Where is SYSCALL() implemented in Linux?

Question

In my last job interview I was asked what seems to be a very straight forward simple question:

Q: In which library syscall (The one is kernel space not the wrapper in libc) is implemented?

A: I answered <unistd.h>

The interviewer told me that it's wrong and he is asking in which library it's implemented not in which header file it's declared.

Why is my answer false, what's the correct answer?

I searched the web for hours and nothing found at all, even writing man 2 syscall in shell gives:

   #include <unistd.h>
   #include <sys/syscall.h>   /* For SYS_xxx definitions */

   long syscall(long number, ...);

Any help please, I let-rally searched and still searching for days with no single result. — user16011868
libc is where the wrapper is implemented I am asking about the one in kernel — user16011868
You should have asked what the correct answer was, just for your own information. — wxz
If you want a comment deleted as rude please flag it as such. Do not edit that as a (probably ignored) comment into your question. A flag has a much better chance of being noticed by a moderator - and sooner. You do have enough reputation for that privilege (flagging posts) and some to spare. — Yunnosch

0___________ 0___________ · Accepted Answer · 2021-05-25T02:07:57

syscall is a wrapper that actually loads the register and executes the instruction syscall on 64 bit x86 or int 80h or sysenter on 32 bit x86 and it is part of the standard library.

example:

syscall:
  endbr64 
  mov     rax,rdi
  mov     rdi,rsi
  mov     rsi,rdx
  mov     rdx,rcx
  mov     r10,r8
  mov     r8,r9
  mov     r9,QWORD PTR [rsp+0x8]
  syscall

So the answer is that that syscall function is in the glibc.

In the kernel in the assembly file the syscall,sysentry instruction entry or int 80h interrupt handler (depending on the system implementation) does some stack magic, performs some checks and then calls the function which will handle the particular system call. Addresses of those functions are placed in the special table containing function pointers. But this part is very hard to be called the "library".

Where is SYSCALL() implemented in Linux?

2 Answers