A Linux kernel syscall implementation tracker

Okay, this is super cool. Thanks for sharing.

In a similar vein, jart's Cosmopolitan libc has a really fun collection of tables that compare various constants across platforms, e.g. syscalls, syscall flags, error numbers, etc. It includes (variants of) Linux, XNU, NT, and the BSDs.

https://github.com/jart/cosmopolitan/blob/master/libc/sysv/c...

In the off chance you haven't heard of Cosmopolitan yet, I hope you find the discovery as much fun as I have.

I wish this site could have existed earlier when I was writing eBPF filters for my sandbox and had to check how specific syscalls were implemented in different archs here and there. Thanks for your great work.

This is SUCH a good tool! Thank you!!

I've been using other tables but they were always incomplete and often x86_64 only. This one contains everything: number, symbol, links to kernel implementation, signature, user space ABI registers. And I can select kernel version, kernel binary interface and processor architecture!

I'm very interested in how you are collecting or generating all this information. Please post details on the process. I need similar information in order to compile system call tables into lone, my own programming language which features direct Linux system call support.

I use scripts that parse the information out of Linux user space API headers: the compiler prints all the preprocessor definitions from linux/unistd.h, the "SYS_" definitions are selected and then turned into a C array initializer for a number/name structure.

  # makefile
  $(call source_to_object,source/lone/lisp/modules/intrinsic/linux.c): $(targets.NR.c)

  $(targets.NR.c): $(targets.NR.list) scripts/NR.generate
      scripts/NR.generate < $< > $@

  $(targets.NR.list): scripts/NR.filter
      $(CC) -E -dM -include linux/unistd.h - < /dev/null | scripts/NR.filter > $@

  # scripts/NR.filter
  grep __NR_ | sed 's/#define //g' | cut -d ' ' -f 1

  # scripts/NR.generate
  # generates C array initializers like:
  #     { "read", __NR_read },
  while read -r NR; do
    printf '{ "%s", %s },\n' "${NR#__NR_}" "${NR}"
  done

  // source/lone/lisp/modules/intrinsic/linux.c

  static struct linux_system_call {
      char *symbol;
      lone_lisp_integer number;
  } linux_system_calls[] = {

      /* huge generated array initializer
       * with all the system calls found
       * on the host platform
       */
      #include <lone/lisp/modules/intrinsic/linux/NR.c>
  };

This is good. Usually I end up finding one I think Google made for Chromebooks. Or even worse, restoring to the man page.

Is there a reason syscall numbers don’t match up between architectures?

Or is it just a quirk of history?

Missing RISC-V

This is neat! Finally someone who added all the information I need :)

Only 357 syscalls in 6.0. Don't know why, but I thought there would be more.

There's a few of these floating around that are generally missing something - recent syscalls, types, etc. Thank you for such a complete one!

Thanks! This is great. If you ever need extra housing for this, I would be glad to provide it.

I've wished for a complete version like this for so long. Great work. Thank you!

Can you make one for kernel exports and list whether they are GPL-only or not?

similarly, does a Windows syscall tracker exist?

From this I learned about Landlock, thanks!

What API is the most common for x86-64bit?

removed

That's handy.

I wonder why it displays without javascript in chromium, but fails to do so in firefox. If the author is here, could that be fixed?

Edit:

Restarting chromium and trying again yields the same behavior as firefox. I wonder if the javascript somehow slipped past umatrix & ublock origin on my first try. Given that I launched chromium by dragging the link onto its icon the first time, perhaps the script-blocking extensions weren't fully loaded?

Testing again several more times, that does seem likely. I can reproduce it intermittently by dragging the URL onto my chromium shortcut if chromium isn't already running.

Edit 2: Sure enough:

https://github.com/gorhill/uBlock/issues/1913

https://github.com/gorhill/uBlock/issues/1327