On 03/21, Jiri Olsa wrote:
>
> On Thu, Mar 21, 2024 at 01:14:56PM +0100, Oleg Nesterov wrote:
> > Either way
> >
> > regs->ip = ip;
> >
> > above ensures that usermode returns to uretprobe_syscall_entry right after
> > the syscall insn.
>
> hm, I think above ensures that do_syscall_64 will skip the 'regs->cx != regs->ip'
> check.. and after the sysret returns to rcx register value and ignores regs->ip
^^^^^^^^^^^^^^^^
Yes, that is why do_syscall_64() returns F if regs->cx != regs->ip.
IOW. To oversimplify, the logic is
// %rcx == ret ip
entry_SYSCALL_64:
pt_regs->ip = %rcx;
pt_regs->cx = %rcx;
do-syscall;
%rcx = pt_regs->cx; // POP_REGS
if (%rcx == pt_regs->ip) {
// OK, we can use sysret which returns to rcx
sysret;
} else {
// debugger/whatever changed rcx or ip, can't use sysret.
// return to pt_regs->ip, see the "Return frame for iretq"
// comment in struct pt_regs.
iret;
}
So return-to-usermode always returns to regs->ip and restores all the registers
from pt_regs, just it can be faster if we can use sysret.
> but in any case we need to set it
Yes, yes, sure.
Oleg.
