Syscalls

System Calls

Ring-3 → ring-0 interface via syscall/sysret (x86_64 fast syscall).

See also: Userspace, Security, Process Management, Architecture

Convention

Register	Purpose
RAX	Syscall number
RDI	arg0
RSI	arg1
RDX	arg2
R10	arg3
R8	arg4
R9	arg5
Return	RAX

Syscall table

#	Name	Description
0	exit(code)	Exit process, wake parent
1	write(fd, buf, len)	Write to fd
2	print(msg)	Debug print (legacy)
3	open(path, flags, mode)	Open file (O_CREAT, O_TRUNC, O_APPEND)
4	read(fd, buf, len)	Read from fd (canonical or raw stdin, pipe, file)
5	close(fd)	Close fd
6	getpid()	Return PID
7	sbrk(inc)	Extend heap (lazy: pages fault in on first touch)
8	fsize(fd)	File size
9	exec(path)	Spawn + wait (foreground; legacy)
10	fork()	COW-clone calling process; child returns 0, parent returns child PID
11	waitpid(pid, *status, options)	Reap a child from ring 3; WNOHANG (options=1) returns 0 if child still running
12	pipe(fds)	Create anonymous pipe; returns 0 on success, fds[0]=read, fds[1]=write. Blocking read, reference-counted ends
13	execve(path, argv, envp)	Replace caller's image in place (same pid, new address space). Builds SysV entry-stack frame with argc/argv
14	dup2(oldfd, newfd)	Duplicate a pipe fd (or move a VFS handle) to a new fd number; shell pipeline primitive
15	getdents(dirfd, buf, max)	Enumerate directory entries into user buffer (68-byte records); the ls/tab-completion primitive
16	kill(pid, sig)	Post a signal to a process (delivered at next return-to-ring-3)
17	signal(sig, handler)	Install a signal handler (SIG_DFL / SIG_IGN / user function)
18	sigreturn()	Restore interrupted context after user handler runs
19	mmap(addr, length, prot, flags, fd, offset)	Map anonymous or file-backed memory (demand-zero, VMA-based). Returns base VA or MAP_FAILED
20	munmap(addr, length)	Unmap a mapped range (frees present pages, drops VMAs)
21	chdir(path)	Set process working directory (relative paths resolve against it)
22	getcwd(buf, size)	Copy current working directory into user buffer
23	mkdir(path, mode)	Create a directory (cwd-relative; requires parent to exist)
24	unlink(path)	Remove a file or empty directory
25	ttymode(mode)	Set stdin discipline: TTY_CANON (0, kernel line read) or TTY_RAW (1, byte-at-a-time + ANSI escapes)
26	mprotect(addr, len, prot)	Change protection of a mapped range (writable per PROT_WRITE, NX unless PROT_EXEC)
27	getprocs(buf, max)	Snapshot process table into nyx_procinfo_t records (the ps primitive)
28	readkey(timeout_ms)	Block up to timeout_ms for one key (0 = forever, returns keycode, 0 on timeout, negative on signal)

Safety

• Pointer validation: user_ptr_ok rejects kernel addresses. See Security.
• Opaque fds: Small integers mapped to VFS handles (kernel pointers never exposed)
• copy_from_user/copy_to_user: Walks user page tables safely
• Interrupt masking: Syscalls run with IF=0