You’re running into one surprising difference between i386 and x86_64: they don’t use the same system call mechanism. The correct code is: movq $60, %rax movq $2, %rdi ; not %rbx! syscall Interrupt 0x80 always invokes 32-bit system calls. It’s used to allow 32-bit applications to run on 64-bit systems. For the purposes of learning, … Read more
You’ll need the Linux kernel sources in order to see the actual source of the system calls. Manual pages, if installed on your local system, only contain the documentation of the calls and not their source itself. Unfortunately for you, system calls aren’t stored in just one particular location in the whole kernel tree. This … Read more
A quick fix of your code: push 0x41414141 ; put ‘AAAA’ into stack memory mov ecx,esp ; pointer to the ‘AAAA’ mov eax, 4 ; write is syscall 4 for 32-bit Linux mov ebx, 1 ; stdout mov edx, 4 int 0x80 add esp,4 ; restore stack No explanation, as you should first check what … Read more
From man 2 write, you can see the signature of write is, ssize_t write(int fd, const void *buf, size_t count); It takes a pointer (const void *buf) to a buffer in memory. You can’t pass it a char by value, so you have to store it to memory and pass a pointer. (Don’t print one … Read more
RCX, along with R11, is used by the syscall instruction, being immediately destroyed by it. Thus these registers are not only not saved after syscall, but they can’t even be used for parameter passing. Thus R10 was chosen to replace unusable RCX to pass fourth parameter. See also this answer for a bit more information … Read more
This is not exactly an answer, but looking over epoll, these problems seem to be solved for it. And if I can trust this message in netdev, they at least tried to fix it in poll() and select() too (breaking other things). Thus, this bug doesn’t seem to be relevant in foreseeable future.
Here’s an archive of a really good online reference with links to documentation and kernel source code.
close is a rather special case. Not only is it not restartable on Linux; when close returns with EINTR on Linux, it has actually already succeeded, and making another call to close will fail with EBADF in single-threaded processes and cause extremely dangerous file-descriptor races in multi-threaded processes. As of the published POSIX 2008, this … Read more
getrandom and getentropy were added to glibc in version 2.25. As of July 2017, most Linux distributions have not yet updated to this version (e.g. Debian’s most recent release, which just came out, has 2.24) but they should soon. Here is how to use the glibc wrappers if available and fall back to the raw … Read more
And the real question in this topic, is the same thing to call this macro in my code as dividing by 256? It will probably always work in the cases where the child process terminates normally (i.e., by calling exit(), not by a segmentation fault, assertion failure, etc.). The status stored by waitpid() encodes both … Read more