Linux -

Syscalls

Lionel Auroux

Generalities

The syscall
userland
interfaces
Linux - Syscalls
Implementation

A guided tour
of some
syscalls Lionel Auroux

2017-09-29

Lionel Auroux Linux - Syscalls 2017-09-29 1 / 27

 Linux -
Syscalls

Lionel Auroux

Generalities

The syscall
userland
interfaces

Implementation

A guided tour
of some
syscalls
Generalities

Lionel Auroux Linux - Syscalls 2017-09-29 2 / 27

 What is a syscall?
Linux -
Syscalls

Lionel Auroux User space can issue requests to the kernel in order to access its
Generalities resources or perfrom restricted operations.
The syscall
userland You can think of a syscall as regular function call, but where the
interfaces
code being called is in the kernel.
Implementation

A guided tour Syscalls usages:

of some
syscalls
Manipulating files and VFS: open, read, write, . . .
System setup: gettimeofday, swapon, shutdown. . .
Processes management: clone, mmap, . . .
Manipulating devices: ioctl, mount, . . .
Cryptography and security: seccomp, getrandom, . . .
...

Lionel Auroux Linux - Syscalls 2017-09-29 3 / 27

 Linux -
Syscalls

Lionel Auroux

Generalities

The syscall
userland
interfaces

Implementation

A guided tour
of some
syscalls The syscall userland interfaces

Lionel Auroux Linux - Syscalls 2017-09-29 4 / 27

 In assembly
Linux -
Syscalls On x86
Lionel Auroux
mov eax, 1 ; exit
Generalities int 0x80 ; or sysenter
The syscall
userland
interfaces Syscall number: eax
Implementation Arguments: ebx, ecx, edx, esi, edi, ebp, then use the
A guided tour stack
of some
syscalls

On x86_64
mov rax, 60 ; exit
syscall

Syscall number: rax

Arguments: rdi, rsi, rdx, rcx, r8 and r9, no args on
memory

Lionel Auroux Linux - Syscalls 2017-09-29 5 / 27

 syscall(2)
Linux -
Syscalls

Lionel Auroux

Generalities

The syscall #include <unistd.h>

userland
interfaces #include <sys/syscall.h> /* for __NR_xxx */
Implementation

A guided tour long syscall(long number, ...);

of some
syscalls

Copies the arguments and syscall number to the registers.

Traps to kernel code.
Sets errno if the syscall returns an error.

Lionel Auroux Linux - Syscalls 2017-09-29 6 / 27

 Don’t panic!
Linux -
Syscalls

Lionel Auroux

Generalities

The syscall
userland
interfaces You will learn all about that in kernel from scratch!
Implementation You almost never use direct calls to syscall(2).
A guided tour Your libc provides wrappers for most of the syscalls you
of some
syscalls need.
Linux also abstracts all thoses details in kernel code.
For a list of the Linux system calls, see syscalls(2).

Lionel Auroux Linux - Syscalls 2017-09-29 7 / 27

 vdso(7)
Linux -
Syscalls

Lionel Auroux
Virtual Dynamically linked Shared Objects
Small shared library (8k) that the kernel automatically
Generalities
maps into the address space of all user-space applications.
The syscall
userland Contains non priviledged code and data: gettimeofday,
interfaces
time, clock_gettime, . . . (arch-depedent)
Implementation
The ELF must be dynamically linked.
A guided tour
of some
syscalls
Why?

Making system calls can be slow.

On x86 32bit, int 0x80 is expensive: goes through the full
interrupt-handling paths in the processor’s microcode as
well as in the kernel.
Even if there is a dedicated instr (syscall), context
switching must be done.

Lionel Auroux Linux - Syscalls 2017-09-29 8 / 27

 Context switch
Linux -
Syscalls

Lionel Auroux

Generalities

The syscall A context is:

userland
interfaces

Implementation The CPU registers (including the instruction pointer)

A guided tour The state of a process (including threads):
of some
syscalls Memory state: stack, page tables, etc.
CPU state: registers, caches, etc.
Process scheduler state
...

Lionel Auroux Linux - Syscalls 2017-09-29 9 / 27

 vdso in action
Linux -
Syscalls
$ cat time.c
Lionel Auroux
int main(int ac, char **av) {
Generalities printf("%d\n", time(0));
The syscall }
userland
interfaces
$ gcc time.c -o time -static
Implementation
$ strace -e time ./time
A guided tour
time(NULL) = 1411171041
of some 1411171041
syscalls
+++ exited with 11 +++
$ gcc time.c -o time
$ ldd ./time
linux-vdso.so.1 (0x00007fffe1735000)
libc.so.6 => /usr/lib/libc.so.6 (0x00007fee5e753000
/lib64/ld-linux-x86-64.so.2 (0x00007fee5eb01000)
$ strace -e time ./time
1411171118
+++ exited with 11 +++

Lionel Auroux Linux - Syscalls 2017-09-29 10 / 27

 Linux -
Syscalls

Lionel Auroux

Generalities

The syscall
userland
interfaces

Implementation

A guided tour
of some
syscalls Implementation

Lionel Auroux Linux - Syscalls 2017-09-29 11 / 27

 Defining a syscall
Linux -
Syscalls

Lionel Auroux
Use the SYSCALL_DEFINEx(syscall, ...) macros anywhere
Generalities
in Linux code.
The syscall
userland
interfaces These macros expands to:
Implementation

A guided tour SYSCALL_METADATA(syscall, ...) generate metadata

of some
syscalls used in the FTRACE tracing framework.
__SYSCALL_DEFINEx(syscall, ...) more function
definition expansion.
Ultimatly expand to: asmlinkage long
SyS_syscall(..)
asmlinkage means that arguments are on the stack.

Lionel Auroux Linux - Syscalls 2017-09-29 12 / 27

 Example
Linux -
Syscalls

Lionel Auroux

Generalities

The syscall In kernel/signal.c:

userland
interfaces
3538 SYSCALL_DEFINE0(pause)
Implementation
3539 {
A guided tour 3540 while (!signal_pending(current)) {
of some
syscalls 3541 current->state = TASK_INTERRUPTIBLE;
3542 schedule();
3543 }
3544 return -ERESTARTNOHAND;
3545 }

Lionel Auroux Linux - Syscalls 2017-09-29 13 / 27

 Side notes
Linux -
Syscalls current
Lionel Auroux
#include <asm/current.h>
Generalities ...
The syscall pr_debug("The process is \"%s\" (pid %i)\n",
userland
interfaces
current->comm, current->pid);
Implementation

A guided tour signal_pending

of some
syscalls static inline int signal_pending(struct task_struct *p)
{
return unlikely(
test_tsk_thread_flag(p,TIF_SIGPENDING));
}

schedule()
Ask the scheduling subsystem to pick the next process to run.

Lionel Auroux Linux - Syscalls 2017-09-29 14 / 27

 The syscalls tables
Linux -
Syscalls
See arch/x86/entry/syscalls/syscall_{32,64}.tbl.
Lionel Auroux

Generalities
syscall_32.tbl
# <number> <abi> <name> <entry point> <compat entry point>
The syscall 0 i386 restart_syscall sys_restart_syscall
userland 1 i386 exit sys_exit
interfaces 2 i386 fork sys_fork stub32_fork
3 i386 read sys_read
Implementation 4 i386 write sys_write
A guided tour 5 i386 open sys_open compat_sys_open
of some 6 i386 close sys_close
syscalls

syscall_64.tbl
0 common read sys_read
1 common write sys_write
2 common open sys_open
3 common close sys_close
4 common stat sys_newstat
5 common fstat sys_newfstat
...
16 64 ioctl sys_ioctl
...
514 x32 ioctl compat_sys_ioctl

Lionel Auroux Linux - Syscalls 2017-09-29 15 / 27

 Generation
Linux -
Syscalls

Lionel Auroux

Generalities

The syscall
userland
interfaces

Implementation Kbuild calls the syscalltbl.sh to generate

A guided tour arch/x86/include/generated/asm/syscalls_{64,32}.h
of some
syscalls Same with syscallhdr.sh

Lionel Auroux Linux - Syscalls 2017-09-29 16 / 27

 Linux -
Syscalls

Lionel Auroux

Generalities

The syscall
userland
interfaces

Implementation

A guided tour
of some
syscalls A guided tour of some syscalls

Lionel Auroux Linux - Syscalls 2017-09-29 17 / 27

 sysinfo
Linux -
Syscalls

Lionel Auroux
kernel/sys.c
Generalities
2099 SYSCALL_DEFINE1(sysinfo,
The syscall
userland struct sysinfo __user *, info)
interfaces
2100 {
Implementation 2101 struct sysinfo val;
A guided tour 2102
of some
syscalls 2103 do_sysinfo(&val);
2104
2105 if (copy_to_user(info, &val,
sizeof(struct sysinfo)))
2106 return -EFAULT;
2107
2108 return 0;
2109 }

Lionel Auroux Linux - Syscalls 2017-09-29 18 / 27

 User data
Linux -
Syscalls

Lionel Auroux
__user
Generalities

The syscall
Used by tools such as sparse to statically check the use of
userland
interfaces
userspace pointers.
Implementation
# define __user __attribute__((noderef,
A guided tour address_space(1)))
of some
syscalls
copy_to_user
Copy data from kernel land to user land.
Checks that all bytes are writeable, using:
access_ok(VERIFIY_WRITE, addr_to, length)

Lionel Auroux Linux - Syscalls 2017-09-29 19 / 27

 ioctl
Linux -
Syscalls

Lionel Auroux

Generalities

The syscall
#include <sys/ioctl.h>
userland
interfaces
int ioctl(int d, unsigned long request, ...);
Implementation

A guided tour
of some
Control devices.
syscalls A big mess:
Request numbers encodes data.
Request data is untyped (void *).
See LDD3, Chapter 6: Advanced Char Driver Operations.

Lionel Auroux Linux - Syscalls 2017-09-29 20 / 27

 clone
Linux - clone
Syscalls
SYSCALL_DEFINE5(clone, unsigned long, clone_flags,
Lionel Auroux
unsigned long, newsp,
int __user *, parent_tidptr,
Generalities
int __user *, child_tidptr,
The syscall int, tls_val)
userland
interfaces {
return do_fork(clone_flags, newsp, 0, parent_tidptr, child_tidptr);
Implementation
}
A guided tour
of some
syscalls

Lionel Auroux Linux - Syscalls 2017-09-29 21 / 27

 clone
Linux - clone
Syscalls
SYSCALL_DEFINE5(clone, unsigned long, clone_flags,
Lionel Auroux
unsigned long, newsp,
int __user *, parent_tidptr,
Generalities
int __user *, child_tidptr,
The syscall int, tls_val)
userland
interfaces {
return do_fork(clone_flags, newsp, 0, parent_tidptr, child_tidptr);
Implementation
}
A guided tour
of some
syscalls fork
SYSCALL_DEFINE0(fork)
{
return do_fork(SIGCHLD, 0, 0, NULL, NULL);
}

Lionel Auroux Linux - Syscalls 2017-09-29 21 / 27

 clone
Linux - clone
Syscalls
SYSCALL_DEFINE5(clone, unsigned long, clone_flags,
Lionel Auroux
unsigned long, newsp,
int __user *, parent_tidptr,
Generalities
int __user *, child_tidptr,
The syscall int, tls_val)
userland
interfaces {
return do_fork(clone_flags, newsp, 0, parent_tidptr, child_tidptr);
Implementation
}
A guided tour
of some
syscalls fork
SYSCALL_DEFINE0(fork)
{
return do_fork(SIGCHLD, 0, 0, NULL, NULL);
}

vfork
SYSCALL_DEFINE0(vfork)
{
return do_fork(CLONE_VFORK | CLONE_VM | SIGCHLD, 0,
0, NULL, NULL);
}
Lionel Auroux Linux - Syscalls 2017-09-29 21 / 27
 clone
Linux - clone
Syscalls
SYSCALL_DEFINE5(clone, unsigned long, clone_flags,
Lionel Auroux
unsigned long, newsp,
int __user *, parent_tidptr,
Generalities
int __user *, child_tidptr,
The syscall int, tls_val)
userland
interfaces {
return do_fork(clone_flags, newsp, 0, parent_tidptr, child_tidptr);
Implementation
}
A guided tour
of some
syscalls fork
SYSCALL_DEFINE0(fork)
{
return do_fork(SIGCHLD, 0, 0, NULL, NULL);
}

vfork
SYSCALL_DEFINE0(vfork)
{
return do_fork(CLONE_VFORK | CLONE_VM | SIGCHLD, 0,
0, NULL, NULL);
}
Lionel Auroux Linux - Syscalls 2017-09-29 21 / 27
 personality
Linux -
Syscalls

Lionel Auroux

Generalities #include <sys/personality.h>

The syscall
userland
interfaces int personality(unsigned long persona);
Implementation

A guided tour
of some
Sets the process execution domain
syscalls
Used by setarch
Tweak:
uname-2.6
exposed architecture (i386, i486, i586, etc.)
STICKY_TIMEOUT
...

Lionel Auroux Linux - Syscalls 2017-09-29 22 / 27

 reboot
Linux -
Syscalls

Lionel Auroux

Generalities #include <unistd.h>

The syscall #include <linux/reboot.h>
userland
interfaces

Implementation int reboot(int magic, int magic2, int cmd, void *arg);
A guided tour
of some
syscalls This system call will fail (with EINVAL) unless magic equals
LINUX_REBOOT_MAGIC1 (that is, 0xfee1dead) and magic2 equals
LINUX_REBOOT_MAGIC2 (that is, 672274793). However, since 2.1.17 also
LINUX_REBOOT_MAGIC2A (that is, 85072278) and since 2.1.97 also
LINUX_REBOOT_MAGIC2B (that is, 369367448) and since 2.5.71 also
LINUX_REBOOT_MAGIC2C (that is, 537993216) are permitted as value for
magic2. (The hexadecimal values of these constants are meaningful.)

Lionel Auroux Linux - Syscalls 2017-09-29 23 / 27

 rt_XXX syscalls
Linux -
Syscalls
The addition or real-time signals required the widening of the
Lionel Auroux
signal set structure (sigset_t) from 32 to 64 bits.
Consequently, various system calls were superseded by new
Generalities
system calls that supported the larger signal sets.
The syscall
userland
interfaces
Linux < 2.0 Linux >= 2.2
Implementation

A guided tour sigaction(2) rt_sigaction(2)

of some
syscalls sigpending(2) rt_sigpending(2)

sigprocmask(2) rt_sigprocmask(2)

sigreturn(2) rt_sigreturn(2)
sigsusprend(2) rt_sigsuspend(2)

sigtimedwait(2) rt_sigtimedwait(2)

Lionel Auroux Linux - Syscalls 2017-09-29 24 / 27

 Going further than syscalls
Linux -
Syscalls

Lionel Auroux

Generalities

The syscall
userland
interfaces
There are places in the kernel where the complexity of the
Implementation
task goes bewond a call to a function.
A guided tour
of some ioctl has grew dangerously.
syscalls
For example, netlink(7) aims to replace ioctl for
network configuration.

Lionel Auroux Linux - Syscalls 2017-09-29 25 / 27

 References
Linux -
Syscalls

Lionel Auroux

Generalities

The syscall
userland
interfaces
http://lwn.net/Articles/604287/
Implementation
http://lwn.net/Articles/604515/
A guided tour
of some https://www.kernel.org/doc/htmldocs/kernel-hacking
syscalls
Searchable Linux Syscall Table:
https://filippo.io/linux-syscall-table/

Lionel Auroux Linux - Syscalls 2017-09-29 26 / 27

 Contact info
Linux -
Syscalls

Lionel Auroux

Generalities

The syscall
userland
interfaces

Implementation

A guided tour lionel [at] lse.epita.fr with [linux] tag

of some
syscalls

Lionel Auroux Linux - Syscalls 2017-09-29 27 / 27