Re: the x86 sysret_rip test fails on the Intel FRED architecture
From: Ammar Faizi
Date: Mon Jan 23 2023 - 04:02:34 EST
On 1/23/23 6:45 AM, H. Peter Anvin wrote:
static enum regs_ok check_regs_syscall(int syscall,
unsigned long arg1, unsigned long arg2)
{
register unsigned long r11 asm("%r11");
unsigned long rcx, rbx, tmp;
tmp is unused.
r11 = r11_sentinel;
rcx = rcx_sentinel;
asm volatile("push %3; popf; "
"lea 1f(%%rip),%2; "
"syscall; "
"1:"
: "+r" (r11), "+c" (rcx), "=b" (rbx)
: "g" (rflags_sentinel),
"a" (syscall), "D" (arg1), "S" (arg2));
BTW, I just realized this "push" is unsafe for userspace code if the
compiler decides to inline this inside a leaf function that uses the
redzone.
Reason: Because this "push;" clobbers redzone.
It doesn't always happen, but when that happens it can be confusing to
debug.
A simple workaround is: just compile it with "-mno-red-zone" flag.
Alternative, without using that flag, maybe preserve the value like:
movq -8(%rsp), %r12
pushq %[rflags_sentinel]
popf
movq %r12, -8(%rsp)
syscall
with "r12" and "memory" added to the clobber list.
What do you think?
--
Ammar Faizi