How to know the arguments of a Linux syscall?

Question

To my knowledge, this is a decent resource to know the parameters of a Linux syscall. However, this only lists 32 bit syscalls, not the 64 bit ones. Moreover, the reference doesn't say which register is being used by what parameter.

So far I understand, the man-pages for the libc wrappers or referring to the Linux kernel headers can be a solution. But, I am looking for a more friendly resource that can be consulted quickly.

• What is an authentic resource to know the parameter to register mappings?
• Is there a resource for 64 bit syscalls as well?

Answer 1

This StackOverflow answer is a great resource.

In summary, for 32 bits: Syscall number is eax. ebx, ecx, edx, esi, edi, ebp are used for arguments. You invoke the syscall with int 0x80. All registers are preserved after the syscall.

For 64 bit, that answer cites this specification, which might be a good "authentic resource" as you asked for.

This is a good syscall table for 64 bit.

This is a good syscall table for 32-bit.

Answer 2

I wouldn't call it authentic, but this surely is a source I've been using for quite some time now.

Double click on the line of the syscall to see what the parameters are (and their types).

You may see things like struct sockaddr __user, for these you need to dig a bit into the source files.