$B%7%9%F%`%3!<%k$H(BLinux$B%+!<%M%k$N%=!<%9(B

linux-2.6.36/arch/x86/include/asm/unistd_32.h

...
   8:	#define __NR_restart_syscall      0
   9:	#define __NR_exit                 1
  10:	#define __NR_fork                 2
  11:	#define __NR_read                 3
  12:	#define __NR_write                4
  13:	#define __NR_open                 5
  14:	#define __NR_close                6
  15:	#define __NR_waitpid              7
  16:	#define __NR_creat                8
  17:	#define __NR_link                 9
  18:	#define __NR_unlink              10
  19:	#define __NR_execve              11
  20:	#define __NR_chdir               12
...
 346:	#define __NR_fanotify_init      338
 347:	#define __NR_fanotify_mark      339
 348:	#define __NR_prlimit64          340
...
 352:	#define NR_syscalls 341
...

$B"!%7%9%F%`!&%3!<%k$NI=(B sys_call_table

   1:	ENTRY(sys_call_table)
   2:	        .long sys_restart_syscall       /* 0 - old "setup()" system call, used for restarting */
   3:	        .long sys_exit
   4:	        .long ptregs_fork
   5:	        .long sys_read
   6:	        .long sys_write
   7:	        .long sys_open          /* 5 */
   8:	        .long sys_close
   9:	        .long sys_waitpid
  10:	        .long sys_creat
  11:	        .long sys_link
  12:	        .long sys_unlink        /* 10 */
...
 340:	        .long sys_fanotify_init
 341:	        .long sys_fanotify_mark
 342:	        .long sys_prlimit64             /* 340 */

• $B#1$D$N%7%9%F%`!&%3!<%k$r=hM}$9$k$?$a$K!"(B1$B$D$N4X?t$,Dj5A$5$l$F$$$k!#(B
• $B4X?t$NL>A0$O!"EAE}E*$K(B sys_ $B$G;O$^$k!#(B $B%f!<%66u4V$N%7%9%F%`!&%3!<%k$HJ6$l$J$$$h$&$K$9$k$?$a!#(B $BNc(B: $B%f!<%6$N(B write() $B%7%9%F%`!&%3!<%k$O!"%+!<%M%kFb$N(B sys_write() $B$H$$$&4X?t$G=hM}$5$l$k!#(B
• $B%7%9%F%`%3!<%k$O!"(Bsys_call_table $B$H$$$&I=$KEPO?$5$l$F$$$k!#(B n$BHVL\$N%7%9%F%`!&%3!<%k$O!"%F!<%V%k$N(Bn$BHVL\$K$"$k4X?t$r8F$S=P$9!#(B C$B8@8l$G=q$/$H!" long sys_call_table[NR_syscalls]; ... { long n = $B%7%9%F%`!&%3!<%k$NHV9f(B long f = sys_call_table[n]; (*f)( $B0z?t(B0, $B0z?t(B1, $B0z?t(B2 ); // $B4X?t$H;W$C$F8F$V(B }

$B"!(Bsys_write()

 408:	SYSCALL_DEFINE3(write, unsigned int, fd, const char __user *, buf,
 409:	                size_t, count)
 410:	{
 411:	        struct file *file;
 412:	        ssize_t ret = -EBADF;
 413:	        int fput_needed;
 414:	
 415:	        file = fget_light(fd, &fput_needed);
 416:	        if (file) {
 417:	                loff_t pos = file_pos_read(file);
 418:	                ret = vfs_write(file, buf, count, &pos);
 419:	                file_pos_write(file, pos);
 420:	                fput_light(file, fput_needed);
 421:	        }
 422:	
 423:	        return ret;
 424:	}

asmlinkage long sys_write(unsigned int fd, const char __user *buf,
	   	size_t count)
{
	$B>JN,(B
}

• $B:#F|$O(B sys_write() $B$NFbMF$O!"@bL@$7$J$$!#(B
• write() $B%7%9%F%`!&%3!<%k$O!"(Bfs/read_write.c $B$NCf$N(B sys_write() $B4X?t$G=hM}$5$l$k!#(B
• sys_write() $B$H$$$&L>A0$O!"(BSYSCALL_DEFINE3() $B$H$$$&%^%/%m$G:n$i$l$k!#(B 3 $B$O!"(B3$B0z?t$N0UL#!#IaDL$O(B 0 $B0z?t(B 5 $B0z?t$^$G!#(B
• $B%^%/%m$K$h$j!"%7%9%F%`!&%3!<%k$r=hM}$9$k4X?t$K$O!"(Basmlinkage $B$H$$(B $B$&%-!<%o!<%I(B($B%3%s%Q%$%i$X$N;X<((B(directive))$B$,IU$/!#(BC$B%3%s%Q%$%i$O!"%"%;(B $B%s%V%j8@8l$+$i$N8F$S=P$7$,4JC1$K$J$k$h$&$J%3!<%I$r=PNO$9$k!#(B
• $B%(%i!<$NHV9f$O!"%(%i!.$5$$@5$N@0?t!#BgJ8;z(B E $B$G;O(B $B$^$kL>A0!J%^%/%m!K$,IU$1$i$l$F$$$k!#(B $BDj5A$O!"(B <errno.h> (include/asm-generic/errno-base.h) $BEy$K4^$^$l$F$$(B $B$k!#(B
• $B%7%9%F%`!&%3!<%k$N=hM}$r$9$k4X?t(B sys_xxx() $B$O!"@.8y$9$k$H(B $B@5$NCM$rJV$9!#(B $B%(%i!<$,H/@8$9$k$H!"%+!<%M%kFb$G$O!"%(%i!<(B $BHV9f$rIi$NCM$K$7$?$b$N$rJV$9!#(B
• $B%7%9%F%`!&%3!<%k$N7k2L$O!"%f!<%66u4V$K$O(BCPU$B$N%l%8%9%?$d(BCPU$B$N%U%i%0(B $B!J>r7oJ,4t$K;H$&$b$N!K$KF~$l$FJV$5$l$k!#(B
• $B%f!<%66u4V$G%7%9%F%`!&%3!<%k$O!"@.8y$9$k$H!"(B 0$B0J>e$NCM$rJV$9!#<:GT$9$k$H!"Ii$NCM(B(-1) $BEy$rJV$9!#(B
• $B%f!<%66u4V$G%7%9%F%`!&%3!<%k$N%(%i!errno $B$r8+$k$HJ,$+$k!#(B ($B%^%k%A%9%l%C%I$N%W%m%0%i%`$G$O!"%9%l%C%I8GM-%G!<%?(B) x86-32 $B$G$O!"(B__syscall_error $B$H$$$&errno $B$K(B $B%;%C%H$9$k!#(B write()$B%7%9%F%`!&%3!<%k(B($B%f!<%66u4V(B) $B;2>H!#(B

$B"!%(%i!

...
   4:	#define EPERM            1      /* Operation not permitted */
   5:	#define ENOENT           2      /* No such file or directory */
   6:	#define ESRCH            3      /* No such process */
   7:	#define EINTR            4      /* Interrupted system call */
   8:	#define EIO              5      /* I/O error */
   9:	#define ENXIO            6      /* No such device or address */
  10:	#define E2BIG            7      /* Argument list too long */
  11:	#define ENOEXEC          8      /* Exec format error */
  12:	#define EBADF            9      /* Bad file number */
  13:	#define ECHILD          10      /* No child processes */
...

$B"!(BSYSCALL_DEFINE$B%^%/%m(B

 188:	#define SYSCALL_DEFINE0(name)      asmlinkage long sys_##name(void)
...
 191:	#define SYSCALL_DEFINE1(name, ...) SYSCALL_DEFINEx(1, _##name, __VA_ARGS__)
 192:	#define SYSCALL_DEFINE2(name, ...) SYSCALL_DEFINEx(2, _##name, __VA_ARGS__)
 193:	#define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__)
 194:	#define SYSCALL_DEFINE4(name, ...) SYSCALL_DEFINEx(4, _##name, __VA_ARGS__)
 195:	#define SYSCALL_DEFINE5(name, ...) SYSCALL_DEFINEx(5, _##name, __VA_ARGS__)
 196:	#define SYSCALL_DEFINE6(name, ...) SYSCALL_DEFINEx(6, _##name, __VA_ARGS__)
...
 223:	#define SYSCALL_DEFINEx(x, sname, ...)                          \
 224:	        __SYSCALL_DEFINEx(x, sname, __VA_ARGS__)
...
 245:	#define __SYSCALL_DEFINEx(x, name, ...)                                 \
 246:	        asmlinkage long sys##name(__SC_DECL##x(__VA_ARGS__))

• $B%^%/%m$K$h$j!"%7%9%F%`!&%3!<%k$r=hM}$9$k4X?t$K$O!"(B $B!V(Bsys_$B!W(B $B$H$$$&%W%l%U%#%C%/%9$,IU$1$i$l$k!#(B $B!V(B##$B!W(B $B$O!"(BC$B%W%j%W%m%;%C%5$NL?Na$G!"J8;zNs$N7k9g$r0UL#$9$k!#(B

$B"!%7%9%F%`!&%3!<%k$N

$ strace ./hello 
execve("./hello", ["./hello"], [/* 38 vars */]) = 0
brk(0)                                  = 0x83a3000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=169180, ...}) = 0
mmap2(NULL, 169180, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7f67000
close(3)                                = 0
open("/lib/libc.so.6", O_RDONLY)        = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\340_\222\0004\0\0\0"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1689640, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f66000
mmap2(0x910000, 1410500, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x910000
mmap2(0xa63000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x152) = 0xa63000
mmap2(0xa66000, 9668, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xa66000
close(3)                                = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f65000
set_thread_area({entry_number:-1 -> 6, base_addr:0xb7f656c0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0
mprotect(0xa63000, 8192, PROT_READ)     = 0
mprotect(0x83d000, 4096, PROT_READ)     = 0
munmap(0xb7f67000, 169180)              = 0
fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 1), ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f90000
write(1, "hello, world!\n", 14hello, world!
)         = 14
exit_group(14)                          = ?
$ 

$ ./hello  
hello, world!
$ ltrace ./hello 
__libc_start_main(0x80483a4, 1, 0xbf8d3764, 0x80483f0, 0x80483e0 
printf("hello, %s!\n", "world"hello, world!
)                  = 14
+++ exited (status 14) +++
$ 

$ gdb hello 
$B>JN,(B
(gdb) b main        # $B%V%l!<%/%]%$%s%H$N@_Dj(B
Breakpoint 1 at 0x80483b2
(gdb) r             # $BJN,(B/hello 
Breakpoint 1, 0x080483b2 in main ()
(gdb) b write       # $B%V%l!<%/%]%$%s%H$N@_Dj(B
Breakpoint 2 at 0x9d2b80
(gdb) c             # $Bbt            # $B%P%C%/%H%l!<%9(B
#0  0x009d2b80 in write () from /lib/libc.so.6
$B>JN,(B
#6  0x0094c271 in vfprintf () from /lib/libc.so.6
#7  0x00955e83 in printf () from /lib/libc.so.6
#8  0x080483c9 in main ()
(gdb) c             # $B



$B"!$=$NB>$N%W%m%;%9$rD4$Y$k%3%^%s%I(B


 ktrace (FreeBSD, MacOSX 10.4)
 dtrace, dtruss (Solaris, MacOSX 10.5$B0J9_(B)
 truss (Solaris, System V Unix)


$B"#%/%$%:(B1
 $B%7%9%F%`%3!<%k$H(BLinux$B%+!<%M%k$N%=!<%9(B

$B!zLdBj(B(101) $B%7%9%F%`!&%3!<%k$H%i%$%V%i%j4X?t$N6&DLE@(B

C$B8@8l$G%W%m%0%i%`$r:n@.$9$k>l9g!"%7%9%F%`!&%3!<%k$H%i%$%V%i%j4X?t$N6&DL(B
$BE@$r=R$Y$J$5$$!#(B

$B!zLdBj(B(102) $B%7%9%F%`!&%3!<%k$H%i%$%V%i%j4X?t$NAj0cE@(B

$B%7%9%F%`!&%3!<%k$H%i%$%V%i%j4X?t$NAj0cE@$r=R$Y$J$5$$!#(B

$B!zLdBj(B(103) close()$B%7%9%F%`%3!<%k$N0z?t$H7k2L(B

close() $B%7%9%F%`!&%3!<%k$N%^%K%e%"%k$K$O!"
CLOSE(2)                   Linux Programmer's Manual                  CLOSE(2)
NAME
       close - close a file descriptor
SYNOPSIS
       #include <unistd.h>
       int close(int fd);
DESCRIPTION
       close()  closes  a  file descriptor, so that it no longer refers to any
       file and may be reused.  Any record locks (see fcntl(2))  held  on  the
       file  it  was  associated  with,  and owned by the process, are removed
       (regardless of the file descriptor that was used to obtain the lock).
...

$B0z?t$H7k2L$N@k8@(B
{
   /*$BFbMF(B*/
}