linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Ammar Faizi <ammar.faizi@students.amikom.ac.id>
To: Willy Tarreau <w@1wt.eu>
Cc: Ammar Faizi <ammar.faizi@students.amikom.ac.id>,
	Paul Walmsley <paul.walmsley@sifive.com>,
	Palmer Dabbelt <palmer@dabbelt.com>,
	Albert Ou <aou@eecs.berkeley.edu>,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
	Andy Lutomirski <luto@kernel.org>,
	Thomas Gleixner <tglx@linutronix.de>,
	Ingo Molnar <mingo@redhat.com>,
	x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>,
	David Laight <David.Laight@ACULAB.COM>,
	Peter Cordes <peter@cordes.ca>,
	Bedirhan KURT <windowz414@gnuweeb.org>,
	Louvian Lyndal <louvianlyndal@gmail.com>
Subject: [PATCH 2/2] tools/nolibc: x86-64: Fix startup code bug
Date: Fri, 15 Oct 2021 15:25:07 +0700	[thread overview]
Message-ID: <CtypPaXXhVINRV0090UVzA-ammarfaizi2@gnuweeb.org> (raw)
In-Reply-To: <dRLArKzRMqajy1jA86k0vg-ammarfaizi2@gnuweeb.org>

Before this patch, the _start function looks like this:

0000000000001170 <_start>:
    1170:	pop    %rdi
    1171:	mov    %rsp,%rsi
    1174:	lea    0x8(%rsi,%rdi,8),%rdx
    1179:	and    $0xfffffffffffffff0,%rsp
    117d:	sub    $0x8,%rsp
    1181:	call   1000 <main>
    1186:	movzbq %al,%rdi
    118a:	mov    $0x3c,%rax
    1191:	syscall
    1193:	hlt
    1194:	data16 cs nopw 0x0(%rax,%rax,1)
    119f:	nop

Note the "and" to %rsp, it makes the %rsp be 16-byte aligned, but then
there is a "sub" with $0x8 which makes the %rsp no longer 16-byte
aligned, then it calls main. That's the bug!

Right before "call", the %rsp must be 16-byte aligned. So the "sub"
here breaks the alignment. Remove it.

Also the content of %rbp may be unspecified at process initialization
time. For example, if the _start gets called by an interpreter, the
interpreter may not zero the %rbp, so we should zero the %rbp on _start.

In this patch, we recode the _start function, and now it looks like
this:

0000000000001170 <_start>:
    1170:	pop    %rdi                       # argc
    1171:	mov    %rsp,%rsi                  # argv
    1174:	lea    0x8(%rsi,%rdi,8),%rdx      # envp
    1179:	xor    %ebp,%ebp                  # %rbp = 0
    117b:	and    $0xfffffffffffffff0,%rsp   # %rsp &= -16
    117f:	call   1000 <main>
    1184:	mov    %eax,%edi
    1186:	mov    $0xe7,%eax
    118b:	syscall                           # sys_exit_group(%rdi)
    118d:	hlt
    118e:	xchg   %ax,%ax

Extra fixes:
  - Use NR_exit_group instead of NR_exit.

  - Use `mov %eax,%edi` instead of `movzbq %al,%rdi`. This makes the
    exit code more observable from strace. While the exit code is
    only 8-bit, the kernel has taken care of that, so no need to
    worry about it.

Cc: Bedirhan KURT <windowz414@gnuweeb.org>
Cc: Louvian Lyndal <louvianlyndal@gmail.com>
Reported-by: Peter Cordes <peter@cordes.ca>
Signed-off-by: Ammar Faizi <ammar.faizi@students.amikom.ac.id>
---
 tools/include/nolibc/nolibc.h | 61 +++++++++++++++++++++++++++--------
 1 file changed, 47 insertions(+), 14 deletions(-)

diff --git a/tools/include/nolibc/nolibc.h b/tools/include/nolibc/nolibc.h
index 1483d95c8330..f502b645d363 100644
--- a/tools/include/nolibc/nolibc.h
+++ b/tools/include/nolibc/nolibc.h
@@ -403,21 +403,54 @@ struct stat {
 	_ret;                                                                 \
 })
 
+
 /* startup code */
-asm(".section .text\n"
-    ".global _start\n"
-    "_start:\n"
-    "pop %rdi\n"                // argc   (first arg, %rdi)
-    "mov %rsp, %rsi\n"          // argv[] (second arg, %rsi)
-    "lea 8(%rsi,%rdi,8),%rdx\n" // then a NULL then envp (third arg, %rdx)
-    "and $-16, %rsp\n"          // x86 ABI : esp must be 16-byte aligned when
-    "sub $8, %rsp\n"            // entering the callee
-    "call main\n"               // main() returns the status code, we'll exit with it.
-    "movzb %al, %rdi\n"         // retrieve exit code from 8 lower bits
-    "mov $60, %rax\n"           // NR_exit == 60
-    "syscall\n"                 // really exit
-    "hlt\n"                     // ensure it does not return
-    "");
+asm(
+	".section .text\n"
+	".global _start\n"
+
+	"_start:\n\t"
+	"popq %rdi\n\t"			// argc   (first arg, %rdi)
+	"movq %rsp, %rsi\n\t"		// argv[] (second arg, %rsi)
+	"leaq 8(%rsi,%rdi,8), %rdx\n\t"	// then a NULL, then envp (third arg, %rdx)
+
+	/*
+	 * The System V ABI mandates the deepest stack frame should be zero.
+	 * Thus we zero the %rbp here.
+	 */
+	"xorl %ebp, %ebp\n\t"
+
+	/*
+	 * The System V ABI mandates the %rsp needs to be aligned at 16-byte
+	 * before performing a function call.
+	 */
+	"andq $-16, %rsp\n\t"
+
+	/*
+	 * main() returns the status code, we will exit with it.
+	 */
+	"callq main\n\t"
+
+	/*
+	 * Move the return value to the first argument of exit_group.
+	 */
+	"movl %eax, %edi\n\t"
+
+	/*
+	 * NR_exit_group == 231
+	 */
+	"movl $231, %eax\n\t"
+
+	/*
+	 * Really exit.
+	 */
+	"syscall\n\t"
+
+	/*
+	 * Ensure it does not return.
+	 */
+	"hlt\n\t"
+);
 
 /* fcntl / open */
 #define O_RDONLY            0
-- 
2.30.2


  parent reply	other threads:[~2021-10-15  8:28 UTC|newest]

Thread overview: 45+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-10-11  4:03 [PATCH] tools/nolibc: x86: Remove `r8`, `r9` and `r10` from the clobber list Ammar Faizi
2021-10-12  5:28 ` Willy Tarreau
2021-10-12  8:36   ` Ammar Faizi
2021-10-12  9:06     ` Willy Tarreau
2021-10-12 20:29       ` Borislav Petkov
2021-10-12 21:51         ` Borislav Petkov
2021-10-12 22:23         ` Ammar Faizi
2021-10-13  3:01           ` Willy Tarreau
2021-10-13  3:32             ` Ammar Faizi
2021-10-13  3:34               ` Ammar Faizi
2021-10-13  3:37                 ` Ammar Faizi
2021-10-13 12:43           ` Borislav Petkov
2021-10-13 12:51             ` Willy Tarreau
2021-10-13 13:06               ` Borislav Petkov
2021-10-13 14:07                 ` Willy Tarreau
2021-10-13 14:20                   ` Borislav Petkov
2021-10-13 14:24                     ` Willy Tarreau
2021-10-13 16:24                       ` Michael Matz
2021-10-13 16:30                         ` Willy Tarreau
2021-10-13 16:51                           ` Andy Lutomirski
2021-10-13 16:52                           ` Borislav Petkov
2021-10-14  8:44                             ` Ammar Faizi
2021-10-14 12:44                             ` Michael Matz
2021-10-14 14:31                               ` Borislav Petkov
2021-10-19  9:06                         ` David Laight
2021-10-23 20:40             ` H. Peter Anvin
2021-10-12 21:21       ` David Laight
2021-10-12 23:02         ` Subject: " Ammar Faizi
2021-10-13  9:03 ` [PATCH v2] " Ammar Faizi
2021-10-15  8:25   ` [PATCH 0/2] Fix clobber list and startup code bug Ammar Faizi
2021-10-15  8:25     ` [PATCH 1/2] tools/nolibc: x86: Remove `r8`, `r9` and `r10` from the clobber list Ammar Faizi
2021-10-18  5:52       ` Willy Tarreau
2021-10-15  8:25     ` Ammar Faizi [this message]
2021-10-15  8:57       ` [PATCH 2/2] tools/nolibc: x86-64: Fix startup code bug Ammar Faizi
2021-10-15  9:26         ` Bedirhan KURT
2021-10-15  9:58           ` Ammar Faizi
2021-10-15  9:41         ` Louvian Lyndal
2021-10-18  4:58       ` Willy Tarreau
2021-10-18  6:53         ` Ammar Faizi
2021-10-23 13:27           ` Ammar Faizi
2021-10-23 13:43             ` Willy Tarreau
2021-10-24  2:11               ` [PATCHSET v2 0/2] tools/nolibc: Fix startup code bug and small improvement Ammar Faizi
2021-10-24  2:11                 ` [PATCH 1/2] tools/nolibc: x86-64: Fix startup code bug Ammar Faizi
2021-10-24  2:11                 ` [PATCH 2/2] tools/nolibc: x86-64: Use `mov $60,%eax` instead of `mov $60,%rax` Ammar Faizi
2021-10-24 11:41                 ` [PATCHSET v2 0/2] tools/nolibc: Fix startup code bug and small improvement Willy Tarreau

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CtypPaXXhVINRV0090UVzA-ammarfaizi2@gnuweeb.org \
    --to=ammar.faizi@students.amikom.ac.id \
    --cc=David.Laight@ACULAB.COM \
    --cc=aou@eecs.berkeley.edu \
    --cc=hpa@zytor.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=louvianlyndal@gmail.com \
    --cc=luto@kernel.org \
    --cc=mingo@redhat.com \
    --cc=palmer@dabbelt.com \
    --cc=paul.walmsley@sifive.com \
    --cc=peter@cordes.ca \
    --cc=tglx@linutronix.de \
    --cc=w@1wt.eu \
    --cc=windowz414@gnuweeb.org \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).