[lkml]   [1998]   [Jun]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: SYSENTER based syscalls patch, 2.1.105, RFC
<> writes:

> [1 <text/plain; US-ASCII (7bit)>]
> the attached patch implements SYSENTER/SYSEXIT based system calls for P6
> type x86 CPUs that support it. (tested only on PII, - K6, PPro anyone?)

I have played around with the corresponding syscall/sysret features of
the K6 and here are some notes/experiences/code
fragments. Unfortunately I have an older version of the K6 which
implements a rather limited version of syscall/sysret.

On the K6 you have a special register called STAR_MSR, which contains
two segment selectors and an eip. One selector and the eip is used by
the syscall instruction, the other selector is used by sysret. After
entering the kernel using syscall ecx contains the return address. esp
is not changed.

Round trip times are 31 cycles (just entering the kernel and
immediately return to user level).

So we have a nice and fast way to enter the kernel but two problems:

- Binary compatibility - ecx is changed, we have to use another
register at least to transfer the value into the kernel (ebp)

- esp is not changed, it still points to the user level stack. We have
to reload it after entering the kernel. We have to keep track of the
current kernel esp, which should be simple (at least for an uni
processor Linux)

- Another problem are the different K6 revisions:

There is a big difference between the documented behavior
(21086.pdf) and the behavior of early implementations of the K6.

Documented behavior:
STAR-MSR: 63-48 SYSRET cs and ss selector base
during SYSRET this is copied to cs, ss = cs+8
STAR-MSR: 47-32 SYSCALL cs and ss selector base
during SYSCALL this is copied to cs, ss = cs+8
STAR-MSR: 31-0 Target eip address
during SYSCALL this is copied to eip

Older versions of K6:
STAR-MSR: 63-48 not writable, write operations lead to a
general protection fault
STAR-MSR: 47-32 SYSCALL cs and ss selector base
during SYSCALL this is copied to cs, ss = cs+8
during SYSRET this is copied to cs, priviledge is set to 3,
STAR-MSR: 31-0 Target eip address
during SYSCALL this is copied to eip

So we have a problem with our segment selectors. Maybe we can use
syscall to enter the kernel and iret to leave it (at least on those
older processor versions)

I will see if I can come up with a complete patch for the k6 over the
weekend. In the meantime here are some code fragments to show, how it
works and to allow to play around with syscall and sysret. It is a
small loadable module and a small c program using syscall and
sysret. Please try to understand what happens before using it. (And it
doesn't look very nice, it is just some code to find out, how it


PS: To verify the behavior I have forced a segmentation fault in my
small test program. The core dump shows the following segment
registers (kernel cs with user level privileges, ss=cs+0x10):

(gdb) i r
eflags 0x10246 66118
cs 0x13 19
ss 0x23 35
ds 0x2b 43

To verify, that esp isn't reloaded and ecx contains the return address
the module prints both values after entering the kernel using syscall.

hello world (esp: bffffc4c, ecx: 8048420)

[unhandled content-type:application/octet-stream][unhandled content-type:application/octet-stream][unhandled content-type:application/octet-stream]--
I get up each morning, gather my wits.
Pick up the paper, read the obits.
if I'm not there I know I'm not dead.
So I eat a good breakfast and go back to bed. Peete Seeger
 \ /
  Last update: 2005-03-22 13:43    [W:0.368 / U:0.256 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site