Where do you find the syscall table for Linux?
Could someone tell me the difference between these unistd files. Explain how unistd.h works? And what the best method for finding the syscall table?
5 Answers 5
When I’m investigating this kind of thing, I find it useful to ask the compiler directly (see Printing out standard C/GCC predefined macros in terminal for details):
printf SYS_read | gcc -include sys/syscall.h -E - This shows that the headers involved (on Debian) are /usr/include/x86_64-linux-gnu/sys/syscall.h , /usr/include/x86_64-linux-gnu/asm/unistd.h , /usr/include/x86_64-linux-gnu/asm/unistd_64.h , and /usr/include/x86_64-linux-gnu/bits/syscall.h , and prints the system call number for read , which is 0 on x86-64.
You can find the system call numbers for other architectures if you have the appropriate system headers installed (in a cross-compiler environment). For 32-bit x86 it’s quite easy:
printf SYS_read | gcc -include sys/syscall.h -m32 -E - which involves /usr/include/asm/unistd_32.h among other header files, and prints the number 3.
So from the userspace perspective, 32-bit x86 system calls are defined in asm/unistd_32.h , 64-bit x86 system calls in asm/unistd_64.h . asm/unistd_x32.h is used for the x32 ABI.
uapi/asm-generic/unistd.h lists the default system calls, which are used on architectures which don’t have an architecture-specific system call table.
In the kernel the references are slightly different, and are architecture-specific (again, for architectures which don’t use the generic system call table). This is where files such as arch/x86/entry/syscalls/syscall_64.tbl come in (and they ultimately end up producing the header files which are used in user space, unistd_64.h etc.). You’ll find a lot more detail about system calls in the pair of LWN articles on the topic, Anatomy of a system call part 1 and Anatomy of a system call part 2.