blob: a29d48020e60f90be4ea2bb941adafc193b3c4e1 [file] [log] [blame] [view]
# Zircon Kernel Invariants
On x86, Zircon needs to maintain the following invariants for code running
in ring 0 (kernel mode).
These invariants are documented here because they are not necessarily easy
to test -- breaking an invariant will not necessarily be caught by
Zircon's test suite.
* Flags register:
* The direction flag (DF) should be 0. This is required by the x86
calling conventions.
If this flag is set to 1, uses of x86 string instructions (e.g. `rep
movs` in `memcpy()` or inlined by the compiler) can go wrong and copy
in the wrong direction. It is OK for a function to set this flag to 1
temporarily as long as it changes it back to 0 before returning or
calling other functions.
* The alignment check flag (AC) should normally be 0. On CPUs that
support SMAP, this prevents the kernel from accidentally reading or
writing userland data.
* The `gs_base` register must point to the current CPU's `x86_percpu`
struct whenever running in kernel mode with interrupts enabled.
`gs_base` should only be changed to point to something else while
interrupts are disabled. For example, the `swapgs` instruction should
only be used when interrupts are disabled.
* The following are partially enforced by the compiler:
* No use of extended registers (SSE, AVX, x87, etc.) is allowed, because
that would clobber userland's register state.
This is partially achieved by passing `-mno-sse` to the compiler. This
option is necessary to prevent the compiler from using SSE registers in
optimizations (e.g. memory copies).
We would like to prevent accidentally using the `float` or `double`
types in kernel code, but GCC and Clang won't do that for us in all
cases. `-mno-sse` does not prevent using `float`/`double` with either
compiler -- the compilers will use x87 instructions instead.
We compile with `-msoft-float`, which seems to prevent GCC from
generating x87 instructions (and hence using x87 registers): GCC 6.3.0
will give an error on `float`/`double` arithmetic and return values,
but it does not prevent passing these types around as arguments.
However, passing `-msoft-float` to Clang seems to have no effect: Clang
7.0.0 will still generate x87 instructions (and use x87 registers) for
code using `float` or `double`.
* No storing data below `%rsp` on the stack. Note that userland code can
do this: the SysV x86-64 ABI allows functions to store data in the "red
zone", which is the 128 bytes below %rsp. However, kernel code cannot
use the red zone because interrupts may clobber this region -- the CPU
pushes data onto the stack immediately below %rsp when it invokes an
interrupt handler.
This is generally enforced by passing `-mno-red-zone` to the compiler.