linux-kernel - Re: [PATCH] tools/nolibc: x86: Remove `r8`, `r9` and `r10` from the clobber list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 13 Oct 2021 15:06:23 +0200
From:   Borislav Petkov <bp@...en8.de>
To:     Willy Tarreau <w@....eu>
Cc:     Ammar Faizi <ammar.faizi@...dents.amikom.ac.id>,
        Paul Walmsley <paul.walmsley@...ive.com>,
        Palmer Dabbelt <palmer@...belt.com>,
        Albert Ou <aou@...s.berkeley.edu>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Andy Lutomirski <luto@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, x86@...nel.org,
        "H. Peter Anvin" <hpa@...or.com>, Michael Matz <matz@...e.de>
Subject: Re: [PATCH] tools/nolibc: x86: Remove `r8`, `r9` and `r10` from the
 clobber list

On Wed, Oct 13, 2021 at 02:51:42PM +0200, Willy Tarreau wrote:
> > > "Figure 3.4: Register Usage" is not the answer, if it were, nolibc.h
> > > would be broken as it is missing "rdi", "rsi", "rdx" in the clobber list.
> > 
> > It is not about what happens in practice but what the contract is:
> > syscall argument registers can potentially get clobbered and userspace
> > should treat them as such. Because if the kernel decides to actually
> > clobber them for whatever reason and some userspace thing thinks
> > otherwise, then it is the userspace thing's problem as it doesn't adhere
> > to the well known ABI.
> 
> I agree and that's why my question was about that authoritative doc, to
> know the contract (since this one will not change under our feet). But
> according to the doc you pointed, here the contract for syscalls is that
> only rcx and r11 are clobbered (and rax gets the result). If so, I'm
> personally fine with this.

Well, I guess that doc could probably state explicitly that argument
registers are callee-clobbered.

The way I'm reading that doc is, as already pasted:

"The Linux AMD64 kernel uses internally the same calling conventions as
user-level applications (see section 3.2.3 for details).

...

The interface between the C library and the Linux kernel is the same as
for the user-level applications with the following differences:

The kernel interface uses %rdi , %rsi , %rdx , %r10 , %r8 and %r9."

So, calling conventions in the kernel are the same as for user-level
apps with the register difference. And argument registers are
callee-clobbered.

Now, when you look at section 3.2.3 Parameter Passing and scroll to
Figure 3.4: Register Usage, it'll give you the info that those argument
registers are not callee-saved.

They appear to be but that's not in the contract. Which means that they
can *potentially* get clobbered. The stress being on "potentially".

And just to make sure I'm reading this correctly, I've asked one of the
authors of that document (CCed) and he confirmed what I'm stating above.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette