Understanding Linux System Calls with a Hello World Assembly Example

System calls are essentially kernel functions invoked by user‑space programs, similar to how a client requests a service from a server, but triggered by a machine instruction rather than an HTTP request.

In assembly, the .data section defines program data (e.g., the string "Hello, world!\n"), while the .text section contains executable code.

The following x86_64 assembly program prints "Hello, world!" using the syscall instruction:

.section .data
msg:
    .ascii "Hello, world!
"    # string with newline
    len = . - msg                # length including newline
.section .text
.global _start
_start:
    # write(1, msg, len)
    movq $1, %rax                # syscall 1 (write)
    movq $1, %rdi                # fd = 1 (stdout)
    movq $msg, %rsi              # address of string
    movq $len, %rdx              # length of string
    syscall
    # exit(0)
    movq $60, %rax               # syscall 60 (exit)
    xorq %rdi, %rdi              # status = 0
    syscall

Compile and link the program with:

$ gcc -c test.S
$ ld -o test test.o

Running ./test outputs Hello, world!.

The syscall instruction causes the CPU to jump to the kernel’s system‑call handler whose address is stored in the MSR IA32_LSTAR. Linux writes the address of entry_SYSCALL_64 to this register during boot: wrmsrl(MSR_LSTAR, entry_SYSCALL_64); Each system call is identified by a numeric ID; for example, write is ID 1. The program places this ID in %rax and passes arguments (file descriptor, buffer address, length) in %rdi, %rsi, and %rdx respectively before invoking syscall. The kernel then dispatches to the appropriate function based on the ID.

SYSCALL invokes an OS system‑call handler at privilege level 0 by loading RIP from the IA32_LSTAR MSR (after saving the address of the next instruction into RCX).

Two illustrative images are included in the original article.