Skip to content

Manually preserve rbx across cpuid instruction #851

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 29, 2020

Conversation

danielverkamp
Copy link
Contributor

This fixes an issue observed when using __cpuid and __cpuid_count with
Address Sanitizer enabled: the generated code uses the rbx register to
access ASAN tracking information without reloading it after cpuid,
resulting in a segfault since the rbx register is overwritten by cpuid
(https://crbug.com/1072045).

This seems like a compiler backend bug, and indeed there is a
long-standing LLVM bug report about a very similar issue:
https://bugs.llvm.org/show_bug.cgi?id=17907

To work around this issue, we can manually preserve the rbx register
contents in the inline assembly. This is the approach taken by LLVM's
own host cpuid detection code (lib/Host/Support.cpp). The original rbx
value is stashed in rsi, which is then swapped with rbx to restore the
original value as well as keep the output ebx value from the CPUID
instruction to be used as an output of the inline assembly.

The rbx clobber is also removed; this seems ineffective, and it
conflicts with the ebx output of the inline assembly (ebx is a
subregister of rbx): "Note that clobbering named registers that are also
present in output constraints is not legal."
(https://llvm.org/docs/LangRef.html#clobber-constraints)

This fixes an issue observed when using __cpuid and __cpuid_count with
Address Sanitizer enabled: the generated code uses the rbx register to
access ASAN tracking information without reloading it after cpuid,
resulting in a segfault since the rbx register is overwritten by cpuid
(https://crbug.com/1072045).

This seems like a compiler backend bug, and indeed there is a
long-standing LLVM bug report about a very similar issue:
https://bugs.llvm.org/show_bug.cgi?id=17907

To work around this issue, we can manually preserve the rbx register
contents in the inline assembly.  This is the approach taken by LLVM's
own host cpuid detection code (lib/Host/Support.cpp).  The original rbx
value is stashed in rsi, which is then swapped with rbx to restore the
original value as well as keep the output ebx value from the CPUID
instruction to be used as an output of the inline assembly.

The rbx clobber is also removed; this seems ineffective, and it
conflicts with the ebx output of the inline assembly (ebx is a
subregister of rbx): "Note that clobbering named registers that are also
present in output constraints is not legal."
(https://llvm.org/docs/LangRef.html#clobber-constraints)
@rust-highfive
Copy link

Thanks for the pull request, and welcome! The Rust team is excited to review your changes, and you should hear from @gnzlbg (or someone else) soon.

If any changes to this PR are deemed necessary, please add them as extra commits. This ensures that the reviewer can see what has changed since they last reviewed the code. Due to the way GitHub handles out-of-date commits, this should also make it reasonably obvious what issues have or haven't been addressed. Large or tricky changes may require several passes of review and changes.

Please see the contribution instructions for more information.

@Amanieu
Copy link
Member

Amanieu commented Apr 29, 2020

Can you add a comment in the code which points to the LLVM bug?

@danielverkamp
Copy link
Contributor Author

Sure, added a comment with a brief explanation and link.

@Amanieu Amanieu merged commit fb9bca9 into rust-lang:master Apr 29, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants