Following links explain x86-32 system call conventions for both UNIX (BSD flavor) & Linux:
I verified these using GNU Assembler (gas) on Linux.
x86-32 Linux System Call convention:
In x86-32 parameters for Linux system call are passed using registers.
%eax for syscall_number. %ebx, %ecx, %edx, %esi, %edi, %ebp are used for passing 6 parameters to system calls.
The return value is in
%eax. All other registers (including EFLAGS) are preserved across the
I took following snippet from the Linux Assembly Tutorial but I'm doubtful about this. If any one can show an example, it would be great.
If there are more than six arguments,
%ebxmust contain the memory location where the list of arguments is stored - but don't worry about this because it's unlikely that you'll use a syscall with more than six arguments.
For an example and a little more reading, refer to http://www.int80h.org/bsdasm/#alternate-calling-convention
There is faster way to make 32bit system calls: using
sysenter. The kernel maps a page of memory into every process (the vdso), with the user-space side of the
sysenter, which has to cooperate with the kernel for it to be able to find the return address. arg to register mapping is the same as for
int 0x80, but instead of that instruction, code should call a function in the vdso. (TODO: update this with a link and/or specific info).
x86-32 [Free|Open|Net|DragonFly]BSD UNIX System Call convention:
Parameters are passed on the stack. Push the parameters (last parameter pushed first) on to the stack. Then push an additional 32-bit of dummy data (Its not actually dummy data. refer to following link for more info) and then give a system call instruction
x86-64 Linux & *BSD System Call convention:
Refer to section: "A.2 AMD64 Linux Kernel Conventions" of System V Application Binary Interface AMD64 Architecture Processor Supplement
Here is the snippet from this section:
- User-level applications use as integer registers for passing the sequence %rdi, %rsi, %rdx, %rcx, %r8 and %r9. The kernel interface uses %rdi, %rsi, %rdx, %r10, %r8 and %r9.
- A system-call is done via the syscall instruction. The kernel destroys registers %rcx and %r11.
- The number of the syscall has to be passed in register %rax.
- System-calls are limited to six arguments, no argument is passed directly on the stack.
- Returning from the syscall, register %rax contains the result of the system-call. A value in the range between -4095 and -1 indicates an error, it is
- Only values of class INTEGER or class MEMORY are passed to the kernel.
x86-32 Function Calling convention:
In x86-32 parameters were passed on stack. Last parameter was pushed first on to the stack until all parameters are done and then
call instruction was executed. This is used for calling C library (libc) functions on Linux from assembly.
x86-64 Function Calling convention:
I guess because of the reason that we have so many general purpose registers and higher width other registers the function calling mechanism is changed. In this new mechanism. First the parameters are divided into classes. The class of each parameter determines the manner in which it is passed to the called function.
For complete information refer to : "3.2 Function Calling Sequence" of System V Application Binary Interface AMD64 Architecture Processor Supplement which reads, in part:
Once arguments are classified, the registers get assigned (in left-to-right order) for passing as follows:
- If the class is MEMORY, pass the argument on the stack.
- If the class is INTEGER, the next available register of the sequence %rdi, %rsi, %rdx, %rcx, %r8 and %r9 is used
%rdi, %rsi, %rdx, %rcx, %r8 and %r9 are the registers in order used to pass parameters to any libc function from assembly. %rdi is used for first parameter. %rsi for 2nd, %rdx for 3rd and so on. Then
call instruction should be given.
If parameters are more than 6 then 7th parameter onwards is passed on the stack.