What is better "int 0x80" or "syscall" in 32-bit code on Linux?

linux assembly x86 system-calls 32-bit
Alex picture Alex · Oct 9, 2012 · Viewed 34.2k times · Source

I study the Linux kernel and found out that for x86_64 architecture the interrupt int 0x80 doesn't work for calling system calls1.

For the i386 architecture (32-bit x86 user-space), what is more preferable: syscall or int 0x80 and why?

I use Linux kernel version 3.4.

Footnote 1: int 0x80 does work in some cases in 64-bit code, but is never recommended. What happens if you use the 32-bit int 0x80 Linux ABI in 64-bit code?

Answer

Paweł Dziepak picture Paweł Dziepak · Oct 9, 2012
  • syscall is the default way of entering kernel mode on x86-64. This instruction is not available in 32 bit modes of operation on Intel processors.
  • sysenter is an instruction most frequently used to invoke system calls in 32 bit modes of operation. It is similar to syscall, a bit more difficult to use though, but that is the kernel's concern.
  • int 0x80 is a legacy way to invoke a system call and should be avoided.

The preferred way to invoke a system call is to use vDSO, a part of memory mapped in each process address space that allows to use system calls more efficiently (for example, by not entering kernel mode in some cases at all). vDSO also takes care of more difficult, in comparison to the legacy int 0x80 way, handling of syscall or sysenter instructions.

Also, see this and this.

Related questions

Compile/run assembler in Linux?

I'm fairly new to Linux (Ubuntu 10.04) and a total novice to assembler. I was following some tutorials and I couldn't find anything specific to Linux. So, my question is, what is a good package to compile/run assembler and what …

Read More
Using gdb to single-step assembly code outside specified executable causes error "cannot find bounds of current function"

I'm outside gdb's target executable and I don't even have a stack that corresponds to that target. I want to single-step anyway, so that I can verify what's going on in my assembly code, because I'm not an expert at …

Read More
How do I disassemble raw 16-bit x86 machine code?

I'd like to disassemble the MBR (first 512 bytes) of a bootable x86 disk that I have. I have copied the MBR to a file using dd if=/dev/my-device of=mbr bs=512 count=1 Any suggestions for a Linux utility that …

Read More