From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with archive (Exim 4.43) id 1LeVyI-0003SR-PS for mharc-grub-devel@gnu.org; Tue, 03 Mar 2009 09:51:50 -0500 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1LeVyH-0003Rf-86 for grub-devel@gnu.org; Tue, 03 Mar 2009 09:51:49 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1LeVyC-0003PL-Kk for grub-devel@gnu.org; Tue, 03 Mar 2009 09:51:48 -0500 Received: from [199.232.76.173] (port=47923 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1LeVyC-0003PH-II for grub-devel@gnu.org; Tue, 03 Mar 2009 09:51:44 -0500 Received: from mail-bw0-f172.google.com ([209.85.218.172]:52526) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1LeVyC-0002HC-0a for grub-devel@gnu.org; Tue, 03 Mar 2009 09:51:44 -0500 Received: by bwz20 with SMTP id 20so2415184bwz.42 for ; Tue, 03 Mar 2009 06:51:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from :user-agent:mime-version:to:subject:references:in-reply-to :content-type:content-transfer-encoding; bh=Yn1pClSeXKsRyO4siowh2Fn6qREp0wvMTClX0XcSqRs=; b=pNDcyJGvcC5GvIKpU2n6jWhMItI7kv2NRrYq/EKzQfod8Gkb7Rs1cQHCbm9NOpK7yy Y1ncGs2Iqat0gH3oPmxlciIcDV8Gqb4vq8yuNLnr2dOw9QcXt7DgLb8OLSSvCq5izgh+ L5SwHJaOMHPKsQ7gRiTwajetLa5RZAUQ6wvzM= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:user-agent:mime-version:to:subject:references :in-reply-to:content-type:content-transfer-encoding; b=c7aprK/Qr6Engic+/BMmpMtbofWmEdB0DJ2ZGm1bfZYI/cn0D7+G+C9Gp87NrrmkMF Zc+WF/ifvUYDRO1yJsZfXqEx0wBpwhgVUAi0OH7CHhNMtRVgTfdRCpzOVQXtloSrEM9M n66L9to8F4l/FNAtFW8U/9F4C4lYTJG6JMRIM= Received: by 10.86.95.8 with SMTP id s8mr3941750fgb.16.1236091899520; Tue, 03 Mar 2009 06:51:39 -0800 (PST) Received: from ?192.168.1.2? (20-72.3-85.cust.bluewin.ch [85.3.72.20]) by mx.google.com with ESMTPS id 12sm707935fgg.13.2009.03.03.06.51.38 (version=SSLv3 cipher=RC4-MD5); Tue, 03 Mar 2009 06:51:39 -0800 (PST) Message-ID: <49AD43FB.8050708@gmail.com> Date: Tue, 03 Mar 2009 15:51:39 +0100 From: phcoder User-Agent: Thunderbird 2.0.0.19 (X11/20090105) MIME-Version: 1.0 To: The development of GRUB 2 References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-detected-operating-system: by monty-python.gnu.org: GNU/Linux 2.6 (newer, 2) Subject: Re: A serious stack issue caused by gcc optimization X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: The development of GRUB 2 List-Id: The development of GRUB 2 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 03 Mar 2009 14:51:49 -0000 Hello Have you tried -mno-red-zone? Here is an extract from man gcc: -mno-red-zone Do not use a so called red zone for x86-64 code. The red zone is mandated by the x86-64 ABI, it is a 128-byte area beyond the location of the stack pointer that will not be modified by signal or interrupt handlers and therefore can be used for temporary data without adjusting the stack pointer. The flag -mno-red-zone disables this red zone. Bean wrote: > Hi, > > I've found a serious stack issue when debugging EFI amd64 port. The > problem is in grub_parser_cmdline_state, the c code is all right, > problem is in the assembly code generated by gcc: > > grub_parser_cmdline_state: > mov %edi,-0x14(%rsp) > movl $0x1,-0xc(%rsp) > leaq EXT_C(my_state_transitions)(%rip),%rcx > > xor %r8d,%r8d > jmp loc_31 > loc_1b: > cmp %edi,%eax > jne loc_2d > mov 0x8(%rcx),%al > cmp %sil,%al > je loc_3e > test %al,%al > cmove %rcx,%r8 > loc_2d: > add $0x10,%rcx > loc_31: > mov (%rcx),%eax > test %eax,%eax > loc_35: > jne loc_1b > loc_37: > jmp loc_4d > loc_39: > lea -0x18(%rsp),%rcx > loc_3e: > xor %eax,%eax > cmpl $0x0,0xc(%rcx) > cmovne %esi,%eax > mov %al,(%rdx) > mov 0x4(%rcx),%eax > addq $0x18, %rsp > retq > loc_4d: > test %r8,%r8 > mov %r8,%rcx > jne loc_3e > jmp loc_39 > > You can see that it access local variable default_transition using > negative offset from %esp. In EFI, hardware interrupt is enabled. When > an interrupt fires (such as timer), it uses the same stack, which in > effect overwritten default_transition ! The result is that the parser > is halted by wrong grub_parser_cmdline_state result, and the menu is > truncated. If I subtract %rsp and uses positive offset, this problem > goes away. > > For grub_parser_cmdline_state itself, there is a simple solution, just > change default_transition to global variable: > > diff --git a/kern/parser.c b/kern/parser.c > index e931853..a0ab0e7 100644 > --- a/kern/parser.c > +++ b/kern/parser.c > @@ -54,6 +54,7 @@ static struct grub_parser_state_transition > state_transitions[] = > { 0, 0, 0, 0} > }; > > +static struct grub_parser_state_transition default_transition; > > /* Determines the state following STATE, determined by C. */ > grub_parser_state_t > @@ -61,7 +62,6 @@ grub_parser_cmdline_state (grub_parser_state_t > state, char c, char *result) > { > struct grub_parser_state_transition *transition; > struct grub_parser_state_transition *next_match = 0; > - struct grub_parser_state_transition default_transition; > int found = 0; > > default_transition.to_state = state; > > But there could be other hidden bombs lurking around. Especially that > random reboot issue, I suspect it's caused by the same bug. > > I've tried a few gcc options, but doesn't seems to work. Anyone knows > how to instruct gcc to subtract %rsp pointer for local variable ? > -- Regards Vladimir 'phcoder' Serbinenko