The x86-64 architecture supports two instruction prefixes, SEGFS and
SEGGS that apply an additional offset to memory operands. The offset
lives in a special register that is accessible to the kernel only
(historically).
On GNU/Linux, SEGFS is used to implement the thread pointer, to avoid
dedicating a general-purpose register to it. At address zero with the
SEGFS prefix, the offset itself is stored so that userspace can read it
without having to call into the kernel. So the SEGFS null pointer is a
valid address, and so are some bytes after it (depending on TCB layout,
some of which is specified by the ABI or is part of the de-facto ABI
used by GCC).
GCC 12 has started warning on __seg_fs null pointer arithmetic. In
glibc, we use this construct:
*(struct pthread *__seg_fs *) offsetof (struct pthread, header.self)
And this is now causing build failures due to -Werror.
It's been suggested that I should prove that these warnings are invalid
under the N1275 document referenced in the GCC manual.
However, I think N1275 is not actually implemented by GCC on x86-64.
The address spaces are treated as disjoint by the front end. That is,
this
int *
f (int __seg_fs *q)
{
return (int *) q;
}
results in
| warning: cast to generic address space pointer from disjoint __seg_fs
| address space pointer
But I would argue that this is not correct under the N1275 rules because
the address spaces are overlapping in practice. I assume the CPU wraps
around address arithmetic, which would make them completely equivalent.
The optimizers appear to treat the address spaces as overlapping, as
expected. In this,
int
f(int *p, int __seg_fs *q)
{
*p = 1;
*q = 2;
return *p;
}
the read in the return statement is not optimized away.
I have trouble deriving from N1275 if pointer casts are supposed to
apply offsets or perform some other sort of address translation to
produce a pointer to the same object. The GCC implementation does not
do this, it preserves the representation. With a shifted address space,
the rule for mapping null pointers to null pointers does not make sense
and is actually not helpful in the GNU/Linux case (because a copy of the
thread pointer is stored at address zero, as mentioned above).
I can't shake the impression that N1275 is about something else and not
the offsets that the x86-64 architecture can apply to addresses.
Thanks,
Florian
