tetsuo(@tetsuoai):What the x86-64 syscall instruction does in the instant it runs. The syscall instruction saves the return address in rcx and the flags in r11, loads the kernel's entry point from LSTAR and a ring 0 code segment from STAR, and masks interrupts. The syscall instruction pushes nothing and switches no stack. The kernel's first instructions run swapgs and load a stack of their own. Single-stepped in gdb, then again inside the kernel booted under QEMU.

tetsuo

@tetsuoai

C and Assembly • Grok • @a_g_e_n_c //: 👾

Joined November 2022

726 Following 241.4K Followers

tetsuo@tetsuoai

2026.09.13 22:59

What the x86-64 syscall instruction does in the instant it runs. The syscall instruction saves the return address in rcx and the flags in r11, loads the kernel's entry point from LSTAR and a ring 0 code segment from STAR, and masks interrupts. The syscall instruction pushes nothing and switches no stack. The kernel's first instructions run swapgs and load a stack of their own. Single-stepped in gdb, then again inside the kernel booted under QEMU.