Syscall Coverage Ledger

Overview

This ledger is the authoritative inventory for the System Call Encyclopedia. It was generated from primary sources, not assembled from memory:

— means the interface does not exist for that architecture (this is meaningful: arm64 and other asm-generic architectures never had fork, open, pipe, stat or the old socket call variants — those exist only as libc compat wrappers).

Status vocabulary (defined in the encyclopedia overview): not-started → name inventoried only · researched → sources read, entry drafted · documented → full entry with signature, semantics, errors, security notes, references · source-limited → documented from fewer sources than the entry should have.

Scope caveats. The inventory reflects the kernel sources it was generated from (linux master, fall 2026). x32 variants (numbers ≥ 512 on x86_64) are tracked in the [x86_64 table itself] and mentioned in notes rather than as separate rows. Multiplexed interfaces (ioctl, fcntl, prctl, bpf, perf_event_open) get one ledger row each and their sub-interfaces live in the linked chapter pages. MIPS, parisc, powerpc, s390, sparc and alpha have their own per-architecture numbering tables which are not columns here (see the overview for how their tables relate); their absence from the numeric columns does not mean the syscall is absent on those architectures.

Ledger

Legend for numbers columns: x64 = x86_64, i386 = 32-bit x86, g64 = asm-generic 64-bit (arm64/riscv/loongarch), arm = arm32 EABI.

process

memory

desc-io

fs-mount

signal-time

sched-misc

net-ipc

Total classified rows: 535. Unclassified: 0.

Aliases, compat names and shared implementation paths

The rows above deliberately include historic and compat names so that coverage is not inflated or silently dropped. Cross-cutting notes:

• Name vs wrapper vs implementation. socketcall (i386) multiplexes the socket family behind one number; x86_64/arm64 have direct numbers. open on arm64 is a libc wrapper over openat. stat/lstat/fstat exist on x86_64 as direct calls (removed in newer kernels for i386) but arm64 only has newfstatat. The kernel implementation name (sys_read → __x64_sys_read → ksys_read) is unrelated to the public name.
• *64 and __NR3264_* pairs (pread64, truncate64, statfs64, …) exist because 32-bit architectures need explicit 64-bit offsets; 64-bit architectures reuse the base call (the asm-generic table expands __NR3264_* accordingly).
• time32 vs time64 variants (clock_gettime vs clock_gettime64, time32 abi rows in scripts/syscall.tbl) exist for 32-bit architectures facing the 2038 problem.
• Removed and never-everywhere calls (_sysctl, uselib, create_module, query_module, vm86, modify_ldt, old sigaction/signal, epoll_ctl_old, nis_* helpers) are kept in the ledger with their status instead of being dropped; several remain architecture-gated (x86 vm86, x86 modify_ldt).
• Shared implementation paths (documented in chapters, not extra rows): wait4/waitpid (libc wrapper), dup2/dup3, pipe/pipe2, epoll_wait/epoll_pwait*, stat/newfstatat, getdents/getdents64, sigaction/rt_sigaction, and the whole socket family on 32-bit via socketcall.

The Since column carries a small set of overrides verified during wave-1 documentation by kernel tag probes (noted in the chapter entries): cachestat 6.5, map_shadow_stack 6.6, mseal 6.10, set_mempolicy_home_node 5.17, pivot_root 2.3.41, futex_wait/ futex_wake/futex_requeue 6.14. Where the man-pages table and an individual man page disagree (e.g. mbind 2.6.6 vs 2.6.7, pkey_* 4.8 vs 4.9), the chapters cite both readings.

Unclassified names (triage queue)

The generator placed every inventoried name in a category; anything listed here was added to the sources after the category map was written and must be triaged into a chapter before its documentation starts.