Linux Syscall

[Tyler]

Does linux make use of SYSCALL under x86 as well as INT 0x80?

[SpooK]

Does linux make use of SYSCALL under x86 as well as INT 0x80?

Non-sequitur

IIRC, The Linux "SYSCALL" on the x86 is based on UNIX, that being software generated INT 0x80.

[Tyler]

Does linux make use of SYSCALL under x86 as well as INT 0x80?

Non-sequitur

IIRC, The Linux "SYSCALL" on the x86 is based on UNIX, that being software generated INT 0x80.

According to the intel manuals, there is a special SYSCALL instruction, are you saying they don't use it for compatability with Unix?

[Alboin]

According to the intel manuals, there is a special SYSCALL instruction, are you saying they don't use it for compatability with Unix?

Linux uses Int 0x80. Simple.

[urxae]

According to the intel manuals, there is a special SYSCALL instruction, are you saying they don't use it for compatability with Unix?

Linux uses Int 0x80. Simple.

Actually, recent linux versions have a "vsyscall page" mapped into a high memory address. It contains instructions for what Linux has determined (at startup) to be the best way to perform a system call, which applications can call as an alternative to int 0x80.
Try the following code on a 32-bit x86 Linux (also works when compiled to a 32-bit binary and run on an amd64 Linux):

Code: Select all

#include <stdio.h>

void *vdso = (void*) 0xffffe000;

int main() {
	FILE* f = fopen("vdso.elf", "wb+");
	fwrite(vdso, 0x1000, 1, f);
	fclose(f);
	return 0;
}

It writes the vsyscall page to "vdso.elf". If you examine it with, you will find it is an ELF file:

Code: Select all

$ objdump -d vdso.elf

vdso.elf:     file format elf32-i386

Disassembly of section .text.vsyscall:

ffffe400 <__kernel_vsyscall>:
ffffe400:       55                      push   ebp
ffffe401:       89 cd                   mov    ebp,ecx
ffffe403:       0f 05                   syscall 
ffffe405:       b9 2b 00 00 00          mov    ecx,0x2b
ffffe40a:       8e d1                   movl   ss,ecx
ffffe40c:       89 e9                   mov    ecx,ebp
ffffe40e:       5d                      pop    ebp
ffffe40f:       c3                      ret    
Disassembly of section .text.sigreturn:

ffffe500 <__kernel_sigreturn>:
ffffe500:       58                      pop    eax
ffffe501:       b8 77 00 00 00          mov    eax,0x77
ffffe506:       0f 05                   syscall 
Disassembly of section .text.rtsigreturn:

ffffe600 <__kernel_rt_sigreturn>:
ffffe600:       b8 ad 00 00 00          mov    eax,0xad
ffffe605:       0f 05                   syscall 

Int 0x80 should still work for backwards compatibility though.