Subject: Re: where do system calls from userland start
To: Travis H. <solinym@gmail.com>
From: David P. Reese, Jr. <daver@siginfo.org>
List: tech-kern
Date: 08/25/2006 01:22:54
On Aug 24, 2006, at 6:10 PM, Travis H. wrote:
[snip]
> Also, I recall reading about NT internals versus Unix, and someone
> mentioned that if you wanted to add a new system call or change the
> meaning of an argument or add an argument, that you got a lot of
> resistance in Unix.  I'm sure there was a good reason, so why exactly
> is that the case?  Does NT have a technical advantage in the way it
> handles system calls?

On Unix, the system call layer is the public interface to the
kernel.  On Windows NT, kernel32.dll is more or less the public
interface to the kernel.  As long as the public interfaces exposed
by kernel32.dll remain stable, Microsoft can make whatever changes
they want to the system call layer.  However, this means that your
syscall table must be matched with your version of kernel32.dll.

So it's not that NT has some magical technical advantage with
regard to how they handle system calls.  It's just that they have
chosen to not make them a public interface.

IIRC, some Windows hotfixes will actually reorder entries in the
syscall table.

--
David P. Reese, Jr.
daver@siginfo.org