Why doesn't the 'syscall' instruction work under Linux?

Question

I have a very basic assembly program that runs in Linux userland:

section .text
global _start

_start:
    mov edx, 14
    mov ecx, msg
    mov ebx, 1
    mov eax, 4
    syscall

    mov eax, 1
    syscall

section .data
msg db "Hello, World!", 0xA

However, this doesn't work as it is, but only if I replace the syscalls with int 0x80. Don't these do the same thing? I know that syscall was designed to be lower-latency, but other than that, I didn't think there was a difference. Why doesn't it work?

Maybe you're looking for sysenter? Linux maps a page with the user-space sysenter wrapper into the virtual address space of 32bit processes. This is the VDSO. — Peter Cordes
– Peter Cordes, Commented Dec 30, 2015 at 20:00
there are so called man-pages you really have to look up. especially about syscall, syscalls and the syscalls you want to call. you find everything you had to know about there. — sivizius
– sivizius, Commented Dec 30, 2015 at 21:36

Mehran Meidani · Accepted Answer · 2015-12-30 19:45:13Z

2

syscall works only in x86-64 operating systems and you should put the system call number in rax register instead of eax. See this website for more information.

answered Dec 30, 2015 at 19:45

Mehran Meidani

3411 silver badge13 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Peter Cordes Over a year ago

No system call numbers need more than 32bits to represent!! mov r32, imm32 zeros the upper32 of the 64bit register. Writing mov rax, 231 will just lead to wasted bytes in the machine code, with some assemblers. (Either REX.W=1 mov r, imm32 (sign-extending) or worse REX.W=1 mov r, imm64.)

Brendan · Accepted Answer · 2015-12-30 20:18:50Z

1

The syscall instruction doesn't store "return RIP" or "return RSP" anywhere, so these are typically stored in registers in previous instructions before the syscall instruction is used.

I suspect that on Linux RCX and RDX are used for this purpose; and that all the other parameters end up in different registers because of this.

answered Dec 30, 2015 at 20:18

Brendan

37.7k2 gold badges45 silver badges72 bronze badges

1 Comment

iBug Over a year ago

RCX and R11, actually

Collectives™ on Stack Overflow

Why doesn't the 'syscall' instruction work under Linux?

2 Answers 2

1 Comment

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related