tetsuo(@tetsuoai):What the x86-64 syscall instruction does in the instant it runs. The syscall instruction saves the return address in rcx and the flags in r11, loads the kernel's entry point from LSTAR and a ring 0 code segment from STAR, and masks interrupts. The syscall instruction pushes nothing and switches no stack. The kernel's first instructions run swapgs and load a stack of their own. Single-stepped in gdb, then again inside the kernel booted under QEMU.

2026.09.13 22:59

What the x86-64 syscall instruction does in the instant it runs. The syscall instruction saves the return address in rcx and the flags in r11, loads the kernel's entry point from LSTAR and a ring 0 code segment from STAR, and masks interrupts. The syscall instruction pushes nothing and switches no stack. The kernel's first instructions run swapgs and load a stack of their own. Single-stepped in gdb, then again inside the kernel booted under QEMU.