Page 1 of 1

Linux Syscall

Posted: Fri Mar 02, 2007 2:03 pm
by Tyler
Does linux make use of SYSCALL under x86 as well as INT 0x80?

Re: Linux Syscall

Posted: Sat Mar 03, 2007 7:03 pm
by SpooK
Tyler wrote:Does linux make use of SYSCALL under x86 as well as INT 0x80?
Non-sequitur :?

IIRC, The Linux "SYSCALL" on the x86 is based on UNIX, that being software generated INT 0x80.

Re: Linux Syscall

Posted: Sat Mar 03, 2007 9:42 pm
by Tyler
SpooK wrote:
Tyler wrote:Does linux make use of SYSCALL under x86 as well as INT 0x80?
Non-sequitur :?

IIRC, The Linux "SYSCALL" on the x86 is based on UNIX, that being software generated INT 0x80.
According to the intel manuals, there is a special SYSCALL instruction, are you saying they don't use it for compatability with Unix?

Re: Linux Syscall

Posted: Sat Mar 03, 2007 9:58 pm
by Alboin
Tyler wrote:According to the intel manuals, there is a special SYSCALL instruction, are you saying they don't use it for compatability with Unix?
Linux uses Int 0x80. Simple.

Re: Linux Syscall

Posted: Sun Mar 04, 2007 5:52 am
by urxae
Alboin wrote:
Tyler wrote:According to the intel manuals, there is a special SYSCALL instruction, are you saying they don't use it for compatability with Unix?
Linux uses Int 0x80. Simple.
Actually, recent linux versions have a "vsyscall page" mapped into a high memory address. It contains instructions for what Linux has determined (at startup) to be the best way to perform a system call, which applications can call as an alternative to int 0x80.
Try the following code on a 32-bit x86 Linux (also works when compiled to a 32-bit binary and run on an amd64 Linux):

Code: Select all

#include <stdio.h>

void *vdso = (void*) 0xffffe000;

int main() {
	FILE* f = fopen("vdso.elf", "wb+");
	fwrite(vdso, 0x1000, 1, f);
	fclose(f);
	return 0;
}
It writes the vsyscall page to "vdso.elf". If you examine it with, you will find it is an ELF file:

Code: Select all

$ objdump -d vdso.elf

vdso.elf:     file format elf32-i386

Disassembly of section .text.vsyscall:

ffffe400 <__kernel_vsyscall>:
ffffe400:       55                      push   ebp
ffffe401:       89 cd                   mov    ebp,ecx
ffffe403:       0f 05                   syscall 
ffffe405:       b9 2b 00 00 00          mov    ecx,0x2b
ffffe40a:       8e d1                   movl   ss,ecx
ffffe40c:       89 e9                   mov    ecx,ebp
ffffe40e:       5d                      pop    ebp
ffffe40f:       c3                      ret    
Disassembly of section .text.sigreturn:

ffffe500 <__kernel_sigreturn>:
ffffe500:       58                      pop    eax
ffffe501:       b8 77 00 00 00          mov    eax,0x77
ffffe506:       0f 05                   syscall 
Disassembly of section .text.rtsigreturn:

ffffe600 <__kernel_rt_sigreturn>:
ffffe600:       b8 ad 00 00 00          mov    eax,0xad
ffffe605:       0f 05                   syscall 
Int 0x80 should still work for backwards compatibility though.