Linux syscalls

The interface

Linux system calls take the call number in RAX and up to six arguments in RDI, RSI, RDX, R10, R8, R9. The SYSCALL instruction enters the kernel, which returns the result in RAX:

mov rax, 1 ; sys_write mov rdi, 1 ; fd: stdout mov rsi, msg ; buffer mov rdx, len ; count syscall ; rax = bytes written

The common numbers

The calls you will use most: 0 read, 1 write, 2 open, 3 close, 60 exit, and 231 exit_group. The full table lives in /usr/include/x86_64-linux-gnu/asm/unistd_64.h:

%define SYS_READ 0 %define SYS_WRITE 1 %define SYS_OPEN 2 %define SYS_CLOSE 3 %define SYS_EXIT 60

Error returns

A failed syscall returns a negative errno in RAX, between -4095 and -1. Test the sign of RAX, and negate it to get the errno value. Unlike libc, raw syscalls set no C library variables.

Next: Arithmetic

Article author: Arthur Isaev