On Tue, May 3, 2016 at 10:45 AM, Brian Gerst <brge...@gmail.com> wrote: > On Mon, May 2, 2016 at 10:56 AM, Denys Vlasenko <dvlas...@redhat.com> wrote: >> Use of a temporary R8 register here seems to be unnecessary. >> >> "push %r8" is a two-byte insn (it needs REX prefix to specify R8), >> "push $0" is two-byte too. It seems just using the latter would be >> no worse. >> >> Thus, code had an unnecessary "xorq %r8,%r8" insn. >> It probably costs nothing in execution time here since we are probably >> limited by store bandwidth at this point, but still. >> >> Run-tested under QEMU: 32-bit calls still work: >> >> / # ./test_syscall_vdso32 >> [RUN] Executing 6-argument 32-bit syscall via VDSO >> [OK] Arguments are preserved across syscall >> [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn >> [OK] R8..R15 did not leak kernel data >> [RUN] Executing 6-argument 32-bit syscall via INT 80 >> [OK] Arguments are preserved across syscall >> [OK] R8..R15 did not leak kernel data >> [RUN] Running tests under ptrace >> [RUN] Executing 6-argument 32-bit syscall via VDSO >> [OK] Arguments are preserved across syscall >> [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn >> [OK] R8..R15 did not leak kernel data >> [RUN] Executing 6-argument 32-bit syscall via INT 80 >> [OK] Arguments are preserved across syscall >> [OK] R8..R15 did not leak kernel data >> >> Signed-off-by: Denys Vlasenko <dvlas...@redhat.com> >> CC: Ingo Molnar <mi...@kernel.org> >> CC: Steven Rostedt <rost...@goodmis.org> >> CC: Borislav Petkov <b...@alien8.de> >> CC: "H. Peter Anvin" <h...@zytor.com> >> CC: Andy Lutomirski <l...@amacapital.net> >> CC: Frederic Weisbecker <fweis...@gmail.com> >> CC: Will Drewry <w...@chromium.org> >> CC: Kees Cook <keesc...@chromium.org> >> CC: x...@kernel.org >> CC: linux-kernel@vger.kernel.org >> --- >> >> Resending. Still applies to current Ingo's tip tree >> >> arch/x86/entry/entry_64_compat.S | 45 >> +++++++++++++++++++--------------------- >> 1 file changed, 21 insertions(+), 24 deletions(-) >> >> diff --git a/arch/x86/entry/entry_64_compat.S >> b/arch/x86/entry/entry_64_compat.S >> index 847f2f0..e1721da 100644 >> --- a/arch/x86/entry/entry_64_compat.S >> +++ b/arch/x86/entry/entry_64_compat.S >> @@ -72,24 +72,23 @@ ENTRY(entry_SYSENTER_compat) >> pushfq /* pt_regs->flags (except IF = 0) */ >> orl $X86_EFLAGS_IF, (%rsp) /* Fix saved flags */ >> pushq $__USER32_CS /* pt_regs->cs */ >> - xorq %r8,%r8 >> - pushq %r8 /* pt_regs->ip = 0 (placeholder) */ >> + pushq $0 /* pt_regs->ip = 0 (placeholder) */ >> pushq %rax /* pt_regs->orig_ax */ >> pushq %rdi /* pt_regs->di */ >> pushq %rsi /* pt_regs->si */ >> pushq %rdx /* pt_regs->dx */ >> pushq %rcx /* pt_regs->cx */ >> pushq $-ENOSYS /* pt_regs->ax */ >> - pushq %r8 /* pt_regs->r8 = 0 */ >> - pushq %r8 /* pt_regs->r9 = 0 */ >> - pushq %r8 /* pt_regs->r10 = 0 */ >> - pushq %r8 /* pt_regs->r11 = 0 */ >> + pushq $0 /* pt_regs->r8 = 0 */ >> + pushq $0 /* pt_regs->r9 = 0 */ >> + pushq $0 /* pt_regs->r10 = 0 */ >> + pushq $0 /* pt_regs->r11 = 0 */ >> pushq %rbx /* pt_regs->rbx */ >> pushq %rbp /* pt_regs->rbp (will be >> overwritten) */ >> - pushq %r8 /* pt_regs->r12 = 0 */ >> - pushq %r8 /* pt_regs->r13 = 0 */ >> - pushq %r8 /* pt_regs->r14 = 0 */ >> - pushq %r8 /* pt_regs->r15 = 0 */ >> + pushq $0 /* pt_regs->r12 = 0 */ >> + pushq $0 /* pt_regs->r13 = 0 */ >> + pushq $0 /* pt_regs->r14 = 0 */ >> + pushq $0 /* pt_regs->r15 = 0 */ > > I think it actually should push r12-r15, since they are callee-saved > and we don't explicitly zero them out on SYSRET like r8-r10. If it > exited via IRET it would reload them as zero, so there is an > inconsistency there.
Hmm. We could do this or we could zero them on the way out from the fast path. I have no real preference. Preserving the values is probably a bit nicer. --Andy
