A leaf's body ran from its start to the next known start or int3 padding,
so a function reached only through a pointer, placed right after the leaf
without int3 padding, was framed as part of the leaf: its rsp operands were
moved and its exits raised rsp although nothing had lowered it.
The body now also ends at 16-byte-aligned code after a ret or ud2, and at
the target of a jmp when only padding lies between them (a tail call to the
next function). Code past such a point is framed only from a real start.
A leaf whose code continues past it is skipped as branching out of the
function. Aligned code after any other jmp stays in the body: loop headers
are aligned there, and cutting after every jmp skipped 2,129 of 2,131
framed leaves in PPSA01556. With this cut 2,132 are framed, and none of
them has rewritten bytes in another function of the unwind table.
Windows writes an exception frame directly below RSP, so a fault resumed on
a guest thread overwrites values a System V leaf function keeps in its red
zone. With --frame-red-zone, a leaf function with a
push rbp; mov rbp, rsp; push ... prologue that reads or writes below its
pushes gets two kinds of trampoline: the prologue lowers RSP by 128 bytes
after its pushes, and each pop ...; pop rbp; ret exit raises it back first.
Sites a branch enters, sites shorter than a jump and sites over a --to-intel
stub are skipped; the conversion reports the framed and skipped counts.
Yunus Shaikh