I'm trying to add a system call using linux kernel 4.1.6 but all the documentation I can find is for older versions. Does anyone know how it's done in the newer kernels or have any good references?

There's supposed to be 3 steps:

  1. Add to the system call table. I've worked out that they now use arch/x86/syscalls/syscall_64.tbl instead of entry.S. So I've put something in there.

  2. Add to the asm/unistd.h file. Apparently the unistd.h file is generated automatically now so we don't have to update it manually? So I've done nothing for this step as the file doesn't exist. https://stackoverflow.com/questions/10988759/arch-x86-include-asm-unistd-h-vs-include-asm-generic-unistd-h

  3. Compile the syscall into the kernel. I've added the actual system call code to kernel/sys.c as suggested in a book based on kernel 2.6 (The linux kernel development book by Robert Love). I've compiled the kernel again.

I then wrote a client program as suggested in the book but it says unknown type name 'helloworld' when I try to compile it. My program is different to the book but the structure is the same.

#include <stdio.h>

#define __NR_helloworld 323 
__syscall0(long, helloworld)

int main()
    printf("I will now call helloworld syscall:\n");

    return 0;

The Internet (and available books) seem to be seriously lacking of this information - or Google is not as smart as it would like to think. Anyway any help is appreciated.

Thanks. ~

  • It's very hard to get new system calls upstreamed these days. So if possible, it might be preferable to do what you want through a device ioctl or the /sys file system, rather than a new system call number. That's probably why there aren't that many guides to adding new system call numbers. Commented Aug 18, 2015 at 8:17
  • wow that was a fast response. this is my first question so I wasn't sure what to expect. anyway it's not for a "real" system call it's purely for learning purposes and required for an assignment. Given what you just said it seems like a rather pointless assignment objective. I understand the process from the perspective of earlier kernel versions so I'm not sure what point there is to get this to work. Nevertheless that seems to be the requirement and I need to find out how to do it. That does explain why I couldn't find anything though. Thanks! Commented Aug 18, 2015 at 8:26
  • 1
    I don't think you'll have too many problems if you use documentation for the 2.6 kernel (which is easier to find). Some things may have changed of course, but I don't recall any "big" change which would invalidate the entire documentation on that topic :) Commented Aug 18, 2015 at 8:34

2 Answers 2


According to _syscall(2) man page the _syscall0 macro may be obsolete and requires #include <linux/unistd.h>; indeed Linux 4.x don't have it

However, you might install musl-libc and use its _syscall function.

And you could simply use the indirect syscall(2) in your user code. So your testing program would be

#define _GNU_SOURCE         /* See feature_test_macros(7) */
#include <unistd.h>
#include <sys/syscall.h> 
#include <stdio.h>
#define __NR_helloworld 323
static inline long mysys_helloworld(void) { return syscall(__NR_helloworld,NULL); }

int main (int argc, char**argv) {  
   printf("will do the helloworld syscall\n");
   if (mysys_helloworld()) perror("helloworld");
   return 0;

Above code is untested!

  • I suppose the "non-deprecated" way would be to define the prototype and library function yourself, and use syscall(2) in it. Commented Aug 18, 2015 at 8:39
  • actually I saw that page shortly before I posted the question and it looked rather interesting but I don't know if it means it can't be done. essentially I'm looking for a way to do it whether it's totally different from the book or not. I can't find anything anywhere that can explain the process. thanks for the link though... Commented Aug 18, 2015 at 8:39
  • I think I just need a break before. after coming back I can see that yes if I swap out the deprecated __syscall macro with the actual code then it fixes the problem with the macro. And as it turns out, it was the only thing that was broken. Doing something similar to what you posted has worked! Interestingly if all I write is "syscall(323, NULL)" then sure enough it runs the system call. well that was easier than it should have been - as I was suspecting all along! Thanks for your help. Commented Aug 18, 2015 at 9:58
  • actually that #define _GNU_SOURCE also seems to have been what I needed as well. I likely would have worked out the other part as I was already looking at it, but this one I wouldn't have guessed. Thanks for the tip! The man page wasn't that readable but I found another stackexchange thread where someone else asked about it. So much info is stored in stackexchange now. Commented Aug 18, 2015 at 11:44

Well then assuming the instructor wants people to read the source and not just cut and paste from the internet, it's arguably a well-designed assignment. (That said, linux kernel code is not super nice to read. Make sure you know how to use etags, because often you have to trace macros three levels deep to see what is going on.)

  • actually the assignment literally says "You may do online research in order to know how to fulfil each task." it also says to use "make modules" which is obsolete since kernel 2.6. I'm not sure the instructor has done it with the new kernel version either. Commented Aug 18, 2015 at 8:33
  • Sorry, I didn't actually mean to enter this as an answer. It was supposed to be a humorous comment. I just didn't notice I was typing in the answer box instead of the comment one. Commented Aug 18, 2015 at 8:34
  • I'm not looking for an "answer". I'm looking for information on how to do this. If it were you where would you look? Commented Aug 18, 2015 at 8:37
  • Sadly, probably the kernel source. I think it's intentionally hard to add system calls via loadable kernel modules, so you are going to have to recompile everything. Try to emulate a simple system call like getpid. Commented Aug 18, 2015 at 8:43
  • well that's kind of where I'm at anyway. I think possibly the last time this course was run version 4.x wasn't out yet. maybe what they want us to do isn't really what they thought. anyway thanks for the reply. Commented Aug 18, 2015 at 8:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .