استدعاءات نظام Linux (syscalls)

Welcome! In this lesson, we'll dive into Linux System Calls (syscalls). These are the fundamental way user-space programs request services from the operating system's kernel.

Think of them as a special set of functions that your program can call to do powerful things, like interacting with files, managing processes, or allocating memory.

Modern operating systems operate in different privilege levels. Typically, there's user mode (where your applications run) and kernel mode (where the OS core runs).

• User Mode: Limited access to hardware and critical memory.
• Kernel Mode: Full access, handles system resources securely.

System calls are the controlled gateway for user-mode programs to temporarily switch to kernel mode and ask the OS to perform privileged operations on their behalf.

On x86-64 Linux, system calls are primarily invoked using the syscall instruction. Before calling syscall, you load specific registers with values:

• RAX: Holds the system call number.
• RDI, RSI, RDX, R10, R8, R9: Hold the system call arguments (up to 6).
• The return value is placed back in RAX.

How do you know which number corresponds to which system call? You can look them up!

• Use the man syscalls command in your terminal.
• Consult header files like /usr/include/asm/unistd_64.h.

For example, sys_write is system call number 1, and sys_exit is number 60.

One of the most common syscalls is sys_write, used to write data to a file descriptor. Its parameters are:

• RDI: File descriptor (e.g., 1 for stdout).
• RSI: Pointer to the buffer containing data.
• RDX: Number of bytes to write.

Standard file descriptors are 0 (stdin), 1 (stdout), and 2 (stderr).

Let's write a simple program that prints "Hello, Syscall!" to the console using sys_write and then exits using sys_exit.

Try running this example:

The counterpart to sys_write is sys_read, which reads data from a file descriptor into a buffer. Its parameters are:

• RDI: File descriptor (e.g., 0 for stdin).
• RSI: Pointer to the buffer to store data.
• RDX: Maximum number of bytes to read.

sys_read returns the number of bytes actually read, or an error code.

Here's a program that reads up to 256 bytes from standard input (stdin) and then writes whatever it read back to standard output (stdout).

Try running this example:

Let's quickly check your understanding of how arguments are passed for x86-64 Linux system calls.

You've learned the basics of Linux system calls!

• Syscalls are how user programs request kernel services.
• The syscall instruction (x86-64) initiates the call.
• RAX holds the syscall number, and RDI-R9 hold arguments.
• We explored sys_write (to stdout), sys_read (from stdin), and sys_exit.

Mastering syscalls is key to understanding low-level Linux programming and operating system interaction.