Vulnerability Development: Re: get SP on Solaris (SPARC) with GCC 3.3.2

[Jonathon Giffin <giffin () cs wisc edu>]

> (gdb) disass get_sp
> Dump of assembler code for function get_sp:
> 0x00010dd8 <get_sp+0>:  mov  %sp, %i0
> 0x00010ddc <get_sp+4>:  retl
> 0x00010de0 <get_sp+8>:  nop
> End of assembler dump.
What you have included here is a leaf function and does not shift register
windows. This is a standard compiler optimization done to functions that
call no other functions (and are hence leaf nodes in the call graph). You
need to use "mov %sp, %o0" not "mov %sp, %i0" to have the correct value
returned.

You should pass return values in %i0 only for non-leaf functions that
use "save" and "restore" to shift the current register window. The restore
instruction will rename the %i0 register to %o0, which is the return
value register. If you do not shift register windows--and your code
above does not--then you must move the return value to %o0 yourself.

If you are unfamiliar with register windows, see for example:
        http://www.sics.se/~psm/sparcstack.html .

Your code above actually violates register safety, as %i0 may be live at
the point of a call to get_sp() and your get_sp() function clobbers the
value. Standard SPARC register usage convention stipulates that out
registers are volatile across function calls but in registers are not
volatile.

> Another way to get SP (maybe more simple) it's get the ARGV[0] of out
> program... work fine, but now I would try to undestand why with gcc
> 3.3.2 doesn't work this function...
Sorry, I don't understand this comment, but that may be because I do not
know the context of your work. What do you mean by "out program"?

Thanks,

Jon