Re: About 4k kernel stack size....

From: linux-os (Dick Johnson)
Date: Wed Dec 21 2005 - 16:38:26 EST



On Wed, 21 Dec 2005, Krzysztof Halasa wrote:

> Giridhar Pemmasani <giri@xxxxxxxxxxxxxxxxx> writes:
>
>> As I see, although people that rely on
>> ndiswrapper (since there is no other way they could use the hardware that
>> they have) will not be able to use their wireless cards when this patch
>> gets merged without having to patch the kernel
>
> Huh? -mm is already a patch so I'm not sure what users are you talking
> about. End-users (non-developers) using -mm kernel (binary?) provided
> by their distribution? Why would they want to use ndiswrapper (= binary
> drivers, which make all bug reports and in fact all development
> pointless) with devel kernel?
> --
> Krzysztof Halasa

The attached patch will poison the user-to-kernel stack with the letters
'Q', starting on each page boundary. It does one page only so it will
work with any sized stack. One can run the machine with the usual
work, then do:

# cat /dev/mem | strings >junk.dat

Somebody, if interested, could make a program that looks for a string
of 'Q's starting on each page boundary reading /dev/kmem. Anyway,
using `vim` and searching for "QQQQQQQQQQQQQQ", you can see how
much of the existing stack is being used. A cursory check shows that,
out of every instance of a string of such poison, the smallest string
was about 48 bytes and the largest was too many to bother to count.
This shows that there is (probably) about 48 bytes of overhead when
using 1 page stacks.


The mailer screws up patches not attached, but here is one
in the foreground for review. It is running on this system so
it doesn't break anything (probably slows syscalls down, though).

--- linux-2.6.13.4/arch/i386/kernel/entry.S.orig 2005-12-21 15:29:05.000000000 -0500
+++ linux-2.6.13.4/arch/i386/kernel/entry.S 2005-12-21 16:09:08.000000000 -0500
@@ -75,6 +75,27 @@
NT_MASK = 0x00004000
VM_MASK = 0x00020000

+poison:
+ pushl %eax
+ pushl %ecx
+ pushl %edi
+ pushl %es
+ pushl %ss
+ popl %es
+ movl %esp, %edi
+ movl %edi, %ecx
+ andl $~0x1000, %edi
+ subl %edi, %ecx
+ movb $'Q', %al
+ rep stosb
+ popl %es
+ popl %edi
+ popl %ecx
+ popl %eax
+ ret
+
+
+
#ifdef CONFIG_PREEMPT
#define preempt_stop cli
#else
@@ -93,6 +114,7 @@
pushl %edx; \
pushl %ecx; \
pushl %ebx; \
+ call poison; \
movl $(__USER_DS), %edx; \
movl %edx, %ds; \
movl %edx, %es;



Cheers,
Dick Johnson
Penguin : Linux version 2.6.13.4 on an i686 machine (5591.09 BogoMips).
Warning : 98.36% of all statistics are fiction.
.


****************************************************************
The information transmitted in this message is confidential and may be privileged. Any review, retransmission, dissemination, or other use of this information by persons or entities other than the intended recipient is prohibited. If you are not the intended recipient, please notify Analogic Corporation immediately - by replying to this message or by sending an email to DeliveryErrors@xxxxxxxxxxxx - and destroy all copies of this information, including any attachments, without reading or disclosing them.

Thank you.--- linux-2.6.13.4/arch/i386/kernel/entry.S.orig 2005-12-21 15:29:05.000000000 -0500
+++ linux-2.6.13.4/arch/i386/kernel/entry.S 2005-12-21 16:09:08.000000000 -0500
@@ -75,6 +75,27 @@
NT_MASK = 0x00004000
VM_MASK = 0x00020000

+poison:
+ pushl %eax
+ pushl %ecx
+ pushl %edi
+ pushl %es
+ pushl %ss
+ popl %es
+ movl %esp, %edi
+ movl %edi, %ecx
+ andl $~0x1000, %edi
+ subl %edi, %ecx
+ movb $'Q', %al
+ rep stosb
+ popl %es
+ popl %edi
+ popl %ecx
+ popl %eax
+ ret
+
+
+
#ifdef CONFIG_PREEMPT
#define preempt_stop cli
#else
@@ -93,6 +114,7 @@
pushl %edx; \
pushl %ecx; \
pushl %ebx; \
+ call poison; \
movl $(__USER_DS), %edx; \
movl %edx, %ds; \
movl %edx, %es;