Messages in this thread | ![/](/images/icornerl.gif) | | Date | Tue, 3 May 2016 13:45:35 -0400 | Subject | Re: [PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt_regs->REGs | From | Brian Gerst <> |
| |
On Mon, May 2, 2016 at 10:56 AM, Denys Vlasenko <dvlasenk@redhat.com> wrote: > Use of a temporary R8 register here seems to be unnecessary. > > "push %r8" is a two-byte insn (it needs REX prefix to specify R8), > "push $0" is two-byte too. It seems just using the latter would be > no worse. > > Thus, code had an unnecessary "xorq %r8,%r8" insn. > It probably costs nothing in execution time here since we are probably > limited by store bandwidth at this point, but still. > > Run-tested under QEMU: 32-bit calls still work: > > / # ./test_syscall_vdso32 > [RUN] Executing 6-argument 32-bit syscall via VDSO > [OK] Arguments are preserved across syscall > [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn > [OK] R8..R15 did not leak kernel data > [RUN] Executing 6-argument 32-bit syscall via INT 80 > [OK] Arguments are preserved across syscall > [OK] R8..R15 did not leak kernel data > [RUN] Running tests under ptrace > [RUN] Executing 6-argument 32-bit syscall via VDSO > [OK] Arguments are preserved across syscall > [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn > [OK] R8..R15 did not leak kernel data > [RUN] Executing 6-argument 32-bit syscall via INT 80 > [OK] Arguments are preserved across syscall > [OK] R8..R15 did not leak kernel data > > Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com> > CC: Ingo Molnar <mingo@kernel.org> > CC: Steven Rostedt <rostedt@goodmis.org> > CC: Borislav Petkov <bp@alien8.de> > CC: "H. Peter Anvin" <hpa@zytor.com> > CC: Andy Lutomirski <luto@amacapital.net> > CC: Frederic Weisbecker <fweisbec@gmail.com> > CC: Will Drewry <wad@chromium.org> > CC: Kees Cook <keescook@chromium.org> > CC: x86@kernel.org > CC: linux-kernel@vger.kernel.org > --- > > Resending. Still applies to current Ingo's tip tree > > arch/x86/entry/entry_64_compat.S | 45 +++++++++++++++++++--------------------- > 1 file changed, 21 insertions(+), 24 deletions(-) > > diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S > index 847f2f0..e1721da 100644 > --- a/arch/x86/entry/entry_64_compat.S > +++ b/arch/x86/entry/entry_64_compat.S > @@ -72,24 +72,23 @@ ENTRY(entry_SYSENTER_compat) > pushfq /* pt_regs->flags (except IF = 0) */ > orl $X86_EFLAGS_IF, (%rsp) /* Fix saved flags */ > pushq $__USER32_CS /* pt_regs->cs */ > - xorq %r8,%r8 > - pushq %r8 /* pt_regs->ip = 0 (placeholder) */ > + pushq $0 /* pt_regs->ip = 0 (placeholder) */ > pushq %rax /* pt_regs->orig_ax */ > pushq %rdi /* pt_regs->di */ > pushq %rsi /* pt_regs->si */ > pushq %rdx /* pt_regs->dx */ > pushq %rcx /* pt_regs->cx */ > pushq $-ENOSYS /* pt_regs->ax */ > - pushq %r8 /* pt_regs->r8 = 0 */ > - pushq %r8 /* pt_regs->r9 = 0 */ > - pushq %r8 /* pt_regs->r10 = 0 */ > - pushq %r8 /* pt_regs->r11 = 0 */ > + pushq $0 /* pt_regs->r8 = 0 */ > + pushq $0 /* pt_regs->r9 = 0 */ > + pushq $0 /* pt_regs->r10 = 0 */ > + pushq $0 /* pt_regs->r11 = 0 */ > pushq %rbx /* pt_regs->rbx */ > pushq %rbp /* pt_regs->rbp (will be overwritten) */ > - pushq %r8 /* pt_regs->r12 = 0 */ > - pushq %r8 /* pt_regs->r13 = 0 */ > - pushq %r8 /* pt_regs->r14 = 0 */ > - pushq %r8 /* pt_regs->r15 = 0 */ > + pushq $0 /* pt_regs->r12 = 0 */ > + pushq $0 /* pt_regs->r13 = 0 */ > + pushq $0 /* pt_regs->r14 = 0 */ > + pushq $0 /* pt_regs->r15 = 0 */
I think it actually should push r12-r15, since they are callee-saved and we don't explicitly zero them out on SYSRET like r8-r10. If it exited via IRET it would reload them as zero, so there is an inconsistency there.
-- Brian Gerst
| ![\](/images/icornerr.gif) |