Skip to content

Commit 511cde0

Browse files
committed
amd64: fix a retarded bug in memset
memset fills the target buffer from a byte-sized value passed in as the second argument. The fully-sized (8 bytes) register containing it is named %rsi. Lower 4 bytes can be referred to as %esi and finally the lowest byte is %sil. Vast majority of all the callers just zero the target buffer and set it up by doing xor %esi,%esi which has a side-effect of zeroing the upper parts of the register as well. Some others do a word-sized move to %esi which has the same result. However, there are callers which only fill %sil. This does *not* clear up the rest of the register. The value of %rsi is multiplied by $0x0101010101010101 to create a 8-byte sized pattern for 8-byte stores. Prior to the patch, the func just blindly took %rsi assuming the unwanted bytes are zeroed out. Since this is not the case for the callers which only play with %sil (the rest of the register can have absolutely anything), the resulting pattern can be garbage. This has potential for funny bugs. One side effect (which was not amusing) after enabling it instead of bzero was that the kernel was hanging on boot as a xen domU. Reported by: Trond Endrestøl <Trond.Endrestol fagskolen.gjovik.no> Pointy hat: me
1 parent 1b1a1a5 commit 511cde0

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

sys/amd64/amd64/support.S

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -271,8 +271,9 @@ ENTRY(memset)
271271
PUSH_FRAME_POINTER
272272
movq %rdi,%r9
273273
movq %rdx,%rcx
274+
movzbq %sil,%r8
274275
movabs $0x0101010101010101,%rax
275-
imulq %rsi,%rax
276+
imulq %r8,%rax
276277
shrq $3,%rcx
277278
rep
278279
stosq

0 commit comments

Comments
 (0)