← Back to Labs

System Call Boundary

Trace one syscall step by step: register setup, privilege transition, policy checks, handler lookup, and the kernel work that returns the result.

user modekernel modeUserspace prepares registersUserspace has decided to call read(), so it loads rax=0 and places rdi=fd, rsi=buf, rdx=count where the syscall ABI expects them.CPU enters kernel modeWith registers ready, the CPU executes syscall, switches from ring 3 to ring 0, saves the user return address in rcx, and jumps into the kernel entry path.Policy and tracing hooksBefore Linux dispatches the request, tracing and policy hooks can inspect it. Seccomp may allow it, deny it, trap it, or hand it to a userspace notifier.Syscall table lookupIf the request survives those checks, Linux uses syscall number 0 to index the architecture-specific table and select the correct handler.Kernel handler runsOnly now does the real kernel handler run for read(): validate pointers, check permissions, do the work, and place rax=byte count or -errno for the trip back to userspace.
Step 1 / 5Userspace prepares registers

A process asks the kernel to copy bytes from an existing file descriptor into a userspace buffer. The kernel must validate the descriptor, fetch the data, and copy the result back safely. Userspace has decided to call read(), so it loads rax=0 and places rdi=fd, rsi=buf, rdx=count where the syscall ABI expects them.

syscall number
0
register setup
rdi=fd, rsi=buf, rdx=count
current result
ready

Arrow keys · R to reset · change the seccomp verdict above

Choose a syscall, then walk it across the boundary

Read the full article →Take the quiz →