linux-kernel - Linux i386 clone(): %ebx 'frobbing' ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080215184228.GA6687@ubuntu>
Date:	Fri, 15 Feb 2008 20:42:28 +0200
From:	"Ahmed S. Darwish" <darwish.07@...il.com>
To:	libc-alpha@...rceware.org, libc-alpha@...rces.redhat.com
Cc:	linux-kernel@...r.kernel.org
Subject: Linux i386 clone(): %ebx 'frobbing' ?

Hi all,

In the clone(int (*fn)(void *arg), void *child_stack, ..., void *arg, ...)
Glibc library function defind in sysdeps/unix/sysv/linux/i386/:

`fn' is saved in 8(child_stack), and `arg' is stored in 12(child_stack):

	movl	STACK(%esp),%ecx
	movl	ARG(%esp),%eax		/* no negative argument counts */
	movl	%eax,12(%ecx)		<---

	/* Save the function pointer as the zeroth argument.
	   It will be popped off in the child in the ebx frobbing below.  */
	movl	FUNC(%esp),%eax
	movl	%eax,8(%ecx)		<---

But after the exectuion of `sys_clone' system call, `fn' is 
called in the child thread by the statement 'call *%ebx' as follows:

	int	$0x80
	[...]

	test	%eax,%eax
	jz	L(thread_start)

/* Parent */
L(pseudo_end):
	ret

/* Child */
L(thread_start):
	/* Note: %esi is zero.  */
	movl	%esi,%ebp	/* terminate the stack frame */
	call	*%ebx

I don't understand how the `fn' argument reached the child thread
in the %ebx register. It's said in the comment that `fn' will be
popped to child 'in the ebx frobbing below'. But what does that mean ?

Thanks in advance

-- 
Ahmed S. Darwish
Homepage: http://darwish.07.googlepages.com
Blog: http://darwish-07.blogspot.com

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/