RYAN A.

CHAPMAN

LATEST POST BROWSE POSTS

LINUX SYSTEM CALL TABLE FOR

X86 64
PUBLISHED THU, NOV 29, 2012

Linux 4.7 (pulled from github.com/torvalds/linux on Jul 20 2016), x86_64

Note: 64-bit x86 uses syscall instead of interrupt 0x80. The result value will be in %rax

To find the implementation of a system call, grep the kernel tree for SYSCALL_DEFINE.\?
(syscall,

For example, to find the read system call:

illusion:/usr/src/linux-source-3.19$ grep -rA3 'SYSCALL_DEFINE.\?(read,' *

fs/read_write.c:SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count)
fs/read_write.c-{
fs/read_write.c- struct file *file;
fs/read_write.c- ssize_t ret = -EBADF;

The results show that the implementation is in fs/read_write.c and that it takes 3 arguments
(thus SYSCALL_DEFINE3).

Linux Cross Reference is another good tool for finding information about system calls.

Refer to the syscall numbers in arch/x86/entry/syscalls/syscall_64.tbl to determine if the table

below is out of date

By the way, the system call numbers are different for 32-bit x86. A system call table for i386 (32-
bit) can be found at http://docs.cs.up.ac.za/programming/asm/derick_tut/syscalls.html

Information on the order of registers can be found on page 124 of the x86_64 ABI paper at
http://www.x86-64.org/documentation/abi.pdf

%rax System call %rdi %rsi %rdx %r10

0 sys_read unsigned int fd char *buf size_t count

1 sys_write unsigned int fd const char *buf size_t count

const char
2 sys_open int flags int mode
*filename

3 sys_close unsigned int fd

const char struct stat

4 sys_stat
*filename *statbuf

struct stat
5 sys_fstat unsigned int fd
*statbuf

fconst char struct stat

6 sys_lstat
*filename *statbuf
7 sys_poll struct poll_fd unsigned int nfds long
*ufds timeout_msecs

unsigned int
8 sys_lseek unsigned int fd off_t offset
origin

unsigned long unsigned long unsigned

9 sys_mmap unsigned long len
addr prot long flags

unsigned long unsigned long

10 sys_mprotect size_t len
start prot

unsigned long
11 sys_munmap size_t len
addr

12 sys_brk unsigned long brk

const struct struct sigaction size_t

13 sys_rt_sigaction int sig
sigaction *act *oact sigsetsize

size_t
14 sys_rt_sigprocmask int how sigset_t *nset sigset_t *oset
sigsetsize

unsigned long
15 sys_rt_sigreturn
__unused

16 sys_ioctl unsigned int fd unsigned int cmd unsigned long arg

17 sys_pread64 unsigned long fd char *buf size_t count loff_t pos

18 sys_pwrite64 unsigned int fd const char *buf size_t count loff_t pos

const struct iovec unsigned long

19 sys_readv unsigned long fd
*vec vlen

const struct iovec unsigned long

20 sys_writev unsigned long fd
*vec vlen

const char
21 sys_access int mode
*filename

22 sys_pipe int *filedes

23 sys_select int n fd_set *inp fd_set *outp fd_set*exp

24 sys_sched_yield

unsigned long unsigned long unsigned long unsigned

25 sys_mremap
addr old_len new_len long flags

unsigned long
26 sys_msync size_t len int flags
start

unsigned long unsigned char

27 sys_mincore size_t len
start *vec

unsigned long
28 sys_madvise size_t len_in int behavior
start

29 sys_shmget key_t key size_t size int shmflg

30 sys_shmat int shmid char *shmaddr int shmflg

struct shmid_ds
31 sys_shmctl int shmid int cmd
*buf

32 sys_dup unsigned int fildes

33 sys_dup2 unsigned int oldfd

 unsigned int
newfd

34 sys_pause

struct timespec struct timespec

35 sys_nanosleep
*rqtp *rmtp

struct itimerval
36 sys_getitimer int which
*value

unsigned int
37 sys_alarm
seconds

struct itimerval struct itimerval

38 sys_setitimer int which
*value *ovalue

39 sys_getpid

40 sys_sendfile int out_fd int in_fd off_t *offset size_t count

41 sys_socket int family int type int protocol

struct sockaddr
42 sys_connect int fd int addrlen
*uservaddr

struct sockaddr int

43 sys_accept int fd
*upeer_sockaddr *upeer_addrlen

unsigned
44 sys_sendto int fd void *buff size_t len
flags

unsigned
45 sys_recvfrom int fd void *ubuf size_t size
flags

struct msghdr
46 sys_sendmsg int fd unsigned flags
*msg

struct msghdr
47 sys_recvmsg int fd unsigned int flags
*msg

48 sys_shutdown int fd int how

struct sokaddr
49 sys_bind int fd int addrlen
*umyaddr

50 sys_listen int fd int backlog

struct sockaddr int

51 sys_getsockname int fd
*usockaddr *usockaddr_len

struct sockaddr int

52 sys_getpeername int fd
*usockaddr *usockaddr_len

int
53 sys_socketpair int family int type int protocol
*usockvec

54 sys_setsockopt int fd int level int optname char *optval

55 sys_getsockopt int fd int level int optname char *optval

unsigned long unsigned long void

56 sys_clone void *parent_tid
clone_flags newsp *child_tid

57 sys_fork

58 sys_vfork

59 sys_execve const char const char *const const char *const

*filename argv[] envp[]
60 sys_exit int error_code

struct
61 sys_wait4 pid_t upid int *stat_addr int options
rusage *ru

62 sys_kill pid_t pid int sig

struct
63 sys_uname old_utsname
*name

64 sys_semget key_t key int nsems int semflg

struct sembuf
65 sys_semop int semid unsigned nsops
*tsops

union
66 sys_semctl int semid int semnum int cmd
semun arg

67 sys_shmdt char *shmaddr

68 sys_msgget key_t key int msgflg

struct msgbuf
69 sys_msgsnd int msqid size_t msgsz int msgflg
*msgp

struct msgbuf
70 sys_msgrcv int msqid size_t msgsz long msgtyp
*msgp

struct msqid_ds
71 sys_msgctl int msqid int cmd
*buf

72 sys_fcntl unsigned int fd unsigned int cmd unsigned long arg

73 sys_flock unsigned int fd unsigned int cmd

74 sys_fsync unsigned int fd

75 sys_fdatasync unsigned int fd

76 sys_truncate const char *path long length

unsigned long
77 sys_ftruncate unsigned int fd
length

struct linux_dirent unsigned int

78 sys_getdents unsigned int fd
*dirent count

79 sys_getcwd char *buf unsigned long size

const char
80 sys_chdir
*filename

81 sys_fchdir unsigned int fd

const char const char

82 sys_rename
*oldname *newname

const char
83 sys_mkdir int mode
*pathname

const char
84 sys_rmdir
*pathname

const char
85 sys_creat int mode
*pathname

const char const char

86 sys_link
*oldname *newname
87 sys_unlink const char
*pathname

const char const char

88 sys_symlink
*oldname *newname

89 sys_readlink const char *path char *buf int bufsiz

const char
90 sys_chmod mode_t mode
*filename

91 sys_fchmod unsigned int fd mode_t mode

const char
92 sys_chown uid_t user gid_t group
*filename

93 sys_fchown unsigned int fd uid_t user gid_t group

const char
94 sys_lchown uid_t user gid_t group
*filename

95 sys_umask int mask

struct timezone
96 sys_gettimeofday struct timeval *tv
*tz

unsigned int
97 sys_getrlimit struct rlimit *rlim
resource

98 sys_getrusage int who struct rusage *ru

struct sysinfo
99 sys_sysinfo
*info

struct sysinfo
100 sys_times
*info

unsigned long unsigned

101 sys_ptrace long request long pid
addr long data

102 sys_getuid

103 sys_syslog int type char *buf int len

104 sys_getgid

105 sys_setuid uid_t uid

106 sys_setgid gid_t gid

107 sys_geteuid

108 sys_getegid

109 sys_setpgid pid_t pid pid_t pgid

110 sys_getppid

111 sys_getpgrp

112 sys_setsid

113 sys_setreuid uid_t ruid uid_t euid

114 sys_setregid gid_t rgid gid_t egid

115 sys_getgroups int gidsetsize gid_t *grouplist

116 sys_setgroups int gidsetsize gid_t *grouplist

117 sys_setresuid uid_t *ruid uid_t *euid uid_t *suid

118 sys_getresuid uid_t *ruid uid_t *euid uid_t *suid

119 sys_setresgid gid_t rgid gid_t egid gid_t sgid

120 sys_getresgid gid_t *rgid gid_t *egid gid_t *sgid

121 sys_getpgid pid_t pid

122 sys_setfsuid uid_t uid

123 sys_setfsgid gid_t gid

124 sys_getsid pid_t pid

cap_user_header_t cap_user_data_t
125 sys_capget
header dataptr

const
cap_user_header_t
126 sys_capset cap_user_data_t
header
data

127 sys_rt_sigpending sigset_t *set size_t sigsetsize

const sigset_t const struct size_t

128 sys_rt_sigtimedwait siginfo_t *uinfo
*uthese timespec *uts sigsetsize

129 sys_rt_sigqueueinfo pid_t pid int sig siginfo_t *uinfo

130 sys_rt_sigsuspend sigset_t *unewset size_t sigsetsize

131 sys_sigaltstack const stack_t *uss stack_t *uoss

struct utimbuf
132 sys_utime char *filename
*times

const char
133 sys_mknod umode_t mode unsigned dev
*filename

NOT
134 sys_uselib
IMPLEMENTED

unsigned int
135 sys_personality
personality

136 sys_ustat unsigned dev struct ustat *ubuf

const char
137 sys_statfs struct statfs *buf
*pathname

138 sys_fstatfs unsigned int fd struct statfs *buf

unsigned long unsigned long

139 sys_sysfs int option
arg1 arg2

140 sys_getpriority int which int who

141 sys_setpriority int which int who int niceval

struct
142 sys_sched_setparam pid_t pid sched_param
*param

struct
143 sys_sched_getparam pid_t pid sched_param
*param

144 sys_sched_setscheduler pid_t pid int policy

 struct
sched_param
*param

145 sys_sched_getscheduler pid_t pid

146 sys_sched_get_priority_max int policy

147 sys_sched_get_priority_min int policy

struct timespec
148 sys_sched_rr_get_interval pid_t pid
*interval

unsigned long
149 sys_mlock size_t len
start

unsigned long
150 sys_munlock size_t len
start

151 sys_mlockall int flags

152 sys_munlockall

153 sys_vhangup

unsigned long
154 sys_modify_ldt int func void *ptr
bytecount

const char const char

155 sys_pivot_root
*new_root *put_old

struct
156 sys__sysctl
__sysctl_args *args

unsigned long unsigned long unsigned

157 sys_prctl int option
arg2 arg3 long arg4

struct task_struct unsigned long

158 sys_arch_prctl int code
*task *addr

struct timex
159 sys_adjtimex
*txc_p

unsigned int
160 sys_setrlimit struct rlimit *rlim
resource

const char
161 sys_chroot
*filename

162 sys_sync

163 sys_acct const char *name

struct timezone
164 sys_settimeofday struct timeval *tv
*tz

unsigned
165 sys_mount char *dev_name char *dir_name char *type
long flags

166 sys_umount2 const char *target int flags

const char
167 sys_swapon int swap_flags
*specialfile

const char
168 sys_swapoff
*specialfile

169 sys_reboot int magic1 int magic2 unsigned int cmd void *arg

170 sys_sethostname char *name int len

171 sys_setdomainname char *name int len

struct pt_regs
172 sys_iopl unsigned int level
*regs

unsigned long unsigned long

173 sys_ioperm int turn_on
from num

REMOVED IN
174 sys_create_module
Linux 2.6

175 sys_init_module void *umod unsigned long len const char *uargs

const chat
176 sys_delete_module unsigned int flags
*name_user

REMOVED IN
177 sys_get_kernel_syms
Linux 2.6

REMOVED IN
178 sys_query_module
Linux 2.6

const char
179 sys_quotactl unsigned int cmd qid_t id void *addr
*special

NOT
180 sys_nfsservctl
IMPLEMENTED

NOT
181 sys_getpmsg
IMPLEMENTED

NOT
182 sys_putpmsg
IMPLEMENTED

NOT
183 sys_afs_syscall
IMPLEMENTED

NOT
184 sys_tuxcall
IMPLEMENTED

NOT
185 sys_security
IMPLEMENTED

186 sys_gettid

187 sys_readahead int fd loff_t offset size_t count

const char
188 sys_setxattr const char *name const void *value size_t size
*pathname

const char
189 sys_lsetxattr const char *name const void *value size_t size
*pathname

190 sys_fsetxattr int fd const char *name const void *value size_t size

const char
191 sys_getxattr const char *name void *value size_t size
*pathname

const char
192 sys_lgetxattr const char *name void *value size_t size
*pathname

193 sys_fgetxattr int fd const har *name void *value size_t size

const char
194 sys_listxattr char *list size_t size
*pathname

const char
195 sys_llistxattr char *list size_t size
*pathname
196 sys_flistxattr int fd char *list size_t size

const char
197 sys_removexattr const char *name
*pathname

const char
198 sys_lremovexattr const char *name
*pathname

199 sys_fremovexattr int fd const char *name

200 sys_tkill pid_t pid ing sig

201 sys_time time_t *tloc

struct
202 sys_futex u32 *uaddr int op u32 val timespec
*utime

unsigned long
203 sys_sched_setaffinity pid_t pid unsigned int len
*user_mask_ptr

unsigned long
204 sys_sched_getaffinity pid_t pid unsigned int len
*user_mask_ptr

NOT
205 sys_set_thread_area IMPLEMENTED.
Use arch_prctl

unsigned aio_context_t
206 sys_io_setup
nr_events *ctxp

207 sys_io_destroy aio_context_t ctx

struct
aio_context_t
208 sys_io_getevents long min_nr long nr io_event
ctx_id
*events

aio_context_t struct iocb

209 sys_io_submit long nr
ctx_id **iocbpp

aio_context_t struct io_event

210 sys_io_cancel struct iocb *iocb
ctx_id *result

NOT
211 sys_get_thread_area IMPLEMENTED.
Use arch_prctl

212 sys_lookup_dcookie u64 cookie64 long buf long len

213 sys_epoll_create int size

NOT
214 sys_epoll_ctl_old
IMPLEMENTED

NOT
215 sys_epoll_wait_old
IMPLEMENTED

unsigned long unsigned long unsigned

216 sys_remap_file_pages unsigned long size
start prot long pgoff

struct
unsigned int
217 sys_getdents64 unsigned int fd linux_dirent64
count
*dirent

218 sys_set_tid_address int *tidptr

219 sys_restart_syscall

220 sys_semtimedop int semid unsigned nsops

 struct sembuf const struct
*tsops timespec
*timeout

221 sys_fadvise64 int fd loff_t offset size_t len int advice

const clockid_t struct sigevent timer_t

222 sys_timer_create
which_clock *timer_event_spec *created_timer_id

const struct struct

223 sys_timer_settime timer_t timer_id int flags itimerspec itimerspec
*new_setting *old_setting

struct itimerspec
224 sys_timer_gettime timer_t timer_id
*setting

225 sys_timer_getoverrun timer_t timer_id

226 sys_timer_delete timer_t timer_id

const clockid_t const struct

227 sys_clock_settime
which_clock timespec *tp

const clockid_t struct timespec

228 sys_clock_gettime
which_clock *tp

const clockid_t struct timespec

229 sys_clock_getres
which_clock *tp

struct
const clockid_t const struct
230 sys_clock_nanosleep int flags timespec
which_clock timespec *rqtp
*rmtp

231 sys_exit_group int error_code

struct epoll_event
232 sys_epoll_wait int epfd int maxevents int timeout
*events

struct
233 sys_epoll_ctl int epfd int op int fd epoll_event
*event

234 sys_tgkill pid_t tgid pid_t pid int sig

struct timeval
235 sys_utimes char *filename
*utimes

NOT
236 sys_vserver
IMPLEMENTED

unsigned long unsigned long unsigned

237 sys_mbind unsigned long len
start mode long *nmask

unsigned long unsigned long

238 sys_set_mempolicy int mode
*nmask maxnode

unsigned long unsigned long unsigned

239 sys_get_mempolicy int *policy
*nmask maxnode long addr

struct
const char
240 sys_mq_open int oflag mode_t mode mq_attr
*u_name
*u_attr

const char
241 sys_mq_unlink
*u_name

const char unsigned int

242 sys_mq_timedsend mqd_t mqdes size_t msg_len
*u_msg_ptr msg_prio
243 sys_mq_timedreceive mqd_t mqdes char *u_msg_ptr size_t msg_len unsigned int
*u_msg_prio

const struct
244 sys_mq_notify mqd_t mqdes sigevent
*u_notification

const struct
struct mq_attr
245 sys_mq_getsetattr mqd_t mqdes mq_attr
*u_omqstat
*u_mqstat

struct
unsigned long unsigned long unsigned
246 sys_kexec_load kexec_segment
entry nr_segments long flags
*segments

struct siginfo
247 sys_waitid int which pid_t upid int options
*infop

const char const void

248 sys_add_key const char *_type size_t plen
*_description *_payload

const char const char key_serial_t

249 sys_request_key const char *_type
*_description *_callout_info destringid

unsigned long unsigned long unsigned

250 sys_keyctl int option
arg2 arg3 long arg4

251 sys_ioprio_set int which int who int ioprio

252 sys_ioprio_get int which int who

253 sys_inotify_init

const char
254 sys_inotify_add_watch int fd u32 mask
*pathname

255 sys_inotify_rm_watch int fd __s32 wd

const
unsigned long const unsigned unsigned
256 sys_migrate_pages pid_t pid
maxnode long *old_nodes long
*new_nodes

const char
257 sys_openat int dfd int flags int mode
*filename

const char
258 sys_mkdirat int dfd int mode
*pathname

const char unsigned

259 sys_mknodat int dfd int mode
*filename dev

const char
260 sys_fchownat int dfd uid_t user gid_t group
*filename

const char struct timeval

261 sys_futimesat int dfd
*filename *utimes

const char struct stat

262 sys_newfstatat int dfd int flag
*filename *statbuf

const char
263 sys_unlinkat int dfd int flag
*pathname

const char const char

264 sys_renameat int oldfd int newfd
*oldname *newname

265 sys_linkat int oldfd int newfd

 const char const char
*oldname *newname

const char const char

266 sys_symlinkat int newfd
*oldname *newname

const char
267 sys_readlinkat int dfd char *buf int bufsiz
*pathname

const char
268 sys_fchmodat int dfd mode_t mode
*filename

const char
269 sys_faccessat int dfd int mode
*filename

270 sys_pselect6 int n fd_set *inp fd_set *outp fd_set *exp

const
struct timespec
271 sys_ppoll struct pollfd *ufds unsigned int nfds sigset_t
*tsp
*sigmask

unsigned long
272 sys_unshare
unshare_flags

struct
273 sys_set_robust_list robust_list_head size_t len
*head

struct
274 sys_get_robust_list int pid robust_list_head size_t *len_ptr
**head_ptr

loff_t
275 sys_splice int fd_in loff_t *off_in int fd_out
*off_out

unsigned int
276 sys_tee int fdin int fdout size_t len
flags

277 sys_sync_file_range long fd loff_t offset loff_t bytes long flags

const struct iovec unsigned long unsigned int

278 sys_vmsplice int fd
*iov nr_segs flags

unsigned long const void const int

279 sys_move_pages pid_t pid
nr_pages **pages *nodes

const char struct timespec

280 sys_utimensat int dfd int flags
*filename *utimes

struct epoll_event
281 sys_epoll_pwait int epfd int maxevents int timeout
*events

sigset_t
282 sys_signalfd int ufd size_t sizemask
*user_mask

283 sys_timerfd_create int clockid int flags

284 sys_eventfd unsigned int count

285 sys_fallocate long fd long mode loff_t offset loff_t len

struct
const struct
286 sys_timerfd_settime int ufd int flags itimerspec
itimerspec *utmr
*otmr

struct itimerspec
287 sys_timerfd_gettime int ufd
*otmr
288 sys_accept4 int fd struct sockaddr int int flags
*upeer_sockaddr *upeer_addrlen

sigset_t
289 sys_signalfd4 int ufd size_t sizemask int flags
*user_mask

290 sys_eventfd2 unsigned int count int flags

291 sys_epoll_create1 int flags

unsigned int
292 sys_dup3 unsigned int oldfd int flags
newfd

293 sys_pipe2 int *filedes int flags

294 sys_inotify_init1 int flags

const struct iovec unsigned long unsigned

295 sys_preadv unsigned long fd
*vec vlen long pos_l

const struct iovec unsigned long unsigned

296 sys_pwritev unsigned long fd
*vec vlen long pos_l

siginfo_t
297 sys_rt_tgsigqueueinfo pid_t tgid pid_t pid int sig
*uinfo

struct
298 sys_perf_event_open perf_event_attr pid_t pid int cpu int group_fd
*attr_uptr

struct msghdr unsigned int

299 sys_recvmmsg int fd unsigned int vlen
*mmsg flags

unsigned int
300 sys_fanotify_init unsigned int flags
event_f_flags

301 sys_fanotify_mark long fanotify_fd long flags __u64 mask long dfd

const struct struct

unsigned int
302 sys_prlimit64 pid_t pid rlimit64 rlimit64
resource
*new_rlim *old_rlim

struct file_handle
303 sys_name_to_handle_at int dfd const char *name int *mnt_id
*handle

struct file_handle
304 sys_open_by_handle_at int dfd const char *name int *mnt_id
*handle

clockid_t
305 sys_clock_adjtime struct timex *tx
which_clock

306 sys_syncfs int fd

struct mmsghdr unsigned int

307 sys_sendmmsg int fd unsigned int vlen
*mmsg flags

308 sys_setns int fd int nstype

struct
309 sys_getcpu unsigned *cpup unsigned *nodep getcpu_cache
*unused

const struct iovec unsigned long const struct

310 sys_process_vm_readv pid_t pid
*lvec liovcnt iovec *rvec

const struct iovec unsigned long const struct

311 sys_process_vm_writev pid_t pid
*lvec liovcnt iovcc *rvec

312 sys_kcmp pid_t pid1 pid_t pid2 int type

 unsigned
long idx1

const char __user

313 sys_finit_module int fd int flags
*uargs

struct sched_attr
314 sys_sched_setattr pid_t pid unsigned int flags
__user *attr

struct sched_attr unsigned int

315 sys_sched_getattr pid_t pid unsigned int size
__user *attr flags

const char
const char __user
316 sys_renameat2 int olddfd int newdfd __user
*oldname
*newname

const char __user

317 sys_seccomp unsigned int op unsigned int flags
*uargs

318 sys_getrandom char __user *buf size_t count unsigned int flags

const char __user

319 sys_memfd_create unsigned int flags
*uname_ptr

const char
unsigned long
320 sys_kexec_file_load int kernel_fd int initrd_fd __user
cmdline_len
*cmdline_ptr

union bpf_attr
321 sys_bpf int cmd unsigned int size
*attr

const char
const char __user
const char __user __user
322 stub_execveat int dfd *const __user
*filename *const
*argv
__user *envp

323 userfaultfd int flags

324 membarrier int cmd int flags

unsigned long
325 mlock2 size_t len int flags
start

loff_t __user loff_t __user

326 copy_file_range int fd_in int fd_out
*off_in * off_out

const struct iovec unsigned long unsigned

327 preadv2 unsigned long fd
__user *vec vlen long pos_l

const struct iovec unsigned long unsigned

328 pwritev2 unsigned long fd
__user *vec vlen long pos_l
2 Comments blog.rchapman.org 
1 Login

 Recommend 8 Sort by Best

Join the discussion…

LOG IN WITH OR SIGN UP WITH DISQUS ?

Name

Osqui • 6 months ago

Superb!! Thanks a lot! I can't understand why this information is isn't more wide-spread
△ ▽ • Reply •

Heinrich Hartmann • 7 months ago

Thx for writing this down!
△ ▽ • Reply •

ALSO ON BLOG.RCHAPMAN.ORG

Eclipse Remote System Explorer fails to connect Yubikey NEO for Physical Access Control

RYAN A. CHAPMAN

© 2016 / POWERED BY HUGO / BLOG SOURCE

GHOSTWRITER THEME BY JOLLYGOODTHEMES / PORTED TO HUGO BY JBUB