lkml.org 
[lkml]   [2016]   [May]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt_regs->REGs
From
On Tue, May 3, 2016 at 1:55 PM, Andy Lutomirski <luto@amacapital.net> wrote:
> On Tue, May 3, 2016 at 10:45 AM, Brian Gerst <brgerst@gmail.com> wrote:
>> On Mon, May 2, 2016 at 10:56 AM, Denys Vlasenko <dvlasenk@redhat.com> wrote:
>>> Use of a temporary R8 register here seems to be unnecessary.
>>>
>>> "push %r8" is a two-byte insn (it needs REX prefix to specify R8),
>>> "push $0" is two-byte too. It seems just using the latter would be
>>> no worse.
>>>
>>> Thus, code had an unnecessary "xorq %r8,%r8" insn.
>>> It probably costs nothing in execution time here since we are probably
>>> limited by store bandwidth at this point, but still.
>>>
>>> Run-tested under QEMU: 32-bit calls still work:
>>>
>>> / # ./test_syscall_vdso32
>>> [RUN] Executing 6-argument 32-bit syscall via VDSO
>>> [OK] Arguments are preserved across syscall
>>> [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn
>>> [OK] R8..R15 did not leak kernel data
>>> [RUN] Executing 6-argument 32-bit syscall via INT 80
>>> [OK] Arguments are preserved across syscall
>>> [OK] R8..R15 did not leak kernel data
>>> [RUN] Running tests under ptrace
>>> [RUN] Executing 6-argument 32-bit syscall via VDSO
>>> [OK] Arguments are preserved across syscall
>>> [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn
>>> [OK] R8..R15 did not leak kernel data
>>> [RUN] Executing 6-argument 32-bit syscall via INT 80
>>> [OK] Arguments are preserved across syscall
>>> [OK] R8..R15 did not leak kernel data
>>>
>>> Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
>>> CC: Ingo Molnar <mingo@kernel.org>
>>> CC: Steven Rostedt <rostedt@goodmis.org>
>>> CC: Borislav Petkov <bp@alien8.de>
>>> CC: "H. Peter Anvin" <hpa@zytor.com>
>>> CC: Andy Lutomirski <luto@amacapital.net>
>>> CC: Frederic Weisbecker <fweisbec@gmail.com>
>>> CC: Will Drewry <wad@chromium.org>
>>> CC: Kees Cook <keescook@chromium.org>
>>> CC: x86@kernel.org
>>> CC: linux-kernel@vger.kernel.org
>>> ---
>>>
>>> Resending. Still applies to current Ingo's tip tree
>>>
>>> arch/x86/entry/entry_64_compat.S | 45 +++++++++++++++++++---------------------
>>> 1 file changed, 21 insertions(+), 24 deletions(-)
>>>
>>> diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
>>> index 847f2f0..e1721da 100644
>>> --- a/arch/x86/entry/entry_64_compat.S
>>> +++ b/arch/x86/entry/entry_64_compat.S
>>> @@ -72,24 +72,23 @@ ENTRY(entry_SYSENTER_compat)
>>> pushfq /* pt_regs->flags (except IF = 0) */
>>> orl $X86_EFLAGS_IF, (%rsp) /* Fix saved flags */
>>> pushq $__USER32_CS /* pt_regs->cs */
>>> - xorq %r8,%r8
>>> - pushq %r8 /* pt_regs->ip = 0 (placeholder) */
>>> + pushq $0 /* pt_regs->ip = 0 (placeholder) */
>>> pushq %rax /* pt_regs->orig_ax */
>>> pushq %rdi /* pt_regs->di */
>>> pushq %rsi /* pt_regs->si */
>>> pushq %rdx /* pt_regs->dx */
>>> pushq %rcx /* pt_regs->cx */
>>> pushq $-ENOSYS /* pt_regs->ax */
>>> - pushq %r8 /* pt_regs->r8 = 0 */
>>> - pushq %r8 /* pt_regs->r9 = 0 */
>>> - pushq %r8 /* pt_regs->r10 = 0 */
>>> - pushq %r8 /* pt_regs->r11 = 0 */
>>> + pushq $0 /* pt_regs->r8 = 0 */
>>> + pushq $0 /* pt_regs->r9 = 0 */
>>> + pushq $0 /* pt_regs->r10 = 0 */
>>> + pushq $0 /* pt_regs->r11 = 0 */
>>> pushq %rbx /* pt_regs->rbx */
>>> pushq %rbp /* pt_regs->rbp (will be overwritten) */
>>> - pushq %r8 /* pt_regs->r12 = 0 */
>>> - pushq %r8 /* pt_regs->r13 = 0 */
>>> - pushq %r8 /* pt_regs->r14 = 0 */
>>> - pushq %r8 /* pt_regs->r15 = 0 */
>>> + pushq $0 /* pt_regs->r12 = 0 */
>>> + pushq $0 /* pt_regs->r13 = 0 */
>>> + pushq $0 /* pt_regs->r14 = 0 */
>>> + pushq $0 /* pt_regs->r15 = 0 */
>>
>> I think it actually should push r12-r15, since they are callee-saved
>> and we don't explicitly zero them out on SYSRET like r8-r10. If it
>> exited via IRET it would reload them as zero, so there is an
>> inconsistency there.
>
> Hmm. We could do this or we could zero them on the way out from the
> fast path. I have no real preference. Preserving the values is
> probably a bit nicer.

It's no difference to push the register vs. pushing a zero (it was
pushing r8 before). It would cost extra to explicitly zero them on
SYSRET.

--
Brian Gerst

\
 
 \ /
  Last update: 2016-05-03 20:21    [W:0.063 / U:0.048 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site