A system call is a deliberate surrender: the program hands control to the kernel and waits for it to come back. This diagram walks the full path — arguments staged in registers, the syscall instruction trapping to ring 0, entry dispatch through the syscall table, argument validation and copying, the handler doing the real work, results copied back, and sysret dropping to ring 3. The ordering matters because the transition is the cost: 50–200 nanoseconds of ring switch, stack switch, and copying happen before any actual work, and strace multiplies it by intercepting every step. The diagram highlights the two copies across the boundary and the checks that reject user pointers. The done state: user code resumes one instruction after the syscall, with the result in rax.
System Call Path
The system call path from user registers to kernel handler: syscall trap, ring 0, sys_call_table, argument validation, and sysret.
The Runtime Theory Team07 stages
trace / request.md
readyThe program loads the syscall number into rax and the arguments into rdi, rsi, rdx, r10, r8, r9 — the kernel's register convention. No syscall number, no dispatch.