system_call value is different each time when I use rdmsrl(MSR_LSTAR, system_call)

Question

I'm writing a lkm to get sys_call_table address and I'm trying to get it by IDT (I have tested other methods and they work). The problem is that when I use rdmsrl to get register MSR_LSTAR , it's different each time.

I have tried function rdmsrl ( MSR_LSTAR ) and asm sentences in Ubuntu 18.04.1 with kernel 4.15.0-51.

asm("rdmsr" : "=a" (low), "=d" (high) : "c" (IA32_LSTAR));
system_call = (void*)(((long)high<<32) | low);
printk(KERN_INFO "system_call: 0x%llx", system_call);

rdmsrl(MSR_LSTAR, sct_off);
printk("sct_off: %016llx\n", sct_off);

The result is as follows:

system_call: 0xfffffe0000006000
system_call: 0xfffffe000008a000
system_call: 0xfffffe0000032000

Answer 1

Do you have CONFIG_RETPOLINE=y enabled? (check via cat /usr/src/`uname -r`/.config | grep RETPOLINE ). If so, for CPUs where Kernel Page Table Isolation is enabled MSR_LSTAR holds the trampoline per-cpu entry SYSCALL64_entry_trampoline instead of the standard entry_SYSCALL_64 for your kernel version.