Following is an overview of available syscall probes and convenience variables they offer. By default, each syscall probe has name and argstr convenience variables, which are not included in the overview in order to keep it short. Non dwarf-based nd_syscall probes are supposed to have the same convenience variables.
Table 38.1. Syscalls list
| syscall | params |
|---|---|
| accept | addr_uaddr, addrlen_uaddr, sockfd |
| accept4 | addr_uaddr, addrlen_uaddr, flags, flags_str, sockfd |
| access | mode, mode_str, pathname, pathname_unquoted |
| acct | filename, filename_unquoted |
| add_key | description_uaddr, payload_uaddr, plen, ringid, type_uaddr |
| adjtimex | buf_str, buf_uaddr |
| alarm | seconds |
| arch_prctl | addr, code, code_str |
| bdflush | $id, $regs, data, data_str, func, int, pt_regs* |
| bind | addrlen, my_addr_uaddr, sockfd, uaddr_af, uaddr_ip, uaddr_ip_port, uaddr_ipv6_flowinfo, uaddr_ipv6_scope_id |
| bpf | attr_uaddr, cmd, cmd_str, size |
| brk | brk |
| capget | data_uaddr, header_uaddr |
| capset | data_uaddr, header_uaddr |
| chdir | path, path_unquoted |
| chmod | mode, path, path_unquoted |
| chown | group, owner, path, path_unquoted |
| chown16 | group, owner, path, path_unquoted |
| chroot | path, path_unquoted |
| clock_adjtime | clk_id, clk_id_str, tx_uaddr, tx_uaddr_str |
| clock_getres | clk_id, clk_id_str, res_uaddr |
| clock_gettime | clk_id, clk_id_str, tp_uaddr |
| clock_nanosleep | clk_id, clk_id_str, flags, flags_str, rem_uaddr, req_str, req_uaddr |
| clock_settime | clk_id, clk_id_str, tp_uaddr, tp_uaddr_str |
| clone | $id, $regs, child_tid_uaddr, clone_flags, int, parent_tid_uaddr, pt_regs*, stack_start |
| close | fd |
| compat_adjtimex | $id, $regs, buf_str, buf_uaddr, int, pt_regs* |
| compat_clock_nanosleep | $id, $regs, clk_id, clk_id_str, flags, flags_str, int, pt_regs*, rem_uaddr, req_str, req_uaddr |
| compat_execve | args, env_str, filename |
| compat_execveat | args, dirfd, dirfd_str, env_str, filename, flags, flags_str |
| compat_fadvise64 | $id, $regs, advice, advice_str, fd, int, len, offset, pt_regs* |
| compat_fadvise64_64 | $id, $regs, advice, advice_str, fd, int, len, offset, pt_regs* |
| compat_fallocate | $id, $regs, fd, int, len, mode, mode_str, offset, pt_regs* |
| compat_ftruncate64 | $id, $regs, fd, int, length, pt_regs* |
| compat_futex | $id, $regs, futex_uaddr, int, op, pt_regs*, uaddr2_uaddr, utime_uaddr, val3, val |
| compat_futimesat | $id, $regs, dirfd, dirfd_str, filename, filename_uaddr, filename_unquoted, int, pt_regs*, tvp_str, tvp_uaddr |
| compat_getitimer | value_uaddr, which |
| compat_lookup_dcookie | $id, $regs, buffer_uaddr, cookie, int, len, pt_regs* |
| compat_nanosleep | $id, $regs, int, pt_regs*, rem_uaddr, req_str, req_uaddr |
| compat_ppoll | $id, $regs, fds_uaddr, int, nfds, pt_regs*, sigmask, sigsetsize, tsp, tsp_str |
| compat_pselect6 | $id, $regs, exceptfds, int, nfds, pt_regs*, readfds, sigmask, timeout, timeout_str, writefds |
| compat_readahead | $id, $regs, count, fd, int, offset, pt_regs* |
| compat_recvmmsg | $id, $regs, flags, flags_str, int, mmsg_uaddr, pt_regs*, s, timeout_str, timeout_uaddr, vlen |
| compat_select | exceptfds_uaddr, n, readfds_uaddr, timeout_str, timeout_uaddr, writefds_uaddr |
| compat_setitimer | ovalue_uaddr, value_str, value_uaddr, which, which_str |
| compat_signalfd | flags |
| compat_sys_msgctl | buf_uaddr, cmd, cmd_str, msqid |
| compat_sys_msgrcv | msgflg, msgflg_str, msgp_uaddr, msgsz, msgtyp, msqid |
| compat_sys_msgsnd | msgflg, msgflg_str, msgp_uaddr, msgsz, msqid |
| compat_sys_recvmsg | flags, flags_str, msg_uaddr, s |
| compat_sys_semctl | arg, cmd, cmdstr, semid, semnum |
| compat_sys_semtimedop | nsops, semid, sops_uaddr, timeout_str, timeout_uaddr |
| compat_sys_sendmsg | flags, flags_str, msg_uaddr, s |
| compat_sys_shmat | shmaddr_uaddr, shmflg, shmflg_str, shmid |
| compat_sys_shmctl | buf_uaddr, cmd, cmd_str, shmid |
| compat_sys_utimes | $id, $regs, filename, filename_unquoted, int, pt_regs*, timeval, tvp_uaddr_str |
| compat_truncate64 | $id, $regs, int, length, path, path_uaddr, path_unquoted, pt_regs* |
| compat_utime | $id, $regs, actime, buf_uaddr, filename, filename_uaddr, filename_unquoted, int, modtime, pt_regs* |
| compat_utimensat | $id, $regs, dfd, dfd_str, filename, filename_uaddr, filename_unquoted, flags, flags_str, int, pt_regs*, tsp_str, tsp_uaddr |
| compat_vmsplice | $id, $regs, fd, flags, flags_str, int, iov, nr_segs, pt_regs* |
| connect | addrlen, serv_addr_uaddr, sockfd, uaddr_af, uaddr_ip, uaddr_ip_port, uaddr_ipv6_flowinfo, uaddr_ipv6_scope_id |
| copy_file_range | fd_in, fd_out, flags, len, off_in, off_out |
| creat | mode, pathname, pathname_unquoted |
| delete_module | flags, flags_str, name_user, name_user_unquoted |
| dup | oldfd |
| dup2 | flags, flags_str, newfd, oldfd |
| dup3 | flags, flags_str, newfd, oldfd |
| epoll_create | flags, size |
| epoll_ctl | epfd, event_uaddr, fd, op, op_str |
| epoll_pwait | epfd, events_uaddr, maxevents, sigmask_uaddr, sigsetsize, timeout |
| epoll_wait | epfd, events_uaddr, maxevents, timeout |
| eventfd | count, flags, flags_str |
| execve | args, env_str, filename |
| execveat | args, dirfd, dirfd_str, env_str, filename, flags, flags_str |
| exit | status |
| exit_group | status |
| faccessat | dirfd, dirfd_str, mode, mode_str, pathname, pathname_unquoted |
| faccessat2 | dirfd, dirfd_str, flags, flags_str, mode, mode_str, pathname, pathname_unquoted |
| fadvise64 | advice, advice_str, fd, len, offset |
| fadvise64_64 | $id, $regs, advice, advice_str, fd, int, len, offset, pt_regs* |
| fallocate | fd, len, mode, mode_str, offset |
| fanotify_init | event_f_flags, event_f_flags_str, flags, flags_str |
| fanotify_mark | dirfd, dirfd_str, fanotify_fd, flags, flags_str, mask, mask_str, pathname, pathname_unquoted |
| fchdir | fd |
| fchmod | fildes, mode |
| fchmodat | dirfd, dirfd_str, mode, pathname, pathname_unquoted |
| fchown | fd, group, owner |
| fchown16 | fd, group, owner |
| fchownat | dirfd, dirfd_str, flags, flags_str, group, owner, pathname, pathname_unquoted |
| fcntl | arg, cmd, cmd_str, fd |
| fdatasync | fd |
| fgetxattr | filedes, name_str, name_str_unquoted, size, value_uaddr |
| finit_module | fd, flags, flags_str, uargs, uargs_unquoted |
| flistxattr | filedes, list_uaddr, size |
| flock | fd, operation |
| fork | |
| fremovexattr | filedes, name_str, name_str_unquoted, name_uaddr |
| fsetxattr | filedes, flags, flags_str, name_str, name_str_unquoted, name_uaddr, size, value_str, value_uaddr |
| fstat | buf_uaddr, filedes |
| fstatat | buf_uaddr, dirfd, dirfd_str, flags, flags_str, path, path_unquoted |
| fstatfs | buf_uaddr, fd |
| fstatfs64 | buf_uaddr, fd, sz |
| fsync | fd |
| ftruncate | fd, length |
| ftruncate64 | $id, $regs, fd, int, length, pt_regs* |
| futex | futex_uaddr, op, uaddr2_uaddr, utime_uaddr, val3, val |
| futimesat | dirfd, dirfd_str, filename, filename_uaddr, filename_unquoted, tvp_str, tvp_uaddr |
| get_mempolicy | addr, flags, flags_str, maxnode, nmask_uaddr, policy_uaddr |
| get_robust_list | len_uaddr, list_head_uaddr, pid |
| get_thread_area | u_info_str, u_info_uaddr |
| getcpu | cpu_uaddr, node_uaddr, tcache_uaddr |
| getcwd | buf_uaddr, size |
| getdents | count, dirp_uaddr, fd |
| getegid | |
| geteuid | |
| getgid | |
| getgroups | list_uaddr, size |
| getitimer | value_uaddr, which |
| getpeername | name_uaddr, namelen_uaddr, s |
| getpgid | pid |
| getpgrp | |
| getpid | |
| getppid | |
| getpriority | which, who |
| getrandom | buf, buf_unquoted, count, flags, flags_str |
| getresgid | egid_uaddr, rgid_uaddr, sgid_uaddr |
| getresuid | euid_uaddr, ruid_uaddr, suid_uaddr |
| getrlimit | resource, rlim_uaddr |
| getrusage | usage_uaddr, who, who_str |
| getsid | pid |
| getsockname | name_uaddr, namelen_uaddr, s |
| getsockopt | fd, level, level_str, optlen_uaddr, optname, optname_str, optval_uaddr |
| gettid | |
| gettimeofday | tv_uaddr, tz_uaddr |
| getuid | |
| getxattr | name_str, name_str_unquoted, path, path_unquoted, size, value_uaddr |
| init_module | len, uargs, uargs_unquoted, umod_uaddr |
| inotify_add_watch | fd, mask, mask_str, path, path_uaddr, path_unquoted |
| inotify_init | flags |
| inotify_rm_watch | fd, wd |
| io_cancel | ctx_id, iocb_uaddr, result_uaddr |
| io_destroy | ctx |
| io_getevents | ctx_id, events_uaddr, min_nr, nr, timeout_uaddr, timestr |
| io_setup | ctxp_uaddr, maxevents |
| io_submit | ctx_id, iocbpp_uaddr, nr |
| ioctl | argp, fd, request |
| ioperm | from, num, turn_on |
| iopl | level |
| ioprio_get | which, which_str, who |
| ioprio_set | ioprio, ioprio_str, which, which_str, who |
| kcmp | idx1, idx2, pid1, pid2, type, type_str |
| kexec_file_load | cmdline, cmdline_len, cmdline_unquoted, flags, flags_str, initrd_fd, kernel_fd |
| kexec_load | entry, flags, flags_str, nr_segments, segments_uaddr |
| keyctl | arg2, arg3, arg4, arg5, option |
| kill | pid, sig, sig_name |
| lchown | group, owner, path, path_unquoted |
| lchown16 | group, owner, path, path_unquoted |
| lgetxattr | name_str, name_str_unquoted, path, path_unquoted, size, value_uaddr |
| link | newpath, newpath_unquoted, oldpath, oldpath_unquoted |
| linkat | flags, flags_str, newdirfd, newdirfd_str, newpath, newpath_unquoted, olddirfd, olddirfd_str, oldpath, oldpath_unquoted |
| listen | backlog, sockfd |
| listxattr | list_uaddr, path, path_uaddr, path_unquoted, size |
| llistxattr | list_uaddr, path, path_uaddr, path_unquoted, size |
| llseek | fd, offset_high, offset_low, result_uaddr, whence, whence_str |
| lookup_dcookie | $id, $regs, buffer_uaddr, cookie, int, len, pt_regs* |
| lremovexattr | name_str, name_str_unquoted, name_uaddr, path, path_uaddr, path_unquoted |
| lseek | fildes, offset, whence, whence_str |
| lsetxattr | flags, flags_str, name_str, name_str_unquoted, name_uaddr, path, path_uaddr, path_unquoted, size, value_str, value_uaddr |
| lstat | buf_uaddr, path, path_unquoted |
| madvise | advice, advice_str, length, start |
| mbind | flags, flags_str, len, maxnode, mode, mode_str, nmask_uaddr, start |
| membarrier | cmd, cmd_str, flags |
| memfd_create | flags, flags_str, uname, uname_unquoted |
| memfd_secret | flags, flags_str |
| migrate_pages | maxnode, new_nodes, old_nodes, pid |
| mincore | length, start, vec_uaddr |
| mkdir | mode, pathname, pathname_uaddr, pathname_unquoted |
| mkdirat | dirfd, dirfd_str, mode, pahtname_unquoted, pathname |
| mknod | dev, mode, mode_str, pathname, pathname_unquoted |
| mknodat | dev, dirfd, dirfd_str, mode, mode_str, pathname, pathname_unquoted |
| mlock | addr, len |
| mlock2 | addr, flags, flags_str, len |
| mlockall | flags, flags_str |
| mmap2 | fd, flags, flags_str, length, pgoffset, prot, prot_str, start |
| modify_ldt | bytecount, func, ptr_uaddr |
| mount | data, data_unquoted, filesystemtype, filesystemtype_unquoted, mountflags, mountflags_str, source, source_unquoted, target, target_unquoted |
| move_pages | flags, flags_str, nodes, nr_pages, pages, pid, status |
| mprotect | addr, len, prot, prot_str |
| mq_getsetattr | mqdes, u_mqstat_uaddr, u_omqstat_uaddr |
| mq_notify | mqdes, notification_uaddr |
| mq_open | filename, filename_unquoted, mode, name_uaddr, oflag, oflag_str, u_attr_uaddr |
| mq_timedreceive | abs_timeout_uaddr, mqdes, msg_len, msg_prio_uaddr, msg_ptr_uaddr |
| mq_timedsend | abs_timeout_uaddr, mqdes, msg_len, msg_prio, msg_ptr_uaddr |
| mq_unlink | u_name, u_name_uaddr, u_name_unquoted |
| mremap | flags, flags_str, new_address, new_size, old_address, old_size |
| msgctl | buf_uaddr, cmd, cmd_str, msqid |
| msgget | key, key_str, msgflg, msgflg_str |
| msgrcv | msgflg, msgflg_str, msgp_uaddr, msgsz, msgtyp, msqid |
| msgsnd | msgflg, msgflg_str, msgp_uaddr, msgsz, msqid |
| msync | flags, flags_str, length, start |
| munlock | addr, len |
| munlockall | |
| munmap | length, start |
| name_to_handle_at | dfd, dfd_str, flags, flags_str, handle_uaddr, mnt_id_uaddr, pathname, pathname_unquoted |
| nanosleep | rem_uaddr, req_str, req_uaddr |
| ni_syscall | |
| nice | inc |
| open | filename, filename_unquoted, flags, flags_str, mode |
| open_by_handle_at | flags, flags_str, handle_uaddr, mount_dfd, mount_dfd_str |
| openat | dfd, dfd_str, filename, filename_unquoted, flags, flags_str, mode |
| pause | |
| perf_event_open | attr_uaddr, cpu, flags, flags_str, group_fd, pid |
| personality | persona |
| pipe | fildes_uaddr, flag_str, flags, pipe0, pipe1 |
| pivot_root | new_root_str, new_root_str_unquoted, old_root_str, old_root_str_unquoted |
| pkey_alloc | flags, init_val, init_val_str |
| pkey_free | pkey |
| pkey_mprotect | addr, len, pkey, prot, prot_str |
| poll | nfds, timeout, ufds_uaddr |
| ppoll | fds_uaddr, nfds, sigmask, sigsetsize, tsp, tsp_str |
| prctl | arg2, arg3, arg4, arg5, option |
| pread | buf_uaddr, count, fd, offset |
| preadv | count, fd, offset, vector_uaddr |
| preadv2 | count, fd, flags, flags_str, offset, vector_uaddr |
| prlimit64 | new_rlim_str, new_rlim_uaddr, old_rlim_uaddr, pid, resource, resource_str |
| process_vm_readv | flags, liovcnt, local_iov_uaddr, pid, remote_iov_uaddr, riovcnt |
| process_vm_writev | flags, liovcnt, local_iov_uaddr, pid, remote_iov_uaddr, riovcnt |
| pselect6 | exceptfds, nfds, readfds, sigmask, timeout, timeout_str, writefds |
| ptrace | addr, data, pid, request |
| pwrite | buf_str, buf_uaddr, count, fd, offset |
| pwrite32 | $id, $regs, buf_str, buf_uaddr, count, fd, int, offset, pt_regs* |
| pwritev | count, fd, offset, vector_uaddr |
| pwritev2 | count, fd, flags, flags_str, offset, vector_uaddr |
| quotactl | addr_uaddr, cmd, cmd_str, id, special, special_str, special_str_unquoted |
| read | buf_uaddr, count, fd |
| readahead | count, fd, offset |
| readdir | count, dirent, fd |
| readlink | buf_uaddr, bufsiz, path, path_unquoted |
| readlinkat | buf_uaddr, bufsiz, dfd, dfd_str, path, path_unquoted |
| readv | count, fd, vector_uaddr |
| reboot | arg_uaddr, flag, flag_str, magic2, magic2_str, magic, magic_str |
| recv | buf_uaddr, flags, flags_str, len, s |
| recvfrom | addr_uaddr, addrlen_uaddr, buf_uaddr, flags, flags_str, len, s |
| recvmmsg | flags, flags_str, mmsg_uaddr, s, timeout_str, timeout_uaddr, vlen |
| recvmsg | flags, flags_str, msg_uaddr, s |
| remap_file_pages | flags, flags_str, pgoff, prot, prot_str, size, start |
| removexattr | name_str, name_str_unquoted, path, path_unquoted |
| rename | newpath, newpath_unquoted, oldpath, oldpath_unquoted |
| renameat | newdfd, newdfd_str, newname, newname_str, newname_str_unquoted, olddfd, olddfd_str, oldname, oldname_str, oldname_str_unquoted |
| renameat2 | flags, flags_str, newdfd, newdfd_str, newname, newname_str, newname_str_unquoted, olddfd, olddfd_str, oldname, oldname_str, oldname_str_unquoted |
| request_key | callout_info_uaddr, description_str, description_str_unquoted, description_uaddr, destringid, type_str, type_str_unquoted, type_uaddr |
| restart_syscall | |
| rmdir | pathname, pathname_unquoted |
| rt_sigaction | act_str, act_uaddr, oact_uaddr, sig, sig_str, sigsetsize |
| rt_sigaction32 | act_str, act_uaddr, oact_uaddr, sig, sig_str, sigsetsize |
| rt_sigpending | set_uaddr, sigsetsize |
| rt_sigprocmask | how, how_str, oldset_uaddr, set_str, set_uaddr, sigsetsize |
| rt_sigqueueinfo | pid, sig, sig_name, siginfo_str, uinfo_uaddr |
| rt_sigsuspend | set_str, set_uaddr, sigsetsize |
| rt_sigtimedwait | sigsetsize, uinfo_str, uinfo_uaddr, uthese_str, uthese_uaddr, uts_str, uts_uaddr |
| rt_tgsigqueueinfo | sig, sig_str, tgid, tid, uinfo_str, uinfo_uaddr |
| sched_get_priority_max | policy, policy_str |
| sched_get_priority_min | policy, policy_str |
| sched_getaffinity | len, mask_uaddr, pid |
| sched_getattr | flags, pid, sched_attr_str, sched_attr_uaddr, size |
| sched_getparam | p_uaddr, pid |
| sched_getscheduler | pid |
| sched_rr_get_interval | pid, tp_uaddr |
| sched_setaffinity | len, mask_uaddr, pid |
| sched_setattr | flags, pid, sched_attr_str, sched_attr_uaddr |
| sched_setparam | p_uaddr, pid |
| sched_setscheduler | p_uaddr, pid, policy, policy_str |
| sched_yield | |
| seccomp | flags, flags_str, op, op_str, uargs_uaddr |
| select | exceptfds_uaddr, n, readfds_uaddr, timeout_str, timeout_uaddr, writefds_uaddr |
| semctl | arg, cmd, cmdstr, semid, semnum |
| semget | key, key_str, nsems, semflg, semflg_str |
| semop | nsops, semid, sops_uaddr |
| semtimedop | nsops, semid, sops_uaddr, timeout_str, timeout_uaddr |
| send | buf, buf_uaddr, flags, flags_str, len, s |
| sendfile | count, in_fd, offset_uaddr, out_fd |
| sendmmsg | flags, flags_str, mmsg_uaddr, s, vlen |
| sendmsg | flags, flags_str, msg_uaddr, s |
| sendto | buf, buf_uaddr, flags, flags_str, len, s, to_str, to_uaddr, tolen |
| set_mempolicy | maxnode, mode, mode_str, nmask_uaddr |
| set_robust_list | len, list_head_uaddr |
| set_thread_area | u_info_str, u_info_uaddr |
| set_tid_address | tidptr_uaddr |
| setdomainname | domainname_str, domainname_str_unquoted, domainname_uaddr, len |
| setfsgid | fsgid |
| setfsuid | fsuid |
| setgid | gid |
| setgroups | list_uaddr, size |
| sethostname | hostname_uaddr, len, name_str, name_str_unquoted |
| setitimer | ovalue_uaddr, value_str, value_uaddr, which, which_str |
| setns | fd, nstype, nstype_str |
| setpgid | pgid, pid |
| setpriority | prio, which, which_str, who |
| setregid | egid, rgid |
| setregid16 | egid, rgid |
| setresgid | egid, rgid, sgid |
| setresgid16 | egid, rgid, sgid |
| setresuid | euid, ruid, suid |
| setresuid16 | euid, ruid, suid |
| setreuid | euid, ruid |
| setreuid16 | euid, ruid |
| setrlimit | resource, resource_str, rlim_str, rlim_uaddr |
| setsid | |
| setsockopt | fd, level, level_str, optlen, optname, optname_str, optval_uaddr |
| settimeofday | tv_str, tv_uaddr, tz_str, tz_uaddr |
| settimeofday32 | tv_str, tv_uaddr, tz_str, tz_uaddr |
| setuid | uid |
| setxattr | flags, flags_str, name_str, name_str_unquoted, name_uaddr, path, path_uaddr, path_unquoted, size, value_str, value_uaddr |
| sgetmask | |
| shmat | shmaddr_uaddr, shmflg, shmflg_str, shmid |
| shmctl | buf_uaddr, cmd, cmd_str, shmid |
| shmdt | shmaddr_uaddr |
| shmget | key, shmflg, shmflg_str, size |
| shutdown | how, how_str, s |
| sigaction | $id, $regs, act_str, act_uaddr, int, oact_uaddr, pt_regs*, sig, sig_str |
| sigaction32 | act_str, act_uaddr, oact_uaddr, sig, sig_str |
| sigaltstack | uoss_uaddr, uss_str, uss_uaddr |
| signal | handler, handler_str, sig, sig_str |
| signalfd | flags |
| sigpending | set |
| sigprocmask | how, how_str, oldset_uaddr, set_uaddr |
| sigsuspend | mask, mask_str |
| socket | family, family_str, protocol, protocol_str, type, type_str |
| socketpair | family, family_str, protocol, protocol_str, sv_uaddr, type, type_str |
| splice | fd_in, fd_out, flags, flags_str, len, off_in, off_out |
| ssetmask | newmask, newmask_str |
| stat | buf_uaddr, filename, filename_uaddr, filename_unquoted |
| statfs | buf_uaddr, path, path_unquoted |
| statfs64 | buf_uaddr, path, path_unquoted, sz |
| statx | buf_uaddr, dfd, dfd_str, filename, filename_uaddr, filename_unquoted, flags, flags_str, mask, mask_str |
| stime | t_uaddr |
| swapoff | path, path_uaddr, path_unquoted |
| swapon | path, path_uaddr, path_unquoted, swapflags, swapflags_str |
| symlink | newpath, oldpath, oldpath_unquoted |
| symlinkat | newdfd, newdfd_str, newname, newname_str, newname_str_unquoted, oldname, oldname_str, oldname_str_unquoted |
| sync | |
| sync_file_range | fd, flags, flags_str, nbytes, offset |
| syncfs | fd |
| sysctl | $id, $regs, args, int, pt_regs* |
| sysfs | arg1, arg2, option |
| sysinfo | info_str, info_uaddr |
| syslog | bufp_uaddr, len, type |
| tee | fdin, fdout, flags, len |
| tgkill | pid, sig, sig_str, tgid |
| time | t_uaddr |
| timer_create | clockid, clockid_str, evp_uaddr, timerid_uaddr |
| timer_delete | timerid |
| timer_getoverrun | timerid |
| timer_gettime | timerid, value_uaddr |
| timer_settime | flags, ovalue_uaddr, timerid, value_str, value_uaddr |
| timerfd_create | clockid, clockid_str, flags, flags_str |
| timerfd_gettime | fd, value_uaddr |
| timerfd_settime | fd, flags, flags_str, ovalue_uaddr, value_str, value_uaddr |
| times | buf_str, buf_uaddr |
| tkill | pid, sig, sig_str |
| truncate | length, path, path_uaddr, path_unquoted |
| umask | mask |
| umount | flags, flags_str, target, target_unquoted |
| uname | name_uaddr |
| unlink | pathname, pathname_uaddr, pathname_unquoted |
| unlinkat | dfd, dfd_str, flag, flag_str, pathname, pathname_str, pathname_str_unquoted |
| unshare | unshare_flags, unshare_flags_str |
| uselib | $id, $regs, int, library, library_uaddr, library_unquoted, pt_regs* |
| userfaultfd | flags, flags_str |
| ustat | dev, ubuf_uaddr |
| ustat32 | dev, ubuf_uaddr |
| utime | actime, buf_uaddr, filename, filename_uaddr, filename_unquoted, modtime |
| utimensat | dfd, dfd_str, filename, filename_uaddr, filename_unquoted, flags, flags_str, tsp_str, tsp_uaddr |
| utimes | filename, filename_uaddr, filename_unquoted, tvp_uaddr, tvp_uaddr_str |
| vfork | |
| vhangup | |
| vmsplice | fd, flags, flags_str, iov, nr_segs |
| wait4 | options, options_str, pid, rusage_uaddr, status_uaddr |
| waitid | infop_uaddr, options, options_str, pid, rusage_uaddr, which, which_str |
| waitpid | options, options_str, pid, status_uaddr |
| write | buf_str, buf_uaddr, count, fd |
| writev | count, fd, vector_uaddr |