Understanding syscall and int 21h in Assembly Language

Who's in Control: The CPU or the Operating System?

In assembly language, there's no concept of "functions" like in high-level programming languages. Instead, there's a mechanism to interact with the operating system to perform essential tasks like reading files, printing text, accessing the network, etc. This is where instructions like syscall and int 21h come into play.

1. What is int 21h?

Origin:

• int stands for Interrupt.

• 21h is the interrupt number used by DOS (Disk Operating System) to provide system services.

How it Works:

When you execute int 21h, the CPU triggers a software interrupt, and control is transferred to the interrupt handler in the operating system, which executes the desired function depending on the value in the AH register.

Example:

mov ah, 09h        ; Function: print string
mov dx, offset msg ; Address of message in DX
int 21h            ; Call DOS interrupt

Services Provided by int 21h:

• Printing text

• Reading user input

• File handling

• Disk access

• Program termination

Is int 21h a CPU Instruction?

• No, interrupts are supported by the CPU, but the meaning of int 21h is defined by the operating system.

2. What is syscall?

Origin:

• Introduced in modern systems like Linux and Windows NT.

• syscall is a special CPU instruction (e.g., on x86-64) that enables direct transition to kernel mode.

How it Works:

• The system call number is placed in a specific register (usually rax in x86-64).

• Parameters are passed in other registers (rdi, rsi, rdx, ...).

• The syscall instruction is executed, switching execution to kernel mode, where the OS decodes the request and performs the operation.

Example (x86-64 Linux):

mov rax, 1      ; syscall number: write
mov rdi, 1      ; file descriptor: stdout
mov rsi, msg    ; pointer to message
mov rdx, len    ; message length
syscall         ; invoke kernel service

Difference Between syscall and int 0x80:

• int 0x80 was the classic way in 32-bit Linux.

• syscall is faster, used in 64-bit mode, and reduces context-switch overhead.

3. Cross-Architecture & OS Comparison

4. Relationship Between the CPU and the OS

• The CPU provides the mechanism (e.g., int, syscall, svc, ecall) to enter kernel mode.

• The operating system defines the meaning, services, and behaviors.

• In short: the CPU opens the gate, but the OS decides what lies beyond it.

5. The Future of System Calls

• As systems evolve, there's increasing focus on speed, security, and multi-core performance.

• Technologies like eBPF, and WebAssembly System Interface (WASI) aim to offer safe, portable runtime APIs that go beyond traditional int and syscall.

Conclusion

• int 21h was a traditional way to call system services in DOS.

• syscall is a modern, fast method for requesting services directly from the kernel.

• Both depend on the operating system to implement functionality.

• Each CPU and OS has its own mechanism, but the core idea is the same: safe and structured transfer of control from user code to the system kernel.