From: Ammar Faizi <ammar.faizi@students.amikom.ac.id>
To: Willy Tarreau <w@1wt.eu>
Cc: Ammar Faizi <ammar.faizi@students.amikom.ac.id>,
Paul Walmsley <paul.walmsley@sifive.com>,
Palmer Dabbelt <palmer@dabbelt.com>,
Albert Ou <aou@eecs.berkeley.edu>,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Andy Lutomirski <luto@kernel.org>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>,
x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>,
David Laight <David.Laight@ACULAB.COM>,
Peter Cordes <peter@cordes.ca>,
Bedirhan KURT <windowz414@gnuweeb.org>,
Louvian Lyndal <louvianlyndal@gmail.com>
Subject: [PATCH 2/2] tools/nolibc: x86-64: Fix startup code bug
Date: Fri, 15 Oct 2021 15:25:07 +0700 [thread overview]
Message-ID: <CtypPaXXhVINRV0090UVzA-ammarfaizi2@gnuweeb.org> (raw)
In-Reply-To: <dRLArKzRMqajy1jA86k0vg-ammarfaizi2@gnuweeb.org>
Before this patch, the _start function looks like this:
0000000000001170 <_start>:
1170: pop %rdi
1171: mov %rsp,%rsi
1174: lea 0x8(%rsi,%rdi,8),%rdx
1179: and $0xfffffffffffffff0,%rsp
117d: sub $0x8,%rsp
1181: call 1000 <main>
1186: movzbq %al,%rdi
118a: mov $0x3c,%rax
1191: syscall
1193: hlt
1194: data16 cs nopw 0x0(%rax,%rax,1)
119f: nop
Note the "and" to %rsp, it makes the %rsp be 16-byte aligned, but then
there is a "sub" with $0x8 which makes the %rsp no longer 16-byte
aligned, then it calls main. That's the bug!
Right before "call", the %rsp must be 16-byte aligned. So the "sub"
here breaks the alignment. Remove it.
Also the content of %rbp may be unspecified at process initialization
time. For example, if the _start gets called by an interpreter, the
interpreter may not zero the %rbp, so we should zero the %rbp on _start.
In this patch, we recode the _start function, and now it looks like
this:
0000000000001170 <_start>:
1170: pop %rdi # argc
1171: mov %rsp,%rsi # argv
1174: lea 0x8(%rsi,%rdi,8),%rdx # envp
1179: xor %ebp,%ebp # %rbp = 0
117b: and $0xfffffffffffffff0,%rsp # %rsp &= -16
117f: call 1000 <main>
1184: mov %eax,%edi
1186: mov $0xe7,%eax
118b: syscall # sys_exit_group(%rdi)
118d: hlt
118e: xchg %ax,%ax
Extra fixes:
- Use NR_exit_group instead of NR_exit.
- Use `mov %eax,%edi` instead of `movzbq %al,%rdi`. This makes the
exit code more observable from strace. While the exit code is
only 8-bit, the kernel has taken care of that, so no need to
worry about it.
Cc: Bedirhan KURT <windowz414@gnuweeb.org>
Cc: Louvian Lyndal <louvianlyndal@gmail.com>
Reported-by: Peter Cordes <peter@cordes.ca>
Signed-off-by: Ammar Faizi <ammar.faizi@students.amikom.ac.id>
---
tools/include/nolibc/nolibc.h | 61 +++++++++++++++++++++++++++--------
1 file changed, 47 insertions(+), 14 deletions(-)
diff --git a/tools/include/nolibc/nolibc.h b/tools/include/nolibc/nolibc.h
index 1483d95c8330..f502b645d363 100644
--- a/tools/include/nolibc/nolibc.h
+++ b/tools/include/nolibc/nolibc.h
@@ -403,21 +403,54 @@ struct stat {
_ret; \
})
+
/* startup code */
-asm(".section .text\n"
- ".global _start\n"
- "_start:\n"
- "pop %rdi\n" // argc (first arg, %rdi)
- "mov %rsp, %rsi\n" // argv[] (second arg, %rsi)
- "lea 8(%rsi,%rdi,8),%rdx\n" // then a NULL then envp (third arg, %rdx)
- "and $-16, %rsp\n" // x86 ABI : esp must be 16-byte aligned when
- "sub $8, %rsp\n" // entering the callee
- "call main\n" // main() returns the status code, we'll exit with it.
- "movzb %al, %rdi\n" // retrieve exit code from 8 lower bits
- "mov $60, %rax\n" // NR_exit == 60
- "syscall\n" // really exit
- "hlt\n" // ensure it does not return
- "");
+asm(
+ ".section .text\n"
+ ".global _start\n"
+
+ "_start:\n\t"
+ "popq %rdi\n\t" // argc (first arg, %rdi)
+ "movq %rsp, %rsi\n\t" // argv[] (second arg, %rsi)
+ "leaq 8(%rsi,%rdi,8), %rdx\n\t" // then a NULL, then envp (third arg, %rdx)
+
+ /*
+ * The System V ABI mandates the deepest stack frame should be zero.
+ * Thus we zero the %rbp here.
+ */
+ "xorl %ebp, %ebp\n\t"
+
+ /*
+ * The System V ABI mandates the %rsp needs to be aligned at 16-byte
+ * before performing a function call.
+ */
+ "andq $-16, %rsp\n\t"
+
+ /*
+ * main() returns the status code, we will exit with it.
+ */
+ "callq main\n\t"
+
+ /*
+ * Move the return value to the first argument of exit_group.
+ */
+ "movl %eax, %edi\n\t"
+
+ /*
+ * NR_exit_group == 231
+ */
+ "movl $231, %eax\n\t"
+
+ /*
+ * Really exit.
+ */
+ "syscall\n\t"
+
+ /*
+ * Ensure it does not return.
+ */
+ "hlt\n\t"
+);
/* fcntl / open */
#define O_RDONLY 0
--
2.30.2
next prev parent reply other threads:[~2021-10-15 8:28 UTC|newest]
Thread overview: 45+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-11 4:03 [PATCH] tools/nolibc: x86: Remove `r8`, `r9` and `r10` from the clobber list Ammar Faizi
2021-10-12 5:28 ` Willy Tarreau
2021-10-12 8:36 ` Ammar Faizi
2021-10-12 9:06 ` Willy Tarreau
2021-10-12 20:29 ` Borislav Petkov
2021-10-12 21:51 ` Borislav Petkov
2021-10-12 22:23 ` Ammar Faizi
2021-10-13 3:01 ` Willy Tarreau
2021-10-13 3:32 ` Ammar Faizi
2021-10-13 3:34 ` Ammar Faizi
2021-10-13 3:37 ` Ammar Faizi
2021-10-13 12:43 ` Borislav Petkov
2021-10-13 12:51 ` Willy Tarreau
2021-10-13 13:06 ` Borislav Petkov
2021-10-13 14:07 ` Willy Tarreau
2021-10-13 14:20 ` Borislav Petkov
2021-10-13 14:24 ` Willy Tarreau
2021-10-13 16:24 ` Michael Matz
2021-10-13 16:30 ` Willy Tarreau
2021-10-13 16:51 ` Andy Lutomirski
2021-10-13 16:52 ` Borislav Petkov
2021-10-14 8:44 ` Ammar Faizi
2021-10-14 12:44 ` Michael Matz
2021-10-14 14:31 ` Borislav Petkov
2021-10-19 9:06 ` David Laight
2021-10-23 20:40 ` H. Peter Anvin
2021-10-12 21:21 ` David Laight
2021-10-12 23:02 ` Subject: " Ammar Faizi
2021-10-13 9:03 ` [PATCH v2] " Ammar Faizi
2021-10-15 8:25 ` [PATCH 0/2] Fix clobber list and startup code bug Ammar Faizi
2021-10-15 8:25 ` [PATCH 1/2] tools/nolibc: x86: Remove `r8`, `r9` and `r10` from the clobber list Ammar Faizi
2021-10-18 5:52 ` Willy Tarreau
2021-10-15 8:25 ` Ammar Faizi [this message]
2021-10-15 8:57 ` [PATCH 2/2] tools/nolibc: x86-64: Fix startup code bug Ammar Faizi
2021-10-15 9:26 ` Bedirhan KURT
2021-10-15 9:58 ` Ammar Faizi
2021-10-15 9:41 ` Louvian Lyndal
2021-10-18 4:58 ` Willy Tarreau
2021-10-18 6:53 ` Ammar Faizi
2021-10-23 13:27 ` Ammar Faizi
2021-10-23 13:43 ` Willy Tarreau
2021-10-24 2:11 ` [PATCHSET v2 0/2] tools/nolibc: Fix startup code bug and small improvement Ammar Faizi
2021-10-24 2:11 ` [PATCH 1/2] tools/nolibc: x86-64: Fix startup code bug Ammar Faizi
2021-10-24 2:11 ` [PATCH 2/2] tools/nolibc: x86-64: Use `mov $60,%eax` instead of `mov $60,%rax` Ammar Faizi
2021-10-24 11:41 ` [PATCHSET v2 0/2] tools/nolibc: Fix startup code bug and small improvement Willy Tarreau
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CtypPaXXhVINRV0090UVzA-ammarfaizi2@gnuweeb.org \
--to=ammar.faizi@students.amikom.ac.id \
--cc=David.Laight@ACULAB.COM \
--cc=aou@eecs.berkeley.edu \
--cc=hpa@zytor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=louvianlyndal@gmail.com \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=palmer@dabbelt.com \
--cc=paul.walmsley@sifive.com \
--cc=peter@cordes.ca \
--cc=tglx@linutronix.de \
--cc=w@1wt.eu \
--cc=windowz414@gnuweeb.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).