sys calls

Executing syscalls and passing parameters (x64)

64-bit SYSCALL instruction entry. Up to 6 arguments in registers.

This is the only entry point used for 64-bit system calls.  The
hardware interface is reasonably well designed and the register to
argument mapping Linux uses fits well with the registers that are
available when SYSCALL is used.

SYSCALL instructions can be found inlined in libc implementations as
well as some other programs and libraries.  There are also a handful
of SYSCALL instructions in the vDSO used, for example, as a
clock_gettimeofday fallback.

64-bit SYSCALL saves rip to rcx, clears rflags.RF, then saves rflags to r11,
then loads new ss, cs, and rip from previously programmed MSRs.
rflags gets masked by a value from another MSR (so CLD and CLAC
are not needed). SYSCALL does not save anything on the stack
and does not change rsp.

Registers on entry:
rax  system call number
rcx  return address
r11  saved rflags (note: r11 is callee-clobbered register in C ABI)
rdi  arg0
rsi  arg1
rdx  arg2
r10  arg3 (needs to be moved to rcx to conform to C ABI)
r8   arg4
r9   arg5
(note: r12-r15, rbp, rbx are callee-preserved in C ABI)

Only called from user space.

Assembler code to call a syscall

.intel_syntax noprefix

.data

string_to_print:
.ascii "Hello, World\n"

.text
.globl _start

_start:
  # syscall write(int fd, const void *buf, size_t count)
    mov rax, 1                       # 1 is the syscall number for write. Store this number in register RAX.
    mov rdi, 1                       # The first parameter of a syscall is stored in RDI. For write, this is the file descriptor (1 is stdout)
    lea rsi, string_to_print[rip]    # Load the address of string_to_print relative to the instruction pointer (position independent code) into the second paramter (RSI)
    mov rdx, 13                      # The length of the string is stored in the third parameter (RDX).
    syscall                          # Invoke syscall

  # syscall exit(int status)
    mov rax, 60        # syscall number for exit
    xor rdi, rdi       # return code 0            # exit with code 0
    syscall            # invoke kernel

$ gcc -nostdlib -o /tmp/hello /tmp/hello.S

Where some sys calls are defined

Alternatives to system calls

TODO

asmlinkage long sys_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg);

SYSCALL_DEFINE3(ioctl, unsigned int, fd, unsigned int, cmd, unsigned long, arg) {
  …
}

grep -r '^SYSCALL_DEFINE' --include='*.c'

See also