Linux 3.2.0-33, x86_64
Note: 64-bit x86 uses syscall instead of interrupt 0x80. The result value will be in %rax
To find the implementation of a system call, grep the kernel tree for SYSCALL_DEFINE.\?(syscall,
For example, to find the read system call:
illusion:/usr/src/linux-source-3.2.0$ grep -rA3 'SYSCALL_DEFINE.\?(read,' * fs/read_write.c:SYSCALL_DEFINE3(read, unsigned int, fd, char __user *, buf, size_t, count) fs/read_write.c-{ fs/read_write.c- struct file *file; fs/read_write.c- ssize_t ret = -EBADF;
The results show that the implementation is in fs/read_write.c and that it takes 3 arguments (thus SYSCALL_DEFINE3).
Linux Cross Reference is another good tool for finding information about system calls.
By the way, the system call numbers are different for 32-bit x86. A system call table for i386 (32-bit) can be found at http://docs.cs.up.ac.za/programming/asm/derick_tut/syscalls.htm
%rax | System call | %rdi | %rsi | %rdx | %rcx | %r8 | %r9 |
0 | sys_read | unsigned int fd | char *buf | size_t count | |||
1 | sys_write | unsigned int fd | const char *buf | size_t count | |||
2 | sys_open | const char *filename | int flags | int mode | |||
3 | sys_close | unsigned int fd | |||||
4 | sys_stat | const char *filename | struct stat *statbuf | ||||
5 | sys_fstat | unsigned int fd | struct stat *statbuf | ||||
6 | sys_lstat | fconst char *filename | struct stat *statbuf | ||||
7 | sys_poll | struct poll_fd *ufds | unsigned int nfds | long timeout_msecs | |||
8 | sys_lseek | unsigned int fd | off_t offset | unsigned int origin | |||
9 | sys_mmap | unsigned long addr | unsigned long len | unsigned long prot | unsigned long flags | unsigned long fd | unsigned long off |
10 | sys_mprotect | unsigned long start | size_t len | unsigned long prot | |||
11 | sys_munmap | unsigned long addr | size_t len | ||||
12 | sys_brk | unsigned long brk | |||||
13 | sys_rt_sigaction | int sig | const struct sigaction *act | struct sigaction *oact | size_t sigsetsize | ||
14 | sys_rt_sigprocmask | int how | sigset_t *nset | sigset_t *oset | size_t sigsetsize | ||
15 | sys_rt_sigreturn | unsigned long __unused | |||||
16 | sys_ioctl | unsigned int fd | unsigned int cmd | unsigned long arg | |||
17 | sys_pread64 | unsigned long fd | char *buf | size_t count | loff_t pos | ||
18 | sys_pwrite64 | unsigned int fd | const char *buf | size_t count | loff_t pos | ||
19 | sys_readv | unsigned long fd | const struct iovec *vec | unsigned long vlen | |||
20 | sys_writev | unsigned long fd | const struct iovec *vec | unsigned long vlen | |||
21 | sys_access | const char *filename | int mode | ||||
22 | sys_pipe | int *filedes | |||||
23 | sys_select | int n | fd_set *in |