Re: Need help in understanding x86 syscall

[Zachary Amsden <zach@vmware.com>]

Steven Rostedt wrote:

>I expect that if I had a Gentoo system that I compiled for my machine,
>this would be different. But I suspect that Debian still wants to run on
>my old Pentium 75MHz laptop.  How would libc know to use sysenter
>instead of int 0x80.  It could do a test of the system, but would there
>be an if statement for every system call then?   I guess that libc needs
>to be compiled either to use it or not. Since there are still several
>machines out there that don't have this feature, it would be safer to
>not use it.
>  
>

zach-dev2:~ $ ldd /bin/ls
        linux-gate.so.1 =>  (0xffffe000)

This is the vsyscall entry point, which gets linked by ld into all 
processes.  It is a kernel page which is visible to user space, and is 
rewritten to support sysenter if indeed that instruction is available.  
Glibc has fixed entry points to this page.  Here is a view of the system 
call entry point on a machine which supports sysenter:

(gdb) break _init
Breakpoint 1 at 0x8049522
(gdb) run
Starting program: /bin/ls
(no debugging symbols found)...[Thread debugging using libthread_db enabled]
[New Thread 1075283616 (LWP 5328)]
[Switching to Thread 1075283616 (LWP 5328)]

Breakpoint 1, 0x08049522 in _init ()
(gdb) x/10i 0xffffe400
0xffffe400:     push   %ecx
0xffffe401:     push   %edx
0xffffe402:     push   %ebp
0xffffe403:     mov    %esp,%ebp
0xffffe405:     sysenter
0xffffe407:     nop   
0xffffe408:     nop   
0xffffe409:     nop   
0xffffe40a:     nop   
0xffffe40b:     nop   

On a machine that does not support sysenter, this will give you:

int $0x80
ret

The int $0x80 system calls are still fully supported by a sysenter 
capable kernel, since it must run older binaries and potentially support 
syscalls during early boot up before it is known that sysenter is supported.

Zach