Re: [PATCH v5 03/16] x86/alternatives: Disable LASS when patching kernel alternatives

From: Peter Zijlstra
Date: Tue Oct 29 2024 - 14:49:26 EST


On Tue, Oct 29, 2024 at 12:36:11PM +0100, Peter Zijlstra wrote:

> Anyway, looking at this, I see we grew rep_{movs,stos}_alternative, as
> used in copy_user_generic() and __clear_user(). Which are all somewhat
> similar.

That is, we could consider something like the completely untested and
probably broken, will light your granny on fire and maul pets like
below..

---
diff --git a/arch/x86/include/asm/string.h b/arch/x86/include/asm/string.h
index 9cb5aae7fba9..e25a988360a1 100644
--- a/arch/x86/include/asm/string.h
+++ b/arch/x86/include/asm/string.h
@@ -2,31 +2,50 @@
#ifndef _ASM_X86_STRING_H
#define _ASM_X86_STRING_H

+#include <asm/asm.h>
+#include <asm/alternative.h>
+
#ifdef CONFIG_X86_32
# include <asm/string_32.h>
#else
# include <asm/string_64.h>
#endif

+#ifdef CONFIG_X86_64
+#define ALT_64(orig, alt, feat) ALTERNATIVE(orig, alt, feat)
+#else
+#define ALT_64(orig, alt, feat) orig
+#endif
+
static __always_inline void *__inline_memcpy(void *to, const void *from, size_t len)
{
void *ret = to;

- asm volatile("rep movsb"
- : "+D" (to), "+S" (from), "+c" (len)
- : : "memory");
- return ret;
+ asm volatile("1:\n\t"
+ ALT_64("rep movsb",
+ "call rep_movs_alternative", ALT_NOT(X86_FEATURE_FSRM))
+ "2:\n\t"
+ _ASM_EXTABLE_UA(1b, 2b)
+ : "+D" (to), "+S" (from), "+c" (len), ASM_CALL_CONSTRAINT
+ : : "memory", _ASM_AX);
+
+ return ret + len;
}

static __always_inline void *__inline_memset(void *s, int v, size_t n)
{
void *ret = s;

- asm volatile("rep stosb"
- : "+D" (s), "+c" (n)
+ asm volatile("1:\n\t"
+ ALT_64("rep stosb",
+ "call rep_stos_alternative", ALT_NOT(X86_FEATURE_FSRM))
+ "2:\n\t"
+ _ASM_EXTABLE_UA(1b, 2b)
+ : "+D" (s), "+c" (n), ASM_CALL_CONSTRAINT
: "a" ((uint8_t)v)
- : "memory");
- return ret;
+ : "memory", _ASM_SI);
+
+ return ret + len;
}

#endif /* _ASM_X86_STRING_H */
diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
index b0a887209400..9f2d2c2ca731 100644
--- a/arch/x86/include/asm/uaccess_64.h
+++ b/arch/x86/include/asm/uaccess_64.h
@@ -13,6 +13,7 @@
#include <asm/page.h>
#include <asm/percpu.h>
#include <asm/runtime-const.h>
+#include <asm/string.h>

/*
* Virtual variable: there's no actual backing store for this,
@@ -118,21 +119,12 @@ rep_movs_alternative(void *to, const void *from, unsigned len);
static __always_inline __must_check unsigned long
copy_user_generic(void *to, const void *from, unsigned long len)
{
+ void *ret;
+
stac();
- /*
- * If CPU has FSRM feature, use 'rep movs'.
- * Otherwise, use rep_movs_alternative.
- */
- asm volatile(
- "1:\n\t"
- ALTERNATIVE("rep movsb",
- "call rep_movs_alternative", ALT_NOT(X86_FEATURE_FSRM))
- "2:\n"
- _ASM_EXTABLE_UA(1b, 2b)
- :"+c" (len), "+D" (to), "+S" (from), ASM_CALL_CONSTRAINT
- : : "memory", "rax");
+ ret = __inline_memcpy(to, from, len);
clac();
- return len;
+ return ret - to;
}

static __always_inline __must_check unsigned long
@@ -178,25 +170,15 @@ rep_stos_alternative(void __user *addr, unsigned long len);

static __always_inline __must_check unsigned long __clear_user(void __user *addr, unsigned long size)
{
- might_fault();
- stac();
+ void *ret;

- /*
- * No memory constraint because it doesn't change any memory gcc
- * knows about.
- */
- asm volatile(
- "1:\n\t"
- ALTERNATIVE("rep stosb",
- "call rep_stos_alternative", ALT_NOT(X86_FEATURE_FSRS))
- "2:\n"
- _ASM_EXTABLE_UA(1b, 2b)
- : "+c" (size), "+D" (addr), ASM_CALL_CONSTRAINT
- : "a" (0));
+ might_fault();

+ stac();
+ ret = __inline_memset(addr, 0, size);
clac();

- return size;
+ return ret - addr;
}

static __always_inline unsigned long clear_user(void __user *to, unsigned long n)
diff --git a/arch/x86/lib/clear_page_64.S b/arch/x86/lib/clear_page_64.S
index 2760a15fbc00..17d4bf6f50e5 100644
--- a/arch/x86/lib/clear_page_64.S
+++ b/arch/x86/lib/clear_page_64.S
@@ -53,16 +53,22 @@ SYM_FUNC_END(clear_page_erms)
EXPORT_SYMBOL_GPL(clear_page_erms)

/*
- * Default clear user-space.
+ * Default memset
* Input:
* rdi destination
+ * rsi scratch
* rcx count
- * rax is zero
+ * al is value
*
* Output:
- * rcx: uncleared bytes or 0 if successful.
+ * rcx: unset bytes or 0 if successful.
*/
SYM_FUNC_START(rep_stos_alternative)
+
+ movzbl %al, %rsi
+ movabs $0x0101010101010101, %rax
+ mulq %rsi
+
cmpq $64,%rcx
jae .Lunrolled