sys calls

Executing syscalls and passing parameters

64-bit SYSCALL instruction entry. Up to 6 arguments in registers.

This is the only entry point used for 64-bit system calls. The hardware interface is reasonably well designed and the register to argument mapping Linux uses fits well with the registers that are available when SYSCALL is used.

SYSCALL instructions can be found inlined in libc implementations as well as some other programs and libraries. There are also a handful of SYSCALL instructions in the vDSO used, for example, as a clock_gettimeofday fallback.

64-bit SYSCALL saves rip to rcx, clears rflags.RF, then saves rflags to r11, then loads new ss, cs, and rip from previously programmed MSRs. rflags gets masked by a value from another MSR (so CLD and CLAC are not needed). SYSCALL does not save anything on the stack and does not change rsp.

Registers on entry: rax system call number rcx return address r11 saved rflags (note: r11 is callee-clobbered register in C ABI) rdi arg0 rsi arg1 rdx arg2 r10 arg3 (needs to be moved to rcx to conform to C ABI) r8 arg4 r9 arg5 (note: r12-r15, rbp, rbx are callee-preserved in C ABI)

Only called from user space.

Assembler code to call a syscall

.intel_syntax noprefix

.data

string_to_print:
.ascii "Hello, World\n"

.text
.globl _start

_start:
  # syscall write(int fd, const void *buf, size_t count)
    mov rax, 1                       # 1 is the syscall number for write. Store this number in register RAX.
    mov rdi, 1                       # The first parameter of a syscall is stored in RDI. For write, this is the file descriptor (1 is stdout)
    lea rsi, string_to_print[rip]    # Load the address of string_to_print relative to the instruction pointer (position independent code) into the second paramter (RSI)
    mov rdx, 13                      # The length of the string is stored in the third parameter (RDX).
    syscall                          # Invoke syscall

  # syscall exit(int status)
    mov rax, 60        # syscall number for exit
    xor rdi, rdi       # return code 0            # exit with code 0
    syscall            # invoke kernel

$ gcc -nostdlib -o /tmp/hello /tmp/hello.S

Where some sys calls are defined

Alternatives to system calls

TODO

asmlinkage long sys_ioctl(unsigned int fd, unsigned int cmd, unsigned long arg);

SYSCALL_DEFINE3(ioctl, unsigned int, fd, unsigned int, cmd, unsigned long, arg) {
  …
}

grep -r '^SYSCALL_DEFINE' --include='*.c'

See also