R – How does a syscall actually happen on linux

internalslinuxlinux-kernelsystem-calls

Inspired by this question

How can I force GDB to disassemble?

and related to this one

What is INT 21h?

How does an actually system call happen under linux? what happens when the call is performed, until the actual kernel routine is invoked ?

Best Answer

Assuming we're talking about x86:

  1. The ID of the system call is deposited into the EAX register
  2. Any arguments required by the system call are deposited into the locations dictated by the system call. For example, some system calls expect their argument to reside in the EBX register. Others may expect their argument to be sitting on the top of the stack.
  3. An INT 0x80 interrupt is invoked.
  4. The Linux kernel services the system call identified by the ID in the EAX register, depositing any results in pre-determined locations.
  5. The calling code makes use of any results.

I may be a bit rusty at this, it's been a few years...