linux-kernel - Re: [RFC PATCH v1 3/6] tools/nolibc: i386: Implement syscall with 6 arguments

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 20 Mar 2022 17:42:30 +0700
From:   Alviro Iskandar Setiawan <alviro.iskandar@...weeb.org>
To:     Ammar Faizi <ammarfaizi2@...weeb.org>
Cc:     Willy Tarreau <w@....eu>, "Paul E. McKenney" <paulmck@...nel.org>,
        Nugraha <richiisei@...il.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        "GNU/Weeb Mailing List" <gwml@...r.gnuweeb.org>, x86@...nel.org,
        llvm@...ts.linux.dev
Subject: Re: [RFC PATCH v1 3/6] tools/nolibc: i386: Implement syscall with 6 arguments

On Sun, Mar 20, 2022 at 5:33 PM Alviro Iskandar Setiawan wrote:
> On Sun, Mar 20, 2022 at 4:37 PM Ammar Faizi wrote:
> > In i386, the 6th argument of syscall goes in %ebp. However, both Clang
> > and GCC cannot use %ebp in the clobber list and in the "r" constraint
> > without using -fomit-frame-pointer. To make it always available for any
> > kind of compilation, the below workaround is implemented.
> >
> > For clang (the Assembly statement can't clobber %ebp):
> >   1) Save the %ebp value to the redzone area -4(%esp).
> >   2) Load the 6-th argument from memory to %ebp.
> >   3) Subtract the %esp by 4.
> >   4) Do the syscall (int $0x80).
> >   5) Pop %ebp.
>
> I don't think you can safely use redzone from inline Assembly. The
> compiler may also use redzone for a leaf function. In case the syscall
> is done at the same time, your %ebp saving will clobber the redzone
> that the compiler uses.
>
> > For GCC, fortunately it has a #pragma that can force a specific function
> > to be compiled with -fomit-frame-pointer, so it can always use "r"(var)
> > where `var` is a variable bound to %ebp.
> >
> > Cc: x86@...nel.org
> > Cc: llvm@...ts.linux.dev
> > Signed-off-by: Ammar Faizi <ammarfaizi2@...weeb.org>
> [...]
> > +#if defined(__clang__)
> > +static inline long ____do_syscall6(long eax, long ebx, long ecx, long edx,
> > +                                  long esi, long edi, long ebp)
> > +{
> > +       __asm__ volatile (
> > +               "movl   %%ebp, -4(%%esp)\n\t"
> > +               "movl   %[arg6], %%ebp\n\t"
> > +               "subl   $4, %%esp\n\t"
> > +               "int    $0x80\n\t"
> > +               "popl   %%ebp\n\t"
> > +               : "=a"(eax)
> > +               : "a"(eax), "b"(ebx), "c"(ecx), "d"(edx), "S"(esi), "D"(edi),
> > +                 [arg6]"m"(ebp)
> > +               : "memory", "cc"
> > +       );
> > +       return eax;
> > +}
> > +
>
> -4(%esp) may be used by the compiler on a leaf call, you can't clobber that.

Using xchgl to preserve %ebp in the same place where the arg6 is
stored in memory is a better solution and doesn't clobber anything.

    xchgl %ebp, %[arg6]
    int    $0x80
    xchgl %ebp, %[arg6]

-- Viro