On a x86 CPU running in long mode, how is the user-mode $RSP value saved after the SYSCALL instruction by the kernel’s handler function?
When changing from user mode (CPL=3) to kernel mode (CPL=0), the $RSP value should be loaded from RSP0 in the active TSS, as described here. The SYSCALL documentation explicitly states the following:
The SYSCALL instruction does not save the stack pointer (RSP).
In the case of the Linux kernel, the SYSCALL handler saves the value of $RSP into some scratch space which is later loaded back before returning to user space.
Given that the user-mode $RSP should be crushed as soon as the privilege level is changed, how is it still valid at entry of the Linux SYSCALL handler and not already clobbered with the value of RSP0?
5