I used to analyze the system calls produced by a program in Linux
using the strace
tool which is quite useful. We can clearly see all the four categories presented by Modern Operating Systems(Tanenbaum et al., 2022): process management, file management, directory management, miscellaneous calls.
Now I want to do the same for QNX
and that's a bit painful since QNX does not seem to provide a full tool for this purpose.
QNX provides tracelogger
in https://www.qnx.com/developers/docs/7.1/#com.qnx.doc.sat/topic/datacapture.html
The problem with this tool is that it's not quite complete.
I believe I need to customize it somehow, but the results are not quite straightforward as Linux's strace.
Can you please give me your insights so that I can follow a better approach?
After some investigation, I finally could find and validate what QNX provides, an IDE called Momentics that can receive as input a .kev file output by tracelogger: https://www.qnx.com/products/neutrino-rtos/qnx-momentics.html
The tool is very slow, but with some pain, we can read and filter all the kernel traces by the following categories:
Communication
Control Events
Interrups
Process and Thread
System
I was expecting a big list of actual system calls, since QNX is a Microkernel, but since it's also POSIX compliant and mainly due to performance in a real time system (context switches are expensive), the list of actual system calls is actually very few as we can confirm in the Momentics IDE:
Overview on QNX Kernel Calls (https://www.qnx.com/developers/docs/7.1/#com.qnx.doc.sat/topic/events_Kernel_call_class.html):
_NTO_TRACE_KERCALLENTER and _NTO_TRACE_KERCALLEXIT: entrances to and exits from kernel calls.
_NTO_TRACE_KERCALLINT: interrupted kernel calls. No _NTO_TRACE_KERCALLEXIT is logged.
_NTO_TRACE_KERCALL: pseudo-class that comprises all the above classes. The traceprinter labels for these classes are KER_CALL, KER_EXIT, and INT_CALL, followed by an uppercase version of the kernel call; the IDE labels consist of the kernel call, followed by Enter, Exit, or INT. Event type is ORed with _NTO_TRACE_KERCALL64 (for 64-bit data types).