The system call is the fundamental interface between an application and the
Linux kernel. As of Linux 2.4.17, there are 1100 system calls listed in
/usr/src/linux/include/asm-*/unistd.h. This man page lists those that
are common to most platforms (providing hyperlinks if you read this with a
Of the above, 9 are obsolete, namely getrlimit, oldfstat, oldlstat, oldolduname,
oldstat, olduname, readdir, select and vm86old (see also obsolete(2)),
and 15 are unimplemented in the standard kernel, namely afs_syscall, break,
ftime, getpmsg, gtty, idle, lock, mpx, phys, prof, profil, putpmsg, security,
stty and ulimit (see also unimplemented(2)). However, ftime(3),
profil(3) and ulimit(3) exist as library routines. The slot for
phys is in use since 2.1.116 for umount; phys will never be implemented. The
getpmsg and putpmsg calls are for kernels patched to support streams, and may
never be in the standard kernel. The security call is for future use.
Roughly speaking, the code belonging to the system call with number __NR_xxx
defined in /usr/include/asm/unistd.h can be found in the kernel source
in the routine sys_xxx(). (The dispatch table for i386 can be found in
/usr/src/linux/arch/i386/kernel/entry.S.) There are many exceptions,
however, mostly because older system calls were superseded by newer ones, and
this has been treated somewhat unsystematically. On platforms with proprietary
OS emulation, such as parisc, sparc, sparc64 and alpha, there are many
additional system calls; mips64 also contains a full set of 32-bit system
calls. Below the details for Linux 2.4.17.
The defines __NR_oldstat and __NR_stat refer to the routines sys_stat() and
sys_newstat(), and similarly for fstat and lstat. Similarly, the
defines __NR_oldolduname, __NR_olduname and __NR_uname refer to the routines
sys_olduname(), sys_uname() and sys_newuname(). Thus, __NR_stat and __NR_uname
have always referred to the latest version of the system call, and the older
ones are for backward compatibility.
It is different with select and mmap. These use five or more
parameters, and caused problems the way parameter passing on the i386 used to
be set up. Thus, while other architectures have sys_select() and sys_mmap()
corresponding to __NR_select and __NR_mmap, on i386 one finds old_select() and
old_mmap() (routines that use a pointer to a parameter block) instead. These
days passing five parameters is not a problem any more, and there is a
__NR__newselect (used by libc 6) that corresponds directly to sys_select() and
Two other system call numbers, __NR__llseek and __NR__sysctl have an additional
underscore absent in sys_llseek() and sys_sysctl().
Then there is __NR_readdir corresponding to old_readdir(), which will read at
most one directory entry at a time, and is superseded by sys_getdents().
On many platforms, including i386, socket calls are all multiplexed through
socketcall() and System V IPC calls through ipc().
On newer platforms that only have 64-bit file access and 32-bit uids (e.g.
alpha, ia64, s390x) there are no *64 or *32 calls. Where the *64 and *32 calls
exist, the other versions are obsolete.
The chown and lchown system calls were swapped in 2.1.81. The *64 and *32 calls
were added for kernel 2.4, as were the new versions of getrlimit and mmap, and
the new calls pivot_root, mincore, madvise, security, gettid and