How does a system call travels from user space to kernel space and back to user space?

Question

I have studied some articles where I get the information that a system call like open() invokes a wrapper function in glibc and then a trap is raised which switches the context from user space to kernel space and then cpu registers are used to invoke system call parameters/arguments in kernel space.

But still I guess I am missing a step by step procedure or detailed sequence for the system call invocation.It will be great if people can provide steps considering ARM arch as a reference.Thanks in advance.

"a trap is raised". This means "jump to a predefined address and switch mode to kernel". That's more or less it. What more details do you need? Which register flips which bit? — n. m. could be an AI, Jun 12 '14 at 05:12
so is the trap handler consists of a jmp instruction to a label(that means trap handler is an assembly code) or it's a C code and where it resides exactl?Also who exactly calls the trap handler and when? — a.saurabh, Jun 12 '14 at 05:19
[This will might be help you](http://unix.stackexchange.com/questions/125343/what-is-meant-by-a-system-call-if-not-the-implementation-in-the-programing-lan) — Jayesh Bhoi, Jun 12 '14 at 05:22
For security reasons there's a special trap instruction that does both the jump and the switch at once. There is no way to switch to the kernel mode otherwise. There is no label, the jump address is hardwired in the CPU. — n. m. could be an AI, Jun 12 '14 at 05:28
On the ARM, it was called *software interrupt*. You know how an interrupt works? The *syscall* is similar, but a *special assembler instruction* triggers the interrupt instead of hardware. The *special assembler* is the part in *glibc*. In [this questions](http://stackoverflow.com/questions/20369440/can-start-be-the-thumb-function), there are two examples of the user space calling `exit()`. One register is a *function number*, a jump table index to get to kernel code. [C Syscalls](http://stackoverflow.com/questions/572942/whats-the-difference-between-c-system-calls-and-c-library-routines) — artless noise, Jun 13 '14 at 17:42

score 5 · Answer 1 · answered Jun 12 '14 at 06:43

Software interrupt exception is used to invoke system calls in case of ARM. It will execute function whose address is stored at physical address 0x08.

Syscall wrapper library function lands to architecture specific implementation of SYSCALL(Check sysdeps/unix directory of libc source code). In our case, syscall from sysdeps/unix/sysv/linux/arm/syscall.S file will be executed. In this function it will store the syscall number in R7 and R0-R6 are used to send arguments to the syscall.

Sample assembly code:

     mov  r7, #SYSCALL NO
     mov  r0, #ARG1
     mov  r1, #ARG2
     swi 0x0

When software exception is generated, vector_swi() <arch/arm/kernel/entry-common.S> is called. This functions gets syscall number from R7, finds and executes the registered function address from sys_call_table.

Check following kernel files for implementation details:

include/linux/syscalls.h
arch/arm/include/asm/unistd.h
arch/arm/kernel/calls.S
arch/arm/kernel/entry_common.S
arch/arm/kernel/sys_arm.c

score 2 · Answer 2 · answered Dec 19 '15 at 18:27

There are two parts of the handling of syscalls.

From starting of the syscall and up to making processor exception to enter into previllege mode. For ARM, this mode would be SVC(Supervisor)mode. This part involves filling the general purpose registers with correct system call no, arguments to be passed in the syscall, and triggering the processor's state to privilege mode.
Second(and a bit more complicated as compared to the first one) part involves processing the syscall in privilege mode, and returning from the privilege mode.

2a. In the exception table of ARM the control is directed by the exception vector(SVC in this case) to common handler for the exceptions. Following is the exception vector for SVC:

[File: arch\arm\kernel\entry-armv.S]

W(ldr)  pc, __vectors_start + 0x1000

Following is the entry to common handler of the exceptions:

[File: arch\arm\kernel\entry-armv.S]

vector_\name:
    .if \correction
    sub lr, lr, #\correction
    .endif

2b. At the finish of this common handler, r0,lr and spsr are saved on the on the stack at addresses of [SP], [SP+4] and [SP+8] respectively.

[File: arch\arm\kernel\entry-armv.S]

stmia   sp, {r0, lr}        @ save r0, lr
mrs lr, spsr
str lr, [sp, #8]        @ save spsr

2c. Then, the common handler transfers/branches the controller to SVC specific handler:

[File: arch\arm\kernel\entry-armv.S]

mrs lr, spsr 
...
and lr, lr, #0x0f
...
 ARM(   ldr lr, [pc, lr, lsl #2]    )
movs    pc, lr          @ branch to handler in SVC mode
...
.word   vector_swi

At the end of the common handler, the controller is transferred to SVC handler vector_swi.

2d. Now let's see how syscall is processed in SVC handler. Context of the caller is saved as following after advancing SP at new FRAME in follwing order: