Home | Notifications | New Note | Local | Federated | Search | Logout

Note Detail

Ammar Nofan Faizi@ammarfaizi2@social.gnuweeb.org (2026-09-18 18:15:41)
RE: https://infosec.exchange/@andersonc0d3/117283945508121323

This reminds me of an ABI contract problem between kernel space and user space.

https://lore.kernel.org/lkml/alpine.LSU.2.20.2110131601000.26294@wotan.suse.de/

Originally, the rule for register clobbering for the `syscall` instruction on x86-64 Linux was the same as for a generic function following the System V AMD64 ABI.

Back in 2021, the x86-64 kernel maintainers argued that the kernel was free to clobber all caller-saved registers, even though it didn't.

But after some source code archaeology in glibc, Michael Matz found evidence that glibc has always assumed `syscall` only clobbers %rax, %rcx, and %r11.

The proof is the clobber list in glibc's inline assembly, which only contains "cc", "r11", "cx". And that code dates back to 2001. Note that %rax is the syscall return value, clobbered via the output operand "=a".

In other words, there was never a time when the kernel didn't save and restore all other registers, so it can't stop doing so now.

After that, the psABI finally explicitly stated that the `syscall` instruction only clobbers %rax, %rcx, and %r11. It restores all other registers.