Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1392263 > unrolled thread
| Started by | Denys Vlasenko <dvlasenk@redhat.com> |
|---|---|
| First post | 2016-05-02 17:00 +0200 |
| Last post | 2016-05-03 20:10 +0200 |
| Articles | 6 — 5 participants |
Back to article view | Back to linux.kernel
[PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt_regs->REGs Denys Vlasenko <dvlasenk@redhat.com> - 2016-05-02 17:00 +0200
Re: [PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt_regs->REGs Andy Lutomirski <luto@kernel.org> - 2016-05-02 20:20 +0200
[tip:x86/asm] x86/asm/entry/32: Simplify pushes of zeroed pt_regs->REGs tip-bot for Denys Vlasenko <tipbot@zytor.com> - 2016-05-03 09:50 +0200
Re: [PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt_regs->REGs Brian Gerst <brgerst@gmail.com> - 2016-05-03 19:50 +0200
Re: [PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt_regs->REGs Andy Lutomirski <luto@amacapital.net> - 2016-05-03 20:00 +0200
Re: [PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt_regs->REGs Brian Gerst <brgerst@gmail.com> - 2016-05-03 20:10 +0200
| From | Denys Vlasenko <dvlasenk@redhat.com> |
|---|---|
| Date | 2016-05-02 17:00 +0200 |
| Subject | [PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt_regs->REGs |
| Message-ID | <runuj-5gi-29@gated-at.bofh.it> |
Use of a temporary R8 register here seems to be unnecessary. "push %r8" is a two-byte insn (it needs REX prefix to specify R8), "push $0" is two-byte too. It seems just using the latter would be no worse. Thus, code had an unnecessary "xorq %r8,%r8" insn. It probably costs nothing in execution time here since we are probably limited by store bandwidth at this point, but still. Run-tested under QEMU: 32-bit calls still work: / # ./test_syscall_vdso32 [RUN] Executing 6-argument 32-bit syscall via VDSO [OK] Arguments are preserved across syscall [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn [OK] R8..R15 did not leak kernel data [RUN] Executing 6-argument 32-bit syscall via INT 80 [OK] Arguments are preserved across syscall [OK] R8..R15 did not leak kernel data [RUN] Running tests under ptrace [RUN] Executing 6-argument 32-bit syscall via VDSO [OK] Arguments are preserved across syscall [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn [OK] R8..R15 did not leak kernel data [RUN] Executing 6-argument 32-bit syscall via INT 80 [OK] Arguments are preserved across syscall [OK] R8..R15 did not leak kernel data Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com> CC: Ingo Molnar <mingo@kernel.org> CC: Steven Rostedt <rostedt@goodmis.org> CC: Borislav Petkov <bp@alien8.de> CC: "H. Peter Anvin" <hpa@zytor.com> CC: Andy Lutomirski <luto@amacapital.net> CC: Frederic Weisbecker <fweisbec@gmail.com> CC: Will Drewry <wad@chromium.org> CC: Kees Cook <keescook@chromium.org> CC: x86@kernel.org CC: linux-kernel@vger.kernel.org --- Resending. Still applies to current Ingo's tip tree arch/x86/entry/entry_64_compat.S | 45 +++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 24 deletions(-) diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S index 847f2f0..e1721da 100644 --- a/arch/x86/entry/entry_64_compat.S +++ b/arch/x86/entry/entry_64_compat.S @@ -72,24 +72,23 @@ ENTRY(entry_SYSENTER_compat) pushfq /* pt_regs->flags (except IF = 0) */ orl $X86_EFLAGS_IF, (%rsp) /* Fix saved flags */ pushq $__USER32_CS /* pt_regs->cs */ - xorq %r8,%r8 - pushq %r8 /* pt_regs->ip = 0 (placeholder) */ + pushq $0 /* pt_regs->ip = 0 (placeholder) */ pushq %rax /* pt_regs->orig_ax */ pushq %rdi /* pt_regs->di */ pushq %rsi /* pt_regs->si */ pushq %rdx /* pt_regs->dx */ pushq %rcx /* pt_regs->cx */ pushq $-ENOSYS /* pt_regs->ax */ - pushq %r8 /* pt_regs->r8 = 0 */ - pushq %r8 /* pt_regs->r9 = 0 */ - pushq %r8 /* pt_regs->r10 = 0 */ - pushq %r8 /* pt_regs->r11 = 0 */ + pushq $0 /* pt_regs->r8 = 0 */ + pushq $0 /* pt_regs->r9 = 0 */ + pushq $0 /* pt_regs->r10 = 0 */ + pushq $0 /* pt_regs->r11 = 0 */ pushq %rbx /* pt_regs->rbx */ pushq %rbp /* pt_regs->rbp (will be overwritten) */ - pushq %r8 /* pt_regs->r12 = 0 */ - pushq %r8 /* pt_regs->r13 = 0 */ - pushq %r8 /* pt_regs->r14 = 0 */ - pushq %r8 /* pt_regs->r15 = 0 */ + pushq $0 /* pt_regs->r12 = 0 */ + pushq $0 /* pt_regs->r13 = 0 */ + pushq $0 /* pt_regs->r14 = 0 */ + pushq $0 /* pt_regs->r15 = 0 */ cld /* @@ -205,17 +204,16 @@ ENTRY(entry_SYSCALL_compat) pushq %rdx /* pt_regs->dx */ pushq %rbp /* pt_regs->cx (stashed in bp) */ pushq $-ENOSYS /* pt_regs->ax */ - xorq %r8,%r8 - pushq %r8 /* pt_regs->r8 = 0 */ - pushq %r8 /* pt_regs->r9 = 0 */ - pushq %r8 /* pt_regs->r10 = 0 */ - pushq %r8 /* pt_regs->r11 = 0 */ + pushq $0 /* pt_regs->r8 = 0 */ + pushq $0 /* pt_regs->r9 = 0 */ + pushq $0 /* pt_regs->r10 = 0 */ + pushq $0 /* pt_regs->r11 = 0 */ pushq %rbx /* pt_regs->rbx */ pushq %rbp /* pt_regs->rbp (will be overwritten) */ - pushq %r8 /* pt_regs->r12 = 0 */ - pushq %r8 /* pt_regs->r13 = 0 */ - pushq %r8 /* pt_regs->r14 = 0 */ - pushq %r8 /* pt_regs->r15 = 0 */ + pushq $0 /* pt_regs->r12 = 0 */ + pushq $0 /* pt_regs->r13 = 0 */ + pushq $0 /* pt_regs->r14 = 0 */ + pushq $0 /* pt_regs->r15 = 0 */ /* * User mode is traced as though IRQs are on, and SYSENTER @@ -316,11 +314,10 @@ ENTRY(entry_INT80_compat) pushq %rdx /* pt_regs->dx */ pushq %rcx /* pt_regs->cx */ pushq $-ENOSYS /* pt_regs->ax */ - xorq %r8,%r8 - pushq %r8 /* pt_regs->r8 = 0 */ - pushq %r8 /* pt_regs->r9 = 0 */ - pushq %r8 /* pt_regs->r10 = 0 */ - pushq %r8 /* pt_regs->r11 = 0 */ + pushq $0 /* pt_regs->r8 = 0 */ + pushq $0 /* pt_regs->r9 = 0 */ + pushq $0 /* pt_regs->r10 = 0 */ + pushq $0 /* pt_regs->r11 = 0 */ pushq %rbx /* pt_regs->rbx */ pushq %rbp /* pt_regs->rbp */ pushq %r12 /* pt_regs->r12 */ -- 1.8.1.4
[toc] | [next] | [standalone]
| From | Andy Lutomirski <luto@kernel.org> |
|---|---|
| Date | 2016-05-02 20:20 +0200 |
| Message-ID | <ruqBQ-8qK-21@gated-at.bofh.it> |
| In reply to | #1392263 |
On Mon, May 2, 2016 at 7:56 AM, Denys Vlasenko <dvlasenk@redhat.com> wrote: > Use of a temporary R8 register here seems to be unnecessary. > > "push %r8" is a two-byte insn (it needs REX prefix to specify R8), > "push $0" is two-byte too. It seems just using the latter would be > no worse. > > Thus, code had an unnecessary "xorq %r8,%r8" insn. > It probably costs nothing in execution time here since we are probably > limited by store bandwidth at this point, but still. > > Run-tested under QEMU: 32-bit calls still work: Acked-by: Andy Lutomirski <luto@kernel.org>
[toc] | [prev] | [next] | [standalone]
| From | tip-bot for Denys Vlasenko <tipbot@zytor.com> |
|---|---|
| Date | 2016-05-03 09:50 +0200 |
| Subject | [tip:x86/asm] x86/asm/entry/32: Simplify pushes of zeroed pt_regs->REGs |
| Message-ID | <ruDfH-3LT-17@gated-at.bofh.it> |
| In reply to | #1392263 |
Commit-ID: 778843f934e362ed4ed734520f60a44a78a074b4 Gitweb: http://git.kernel.org/tip/778843f934e362ed4ed734520f60a44a78a074b4 Author: Denys Vlasenko <dvlasenk@redhat.com> AuthorDate: Mon, 2 May 2016 16:56:50 +0200 Committer: Ingo Molnar <mingo@kernel.org> CommitDate: Tue, 3 May 2016 08:19:40 +0200 x86/asm/entry/32: Simplify pushes of zeroed pt_regs->REGs Use of a temporary R8 register here seems to be unnecessary. "push %r8" is a two-byte insn (it needs REX prefix to specify R8), "push $0" is two-byte too. It seems just using the latter would be no worse. Thus, code had an unnecessary "xorq %r8,%r8" insn. It probably costs nothing in execution time here since we are probably limited by store bandwidth at this point, but still. Run-tested under QEMU: 32-bit calls still work: / # ./test_syscall_vdso32 [RUN] Executing 6-argument 32-bit syscall via VDSO [OK] Arguments are preserved across syscall [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn [OK] R8..R15 did not leak kernel data [RUN] Executing 6-argument 32-bit syscall via INT 80 [OK] Arguments are preserved across syscall [OK] R8..R15 did not leak kernel data [RUN] Running tests under ptrace [RUN] Executing 6-argument 32-bit syscall via VDSO [OK] Arguments are preserved across syscall [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn [OK] R8..R15 did not leak kernel data [RUN] Executing 6-argument 32-bit syscall via INT 80 [OK] Arguments are preserved across syscall [OK] R8..R15 did not leak kernel data Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com> Acked-by: Andy Lutomirski <luto@kernel.org> Cc: Andy Lutomirski <luto@amacapital.net> Cc: Borislav Petkov <bp@alien8.de> Cc: Brian Gerst <brgerst@gmail.com> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Kees Cook <keescook@chromium.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Will Drewry <wad@chromium.org> Cc: linux-kernel@vger.kernel.org Link: http://lkml.kernel.org/r/1462201010-16846-1-git-send-email-dvlasenk@redhat.com Signed-off-by: Ingo Molnar <mingo@kernel.org> --- arch/x86/entry/entry_64_compat.S | 45 +++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 24 deletions(-) diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S index 847f2f0..e1721da 100644 --- a/arch/x86/entry/entry_64_compat.S +++ b/arch/x86/entry/entry_64_compat.S @@ -72,24 +72,23 @@ ENTRY(entry_SYSENTER_compat) pushfq /* pt_regs->flags (except IF = 0) */ orl $X86_EFLAGS_IF, (%rsp) /* Fix saved flags */ pushq $__USER32_CS /* pt_regs->cs */ - xorq %r8,%r8 - pushq %r8 /* pt_regs->ip = 0 (placeholder) */ + pushq $0 /* pt_regs->ip = 0 (placeholder) */ pushq %rax /* pt_regs->orig_ax */ pushq %rdi /* pt_regs->di */ pushq %rsi /* pt_regs->si */ pushq %rdx /* pt_regs->dx */ pushq %rcx /* pt_regs->cx */ pushq $-ENOSYS /* pt_regs->ax */ - pushq %r8 /* pt_regs->r8 = 0 */ - pushq %r8 /* pt_regs->r9 = 0 */ - pushq %r8 /* pt_regs->r10 = 0 */ - pushq %r8 /* pt_regs->r11 = 0 */ + pushq $0 /* pt_regs->r8 = 0 */ + pushq $0 /* pt_regs->r9 = 0 */ + pushq $0 /* pt_regs->r10 = 0 */ + pushq $0 /* pt_regs->r11 = 0 */ pushq %rbx /* pt_regs->rbx */ pushq %rbp /* pt_regs->rbp (will be overwritten) */ - pushq %r8 /* pt_regs->r12 = 0 */ - pushq %r8 /* pt_regs->r13 = 0 */ - pushq %r8 /* pt_regs->r14 = 0 */ - pushq %r8 /* pt_regs->r15 = 0 */ + pushq $0 /* pt_regs->r12 = 0 */ + pushq $0 /* pt_regs->r13 = 0 */ + pushq $0 /* pt_regs->r14 = 0 */ + pushq $0 /* pt_regs->r15 = 0 */ cld /* @@ -205,17 +204,16 @@ ENTRY(entry_SYSCALL_compat) pushq %rdx /* pt_regs->dx */ pushq %rbp /* pt_regs->cx (stashed in bp) */ pushq $-ENOSYS /* pt_regs->ax */ - xorq %r8,%r8 - pushq %r8 /* pt_regs->r8 = 0 */ - pushq %r8 /* pt_regs->r9 = 0 */ - pushq %r8 /* pt_regs->r10 = 0 */ - pushq %r8 /* pt_regs->r11 = 0 */ + pushq $0 /* pt_regs->r8 = 0 */ + pushq $0 /* pt_regs->r9 = 0 */ + pushq $0 /* pt_regs->r10 = 0 */ + pushq $0 /* pt_regs->r11 = 0 */ pushq %rbx /* pt_regs->rbx */ pushq %rbp /* pt_regs->rbp (will be overwritten) */ - pushq %r8 /* pt_regs->r12 = 0 */ - pushq %r8 /* pt_regs->r13 = 0 */ - pushq %r8 /* pt_regs->r14 = 0 */ - pushq %r8 /* pt_regs->r15 = 0 */ + pushq $0 /* pt_regs->r12 = 0 */ + pushq $0 /* pt_regs->r13 = 0 */ + pushq $0 /* pt_regs->r14 = 0 */ + pushq $0 /* pt_regs->r15 = 0 */ /* * User mode is traced as though IRQs are on, and SYSENTER @@ -316,11 +314,10 @@ ENTRY(entry_INT80_compat) pushq %rdx /* pt_regs->dx */ pushq %rcx /* pt_regs->cx */ pushq $-ENOSYS /* pt_regs->ax */ - xorq %r8,%r8 - pushq %r8 /* pt_regs->r8 = 0 */ - pushq %r8 /* pt_regs->r9 = 0 */ - pushq %r8 /* pt_regs->r10 = 0 */ - pushq %r8 /* pt_regs->r11 = 0 */ + pushq $0 /* pt_regs->r8 = 0 */ + pushq $0 /* pt_regs->r9 = 0 */ + pushq $0 /* pt_regs->r10 = 0 */ + pushq $0 /* pt_regs->r11 = 0 */ pushq %rbx /* pt_regs->rbx */ pushq %rbp /* pt_regs->rbp */ pushq %r12 /* pt_regs->r12 */
[toc] | [prev] | [next] | [standalone]
| From | Brian Gerst <brgerst@gmail.com> |
|---|---|
| Date | 2016-05-03 19:50 +0200 |
| Message-ID | <ruMCm-3Wx-11@gated-at.bofh.it> |
| In reply to | #1392263 |
On Mon, May 2, 2016 at 10:56 AM, Denys Vlasenko <dvlasenk@redhat.com> wrote: > Use of a temporary R8 register here seems to be unnecessary. > > "push %r8" is a two-byte insn (it needs REX prefix to specify R8), > "push $0" is two-byte too. It seems just using the latter would be > no worse. > > Thus, code had an unnecessary "xorq %r8,%r8" insn. > It probably costs nothing in execution time here since we are probably > limited by store bandwidth at this point, but still. > > Run-tested under QEMU: 32-bit calls still work: > > / # ./test_syscall_vdso32 > [RUN] Executing 6-argument 32-bit syscall via VDSO > [OK] Arguments are preserved across syscall > [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn > [OK] R8..R15 did not leak kernel data > [RUN] Executing 6-argument 32-bit syscall via INT 80 > [OK] Arguments are preserved across syscall > [OK] R8..R15 did not leak kernel data > [RUN] Running tests under ptrace > [RUN] Executing 6-argument 32-bit syscall via VDSO > [OK] Arguments are preserved across syscall > [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn > [OK] R8..R15 did not leak kernel data > [RUN] Executing 6-argument 32-bit syscall via INT 80 > [OK] Arguments are preserved across syscall > [OK] R8..R15 did not leak kernel data > > Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com> > CC: Ingo Molnar <mingo@kernel.org> > CC: Steven Rostedt <rostedt@goodmis.org> > CC: Borislav Petkov <bp@alien8.de> > CC: "H. Peter Anvin" <hpa@zytor.com> > CC: Andy Lutomirski <luto@amacapital.net> > CC: Frederic Weisbecker <fweisbec@gmail.com> > CC: Will Drewry <wad@chromium.org> > CC: Kees Cook <keescook@chromium.org> > CC: x86@kernel.org > CC: linux-kernel@vger.kernel.org > --- > > Resending. Still applies to current Ingo's tip tree > > arch/x86/entry/entry_64_compat.S | 45 +++++++++++++++++++--------------------- > 1 file changed, 21 insertions(+), 24 deletions(-) > > diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S > index 847f2f0..e1721da 100644 > --- a/arch/x86/entry/entry_64_compat.S > +++ b/arch/x86/entry/entry_64_compat.S > @@ -72,24 +72,23 @@ ENTRY(entry_SYSENTER_compat) > pushfq /* pt_regs->flags (except IF = 0) */ > orl $X86_EFLAGS_IF, (%rsp) /* Fix saved flags */ > pushq $__USER32_CS /* pt_regs->cs */ > - xorq %r8,%r8 > - pushq %r8 /* pt_regs->ip = 0 (placeholder) */ > + pushq $0 /* pt_regs->ip = 0 (placeholder) */ > pushq %rax /* pt_regs->orig_ax */ > pushq %rdi /* pt_regs->di */ > pushq %rsi /* pt_regs->si */ > pushq %rdx /* pt_regs->dx */ > pushq %rcx /* pt_regs->cx */ > pushq $-ENOSYS /* pt_regs->ax */ > - pushq %r8 /* pt_regs->r8 = 0 */ > - pushq %r8 /* pt_regs->r9 = 0 */ > - pushq %r8 /* pt_regs->r10 = 0 */ > - pushq %r8 /* pt_regs->r11 = 0 */ > + pushq $0 /* pt_regs->r8 = 0 */ > + pushq $0 /* pt_regs->r9 = 0 */ > + pushq $0 /* pt_regs->r10 = 0 */ > + pushq $0 /* pt_regs->r11 = 0 */ > pushq %rbx /* pt_regs->rbx */ > pushq %rbp /* pt_regs->rbp (will be overwritten) */ > - pushq %r8 /* pt_regs->r12 = 0 */ > - pushq %r8 /* pt_regs->r13 = 0 */ > - pushq %r8 /* pt_regs->r14 = 0 */ > - pushq %r8 /* pt_regs->r15 = 0 */ > + pushq $0 /* pt_regs->r12 = 0 */ > + pushq $0 /* pt_regs->r13 = 0 */ > + pushq $0 /* pt_regs->r14 = 0 */ > + pushq $0 /* pt_regs->r15 = 0 */ I think it actually should push r12-r15, since they are callee-saved and we don't explicitly zero them out on SYSRET like r8-r10. If it exited via IRET it would reload them as zero, so there is an inconsistency there. -- Brian Gerst
[toc] | [prev] | [next] | [standalone]
| From | Andy Lutomirski <luto@amacapital.net> |
|---|---|
| Date | 2016-05-03 20:00 +0200 |
| Message-ID | <ruMM2-41x-13@gated-at.bofh.it> |
| In reply to | #1393675 |
On Tue, May 3, 2016 at 10:45 AM, Brian Gerst <brgerst@gmail.com> wrote: > On Mon, May 2, 2016 at 10:56 AM, Denys Vlasenko <dvlasenk@redhat.com> wrote: >> Use of a temporary R8 register here seems to be unnecessary. >> >> "push %r8" is a two-byte insn (it needs REX prefix to specify R8), >> "push $0" is two-byte too. It seems just using the latter would be >> no worse. >> >> Thus, code had an unnecessary "xorq %r8,%r8" insn. >> It probably costs nothing in execution time here since we are probably >> limited by store bandwidth at this point, but still. >> >> Run-tested under QEMU: 32-bit calls still work: >> >> / # ./test_syscall_vdso32 >> [RUN] Executing 6-argument 32-bit syscall via VDSO >> [OK] Arguments are preserved across syscall >> [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn >> [OK] R8..R15 did not leak kernel data >> [RUN] Executing 6-argument 32-bit syscall via INT 80 >> [OK] Arguments are preserved across syscall >> [OK] R8..R15 did not leak kernel data >> [RUN] Running tests under ptrace >> [RUN] Executing 6-argument 32-bit syscall via VDSO >> [OK] Arguments are preserved across syscall >> [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn >> [OK] R8..R15 did not leak kernel data >> [RUN] Executing 6-argument 32-bit syscall via INT 80 >> [OK] Arguments are preserved across syscall >> [OK] R8..R15 did not leak kernel data >> >> Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com> >> CC: Ingo Molnar <mingo@kernel.org> >> CC: Steven Rostedt <rostedt@goodmis.org> >> CC: Borislav Petkov <bp@alien8.de> >> CC: "H. Peter Anvin" <hpa@zytor.com> >> CC: Andy Lutomirski <luto@amacapital.net> >> CC: Frederic Weisbecker <fweisbec@gmail.com> >> CC: Will Drewry <wad@chromium.org> >> CC: Kees Cook <keescook@chromium.org> >> CC: x86@kernel.org >> CC: linux-kernel@vger.kernel.org >> --- >> >> Resending. Still applies to current Ingo's tip tree >> >> arch/x86/entry/entry_64_compat.S | 45 +++++++++++++++++++--------------------- >> 1 file changed, 21 insertions(+), 24 deletions(-) >> >> diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S >> index 847f2f0..e1721da 100644 >> --- a/arch/x86/entry/entry_64_compat.S >> +++ b/arch/x86/entry/entry_64_compat.S >> @@ -72,24 +72,23 @@ ENTRY(entry_SYSENTER_compat) >> pushfq /* pt_regs->flags (except IF = 0) */ >> orl $X86_EFLAGS_IF, (%rsp) /* Fix saved flags */ >> pushq $__USER32_CS /* pt_regs->cs */ >> - xorq %r8,%r8 >> - pushq %r8 /* pt_regs->ip = 0 (placeholder) */ >> + pushq $0 /* pt_regs->ip = 0 (placeholder) */ >> pushq %rax /* pt_regs->orig_ax */ >> pushq %rdi /* pt_regs->di */ >> pushq %rsi /* pt_regs->si */ >> pushq %rdx /* pt_regs->dx */ >> pushq %rcx /* pt_regs->cx */ >> pushq $-ENOSYS /* pt_regs->ax */ >> - pushq %r8 /* pt_regs->r8 = 0 */ >> - pushq %r8 /* pt_regs->r9 = 0 */ >> - pushq %r8 /* pt_regs->r10 = 0 */ >> - pushq %r8 /* pt_regs->r11 = 0 */ >> + pushq $0 /* pt_regs->r8 = 0 */ >> + pushq $0 /* pt_regs->r9 = 0 */ >> + pushq $0 /* pt_regs->r10 = 0 */ >> + pushq $0 /* pt_regs->r11 = 0 */ >> pushq %rbx /* pt_regs->rbx */ >> pushq %rbp /* pt_regs->rbp (will be overwritten) */ >> - pushq %r8 /* pt_regs->r12 = 0 */ >> - pushq %r8 /* pt_regs->r13 = 0 */ >> - pushq %r8 /* pt_regs->r14 = 0 */ >> - pushq %r8 /* pt_regs->r15 = 0 */ >> + pushq $0 /* pt_regs->r12 = 0 */ >> + pushq $0 /* pt_regs->r13 = 0 */ >> + pushq $0 /* pt_regs->r14 = 0 */ >> + pushq $0 /* pt_regs->r15 = 0 */ > > I think it actually should push r12-r15, since they are callee-saved > and we don't explicitly zero them out on SYSRET like r8-r10. If it > exited via IRET it would reload them as zero, so there is an > inconsistency there. Hmm. We could do this or we could zero them on the way out from the fast path. I have no real preference. Preserving the values is probably a bit nicer. --Andy
[toc] | [prev] | [next] | [standalone]
| From | Brian Gerst <brgerst@gmail.com> |
|---|---|
| Date | 2016-05-03 20:10 +0200 |
| Message-ID | <ruMVI-4wA-19@gated-at.bofh.it> |
| In reply to | #1393686 |
On Tue, May 3, 2016 at 1:55 PM, Andy Lutomirski <luto@amacapital.net> wrote: > On Tue, May 3, 2016 at 10:45 AM, Brian Gerst <brgerst@gmail.com> wrote: >> On Mon, May 2, 2016 at 10:56 AM, Denys Vlasenko <dvlasenk@redhat.com> wrote: >>> Use of a temporary R8 register here seems to be unnecessary. >>> >>> "push %r8" is a two-byte insn (it needs REX prefix to specify R8), >>> "push $0" is two-byte too. It seems just using the latter would be >>> no worse. >>> >>> Thus, code had an unnecessary "xorq %r8,%r8" insn. >>> It probably costs nothing in execution time here since we are probably >>> limited by store bandwidth at this point, but still. >>> >>> Run-tested under QEMU: 32-bit calls still work: >>> >>> / # ./test_syscall_vdso32 >>> [RUN] Executing 6-argument 32-bit syscall via VDSO >>> [OK] Arguments are preserved across syscall >>> [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn >>> [OK] R8..R15 did not leak kernel data >>> [RUN] Executing 6-argument 32-bit syscall via INT 80 >>> [OK] Arguments are preserved across syscall >>> [OK] R8..R15 did not leak kernel data >>> [RUN] Running tests under ptrace >>> [RUN] Executing 6-argument 32-bit syscall via VDSO >>> [OK] Arguments are preserved across syscall >>> [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn >>> [OK] R8..R15 did not leak kernel data >>> [RUN] Executing 6-argument 32-bit syscall via INT 80 >>> [OK] Arguments are preserved across syscall >>> [OK] R8..R15 did not leak kernel data >>> >>> Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com> >>> CC: Ingo Molnar <mingo@kernel.org> >>> CC: Steven Rostedt <rostedt@goodmis.org> >>> CC: Borislav Petkov <bp@alien8.de> >>> CC: "H. Peter Anvin" <hpa@zytor.com> >>> CC: Andy Lutomirski <luto@amacapital.net> >>> CC: Frederic Weisbecker <fweisbec@gmail.com> >>> CC: Will Drewry <wad@chromium.org> >>> CC: Kees Cook <keescook@chromium.org> >>> CC: x86@kernel.org >>> CC: linux-kernel@vger.kernel.org >>> --- >>> >>> Resending. Still applies to current Ingo's tip tree >>> >>> arch/x86/entry/entry_64_compat.S | 45 +++++++++++++++++++--------------------- >>> 1 file changed, 21 insertions(+), 24 deletions(-) >>> >>> diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S >>> index 847f2f0..e1721da 100644 >>> --- a/arch/x86/entry/entry_64_compat.S >>> +++ b/arch/x86/entry/entry_64_compat.S >>> @@ -72,24 +72,23 @@ ENTRY(entry_SYSENTER_compat) >>> pushfq /* pt_regs->flags (except IF = 0) */ >>> orl $X86_EFLAGS_IF, (%rsp) /* Fix saved flags */ >>> pushq $__USER32_CS /* pt_regs->cs */ >>> - xorq %r8,%r8 >>> - pushq %r8 /* pt_regs->ip = 0 (placeholder) */ >>> + pushq $0 /* pt_regs->ip = 0 (placeholder) */ >>> pushq %rax /* pt_regs->orig_ax */ >>> pushq %rdi /* pt_regs->di */ >>> pushq %rsi /* pt_regs->si */ >>> pushq %rdx /* pt_regs->dx */ >>> pushq %rcx /* pt_regs->cx */ >>> pushq $-ENOSYS /* pt_regs->ax */ >>> - pushq %r8 /* pt_regs->r8 = 0 */ >>> - pushq %r8 /* pt_regs->r9 = 0 */ >>> - pushq %r8 /* pt_regs->r10 = 0 */ >>> - pushq %r8 /* pt_regs->r11 = 0 */ >>> + pushq $0 /* pt_regs->r8 = 0 */ >>> + pushq $0 /* pt_regs->r9 = 0 */ >>> + pushq $0 /* pt_regs->r10 = 0 */ >>> + pushq $0 /* pt_regs->r11 = 0 */ >>> pushq %rbx /* pt_regs->rbx */ >>> pushq %rbp /* pt_regs->rbp (will be overwritten) */ >>> - pushq %r8 /* pt_regs->r12 = 0 */ >>> - pushq %r8 /* pt_regs->r13 = 0 */ >>> - pushq %r8 /* pt_regs->r14 = 0 */ >>> - pushq %r8 /* pt_regs->r15 = 0 */ >>> + pushq $0 /* pt_regs->r12 = 0 */ >>> + pushq $0 /* pt_regs->r13 = 0 */ >>> + pushq $0 /* pt_regs->r14 = 0 */ >>> + pushq $0 /* pt_regs->r15 = 0 */ >> >> I think it actually should push r12-r15, since they are callee-saved >> and we don't explicitly zero them out on SYSRET like r8-r10. If it >> exited via IRET it would reload them as zero, so there is an >> inconsistency there. > > Hmm. We could do this or we could zero them on the way out from the > fast path. I have no real preference. Preserving the values is > probably a bit nicer. It's no difference to push the register vs. pushing a zero (it was pushing r8 before). It would cost extra to explicitly zero them on SYSRET. -- Brian Gerst
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web