I was working on memorizing the order of the Linux system calls so I could more easily identify this. And, then I found this paper here, and it says,
To make a system call in 32-bit Linux, place the system call number in
eax
, then its arguments, in order, inebx
,ecx
,edx
,esi
,edi
, andebp
, then invoke int 0x80.
And, then,
To make a system call in 64-bit Linux, place the system call number in
rax
, then its arguments, in order, inrdi
,rsi
,rdx
,r10
,r8
, andr9
, then invoke syscall.
How come the order gets so mutilated between 64 bit and 32 bit? I know this question may be historical rather than technical.
This is totally decided by the kernel, right? Are there technical reasons to favor the newer convention?
SYSENTER
isn't even available on x86_64 though, right? Could you explain more about this. Sorry, I come back months later as I learn more =) – Evan Carroll Sep 30 '18 at 21:00SYSENTER
is available on 64-bit x86 as well as 32-bit x86 (since the Pentium II), but it doesn’t need ECX/RCX so it doesn’t have any impact on this discussion (I’ve updated my answer).SYSCALL
is 64-bit-specific and overwrites RCX. – Stephen Kitt Oct 01 '18 at 07:27