How can I get a list of Linux system calls and num

Question

I writing a Linux system call map for the radare2 debugger. This means providing a huge static array mapping system call number to a syscall name name and the number of arguments it takes. This was easy for OpenBSD as the syscall numbers are defined in sys/syscall.h and in a comment above each is the number of args. It was just a matter of writing a script to parse this and throw out the C code for the array.

On linux however, we do not have this luxury. It is easy to get the syscall number from the kernel headers, but how should I get the number of args? The only ideas I have are:

1) Type them in manually. For each and every arch (they vary between arches in linux). All 300+ of the damned things. No way!

2) Parse manual pages.

3) Write a script which tries to call each syscall with 0, 1, 2... args until the program builds. Won't work for varargs, but do syscalls support that?

There has to be a better way. Please help!

Answer 1

Documentation parsing:

http://asm.sourceforge.net/syscall.html Parse the HTML inside the <pre> tags.

or

http://syscalls.kernelgrok.com/ Convert JSON http://syscalls.kernelgrok.com/syscalls-2.6.35.4.js

Answer 2

This post is worth reading. Hope this helps :)

Answer 3

The only list I know is the kernel source, in include/linux/syscalls.h. But that is only by name, not number; I think you need to use the syscall.h header for your particular platform to get the numbers. And there are a few #ifdefs in that file...

Answer 4

ausyscall - a program that allows mapping syscall names and numbers

Answer 5

There are system calls with variable numbers of arguments - witness the open() call at the C level, where the third parameter is optional (might not be optional at the assembler level).

Your best bet might be to find the system calls identified by name in syscalls.h in the (preprocessed) source of the other system headers. From those, you can count the number of arguments. Just getting the right headers in place might be tricky, and there might conceivably be system calls that are never exposed as C functions directly (I haven't looked to see; it is fairly unlikely, though).

You might look at how another debugger, such as GDB, does the same job.

Answer 6

strace (home page) has tables with all this stuff in (see linux/<platform>/syscallent.h). Source code available in GitHub/strace and GitLab/strace. For example, list of syscalls in x86_64 architecture are in this link.