[BUG] Kernel jump argument moves omit their register constraints #6

New issue

Closed

opened 2026-09-14 13:19:42 +02:00 by erikinkinen · 0 comments

erikinkinen commented

2026-09-14 13:19:42 +02:00

Owner

Summary

The x86_64 jump_to_kernel assembly assigns its handoff pointer and length to RDI and RSI using sequential moves, while describing those operands and the jump target as arbitrary input registers. The compiler is not told that those moves overwrite registers. A permitted allocation can therefore destroy a later input before it is used.

Reproduction

Inspect src/transition.rs at Bootloader e7fa39357a38c21529cccfd16cf3446eb07e8aa5. The block emits mov rdi, {handoff_ptr}, mov rsi, {handoff_size} and jmp {entry} while all four operands use in(reg). The source contract permits an argument or jump operand to occupy a register overwritten by an earlier instruction.

This is an assembly-constraint review finding. No Bootloader VM failure is attributed to it, and no hosted jump or privileged instruction was executed to investigate it.

Expected and actual behavior

Expected: the compiler preserves the independently supplied entry address, stack top, handoff pointer and exact serialized length through the nonreturning transfer. RDI and RSI must contain the existing two argument values at kernel entry.

Actual: the assembly contract omits the destination-register effects of its argument moves. Correctness depends on the compiler choosing a nonconflicting allocation. The current successful boots do not establish correctness for every permitted allocation or future compiler build.

Environment and identity

Bootloader source: e7fa39357a38c21529cccfd16cf3446eb07e8aa5.
Boundary: UEFI x86_64 boot-to-kernel transfer; current host toolchain Rust 1.97.1.
Existing inputs: validated executable entry, mapped stack and immutable serialized handoff bytes.
Scope: preserve the existing transition contract, interrupt/direction flag operations and explicit mappings. Add no authority or fallback discovery.

Evidence and prior checks

The finding follows inspection of the concrete initial userspace argument overwrite in Kernel issue 10. Bootloader has the same undeclared sequential-register-write pattern, with an additional live jump-target operand. Bind RDI and RSI explicitly, remove the corresponding moves, inspect the resulting UEFI instructions, and retain full strict checks and actual kernel-ingress VM validation. Keep source-level evidence distinct from an observed VM failure.

Validation checkpoint — 14 September 2026: Signed Bootloader 3a99ba23cad27d7db4b87919425fc44d6e5db71b passes strict development/release default/all host and UEFI checks, 34 units, seven standalone tests, all four Python suites and private rustdoc. CI 137 and 138 pass with four complete logs and zero warning candidates. Both final Integration 7cc0593e101b2e0ca42f24d4fa189dd96cb1455c native VMs enter the kernel and complete their unchanged oracles with empty stderr. No observed Bootloader failure is attributed to the former register-constraint defect.

Tracking

Related: the component authority audit #2, Bootloader PR 3, Integration issue 50 and Kernel issue 10. Correction, signed publication and matching VM evidence remain pending.

## Summary The x86_64 `jump_to_kernel` assembly assigns its handoff pointer and length to RDI and RSI using sequential moves, while describing those operands and the jump target as arbitrary input registers. The compiler is not told that those moves overwrite registers. A permitted allocation can therefore destroy a later input before it is used. ## Reproduction Inspect `src/transition.rs` at Bootloader `e7fa39357a38c21529cccfd16cf3446eb07e8aa5`. The block emits `mov rdi, {handoff_ptr}`, `mov rsi, {handoff_size}` and `jmp {entry}` while all four operands use `in(reg)`. The source contract permits an argument or jump operand to occupy a register overwritten by an earlier instruction. This is an assembly-constraint review finding. No Bootloader VM failure is attributed to it, and no hosted jump or privileged instruction was executed to investigate it. ## Expected and actual behavior Expected: the compiler preserves the independently supplied entry address, stack top, handoff pointer and exact serialized length through the nonreturning transfer. RDI and RSI must contain the existing two argument values at kernel entry. Actual: the assembly contract omits the destination-register effects of its argument moves. Correctness depends on the compiler choosing a nonconflicting allocation. The current successful boots do not establish correctness for every permitted allocation or future compiler build. ## Environment and identity - Bootloader source: `e7fa39357a38c21529cccfd16cf3446eb07e8aa5`. - Boundary: UEFI x86_64 boot-to-kernel transfer; current host toolchain Rust 1.97.1. - Existing inputs: validated executable entry, mapped stack and immutable serialized handoff bytes. - Scope: preserve the existing transition contract, interrupt/direction flag operations and explicit mappings. Add no authority or fallback discovery. ## Evidence and prior checks The finding follows inspection of the concrete initial userspace argument overwrite in [Kernel issue 10](https://git.erikinkinen.fi/erix/kernel/issues/10). Bootloader has the same undeclared sequential-register-write pattern, with an additional live jump-target operand. Bind RDI and RSI explicitly, remove the corresponding moves, inspect the resulting UEFI instructions, and retain full strict checks and actual kernel-ingress VM validation. Keep source-level evidence distinct from an observed VM failure. Validation checkpoint — 14 September 2026: Signed Bootloader `3a99ba23cad27d7db4b87919425fc44d6e5db71b` passes strict development/release default/all host and UEFI checks, 34 units, seven standalone tests, all four Python suites and private rustdoc. CI [137](https://git.erikinkinen.fi/erix/bootloader/actions/runs/137) and [138](https://git.erikinkinen.fi/erix/bootloader/actions/runs/138) pass with four complete logs and zero warning candidates. Both final Integration `7cc0593e101b2e0ca42f24d4fa189dd96cb1455c` native VMs enter the kernel and complete their unchanged oracles with empty stderr. No observed Bootloader failure is attributed to the former register-constraint defect. ## Tracking Related: the component authority audit #2, [Bootloader PR 3](https://git.erikinkinen.fi/erix/bootloader/pulls/3), [Integration issue 50](https://git.erikinkinen.fi/erix/integration/issues/50) and [Kernel issue 10](https://git.erikinkinen.fi/erix/kernel/issues/10). Correction, signed publication and matching VM evidence remain pending.

erikinkinen

2026-09-14 13:19:42 +02:00