UNIX for Dummies Questions & Answers

I recently went through Understanding the linux kernel, to get an idea of how system calls and interrupts function in an x86 based machine.

However, the level of detail has left me slightly confused. Here's what I understand.

System call process:

User mode:
User code calls a library function -> library function involves making a system call -> the int 0x80 instruction is executed causing transfer to kernel mode

Kernel mode:
Dispatch table is looked up for validity of the system call no. passed via eax register and if valid, backs up remaining structures onto kernel mode stack->system call routine calls the actual system call service routine.

Interrupt handling:
interrupt vector used to get into the IDT and the segment selector is retrieved after suitable privelege checks.-> After backing up registers, CS EIP obtained from the contents of the Gate descriptor and control jumps to 1st instruction of handler.

What I am not able to wrap my head around is how the above two : system call and interrupt handling tie in or overlap..

What i think happens is:

USER MODE | Kernel mode

User code->API->wrapper(0x80) -> Interrupt handling-> System call lookup(dispatch table)->System call routine.

Could someone help confirm / correct my understanding?

p.s the main area where i am fuzzy is what happens once the wrapper routine in the library does the system call. What location does the interrupt handler point to? And how is the system call no. used post it being put in EAX.?

Could this post be moved to the Unix for Dummies Q&A?

I dont know which Linux kernel book you are referring to...but the book from the creators of BSD is a good one as it goes throgh those details in a simple and conceptual manner...so check it out.
The API is the wrapper...0x80 isnt a wrapper...it is a software interrupt that is used to switch mode from user to kernel.

That location is known only to the kernel as then the process is running in kernel mode...which could be a physical or logical address based on the mem mgmt policy the kernel uses.
The system call no that is loaded into the eax register is used to index into the dispatch table...the kernel retrieves the address of the routine to service the interrupt based on the system call no found in eax...and then control is transferred to the first instruction at that address.

Hmm so as I understand it,

int 0x80 causes the change to the kernel mode.

here 0x80 is used to index the IDT to get the location of the ISR.

What does the ISR location usually contain?

Does the ISR have code to use the system call no. from EAX to look into the dispatch table?
Also, I guess i'll have to look into how the dispatch table is populated in the first place.

The confusing part for me is that there seem to be 2 jumps here once we are in kernel mode.
1) Look up Interrupt vector table and jump to ISR
2) Look up dispatch table and jump to System call handler.

Please correct me if I'm wrong.

This book is what I'm referring to: Amazon.com: Understanding the Linux Kernel, Third Edition (9780596005658): Daniel P. Bovet, Marco Cesati Ph.D.: Books

Yes it is just a sw interrupt for switching from user to kernel mode.
No 0x80 is not the system call no...the system call no is inserted into eax by the wrapper routine before the int 0x80 instruction is executed...so for ex. if you call fputs its job is to setup the system call no in eax and then execute the int 0x80 instruction for mode switching.
It contains the instructions that makeup the ISR.
That is the job of the kernel...it looks up the system call no in eax and then indexes into the dispatch table to get the address of the ISR and then jumps to that address.
Each dispatch table entry has two parts...one is the index or system call no and the other is the address of the ISR.
Yes you are wrong because the dispatch table is the same as the interrupt vector table and these terms are used interchangeably...similarly ISR is the same as the system call handler.
I havent looked at it...try reading the BSD one...it is here.

Note that using int 0x80 to enter kernel mode has been deprecated since kernel 2.5 and replaced by the faster sysenter/syscall instructions when available.

One more clarification,
From what i understand, there are a limited number of exceptions made available. But the no. of system calls is quite high,

If the dispatch table is indexed via the system call no. , this would seem to indicate there are a huge no. of entries in the dispatch table............but this doesnt seem to be the case right?

Meanwhile, i obtained the book mentioned above..but that doesnt give much x86 specific details.