Exercise 1: Why Syscalls Use R10 Instead of RCX for Argument 4 — Possible Solution ==================================================================== WHAT assembly2-5's OWN CONVENTION SAYS ------------------------------ Per assembly2-5, the ordinary System V AMD64 ABI function-calling convention passes the 4th integer/pointer argument in RCX (the full order being RDI, RSI, RDX, RCX, R8, R9). WHY SYSCALLS CAN'T USE RCX IN THAT SAME SLOT ------------------------------ Per this chapter's own explanation, the SYSCALL instruction itself internally CLOBBERS RCX as part of its own mechanism for making the transition into the kernel — RCX gets overwritten as a side effect of executing SYSCALL itself, specifically to hold the return address the CPU needs afterward. If the Linux syscall convention still tried to use RCX to carry the 4th argument's actual value, that value would already be destroyed by the very instruction that's supposed to use it, before the kernel ever got a chance to read it. WHY R10 IS THE SUBSTITUTE ------------------------------ Since RCX is unusable for this specific purpose, the Linux syscall convention simply reassigns the 4th argument slot to a DIFFERENT register — R10 — which SYSCALL does not clobber, and which is otherwise unused by the standard argument-passing order. This preserves the same overall pattern (six possible register-passed arguments) while working around the one register SYSCALL itself needs for its own internal purposes. WHY THIS IS A REAL, EASY MISTAKE TO MAKE ------------------------------ Since the syscall argument order (RDI, RSI, RDX, R10, R8, R9) matches assembly2-5's own ordinary calling convention in every position EXCEPT the 4th, it's easy to assume the two conventions are simply identical and default to using RCX out of habit — exactly the mistake this chapter's own warn-box is written to head off. WHY THIS WORKS AS AN ANSWER ------------------------------ It explains the actual mechanical reason RCX is unusable here (SYSCALL clobbers it for its own internal return-address purposes), rather than treating the R10 substitution as an arbitrary difference, and explains why the near-identical overlap between the two conventions makes the mistake this chapter warns about a genuinely easy one.