Syscall Table

System calls (syscalls) are the fundamental interface between user-space programs and the Linux kernel. Every operation that requires kernel privilege — file I/O, process creation, network communication, memory management — goes through a system call. This chapter documents the x86_64 syscall table, common syscall signatures, and how to find and use syscall numbers.

Introduction

A system call is a controlled entry point into the kernel. When a user-space program needs to perform a privileged operation, it invokes a syscall using a specific instruction (syscall on x86_64), which switches the CPU from user mode to kernel mode.

graph LR
    A[User-space program] -->|syscall instruction| B[Kernel syscall handler]
    B --> C[syscall table lookup]
    C --> D[Execute kernel function]
    D --> E[Return result]
    E -->|ret from syscall| A
    
    F[syscall number in RAX] --> C
    G[args in RDI,RSI,RDX,R10,R8,R9] --> D

Calling Convention (x86_64)

On error, the return value in RAX is a negative errno (e.g., -ENOENT = -2).

Finding Syscall Numbers

From Header Files

# The authoritative source
cat /usr/include/asm/unistd_64.h
# or
cat /usr/include/x86_64-linux-gnu/asm/unistd_64.h

# Example output:
# #define __NR_read 0
# #define __NR_write 1
# #define __NR_open 2
# #define __NR_close 3
# ...

Using ausyscall (audit tools)

# Install audit tools
sudo apt install auditd

# Look up a syscall number
ausyscall x86_64 read
# Output: read      0

# Look up by number
ausyscall x86_64 0
# Output: read      0

# List all syscalls
ausyscall x86_64 --dump | head -20

Using the Source

# The syscall table in kernel source
# arch/x86/entry/syscalls/syscall_64.tbl

# Download kernel source
wget https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.1.tar.xz
tar xf linux-6.1.tar.xz
cat linux-6.1/arch/x86/entry/syscalls/syscall_64.tbl | head -30

Using strace

# Trace syscalls of a program
strace ls
# Output includes syscall names and arguments:
# openat(AT_FDCWD, ".", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
# getdents64(3, /* 25 entries */, 32768)    = 1080
# write(1, "file1.txt  file2.txt\n", 20)    = 20

# Show syscall numbers
strace -e raw=all ls 2>&1 | head -10

# Trace specific syscalls
strace -e trace=open,read,write ls

# Count syscalls
strace -c ls
# % time     seconds  usecs/call     calls    errors syscall
# ------ ----------- ----------- --------- --------- --------
#  45.00    0.000090           9        10           write
#  25.00    0.000050          12         4           mmap
#  ...

Using the Man Page

# Section 2 man pages document syscalls
man 2 syscall
man 2 syscalls    # Lists all syscalls

# Find the syscall number for a specific call
grep -r "__NR_open " /usr/include/asm/

x86_64 Syscall Table

File I/O (0–18)

Filesystem (76–94)

Process Management (56–62, 231)

Memory (9–12, 25–28)

Socket / Network (41–53)

Modern / Advanced

Common Syscall Examples

File I/O Example

#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>

int main() {
    // Equivalent syscalls: open, write, read, close
    int fd = open("/tmp/test.txt", O_WRONLY | O_CREAT | O_TRUNC, 0644);
    // Syscall: openat(AT_FDCWD, "/tmp/test.txt", O_WRONLY|O_CREAT|O_TRUNC, 0644) = 3

    write(fd, "Hello, World!\n", 14);
    // Syscall: write(3, "Hello, World!\n", 14) = 14

    close(fd);
    // Syscall: close(3) = 0

    // Reopen for reading
    fd = open("/tmp/test.txt", O_RDONLY);
    char buf[64];
    ssize_t n = read(fd, buf, sizeof(buf));
    // Syscall: read(3, "Hello, World!\n\0\0\0"..., 64) = 14

    close(fd);
    return 0;
}

Process Creation Example

#include <unistd.h>
#include <sys/wait.h>
#include <stdio.h>

int main() {
    // Syscall: clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|...) = <pid>
    pid_t pid = fork();

    if (pid == 0) {
        // Child process
        // Syscall: execve("/bin/ls", ["ls", "-l"], [env]) = 0
        execlp("ls", "ls", "-l", NULL);
    } else {
        // Parent process
        int status;
        // Syscall: wait4(<pid>, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = <pid>
        waitpid(pid, &status, 0);
        printf("Child exited with status %d\n", WEXITSTATUS(status));
    }
    return 0;
}

Socket Example

#include <sys/socket.h>
#include <netinet/in.h>
#include <unistd.h>
#include <string.h>

int main() {
    // Syscall: socket(AF_INET, SOCK_STREAM, IPPROTO_TCP) = 3
    int sockfd = socket(AF_INET, SOCK_STREAM, 0);

    struct sockaddr_in addr = {
        .sin_family = AF_INET,
        .sin_port = htons(8080),
        .sin_addr.s_addr = INADDR_ANY
    };

    // Syscall: bind(3, {sa_family=AF_INET, sin_port=htons(8080), ...}, 16) = 0
    bind(sockfd, (struct sockaddr*)&addr, sizeof(addr));

    // Syscall: listen(3, 128) = 0
    listen(sockfd, 128);

    // Syscall: accept4(3, ...) = 4
    int client = accept(sockfd, NULL, NULL);

    // Syscall: write(4, "Hello\n", 6) = 6
    write(client, "Hello\n", 6);

    // Syscall: close(4) = 0
    close(client);
    // Syscall: close(3) = 0
    close(sockfd);

    return 0;
}

Memory Mapping Example

#include <sys/mman.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

int main() {
    int fd = open("/tmp/mmap_test", O_RDWR | O_CREAT | O_TRUNC, 0644);
    ftruncate(fd, 4096);

    // Syscall: mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_SHARED, 3, 0) = 0x7f...
    void *addr = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);

    strcpy(addr, "Written via mmap!");

    // Syscall: msync(addr, 4096, MS_SYNC) = 0
    msync(addr, 4096, MS_SYNC);

    // Syscall: munmap(addr, 4096) = 0
    munmap(addr, 4096);

    close(fd);
    return 0;
}

Syscall Error Handling

Syscalls return -1 on error and set errno:

# Common errno values
EPERM (1)       — Operation not permitted
ENOENT (2)      — No such file or directory
EINTR (4)       — Interrupted system call
EIO (5)         — I/O error
EBADF (9)       — Bad file descriptor
ENOMEM (12)     — Out of memory
EACCES (13)     — Permission denied
EBUSY (16)      — Device or resource busy
EEXIST (17)     — File exists
ENOTDIR (20)    — Not a directory
EISDIR (21)     — Is a directory
EINVAL (22)     — Invalid argument
EMFILE (24)     — Too many open files
ENOSPC (28)     — No space left on device
EPIPE (32)      — Broken pipe
EAGAIN (11)     — Resource temporarily unavailable
ECONNREFUSED (111) — Connection refused
ETIMEDOUT (110) — Connection timed out

# View errno definitions
grep -r "define E" /usr/include/asm-generic/errno*.h | head -20

# strace shows errno on failure
strace cat /nonexistent 2>&1 | tail -5
# openat(AT_FDCWD, "/nonexistent", O_RDONLY) = -1 ENOENT (No such file or directory)
# ...
# +++ exited with 1 +++

Invoking Syscalls Directly

Inline Assembly (x86_64)

#include <stdio.h>

static inline long syscall_write(int fd, const void *buf, size_t count) {
    long ret;
    asm volatile (
        "syscall"
        : "=a"(ret)                    // Output: RAX → ret
        : "a"(1),                      // Input: syscall number (write = 1)
          "D"(fd),                     // RDI = fd
          "S"(buf),                    // RSI = buf
          "d"(count)                   // RDX = count
        : "rcx", "r11", "memory"       // Clobbered registers
    );
    return ret;
}

int main() {
    syscall_write(1, "Direct syscall!\n", 16);
    return 0;
}

Using the syscall() Wrapper

#include <sys/syscall.h>
#include <unistd.h>
#include <stdio.h>

int main() {
    // Write "Hello" to stdout using syscall(2)
    syscall(SYS_write, 1, "Hello\n", 6);

    // Get PID
    pid_t pid = syscall(SYS_getpid);
    printf("PID: %d\n", pid);

    // Allocate memory
    void *p = syscall(SYS_mmap, NULL, 4096,
                      PROT_READ | PROT_WRITE,
                      MAP_PRIVATE | MAP_ANONYMOUS,
                      -1, 0);
    printf("Mapped at: %p\n", p);

    return 0;
}

Seccomp and Syscall Filtering

Seccomp allows restricting which syscalls a process can use:

#include <linux/seccomp.h>
#include <linux/filter.h>
#include <linux/audit.h>
#include <sys/prctl.h>
#include <stddef.h>

// BPF filter: allow only read, write, exit, exit_group
struct sock_filter filter[] = {
    // Load syscall number
    BPF_STMT(BPF_LD | BPF_W | BPF_ABS, offsetof(struct seccomp_data, nr)),
    // Allow read (0)
    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_read, 0, 1),
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
    // Allow write (1)
    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_write, 0, 1),
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
    // Allow exit_group (231)
    BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, __NR_exit_group, 0, 1),
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_ALLOW),
    // Deny everything else
    BPF_STMT(BPF_RET | BPF_K, SECCOMP_RET_KILL),
};

# Check seccomp status of a process
grep Seccomp /proc/self/status
# Seccomp:        0
# Seccomp_filters: 0

# Docker uses seccomp profiles
docker run --security-opt seccomp=profile.json alpine

io_uring — Modern Async I/O

io_uring (kernel 5.1+) provides high-performance asynchronous I/O:

# Check kernel support
grep io_uring /proc/kallsyms | head -5

# io_uring syscalls:
# io_uring_setup(2)  — Create ring
# io_uring_enter(2)  — Submit/wait
# io_uring_register(2) — Register buffers/files

# System requirements: kernel 5.1+
uname -r

Cross-References

• Glossary — Definitions of terms used here
• Man Pages — Section 2 (system calls) documentation
• Kernel Config — CONFIG_* options enabling syscalls
• Commands Reference — strace, ltrace, and debugging tools
• Further Reading — Kernel internals resources

Further Reading

• The Linux Kernel Documentation

• LWN.net - Linux and free software news

• GNU Project Documentation

• GNU Manuals

• Free Software Directory

• Planet GNU

• Free Software Books

• syscalls(2) — Linux man page listing all system calls

• Linux Syscall Reference

• Chromium Linux Syscall Reference

• Linux Kernel Source — syscall_64.tbl

• io_uring documentation

• strace(1) — trace system calls