ioctl_list - list of ioctl calls in Linux/i386 kernel


This is Ioctl List 1.3.27, a list of ioctl calls in Linux/i386 kernel 1.3.27. It contains 421 ioctls from </usr/include/{asm,linux}/*.h>. For each ioctl, its numerical value, its name, and its argument type are given.

An argument type of const struct foo * means the argument is input to the kernel. struct foo * means the kernel outputs the argument. If the kernel uses the argument for both input and output, this is marked with // I-O.

Some ioctls take more arguments or return more values than a single structure. These are marked // MORE and documented further in a separate section. In addition, information about some ioctls can be found in the pages listed under SEE ALSO in ioctl(2).

This list is very incomplete.

ioctl structure
Ioctl command values are 32-bit constants. In principle these constants are completely arbitrary, but people have tried to build some structure into them.

The old Linux situation was that of mostly 16-bit constants, where the last byte is a serial number, and the preceding byte(s) give a type indicating the driver. Sometimes the major number was used: 0x03 for the HDIO_* ioctls, 0x06 for the LP* ioctls. And sometimes one or more ASCII letters were used. For example, TCGETS has value 0x00005401, with 0x54 = 'T' indicating the terminal driver, and CYGETTIMEOUT has value 0x00435906, with 0x43 0x59 = 'C' 'Y' indicating the cyclades driver.

Later (0.98p5) some more information was built into the number. One has 2 direction bits (00: none, 01: write, 10: read, 11: read/write) followed by 14 size bits (giving the size of the argument), followed by an 8-bit type (collecting the ioctls in groups for a common purpose or a common driver), and an 8-bit serial number.

The macros describing this structure live in <asm/ioctl.h> and are _IO(type,nr) and {_IOR,_IOW,_IOWR}(type,nr,size). They use sizeof(size) so that size is a misnomer here: this third argument is a data type.

Note that the size bits are very unreliable: in lots of cases they are wrong, either because of buggy macros using sizeof(sizeof(struct)), or because of legacy values.

Thus, it seems that the new structure only gave disadvantages: it does not help in checking, but it causes varying values for the various architectures.


Decent ioctls return 0 on success and -1 on error, while any output value is stored via the argument. However, quite a few ioctls in fact return an output value. This is not yet indicated below.

// Main table.

// <include/asm-i386/socket.h>

// <include/asm-i386/termios.h>

// <include/linux/ax25.h>

// <include/linux/cdk.h>

// <include/linux/cdrom.h>

// <include/linux/cm206.h>

// <include/linux/cyclades.h>

// <include/linux/fd.h>

// <include/linux/fs.h>

// <include/linux/hdreg.h>

// <include/linux/if_eql.h>

// <include/linux/if_plip.h>

// <include/linux/if_ppp.h>

// <include/linux/ipx.h>

// <include/linux/kd.h>

// <include/linux/lp.h>

// <include/linux/mroute.h>

// <include/linux/msdos_fs.h> see ioctl_fat(2)

// <include/linux/mtio.h>

// <include/linux/netrom.h>

// <include/uapi/linux/wireless.h>
// This API is deprecated.
// It is being replaced by nl80211 and cfg80211. See

// <include/linux/sbpcd.h>

// <include/linux/scc.h>

// <include/linux/scsi.h>

// <include/linux/smb_fs.h>

// <include/uapi/linux/sockios.h> see netdevice(7)

// <include/linux/soundcard.h>

// <include/linux/timerfd.h> see timerfd_create(2)

// <include/linux/umsdos_fs.h>

// <include/linux/vt.h>

// More arguments. Some ioctl’s take a pointer to a structure which contains additional pointers. These are documented here in alphabetical order.

CDROMREADAUDIO takes an input pointer const struct cdrom_read_audio *. The buf field points to an output buffer of length nframes * CD_FRAMESIZE_RAW.

CDROMREADCOOKED, CDROMREADMODE1, CDROMREADMODE2, and CDROMREADRAW take an input pointer const struct cdrom_msf *. They use the same pointer as an output pointer to char []. The length varies by request. For CDROMREADMODE1, most drivers use CD_FRAMESIZE, but the Optics Storage driver uses OPT_BLOCKSIZE instead (both have the numerical value 2048).


EQL_ENSLAVE, EQL_EMANCIPATE, EQL_GETSLAVECFG, EQL_SETSLAVECFG, EQL_GETMASTERCFG, and EQL_SETMASTERCFG take a struct ifreq *. The ifr_data field is a pointer to another structure as follows:

EQL_ENSLAVE const struct slaving_request *
EQL_EMANCIPATE const struct slaving_request *
EQL_GETSLAVECFG struct slave_config * // I-O
EQL_SETSLAVECFG const struct slave_config *
EQL_GETMASTERCFG struct master_config *
EQL_SETMASTERCFG const struct master_config *

FDRAWCMD takes a struct floppy raw_cmd *. If flags & FD_RAW_WRITE is nonzero, then data points to an input buffer of length length. If flags & FD_RAW_READ is nonzero, then data points to an output buffer of length length.

GIO_FONTX and PIO_FONTX take a struct console_font_desc * or a const struct console_font_desc *, respectively. chardata points to a buffer of char [charcount]. This is an output buffer for GIO_FONTX and an input buffer for PIO_FONTX.

GIO_UNIMAP and PIO_UNIMAP take a struct unimapdesc * or a const struct unimapdesc *, respectively. entries points to a buffer of struct unipair [entry_ct]. This is an output buffer for GIO_UNIMAP and an input buffer for PIO_UNIMAP.

KDADDIO, KDDELIO, KDDISABIO, and KDENABIO enable or disable access to I/O ports. They are essentially alternate interfaces to ’ioperm’.

KDMAPDISP and KDUNMAPDISP enable or disable memory mappings or I/O port access. They are not implemented in the kernel.

SCSI_IOCTL_PROBE_HOST takes an input pointer const int *, which is a length. It uses the same pointer as an output pointer to a char [] buffer of this length.

SIOCADDRT and SIOCDELRT take an input pointer whose type depends on the protocol:

Most protocols const struct rtentry *
AX.25 const struct ax25_route *
NET/ROM const struct nr_route_struct *
INET6 const struct in6_rtmsg *

SIOCGIFCONF takes a struct ifconf *. The ifc_buf field points to a buffer of length ifc_len bytes, into which the kernel writes a list of type struct ifreq [].

SIOCSIFHWADDR takes an input pointer whose type depends on the protocol:

Most protocols const struct ifreq *
AX.25 const char [AX25_ADDR_LEN]

TIOCLINUX takes a const char *. It uses this to distinguish several independent subcases. In the table below, N + foo means foo after an N-byte pad. struct selection is implicitly defined in drivers/char/selection.c

TIOCLINUX-2 1 + const struct selection *
TIOCLINUX-5 4 + const struct { long [8]; } *
TIOCLINUX-6 char *
TIOCLINUX-7 char *
TIOCLINUX-10 1 + const char *

// Duplicate ioctls

This list does not include ioctls in the range SIOCDEVPRIVATE and SIOCPROTOPRIVATE.


ioctl(2), ioctl_fat(2), netdevice(7)


This page is part of release 5.06 of the Linux man-pages project. A description of the project, information about reporting bugs, and the latest version of this page, can be found at