What the x86-64 syscall instruction does in the instant it runs.
The syscall instruction saves the return address in rcx and the flags in r11, loads the kernel's entry point from LSTAR and a ring 0 code segment from STAR, and masks interrupts. The syscall instruction pushes nothing and switches no stack. The kernel's first instructions run swapgs and load a stack of their own.
Single-stepped in gdb, then again inside the kernel booted under QEMU.
더 보기
