2005-01-28 00:12:26

by H. Peter Anvin

[permalink] [raw]
Subject: Re: Patch 4/6 randomize the stack pointer

Followup to: <[email protected]>
By author: Julien TINNES <[email protected]>
In newsgroup: linux.dev.kernel
>
> Not very important but ((get_random_int() % 4096) << 4) could be
> optimized into get_random_int() & 0xFFF0. Because 4096 is a power of 2
> you won't loose any entropy by doing & 0xFFF instead of %4096
>

.. and gcc knows that.

: tazenda 8 ; cat testme.c
extern unsigned int get_random_int(void);

unsigned int test(void)
{
return (get_random_int() % 4096) << 4;
}
: tazenda 9 ; objdump -dr testme.o

testme.o: file format elf64-x86-64

Disassembly of section .text:

0000000000000000 <test>:
0: 48 83 ec 08 sub $0x8,%rsp
4: e8 00 00 00 00 callq 9 <test+0x9>
5: R_X86_64_PC32
get_random_int+0xfffffffffffffffc
9: 25 ff 0f 00 00 and $0xfff,%eax
e: 48 83 c4 08 add $0x8,%rsp
12: c1 e0 04 shl $0x4,%eax
15: c3 retq
: tazenda 10 ; gcc -m32 -O2 -fomit-frame-pointer -g -c testme.c
: tazenda 11 ; objdump -dr testme.o

testme.o: file format elf32-i386

Disassembly of section .text:

00000000 <test>:
0: 83 ec 0c sub $0xc,%esp
3: e8 fc ff ff ff call 4 <test+0x4>
4: R_386_PC32 get_random_int
8: 25 ff 0f 00 00 and $0xfff,%eax
d: 83 c4 0c add $0xc,%esp
10: c1 e0 04 shl $0x4,%eax
13: c3 ret
: tazenda 12 ;


2005-01-28 00:27:56

by Roland Dreier

[permalink] [raw]
Subject: Re: Patch 4/6 randomize the stack pointer

Julien> Not very important but ((get_random_int() % 4096) << 4)
Julien> could be optimized into get_random_int() & 0xFFF0.

HPA> .. and gcc knows that.

HPA> 8: 25 ff 0f 00 00 and $0xfff,%eax
HPA> d: 83 c4 0c add $0xc,%esp
HPA> 10: c1 e0 04 shl $0x4,%eax

Actually gcc isn't quite that smart (since it obviously can't
understand the semantics of get_random int()). The original point was
that the "shl $0x4" can be avoided by directly &'ing with 0xfff0, not
that "% 4096" can be strength reduced to "& 0xfff".

- R.

2005-01-28 01:07:09

by H. Peter Anvin

[permalink] [raw]
Subject: Re: Patch 4/6 randomize the stack pointer

Roland Dreier wrote:
> Julien> Not very important but ((get_random_int() % 4096) << 4)
> Julien> could be optimized into get_random_int() & 0xFFF0.
>
> HPA> .. and gcc knows that.
>
> HPA> 8: 25 ff 0f 00 00 and $0xfff,%eax
> HPA> d: 83 c4 0c add $0xc,%esp
> HPA> 10: c1 e0 04 shl $0x4,%eax
>
> Actually gcc isn't quite that smart (since it obviously can't
> understand the semantics of get_random int()). The original point was
> that the "shl $0x4" can be avoided by directly &'ing with 0xfff0, not
> that "% 4096" can be strength reduced to "& 0xfff".
>

Oh, right. D'oh! :)

-hpa