linux-kernel - Re: [PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMzpN2jC3M8LbzN5NVzjHDrvBTJAW1RayiG=k-oR4ubu6_FgLg@mail.gmail.com>
Date:	Tue, 3 May 2016 13:45:35 -0400
From:	Brian Gerst <brgerst@...il.com>
To:	Denys Vlasenko <dvlasenk@...hat.com>
Cc:	Ingo Molnar <mingo@...nel.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	Borislav Petkov <bp@...en8.de>,
	"H. Peter Anvin" <hpa@...or.com>,
	Andy Lutomirski <luto@...capital.net>,
	Frederic Weisbecker <fweisbec@...il.com>,
	Will Drewry <wad@...omium.org>,
	Kees Cook <keescook@...omium.org>,
	"the arch/x86 maintainers" <x86@...nel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt_regs->REGs

On Mon, May 2, 2016 at 10:56 AM, Denys Vlasenko <dvlasenk@...hat.com> wrote:
> Use of a temporary R8 register here seems to be unnecessary.
>
> "push %r8" is a two-byte insn (it needs REX prefix to specify R8),
> "push $0" is two-byte too. It seems just using the latter would be
> no worse.
>
> Thus, code had an unnecessary "xorq %r8,%r8" insn.
> It probably costs nothing in execution time here since we are probably
> limited by store bandwidth at this point, but still.
>
> Run-tested under QEMU: 32-bit calls still work:
>
> / # ./test_syscall_vdso32
> [RUN]   Executing 6-argument 32-bit syscall via VDSO
> [OK]    Arguments are preserved across syscall
> [NOTE]  R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn
> [OK]    R8..R15 did not leak kernel data
> [RUN]   Executing 6-argument 32-bit syscall via INT 80
> [OK]    Arguments are preserved across syscall
> [OK]    R8..R15 did not leak kernel data
> [RUN]   Running tests under ptrace
> [RUN]   Executing 6-argument 32-bit syscall via VDSO
> [OK]    Arguments are preserved across syscall
> [NOTE]  R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn
> [OK]    R8..R15 did not leak kernel data
> [RUN]   Executing 6-argument 32-bit syscall via INT 80
> [OK]    Arguments are preserved across syscall
> [OK]    R8..R15 did not leak kernel data
>
> Signed-off-by: Denys Vlasenko <dvlasenk@...hat.com>
> CC: Ingo Molnar <mingo@...nel.org>
> CC: Steven Rostedt <rostedt@...dmis.org>
> CC: Borislav Petkov <bp@...en8.de>
> CC: "H. Peter Anvin" <hpa@...or.com>
> CC: Andy Lutomirski <luto@...capital.net>
> CC: Frederic Weisbecker <fweisbec@...il.com>
> CC: Will Drewry <wad@...omium.org>
> CC: Kees Cook <keescook@...omium.org>
> CC: x86@...nel.org
> CC: linux-kernel@...r.kernel.org
> ---
>
> Resending. Still applies to current Ingo's tip tree
>
>  arch/x86/entry/entry_64_compat.S | 45 +++++++++++++++++++---------------------
>  1 file changed, 21 insertions(+), 24 deletions(-)
>
> diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S
> index 847f2f0..e1721da 100644
> --- a/arch/x86/entry/entry_64_compat.S
> +++ b/arch/x86/entry/entry_64_compat.S
> @@ -72,24 +72,23 @@ ENTRY(entry_SYSENTER_compat)
>         pushfq                          /* pt_regs->flags (except IF = 0) */
>         orl     $X86_EFLAGS_IF, (%rsp)  /* Fix saved flags */
>         pushq   $__USER32_CS            /* pt_regs->cs */
> -       xorq    %r8,%r8
> -       pushq   %r8                     /* pt_regs->ip = 0 (placeholder) */
> +       pushq   $0                      /* pt_regs->ip = 0 (placeholder) */
>         pushq   %rax                    /* pt_regs->orig_ax */
>         pushq   %rdi                    /* pt_regs->di */
>         pushq   %rsi                    /* pt_regs->si */
>         pushq   %rdx                    /* pt_regs->dx */
>         pushq   %rcx                    /* pt_regs->cx */
>         pushq   $-ENOSYS                /* pt_regs->ax */
> -       pushq   %r8                     /* pt_regs->r8  = 0 */
> -       pushq   %r8                     /* pt_regs->r9  = 0 */
> -       pushq   %r8                     /* pt_regs->r10 = 0 */
> -       pushq   %r8                     /* pt_regs->r11 = 0 */
> +       pushq   $0                      /* pt_regs->r8  = 0 */
> +       pushq   $0                      /* pt_regs->r9  = 0 */
> +       pushq   $0                      /* pt_regs->r10 = 0 */
> +       pushq   $0                      /* pt_regs->r11 = 0 */
>         pushq   %rbx                    /* pt_regs->rbx */
>         pushq   %rbp                    /* pt_regs->rbp (will be overwritten) */
> -       pushq   %r8                     /* pt_regs->r12 = 0 */
> -       pushq   %r8                     /* pt_regs->r13 = 0 */
> -       pushq   %r8                     /* pt_regs->r14 = 0 */
> -       pushq   %r8                     /* pt_regs->r15 = 0 */
> +       pushq   $0                      /* pt_regs->r12 = 0 */
> +       pushq   $0                      /* pt_regs->r13 = 0 */
> +       pushq   $0                      /* pt_regs->r14 = 0 */
> +       pushq   $0                      /* pt_regs->r15 = 0 */

I think it actually should push r12-r15, since they are callee-saved
and we don't explicitly zero them out on SYSRET like r8-r10.  If it
exited via IRET it would reload them as zero, so there is an
inconsistency there.

--
Brian Gerst