As i understand, from windows xp, there is a
sysenter instruction introduced, instead of 'int 2e' interrupt. But on win 10 there is
syscall instruction used in ntdll. So is the
sysenter used only for x86 windows systems? And
syscall only for x64 bit systems?
The Intel and AMD instruction sets are similar but not identical.
There are many examples of that: FMA3/FMA4, AMD-V and VT-x (and their extensions), etc.
The fast system call interface is yet another difference.
SYSENTERin all modes1 - Legacy Mode (or, on the few 32-bit only Intel CPUs, simply Protected Mode), Long Mode and Compatibility Mode. (It doesn't work in Real Mode, obviously, and the from now on I'm ignoring it.)
SYSCALLonly in 64-bit Long Mode2 (not compat. mode). It also requires setting a bit in some MSR.
SYSENTERonly in Legacy Mode3, not in any of the Long Mode submodes.
SYSCALLin all modes4.
So as the OSDEV page on the topic says:
- In 64-bit Long Mode - only
SYSCALLworks on both ISAs. (
SYSENTERdoesn't work on AMD.)
- In Legacy Mode - only
SYSENTERworks on both ISAs. (
SYSCALLdoesn't work on Intel.)
- There's no single instruction that works on both Intel and AMD in Compatibility Mode (
SYSENTERdoesn't work on AMD and
SYSCALLdoesn't work on Intel), but there's no need for one. A 32-bit kernel will stay in Legacy Mode after boot.
syscall (created by AMD) and sysenter (created by Intel) are competing implementations of fast switch-to-ring0 instructions. For compatibility, x64 systems support both types. That wasn't deemed to be necessary for 32-bit systems.