oldfstat"; break;
442 case 29: return "pause"; break;
443 case 30: return "utime"; break;
444 case 31: return "stty"; break;
445 case 32: return "gtty"; break;
446 case 33: return "access"; break;
447 case 34: return "nice"; break;
448 case 35: return "ftime"; break;
449 case 36: return "sync"; break;
450 case 37: return "kill"; break;
451 case 38: return "rename"; break;
452 case 39: return "mkdir"; break;
453 case 40: return "rmdir"; break;
454 case 41: return "dup"; break;
455 case 42: return "pipe"; break;
456 case 43: return "times"; break;
457 case 44: return "prof"; break;
458 case 45: return "brk"; break;
459 case 46: return "setgid"; break;
460 case 47: return "getgid"; break;
461 case 48: return "signal"; break;
462 case 49: return "geteuid"; break;
463 case 50: return "getegid"; break;
464 case 51: return "acct"; break;
465 case 52: return "umount2"; break;
466 case 53: return "lock"; break;
467 case 54: return "ioctl"; break;
468 case 55: return "fcntl"; break;
469 case 56: return "mpx"; break;
470 case 57: return "setpgid"; break;
471 case 58: return "ulimit"; break;
472 case 59: return "oldolduname"; break;
473 case 60: return "umask"; break;
474 case 61: return "chroot"; break;
475 case 62: return "ustat"; break;
476 case 63: return "dup2"; break;
477 case 64: return "getppid"; break;
478 case 65: return "getpgrp"; break;
479 case 66: return "setsid"; break;
480 case 67: return "sigaction"; break;
481 case 68: return "sgetmask"; break;
482 case 69: return "ssetmask"; break;
483 case 70: return "setreuid"; break;
484 case 71: return "setregid"; break;
485 case 72: return "sigsuspend"; break;
486 case 73: return "sigpending"; break;
487 case 74: return "sethostname"; break;
488 case 75: return "setrlimit"; break;
489 case 76: return "getrlimit"; break;
490 case 77: return "getrusage"; break;
491 case 78: return "gettimeofday"; break;
492 case 79: return "settimeofday"; break;
493 case 80: return "getgroups"; break;
494 case 81: return "setgroups"; break;
495 case 82: return "select"; break;
496 case 83: return "symlink"; break;
497 case 84: return "oldlstat"; break;
498 case 85: return "readlink"; break;
499 case 86: return "uselib"; break;
500 case 87: return "swapon"; break;
501 case 88: return "reboot"; break;
502 case 89: return "readdir"; break;
503 case 90: return "mmap"; break;
504 case 91: return "munmap"; break;
505 case 92: return "truncate"; break;
506 case 93: return "ftruncate"; break;
507 case 94: return "fchmod"; break;
508 case 95: return "fchown"; break;
509 case 96: return "getpriority"; break;
510 case 97: return "setpriority"; break;
511 case 98: return "profil"; break;
512 case 99: return "statfs"; break;
513 case 100: return "fstatfs"; break;
514 case 101: return "ioperm"; break;
515 case 102: return "socketcall"; break;
516 case 103: return "syslog"; break;
517 case 104: return "setitimer"; break;
518 case 105: return "getitimer"; break;
519 case 106: return "stat"; break;
520 case 107: return "lstat"; break;
521 case 108: return "fstat"; break;
522 case 109: return "olduname"; break;
523 case 110: return "iopl"; break;
524 case 111: return "vhangup"; break;
525 case 112: return "idle"; break;
526 case 113: return "vm86old"; break;
527 case 114: return "wait4"; break;
528 case 115: return "swapoff"; break;
529 case 116: return "sysinfo"; break;
530 case 117: return "ipc"; break;
531 case 118: return "fsync"; break;
532 case 119: return "sigreturn"; break;
533 case 120: return "clone"; break;
534 case 121: return "setdomainname"; break;
535 case 122: return "uname"; break;
536 case 123: return "modify_ldt"; break;
537 case 124: return "adjtimex"; break;
538 case 125: return "mprotect"; break;
539 case 126: return "sigprocmask"; break;
540 case 127: return "create_module"; break;
541 case 128: return "init_module"; break;
542 case 129: return "delete_module"; break;
543 case 130: return "get_kernel_syms"; break;
544 case 131: return "quotactl"; break;
545 case 132: return "getpgid"; break;
546 case 133: return "fchdir"; break;
547 case 134: return "bdflush"; break;
548 case 135: return "sysfs"; break;
549 case 136: return "personality"; break;
550 case 137: return "afs_syscall"; break;
551 case 138: return "setfsuid"; break;
552 case 139: return "setfsgid"; break;
553 case 140: return "_llseek"; break;
554 case 141: return "getdents"; break;
555 case 142: return "_newselect"; break;
556 case 143: return "flock"; break;
557 case 144: return "msync"; break;
558 case 145: return "readv"; break;
559 case 146: return "writev"; break;
560 case 147: return "getsid"; break;
561 case 148: return "fdatasync"; break;
562 case 149: return "_sysctl"; break;
563 case 150: return "mlock"; break;
564 case 151: return "munlock"; break;
565 case 152: return "mlockall"; break;
566 case 153: return "munlockall"; break;
567 case 154: return "sched_setparam"; break;
568 case 155: return "sched_getparam"; break;
569 case 156: return "sched_setscheduler"; break;
570 case 157: return "sched_getscheduler"; break;
571 case 158: return "sched_yield"; break;
572 case 159: return "sched_get_priority_max"; break;
573 case 160: return "sched_get_priority_min"; break;
574 case 161: return "sched_rr_get_interval"; break;
575 case 162: return "nanosleep"; break;
576 case 163: return "mremap"; break;
577 case 164: return "setresuid"; break;
578 case 165: return "getresuid"; break;
579 case 166: return "vm86"; break;
580 case 167: return "query_module"; break;
581 case 168: return "poll"; break;
582 case 169: return "nfsservctl"; break;
583 case 170: return "setresgid"; break;
584 case 171: return "getresgid"; break;
585 case 172: return "prctl"; break;
586 case 173: return "rt_sigreturn"; break;
587 case 174: return "rt_sigaction"; break;
588 case 175: return "rt_sigprocmask"; break;
589 case 176: return "rt_sigpending"; break;
590 case 177: return "rt_sigtimedwait"; break;
591 case 178: return "rt_sigqueueinfo"; break;
592 case 179: return "rt_sigsuspend"; break;
593 case 180: return "pread64"; break;
594 case 181: return "pwrite64"; break;
595 case 182: return "chown"; break;
596 case 183: return "getcwd"; break;
597 case 184: return "capget"; break;
598 case 185: return "capset"; break;
599 case 186: return "sigaltstack"; break;
600 case 187: return "sendfile"; break;
601 case 188: return "getpmsg"; break;
602 case 189: return "putpmsg"; break;
603 case 190: return "vfork"; break;
604 case 191: return "ugetrlimit"; break;
605 case 192: return "mmap2"; break;
606 case 193: return "truncate64"; break;
607 case 194: return "ftruncate64"; break;
608 case 195: return "stat64"; break;
609 case 196: return "lstat64"; break;
610 case 197: return "fstat64"; break;
611 case 198: return "lchown32"; break;
612 case 199: return "getuid32"; break;
613 case 200: return "getgid32"; break;
614 case 201: return "geteuid32"; break;
615 case 202: return "getegid32"; break;
616 case 203: return "setreuid32"; break;
617 case 204: return "setregid32"; break;
618 case 205: return "getgroups32"; break;
619 case 206: return "setgroups32"; break;
620 case 207: return "fchown32"; break;
621 case 208: return "setresuid32"; break;
622 case 209: return "getresuid32"; break;
623 case 210: return "setresgid32"; break;
624 case 211: return "getresgid32"; break;
625 case 212: return "chown32"; break;
626 case 213: return "setuid32"; break;
627 case 214: return "setgid32"; break;
628 case 215: return "setfsuid32"; break;
629 case 216: return "setfsgid32"; break;
630 case 217: return "pivot_root"; break;
631 case 218: return "mincore"; break;
632 case 219: return "madvise1"; break;
633 case 220: return "getdents64"; break;
634 case 221: return "fcntl64"; break;
635 case 224: return "gettid"; break;
636 case 225: return "readahead"; break;
637 case 226: return "setxattr"; break;
638 case 227: return "lsetxattr"; break;
639 case 228: return "fsetxattr"; break;
640 case 229: return "getxattr"; break;
641 case 230: return "lgetxattr"; break;
642 case 231: return "fgetxattr"; break;
643 case 232: return "listxattr"; break;
644 case 233: return "llistxattr"; break;
645 case 234: return "flistxattr"; break;
646 case 235: return "removexattr"; break;
647 case 236: return "lremovexattr"; break;
648 case 237: return "fremovexattr"; break;
649 case 238: return "tkill"; break;
650 case 239: return "sendfile64"; break;
651 case 240: return "futex"; break;
652 case 241: return "sched_setaffinity"; break;
653 case 242: return "sched_getaffinity"; break;
654 case 243: return "set_thread_area"; break;
655 case 244: return "get_thread_area"; break;
656 case 245: return "io_setup"; break;
657 case 246: return "io_destroy"; break;
658 case 247: return "io_getevents"; break;
659 case 248: return "io_submit"; break;
660 case 249: return "io_cancel"; break;
661 case 250: return "fadvise64"; break;
662 case 252: return "exit_group"; break;
663 case 253: return "lookup_dcookie"; break;
664 case 254: return "epoll_create"; break;
665 case 255: return "epoll_ctl"; break;
666 case 256: return "epoll_wait"; break;
667 case 257: return "remap_file_pages"; break;
668 case 258: return "set_tid_address"; break;
669 case 259: return "timer_create"; break;
670 case 260: return "timer_settime"; break;
671 case 261: return "timer_gettime"; break;
672 case 262: return "timer_getoverrun"; break;
673 case 263: return "timer_delete"; break;
674 case 264: return "clock_settime"; break;
675 case 265: return "clock_gettime"; break;
676 case 266: return "clock_getres"; break;
677 case 267: return "clock_nanosleep"; break;
678 case 268: return "statfs64"; break;
679 case 269: return "fstatfs64"; break;
680 case 270: return "tgkill"; break;
681 case 271: return "utimes"; break;
682 case 272: return "fadvise64_64"; break;
683 case 273: return "vserver"; break;
684 case 274: return "mbind"; break;
685 case 275: return "get_mempolicy"; break;
686 case 276: return "set_mempolicy"; break;
687 case 277: return "mq_open"; break;
688 case 278: return "mq_unlink"; break;
689 case 279: return "mq_timedsend"; break;
690 case 280: return "mq_timedreceive"; break;
691 case 281: return "mq_notify"; break;
692 case 282: return "mq_getsetattr"; break;
693 case 283: return "kexec_load"; break;
694 case 284: return "waitid"; break;
695 case 285: return "sys_setaltroot"; break;
696 case 286: return "add_key"; break;
697 case 287: return "request_key"; break;
698 case 288: return "keyctl"; break;
699 case 289: return "ioprio_set"; break;
700 case 290: return "ioprio_get"; break;
701 case 291: return "inotify_init"; break;
702 case 292: return "inotify_add_watch"; break;
703 case 293: return "inotify_rm_watch"; break;
704 case 294: return "migrate_pages"; break;
705 case 295: return "openat"; break;
706 case 296: return "mkdirat"; break;
707 case 297: return "mknodat"; break;
708 case 298: return "fchownat"; break;
709 case 299: return "futimesat"; break;
710 case 300: return "fstatat64"; break;
711 case 301: return "unlinkat"; break;
712 case 302: return "renameat"; break;
713 case 303: return "linkat"; break;
714 case 304: return "symlinkat"; break;
715 case 305: return "readlinkat"; break;
716 case 306: return "fchmodat"; break;
717 case 307: return "faccessat"; break;
718 case 308: return "pselect6"; break;
719 case 309: return "ppoll"; break;
720 case 310: return "unshare"; break;
721 case 311: return "set_robust_list"; break;
722 case 312: return "get_robust_list"; break;
723 case 313: return "splice"; break;
724 case 314: return "sync_file_range"; break;
725 case 315: return "tee"; break;
726 case 316: return "vmsplice"; break;
727 case 317: return "move_pages"; break;
728 case 318: return "getcpu"; break;
729 case 319: return "epoll_pwait"; break;
730 case 320: return "utimensat"; break;
731 case 321: return "signalfd"; break;
732 case 322: return "timerfd_create"; break;
733 case 323: return "eventfd"; break;
734 case 324: return "fallocate"; break;
735 case 325: return "timerfd_settime"; break;
736 case 326: return "timerfd_gettime"; break;
737 case 327: return "signalfd4"; break;
738 case 328: return "eventfd2"; break;
739 case 329: return "epoll_create1"; break;
740 case 330: return "dup3"; break;
741 case 331: return "pipe2"; break;
742 case 332: return "inotify_init1"; break;
743 case 333: return "preadv"; break;
744 case 334: return "pwritev"; break;
745 case 335: return "rt_tgsigqueueinfo"; break;
746 case 336: return "perf_event_open"; break;
747 default: return "UNKNOWN"; break;
752 char * get_linux_syscall_name64 (uint_t syscall_nr) {
754 switch (syscall_nr) {
756 case 0: return "read"; break;
757 case 1: return "write"; break;
758 case 2: return "open"; break;
759 case 3: return "close"; break;
760 case 4: return "stat"; break;
761 case 5: return "fstat"; break;
762 case 6: return "lstat"; break;
763 case 7: return "poll"; break;
764 case 8: return "lseek"; break;
765 case 9: return "mmap"; break;
766 case 10: return "mprotect"; break;
767 case 11: return "munmap"; break;
768 case 12: return "brk"; break;
769 case 13: return "rt_sigaction"; break;
770 case 14: return "rt_sigprocmask"; break;
771 case 15: return "rt_sigreturn"; break;
772 case 16: return "ioctl"; break;
773 case 17: return "pread64"; break;
774 case 18: return "pwrite64"; break;
775 case 19: return "readv"; break;
776 case 20: return "writev"; break;
777 case 21: return "access"; break;
778 case 22: return "pipe"; break;
779 case 23: return "select"; break;
780 case 24: return "sched_yield"; break;
781 case 25: return "mremap"; break;
782 case 26: return "msync"; break;
783 case 27: return "mincore"; break;
784 case 28: return "madvise"; break;
785 case 29: return "shmget"; break;
786 case 30: return "shmat"; break;
787 case 31: return "shmctl"; break;
788 case 32: return "dup"; break;
789 case 33: return "dup2"; break;
790 case 34: return "pause"; break;
791 case 35: return "nanosleep"; break;
792 case 36: return "getitimer"; break;
793 case 37: return "alarm"; break;
794 case 38: return "setitimer"; break;
795 case 39: return "getpid"; break;
796 case 40: return "sendfile"; break;
797 case 41: return "socket"; break;
798 case 42: return "connect"; break;
799 case 43: return "accept"; break;
800 case 44: return "sendto"; break;
801 case 45: return "recvfrom"; break;
802 case 46: return "sendmsg"; break;
803 case 47: return "recvmsg"; break;
804 case 48: return "shutdown"; break;
805 case 49: return "bind"; break;
806 case 50: return "listen"; break;
807 case 51: return "getsockname"; break;
808 case 52: return "getpeername"; break;
809 case 53: return "socketpair"; break;
810 case 54: return "setsockopt"; break;
811 case 55: return "getsockopt"; break;
812 case 56: return "clone"; break;
813 case 57: return "fork"; break;
814 case 58: return "vfork"; break;
815 case 59: return "execve"; break;
816 case 60: return "exit"; break;
817 case 61: return "wait4"; break;
818 case 62: return "kill"; break;
819 case 63: return "uname"; break;
820 case 64: return "semget"; break;
821 case 65: return "semop"; break;
822 case 66: return "semctl"; break;
823 case 67: return "shmdt"; break;
824 case 68: return "msgget"; break;
825 case 69: return "msgsnd"; break;
826 case 70: return "msgrcv"; break;
827 case 71: return "msgctl"; break;
828 case 72: return "fcntl"; break;
829 case 73: return "flock"; break;
830 case 74: return "fsync"; break;
831 case 75: return "fdatasync"; break;
832 case 76: return "truncate"; break;
833 case 77: return "ftruncate"; break;
834 case 78: return "getdents"; break;
835 case 79: return "getcwd"; break;
836 case 80: return "chdir"; break;
837 case 81: return "fchdir"; break;
838 case 82: return "rename"; break;
839 case 83: return "mkdir"; break;
840 case 84: return "rmdir"; break;
841 case 85: return "creat"; break;
842 case 86: return "link"; break;
843 case 87: return "unlink"; break;
844 case 88: return "symlink"; break;
845 case 89: return "readlink"; break;
846 case 90: return "chmod"; break;
847 case 91: return "fchmod"; break;
848 case 92: return "chown"; break;
849 case 93: return "fchown"; break;
850 case 94: return "lchown"; break;
851 case 95: return "umask"; break;
852 case 96: return "gettimeofday"; break;
853 case 97: return "getrlimit"; break;
854 case 98: return "getrusage"; break;
855 case 99: return "sysinfo"; break;
856 case 100: return "times"; break;
857 case 101: return "ptrace"; break;
858 case 102: return "getuid"; break;
859 case 103: return "syslog"; break;
860 case 104: return "getgid"; break;
861 case 105: return "setuid"; break;
862 case 106: return "setgid"; break;
863 case 107: return "geteuid"; break;
864 case 108: return "getegid"; break;
865 case 109: return "setpgid"; break;
866 case 110: return "getppid"; break;
867 case 111: return "getpgrp"; break;
868 case 112: return "setsid"; break;
869 case 113: return "setreuid"; break;
870 case 114: return "setregid"; break;
871 case 115: return "getgroups"; break;
872 case 116: return "setgroups"; break;
873 case 117: return "setresuid"; break;
874 case 118: return "getresuid"; break;
875 case 119: return "setresgid"; break;
876 case 120: return "getresgid"; break;
877 case 121: return "getpgid"; break;
878 case 122: return "setfsuid"; break;
879 case 123: return "setfsgid"; break;
880 case 124: return "getsid"; break;
881 case 125: return "capget"; break;
882 case 126: return "capset"; break;
883 case 127: return "rt_sigpending"; break;
884 case 128: return "rt_sigtimedwait"; break;
885 case 129: return "rt_sigqueueinfo"; break;
886 case 130: return "rt_sigsuspend"; break;
887 case 131: return "sigaltstack"; break;
888 case 132: return "utime"; break;
889 case 133: return "mknod"; break;
890 case 134: return "uselib"; break;
891 case 135: return "personality"; break;
892 case 136: return "ustat"; break;
893 case 137: return "statfs"; break;
894 case 138: return "fstatfs"; break;
895 case 139: return "sysfs"; break;
896 case 140: return "getpriority"; break;
897 case 141: return "setpriority"; break;
898 case 142: return "sched_setparam"; break;
899 case 143: return "sched_getparam"; break;
900 case 144: return "sched_setscheduler"; break;
901 case 145: return "sched_getscheduler"; break;
902 case 146: return "sched_get_priority_max"; break;
903 case 147: return "sched_get_priority_min"; break;
904 case 148: return "sched_rr_get_interval"; break;
905 case 149: return "mlock"; break;
906 case 150: return "munlock"; break;
907 case 151: return "mlockall"; break;
908 case 152: return "munlockall"; break;
909 case 153: return "vhangup"; break;
910 case 154: return "modify_ldt"; break;
911 case 155: return "pivot_root"; break;
912 case 156: return "_sysctl"; break;
913 case 157: return "prctl"; break;
914 case 158: return "arch_prctl"; break;
915 case 159: return "adjtimex"; break;
916 case 160: return "setrlimit"; break;
917 case 161: return "chroot"; break;
918 case 162: return "sync"; break;
919 case 163: return "acct"; break;
920 case 164: return "settimeofday"; break;
921 case 165: return "mount"; break;
922 case 166: return "umount2"; break;
923 case 167: return "swapon"; break;
924 case 168: return "swapoff"; break;
925 case 169: return "reboot"; break;
926 case 170: return "sethostname"; break;
927 case 171: return "setdomainname"; break;
928 case 172: return "iopl"; break;
929 case 173: return "ioperm"; break;
930 case 174: return "create_module"; break;
931 case 175: return "init_module"; break;
932 case 176: return "delete_module"; break;
933 case 177: return "get_kernel_syms"; break;
934 case 178: return "query_module"; break;
935 case 179: return "quotactl"; break;
936 case 180: return "nfsservctl"; break;
937 case 181: return "getpmsg"; break;
938 case 182: return "putpmsg"; break;
939 case 183: return "afs_syscall"; break;
940 case 184: return "tuxcall"; break;
941 case 185: return "security"; break;
942 case 186: return "gettid"; break;
943 case 187: return "readahead"; break;
944 case 188: return "setxattr"; break;
945 case 189: return "lsetxattr"; break;
946 case 190: return "fsetxattr"; break;
947 case 191: return "getxattr"; break;
948 case 192: return "lgetxattr"; break;
949 case 193: return "fgetxattr"; break;
950 case 194: return "listxattr"; break;
951 case 195: return "llistxattr"; break;
952 case 196: return "flistxattr"; break;
953 case 197: return "removexattr"; break;
954 case 198: return "lremovexattr"; break;
955 case 199: return "fremovexattr"; break;
956 case 200: return "tkill"; break;
957 case 201: return "time"; break;
958 case 202: return "futex"; break;
959 case 203: return "sched_setaffinity"; break;
960 case 204: return "sched_getaffinity"; break;
961 case 205: return "set_thread_area"; break;
962 case 206: return "io_setup"; break;
963 case 207: return "io_destroy"; break;
964 case 208: return "io_getevents"; break;
965 case 209: return "io_submit"; break;
966 case 210: return "io_cancel"; break;
967 case 211: return "get_thread_area"; break;
968 case 212: return "lookup_dcookie"; break;
969 case 213: return "epoll_create"; break;
970 case 214: return "epoll_ctl_old"; break;
971 case 215: return "epoll_wait_old"; break;
972 case 216: return "remap_file_pages"; break;
973 case 217: return "getdents64"; break;
974 case 218: return "set_tid_address"; break;
975 case 219: return "restart_syscall"; break;
976 case 220: return "semtimedop"; break;
977 case 221: return "fadvise64"; break;
978 case 222: return "timer_create"; break;
979 case 223: return "timer_settime"; break;
980 case 224: return "timer_gettime"; break;
981 case 225: return "timer_getoverrun"; break;
982 case 226: return "timer_delete"; break;
983 case 227: return "clock_settime"; break;
984 case 228: return "clock_gettime"; break;
985 case 229: return "clock_getres"; break;
986 case 230: return "clock_nanosleep"; break;
987 case 231: return "exit_group"; break;
988 case 232: return "epoll_wait"; break;
989 case 233: return "epoll_ctl"; break;
990 case 234: return "tgkill"; break;
991 case 235: return "utimes"; break;
992 case 236: return "vserver"; break;
993 case 237: return "mbind"; break;
994 case 238: return "set_mempolicy"; break;
995 case 239: return "get_mempolicy"; break;
996 case 240: return "mq_open"; break;
997 case 241: return "mq_unlink"; break;
998 case 242: return "mq_timedsend"; break;
999 case 243: return "mq_timedreceive"; break;
1000 case 244: return "mq_notify"; break;
1001 case 246: return "kexec_load"; break;
1002 case 247: return "waitid"; break;
1003 case 248: return "add_key"; break;
1004 case 249: return "request_key"; break;
1005 case 250: return "keyctl"; break;
1006 case 251: return "ioprio_set"; break;
1007 case 252: return "ioprio_get"; break;
1008 case 253: return "inotify_init"; break;
1009 case 254: return "inotify_add_watch"; break;
1010 case 255: return "inotify_rm_watch"; break;
1011 case 256: return "migrate_pages"; break;
1012 case 257: return "openat"; break;
1013 case 258: return "mkdirat"; break;
1014 case 259: return "mknodat"; break;
1015 case 260: return "fchownat"; break;
1016 case 261: return "futimesat"; break;
1017 case 262: return "newfstatat"; break;
1018 case 263: return "unlinkat"; break;
1019 case 264: return "renameat"; break;
1020 case 265: return "linkat"; break;
1021 case 266: return "symlinkat"; break;
1022 case 267: return "readlinkat"; break;
1023 case 268: return "fchmodat"; break;
1024 case 269: return "faccessat"; break;
1025 case 270: return "pselect6"; break;
1026 case 271: return "ppoll"; break;
1027 case 272: return "unshare"; break;
1028 case 273: return "set_robust_list"; break;
1029 case 274: return "get_robust_list"; break;
1030 case 275: return "splice"; break;
1031 case 276: return "tee"; break;
1032 case 277: return "sync_file_range"; break;
1033 case 278: return "vmsplice"; break;
1034 case 279: return "move_pages"; break;
1035 case 280: return "utimensat"; break;
1036 case 281: return "epoll_pwait"; break;
1037 case 282: return "signalfd"; break;
1038 case 283: return "timerfd_create"; break;
1039 case 284: return "eventfd"; break;
1040 case 285: return "fallocate"; break;
1041 case 286: return "timerfd_settime"; break;
1042 case 287: return "timerfd_gettime"; break;
1043 case 288: return "accept4"; break;
1044 case 289: return "signalfd4"; break;
1045 case 290: return "eventfd2"; break;
1046 case 291: return "epoll_create1"; break;
1047 case 292: return "dup3"; break;
1048 case 293: return "pipe2"; break;
1049 case 294: return "inotify_init1"; break;
1050 case 295: return "preadv"; break;
1051 case 296: return "pwritev"; break;
1052 case 297: return "rt_tgsigqueueinfo"; break;
1053 case 298: return "perf_event_open"; break;
1054 default: return "UNKNOWN"; break;