From cc76c9b82bf5272ce9bcc17df8c2aa21b6dfef0f Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Sun, 11 Oct 2026 15:48:42 +0200 Subject: [PATCH] lib/crypto: x86/sha256: Follow the normal %rbp convention Some of the SHA-256 assembly functions push callee-save GPRs to the stack *before* they set up the frame pointer (%rbp). (They are leaf functions, but they need to set up a frame pointer anyway because they allocate a 16- or 32-byte-aligned buffer on the stack.) As a result, during these functions, 8(%rbp) doesn't contain a return address like it is supposed to. This differs from the convention used by C code, and it interferes with the frame pointer unwinder (CONFIG_UNWINDER_FRAME_POINTER=y). Specifically, if a call trace is dumped in these functions, then all entries are populated purely from the fallback scan of the entire stack: RIP: 0010:sha256_transform_rorx+0xd78/0x1120 [...] Call Trace: ? sha256_blocks_avx2+0x37/0x70 ? __sha256_update+0x77/0x220 ? sha256+0x9d/0x110 [...] ? do_syscall_64+0x6f/0x3e0 With this fix to follow the normal %rbp convention, the call trace is generated reliably: RIP: 0010:sha256_transform_rorx+0xdae/0x1120 [...] Call Trace: sha256_blocks_avx2+0x37/0x70 __sha256_update+0x77/0x220 sha256+0x9d/0x110 [...] do_syscall_64+0x6f/0x3e0 Reviewed-by: Ard Biesheuvel Link: https://patch.msgid.link/20261011134843.166585-3-ebiggers@kernel.org Signed-off-by: Eric Biggers --- lib/crypto/x86/sha256-avx-asm.S | 10 +++++----- lib/crypto/x86/sha256-avx2-asm.S | 10 ++++------ lib/crypto/x86/sha256-ni-asm.S | 9 +++++---- lib/crypto/x86/sha256-ssse3-asm.S | 8 ++++---- 4 files changed, 18 insertions(+), 19 deletions(-) diff --git a/lib/crypto/x86/sha256-avx-asm.S b/lib/crypto/x86/sha256-avx-asm.S index c1aceb3ba3a3..efb8dff5e8a9 100644 --- a/lib/crypto/x86/sha256-avx-asm.S +++ b/lib/crypto/x86/sha256-avx-asm.S @@ -345,13 +345,13 @@ a = TMP_ ######################################################################## .text SYM_FUNC_START(sha256_transform_avx) + pushq %rbp + movq %rsp, %rbp pushq %rbx pushq %r12 pushq %r13 pushq %r14 pushq %r15 - pushq %rbp - movq %rsp, %rbp subq $STACK_SIZE, %rsp # allocate stack space and $~15, %rsp # align stack pointer @@ -445,13 +445,13 @@ SYM_FUNC_START(sha256_transform_avx) cmp _INP_END(%rsp), INP jne .Lloop0 - mov %rbp, %rsp - popq %rbp + lea -40(%rbp), %rsp popq %r15 popq %r14 popq %r13 - popq %r12 + popq %r12 popq %rbx + popq %rbp RET SYM_FUNC_END(sha256_transform_avx) diff --git a/lib/crypto/x86/sha256-avx2-asm.S b/lib/crypto/x86/sha256-avx2-asm.S index eb8836fb9695..a719c2173b61 100644 --- a/lib/crypto/x86/sha256-avx2-asm.S +++ b/lib/crypto/x86/sha256-avx2-asm.S @@ -522,15 +522,14 @@ STACK_SIZE = _CTX + _CTX_SIZE ######################################################################## .text SYM_FUNC_START(sha256_transform_rorx) + pushq %rbp + mov %rsp, %rbp pushq %rbx pushq %r12 pushq %r13 pushq %r14 pushq %r15 - push %rbp - mov %rsp, %rbp - subq $STACK_SIZE, %rsp and $-32, %rsp # align rsp to 32 byte boundary @@ -704,14 +703,13 @@ SYM_FUNC_START(sha256_transform_rorx) .Ldone_hash: - mov %rbp, %rsp - pop %rbp - + lea -40(%rbp), %rsp popq %r15 popq %r14 popq %r13 popq %r12 popq %rbx + popq %rbp vzeroupper RET SYM_FUNC_END(sha256_transform_rorx) diff --git a/lib/crypto/x86/sha256-ni-asm.S b/lib/crypto/x86/sha256-ni-asm.S index de5f707e7ef7..e47263273f43 100644 --- a/lib/crypto/x86/sha256-ni-asm.S +++ b/lib/crypto/x86/sha256-ni-asm.S @@ -276,10 +276,11 @@ SYM_FUNC_END(sha256_ni_transform) // to taking better advantage of the CPU's SHA-256 and SIMD throughput. // SYM_FUNC_START(sha256_ni_finup2x) - // Allocate 128 bytes of stack space, 16-byte aligned. - push %rbx push %rbp mov %rsp, %rbp + push %rbx + + // Allocate 128 bytes of stack space, 16-byte aligned. sub $128, %rsp and $~15, %rsp @@ -527,9 +528,9 @@ SYM_FUNC_START(sha256_ni_finup2x) movdqu STATE1_A, 0*16(OUT1) movdqu STATE1_B, 0*16(OUT2) - mov %rbp, %rsp - pop %rbp + lea -8(%rbp), %rsp pop %rbx + pop %rbp RET SYM_FUNC_END(sha256_ni_finup2x) diff --git a/lib/crypto/x86/sha256-ssse3-asm.S b/lib/crypto/x86/sha256-ssse3-asm.S index 383b8eec7ebe..cc91b3e15a83 100644 --- a/lib/crypto/x86/sha256-ssse3-asm.S +++ b/lib/crypto/x86/sha256-ssse3-asm.S @@ -352,13 +352,13 @@ a = TMP_ ######################################################################## .text SYM_FUNC_START(sha256_transform_ssse3) + pushq %rbp + mov %rsp, %rbp pushq %rbx pushq %r12 pushq %r13 pushq %r14 pushq %r15 - pushq %rbp - mov %rsp, %rbp subq $STACK_SIZE, %rsp and $~15, %rsp @@ -456,13 +456,13 @@ SYM_FUNC_START(sha256_transform_ssse3) cmp _INP_END(%rsp), INP jne .Lloop0 - mov %rbp, %rsp - popq %rbp + lea -40(%rbp), %rsp popq %r15 popq %r14 popq %r13 popq %r12 popq %rbx + popq %rbp RET SYM_FUNC_END(sha256_transform_ssse3)