Re: Need help in understanding x86 syscall

Zachary Amsden
2005-08-11T17:59:25Z

Steven Rostedt wrote:

>I expect that if I had a Gentoo system that I compiled for my machine,
>this would be different. But I suspect that Debian still wants to run on
>my old Pentium 75MHz laptop. How would libc know to use sysenter
>instead of int 0x80. It could do a test of the system, but would there
>be an if statement for every system call then? I guess that libc needs
>to be compiled either to use it or not. Since there are still several
>machines out there that don't have this feature, it would be safer to
>not use it.
>
>

zach-dev2:~ $ ldd /bin/ls
linux-gate.so.1 => (0xffffe000)

This is the vsyscall entry point, which gets linked by ld into all
processes. It is a kernel page which is visible to user space, and is
rewritten to support sysenter if indeed that instruction is available.
Glibc has fixed entry points to this page. Here is a view of the system
call entry point on a machine which supports sysenter:

(gdb) break _init
Breakpoint 1 at 0x8049522
(gdb) run
Starting program: /bin/ls
(no debugging symbols found)...[Thread debugging using libthread_db enabled]
[New Thread 1075283616 (LWP 5328)]
[Switching to Thread 1075283616 (LWP 5328)]

Breakpoint 1, 0x08049522 in _init ()
(gdb) x/10i 0xffffe400
0xffffe400: push %ecx
0xffffe401: push %edx
0xffffe402: push %ebp
0xffffe403: mov %esp,%ebp
0xffffe405: sysenter
0xffffe407: nop
0xffffe408: nop
0xffffe409: nop
0xffffe40a: nop
0xffffe40b: nop

On a machine that does not support sysenter, this will give you:

int $0x80
ret

The int $0x80 system calls are still fully supported by a sysenter
capable kernel, since it must run older binaries and potentially support
syscalls during early boot up before it is known that sysenter is supported.

Zach