RE: the x86 sysret_rip test fails on the Intel FRED architecture

From: Li, Xin3
Date: Sat Jan 21 2023 - 22:38:42 EST


> >> The x86 sysret_rip test has the following assertion:
> >>
> >> /* R11 and EFLAGS should already match. */
> >> assert(ctx->uc_mcontext.gregs[REG_EFL] ==
> >> ctx->uc_mcontext.gregs[REG_R11]);
> >>
> >> This is being tested to avoid kernel state leak due to sysret vs
> >> iret, but that on FRED r11 is *always* preserved, and the test just fails.
> >
> >Let's figure out the reason that FRED acts differently, first. Right
> >now, the SDM says:
> >
> > SYSCALL also saves RFLAGS into R11
> >
> >so that behavior of SYSCALL _looks_ architectural to me. Was this
> >change in SYSCALL behavior with FRED intentional?
> >
> >If not intentional, it might be something that can still be fixed. If
> >it is intentional and is going to be with us for a while we have a few
> >options. If userspace is _really_ depending on this behavior, we could
> >just clobber r11 ourselves in the FRED entry path. If not, we can
> >remove the assertion in the selftest.
>
> We can't clobber it in the FRED entry path, since it is common for all events, but we
> could do it in the syscall dispatch.

Yes, adding "regs->r11 = regs->flags" in the SYSCALL dispatch does make
the test pass.

>
> However, it doesn't seem to make sense to do so to me. The current behavior is
> much more of an artifact than desired behavior.

We kind of have an agreement that %r11 = %flags after returning from the kernel.

And the question is, is it what we want?