| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 3 May 2016 14:09:30 -0400 From: Brian Gerst <brgerst@...il.com> To: Andy Lutomirski <luto@...capital.net> Cc: Denys Vlasenko <dvlasenk@...hat.com>, Ingo Molnar <mingo@...nel.org>, Steven Rostedt <rostedt@...dmis.org>, Borislav Petkov <bp@...en8.de>, "H. Peter Anvin" <hpa@...or.com>, Frederic Weisbecker <fweisbec@...il.com>, Will Drewry <wad@...omium.org>, Kees Cook <keescook@...omium.org>, "the arch/x86 maintainers" <x86@...nel.org>, Linux Kernel Mailing List <linux-kernel@...r.kernel.org> Subject: Re: [PATCH RESEND] x86/asm/entry/32: simplify pushes of zeroed pt_regs->REGs On Tue, May 3, 2016 at 1:55 PM, Andy Lutomirski <luto@...capital.net> wrote: > On Tue, May 3, 2016 at 10:45 AM, Brian Gerst <brgerst@...il.com> wrote: >> On Mon, May 2, 2016 at 10:56 AM, Denys Vlasenko <dvlasenk@...hat.com> wrote: >>> Use of a temporary R8 register here seems to be unnecessary. >>> >>> "push %r8" is a two-byte insn (it needs REX prefix to specify R8), >>> "push $0" is two-byte too. It seems just using the latter would be >>> no worse. >>> >>> Thus, code had an unnecessary "xorq %r8,%r8" insn. >>> It probably costs nothing in execution time here since we are probably >>> limited by store bandwidth at this point, but still. >>> >>> Run-tested under QEMU: 32-bit calls still work: >>> >>> / # ./test_syscall_vdso32 >>> [RUN] Executing 6-argument 32-bit syscall via VDSO >>> [OK] Arguments are preserved across syscall >>> [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn >>> [OK] R8..R15 did not leak kernel data >>> [RUN] Executing 6-argument 32-bit syscall via INT 80 >>> [OK] Arguments are preserved across syscall >>> [OK] R8..R15 did not leak kernel data >>> [RUN] Running tests under ptrace >>> [RUN] Executing 6-argument 32-bit syscall via VDSO >>> [OK] Arguments are preserved across syscall >>> [NOTE] R11 has changed:0000000000200ed7 - assuming clobbered by SYSRET insn >>> [OK] R8..R15 did not leak kernel data >>> [RUN] Executing 6-argument 32-bit syscall via INT 80 >>> [OK] Arguments are preserved across syscall >>> [OK] R8..R15 did not leak kernel data >>> >>> Signed-off-by: Denys Vlasenko <dvlasenk@...hat.com> >>> CC: Ingo Molnar <mingo@...nel.org> >>> CC: Steven Rostedt <rostedt@...dmis.org> >>> CC: Borislav Petkov <bp@...en8.de> >>> CC: "H. Peter Anvin" <hpa@...or.com> >>> CC: Andy Lutomirski <luto@...capital.net> >>> CC: Frederic Weisbecker <fweisbec@...il.com> >>> CC: Will Drewry <wad@...omium.org> >>> CC: Kees Cook <keescook@...omium.org> >>> CC: x86@...nel.org >>> CC: linux-kernel@...r.kernel.org >>> --- >>> >>> Resending. Still applies to current Ingo's tip tree >>> >>> arch/x86/entry/entry_64_compat.S | 45 +++++++++++++++++++--------------------- >>> 1 file changed, 21 insertions(+), 24 deletions(-) >>> >>> diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S >>> index 847f2f0..e1721da 100644 >>> --- a/arch/x86/entry/entry_64_compat.S >>> +++ b/arch/x86/entry/entry_64_compat.S >>> @@ -72,24 +72,23 @@ ENTRY(entry_SYSENTER_compat) >>> pushfq /* pt_regs->flags (except IF = 0) */ >>> orl $X86_EFLAGS_IF, (%rsp) /* Fix saved flags */ >>> pushq $__USER32_CS /* pt_regs->cs */ >>> - xorq %r8,%r8 >>> - pushq %r8 /* pt_regs->ip = 0 (placeholder) */ >>> + pushq $0 /* pt_regs->ip = 0 (placeholder) */ >>> pushq %rax /* pt_regs->orig_ax */ >>> pushq %rdi /* pt_regs->di */ >>> pushq %rsi /* pt_regs->si */ >>> pushq %rdx /* pt_regs->dx */ >>> pushq %rcx /* pt_regs->cx */ >>> pushq $-ENOSYS /* pt_regs->ax */ >>> - pushq %r8 /* pt_regs->r8 = 0 */ >>> - pushq %r8 /* pt_regs->r9 = 0 */ >>> - pushq %r8 /* pt_regs->r10 = 0 */ >>> - pushq %r8 /* pt_regs->r11 = 0 */ >>> + pushq $0 /* pt_regs->r8 = 0 */ >>> + pushq $0 /* pt_regs->r9 = 0 */ >>> + pushq $0 /* pt_regs->r10 = 0 */ >>> + pushq $0 /* pt_regs->r11 = 0 */ >>> pushq %rbx /* pt_regs->rbx */ >>> pushq %rbp /* pt_regs->rbp (will be overwritten) */ >>> - pushq %r8 /* pt_regs->r12 = 0 */ >>> - pushq %r8 /* pt_regs->r13 = 0 */ >>> - pushq %r8 /* pt_regs->r14 = 0 */ >>> - pushq %r8 /* pt_regs->r15 = 0 */ >>> + pushq $0 /* pt_regs->r12 = 0 */ >>> + pushq $0 /* pt_regs->r13 = 0 */ >>> + pushq $0 /* pt_regs->r14 = 0 */ >>> + pushq $0 /* pt_regs->r15 = 0 */ >> >> I think it actually should push r12-r15, since they are callee-saved >> and we don't explicitly zero them out on SYSRET like r8-r10. If it >> exited via IRET it would reload them as zero, so there is an >> inconsistency there. > > Hmm. We could do this or we could zero them on the way out from the > fast path. I have no real preference. Preserving the values is > probably a bit nicer. It's no difference to push the register vs. pushing a zero (it was pushing r8 before). It would cost extra to explicitly zero them on SYSRET. -- Brian Gerst
Powered by blists - more mailing lists