[Bug 60461] New: ARM64EC: after a raw x64 syscall instruction, rcx holds the status and r10 the return address

[WineHQ Bugzilla]

http://bugs.winehq.org/show_bug.cgi?id=60461

            Bug ID: 60461
           Summary: ARM64EC: after a raw x64 syscall instruction, rcx
                    holds the status and r10 the return address
           Product: Wine
           Version: unspecified
          Hardware: aarch64
                OS: Android
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: ntdll
          Assignee: [e-mail]
          Reporter: [e-mail]
  Target Milestone: ---

On x86-64, SYSCALL copies the return address into rcx and rflags into r11, and
SYSRET returns through them, so after any syscall rcx holds the address of the
next instruction. Native x64 Wine does the same (rcx = rip, r11 = eflags, MR
!282).

Under ARM64EC, an x64 syscall instruction executed by emulated code goes
through dispatch_syscall (dlls/ntdll/signal_arm64ec.c), which resumes the x64
code at invoke_arm64ec_syscall (dlls/ntdll/signal_x86_64.c). That helper calls
the syscall like a function:

    callq *(%r10,%rax,8)
    movq (%rsp),%r10
    pushq 8(%rsp)      /* restore ret to caller */
    pushq %r10         /* and return to syscall thunk */
    ret

so the x64 code gets back rax = status, rcx = status (x0 after the ARM64EC
entry thunk), r10 = the return address, and rdx/r8/r9/r11 = whatever the
ARM64EC callee left in x1-x3/x5. The helper also writes the caller's home slots
at [rsp+8] and [rsp+16].

Measured on Proton 11 ARM64EC (GameNative) with FEX on a Snapdragon 8 Gen 2
(Android): a test program loads marker values, issues one raw syscall for
NtYieldExecution (number 0x46, taken from ntdll's own x64 stub) and dumps the
registers afterwards:

    register   x86-64 hardware                  Wine ARM64EC
    rax        status                           0x40000024 (status)
    rcx        return address (0x1400016cb)     0x40000024 (the status)
    r10        not defined by the instruction   0x1400016cb (the return
address)
    rdx        not defined by the instruction   changed (a stack address)

Code that checks rcx after its own syscall (some anti-tamper and DRM does) sees
a difference from any real x86-64 machine. The code is the same in current
master (63f62f7cd696): dispatch_syscall at signal_arm64ec.c:1281-1294 and
invoke_arm64ec_syscall at signal_x86_64.c:65-74, unchanged since 8043e1f6b8b7.

Expected: rcx = return address and r11 = rflags after the syscall, and the
caller's stack above the return address left alone, as on hardware and in
native x64 Wine.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.