docs/concepts/kernel/kernel_invariants.md

# Zircon Kernel Invariants

On x86, Zircon needs to maintain the following invariants for code running
in ring 0 (kernel mode).

These invariants are documented here because they are not necessarily easy
to test -- breaking an invariant will not necessarily be caught by
Zircon's test suite.

* Flags register:

  * The direction flag (DF) should be 0.  This is required by the x86
    calling conventions.

    If this flag is set to 1, uses of x86 string instructions (e.g. `rep
    movs` in `memcpy()` or inlined by the compiler) can go wrong and copy
    in the wrong direction.  It is OK for a function to set this flag to 1
    temporarily as long as it changes it back to 0 before returning or
    calling other functions.

  * The alignment check flag (AC) should normally be 0.  On CPUs that
    support SMAP, this prevents the kernel from accidentally reading or
    writing userland data.

* The `gs_base` register must point to the current CPU's `x86_percpu`
  struct whenever running in kernel mode with interrupts enabled.
  `gs_base` should only be changed to point to something else while
  interrupts are disabled.  For example, the `swapgs` instruction should
  only be used when interrupts are disabled.

* The following are partially enforced by the compiler:

  * No use of extended registers (SSE, AVX, x87, etc.) is allowed, because
    that would clobber userland's register state.

    This is partially achieved by passing `-mno-sse` to the compiler.  This
    option is necessary to prevent the compiler from using SSE registers in
    optimizations (e.g. memory copies).

    We would like to prevent accidentally using the `float` or `double`
    types in kernel code, but GCC and Clang won't do that for us in all
    cases.  `-mno-sse` does not prevent using `float`/`double` with either
    compiler -- the compilers will use x87 instructions instead.

    We compile with `-msoft-float`, which seems to prevent GCC from
    generating x87 instructions (and hence using x87 registers): GCC 6.3.0
    will give an error on `float`/`double` arithmetic and return values,
    but it does not prevent passing these types around as arguments.
    However, passing `-msoft-float` to Clang seems to have no effect: Clang
    7.0.0 will still generate x87 instructions (and use x87 registers) for
    code using `float` or `double`.

  * No storing data below `%rsp` on the stack.  Note that userland code can
    do this: the SysV x86-64 ABI allows functions to store data in the "red
    zone", which is the 128 bytes below %rsp.  However, kernel code cannot
    use the red zone because interrupts may clobber this region -- the CPU
    pushes data onto the stack immediately below %rsp when it invokes an
    interrupt handler.

    This is generally enforced by passing `-mno-red-zone` to the compiler.