* [PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt_regs->REGs
@ 2016-05-02 14:56 Denys Vlasenko
2016-05-02 18:19 ` Andy Lutomirski
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Denys Vlasenko @ 2016-05-02 14:56 UTC (permalink / raw)
To: Ingo Molnar
Cc: Denys Vlasenko, Steven Rostedt, Borislav Petkov, H. Peter Anvin,
Andy Lutomirski, Frederic Weisbecker, Will Drewry, Kees Cook,
x86, linux-kernel
Use of a temporary R8 register here seems to be unnecessary.
"push %r8" is a two-byte insn (it needs REX prefix to specify R8),
"push $0" is two-byte too. It seems just using the latter would be
no worse.
Thus, code had an unnecessary "xorq %r8,%r8" insn.
It probably costs nothing in execution time here since we are probably
limited by store bandwidth at this point, but still.
Run-tested under QEMU: 32-bit calls still work:
/ # ./test_syscall_vdso32
[RUN] Executing 6-argument 32-bit syscall via VDSO
[OK] Arguments are preserved across syscall
[NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn
[OK] R8..R15 did not leak kernel data
[RUN] Executing 6-argument 32-bit syscall via INT 80
[OK] Arguments are preserved across syscall
[OK] R8..R15 did not leak kernel data
[RUN] Running tests under ptrace
[RUN] Executing 6-argument 32-bit syscall via VDSO
[OK] Arguments are preserved across syscall
[NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn
[OK] R8..R15 did not leak kernel data
[RUN] Executing 6-argument 32-bit syscall via INT 80
[OK] Arguments are preserved across syscall
[OK] R8..R15 did not leak kernel data
Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
CC: Ingo Molnar <mingo@kernel.org>
CC: Steven Rostedt <rostedt@goodmis.org>
CC: Borislav Petkov <bp@alien8.de>
CC: "H. Peter Anvin" <hpa@zytor.com>
CC: Andy Lutomirski <luto@amacapital.net>
CC: Frederic Weisbecker <fweisbec@gmail.com>
CC: Will Drewry <wad@chromium.org>
CC: Kees Cook <keescook@chromium.org>
CC: x86@kernel.org
CC: linux-kernel@vger.kernel.org
---
Resending. Still applies to current Ingo's tip tree
arch/x86/entry/entry_64_compat.S | 45 +++++++++++++++++++---------------------
1 file changed, 21 insertions(+), 24 deletions(-)
diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index 847f2f0..e1721da 100644
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -72,24 +72,23 @@ ENTRY(entry_SYSENTER_compat)
pushfq /* pt_regs->flags (except IF = 0) */
orl $X86_EFLAGS_IF, (%rsp) /* Fix saved flags */
pushq $__USER32_CS /* pt_regs->cs */
- xorq %r8,%r8
- pushq %r8 /* pt_regs->ip = 0 (placeholder) */
+ pushq $0 /* pt_regs->ip = 0 (placeholder) */
pushq %rax /* pt_regs->orig_ax */
pushq %rdi /* pt_regs->di */
pushq %rsi /* pt_regs->si */
pushq %rdx /* pt_regs->dx */
pushq %rcx /* pt_regs->cx */
pushq $-ENOSYS /* pt_regs->ax */
- pushq %r8 /* pt_regs->r8 = 0 */
- pushq %r8 /* pt_regs->r9 = 0 */
- pushq %r8 /* pt_regs->r10 = 0 */
- pushq %r8 /* pt_regs->r11 = 0 */
+ pushq $0 /* pt_regs->r8 = 0 */
+ pushq $0 /* pt_regs->r9 = 0 */
+ pushq $0 /* pt_regs->r10 = 0 */
+ pushq $0 /* pt_regs->r11 = 0 */
pushq %rbx /* pt_regs->rbx */
pushq %rbp /* pt_regs->rbp (will be overwritten) */
- pushq %r8 /* pt_regs->r12 = 0 */
- pushq %r8 /* pt_regs->r13 = 0 */
- pushq %r8 /* pt_regs->r14 = 0 */
- pushq %r8 /* pt_regs->r15 = 0 */
+ pushq $0 /* pt_regs->r12 = 0 */
+ pushq $0 /* pt_regs->r13 = 0 */
+ pushq $0 /* pt_regs->r14 = 0 */
+ pushq $0 /* pt_regs->r15 = 0 */
cld
/*
@@ -205,17 +204,16 @@ ENTRY(entry_SYSCALL_compat)
pushq %rdx /* pt_regs->dx */
pushq %rbp /* pt_regs->cx (stashed in bp) */
pushq $-ENOSYS /* pt_regs->ax */
- xorq %r8,%r8
- pushq %r8 /* pt_regs->r8 = 0 */
- pushq %r8 /* pt_regs->r9 = 0 */
- pushq %r8 /* pt_regs->r10 = 0 */
- pushq %r8 /* pt_regs->r11 = 0 */
+ pushq $0 /* pt_regs->r8 = 0 */
+ pushq $0 /* pt_regs->r9 = 0 */
+ pushq $0 /* pt_regs->r10 = 0 */
+ pushq $0 /* pt_regs->r11 = 0 */
pushq %rbx /* pt_regs->rbx */
pushq %rbp /* pt_regs->rbp (will be overwritten) */
- pushq %r8 /* pt_regs->r12 = 0 */
- pushq %r8 /* pt_regs->r13 = 0 */
- pushq %r8 /* pt_regs->r14 = 0 */
- pushq %r8 /* pt_regs->r15 = 0 */
+ pushq $0 /* pt_regs->r12 = 0 */
+ pushq $0 /* pt_regs->r13 = 0 */
+ pushq $0 /* pt_regs->r14 = 0 */
+ pushq $0 /* pt_regs->r15 = 0 */
/*
* User mode is traced as though IRQs are on, and SYSENTER
@@ -316,11 +314,10 @@ ENTRY(entry_INT80_compat)
pushq %rdx /* pt_regs->dx */
pushq %rcx /* pt_regs->cx */
pushq $-ENOSYS /* pt_regs->ax */
- xorq %r8,%r8
- pushq %r8 /* pt_regs->r8 = 0 */
- pushq %r8 /* pt_regs->r9 = 0 */
- pushq %r8 /* pt_regs->r10 = 0 */
- pushq %r8 /* pt_regs->r11 = 0 */
+ pushq $0 /* pt_regs->r8 = 0 */
+ pushq $0 /* pt_regs->r9 = 0 */
+ pushq $0 /* pt_regs->r10 = 0 */
+ pushq $0 /* pt_regs->r11 = 0 */
pushq %rbx /* pt_regs->rbx */
pushq %rbp /* pt_regs->rbp */
pushq %r12 /* pt_regs->r12 */
--
1.8.1.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt_regs->REGs
2016-05-02 14:56 [PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt_regs->REGs Denys Vlasenko
@ 2016-05-02 18:19 ` Andy Lutomirski
2016-05-03 7:46 ` [tip:x86/asm] x86/asm/entry/32: Simplify " tip-bot for Denys Vlasenko
2016-05-03 17:45 ` [PATCH RESEND] x86/asm/entry/32: simplify " Brian Gerst
2 siblings, 0 replies; 6+ messages in thread
From: Andy Lutomirski @ 2016-05-02 18:19 UTC (permalink / raw)
To: Denys Vlasenko
Cc: Ingo Molnar, Steven Rostedt, Borislav Petkov, H. Peter Anvin,
Frederic Weisbecker, Will Drewry, Kees Cook, X86 ML,
linux-kernel
On Mon, May 2, 2016 at 7:56 AM, Denys Vlasenko <dvlasenk@redhat.com> wrote:
> Use of a temporary R8 register here seems to be unnecessary.
>
> "push %r8" is a two-byte insn (it needs REX prefix to specify R8),
> "push $0" is two-byte too. It seems just using the latter would be
> no worse.
>
> Thus, code had an unnecessary "xorq %r8,%r8" insn.
> It probably costs nothing in execution time here since we are probably
> limited by store bandwidth at this point, but still.
>
> Run-tested under QEMU: 32-bit calls still work:
Acked-by: Andy Lutomirski <luto@kernel.org>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [tip:x86/asm] x86/asm/entry/32: Simplify pushes of zeroed pt_regs->REGs
2016-05-02 14:56 [PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt_regs->REGs Denys Vlasenko
2016-05-02 18:19 ` Andy Lutomirski
@ 2016-05-03 7:46 ` tip-bot for Denys Vlasenko
2016-05-03 17:45 ` [PATCH RESEND] x86/asm/entry/32: simplify " Brian Gerst
2 siblings, 0 replies; 6+ messages in thread
From: tip-bot for Denys Vlasenko @ 2016-05-03 7:46 UTC (permalink / raw)
To: linux-tip-commits
Cc: peterz, wad, brgerst, torvalds, rostedt, keescook, fweisbec, bp,
mingo, luto, hpa, linux-kernel, dvlasenk, tglx, luto
Commit-ID: 778843f934e362ed4ed734520f60a44a78a074b4
Gitweb: http://git.kernel.org/tip/778843f934e362ed4ed734520f60a44a78a074b4
Author: Denys Vlasenko <dvlasenk@redhat.com>
AuthorDate: Mon, 2 May 2016 16:56:50 +0200
Committer: Ingo Molnar <mingo@kernel.org>
CommitDate: Tue, 3 May 2016 08:19:40 +0200
x86/asm/entry/32: Simplify pushes of zeroed pt_regs->REGs
Use of a temporary R8 register here seems to be unnecessary.
"push %r8" is a two-byte insn (it needs REX prefix to specify R8),
"push $0" is two-byte too. It seems just using the latter would be
no worse.
Thus, code had an unnecessary "xorq %r8,%r8" insn.
It probably costs nothing in execution time here since we are probably
limited by store bandwidth at this point, but still.
Run-tested under QEMU: 32-bit calls still work:
/ # ./test_syscall_vdso32
[RUN] Executing 6-argument 32-bit syscall via VDSO
[OK] Arguments are preserved across syscall
[NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn
[OK] R8..R15 did not leak kernel data
[RUN] Executing 6-argument 32-bit syscall via INT 80
[OK] Arguments are preserved across syscall
[OK] R8..R15 did not leak kernel data
[RUN] Running tests under ptrace
[RUN] Executing 6-argument 32-bit syscall via VDSO
[OK] Arguments are preserved across syscall
[NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn
[OK] R8..R15 did not leak kernel data
[RUN] Executing 6-argument 32-bit syscall via INT 80
[OK] Arguments are preserved across syscall
[OK] R8..R15 did not leak kernel data
Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
Acked-by: Andy Lutomirski <luto@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Drewry <wad@chromium.org>
Cc: linux-kernel@vger.kernel.org
Link: http://lkml.kernel.org/r/1462201010-16846-1-git-send-email-dvlasenk@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
arch/x86/entry/entry_64_compat.S | 45 +++++++++++++++++++---------------------
1 file changed, 21 insertions(+), 24 deletions(-)
diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
index 847f2f0..e1721da 100644
--- a/arch/x86/entry/entry_64_compat.S
+++ b/arch/x86/entry/entry_64_compat.S
@@ -72,24 +72,23 @@ ENTRY(entry_SYSENTER_compat)
pushfq /* pt_regs->flags (except IF = 0) */
orl $X86_EFLAGS_IF, (%rsp) /* Fix saved flags */
pushq $__USER32_CS /* pt_regs->cs */
- xorq %r8,%r8
- pushq %r8 /* pt_regs->ip = 0 (placeholder) */
+ pushq $0 /* pt_regs->ip = 0 (placeholder) */
pushq %rax /* pt_regs->orig_ax */
pushq %rdi /* pt_regs->di */
pushq %rsi /* pt_regs->si */
pushq %rdx /* pt_regs->dx */
pushq %rcx /* pt_regs->cx */
pushq $-ENOSYS /* pt_regs->ax */
- pushq %r8 /* pt_regs->r8 = 0 */
- pushq %r8 /* pt_regs->r9 = 0 */
- pushq %r8 /* pt_regs->r10 = 0 */
- pushq %r8 /* pt_regs->r11 = 0 */
+ pushq $0 /* pt_regs->r8 = 0 */
+ pushq $0 /* pt_regs->r9 = 0 */
+ pushq $0 /* pt_regs->r10 = 0 */
+ pushq $0 /* pt_regs->r11 = 0 */
pushq %rbx /* pt_regs->rbx */
pushq %rbp /* pt_regs->rbp (will be overwritten) */
- pushq %r8 /* pt_regs->r12 = 0 */
- pushq %r8 /* pt_regs->r13 = 0 */
- pushq %r8 /* pt_regs->r14 = 0 */
- pushq %r8 /* pt_regs->r15 = 0 */
+ pushq $0 /* pt_regs->r12 = 0 */
+ pushq $0 /* pt_regs->r13 = 0 */
+ pushq $0 /* pt_regs->r14 = 0 */
+ pushq $0 /* pt_regs->r15 = 0 */
cld
/*
@@ -205,17 +204,16 @@ ENTRY(entry_SYSCALL_compat)
pushq %rdx /* pt_regs->dx */
pushq %rbp /* pt_regs->cx (stashed in bp) */
pushq $-ENOSYS /* pt_regs->ax */
- xorq %r8,%r8
- pushq %r8 /* pt_regs->r8 = 0 */
- pushq %r8 /* pt_regs->r9 = 0 */
- pushq %r8 /* pt_regs->r10 = 0 */
- pushq %r8 /* pt_regs->r11 = 0 */
+ pushq $0 /* pt_regs->r8 = 0 */
+ pushq $0 /* pt_regs->r9 = 0 */
+ pushq $0 /* pt_regs->r10 = 0 */
+ pushq $0 /* pt_regs->r11 = 0 */
pushq %rbx /* pt_regs->rbx */
pushq %rbp /* pt_regs->rbp (will be overwritten) */
- pushq %r8 /* pt_regs->r12 = 0 */
- pushq %r8 /* pt_regs->r13 = 0 */
- pushq %r8 /* pt_regs->r14 = 0 */
- pushq %r8 /* pt_regs->r15 = 0 */
+ pushq $0 /* pt_regs->r12 = 0 */
+ pushq $0 /* pt_regs->r13 = 0 */
+ pushq $0 /* pt_regs->r14 = 0 */
+ pushq $0 /* pt_regs->r15 = 0 */
/*
* User mode is traced as though IRQs are on, and SYSENTER
@@ -316,11 +314,10 @@ ENTRY(entry_INT80_compat)
pushq %rdx /* pt_regs->dx */
pushq %rcx /* pt_regs->cx */
pushq $-ENOSYS /* pt_regs->ax */
- xorq %r8,%r8
- pushq %r8 /* pt_regs->r8 = 0 */
- pushq %r8 /* pt_regs->r9 = 0 */
- pushq %r8 /* pt_regs->r10 = 0 */
- pushq %r8 /* pt_regs->r11 = 0 */
+ pushq $0 /* pt_regs->r8 = 0 */
+ pushq $0 /* pt_regs->r9 = 0 */
+ pushq $0 /* pt_regs->r10 = 0 */
+ pushq $0 /* pt_regs->r11 = 0 */
pushq %rbx /* pt_regs->rbx */
pushq %rbp /* pt_regs->rbp */
pushq %r12 /* pt_regs->r12 */
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt_regs->REGs
2016-05-02 14:56 [PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt_regs->REGs Denys Vlasenko
2016-05-02 18:19 ` Andy Lutomirski
2016-05-03 7:46 ` [tip:x86/asm] x86/asm/entry/32: Simplify " tip-bot for Denys Vlasenko
@ 2016-05-03 17:45 ` Brian Gerst
2016-05-03 17:55 ` Andy Lutomirski
2 siblings, 1 reply; 6+ messages in thread
From: Brian Gerst @ 2016-05-03 17:45 UTC (permalink / raw)
To: Denys Vlasenko
Cc: Ingo Molnar, Steven Rostedt, Borislav Petkov, H. Peter Anvin,
Andy Lutomirski, Frederic Weisbecker, Will Drewry, Kees Cook,
the arch/x86 maintainers, Linux Kernel Mailing List
On Mon, May 2, 2016 at 10:56 AM, Denys Vlasenko <dvlasenk@redhat.com> wrote:
> Use of a temporary R8 register here seems to be unnecessary.
>
> "push %r8" is a two-byte insn (it needs REX prefix to specify R8),
> "push $0" is two-byte too. It seems just using the latter would be
> no worse.
>
> Thus, code had an unnecessary "xorq %r8,%r8" insn.
> It probably costs nothing in execution time here since we are probably
> limited by store bandwidth at this point, but still.
>
> Run-tested under QEMU: 32-bit calls still work:
>
> / # ./test_syscall_vdso32
> [RUN] Executing 6-argument 32-bit syscall via VDSO
> [OK] Arguments are preserved across syscall
> [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn
> [OK] R8..R15 did not leak kernel data
> [RUN] Executing 6-argument 32-bit syscall via INT 80
> [OK] Arguments are preserved across syscall
> [OK] R8..R15 did not leak kernel data
> [RUN] Running tests under ptrace
> [RUN] Executing 6-argument 32-bit syscall via VDSO
> [OK] Arguments are preserved across syscall
> [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn
> [OK] R8..R15 did not leak kernel data
> [RUN] Executing 6-argument 32-bit syscall via INT 80
> [OK] Arguments are preserved across syscall
> [OK] R8..R15 did not leak kernel data
>
> Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
> CC: Ingo Molnar <mingo@kernel.org>
> CC: Steven Rostedt <rostedt@goodmis.org>
> CC: Borislav Petkov <bp@alien8.de>
> CC: "H. Peter Anvin" <hpa@zytor.com>
> CC: Andy Lutomirski <luto@amacapital.net>
> CC: Frederic Weisbecker <fweisbec@gmail.com>
> CC: Will Drewry <wad@chromium.org>
> CC: Kees Cook <keescook@chromium.org>
> CC: x86@kernel.org
> CC: linux-kernel@vger.kernel.org
> ---
>
> Resending. Still applies to current Ingo's tip tree
>
> arch/x86/entry/entry_64_compat.S | 45 +++++++++++++++++++---------------------
> 1 file changed, 21 insertions(+), 24 deletions(-)
>
> diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
> index 847f2f0..e1721da 100644
> --- a/arch/x86/entry/entry_64_compat.S
> +++ b/arch/x86/entry/entry_64_compat.S
> @@ -72,24 +72,23 @@ ENTRY(entry_SYSENTER_compat)
> pushfq /* pt_regs->flags (except IF = 0) */
> orl $X86_EFLAGS_IF, (%rsp) /* Fix saved flags */
> pushq $__USER32_CS /* pt_regs->cs */
> - xorq %r8,%r8
> - pushq %r8 /* pt_regs->ip = 0 (placeholder) */
> + pushq $0 /* pt_regs->ip = 0 (placeholder) */
> pushq %rax /* pt_regs->orig_ax */
> pushq %rdi /* pt_regs->di */
> pushq %rsi /* pt_regs->si */
> pushq %rdx /* pt_regs->dx */
> pushq %rcx /* pt_regs->cx */
> pushq $-ENOSYS /* pt_regs->ax */
> - pushq %r8 /* pt_regs->r8 = 0 */
> - pushq %r8 /* pt_regs->r9 = 0 */
> - pushq %r8 /* pt_regs->r10 = 0 */
> - pushq %r8 /* pt_regs->r11 = 0 */
> + pushq $0 /* pt_regs->r8 = 0 */
> + pushq $0 /* pt_regs->r9 = 0 */
> + pushq $0 /* pt_regs->r10 = 0 */
> + pushq $0 /* pt_regs->r11 = 0 */
> pushq %rbx /* pt_regs->rbx */
> pushq %rbp /* pt_regs->rbp (will be overwritten) */
> - pushq %r8 /* pt_regs->r12 = 0 */
> - pushq %r8 /* pt_regs->r13 = 0 */
> - pushq %r8 /* pt_regs->r14 = 0 */
> - pushq %r8 /* pt_regs->r15 = 0 */
> + pushq $0 /* pt_regs->r12 = 0 */
> + pushq $0 /* pt_regs->r13 = 0 */
> + pushq $0 /* pt_regs->r14 = 0 */
> + pushq $0 /* pt_regs->r15 = 0 */
I think it actually should push r12-r15, since they are callee-saved
and we don't explicitly zero them out on SYSRET like r8-r10. If it
exited via IRET it would reload them as zero, so there is an
inconsistency there.
--
Brian Gerst
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt_regs->REGs
2016-05-03 17:45 ` [PATCH RESEND] x86/asm/entry/32: simplify " Brian Gerst
@ 2016-05-03 17:55 ` Andy Lutomirski
2016-05-03 18:09 ` Brian Gerst
0 siblings, 1 reply; 6+ messages in thread
From: Andy Lutomirski @ 2016-05-03 17:55 UTC (permalink / raw)
To: Brian Gerst
Cc: Denys Vlasenko, Ingo Molnar, Steven Rostedt, Borislav Petkov,
H. Peter Anvin, Frederic Weisbecker, Will Drewry, Kees Cook,
the arch/x86 maintainers, Linux Kernel Mailing List
On Tue, May 3, 2016 at 10:45 AM, Brian Gerst <brgerst@gmail.com> wrote:
> On Mon, May 2, 2016 at 10:56 AM, Denys Vlasenko <dvlasenk@redhat.com> wrote:
>> Use of a temporary R8 register here seems to be unnecessary.
>>
>> "push %r8" is a two-byte insn (it needs REX prefix to specify R8),
>> "push $0" is two-byte too. It seems just using the latter would be
>> no worse.
>>
>> Thus, code had an unnecessary "xorq %r8,%r8" insn.
>> It probably costs nothing in execution time here since we are probably
>> limited by store bandwidth at this point, but still.
>>
>> Run-tested under QEMU: 32-bit calls still work:
>>
>> / # ./test_syscall_vdso32
>> [RUN] Executing 6-argument 32-bit syscall via VDSO
>> [OK] Arguments are preserved across syscall
>> [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn
>> [OK] R8..R15 did not leak kernel data
>> [RUN] Executing 6-argument 32-bit syscall via INT 80
>> [OK] Arguments are preserved across syscall
>> [OK] R8..R15 did not leak kernel data
>> [RUN] Running tests under ptrace
>> [RUN] Executing 6-argument 32-bit syscall via VDSO
>> [OK] Arguments are preserved across syscall
>> [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn
>> [OK] R8..R15 did not leak kernel data
>> [RUN] Executing 6-argument 32-bit syscall via INT 80
>> [OK] Arguments are preserved across syscall
>> [OK] R8..R15 did not leak kernel data
>>
>> Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
>> CC: Ingo Molnar <mingo@kernel.org>
>> CC: Steven Rostedt <rostedt@goodmis.org>
>> CC: Borislav Petkov <bp@alien8.de>
>> CC: "H. Peter Anvin" <hpa@zytor.com>
>> CC: Andy Lutomirski <luto@amacapital.net>
>> CC: Frederic Weisbecker <fweisbec@gmail.com>
>> CC: Will Drewry <wad@chromium.org>
>> CC: Kees Cook <keescook@chromium.org>
>> CC: x86@kernel.org
>> CC: linux-kernel@vger.kernel.org
>> ---
>>
>> Resending. Still applies to current Ingo's tip tree
>>
>> arch/x86/entry/entry_64_compat.S | 45 +++++++++++++++++++---------------------
>> 1 file changed, 21 insertions(+), 24 deletions(-)
>>
>> diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
>> index 847f2f0..e1721da 100644
>> --- a/arch/x86/entry/entry_64_compat.S
>> +++ b/arch/x86/entry/entry_64_compat.S
>> @@ -72,24 +72,23 @@ ENTRY(entry_SYSENTER_compat)
>> pushfq /* pt_regs->flags (except IF = 0) */
>> orl $X86_EFLAGS_IF, (%rsp) /* Fix saved flags */
>> pushq $__USER32_CS /* pt_regs->cs */
>> - xorq %r8,%r8
>> - pushq %r8 /* pt_regs->ip = 0 (placeholder) */
>> + pushq $0 /* pt_regs->ip = 0 (placeholder) */
>> pushq %rax /* pt_regs->orig_ax */
>> pushq %rdi /* pt_regs->di */
>> pushq %rsi /* pt_regs->si */
>> pushq %rdx /* pt_regs->dx */
>> pushq %rcx /* pt_regs->cx */
>> pushq $-ENOSYS /* pt_regs->ax */
>> - pushq %r8 /* pt_regs->r8 = 0 */
>> - pushq %r8 /* pt_regs->r9 = 0 */
>> - pushq %r8 /* pt_regs->r10 = 0 */
>> - pushq %r8 /* pt_regs->r11 = 0 */
>> + pushq $0 /* pt_regs->r8 = 0 */
>> + pushq $0 /* pt_regs->r9 = 0 */
>> + pushq $0 /* pt_regs->r10 = 0 */
>> + pushq $0 /* pt_regs->r11 = 0 */
>> pushq %rbx /* pt_regs->rbx */
>> pushq %rbp /* pt_regs->rbp (will be overwritten) */
>> - pushq %r8 /* pt_regs->r12 = 0 */
>> - pushq %r8 /* pt_regs->r13 = 0 */
>> - pushq %r8 /* pt_regs->r14 = 0 */
>> - pushq %r8 /* pt_regs->r15 = 0 */
>> + pushq $0 /* pt_regs->r12 = 0 */
>> + pushq $0 /* pt_regs->r13 = 0 */
>> + pushq $0 /* pt_regs->r14 = 0 */
>> + pushq $0 /* pt_regs->r15 = 0 */
>
> I think it actually should push r12-r15, since they are callee-saved
> and we don't explicitly zero them out on SYSRET like r8-r10. If it
> exited via IRET it would reload them as zero, so there is an
> inconsistency there.
Hmm. We could do this or we could zero them on the way out from the
fast path. I have no real preference. Preserving the values is
probably a bit nicer.
--Andy
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt_regs->REGs
2016-05-03 17:55 ` Andy Lutomirski
@ 2016-05-03 18:09 ` Brian Gerst
0 siblings, 0 replies; 6+ messages in thread
From: Brian Gerst @ 2016-05-03 18:09 UTC (permalink / raw)
To: Andy Lutomirski
Cc: Denys Vlasenko, Ingo Molnar, Steven Rostedt, Borislav Petkov,
H. Peter Anvin, Frederic Weisbecker, Will Drewry, Kees Cook,
the arch/x86 maintainers, Linux Kernel Mailing List
On Tue, May 3, 2016 at 1:55 PM, Andy Lutomirski <luto@amacapital.net> wrote:
> On Tue, May 3, 2016 at 10:45 AM, Brian Gerst <brgerst@gmail.com> wrote:
>> On Mon, May 2, 2016 at 10:56 AM, Denys Vlasenko <dvlasenk@redhat.com> wrote:
>>> Use of a temporary R8 register here seems to be unnecessary.
>>>
>>> "push %r8" is a two-byte insn (it needs REX prefix to specify R8),
>>> "push $0" is two-byte too. It seems just using the latter would be
>>> no worse.
>>>
>>> Thus, code had an unnecessary "xorq %r8,%r8" insn.
>>> It probably costs nothing in execution time here since we are probably
>>> limited by store bandwidth at this point, but still.
>>>
>>> Run-tested under QEMU: 32-bit calls still work:
>>>
>>> / # ./test_syscall_vdso32
>>> [RUN] Executing 6-argument 32-bit syscall via VDSO
>>> [OK] Arguments are preserved across syscall
>>> [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn
>>> [OK] R8..R15 did not leak kernel data
>>> [RUN] Executing 6-argument 32-bit syscall via INT 80
>>> [OK] Arguments are preserved across syscall
>>> [OK] R8..R15 did not leak kernel data
>>> [RUN] Running tests under ptrace
>>> [RUN] Executing 6-argument 32-bit syscall via VDSO
>>> [OK] Arguments are preserved across syscall
>>> [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn
>>> [OK] R8..R15 did not leak kernel data
>>> [RUN] Executing 6-argument 32-bit syscall via INT 80
>>> [OK] Arguments are preserved across syscall
>>> [OK] R8..R15 did not leak kernel data
>>>
>>> Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
>>> CC: Ingo Molnar <mingo@kernel.org>
>>> CC: Steven Rostedt <rostedt@goodmis.org>
>>> CC: Borislav Petkov <bp@alien8.de>
>>> CC: "H. Peter Anvin" <hpa@zytor.com>
>>> CC: Andy Lutomirski <luto@amacapital.net>
>>> CC: Frederic Weisbecker <fweisbec@gmail.com>
>>> CC: Will Drewry <wad@chromium.org>
>>> CC: Kees Cook <keescook@chromium.org>
>>> CC: x86@kernel.org
>>> CC: linux-kernel@vger.kernel.org
>>> ---
>>>
>>> Resending. Still applies to current Ingo's tip tree
>>>
>>> arch/x86/entry/entry_64_compat.S | 45 +++++++++++++++++++---------------------
>>> 1 file changed, 21 insertions(+), 24 deletions(-)
>>>
>>> diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
>>> index 847f2f0..e1721da 100644
>>> --- a/arch/x86/entry/entry_64_compat.S
>>> +++ b/arch/x86/entry/entry_64_compat.S
>>> @@ -72,24 +72,23 @@ ENTRY(entry_SYSENTER_compat)
>>> pushfq /* pt_regs->flags (except IF = 0) */
>>> orl $X86_EFLAGS_IF, (%rsp) /* Fix saved flags */
>>> pushq $__USER32_CS /* pt_regs->cs */
>>> - xorq %r8,%r8
>>> - pushq %r8 /* pt_regs->ip = 0 (placeholder) */
>>> + pushq $0 /* pt_regs->ip = 0 (placeholder) */
>>> pushq %rax /* pt_regs->orig_ax */
>>> pushq %rdi /* pt_regs->di */
>>> pushq %rsi /* pt_regs->si */
>>> pushq %rdx /* pt_regs->dx */
>>> pushq %rcx /* pt_regs->cx */
>>> pushq $-ENOSYS /* pt_regs->ax */
>>> - pushq %r8 /* pt_regs->r8 = 0 */
>>> - pushq %r8 /* pt_regs->r9 = 0 */
>>> - pushq %r8 /* pt_regs->r10 = 0 */
>>> - pushq %r8 /* pt_regs->r11 = 0 */
>>> + pushq $0 /* pt_regs->r8 = 0 */
>>> + pushq $0 /* pt_regs->r9 = 0 */
>>> + pushq $0 /* pt_regs->r10 = 0 */
>>> + pushq $0 /* pt_regs->r11 = 0 */
>>> pushq %rbx /* pt_regs->rbx */
>>> pushq %rbp /* pt_regs->rbp (will be overwritten) */
>>> - pushq %r8 /* pt_regs->r12 = 0 */
>>> - pushq %r8 /* pt_regs->r13 = 0 */
>>> - pushq %r8 /* pt_regs->r14 = 0 */
>>> - pushq %r8 /* pt_regs->r15 = 0 */
>>> + pushq $0 /* pt_regs->r12 = 0 */
>>> + pushq $0 /* pt_regs->r13 = 0 */
>>> + pushq $0 /* pt_regs->r14 = 0 */
>>> + pushq $0 /* pt_regs->r15 = 0 */
>>
>> I think it actually should push r12-r15, since they are callee-saved
>> and we don't explicitly zero them out on SYSRET like r8-r10. If it
>> exited via IRET it would reload them as zero, so there is an
>> inconsistency there.
>
> Hmm. We could do this or we could zero them on the way out from the
> fast path. I have no real preference. Preserving the values is
> probably a bit nicer.
It's no difference to push the register vs. pushing a zero (it was
pushing r8 before). It would cost extra to explicitly zero them on
SYSRET.
--
Brian Gerst
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-05-03 18:09 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-05-02 14:56 [PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt_regs->REGs Denys Vlasenko
2016-05-02 18:19 ` Andy Lutomirski
2016-05-03 7:46 ` [tip:x86/asm] x86/asm/entry/32: Simplify " tip-bot for Denys Vlasenko
2016-05-03 17:45 ` [PATCH RESEND] x86/asm/entry/32: simplify " Brian Gerst
2016-05-03 17:55 ` Andy Lutomirski
2016-05-03 18:09 ` Brian Gerst
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).