linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Ammar Faizi <ammar.faizi@students.amikom.ac.id>
To: Willy Tarreau <w@1wt.eu>
Cc: Ammar Faizi <ammar.faizi@students.amikom.ac.id>,
	Paul Walmsley <paul.walmsley@sifive.com>,
	Palmer Dabbelt <palmer@dabbelt.com>,
	Albert Ou <aou@eecs.berkeley.edu>,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
	Andy Lutomirski <luto@kernel.org>,
	Thomas Gleixner <tglx@linutronix.de>,
	Ingo Molnar <mingo@redhat.com>,
	x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>,
	David Laight <David.Laight@ACULAB.COM>,
	Peter Cordes <peter@cordes.ca>,
	Bedirhan KURT <windowz414@gnuweeb.org>,
	Louvian Lyndal <louvianlyndal@gmail.com>
Subject: Re: [PATCH 2/2] tools/nolibc: x86-64: Fix startup code bug
Date: Fri, 15 Oct 2021 15:57:01 +0700	[thread overview]
Message-ID: <6sZ9qpcJvtqCksJQVaiZyA-ammarfaizi2@gnuweeb.org> (raw)
In-Reply-To: <CtypPaXXhVINRV0090UVzA-ammarfaizi2@gnuweeb.org>

Hi,

This is a code to test.

Compile with:
  gcc -O3 -ggdb3 -nostdlib -o test test.c

Technical explanation:
The System V ABI mandates the %rsp must be 16-byte aligned before
performing a function call, but the current nolibc.h violates it.

This %rsp alignment violation makes the callee can't align its stack
properly. Note that the callee may have a situation where it requires
vector aligned move. For example, `movaps` with memory operand w.r.t.
xmm registers, it requires the src/dst address be 16-byte aligned.

Since the callee can't align its stack properly, it will segfault when
executing `movaps`. The following C code is the reproducer and test
to ensure the bug really exists and this patch fixes it.

```
/* SPDX-License-Identifier: LGPL-2.1 OR MIT */

/*
 * Bug reproducer and test for Willy's nolibc (x86-64) by Ammar.
 *
 * Compile with:
 *  gcc -O3 -ggdb3 -nostdlib -o test test.c
 */

#include "tools/include/nolibc/nolibc.h"

static void dump_argv(int argc, char *argv[])
{
	int i;
	const char str[] = "\nDumping argv...\n";

	write(1, str, strlen(str));
	for (i = 0; i < argc; i++) {
		write(1, argv[i], strlen(argv[i]));
		write(1, "\n", 1);
	}
}

static void dump_envp(char *envp[])
{
	int i = 0;
	const char str[] = "\nDumping envp...\n";

	write(1, str, strlen(str));
	while (envp[i] != NULL) {
		write(1, envp[i], strlen(envp[i]));
		write(1, "\n", 1);
		i++;
	}
}

#define read_barrier(PTR) __asm__ volatile(""::"r"(PTR):"memory")

__attribute__((__target__("sse2")))
static void test_sse_move_aligned(void)
{
	int i;
	int arr[32] __attribute__((__aligned__(16)));

	/*
	 * The assignment inside this loop is very likely
	 * performed with aligned move, thus if we don't
	 * align the %rsp properly, it will fault!
	 *
	 * If we fault due to misaligned here, then there
	 * must be a caller below us that violates SysV
	 * ABI w.r.t. to %rsp alignment before func call.
	 */
	for (i = 0; i < 32; i++)
		arr[i] = 1;

	read_barrier(arr);
}

int main(int argc, char *argv[], char *envp[])
{
	dump_argv(argc, argv);
	dump_envp(envp);
	test_sse_move_aligned();
	return 0;
}
```

-- 
Ammar Faizi

  reply	other threads:[~2021-10-15  8:57 UTC|newest]

Thread overview: 45+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-10-11  4:03 [PATCH] tools/nolibc: x86: Remove `r8`, `r9` and `r10` from the clobber list Ammar Faizi
2021-10-12  5:28 ` Willy Tarreau
2021-10-12  8:36   ` Ammar Faizi
2021-10-12  9:06     ` Willy Tarreau
2021-10-12 20:29       ` Borislav Petkov
2021-10-12 21:51         ` Borislav Petkov
2021-10-12 22:23         ` Ammar Faizi
2021-10-13  3:01           ` Willy Tarreau
2021-10-13  3:32             ` Ammar Faizi
2021-10-13  3:34               ` Ammar Faizi
2021-10-13  3:37                 ` Ammar Faizi
2021-10-13 12:43           ` Borislav Petkov
2021-10-13 12:51             ` Willy Tarreau
2021-10-13 13:06               ` Borislav Petkov
2021-10-13 14:07                 ` Willy Tarreau
2021-10-13 14:20                   ` Borislav Petkov
2021-10-13 14:24                     ` Willy Tarreau
2021-10-13 16:24                       ` Michael Matz
2021-10-13 16:30                         ` Willy Tarreau
2021-10-13 16:51                           ` Andy Lutomirski
2021-10-13 16:52                           ` Borislav Petkov
2021-10-14  8:44                             ` Ammar Faizi
2021-10-14 12:44                             ` Michael Matz
2021-10-14 14:31                               ` Borislav Petkov
2021-10-19  9:06                         ` David Laight
2021-10-23 20:40             ` H. Peter Anvin
2021-10-12 21:21       ` David Laight
2021-10-12 23:02         ` Subject: " Ammar Faizi
2021-10-13  9:03 ` [PATCH v2] " Ammar Faizi
2021-10-15  8:25   ` [PATCH 0/2] Fix clobber list and startup code bug Ammar Faizi
2021-10-15  8:25     ` [PATCH 1/2] tools/nolibc: x86: Remove `r8`, `r9` and `r10` from the clobber list Ammar Faizi
2021-10-18  5:52       ` Willy Tarreau
2021-10-15  8:25     ` [PATCH 2/2] tools/nolibc: x86-64: Fix startup code bug Ammar Faizi
2021-10-15  8:57       ` Ammar Faizi [this message]
2021-10-15  9:26         ` Bedirhan KURT
2021-10-15  9:58           ` Ammar Faizi
2021-10-15  9:41         ` Louvian Lyndal
2021-10-18  4:58       ` Willy Tarreau
2021-10-18  6:53         ` Ammar Faizi
2021-10-23 13:27           ` Ammar Faizi
2021-10-23 13:43             ` Willy Tarreau
2021-10-24  2:11               ` [PATCHSET v2 0/2] tools/nolibc: Fix startup code bug and small improvement Ammar Faizi
2021-10-24  2:11                 ` [PATCH 1/2] tools/nolibc: x86-64: Fix startup code bug Ammar Faizi
2021-10-24  2:11                 ` [PATCH 2/2] tools/nolibc: x86-64: Use `mov $60,%eax` instead of `mov $60,%rax` Ammar Faizi
2021-10-24 11:41                 ` [PATCHSET v2 0/2] tools/nolibc: Fix startup code bug and small improvement Willy Tarreau

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=6sZ9qpcJvtqCksJQVaiZyA-ammarfaizi2@gnuweeb.org \
    --to=ammar.faizi@students.amikom.ac.id \
    --cc=David.Laight@ACULAB.COM \
    --cc=aou@eecs.berkeley.edu \
    --cc=hpa@zytor.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=louvianlyndal@gmail.com \
    --cc=luto@kernel.org \
    --cc=mingo@redhat.com \
    --cc=palmer@dabbelt.com \
    --cc=paul.walmsley@sifive.com \
    --cc=peter@cordes.ca \
    --cc=tglx@linutronix.de \
    --cc=w@1wt.eu \
    --cc=windowz414@gnuweeb.org \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).