How does the gettimeofday syscall wor‍k?

Question

gettimeofday is a syscall of x86-86 according to this page(just search gettimeofday in the box):

int gettimeofday(struct timeval *t         


        

Answer 1

gettimeofday() on Linux is what's called a vsyscall and/or vdso. Hence you see the two lines:

0x00000034f408c2d4 : mov    $0xffffffffff600000,%rax
0x00000034f408c2db : callq  *%rax

in your disassembly. The address 0xffffffffff600000 is the vsyscall page (on x86_64).

The mechanism maps a specific kernel-created code page into user memory, so that a few "syscalls" can be made without the overhead of a user/kernel context switch, but rather as "ordinary" function call. The actual implementation is right here.

Answer 2

Syscalls generally create a lot of overhead, and given the abundance of gettimeofday() calls, one would prefer not to use a syscall. To that end, Linux kernel may map one or two special areas into each program, called vdso and vsyscall. Your implementation of gettimeofday() seems to be using vsyscall:

mov $0xffffffffff600000,%rax

This is the standard address of vsyscall map. Try cat /proc/self/maps to see that mapping. The idea behind vsyscall is that kernel provides fast user-space implementations of some functions, and libc just calls them.

Read this nice article for more details.