6

As i understand, from windows xp, there is a sysenter instruction introduced, instead of 'int 2e' interrupt. But on win 10 there is syscall instruction used in ntdll. So is the sysenter used only for x86 windows systems? And syscall only for x64 bit systems?

  • 1
    I don't think this is on topic here. You're asking about generic intel instructions on Windows. – Evan Carroll Oct 3 '18 at 0:18
  • @EvanCarroll Why don't you think Intel instructions are on-topic in a reverse engineering Q&A site? Granted, one can easily grab an instruction set manual and figure it out quickly. It is still on-topic IMHO. – NirIzr Oct 3 '18 at 2:08
  • @NirIzr because it's asking for a difference between two pieces of technology. That's a classical engineering problem -- not reverse engineering. "What is the function of "sysenter" in the Windows kernel?" is potentially on-topic, but not likely I asked a similar question today on Unix.SE because even questions on how an operating system works in isolation of other software seem a better fit elsewhere. – Evan Carroll Oct 3 '18 at 5:59
  • I tend to disagree, I'm afraid. There can be more than one "on-topic" SE site for a given question. – NirIzr Oct 3 '18 at 6:10
8

The Intel and AMD instruction sets are similar but not identical.

There are many examples of that: FMA3/FMA4, AMD-V and VT-x (and their extensions), etc.

The fast system call interface is yet another difference.

  • Intel supports SYSENTER in all modes1 - Legacy Mode (or, on the few 32-bit only Intel CPUs, simply Protected Mode), Long Mode and Compatibility Mode. (It doesn't work in Real Mode, obviously, and the from now on I'm ignoring it.)

  • Intel supports SYSCALL only in 64-bit Long Mode2 (not compat. mode). It also requires setting a bit in some MSR.

  • AMD supports SYSENTER only in Legacy Mode3, not in any of the Long Mode submodes.

  • AMD supports SYSCALL in all modes4.

So as the OSDEV page on the topic says:

  • In 64-bit Long Mode - only SYSCALL works on both ISAs. (SYSENTER doesn't work on AMD.)
  • In Legacy Mode - only SYSENTER works on both ISAs. (SYSCALL doesn't work on Intel.)
  • There's no single instruction that works on both Intel and AMD in Compatibility Mode (SYSENTER doesn't work on AMD and SYSCALL doesn't work on Intel), but there's no need for one. A 32-bit kernel will stay in Legacy Mode after boot.

1 Intel® 64 and IA-32 architectures software developer's manual volume 2B: Instruction set reference, M-U, p. 4-668

2 Intel® 64 and IA-32 architectures software developer's manual volume 2B: Instruction set reference, M-U, p. 4-666

3 AMD64 Architecture Programmer’s Manual Volume 3: General-Purpose and System Instructions, p. 423

4 AMD64 Architecture Programmer’s Manual Volume 3: General-Purpose and System Instructions, p. 419

0

syscall (created by AMD) and sysenter (created by Intel) are competing implementations of fast switch-to-ring0 instructions. For compatibility, x64 systems support both types. That wasn't deemed to be necessary for 32-bit systems.

  • This is wrong. And mentioned in the links I put in my comment on the question. In Long Mode, SYSCALL is the only one supported both on AMD64 and on Intel 64. The AMD manual says explicitly on the page on SYSENTER "An invalid-opcode exception occurs if this instruction is used in long mode. Software should use the SYSCALL (and SYSRET) instructions in long mode." – conio Oct 8 '17 at 0:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.