The Runtime Theory

System Call Path

The system call path from user registers to kernel handler: syscall trap, ring 0, sys_call_table, argument validation, and sysret.

The Runtime Theory Team07 stages

trace / request.md

USER CODEPREPARESSYSCALL TRAPSTO RING 0ENTRY DISPATCHARGUMENTSVALIDATEDHANDLER RUNSRESULT COPIED OUTSYSRET RETURNSTO USER

readyThe program loads the syscall number into rax and the arguments into rdi, rsi, rdx, r10, r8, r9 — the kernel's register convention. No syscall number, no dispatch.

A system call is a deliberate surrender: the program hands control to the kernel and waits for it to come back. This diagram walks the full path — arguments staged in registers, the syscall instruction trapping to ring 0, entry dispatch through the syscall table, argument validation and copying, the handler doing the real work, results copied back, and sysret dropping to ring 3. The ordering matters because the transition is the cost: 50–200 nanoseconds of ring switch, stack switch, and copying happen before any actual work, and strace multiplies it by intercepting every step. The diagram highlights the two copies across the boundary and the checks that reject user pointers. The done state: user code resumes one instruction after the syscall, with the result in rax.