2020-09-14 15:14:21

by Oliver Swede

[permalink] [raw]
Subject: [PATCH v5 00/14] Optimise and update memcpy, user copy and string routines

Hi all,

In this version the backtracking fixups are replaced with a two-stage
approach that maintains the accuracy in v4 and still uses the fault address,
but provides a copy-routine-independent mechanism for determining the fault
address.

The same constraints on the fixup routine (the available information being
src,dst,count,faddr) are used here, but in a more straightforward way that
could allow the copy template to be re-used with the new optimized copy
routines, and for the fixups to also apply to future copy routines.

There is a secondary in-order copy invoked which is expected to fault, and
this is byte-wise to provide the second fixup with the exact fault address,
which helps to avoid the need to special-case fixups for unprivileged
load/store accesses.

This alternative came about shortly after posting v4 and builds on a
discussion between Robin and I regarding a new idea for a cleaner approach
to the fixup routines, and I found some time to prototype it a couple of
weeks ago (previously been busy with moving teams internally and also wanted
to wait for further feedback before re-submitting to avoid excessive
revisions). A solution akin to this was incidentally one of my initial
thoughts but took a different direction as had previously assumed there
would be problems faulting from within a fixup routine (please point out
any issues with this that I may be unaware of - so far it has only been
tested internally on a couple of machines under basic workloads).

In order to provide additional information to the fixup that could reduce
the overhead of the secondary copy for large copy sizes, we also discussed
a potential magnitude N to jump back by from the first fault rather than
initiate from the beginning, on the basis that this is a basic property to
identify in the algorithm and one that could apply to future copy routines
simply by increasing this value. It holds for long copies due to the
cortex-strings implementation effectively copying in an in-order manner in
chunks of 64B (but out-of-order within each chunk). However, I have included
this as a standalone patch as this is based on an assumption about the
algorithm.

I thought that you might consequently like to have a look at v5 in deciding
whether or not to use separate algorithms for in-kernel/uaccess copy routines
(re feedback from v4).

Comments welcome,

Many thanks,
Oli

Changes since v4:
* Replaces the fixup routines in v4, which would require an understanding of
and be subject to change with newer optimizations, with another approach that
provides the same level of accuracy;
* Introduces an intermediate fixup routine that initiates an in-order copy;
* Configures a value to jump back from the fault address by before starting
the copy;
* Adds the additional macros to the copy template to account for the second
fixup, and reduces the total number of new macros initially added;
* Removes the special-case for UAO in the fixup (please see patch 14 in v4)
as this is now handled by the copy template substituting in the unprivileged
variants for the in-order copy, so the same fixups should apply to those
systems without modification;
* Repurpose commit 11 to exclusively check for overlapping buffers in
copy_in_user() calls and return the full width for these cases as it may result
in unusual behaviour, due implementations invoking memmov routines for which the
fixup wouldn't be applicable;
* In the process of rebasing to v5.9-rc4, moves Sam's fixup-offset
implementation in eatable.h to occur after bpf-related checks
* Rephrases commit messages in patches 9-14 for clarity and to reflect the
new changes.

This revision was tested on two machines (UAO & non-UAO) internally using a
custom test module (planning on posting this shortly).

v4: https://lore.kernel.org/linux-arm-kernel/[email protected]/

Oliver Swede (5):
arm64: usercopy: Store the arguments on stack
arm64: usercopy: Check for overlapping buffers in fixup
arm64: usercopy: Add intermediate fixup routine
arm64: usercopy: Add conclusive fixup routine
arm64: usercopy: Reduce overhead in fixup

Robin Murphy (2):
arm64: kprobes: Drop open-coded exception fixup
arm64: Tidy up _asm_extable_faultaddr usage

Sam Tebbs (7):
arm64: Allow passing fault address to fixup handlers
arm64: Import latest version of Cortex Strings' memcmp
arm64: Import latest version of Cortex Strings' memmove
arm64: Import latest version of Cortex Strings' strcmp
arm64: Import latest version of Cortex Strings' strlen
arm64: Import latest version of Cortex Strings' strncmp
arm64: Import latest optimization of memcpy

arch/arm64/include/asm/alternative.h | 36 ---
arch/arm64/include/asm/assembler.h | 13 +
arch/arm64/include/asm/extable.h | 11 +-
arch/arm64/kernel/probes/kprobes.c | 7 -
arch/arm64/lib/copy_from_user.S | 117 +++++++--
arch/arm64/lib/copy_in_user.S | 122 +++++++--
arch/arm64/lib/copy_template.S | 375 +++++++++++++++------------
arch/arm64/lib/copy_template_user.S | 32 +++
arch/arm64/lib/copy_to_user.S | 118 +++++++--
arch/arm64/lib/copy_user_fixup.S | 94 +++++++
arch/arm64/lib/memcmp.S | 333 +++++++++---------------
arch/arm64/lib/memcpy.S | 47 ++--
arch/arm64/lib/memmove.S | 232 ++++++-----------
arch/arm64/lib/strcmp.S | 272 ++++++++-----------
arch/arm64/lib/strlen.S | 247 ++++++++++++------
arch/arm64/lib/strncmp.S | 363 ++++++++++++--------------
arch/arm64/mm/extable.c | 27 +-
arch/arm64/mm/fault.c | 2 +-
18 files changed, 1323 insertions(+), 1125 deletions(-)
create mode 100644 arch/arm64/lib/copy_template_user.S
create mode 100644 arch/arm64/lib/copy_user_fixup.S

--
2.17.1


2020-09-14 15:14:28

by Oliver Swede

[permalink] [raw]
Subject: [PATCH v5 05/14] arm64: Import latest version of Cortex Strings' strcmp

From: Sam Tebbs <[email protected]>

Import the latest version of Cortex Strings' strcmp function.

The upstream source is src/aarch64/strcmp.S as of commit 90b61261ceb4
in https://git.linaro.org/toolchain/cortex-strings.git.

Signed-off-by: Sam Tebbs <[email protected]>
[ rm: update attribution, expand commit message ]
Signed-off-by: Robin Murphy <[email protected]>
Signed-off-by: Oliver Swede <[email protected]>
---
arch/arm64/lib/strcmp.S | 272 +++++++++++++++++-----------------------
1 file changed, 113 insertions(+), 159 deletions(-)

diff --git a/arch/arm64/lib/strcmp.S b/arch/arm64/lib/strcmp.S
index 4e79566726c8..e00ff46c4ffc 100644
--- a/arch/arm64/lib/strcmp.S
+++ b/arch/arm64/lib/strcmp.S
@@ -1,13 +1,11 @@
/* SPDX-License-Identifier: GPL-2.0-only */
/*
- * Copyright (C) 2013 ARM Ltd.
- * Copyright (C) 2013 Linaro.
+ * Copyright (c) 2012,2018 Linaro Limited. All rights reserved.
*
- * This code is based on glibc cortex strings work originally authored by Linaro
- * be found @
+ * This code is based on glibc Cortex Strings work originally authored by
+ * Linaro, found at:
*
- * http://bazaar.launchpad.net/~linaro-toolchain-dev/cortex-strings/trunk/
- * files/head:/src/aarch64/
+ * https://git.linaro.org/toolchain/cortex-strings.git
*/

#include <linux/linkage.h>
@@ -25,60 +23,106 @@
* or be greater than s2.
*/

+#define L(label) .L ## label
+
#define REP8_01 0x0101010101010101
#define REP8_7f 0x7f7f7f7f7f7f7f7f
#define REP8_80 0x8080808080808080

/* Parameters and result. */
-src1 .req x0
-src2 .req x1
-result .req x0
+#define src1 x0
+#define src2 x1
+#define result x0

/* Internal variables. */
-data1 .req x2
-data1w .req w2
-data2 .req x3
-data2w .req w3
-has_nul .req x4
-diff .req x5
-syndrome .req x6
-tmp1 .req x7
-tmp2 .req x8
-tmp3 .req x9
-zeroones .req x10
-pos .req x11
-
+#define data1 x2
+#define data1w w2
+#define data2 x3
+#define data2w w3
+#define has_nul x4
+#define diff x5
+#define syndrome x6
+#define tmp1 x7
+#define tmp2 x8
+#define tmp3 x9
+#define zeroones x10
+#define pos x11
+
+ /* Start of performance-critical section -- one 64B cache line. */
SYM_FUNC_START_WEAK_PI(strcmp)
eor tmp1, src1, src2
mov zeroones, #REP8_01
tst tmp1, #7
- b.ne .Lmisaligned8
+ b.ne L(misaligned8)
ands tmp1, src1, #7
- b.ne .Lmutual_align
-
- /*
- * NUL detection works on the principle that (X - 1) & (~X) & 0x80
- * (=> (X - 1) & ~(X | 0x7f)) is non-zero iff a byte is zero, and
- * can be done in parallel across the entire word.
- */
-.Lloop_aligned:
+ b.ne L(mutual_align)
+ /* NUL detection works on the principle that (X - 1) & (~X) & 0x80
+ (=> (X - 1) & ~(X | 0x7f)) is non-zero iff a byte is zero, and
+ can be done in parallel across the entire word. */
+L(loop_aligned):
ldr data1, [src1], #8
ldr data2, [src2], #8
-.Lstart_realigned:
+L(start_realigned):
sub tmp1, data1, zeroones
orr tmp2, data1, #REP8_7f
eor diff, data1, data2 /* Non-zero if differences found. */
bic has_nul, tmp1, tmp2 /* Non-zero if NUL terminator. */
orr syndrome, diff, has_nul
- cbz syndrome, .Lloop_aligned
- b .Lcal_cmpresult
-
-.Lmutual_align:
- /*
- * Sources are mutually aligned, but are not currently at an
- * alignment boundary. Round down the addresses and then mask off
- * the bytes that preceed the start point.
- */
+ cbz syndrome, L(loop_aligned)
+ /* End of performance-critical section -- one 64B cache line. */
+
+L(end):
+CPU_LE(rev syndrome, syndrome)
+CPU_LE(rev data1, data1)
+ /* The MS-non-zero bit of the syndrome marks either the first bit
+ that is different, or the top bit of the first zero byte.
+ Shifting left now will bring the critical information into the
+ top bits. */
+CPU_LE(clz pos, syndrome)
+CPU_LE(rev data2, data2)
+CPU_LE(lsl data1, data1, pos)
+CPU_LE(lsl data2, data2, pos)
+ /* But we need to zero-extend (char is unsigned) the value and then
+ perform a signed 32-bit subtraction. */
+CPU_LE(lsr data1, data1, #56)
+CPU_LE(sub result, data1, data2, lsr #56)
+CPU_LE(ret)
+ /* For big-endian we cannot use the trick with the syndrome value
+ as carry-propagation can corrupt the upper bits if the trailing
+ bytes in the string contain 0x01. */
+ /* However, if there is no NUL byte in the dword, we can generate
+ the result directly. We can't just subtract the bytes as the
+ MSB might be significant. */
+CPU_BE(cbnz has_nul, 1f)
+CPU_BE(cmp data1, data2)
+CPU_BE(cset result, ne)
+CPU_BE(cneg result, result, lo)
+CPU_BE(ret)
+1:
+ /* Re-compute the NUL-byte detection, using a byte-reversed value. */
+CPU_BE(rev tmp3, data1)
+CPU_BE(sub tmp1, tmp3, zeroones)
+CPU_BE(orr tmp2, tmp3, #REP8_7f)
+CPU_BE(bic has_nul, tmp1, tmp2)
+CPU_BE(rev has_nul, has_nul)
+CPU_BE(orr syndrome, diff, has_nul)
+CPU_BE(clz pos, syndrome)
+ /* The MS-non-zero bit of the syndrome marks either the first bit
+ that is different, or the top bit of the first zero byte.
+ Shifting left now will bring the critical information into the
+ top bits. */
+CPU_BE(lsl data1, data1, pos)
+CPU_BE(lsl data2, data2, pos)
+ /* But we need to zero-extend (char is unsigned) the value and then
+ perform a signed 32-bit subtraction. */
+CPU_BE(lsr data1, data1, #56)
+CPU_BE(sub result, data1, data2, lsr #56)
+CPU_BE(ret)
+
+L(mutual_align):
+ /* Sources are mutually aligned, but are not currently at an
+ alignment boundary. Round down the addresses and then mask off
+ the bytes that preceed the start point. */
bic src1, src1, #7
bic src2, src2, #7
lsl tmp1, tmp1, #3 /* Bytes beyond alignment -> bits. */
@@ -87,137 +131,47 @@ SYM_FUNC_START_WEAK_PI(strcmp)
ldr data2, [src2], #8
mov tmp2, #~0
/* Big-endian. Early bytes are at MSB. */
-CPU_BE( lsl tmp2, tmp2, tmp1 ) /* Shift (tmp1 & 63). */
+CPU_BE(lsl tmp2, tmp2, tmp1) /* Shift (tmp1 & 63). */
/* Little-endian. Early bytes are at LSB. */
-CPU_LE( lsr tmp2, tmp2, tmp1 ) /* Shift (tmp1 & 63). */
-
+CPU_LE(lsr tmp2, tmp2, tmp1) /* Shift (tmp1 & 63). */
orr data1, data1, tmp2
orr data2, data2, tmp2
- b .Lstart_realigned
-
-.Lmisaligned8:
- /*
- * Get the align offset length to compare per byte first.
- * After this process, one string's address will be aligned.
- */
- and tmp1, src1, #7
- neg tmp1, tmp1
- add tmp1, tmp1, #8
- and tmp2, src2, #7
- neg tmp2, tmp2
- add tmp2, tmp2, #8
- subs tmp3, tmp1, tmp2
- csel pos, tmp1, tmp2, hi /*Choose the maximum. */
-.Ltinycmp:
+ b L(start_realigned)
+
+L(misaligned8):
+ /* Align SRC1 to 8 bytes and then compare 8 bytes at a time, always
+ checking to make sure that we don't access beyond page boundary in
+ SRC2. */
+ tst src1, #7
+ b.eq L(loop_misaligned)
+L(do_misaligned):
ldrb data1w, [src1], #1
ldrb data2w, [src2], #1
- subs pos, pos, #1
- ccmp data1w, #1, #0, ne /* NZCV = 0b0000. */
- ccmp data1w, data2w, #0, cs /* NZCV = 0b0000. */
- b.eq .Ltinycmp
- cbnz pos, 1f /*find the null or unequal...*/
cmp data1w, #1
- ccmp data1w, data2w, #0, cs
- b.eq .Lstart_align /*the last bytes are equal....*/
-1:
- sub result, data1, data2
- ret
-
-.Lstart_align:
- ands xzr, src1, #7
- b.eq .Lrecal_offset
- /*process more leading bytes to make str1 aligned...*/
- add src1, src1, tmp3
- add src2, src2, tmp3
- /*load 8 bytes from aligned str1 and non-aligned str2..*/
+ ccmp data1w, data2w, #0, cs /* NZCV = 0b0000. */
+ b.ne L(done)
+ tst src1, #7
+ b.ne L(do_misaligned)
+
+L(loop_misaligned):
+ /* Test if we are within the last dword of the end of a 4K page. If
+ yes then jump back to the misaligned loop to copy a byte at a time. */
+ and tmp1, src2, #0xff8
+ eor tmp1, tmp1, #0xff8
+ cbz tmp1, L(do_misaligned)
ldr data1, [src1], #8
ldr data2, [src2], #8

sub tmp1, data1, zeroones
orr tmp2, data1, #REP8_7f
- bic has_nul, tmp1, tmp2
- eor diff, data1, data2 /* Non-zero if differences found. */
- orr syndrome, diff, has_nul
- cbnz syndrome, .Lcal_cmpresult
- /*How far is the current str2 from the alignment boundary...*/
- and tmp3, tmp3, #7
-.Lrecal_offset:
- neg pos, tmp3
-.Lloopcmp_proc:
- /*
- * Divide the eight bytes into two parts. First,backwards the src2
- * to an alignment boundary,load eight bytes from the SRC2 alignment
- * boundary,then compare with the relative bytes from SRC1.
- * If all 8 bytes are equal,then start the second part's comparison.
- * Otherwise finish the comparison.
- * This special handle can garantee all the accesses are in the
- * thread/task space in avoid to overrange access.
- */
- ldr data1, [src1,pos]
- ldr data2, [src2,pos]
- sub tmp1, data1, zeroones
- orr tmp2, data1, #REP8_7f
- bic has_nul, tmp1, tmp2
- eor diff, data1, data2 /* Non-zero if differences found. */
- orr syndrome, diff, has_nul
- cbnz syndrome, .Lcal_cmpresult
-
- /*The second part process*/
- ldr data1, [src1], #8
- ldr data2, [src2], #8
- sub tmp1, data1, zeroones
- orr tmp2, data1, #REP8_7f
- bic has_nul, tmp1, tmp2
- eor diff, data1, data2 /* Non-zero if differences found. */
+ eor diff, data1, data2 /* Non-zero if differences found. */
+ bic has_nul, tmp1, tmp2 /* Non-zero if NUL terminator. */
orr syndrome, diff, has_nul
- cbz syndrome, .Lloopcmp_proc
+ cbz syndrome, L(loop_misaligned)
+ b L(end)

-.Lcal_cmpresult:
- /*
- * reversed the byte-order as big-endian,then CLZ can find the most
- * significant zero bits.
- */
-CPU_LE( rev syndrome, syndrome )
-CPU_LE( rev data1, data1 )
-CPU_LE( rev data2, data2 )
-
- /*
- * For big-endian we cannot use the trick with the syndrome value
- * as carry-propagation can corrupt the upper bits if the trailing
- * bytes in the string contain 0x01.
- * However, if there is no NUL byte in the dword, we can generate
- * the result directly. We cannot just subtract the bytes as the
- * MSB might be significant.
- */
-CPU_BE( cbnz has_nul, 1f )
-CPU_BE( cmp data1, data2 )
-CPU_BE( cset result, ne )
-CPU_BE( cneg result, result, lo )
-CPU_BE( ret )
-CPU_BE( 1: )
- /*Re-compute the NUL-byte detection, using a byte-reversed value. */
-CPU_BE( rev tmp3, data1 )
-CPU_BE( sub tmp1, tmp3, zeroones )
-CPU_BE( orr tmp2, tmp3, #REP8_7f )
-CPU_BE( bic has_nul, tmp1, tmp2 )
-CPU_BE( rev has_nul, has_nul )
-CPU_BE( orr syndrome, diff, has_nul )
-
- clz pos, syndrome
- /*
- * The MS-non-zero bit of the syndrome marks either the first bit
- * that is different, or the top bit of the first zero byte.
- * Shifting left now will bring the critical information into the
- * top bits.
- */
- lsl data1, data1, pos
- lsl data2, data2, pos
- /*
- * But we need to zero-extend (char is unsigned) the value and then
- * perform a signed 32-bit subtraction.
- */
- lsr data1, data1, #56
- sub result, data1, data2, lsr #56
+L(done):
+ sub result, data1, data2
ret
SYM_FUNC_END_PI(strcmp)
EXPORT_SYMBOL_NOKASAN(strcmp)
--
2.17.1

2020-09-14 15:15:04

by Oliver Swede

[permalink] [raw]
Subject: [PATCH v5 11/14] arm64: usercopy: Check for overlapping buffers in fixup

Check for overlapping source and destination buffers in the usercopy
fixup before proceeding, and if this is the case then return from
the fixup with the full copy size in x0.

Imported optimized copy routines may contain the implementation of
both memcpy() and memmov(), where the latter code path is very
different and may result in behaviour that is incompatible with
memcopy in the context of constructing a non-exhaustive fixup
recovery routine. For instance, the current memmov() implementation
copies in reverse.

As this is likely to be an edge case across multiple copy routines
(checked for explicitly from within the routines themselves), and
independent of any specific implementation, it should be suitable
to return the full copy width back to the kernel code path calling
the usercopy function.

Signed-off-by: Oliver Swede <[email protected]>
---
arch/arm64/lib/copy_from_user.S | 24 ++++++++--------
arch/arm64/lib/copy_in_user.S | 48 ++++++++++++++++----------------
arch/arm64/lib/copy_to_user.S | 24 ++++++++--------
arch/arm64/lib/copy_user_fixup.S | 36 +++++++++++++++++++-----
4 files changed, 77 insertions(+), 55 deletions(-)

diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S
index cd3042e98394..745fbbfc23bb 100644
--- a/arch/arm64/lib/copy_from_user.S
+++ b/arch/arm64/lib/copy_from_user.S
@@ -20,7 +20,7 @@
* x0 - bytes not copied
*/
.macro ldrb1 reg, ptr, offset=0
- USER_F(9998f, ldtrb \reg, [\ptr, \offset])
+ USER_F(9996f, ldtrb \reg, [\ptr, \offset])
.endm

.macro strb1 reg, ptr, offset=0
@@ -29,7 +29,7 @@

.macro ldrb1_reg reg, ptr, offset
add \ptr, \ptr, \offset
- USER_F(9998f, ldtrb \reg, [\ptr])
+ USER_F(9997f, ldtrb \reg, [\ptr])
sub \ptr, \ptr, \offset
.endm

@@ -38,7 +38,7 @@
.endm

.macro ldr1 reg, ptr, offset=0
- USER_F(9998f, ldtr \reg, [\ptr, \offset])
+ USER_F(9997f, ldtr \reg, [\ptr, \offset])
.endm

.macro str1 reg, ptr, offset=0
@@ -46,8 +46,8 @@
.endm

.macro ldp1 regA, regB, ptr, offset=0
- USER_F(9998f, ldtr \regA, [\ptr, \offset])
- USER_F(9998f, ldtr \regB, [\ptr, \offset + 8])
+ USER_F(9997f, ldtr \regA, [\ptr, \offset])
+ USER_F(9997f, ldtr \regB, [\ptr, \offset + 8])
.endm

.macro stp1 regA, regB, ptr, offset=0
@@ -55,8 +55,8 @@
.endm

.macro ldp1_pre regA, regB, ptr, offset
- USER_F(9998f, ldtr \regA, [\ptr, \offset])
- USER_F(9998f, ldtr \regB, [\ptr, \offset + 8])
+ USER_F(9997f, ldtr \regA, [\ptr, \offset])
+ USER_F(9997f, ldtr \regB, [\ptr, \offset + 8])
add \ptr, \ptr, \offset
.endm

@@ -65,7 +65,7 @@
.endm

.macro ldrb1_nuao reg, ptr, offset=0
- USER_F(9998f, ldrb \reg, [\ptr, \offset])
+ USER_F(9997f, ldrb \reg, [\ptr, \offset])
.endm

.macro strb1_nuao reg, ptr, offset=0
@@ -73,7 +73,7 @@
.endm

.macro ldrb1_nuao_reg reg, ptr, offset=0
- USER_F(9998f, ldrb \reg, [\ptr, \offset])
+ USER_F(9997f, ldrb \reg, [\ptr, \offset])
.endm

.macro strb1_nuao_reg reg, ptr, offset=0
@@ -81,7 +81,7 @@
.endm

.macro ldr1_nuao reg, ptr, offset=0
- USER_F(9998f, ldr \reg, [\ptr, \offset])
+ USER_F(9997f, ldr \reg, [\ptr, \offset])
.endm

.macro str1_nuao reg, ptr, offset=0
@@ -89,7 +89,7 @@
.endm

.macro ldp1_nuao regA, regB, ptr, offset=0
- USER_F(9998f, ldp \regA, \regB, [\ptr, \offset])
+ USER_F(9997f, ldp \regA, \regB, [\ptr, \offset])
.endm

.macro stp1_nuao regA, regB, ptr, offset=0
@@ -97,7 +97,7 @@
.endm

.macro ldp1_pre_nuao regA, regB, ptr, offset
- USER_F(9998f, ldp \regA, \regB, [\ptr, \offset]!)
+ USER_F(9997f, ldp \regA, \regB, [\ptr, \offset]!)
.endm

.macro stp1_pre_nuao regA, regB, ptr, offset
diff --git a/arch/arm64/lib/copy_in_user.S b/arch/arm64/lib/copy_in_user.S
index fe035e513b34..34389d16c338 100644
--- a/arch/arm64/lib/copy_in_user.S
+++ b/arch/arm64/lib/copy_in_user.S
@@ -22,93 +22,93 @@
* x0 - bytes not copied
*/
.macro ldrb1 reg, ptr, offset=0
- USER_F(9998f, ldtrb \reg, [\ptr, \offset])
+ USER_F(9997f, ldtrb \reg, [\ptr, \offset])
.endm

.macro strb1 reg, ptr, offset=0
- USER_F(9998f, sttrb \reg, [\ptr, \offset])
+ USER_F(9997f, sttrb \reg, [\ptr, \offset])
.endm

.macro ldrb1_reg reg, ptr, offset
add \ptr, \ptr, \offset
- USER_F(9998f, ldtrb \reg, [\ptr])
+ USER_F(9997f, ldtrb \reg, [\ptr])
sub \ptr, \ptr, \offset
.endm

.macro strb1_reg reg, ptr, offset
add \ptr, \ptr, \offset
- USER_F(9998f, sttrb \reg, [\ptr])
+ USER_F(9997f, sttrb \reg, [\ptr])
sub \ptr, \ptr, \offset
.endm

.macro ldr1 reg, ptr, offset=0
- USER_F(9998f, ldtr \reg, [\ptr, \offset])
+ USER_F(9997f, ldtr \reg, [\ptr, \offset])
.endm

.macro str1 reg, ptr, offset=0
- USER_F(9998f, sttr \reg, [\ptr, \offset])
+ USER_F(9997f, sttr \reg, [\ptr, \offset])
.endm

.macro ldp1 regA, regB, ptr, offset=0
- USER_F(9998f, ldtr \regA, [\ptr, \offset])
- USER_F(9998f, ldtr \regB, [\ptr, \offset + 8])
+ USER_F(9997f, ldtr \regA, [\ptr, \offset])
+ USER_F(9997f, ldtr \regB, [\ptr, \offset + 8])
.endm

.macro stp1 regA, regB, ptr, offset=0
- USER_F(9998f, sttr \regA, [\ptr, \offset])
- USER_F(9998f, sttr \regB, [\ptr, \offset + 8])
+ USER_F(9997f, sttr \regA, [\ptr, \offset])
+ USER_F(9997f, sttr \regB, [\ptr, \offset + 8])
.endm

.macro ldp1_pre regA, regB, ptr, offset
- USER_F(9998f, ldtr \regA, [\ptr, \offset])
- USER_F(9998f, ldtr \regB, [\ptr, \offset + 8])
+ USER_F(9997f, ldtr \regA, [\ptr, \offset])
+ USER_F(9997f, ldtr \regB, [\ptr, \offset + 8])
add \ptr, \ptr, \offset
.endm

.macro stp1_pre regA, regB, ptr, offset
- USER_F(9998f, sttr \regA, [\ptr, \offset])
- USER_F(9998f, sttr \regB, [\ptr, \offset + 8])
+ USER_F(9997f, sttr \regA, [\ptr, \offset])
+ USER_F(9997f, sttr \regB, [\ptr, \offset + 8])
add \ptr, \ptr, \offset
.endm

.macro ldrb1_nuao reg, ptr, offset=0
- USER_F(9998f, ldrb \reg, [\ptr, \offset])
+ USER_F(9997f, ldrb \reg, [\ptr, \offset])
.endm

.macro strb1_nuao reg, ptr, offset=0
- USER_F(9998f, strb \reg, [\ptr, \offset])
+ USER_F(9997f, strb \reg, [\ptr, \offset])
.endm

.macro ldrb1_nuao_reg reg, ptr, offset=0
- USER_F(9998f, ldrb \reg, [\ptr, \offset])
+ USER_F(9997f, ldrb \reg, [\ptr, \offset])
.endm

.macro strb1_nuao_reg reg, ptr, offset=0
- USER_F(9998f, strb \reg, [\ptr, \offset])
+ USER_F(9997f, strb \reg, [\ptr, \offset])
.endm

.macro ldr1_nuao reg, ptr, offset=0
- USER_F(9998f, ldr \reg, [\ptr, \offset])
+ USER_F(9997f, ldr \reg, [\ptr, \offset])
.endm

.macro str1_nuao reg, ptr, offset=0
- USER_F(9998f, str \reg, [\ptr, \offset])
+ USER_F(9997f, str \reg, [\ptr, \offset])
.endm

.macro ldp1_nuao regA, regB, ptr, offset=0
- USER_F(9998f, ldp \regA, \regB, [\ptr, \offset])
+ USER_F(9997f, ldp \regA, \regB, [\ptr, \offset])
.endm

.macro stp1_nuao regA, regB, ptr, offset=0
- USER_F(9998f, stp \regA, \regB, [\ptr, \offset])
+ USER_F(9997f, stp \regA, \regB, [\ptr, \offset])
.endm

.macro ldp1_pre_nuao regA, regB, ptr, offset
- USER_F(9998f, ldp \regA, \regB, [\ptr, \offset]!)
+ USER_F(9997f, ldp \regA, \regB, [\ptr, \offset]!)
.endm

.macro stp1_pre_nuao regA, regB, ptr, offset
- USER_F(9998f, stp \regA, \regB, [\ptr, \offset]!)
+ USER_F(9997f, stp \regA, \regB, [\ptr, \offset]!)
.endm

.macro copy_exit
diff --git a/arch/arm64/lib/copy_to_user.S b/arch/arm64/lib/copy_to_user.S
index de0af211b3ba..cbb4cdfc7ad3 100644
--- a/arch/arm64/lib/copy_to_user.S
+++ b/arch/arm64/lib/copy_to_user.S
@@ -24,7 +24,7 @@
.endm

.macro strb1 reg, ptr, offset=0
- USER_F(9998f, sttrb \reg, [\ptr, \offset])
+ USER_F(9997f, sttrb \reg, [\ptr, \offset])
.endm

.macro ldrb1_reg reg, ptr, offset
@@ -33,7 +33,7 @@

.macro strb1_reg reg, ptr, offset
add \ptr, \ptr, \offset
- USER_F(9998f, sttrb \reg, [\ptr])
+ USER_F(9997f, sttrb \reg, [\ptr])
sub \ptr, \ptr, \offset
.endm

@@ -42,7 +42,7 @@
.endm

.macro str1 reg, ptr, offset=0
- USER_F(9998f, sttr \reg, [\ptr, \offset])
+ USER_F(9997f, sttr \reg, [\ptr, \offset])
.endm

.macro ldp1 regA, regB, ptr, offset=0
@@ -50,8 +50,8 @@
.endm

.macro stp1 regA, regB, ptr, offset=0
- USER_F(9998f, sttr \regA, [\ptr, \offset])
- USER_F(9998f, sttr \regB, [\ptr, \offset + 8])
+ USER_F(9997f, sttr \regA, [\ptr, \offset])
+ USER_F(9997f, sttr \regB, [\ptr, \offset + 8])
.endm

.macro ldp1_pre regA, regB, ptr, offset
@@ -59,8 +59,8 @@
.endm

.macro stp1_pre regA, regB, ptr, offset
- USER_F(9998f, sttr \regA, [\ptr, \offset])
- USER_F(9998f, sttr \regB, [\ptr, \offset + 8])
+ USER_F(9997f, sttr \regA, [\ptr, \offset])
+ USER_F(9997f, sttr \regB, [\ptr, \offset + 8])
add \ptr, \ptr, \offset
.endm

@@ -69,7 +69,7 @@
.endm

.macro strb1_nuao reg, ptr, offset=0
- USER_F(9998f, strb \reg, [\ptr, \offset])
+ USER_F(9997f, strb \reg, [\ptr, \offset])
.endm

.macro ldrb1_nuao_reg reg, ptr, offset=0
@@ -77,7 +77,7 @@
.endm

.macro strb1_nuao_reg reg, ptr, offset=0
- strb \reg, [\ptr, \offset]
+ USER_F(9997f, strb \reg, [\ptr, \offset])
.endm

.macro ldr1_nuao reg, ptr, offset=0
@@ -85,7 +85,7 @@
.endm

.macro str1_nuao reg, ptr, offset=0
- USER_F(9998f, str \reg, [\ptr, \offset])
+ USER_F(9997f, str \reg, [\ptr, \offset])
.endm

.macro ldp1_nuao regA, regB, ptr, offset=0
@@ -97,11 +97,11 @@
.endm

.macro stp1_nuao regA, regB, ptr, offset=0
- USER_F(9998f, stp \regA, \regB, [\ptr, \offset])
+ USER_F(9997f, stp \regA, \regB, [\ptr, \offset])
.endm

.macro stp1_pre_nuao regA, regB, ptr, offset
- USER_F(9998f, stp \regA, \regB, [\ptr, \offset]!)
+ USER_F(9997f, stp \regA, \regB, [\ptr, \offset]!)
.endm

.macro copy_exit
diff --git a/arch/arm64/lib/copy_user_fixup.S b/arch/arm64/lib/copy_user_fixup.S
index a528b7d7d1bd..01e5c34461d7 100644
--- a/arch/arm64/lib/copy_user_fixup.S
+++ b/arch/arm64/lib/copy_user_fixup.S
@@ -3,13 +3,35 @@
addr .req x15
.section .fixup,"ax"
.align 2
+9997:
+ ldp x0, x1, [sp], #16 // x0 (dst), x1 (src)
+ ldr x2, [sp], #16 // x2 (count)
+ add x3, x0, x2 // x3: dstend
+ add x4, x1, x2 // x4: srcend
+ /*
+ * Overlapping buffers:
+ * (src <= dst && dst < srcend)
+ * || (dst <= src && src < dstend)
+ */
+ cmp x1, x0 // src (x1), dst (x0)
+ ccmp x0, x4, #0, le // dst (x0), srcend (x4)
+ b.lt L(none_copied)
+ cmp x0, x1 // dst (x0), src (x1)
+ ccmp x1, x3, #0, le // src (x1), dstend (x3)
+ b.lt L(none_copied)
+ /*
+ * Direct to subroutine based on location of fault
+ */
+ cmp addr, x1 // addr (x15), src (x1)
+ ccmp addr, x4, #0x0, ge // addr, x4, #0, ge
+ b.lt L(src_fault)
+ b L(dst_fault)
+
+L(src_fault):
+L(dst_fault):
+
9998:
- // If it falls in the src range then it was a load that failed,
- // otherwise it was a store
- cmp addr, src
- ccmp addr, srcend, #0x0, ge
- csel x0, srcend, dstend, lt
- sub x0, x0, addr
- add sp, sp, 32
+L(none_copied):
+ mov x0, x2 // count (x2)
ret

--
2.17.1

2020-09-14 15:15:21

by Oliver Swede

[permalink] [raw]
Subject: [PATCH v5 07/14] arm64: Import latest version of Cortex Strings' strncmp

From: Sam Tebbs <[email protected]>

Import latest version of Cortex Strings' strncmp function.

The upstream source is src/aarch64/strncmp.S as of commit 071fe283b28d
in https://git.linaro.org/toolchain/cortex-strings.git.

Signed-off-by: Sam Tebbs <[email protected]>
[ rm: update attribution, expand commit message ]
Signed-off-by: Robin Murphy <[email protected]>
Signed-off-by: Oliver Swede <[email protected]>
---
arch/arm64/lib/strncmp.S | 363 ++++++++++++++++++---------------------
1 file changed, 163 insertions(+), 200 deletions(-)

diff --git a/arch/arm64/lib/strncmp.S b/arch/arm64/lib/strncmp.S
index 2a7ee949ed47..b954e0fd93be 100644
--- a/arch/arm64/lib/strncmp.S
+++ b/arch/arm64/lib/strncmp.S
@@ -1,13 +1,11 @@
/* SPDX-License-Identifier: GPL-2.0-only */
/*
- * Copyright (C) 2013 ARM Ltd.
- * Copyright (C) 2013 Linaro.
+ * Copyright (c) 2013,2018 Linaro Limited. All rights reserved.
*
- * This code is based on glibc cortex strings work originally authored by Linaro
- * be found @
+ * This code is based on glibc Cortex Strings work originally authored by
+ * Linaro, found at:
*
- * http://bazaar.launchpad.net/~linaro-toolchain-dev/cortex-strings/trunk/
- * files/head:/src/aarch64/
+ * https://git.linaro.org/toolchain/cortex-strings.git
*/

#include <linux/linkage.h>
@@ -30,49 +28,49 @@
#define REP8_80 0x8080808080808080

/* Parameters and result. */
-src1 .req x0
-src2 .req x1
-limit .req x2
-result .req x0
+#define src1 x0
+#define src2 x1
+#define limit x2
+#define result x0

/* Internal variables. */
-data1 .req x3
-data1w .req w3
-data2 .req x4
-data2w .req w4
-has_nul .req x5
-diff .req x6
-syndrome .req x7
-tmp1 .req x8
-tmp2 .req x9
-tmp3 .req x10
-zeroones .req x11
-pos .req x12
-limit_wd .req x13
-mask .req x14
-endloop .req x15
+#define data1 x3
+#define data1w w3
+#define data2 x4
+#define data2w w4
+#define has_nul x5
+#define diff x6
+#define syndrome x7
+#define tmp1 x8
+#define tmp2 x9
+#define tmp3 x10
+#define zeroones x11
+#define pos x12
+#define limit_wd x13
+#define mask x14
+#define endloop x15
+#define count mask

+ .p2align 6
+ .rep 7
+ nop /* Pad so that the loop below fits a cache line. */
+ .endr
SYM_FUNC_START_WEAK_PI(strncmp)
cbz limit, .Lret0
eor tmp1, src1, src2
mov zeroones, #REP8_01
tst tmp1, #7
+ and count, src1, #7
b.ne .Lmisaligned8
- ands tmp1, src1, #7
- b.ne .Lmutual_align
+ cbnz count, .Lmutual_align
/* Calculate the number of full and partial words -1. */
- /*
- * when limit is mulitply of 8, if not sub 1,
- * the judgement of last dword will wrong.
- */
- sub limit_wd, limit, #1 /* limit != 0, so no underflow. */
- lsr limit_wd, limit_wd, #3 /* Convert to Dwords. */
+ sub limit_wd, limit, #1 /* limit != 0, so no underflow. */
+ lsr limit_wd, limit_wd, #3 /* Convert to Dwords. */

- /*
- * NUL detection works on the principle that (X - 1) & (~X) & 0x80
- * (=> (X - 1) & ~(X | 0x7f)) is non-zero iff a byte is zero, and
- * can be done in parallel across the entire word.
- */
+ /* NUL detection works on the principle that (X - 1) & (~X) & 0x80
+ (=> (X - 1) & ~(X | 0x7f)) is non-zero iff a byte is zero, and
+ can be done in parallel across the entire word. */
+ /* Start of performance-critical section -- one 64B cache line. */
.Lloop_aligned:
ldr data1, [src1], #8
ldr data2, [src2], #8
@@ -80,23 +78,24 @@ SYM_FUNC_START_WEAK_PI(strncmp)
subs limit_wd, limit_wd, #1
sub tmp1, data1, zeroones
orr tmp2, data1, #REP8_7f
- eor diff, data1, data2 /* Non-zero if differences found. */
- csinv endloop, diff, xzr, pl /* Last Dword or differences.*/
- bics has_nul, tmp1, tmp2 /* Non-zero if NUL terminator. */
+ eor diff, data1, data2 /* Non-zero if differences found. */
+ csinv endloop, diff, xzr, pl /* Last Dword or differences. */
+ bics has_nul, tmp1, tmp2 /* Non-zero if NUL terminator. */
ccmp endloop, #0, #0, eq
b.eq .Lloop_aligned
+ /* End of performance-critical section -- one 64B cache line. */

- /*Not reached the limit, must have found the end or a diff. */
+ /* Not reached the limit, must have found the end or a diff. */
tbz limit_wd, #63, .Lnot_limit

/* Limit % 8 == 0 => all bytes significant. */
ands limit, limit, #7
b.eq .Lnot_limit

- lsl limit, limit, #3 /* Bits -> bytes. */
+ lsl limit, limit, #3 /* Bits -> bytes. */
mov mask, #~0
-CPU_BE( lsr mask, mask, limit )
-CPU_LE( lsl mask, mask, limit )
+CPU_BE(lsr mask, mask, limit)
+CPU_LE(lsl mask, mask, limit)
bic data1, data1, mask
bic data2, data2, mask

@@ -105,192 +104,156 @@ CPU_LE( lsl mask, mask, limit )

.Lnot_limit:
orr syndrome, diff, has_nul
- b .Lcal_cmpresult
+
+ CPU_LE(rev syndrome, syndrome)
+ CPU_LE(rev data1, data1)
+ /* The MS-non-zero bit of the syndrome marks either the first bit
+ that is different, or the top bit of the first zero byte.
+ Shifting left now will bring the critical information into the
+ top bits. */
+ CPU_LE(clz pos, syndrome)
+ CPU_LE(rev data2, data2)
+ CPU_LE(lsl data1, data1, pos)
+ CPU_LE(lsl data2, data2, pos)
+ /* But we need to zero-extend (char is unsigned) the value and then
+ perform a signed 32-bit subtraction. */
+ CPU_LE(lsr data1, data1, #56)
+ CPU_LE(sub result, data1, data2, lsr #56)
+ CPU_LE(ret)
+ /* For big-endian we cannot use the trick with the syndrome value
+ as carry-propagation can corrupt the upper bits if the trailing
+ bytes in the string contain 0x01. */
+ /* However, if there is no NUL byte in the dword, we can generate
+ the result directly. We can't just subtract the bytes as the
+ MSB might be significant. */
+ CPU_BE(cbnz has_nul, 1f)
+ CPU_BE(cmp data1, data2)
+ CPU_BE(cset result, ne)
+ CPU_BE(cneg result, result, lo)
+ CPU_BE(ret)
+1:
+ /* Re-compute the NUL-byte detection, using a byte-reversed value. */
+ CPU_BE(rev tmp3, data1)
+ CPU_BE(sub tmp1, tmp3, zeroones)
+ CPU_BE(orr tmp2, tmp3, #REP8_7f)
+ CPU_BE(bic has_nul, tmp1, tmp2)
+ CPU_BE(rev has_nul, has_nul)
+ CPU_BE(orr syndrome, diff, has_nul)
+ CPU_BE(clz pos, syndrome)
+ /* The MS-non-zero bit of the syndrome marks either the first bit
+ that is different, or the top bit of the first zero byte.
+ Shifting left now will bring the critical information into the
+ top bits. */
+ CPU_BE(lsl data1, data1, pos)
+ CPU_BE(lsl data2, data2, pos)
+ /* But we need to zero-extend (char is unsigned) the value and then
+ perform a signed 32-bit subtraction. */
+ CPU_BE(lsr data1, data1, #56)
+ CPU_BE(sub result, data1, data2, lsr #56)
+ CPU_BE(ret)

.Lmutual_align:
- /*
- * Sources are mutually aligned, but are not currently at an
- * alignment boundary. Round down the addresses and then mask off
- * the bytes that precede the start point.
- * We also need to adjust the limit calculations, but without
- * overflowing if the limit is near ULONG_MAX.
- */
+ /* Sources are mutually aligned, but are not currently at an
+ alignment boundary. Round down the addresses and then mask off
+ the bytes that precede the start point.
+ We also need to adjust the limit calculations, but without
+ overflowing if the limit is near ULONG_MAX. */
bic src1, src1, #7
bic src2, src2, #7
ldr data1, [src1], #8
- neg tmp3, tmp1, lsl #3 /* 64 - bits(bytes beyond align). */
+ neg tmp3, count, lsl #3 /* 64 - bits(bytes beyond align). */
ldr data2, [src2], #8
mov tmp2, #~0
- sub limit_wd, limit, #1 /* limit != 0, so no underflow. */
+ sub limit_wd, limit, #1 /* limit != 0, so no underflow. */
/* Big-endian. Early bytes are at MSB. */
-CPU_BE( lsl tmp2, tmp2, tmp3 ) /* Shift (tmp1 & 63). */
+ CPU_BE(lsl tmp2, tmp2, tmp3) /* Shift (count & 63). */
/* Little-endian. Early bytes are at LSB. */
-CPU_LE( lsr tmp2, tmp2, tmp3 ) /* Shift (tmp1 & 63). */
-
+ CPU_LE(lsr tmp2, tmp2, tmp3) /* Shift (count & 63). */
and tmp3, limit_wd, #7
lsr limit_wd, limit_wd, #3
- /* Adjust the limit. Only low 3 bits used, so overflow irrelevant.*/
- add limit, limit, tmp1
- add tmp3, tmp3, tmp1
+ /* Adjust the limit. Only low 3 bits used, so overflow irrelevant. */
+ add limit, limit, count
+ add tmp3, tmp3, count
orr data1, data1, tmp2
orr data2, data2, tmp2
add limit_wd, limit_wd, tmp3, lsr #3
b .Lstart_realigned

-/*when src1 offset is not equal to src2 offset...*/
+ .p2align 6
+ /* Don't bother with dwords for up to 16 bytes. */
.Lmisaligned8:
- cmp limit, #8
- b.lo .Ltiny8proc /*limit < 8... */
- /*
- * Get the align offset length to compare per byte first.
- * After this process, one string's address will be aligned.*/
- and tmp1, src1, #7
- neg tmp1, tmp1
- add tmp1, tmp1, #8
- and tmp2, src2, #7
- neg tmp2, tmp2
- add tmp2, tmp2, #8
- subs tmp3, tmp1, tmp2
- csel pos, tmp1, tmp2, hi /*Choose the maximum. */
- /*
- * Here, limit is not less than 8, so directly run .Ltinycmp
- * without checking the limit.*/
- sub limit, limit, pos
-.Ltinycmp:
+ cmp limit, #16
+ b.hs .Ltry_misaligned_words
+
+.Lbyte_loop:
+ /* Perhaps we can do better than this. */
ldrb data1w, [src1], #1
ldrb data2w, [src2], #1
- subs pos, pos, #1
- ccmp data1w, #1, #0, ne /* NZCV = 0b0000. */
- ccmp data1w, data2w, #0, cs /* NZCV = 0b0000. */
- b.eq .Ltinycmp
- cbnz pos, 1f /*find the null or unequal...*/
- cmp data1w, #1
- ccmp data1w, data2w, #0, cs
- b.eq .Lstart_align /*the last bytes are equal....*/
-1:
+ subs limit, limit, #1
+ ccmp data1w, #1, #0, hi /* NZCV = 0b0000. */
+ ccmp data1w, data2w, #0, cs /* NZCV = 0b0000. */
+ b.eq .Lbyte_loop
+.Ldone:
sub result, data1, data2
ret
-
-.Lstart_align:
+ /* Align the SRC1 to a dword by doing a bytewise compare and then do
+ the dword loop. */
+.Ltry_misaligned_words:
lsr limit_wd, limit, #3
- cbz limit_wd, .Lremain8
- /*process more leading bytes to make str1 aligned...*/
- ands xzr, src1, #7
- b.eq .Lrecal_offset
- add src1, src1, tmp3 /*tmp3 is positive in this branch.*/
- add src2, src2, tmp3
- ldr data1, [src1], #8
- ldr data2, [src2], #8
+ cbz count, .Ldo_misaligned

- sub limit, limit, tmp3
+ neg count, count
+ and count, count, #7
+ sub limit, limit, count
lsr limit_wd, limit, #3
- subs limit_wd, limit_wd, #1

- sub tmp1, data1, zeroones
- orr tmp2, data1, #REP8_7f
- eor diff, data1, data2 /* Non-zero if differences found. */
- csinv endloop, diff, xzr, ne/*if limit_wd is 0,will finish the cmp*/
- bics has_nul, tmp1, tmp2
- ccmp endloop, #0, #0, eq /*has_null is ZERO: no null byte*/
- b.ne .Lunequal_proc
- /*How far is the current str2 from the alignment boundary...*/
- and tmp3, tmp3, #7
-.Lrecal_offset:
- neg pos, tmp3
-.Lloopcmp_proc:
- /*
- * Divide the eight bytes into two parts. First,backwards the src2
- * to an alignment boundary,load eight bytes from the SRC2 alignment
- * boundary,then compare with the relative bytes from SRC1.
- * If all 8 bytes are equal,then start the second part's comparison.
- * Otherwise finish the comparison.
- * This special handle can garantee all the accesses are in the
- * thread/task space in avoid to overrange access.
- */
- ldr data1, [src1,pos]
- ldr data2, [src2,pos]
- sub tmp1, data1, zeroones
- orr tmp2, data1, #REP8_7f
- bics has_nul, tmp1, tmp2 /* Non-zero if NUL terminator. */
- eor diff, data1, data2 /* Non-zero if differences found. */
- csinv endloop, diff, xzr, eq
- cbnz endloop, .Lunequal_proc
+.Lpage_end_loop:
+ ldrb data1w, [src1], #1
+ ldrb data2w, [src2], #1
+ cmp data1w, #1
+ ccmp data1w, data2w, #0, cs /* NZCV = 0b0000. */
+ b.ne .Ldone
+ subs count, count, #1
+ b.hi .Lpage_end_loop
+
+.Ldo_misaligned:
+ /* Prepare ourselves for the next page crossing. Unlike the aligned
+ loop, we fetch 1 less dword because we risk crossing bounds on
+ SRC2. */
+ mov count, #8
+ subs limit_wd, limit_wd, #1
+ b.lo .Ldone_loop
+.Lloop_misaligned:
+ and tmp2, src2, #0xff8
+ eor tmp2, tmp2, #0xff8
+ cbz tmp2, .Lpage_end_loop

- /*The second part process*/
ldr data1, [src1], #8
ldr data2, [src2], #8
- subs limit_wd, limit_wd, #1
sub tmp1, data1, zeroones
orr tmp2, data1, #REP8_7f
- eor diff, data1, data2 /* Non-zero if differences found. */
- csinv endloop, diff, xzr, ne/*if limit_wd is 0,will finish the cmp*/
- bics has_nul, tmp1, tmp2
- ccmp endloop, #0, #0, eq /*has_null is ZERO: no null byte*/
- b.eq .Lloopcmp_proc
-
-.Lunequal_proc:
- orr syndrome, diff, has_nul
- cbz syndrome, .Lremain8
-.Lcal_cmpresult:
- /*
- * reversed the byte-order as big-endian,then CLZ can find the most
- * significant zero bits.
- */
-CPU_LE( rev syndrome, syndrome )
-CPU_LE( rev data1, data1 )
-CPU_LE( rev data2, data2 )
- /*
- * For big-endian we cannot use the trick with the syndrome value
- * as carry-propagation can corrupt the upper bits if the trailing
- * bytes in the string contain 0x01.
- * However, if there is no NUL byte in the dword, we can generate
- * the result directly. We can't just subtract the bytes as the
- * MSB might be significant.
- */
-CPU_BE( cbnz has_nul, 1f )
-CPU_BE( cmp data1, data2 )
-CPU_BE( cset result, ne )
-CPU_BE( cneg result, result, lo )
-CPU_BE( ret )
-CPU_BE( 1: )
- /* Re-compute the NUL-byte detection, using a byte-reversed value.*/
-CPU_BE( rev tmp3, data1 )
-CPU_BE( sub tmp1, tmp3, zeroones )
-CPU_BE( orr tmp2, tmp3, #REP8_7f )
-CPU_BE( bic has_nul, tmp1, tmp2 )
-CPU_BE( rev has_nul, has_nul )
-CPU_BE( orr syndrome, diff, has_nul )
- /*
- * The MS-non-zero bit of the syndrome marks either the first bit
- * that is different, or the top bit of the first zero byte.
- * Shifting left now will bring the critical information into the
- * top bits.
- */
- clz pos, syndrome
- lsl data1, data1, pos
- lsl data2, data2, pos
- /*
- * But we need to zero-extend (char is unsigned) the value and then
- * perform a signed 32-bit subtraction.
- */
- lsr data1, data1, #56
- sub result, data1, data2, lsr #56
- ret
-
-.Lremain8:
- /* Limit % 8 == 0 => all bytes significant. */
- ands limit, limit, #7
- b.eq .Lret0
-.Ltiny8proc:
- ldrb data1w, [src1], #1
- ldrb data2w, [src2], #1
- subs limit, limit, #1
+ eor diff, data1, data2 /* Non-zero if differences found. */
+ bics has_nul, tmp1, tmp2 /* Non-zero if NUL terminator. */
+ ccmp diff, #0, #0, eq
+ b.ne .Lnot_limit
+ subs limit_wd, limit_wd, #1
+ b.pl .Lloop_misaligned

- ccmp data1w, #1, #0, ne /* NZCV = 0b0000. */
- ccmp data1w, data2w, #0, cs /* NZCV = 0b0000. */
- b.eq .Ltiny8proc
- sub result, data1, data2
- ret
+.Ldone_loop:
+ /* We found a difference or a NULL before the limit was reached. */
+ and limit, limit, #7
+ cbz limit, .Lnot_limit
+ /* Read the last word. */
+ sub src1, src1, 8
+ sub src2, src2, 8
+ ldr data1, [src1, limit]
+ ldr data2, [src2, limit]
+ sub tmp1, data1, zeroones
+ orr tmp2, data1, #REP8_7f
+ eor diff, data1, data2 /* Non-zero if differences found. */
+ bics has_nul, tmp1, tmp2 /* Non-zero if NUL terminator. */
+ ccmp diff, #0, #0, eq
+ b.ne .Lnot_limit

.Lret0:
mov result, #0
--
2.17.1

2020-09-14 15:15:23

by Oliver Swede

[permalink] [raw]
Subject: [PATCH v5 13/14] arm64: usercopy: Add conclusive fixup routine

This adds a second-stage routine to the usercopy functions that
contains the final calculation for the return value, which
represents the number of bytes not copied and is returned to the
faulting syscall. This is only reached in the code path where a
fault occurs during the second in-order copy; otherwise, the
intermediate fixup will fall back to returning zero if it reaches
the end of the buffer.

As the intermediate fixup has already placed either srcend or dstend
in x5 depending on the instruction that faulted, the sub operation is
the same and the final fixup can be re-used for both cases.

Signed-off-by: Oliver Swede <[email protected]>
---
arch/arm64/lib/copy_user_fixup.S | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/lib/copy_user_fixup.S b/arch/arm64/lib/copy_user_fixup.S
index 6a7b2406d948..4858edd55994 100644
--- a/arch/arm64/lib/copy_user_fixup.S
+++ b/arch/arm64/lib/copy_user_fixup.S
@@ -62,8 +62,17 @@ L(all_copied):
mov x0, #0 // reached the end of buffer
ret

-9998:
-// TODO: add accurate fixup
L(none_copied):
mov x0, x2 // count (x2)
ret
+
+/*
+ * Faults during a scan of the user buffer while running an
+ * in-order copy.
+ *
+ * Calculate the number of bytes not copied, using the fault
+ * address as a precise indicator.
+ */
+9998:
+ sub x0, x5, addr // x0: srcend-faddr or dstend-faddr
+ ret
--
2.17.1

2020-09-14 15:16:41

by Oliver Swede

[permalink] [raw]
Subject: [PATCH v5 09/14] arm64: Tidy up _asm_extable_faultaddr usage

From: Robin Murphy <[email protected]>

To match the way the USER() shorthand wraps _asm_extable entries,
introduce USER_F() to wrap _asm_extable_faultaddr and clean up a bit.

Signed-off-by: Robin Murphy <[email protected]>
Signed-off-by: Oliver Swede <[email protected]>
---
arch/arm64/include/asm/assembler.h | 4 ++
arch/arm64/lib/copy_from_user.S | 37 ++++++---------
arch/arm64/lib/copy_in_user.S | 72 ++++++++++--------------------
arch/arm64/lib/copy_to_user.S | 33 +++++---------
4 files changed, 52 insertions(+), 94 deletions(-)

diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
index 438382a277c8..84ddf25546eb 100644
--- a/arch/arm64/include/asm/assembler.h
+++ b/arch/arm64/include/asm/assembler.h
@@ -142,6 +142,10 @@ alternative_endif
9999: x; \
_asm_extable 9999b, l

+#define USER_F(l, x...) \
+9999: x; \
+ _asm_extable_faultaddr 9999b, l
+
/*
* Register aliases.
*/
diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S
index 86945e84c009..fa319f27a42b 100644
--- a/arch/arm64/lib/copy_from_user.S
+++ b/arch/arm64/lib/copy_from_user.S
@@ -19,8 +19,8 @@
* Returns:
* x0 - bytes not copied
*/
- 8888: ldtrb \reg, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ .macro ldrb1 reg, ptr, offset=0
+ USER_F(9998f, ldtrb \reg, [\ptr, \offset])
.endm

.macro strb1 reg, ptr, offset=0
@@ -29,9 +29,8 @@

.macro ldrb1_reg reg, ptr, offset
add \ptr, \ptr, \offset
- 8888: ldtrb \reg, [\ptr]
+ USER_F(9998f, ldtrb \reg, [\ptr])
sub \ptr, \ptr, \offset
- _asm_extable_faultaddr 8888b,9998f;
.endm

.macro strb1_reg reg, ptr, offset
@@ -39,8 +38,7 @@
.endm

.macro ldr1 reg, ptr, offset=0
- 8888: ldtr \reg, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, ldtr \reg, [\ptr, \offset])
.endm

.macro str1 reg, ptr, offset=0
@@ -48,10 +46,8 @@
.endm

.macro ldp1 regA, regB, ptr, offset=0
- 8888: ldtr \regA, [\ptr, \offset]
- 8889: ldtr \regB, [\ptr, \offset + 8]
- _asm_extable_faultaddr 8888b,9998f;
- _asm_extable_faultaddr 8889b,9998f;
+ USER_F(9998f, ldtr \regA, [\ptr, \offset])
+ USER_F(9998f, ldtr \regB, [\ptr, \offset + 8])
.endm

.macro stp1 regA, regB, ptr, offset=0
@@ -59,11 +55,9 @@
.endm

.macro ldp1_pre regA, regB, ptr, offset
- 8888: ldtr \regA, [\ptr, \offset]
- 8889: ldtr \regB, [\ptr, \offset + 8]
+ USER_F(9998f, ldtr \regA, [\ptr, \offset])
+ USER_F(9998f, ldtr \regB, [\ptr, \offset + 8])
add \ptr, \ptr, \offset
- _asm_extable_faultaddr 8888b,9998f;
- _asm_extable_faultaddr 8889b,9998f;
.endm

.macro stp1_pre regA, regB, ptr, offset
@@ -71,8 +65,7 @@
.endm

.macro ldrb1_nuao reg, ptr, offset=0
- 8888: ldrb \reg, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, ldrb \reg, [\ptr, \offset])
.endm

.macro strb1_nuao reg, ptr, offset=0
@@ -80,8 +73,7 @@
.endm

.macro ldrb1_nuao_reg reg, ptr, offset=0
- 8888: ldrb \reg, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, ldrb \reg, [\ptr, \offset])
.endm

.macro strb1_nuao_reg reg, ptr, offset=0
@@ -89,8 +81,7 @@
.endm

.macro ldr1_nuao reg, ptr, offset=0
- 8888: ldr \reg, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, ldr \reg, [\ptr, \offset])
.endm

.macro str1_nuao reg, ptr, offset=0
@@ -98,8 +89,7 @@
.endm

.macro ldp1_nuao regA, regB, ptr, offset=0
- 8888: ldp \regA, \regB, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, ldp \regA, \regB, [\ptr, \offset])
.endm

.macro stp1_nuao regA, regB, ptr, offset=0
@@ -107,8 +97,7 @@
.endm

.macro ldp1_pre_nuao regA, regB, ptr, offset
- 8888: ldp \regA, \regB, [\ptr, \offset]!
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, ldp \regA, \regB, [\ptr, \offset]!)
.endm

.macro stp1_pre_nuao regA, regB, ptr, offset
diff --git a/arch/arm64/lib/copy_in_user.S b/arch/arm64/lib/copy_in_user.S
index 77dfccc618b6..6b9bb6091dd8 100644
--- a/arch/arm64/lib/copy_in_user.S
+++ b/arch/arm64/lib/copy_in_user.S
@@ -22,117 +22,93 @@
* x0 - bytes not copied
*/
.macro ldrb1 reg, ptr, offset=0
- 8888: ldtrb \reg, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, ldtrb \reg, [\ptr, \offset])
.endm

.macro strb1 reg, ptr, offset=0
- 8888: sttrb \reg, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, sttrb \reg, [\ptr, \offset])
.endm

.macro ldrb1_reg reg, ptr, offset
add \ptr, \ptr, \offset
- 8888: ldtrb \reg, [\ptr]
+ USER_F(9998f, ldtrb \reg, [\ptr])
sub \ptr, \ptr, \offset
- _asm_extable_faultaddr 8888b,9998f;
.endm

.macro strb1_reg reg, ptr, offset
add \ptr, \ptr, \offset
- 8888: sttrb \reg, [\ptr]
+ USER_F(9998f, sttrb \reg, [\ptr])
sub \ptr, \ptr, \offset
- _asm_extable_faultaddr 8888b,9998f;
.endm

.macro ldr1 reg, ptr, offset=0
- 8888: ldtr \reg, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, ldtr \reg, [\ptr, \offset])
.endm

.macro str1 reg, ptr, offset=0
- 8888: sttr \reg, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, sttr \reg, [\ptr, \offset])
.endm

.macro ldp1 regA, regB, ptr, offset=0
- 8888: ldtr \regA, [\ptr, \offset]
- 8889: ldtr \regB, [\ptr, \offset + 8]
- _asm_extable_faultaddr 8888b,9998f;
- _asm_extable_faultaddr 8889b,9998f;
+ USER_F(9998f, ldtr \regA, [\ptr, \offset])
+ USER_F(9998f, ldtr \regB, [\ptr, \offset + 8])
.endm

.macro stp1 regA, regB, ptr, offset=0
- 8888: sttr \regA, [\ptr, \offset]
- 8889: sttr \regB, [\ptr, \offset + 8]
- _asm_extable_faultaddr 8888b,9998f;
- _asm_extable_faultaddr 8889b,9998f;
+ USER_F(9998f, sttr \regA, [\ptr, \offset])
+ USER_F(9998f, sttr \regB, [\ptr, \offset + 8])
.endm

.macro ldp1_pre regA, regB, ptr, offset
- 8888: ldtr \regA, [\ptr, \offset]
- 8889: ldtr \regB, [\ptr, \offset + 8]
+ USER_F(9998f, ldtr \regA, [\ptr, \offset])
+ USER_F(9998f, ldtr \regB, [\ptr, \offset + 8])
add \ptr, \ptr, \offset
- _asm_extable_faultaddr 8888b,9998f;
- _asm_extable_faultaddr 8889b,9998f;
.endm

.macro stp1_pre regA, regB, ptr, offset
- 8888: sttr \regA, [\ptr, \offset]
- 8889: sttr \regB, [\ptr, \offset + 8]
+ USER_F(9998f, sttr \regA, [\ptr, \offset])
+ USER_F(9998f, sttr \regB, [\ptr, \offset + 8])
add \ptr, \ptr, \offset
- _asm_extable_faultaddr 8888b,9998f;
- _asm_extable_faultaddr 8889b,9998f;
.endm

.macro ldrb1_nuao reg, ptr, offset=0
- 8888: ldrb \reg, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, ldrb \reg, [\ptr, \offset])
.endm

.macro strb1_nuao reg, ptr, offset=0
- 8888: strb \reg, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, strb \reg, [\ptr, \offset])
.endm

.macro ldrb1_nuao_reg reg, ptr, offset=0
- 8888: ldrb \reg, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, ldrb \reg, [\ptr, \offset])
.endm

.macro strb1_nuao_reg reg, ptr, offset=0
- 8888: strb \reg, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, strb \reg, [\ptr, \offset])
.endm

.macro ldr1_nuao reg, ptr, offset=0
- 8888: ldr \reg, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, ldr \reg, [\ptr, \offset])
.endm

.macro str1_nuao reg, ptr, offset=0
- 8888: str \reg, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, str \reg, [\ptr, \offset])
.endm

.macro ldp1_nuao regA, regB, ptr, offset=0
- 8888: ldp \regA, \regB, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, ldp \regA, \regB, [\ptr, \offset])
.endm

.macro stp1_nuao regA, regB, ptr, offset=0
- 8888: stp \regA, \regB, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, stp \regA, \regB, [\ptr, \offset])
.endm

.macro ldp1_pre_nuao regA, regB, ptr, offset
- 8888: ldp \regA, \regB, [\ptr, \offset]!
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, ldp \regA, \regB, [\ptr, \offset]!)
.endm

.macro stp1_pre_nuao regA, regB, ptr, offset
- 8888: stp \regA, \regB, [\ptr, \offset]!
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, stp \regA, \regB, [\ptr, \offset]!)
.endm

.macro copy_exit
diff --git a/arch/arm64/lib/copy_to_user.S b/arch/arm64/lib/copy_to_user.S
index 6b4742cac083..23af6af254da 100644
--- a/arch/arm64/lib/copy_to_user.S
+++ b/arch/arm64/lib/copy_to_user.S
@@ -24,8 +24,7 @@
.endm

.macro strb1 reg, ptr, offset=0
- 8888: sttrb \reg, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, sttrb \reg, [\ptr, \offset])
.endm

.macro ldrb1_reg reg, ptr, offset
@@ -34,9 +33,8 @@

.macro strb1_reg reg, ptr, offset
add \ptr, \ptr, \offset
- 8888: sttrb \reg, [\ptr]
+ USER_F(9998f, sttrb \reg, [\ptr])
sub \ptr, \ptr, \offset
- _asm_extable_faultaddr 8888b,9998f;
.endm

.macro ldr1 reg, ptr, offset=0
@@ -44,8 +42,7 @@
.endm

.macro str1 reg, ptr, offset=0
- 8888: sttr \reg, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, sttr \reg, [\ptr, \offset])
.endm

.macro ldp1 regA, regB, ptr, offset=0
@@ -53,10 +50,8 @@
.endm

.macro stp1 regA, regB, ptr, offset=0
- 8888: sttr \regA, [\ptr, \offset]
- 8889: sttr \regB, [\ptr, \offset + 8]
- _asm_extable_faultaddr 8888b,9998f;
- _asm_extable_faultaddr 8889b,9998f;
+ USER_F(9998f, sttr \regA, [\ptr, \offset])
+ USER_F(9998f, sttr \regB, [\ptr, \offset + 8])
.endm

.macro ldp1_pre regA, regB, ptr, offset
@@ -64,11 +59,9 @@
.endm

.macro stp1_pre regA, regB, ptr, offset
- 8888: sttr \regA, [\ptr, \offset]
- 8889: sttr \regB, [\ptr, \offset + 8]
+ USER_F(9998f, sttr \regA, [\ptr, \offset])
+ USER_F(9998f, sttr \regB, [\ptr, \offset + 8])
add \ptr, \ptr, \offset
- _asm_extable_faultaddr 8888b,9998f;
- _asm_extable_faultaddr 8889b,9998f;
.endm

.macro ldrb1_nuao reg, ptr, offset=0
@@ -76,8 +69,7 @@
.endm

.macro strb1_nuao reg, ptr, offset=0
- 8888: strb \reg, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, strb \reg, [\ptr, \offset])
.endm

.macro ldrb1_nuao_reg reg, ptr, offset=0
@@ -93,8 +85,7 @@
.endm

.macro str1_nuao reg, ptr, offset=0
- 8888: str \reg, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, str \reg, [\ptr, \offset])
.endm

.macro ldp1_nuao regA, regB, ptr, offset=0
@@ -106,13 +97,11 @@
.endm

.macro stp1_nuao regA, regB, ptr, offset=0
- 8888: stp \regA, \regB, [\ptr, \offset]
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, stp \regA, \regB, [\ptr, \offset])
.endm

.macro stp1_pre_nuao regA, regB, ptr, offset
- 8888: stp \regA, \regB, [\ptr, \offset]!
- _asm_extable_faultaddr 8888b,9998f;
+ USER_F(9998f, stp \regA, \regB, [\ptr, \offset]!)
.endm

.macro copy_exit
--
2.17.1

2020-09-14 15:16:43

by Oliver Swede

[permalink] [raw]
Subject: [PATCH v5 12/14] arm64: usercopy: Add intermediate fixup routine

This adds an intermediate fixup routine that initiates an in-order
byte-wise copy that is expected to fault for a second time, and then
be redirected to the final fixup where the precise number of bytes
remaining is obtained. As well as compatibility with the latest
optimized copy routine, these fixups should also be applicable to
future copy algorithms that utilize out-of-order copying.

The copy template is extended to add the relevant macros for the
second-stage fixup to each of the usercopy functions, where the
exception table entries are inserted to redirect the PC to the
conclusive fixup from the second instruction fault.

Signed-off-by: Oliver Swede <[email protected]>
---
arch/arm64/lib/copy_from_user.S | 18 ++++++++++++++-
arch/arm64/lib/copy_in_user.S | 16 ++++++++++++++
arch/arm64/lib/copy_template_user.S | 2 ++
arch/arm64/lib/copy_to_user.S | 16 ++++++++++++++
arch/arm64/lib/copy_user_fixup.S | 34 ++++++++++++++++++++++++++++-
5 files changed, 84 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S
index 745fbbfc23bb..7d3b7a790091 100644
--- a/arch/arm64/lib/copy_from_user.S
+++ b/arch/arm64/lib/copy_from_user.S
@@ -20,7 +20,7 @@
* x0 - bytes not copied
*/
.macro ldrb1 reg, ptr, offset=0
- USER_F(9996f, ldtrb \reg, [\ptr, \offset])
+ USER_F(9997f, ldtrb \reg, [\ptr, \offset])
.endm

.macro strb1 reg, ptr, offset=0
@@ -104,6 +104,22 @@
stp \regA, \regB, [\ptr, \offset]!
.endm

+ .macro ldrb2_post reg, ptr, offset=0
+ USER_F(9998f, ldtrb \reg, [\ptr], \offset)
+ .endm
+
+ .macro strb2_post reg, ptr, offset=0
+ strb \reg, [\ptr], \offset
+ .endm
+
+ .macro ldrb2_post_nuao reg, ptr, offset=0
+ USER_F(9998f, ldrb \reg, [\ptr], \offset)
+ .endm
+
+ .macro strb2_post_nuao reg, ptr, offset=0
+ strb \reg, [\ptr], \offset
+ .endm
+
.macro copy_exit
b .Luaccess_finish
.endm
diff --git a/arch/arm64/lib/copy_in_user.S b/arch/arm64/lib/copy_in_user.S
index 34389d16c338..ded937129270 100644
--- a/arch/arm64/lib/copy_in_user.S
+++ b/arch/arm64/lib/copy_in_user.S
@@ -111,6 +111,22 @@
USER_F(9997f, stp \regA, \regB, [\ptr, \offset]!)
.endm

+ .macro ldrb2_post reg, ptr, offset=0
+ USER_F(9998f, ldtrb \reg, [\ptr], \offset)
+ .endm
+
+ .macro strb2_post reg, ptr, offset=0
+ USER_F(9998f, sttrb \reg, [\ptr], \offset)
+ .endm
+
+ .macro ldrb2_post_nuao reg, ptr, offset=0
+ USER_F(9998f, ldrb \reg, [\ptr], \offset)
+ .endm
+
+ .macro strb2_post_nuao reg, ptr, offset=0
+ USER_F(9998f, strb \reg, [\ptr], \offset)
+ .endm
+
.macro copy_exit
b .Luaccess_finish
.endm
diff --git a/arch/arm64/lib/copy_template_user.S b/arch/arm64/lib/copy_template_user.S
index 1d13daf314b0..e94911e4df0f 100644
--- a/arch/arm64/lib/copy_template_user.S
+++ b/arch/arm64/lib/copy_template_user.S
@@ -17,6 +17,8 @@
#define strb1 strb1_nuao
#define ldrb1_reg ldrb1_nuao_reg
#define strb1_reg strb1_nuao_reg
+#define ldrb2_post ldrb2_post_nuao
+#define strb2_post strb2_post_nuao

L(copy_non_uao):
#undef L
diff --git a/arch/arm64/lib/copy_to_user.S b/arch/arm64/lib/copy_to_user.S
index cbb4cdfc7ad3..05a87ebe3ddc 100644
--- a/arch/arm64/lib/copy_to_user.S
+++ b/arch/arm64/lib/copy_to_user.S
@@ -104,6 +104,22 @@
USER_F(9997f, stp \regA, \regB, [\ptr, \offset]!)
.endm

+ .macro ldrb2_post reg, ptr, offset=0
+ ldrb \reg, [\ptr], \offset
+ .endm
+
+ .macro strb2_post reg, ptr, offset=0
+ USER_F(9998f, sttrb \reg, [\ptr], \offset)
+ .endm
+
+ .macro ldrb2_post_nuao reg, ptr, offset=0
+ ldrb \reg, [\ptr], \offset
+ .endm
+
+ .macro strb2_post_nuao reg, ptr, offset=0
+ USER_F(9998f, strb \reg, [\ptr], \offset)
+ .endm
+
.macro copy_exit
b .Luaccess_finish
.endm
diff --git a/arch/arm64/lib/copy_user_fixup.S b/arch/arm64/lib/copy_user_fixup.S
index 01e5c34461d7..6a7b2406d948 100644
--- a/arch/arm64/lib/copy_user_fixup.S
+++ b/arch/arm64/lib/copy_user_fixup.S
@@ -27,11 +27,43 @@ addr .req x15
b.lt L(src_fault)
b L(dst_fault)

+/*
+ * Reached here from load instruction during
+ * copy_{from/in}_user(dst, __user src, count)
+ */
L(src_fault):
+ mov x3, x1 // x3: initial target (user) load address
+ mov x4, x0 // x4: initial target store address
+ add x5, x1, x2 // x5: srcend
+
+L(src_buf_scan):
+ ldrb2_post w6, x3, #1
+ strb2_post w6, x4, #1
+ cmp x3, x5
+ b.lt L(src_buf_scan)
+ b L(all_copied)
+
+/*
+ * Reached here from store instruction during
+ * copy_{to/in}_user(__user dst, src, count)
+ */
L(dst_fault):
+ mov x3, x0 // x3: initial target (user) store address
+ mov x4, x1 // x4: initial target load address
+ add x5, x0, x2 // x5: dstend
+
+L(dst_buf_scan):
+ ldrb2_post w6, x4, #1
+ strb2_post w6, x3, #1
+ cmp x3, x5
+ b.lt L(dst_buf_scan)
+
+L(all_copied):
+ mov x0, #0 // reached the end of buffer
+ ret

9998:
+// TODO: add accurate fixup
L(none_copied):
mov x0, x2 // count (x2)
ret
-
--
2.17.1

2020-09-14 15:18:06

by Oliver Swede

[permalink] [raw]
Subject: [PATCH v5 10/14] arm64: usercopy: Store the arguments on stack

Use the stack to preserve the initial arguments to the usercopy
functions before the copy routine modifies the relevant registers.
The values in x0 (dst), x1 (src) and x2 (count) may be modified
in the code paths for large copy sizes, and saving them before
the copy begins enables restoration by the fixup routines to
ensure they have the required information to backtrack effectively.

The stack is used instead of other general-purpose registers due to
resource constraints as all scratch registers x0-x17 defined by the
PCS in the ABI are utilized by the imported copy routine.

The stack pointer is restored to its initial position either from
the fixup code in the case of a fault, or at the end of the copy
algorithm otherwise. The .Luaccess_finish directive is also moved
to copy_template_user.S as the code is common to all usercopy
functions.

Signed-off-by: Oliver Swede <[email protected]>
---
arch/arm64/lib/copy_from_user.S | 3 ---
arch/arm64/lib/copy_in_user.S | 3 ---
arch/arm64/lib/copy_template_user.S | 6 ++++++
arch/arm64/lib/copy_to_user.S | 3 ---
arch/arm64/lib/copy_user_fixup.S | 1 +
5 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S
index fa319f27a42b..cd3042e98394 100644
--- a/arch/arm64/lib/copy_from_user.S
+++ b/arch/arm64/lib/copy_from_user.S
@@ -110,9 +110,6 @@

SYM_FUNC_START(__arch_copy_from_user)
#include "copy_template_user.S"
-.Luaccess_finish:
- mov x0, #0
- ret
SYM_FUNC_END(__arch_copy_from_user)
EXPORT_SYMBOL(__arch_copy_from_user)
#include "copy_user_fixup.S"
diff --git a/arch/arm64/lib/copy_in_user.S b/arch/arm64/lib/copy_in_user.S
index 6b9bb6091dd8..fe035e513b34 100644
--- a/arch/arm64/lib/copy_in_user.S
+++ b/arch/arm64/lib/copy_in_user.S
@@ -117,9 +117,6 @@

SYM_FUNC_START(__arch_copy_in_user)
#include "copy_template_user.S"
-.Luaccess_finish:
- mov x0, #0
- ret
SYM_FUNC_END(__arch_copy_in_user)
EXPORT_SYMBOL(__arch_copy_in_user)
#include "copy_user_fixup.S"
diff --git a/arch/arm64/lib/copy_template_user.S b/arch/arm64/lib/copy_template_user.S
index 3db24dcdab05..1d13daf314b0 100644
--- a/arch/arm64/lib/copy_template_user.S
+++ b/arch/arm64/lib/copy_template_user.S
@@ -21,4 +21,10 @@
L(copy_non_uao):
#undef L
#define L(l) .Lnuao ## l
+ str x2, [sp, #-16]! // count
+ stp x0, x1, [sp, #-16]! // dstin, src
#include "copy_template.S"
+.Luaccess_finish:
+ add sp, sp, 32
+ mov x0, #0
+ ret
diff --git a/arch/arm64/lib/copy_to_user.S b/arch/arm64/lib/copy_to_user.S
index 23af6af254da..de0af211b3ba 100644
--- a/arch/arm64/lib/copy_to_user.S
+++ b/arch/arm64/lib/copy_to_user.S
@@ -110,9 +110,6 @@

SYM_FUNC_START(__arch_copy_to_user)
#include "copy_template_user.S"
-.Luaccess_finish:
- mov x0, #0
- ret
SYM_FUNC_END(__arch_copy_to_user)
EXPORT_SYMBOL(__arch_copy_to_user)
#include "copy_user_fixup.S"
diff --git a/arch/arm64/lib/copy_user_fixup.S b/arch/arm64/lib/copy_user_fixup.S
index 32fae9e2e799..a528b7d7d1bd 100644
--- a/arch/arm64/lib/copy_user_fixup.S
+++ b/arch/arm64/lib/copy_user_fixup.S
@@ -10,5 +10,6 @@ addr .req x15
ccmp addr, srcend, #0x0, ge
csel x0, srcend, dstend, lt
sub x0, x0, addr
+ add sp, sp, 32
ret

--
2.17.1

2020-09-14 16:46:25

by Oliver Swede

[permalink] [raw]
Subject: [PATCH v5 01/14] arm64: Allow passing fault address to fixup handlers

From: Sam Tebbs <[email protected]>

Extend fixup_exception() to optionally place the faulting address in a
register when returning to a fixup handler. Since A64 instructions must
be 4-byte-aligned, we can mimic the IA-64 implementation and encode a
flag in the lower bits of the offset field to indicate handlers which
expect an address. This will allow us to use more efficient offset
addressing modes in usercopy routines, rather than updating the base
register on every access just for the sake of inferring where a fault
occurred in order to compute the return value upon failure.

The choice of x15 is somewhat arbitrary, but with the consideration that
as the highest-numbered temporary register with no possible 'special'
role in the ABI, it is most likely not used by hand-written assembly
code, and thus a minimally-invasive option for imported routines.

Signed-off-by: Sam Tebbs <[email protected]>
[ rm: split into separate patch, use UL(), expand commit message ]
Signed-off-by: Robin Murphy <[email protected]>
[ os: move insertion to condition block for rebase onto bpf changes]
Signed-off-by: Oliver Swede <[email protected]>
---
arch/arm64/include/asm/assembler.h | 9 +++++++++
arch/arm64/include/asm/extable.h | 11 ++++++++++-
arch/arm64/mm/extable.c | 27 +++++++++++++++++----------
arch/arm64/mm/fault.c | 2 +-
4 files changed, 37 insertions(+), 12 deletions(-)

diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
index 54d181177656..438382a277c8 100644
--- a/arch/arm64/include/asm/assembler.h
+++ b/arch/arm64/include/asm/assembler.h
@@ -18,6 +18,7 @@
#include <asm/cpufeature.h>
#include <asm/cputype.h>
#include <asm/debug-monitors.h>
+#include <asm/extable.h>
#include <asm/page.h>
#include <asm/pgtable-hwdef.h>
#include <asm/ptrace.h>
@@ -129,6 +130,14 @@ alternative_endif
.popsection
.endm

+/*
+ * Emit an entry into the exception table.
+ * The fixup handler will receive the faulting address in x15
+ */
+ .macro _asm_extable_faultaddr, from, to
+ _asm_extable \from, \to + FIXUP_WITH_ADDR
+ .endm
+
#define USER(l, x...) \
9999: x; \
_asm_extable 9999b, l
diff --git a/arch/arm64/include/asm/extable.h b/arch/arm64/include/asm/extable.h
index 840a35ed92ec..2cfb3dce9a10 100644
--- a/arch/arm64/include/asm/extable.h
+++ b/arch/arm64/include/asm/extable.h
@@ -2,6 +2,12 @@
#ifndef __ASM_EXTABLE_H
#define __ASM_EXTABLE_H

+#include <linux/const.h>
+
+#define FIXUP_WITH_ADDR UL(1)
+
+#ifndef __ASSEMBLY__
+
/*
* The exception table consists of pairs of relative offsets: the first
* is the relative offset to an instruction that is allowed to fault,
@@ -34,5 +40,8 @@ int arm64_bpf_fixup_exception(const struct exception_table_entry *ex,
}
#endif /* !CONFIG_BPF_JIT */

-extern int fixup_exception(struct pt_regs *regs);
+extern int fixup_exception(struct pt_regs *regs, unsigned long addr);
+
+#endif
+
#endif
diff --git a/arch/arm64/mm/extable.c b/arch/arm64/mm/extable.c
index eee1732ab6cd..97802e1f178d 100644
--- a/arch/arm64/mm/extable.c
+++ b/arch/arm64/mm/extable.c
@@ -6,19 +6,26 @@
#include <linux/extable.h>
#include <linux/uaccess.h>

-int fixup_exception(struct pt_regs *regs)
+int fixup_exception(struct pt_regs *regs, unsigned long addr)
{
const struct exception_table_entry *fixup;

fixup = search_exception_tables(instruction_pointer(regs));
- if (!fixup)
- return 0;

- if (IS_ENABLED(CONFIG_BPF_JIT) &&
- regs->pc >= BPF_JIT_REGION_START &&
- regs->pc < BPF_JIT_REGION_END)
- return arm64_bpf_fixup_exception(fixup, regs);
-
- regs->pc = (unsigned long)&fixup->fixup + fixup->fixup;
- return 1;
+ if (fixup) {
+ if (IS_ENABLED(CONFIG_BPF_JIT) &&
+ regs->pc >= BPF_JIT_REGION_START &&
+ regs->pc < BPF_JIT_REGION_END) {
+ return arm64_bpf_fixup_exception(fixup, regs);
+ } else {
+ unsigned long offset = fixup->fixup;
+ if (offset & FIXUP_WITH_ADDR) {
+ regs->regs[15] = addr;
+ offset &= ~FIXUP_WITH_ADDR;
+ }
+ regs->pc = (unsigned long)&fixup->fixup + offset;
+ return 1;
+ }
+ }
+ return 0;
}
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index f07333e86c2f..b9c263d18510 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -303,7 +303,7 @@ static void __do_kernel_fault(unsigned long addr, unsigned int esr,
* Are we prepared to handle this kernel fault?
* We are almost certainly not prepared to handle instruction faults.
*/
- if (!is_el1_instruction_abort(esr) && fixup_exception(regs))
+ if (!is_el1_instruction_abort(esr) && fixup_exception(regs, addr))
return;

if (WARN_RATELIMIT(is_spurious_el1_translation_fault(addr, esr, regs),
--
2.17.1

2020-09-14 16:46:47

by Oliver Swede

[permalink] [raw]
Subject: [PATCH v5 06/14] arm64: Import latest version of Cortex Strings' strlen

From: Sam Tebbs <[email protected]>

Import latest version of Cortex Strings' strlen function.

The upstream source is src/aarch64/strlen.S as of commit eb80ac77a6cd
in https://git.linaro.org/toolchain/cortex-strings.git.

Signed-off-by: Sam Tebbs <[email protected]>
[ rm: update attribution, expand commit message ]
Signed-off-by: Robin Murphy <[email protected]>
Signed-off-by: Oliver Swede <[email protected]>
---
arch/arm64/lib/strlen.S | 247 +++++++++++++++++++++++++++-------------
1 file changed, 168 insertions(+), 79 deletions(-)

diff --git a/arch/arm64/lib/strlen.S b/arch/arm64/lib/strlen.S
index ee3ed882dd79..974b67dcc186 100644
--- a/arch/arm64/lib/strlen.S
+++ b/arch/arm64/lib/strlen.S
@@ -1,13 +1,11 @@
/* SPDX-License-Identifier: GPL-2.0-only */
/*
- * Copyright (C) 2013 ARM Ltd.
- * Copyright (C) 2013 Linaro.
+ * Copyright (c) 2013-2015 Linaro Limited. All rights reserved.
*
- * This code is based on glibc cortex strings work originally authored by Linaro
- * be found @
+ * This code is based on glibc Cortex Strings work originally authored by
+ * Linaro, found at:
*
- * http://bazaar.launchpad.net/~linaro-toolchain-dev/cortex-strings/trunk/
- * files/head:/src/aarch64/
+ * https://git.linaro.org/toolchain/cortex-strings.git
*/

#include <linux/linkage.h>
@@ -23,93 +21,184 @@
*/

/* Arguments and results. */
-srcin .req x0
-len .req x0
+#define srcin x0
+#define len x0

/* Locals and temporaries. */
-src .req x1
-data1 .req x2
-data2 .req x3
-data2a .req x4
-has_nul1 .req x5
-has_nul2 .req x6
-tmp1 .req x7
-tmp2 .req x8
-tmp3 .req x9
-tmp4 .req x10
-zeroones .req x11
-pos .req x12
+#define src x1
+#define data1 x2
+#define data2 x3
+#define has_nul1 x4
+#define has_nul2 x5
+#define tmp1 x4
+#define tmp2 x5
+#define tmp3 x6
+#define tmp4 x7
+#define zeroones x8
+
+#define L(l) .L ## l
+
+ /* NUL detection works on the principle that (X - 1) & (~X) & 0x80
+ (=> (X - 1) & ~(X | 0x7f)) is non-zero iff a byte is zero, and
+ can be done in parallel across the entire word. A faster check
+ (X - 1) & 0x80 is zero for non-NUL ASCII characters, but gives
+ false hits for characters 129..255. */

#define REP8_01 0x0101010101010101
#define REP8_7f 0x7f7f7f7f7f7f7f7f
#define REP8_80 0x8080808080808080

+#ifdef TEST_PAGE_CROSS
+# define MIN_PAGE_SIZE 15
+#else
+# define MIN_PAGE_SIZE 4096
+#endif
+
+ /* Since strings are short on average, we check the first 16 bytes
+ of the string for a NUL character. In order to do an unaligned ldp
+ safely we have to do a page cross check first. If there is a NUL
+ byte we calculate the length from the 2 8-byte words using
+ conditional select to reduce branch mispredictions (it is unlikely
+ strlen will be repeatedly called on strings with the same length).
+
+ If the string is longer than 16 bytes, we align src so don't need
+ further page cross checks, and process 32 bytes per iteration
+ using the fast NUL check. If we encounter non-ASCII characters,
+ fallback to a second loop using the full NUL check.
+
+ If the page cross check fails, we read 16 bytes from an aligned
+ address, remove any characters before the string, and continue
+ in the main loop using aligned loads. Since strings crossing a
+ page in the first 16 bytes are rare (probability of
+ 16/MIN_PAGE_SIZE ~= 0.4%), this case does not need to be optimized.
+
+ AArch64 systems have a minimum page size of 4k. We don't bother
+ checking for larger page sizes - the cost of setting up the correct
+ page size is just not worth the extra gain from a small reduction in
+ the cases taking the slow path. Note that we only care about
+ whether the first fetch, which may be misaligned, crosses a page
+ boundary. */
+
SYM_FUNC_START_WEAK_PI(strlen)
- mov zeroones, #REP8_01
- bic src, srcin, #15
- ands tmp1, srcin, #15
- b.ne .Lmisaligned
- /*
- * NUL detection works on the principle that (X - 1) & (~X) & 0x80
- * (=> (X - 1) & ~(X | 0x7f)) is non-zero iff a byte is zero, and
- * can be done in parallel across the entire word.
- */
- /*
- * The inner loop deals with two Dwords at a time. This has a
- * slightly higher start-up cost, but we should win quite quickly,
- * especially on cores with a high number of issue slots per
- * cycle, as we get much better parallelism out of the operations.
- */
-.Lloop:
- ldp data1, data2, [src], #16
-.Lrealigned:
+ and tmp1, srcin, MIN_PAGE_SIZE - 1
+ mov zeroones, REP8_01
+ cmp tmp1, MIN_PAGE_SIZE - 16
+ b.gt L(page_cross)
+ ldp data1, data2, [srcin]
+ /* For big-endian, carry propagation (if the final byte in the
+ string is 0x01) means we cannot use has_nul1/2 directly.
+ Since we expect strings to be small and early-exit,
+ byte-swap the data now so has_null1/2 will be correct. */
+CPU_BE(rev data1, data1)
+CPU_BE(rev data2, data2)
+ sub tmp1, data1, zeroones
+ orr tmp2, data1, REP8_7f
+ sub tmp3, data2, zeroones
+ orr tmp4, data2, REP8_7f
+ bics has_nul1, tmp1, tmp2
+ bic has_nul2, tmp3, tmp4
+ ccmp has_nul2, 0, 0, eq
+ beq L(main_loop_entry)
+
+ /* Enter with C = has_nul1 == 0. */
+ csel has_nul1, has_nul1, has_nul2, cc
+ mov len, 8
+ rev has_nul1, has_nul1
+ clz tmp1, has_nul1
+ csel len, xzr, len, cc
+ add len, len, tmp1, lsr 3
+ ret
+
+ /* The inner loop processes 32 bytes per iteration and uses the fast
+ NUL check. If we encounter non-ASCII characters, use a second
+ loop with the accurate NUL check. */
+ .p2align 4
+L(main_loop_entry):
+ bic src, srcin, 15
+ sub src, src, 16
+L(main_loop):
+ ldp data1, data2, [src, 32]!
+.Lpage_cross_entry:
sub tmp1, data1, zeroones
- orr tmp2, data1, #REP8_7f
sub tmp3, data2, zeroones
- orr tmp4, data2, #REP8_7f
- bic has_nul1, tmp1, tmp2
- bics has_nul2, tmp3, tmp4
- ccmp has_nul1, #0, #0, eq /* NZCV = 0000 */
- b.eq .Lloop
+ orr tmp2, tmp1, tmp3
+ tst tmp2, zeroones, lsl 7
+ bne 1f
+ ldp data1, data2, [src, 16]
+ sub tmp1, data1, zeroones
+ sub tmp3, data2, zeroones
+ orr tmp2, tmp1, tmp3
+ tst tmp2, zeroones, lsl 7
+ beq L(main_loop)
+ add src, src, 16
+1:
+ /* The fast check failed, so do the slower, accurate NUL check. */
+ orr tmp2, data1, REP8_7f
+ orr tmp4, data2, REP8_7f
+ bics has_nul1, tmp1, tmp2
+ bic has_nul2, tmp3, tmp4
+ ccmp has_nul2, 0, 0, eq
+ beq L(nonascii_loop)

+ /* Enter with C = has_nul1 == 0. */
+L(tail):
+ /* For big-endian, carry propagation (if the final byte in the
+ string is 0x01) means we cannot use has_nul1/2 directly. The
+ easiest way to get the correct byte is to byte-swap the data
+ and calculate the syndrome a second time. */
+CPU_BE(csel data1, data1, data2, cc)
+CPU_BE(rev data1, data1)
+CPU_BE(sub tmp1, data1, zeroones)
+CPU_BE(orr tmp2, data1, REP8_7f)
+CPU_BE(bic has_nul1, tmp1, tmp2)
+CPU_LE(csel has_nul1, has_nul1, has_nul2, cc)
sub len, src, srcin
- cbz has_nul1, .Lnul_in_data2
-CPU_BE( mov data2, data1 ) /*prepare data to re-calculate the syndrome*/
- sub len, len, #8
- mov has_nul2, has_nul1
-.Lnul_in_data2:
- /*
- * For big-endian, carry propagation (if the final byte in the
- * string is 0x01) means we cannot use has_nul directly. The
- * easiest way to get the correct byte is to byte-swap the data
- * and calculate the syndrome a second time.
- */
-CPU_BE( rev data2, data2 )
-CPU_BE( sub tmp1, data2, zeroones )
-CPU_BE( orr tmp2, data2, #REP8_7f )
-CPU_BE( bic has_nul2, tmp1, tmp2 )
-
- sub len, len, #8
- rev has_nul2, has_nul2
- clz pos, has_nul2
- add len, len, pos, lsr #3 /* Bits to bytes. */
+ rev has_nul1, has_nul1
+ add tmp2, len, 8
+ clz tmp1, has_nul1
+ csel len, len, tmp2, cc
+ add len, len, tmp1, lsr 3
ret

-.Lmisaligned:
- cmp tmp1, #8
- neg tmp1, tmp1
- ldp data1, data2, [src], #16
- lsl tmp1, tmp1, #3 /* Bytes beyond alignment -> bits. */
- mov tmp2, #~0
- /* Big-endian. Early bytes are at MSB. */
-CPU_BE( lsl tmp2, tmp2, tmp1 ) /* Shift (tmp1 & 63). */
- /* Little-endian. Early bytes are at LSB. */
-CPU_LE( lsr tmp2, tmp2, tmp1 ) /* Shift (tmp1 & 63). */
+L(nonascii_loop):
+ ldp data1, data2, [src, 16]!
+ sub tmp1, data1, zeroones
+ orr tmp2, data1, REP8_7f
+ sub tmp3, data2, zeroones
+ orr tmp4, data2, REP8_7f
+ bics has_nul1, tmp1, tmp2
+ bic has_nul2, tmp3, tmp4
+ ccmp has_nul2, 0, 0, eq
+ bne L(tail)
+ ldp data1, data2, [src, 16]!
+ sub tmp1, data1, zeroones
+ orr tmp2, data1, REP8_7f
+ sub tmp3, data2, zeroones
+ orr tmp4, data2, REP8_7f
+ bics has_nul1, tmp1, tmp2
+ bic has_nul2, tmp3, tmp4
+ ccmp has_nul2, 0, 0, eq
+ beq L(nonascii_loop)
+ b L(tail)

- orr data1, data1, tmp2
- orr data2a, data2, tmp2
- csinv data1, data1, xzr, le
- csel data2, data2, data2a, le
- b .Lrealigned
+ /* Load 16 bytes from [srcin & ~15] and force the bytes that precede
+ srcin to 0x7f, so we ignore any NUL bytes before the string.
+ Then continue in the aligned loop. */
+L(page_cross):
+ bic src, srcin, 15
+ ldp data1, data2, [src]
+ lsl tmp1, srcin, 3
+ mov tmp4, -1
+ /* Big-endian. Early bytes are at MSB. */
+CPU_BE(lsr tmp1, tmp4, tmp1) /* Shift (tmp1 & 63). */
+ /* Little-endian. Early bytes are at LSB. */
+CPU_LE(lsl tmp1, tmp4, tmp1) /* Shift (tmp1 & 63). */
+ orr tmp1, tmp1, REP8_80
+ orn data1, data1, tmp1
+ orn tmp2, data2, tmp1
+ tst srcin, 8
+ csel data1, data1, tmp4, eq
+ csel data2, data2, tmp2, eq
+ b L(page_cross_entry)
SYM_FUNC_END_PI(strlen)
EXPORT_SYMBOL_NOKASAN(strlen)
--
2.17.1

2020-09-14 16:47:12

by Oliver Swede

[permalink] [raw]
Subject: [PATCH v5 14/14] arm64: usercopy: Reduce overhead in fixup

In the usercopy fixups the intermediate in-order copy step could
create an overhead for a fault that occurs a large number of
bytes ahead in the buffer. On inspection of the copy routine,
it appears possible to leverage the property where all bytes lower
than the fault address minus N bytes (128 for this algorithm) have
already been copied at the point of a fault .

This adds a preprocessor directive for defining the value that should
be subtracted from the intermediate fault address by the first-stage
fixup routine. This is the only dependency on the copy routine and
this change should be re-evaluated when importing new optimized copy
routines to determine if the property still holds, or e.g. if N needs
to be increased, to ensure the fixup remains precise.

Signed-off-by: Oliver Swede <[email protected]>
---
arch/arm64/lib/copy_user_fixup.S | 16 ++++++++++++++++
1 file changed, 16 insertions(+)

diff --git a/arch/arm64/lib/copy_user_fixup.S b/arch/arm64/lib/copy_user_fixup.S
index 4858edd55994..970370b5b0a5 100644
--- a/arch/arm64/lib/copy_user_fixup.S
+++ b/arch/arm64/lib/copy_user_fixup.S
@@ -1,5 +1,7 @@
/* SPDX-License-Identifier: GPL-2.0-only */

+#define FIXUP_GRANULE 128
+
addr .req x15
.section .fixup,"ax"
.align 2
@@ -36,6 +38,13 @@ L(src_fault):
mov x4, x0 // x4: initial target store address
add x5, x1, x2 // x5: srcend

+ subs x3, x15, FIXUP_GRANULE
+ ccmp x3, x1, #0, pl
+ csel x3, x3, x1, ge // x3: initial target (user) load address
+ sub x4, x3, x1
+ add x4, x0, x4 // x4: initial target store address
+ add x5, x1, x2 // x5: srcend
+
L(src_buf_scan):
ldrb2_post w6, x3, #1
strb2_post w6, x4, #1
@@ -52,6 +61,13 @@ L(dst_fault):
mov x4, x1 // x4: initial target load address
add x5, x0, x2 // x5: dstend

+ subs x3, x15, FIXUP_GRANULE
+ ccmp x3, x0, #0, pl
+ csel x3, x3, x0, ge // x3: initial target (user) store address
+ sub x4, x3, x0
+ add x4, x1, x4 // x4: initial target load address
+ add x5, x0, x2 // x5: dstend
+
L(dst_buf_scan):
ldrb2_post w6, x4, #1
strb2_post w6, x3, #1
--
2.17.1

2020-09-14 16:47:35

by Oliver Swede

[permalink] [raw]
Subject: [PATCH v5 02/14] arm64: kprobes: Drop open-coded exception fixup

From: Robin Murphy <[email protected]>

The short-circuit call to fixup_exception() from kprobe_fault_handler()
poses a problem now that the former wants to consume the fault address
too, since the common kprobes API offers us no way to pass it through.
Fortunately, however, it works out to be unnecessary:

- uaccess instructions themselves are not probeable, so at most we
should only ever expect to take a fixable fault from the pre or post
handlers.
- the pre and post handler run with preemption disabled, thus for any
fault they may cause, an unhandled return from kprobe_page_fault()
will proceed directly to __do_kernel_fault() thanks to the
faulthandler_disabled() check.
- __do_kernel_fault() will immediately call fixup_exception() unless
we're in an EL1 instruction abort, and if we've somehow taken one of
those on what we think is the middle of a uaccess routine, then the
world is already very on fire.

Thus we can reasonably drop the call from kprobe_fault_handler() and
leave uaccess fixups to the regular flow.

Signed-off-by: Robin Murphy <[email protected]>
Signed-off-by: Oliver Swede <[email protected]>
---
arch/arm64/kernel/probes/kprobes.c | 7 -------
1 file changed, 7 deletions(-)

diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
index 5290f17a4d80..c54c8252b32f 100644
--- a/arch/arm64/kernel/probes/kprobes.c
+++ b/arch/arm64/kernel/probes/kprobes.c
@@ -328,13 +328,6 @@ int __kprobes kprobe_fault_handler(struct pt_regs *regs, unsigned int fsr)
*/
if (cur->fault_handler && cur->fault_handler(cur, regs, fsr))
return 1;
-
- /*
- * In case the user-specified fault handler returned
- * zero, try to fix up.
- */
- if (fixup_exception(regs))
- return 1;
}
return 0;
}
--
2.17.1

2020-09-14 16:47:49

by Oliver Swede

[permalink] [raw]
Subject: [PATCH v5 03/14] arm64: Import latest version of Cortex Strings' memcmp

From: Sam Tebbs <[email protected]>

Import the latest version of Cortex Strings' memcmp function.

The upstream source is src/aarch64/memcmp.S as of commit f77e4c932b4f
in https://git.linaro.org/toolchain/cortex-strings.git.

Signed-off-by: Sam Tebbs <[email protected]>
[ rm: update attribution, expand commit message ]
Signed-off-by: Robin Murphy <[email protected]>
Signed-off-by: Oliver Swede <[email protected]>
---
arch/arm64/lib/memcmp.S | 333 ++++++++++++++--------------------------
1 file changed, 117 insertions(+), 216 deletions(-)

diff --git a/arch/arm64/lib/memcmp.S b/arch/arm64/lib/memcmp.S
index c0671e793ea9..580dd0b12ccb 100644
--- a/arch/arm64/lib/memcmp.S
+++ b/arch/arm64/lib/memcmp.S
@@ -1,13 +1,12 @@
/* SPDX-License-Identifier: GPL-2.0-only */
/*
- * Copyright (C) 2013 ARM Ltd.
- * Copyright (C) 2013 Linaro.
+ * Copyright (c) 2013, 2018 Linaro Limited. All rights reserved.
+ * Copyright (c) 2017 ARM Ltd. All rights reserved.
*
- * This code is based on glibc cortex strings work originally authored by Linaro
- * be found @
+ * This code is based on glibc Cortex Strings work originally authored by
+ * Linaro, found at:
*
- * http://bazaar.launchpad.net/~linaro-toolchain-dev/cortex-strings/trunk/
- * files/head:/src/aarch64/
+ * https://git.linaro.org/toolchain/cortex-strings.git
*/

#include <linux/linkage.h>
@@ -25,223 +24,125 @@
* x0 - a compare result, maybe less than, equal to, or greater than ZERO
*/

+#define L(l) .L ## l
+
/* Parameters and result. */
-src1 .req x0
-src2 .req x1
-limit .req x2
-result .req x0
+#define src1 x0
+#define src2 x1
+#define limit x2
+#define result w0

/* Internal variables. */
-data1 .req x3
-data1w .req w3
-data2 .req x4
-data2w .req w4
-has_nul .req x5
-diff .req x6
-endloop .req x7
-tmp1 .req x8
-tmp2 .req x9
-tmp3 .req x10
-pos .req x11
-limit_wd .req x12
-mask .req x13
+#define data1 x3
+#define data1w w3
+#define data1h x4
+#define data2 x5
+#define data2w w5
+#define data2h x6
+#define tmp1 x7
+#define tmp2 x8

SYM_FUNC_START_WEAK_PI(memcmp)
- cbz limit, .Lret0
- eor tmp1, src1, src2
- tst tmp1, #7
- b.ne .Lmisaligned8
- ands tmp1, src1, #7
- b.ne .Lmutual_align
- sub limit_wd, limit, #1 /* limit != 0, so no underflow. */
- lsr limit_wd, limit_wd, #3 /* Convert to Dwords. */
- /*
- * The input source addresses are at alignment boundary.
- * Directly compare eight bytes each time.
- */
-.Lloop_aligned:
- ldr data1, [src1], #8
- ldr data2, [src2], #8
-.Lstart_realigned:
- subs limit_wd, limit_wd, #1
- eor diff, data1, data2 /* Non-zero if differences found. */
- csinv endloop, diff, xzr, cs /* Last Dword or differences. */
- cbz endloop, .Lloop_aligned
-
- /* Not reached the limit, must have found a diff. */
- tbz limit_wd, #63, .Lnot_limit
-
- /* Limit % 8 == 0 => the diff is in the last 8 bytes. */
- ands limit, limit, #7
- b.eq .Lnot_limit
- /*
- * The remained bytes less than 8. It is needed to extract valid data
- * from last eight bytes of the intended memory range.
- */
- lsl limit, limit, #3 /* bytes-> bits. */
- mov mask, #~0
-CPU_BE( lsr mask, mask, limit )
-CPU_LE( lsl mask, mask, limit )
- bic data1, data1, mask
- bic data2, data2, mask
-
- orr diff, diff, mask
- b .Lnot_limit
-
-.Lmutual_align:
- /*
- * Sources are mutually aligned, but are not currently at an
- * alignment boundary. Round down the addresses and then mask off
- * the bytes that precede the start point.
- */
- bic src1, src1, #7
- bic src2, src2, #7
- ldr data1, [src1], #8
- ldr data2, [src2], #8
- /*
- * We can not add limit with alignment offset(tmp1) here. Since the
- * addition probably make the limit overflown.
- */
- sub limit_wd, limit, #1/*limit != 0, so no underflow.*/
- and tmp3, limit_wd, #7
- lsr limit_wd, limit_wd, #3
- add tmp3, tmp3, tmp1
- add limit_wd, limit_wd, tmp3, lsr #3
- add limit, limit, tmp1/* Adjust the limit for the extra. */
-
- lsl tmp1, tmp1, #3/* Bytes beyond alignment -> bits.*/
- neg tmp1, tmp1/* Bits to alignment -64. */
- mov tmp2, #~0
- /*mask off the non-intended bytes before the start address.*/
-CPU_BE( lsl tmp2, tmp2, tmp1 )/*Big-endian.Early bytes are at MSB*/
- /* Little-endian. Early bytes are at LSB. */
-CPU_LE( lsr tmp2, tmp2, tmp1 )
-
- orr data1, data1, tmp2
- orr data2, data2, tmp2
- b .Lstart_realigned
-
- /*src1 and src2 have different alignment offset.*/
-.Lmisaligned8:
- cmp limit, #8
- b.lo .Ltiny8proc /*limit < 8: compare byte by byte*/
-
- and tmp1, src1, #7
- neg tmp1, tmp1
- add tmp1, tmp1, #8/*valid length in the first 8 bytes of src1*/
- and tmp2, src2, #7
- neg tmp2, tmp2
- add tmp2, tmp2, #8/*valid length in the first 8 bytes of src2*/
- subs tmp3, tmp1, tmp2
- csel pos, tmp1, tmp2, hi /*Choose the maximum.*/
-
- sub limit, limit, pos
- /*compare the proceeding bytes in the first 8 byte segment.*/
-.Ltinycmp:
- ldrb data1w, [src1], #1
- ldrb data2w, [src2], #1
- subs pos, pos, #1
- ccmp data1w, data2w, #0, ne /* NZCV = 0b0000. */
- b.eq .Ltinycmp
- cbnz pos, 1f /*diff occurred before the last byte.*/
- cmp data1w, data2w
- b.eq .Lstart_align
-1:
- sub result, data1, data2
- ret
-
-.Lstart_align:
- lsr limit_wd, limit, #3
- cbz limit_wd, .Lremain8
-
- ands xzr, src1, #7
- b.eq .Lrecal_offset
- /*process more leading bytes to make src1 aligned...*/
- add src1, src1, tmp3 /*backwards src1 to alignment boundary*/
- add src2, src2, tmp3
- sub limit, limit, tmp3
- lsr limit_wd, limit, #3
- cbz limit_wd, .Lremain8
- /*load 8 bytes from aligned SRC1..*/
- ldr data1, [src1], #8
- ldr data2, [src2], #8
-
- subs limit_wd, limit_wd, #1
- eor diff, data1, data2 /*Non-zero if differences found.*/
- csinv endloop, diff, xzr, ne
- cbnz endloop, .Lunequal_proc
- /*How far is the current SRC2 from the alignment boundary...*/
- and tmp3, tmp3, #7
-
-.Lrecal_offset:/*src1 is aligned now..*/
- neg pos, tmp3
-.Lloopcmp_proc:
- /*
- * Divide the eight bytes into two parts. First,backwards the src2
- * to an alignment boundary,load eight bytes and compare from
- * the SRC2 alignment boundary. If all 8 bytes are equal,then start
- * the second part's comparison. Otherwise finish the comparison.
- * This special handle can garantee all the accesses are in the
- * thread/task space in avoid to overrange access.
- */
- ldr data1, [src1,pos]
- ldr data2, [src2,pos]
- eor diff, data1, data2 /* Non-zero if differences found. */
- cbnz diff, .Lnot_limit
-
- /*The second part process*/
- ldr data1, [src1], #8
- ldr data2, [src2], #8
- eor diff, data1, data2 /* Non-zero if differences found. */
- subs limit_wd, limit_wd, #1
- csinv endloop, diff, xzr, ne/*if limit_wd is 0,will finish the cmp*/
- cbz endloop, .Lloopcmp_proc
-.Lunequal_proc:
- cbz diff, .Lremain8
-
-/* There is difference occurred in the latest comparison. */
-.Lnot_limit:
-/*
-* For little endian,reverse the low significant equal bits into MSB,then
-* following CLZ can find how many equal bits exist.
-*/
-CPU_LE( rev diff, diff )
-CPU_LE( rev data1, data1 )
-CPU_LE( rev data2, data2 )
-
- /*
- * The MS-non-zero bit of DIFF marks either the first bit
- * that is different, or the end of the significant data.
- * Shifting left now will bring the critical information into the
- * top bits.
- */
- clz pos, diff
- lsl data1, data1, pos
- lsl data2, data2, pos
- /*
- * We need to zero-extend (char is unsigned) the value and then
- * perform a signed subtraction.
- */
- lsr data1, data1, #56
- sub result, data1, data2, lsr #56
+ subs limit, limit, 8
+ b.lo L(less8)
+
+ ldr data1, [src1], 8
+ ldr data2, [src2], 8
+ cmp data1, data2
+ b.ne L(return)
+
+ subs limit, limit, 8
+ b.gt L(more16)
+
+ ldr data1, [src1, limit]
+ ldr data2, [src2, limit]
+ b L(return)
+
+L(more16):
+ ldr data1, [src1], 8
+ ldr data2, [src2], 8
+ cmp data1, data2
+ bne L(return)
+
+ /* Jump directly to comparing the last 16 bytes for 32 byte (or less)
+ strings. */
+ subs limit, limit, 16
+ b.ls L(last_bytes)
+
+ /* We overlap loads between 0-32 bytes at either side of SRC1 when we
+ try to align, so limit it only to strings larger than 128 bytes. */
+ cmp limit, 96
+ b.ls L(loop16)
+
+ /* Align src1 and adjust src2 with bytes not yet done. */
+ and tmp1, src1, 15
+ add limit, limit, tmp1
+ sub src1, src1, tmp1
+ sub src2, src2, tmp1
+
+ /* Loop performing 16 bytes per iteration using aligned src1.
+ Limit is pre-decremented by 16 and must be larger than zero.
+ Exit if <= 16 bytes left to do or if the data is not equal. */
+ .p2align 4
+L(loop16):
+ ldp data1, data1h, [src1], 16
+ ldp data2, data2h, [src2], 16
+ subs limit, limit, 16
+ ccmp data1, data2, 0, hi
+ ccmp data1h, data2h, 0, eq
+ b.eq L(loop16)
+
+ cmp data1, data2
+ bne L(return)
+ mov data1, data1h
+ mov data2, data2h
+ cmp data1, data2
+ bne L(return)
+
+ /* Compare last 1-16 bytes using unaligned access. */
+L(last_bytes):
+ add src1, src1, limit
+ add src2, src2, limit
+ ldp data1, data1h, [src1]
+ ldp data2, data2h, [src2]
+ cmp data1, data2
+ bne L(return)
+ mov data1, data1h
+ mov data2, data2h
+ cmp data1, data2
+
+ /* Compare data bytes and set return value to 0, -1 or 1. */
+L(return):
+#ifndef __AARCH64EB__
+ rev data1, data1
+ rev data2, data2
+#endif
+ cmp data1, data2
+L(ret_eq):
+ cset result, ne
+ cneg result, result, lo
ret

-.Lremain8:
- /* Limit % 8 == 0 =>. all data are equal.*/
- ands limit, limit, #7
- b.eq .Lret0
-
-.Ltiny8proc:
- ldrb data1w, [src1], #1
- ldrb data2w, [src2], #1
- subs limit, limit, #1
-
- ccmp data1w, data2w, #0, ne /* NZCV = 0b0000. */
- b.eq .Ltiny8proc
- sub result, data1, data2
- ret
-.Lret0:
- mov result, #0
+ .p2align 4
+ /* Compare up to 8 bytes. Limit is [-8..-1]. */
+L(less8):
+ adds limit, limit, 4
+ b.lo L(less4)
+ ldr data1w, [src1], 4
+ ldr data2w, [src2], 4
+ cmp data1w, data2w
+ b.ne L(return)
+ sub limit, limit, 4
+L(less4):
+ adds limit, limit, 4
+ beq L(ret_eq)
+L(byte_loop):
+ ldrb data1w, [src1], 1
+ ldrb data2w, [src2], 1
+ subs limit, limit, 1
+ ccmp data1w, data2w, 0, ne /* NZCV = 0b0000. */
+ b.eq L(byte_loop)
+ sub result, data1w, data2w
ret
SYM_FUNC_END_PI(memcmp)
EXPORT_SYMBOL_NOKASAN(memcmp)
--
2.17.1

2020-09-14 16:50:12

by Oliver Swede

[permalink] [raw]
Subject: [PATCH v5 04/14] arm64: Import latest version of Cortex Strings' memmove

From: Sam Tebbs <[email protected]>

Import the latest version of Cortex Strings' memmove function.

The upstream source is src/aarch64/memmove.S as of commit 99b01ddb8e41
in https://git.linaro.org/toolchain/cortex-strings.git.

Signed-off-by: Sam Tebbs <[email protected]>
[ rm: update attribution, expand commit message ]
Signed-off-by: Robin Murphy <[email protected]>
Signed-off-by: Oliver Swede <[email protected]>
---
arch/arm64/lib/memmove.S | 232 +++++++++++++--------------------------
1 file changed, 78 insertions(+), 154 deletions(-)

diff --git a/arch/arm64/lib/memmove.S b/arch/arm64/lib/memmove.S
index 02cda2e33bde..d0977d0ad745 100644
--- a/arch/arm64/lib/memmove.S
+++ b/arch/arm64/lib/memmove.S
@@ -1,13 +1,12 @@
/* SPDX-License-Identifier: GPL-2.0-only */
/*
- * Copyright (C) 2013 ARM Ltd.
- * Copyright (C) 2013 Linaro.
+ * Copyright (c) 2013 Linaro Limited. All rights reserved.
+ * Copyright (c) 2015 ARM Ltd. All rights reserved.
*
- * This code is based on glibc cortex strings work originally authored by Linaro
- * be found @
+ * This code is based on glibc Cortex Strings work originally authored by
+ * Linaro, found at:
*
- * http://bazaar.launchpad.net/~linaro-toolchain-dev/cortex-strings/trunk/
- * files/head:/src/aarch64/
+ * https://git.linaro.org/toolchain/cortex-strings.git
*/

#include <linux/linkage.h>
@@ -25,165 +24,90 @@
* Returns:
* x0 - dest
*/
-dstin .req x0
-src .req x1
-count .req x2
-tmp1 .req x3
-tmp1w .req w3
-tmp2 .req x4
-tmp2w .req w4
-tmp3 .req x5
-tmp3w .req w5
-dst .req x6
+/* Parameters and result. */
+#define dstin x0
+#define src x1
+#define count x2
+#define srcend x3
+#define dstend x4
+#define tmp1 x5
+#define A_l x6
+#define A_h x7
+#define B_l x8
+#define B_h x9
+#define C_l x10
+#define C_h x11
+#define D_l x12
+#define D_h x13
+#define E_l count
+#define E_h tmp1

-A_l .req x7
-A_h .req x8
-B_l .req x9
-B_h .req x10
-C_l .req x11
-C_h .req x12
-D_l .req x13
-D_h .req x14
+/* All memmoves up to 96 bytes are done by memcpy as it supports overlaps.
+ Larger backwards copies are also handled by memcpy. The only remaining
+ case is forward large copies. The destination is aligned, and an
+ unrolled loop processes 64 bytes per iteration.
+*/

- .weak memmove
+ .weak memmove
SYM_FUNC_START_ALIAS(__memmove)
SYM_FUNC_START_PI(memmove)
- cmp dstin, src
- b.lo __memcpy
- add tmp1, src, count
- cmp dstin, tmp1
- b.hs __memcpy /* No overlap. */
+ sub tmp1, dstin, src
+ cmp count, 96
+ ccmp tmp1, count, 2, hi
+ b.hs __memcpy

- add dst, dstin, count
- add src, src, count
- cmp count, #16
- b.lo .Ltail15 /*probably non-alignment accesses.*/
+ cbz tmp1, 3f
+ add dstend, dstin, count
+ add srcend, src, count

- ands tmp2, src, #15 /* Bytes to reach alignment. */
- b.eq .LSrcAligned
- sub count, count, tmp2
- /*
- * process the aligned offset length to make the src aligned firstly.
- * those extra instructions' cost is acceptable. It also make the
- * coming accesses are based on aligned address.
- */
- tbz tmp2, #0, 1f
- ldrb tmp1w, [src, #-1]!
- strb tmp1w, [dst, #-1]!
-1:
- tbz tmp2, #1, 2f
- ldrh tmp1w, [src, #-2]!
- strh tmp1w, [dst, #-2]!
-2:
- tbz tmp2, #2, 3f
- ldr tmp1w, [src, #-4]!
- str tmp1w, [dst, #-4]!
-3:
- tbz tmp2, #3, .LSrcAligned
- ldr tmp1, [src, #-8]!
- str tmp1, [dst, #-8]!
-
-.LSrcAligned:
- cmp count, #64
- b.ge .Lcpy_over64
+ /* Align dstend to 16 byte alignment so that we don't cross cache line
+ boundaries on both loads and stores. There are at least 96 bytes
+ to copy, so copy 16 bytes unaligned and then align. The loop
+ copies 64 bytes per iteration and prefetches one iteration ahead. */

- /*
- * Deal with small copies quickly by dropping straight into the
- * exit block.
- */
-.Ltail63:
- /*
- * Copy up to 48 bytes of data. At this point we only need the
- * bottom 6 bits of count to be accurate.
- */
- ands tmp1, count, #0x30
- b.eq .Ltail15
- cmp tmp1w, #0x20
- b.eq 1f
- b.lt 2f
- ldp A_l, A_h, [src, #-16]!
- stp A_l, A_h, [dst, #-16]!
+ and tmp1, dstend, 15
+ ldp D_l, D_h, [srcend, -16]
+ sub srcend, srcend, tmp1
+ sub count, count, tmp1
+ ldp A_l, A_h, [srcend, -16]
+ stp D_l, D_h, [dstend, -16]
+ ldp B_l, B_h, [srcend, -32]
+ ldp C_l, C_h, [srcend, -48]
+ ldp D_l, D_h, [srcend, -64]!
+ sub dstend, dstend, tmp1
+ subs count, count, 128
+ b.ls 2f
+ nop
1:
- ldp A_l, A_h, [src, #-16]!
- stp A_l, A_h, [dst, #-16]!
-2:
- ldp A_l, A_h, [src, #-16]!
- stp A_l, A_h, [dst, #-16]!
+ stp A_l, A_h, [dstend, -16]
+ ldp A_l, A_h, [srcend, -16]
+ stp B_l, B_h, [dstend, -32]
+ ldp B_l, B_h, [srcend, -32]
+ stp C_l, C_h, [dstend, -48]
+ ldp C_l, C_h, [srcend, -48]
+ stp D_l, D_h, [dstend, -64]!
+ ldp D_l, D_h, [srcend, -64]!
+ subs count, count, 64
+ b.hi 1b

-.Ltail15:
- tbz count, #3, 1f
- ldr tmp1, [src, #-8]!
- str tmp1, [dst, #-8]!
-1:
- tbz count, #2, 2f
- ldr tmp1w, [src, #-4]!
- str tmp1w, [dst, #-4]!
+ /* Write the last full set of 64 bytes. The remainder is at most 64
+ bytes, so it is safe to always copy 64 bytes from the start even if
+ there is just 1 byte left. */
2:
- tbz count, #1, 3f
- ldrh tmp1w, [src, #-2]!
- strh tmp1w, [dst, #-2]!
-3:
- tbz count, #0, .Lexitfunc
- ldrb tmp1w, [src, #-1]
- strb tmp1w, [dst, #-1]
-
-.Lexitfunc:
- ret
-
-.Lcpy_over64:
- subs count, count, #128
- b.ge .Lcpy_body_large
- /*
- * Less than 128 bytes to copy, so handle 64 bytes here and then jump
- * to the tail.
- */
- ldp A_l, A_h, [src, #-16]
- stp A_l, A_h, [dst, #-16]
- ldp B_l, B_h, [src, #-32]
- ldp C_l, C_h, [src, #-48]
- stp B_l, B_h, [dst, #-32]
- stp C_l, C_h, [dst, #-48]
- ldp D_l, D_h, [src, #-64]!
- stp D_l, D_h, [dst, #-64]!
-
- tst count, #0x3f
- b.ne .Ltail63
- ret
-
- /*
- * Critical loop. Start at a new cache line boundary. Assuming
- * 64 bytes per line this ensures the entire loop is in one line.
- */
- .p2align L1_CACHE_SHIFT
-.Lcpy_body_large:
- /* pre-load 64 bytes data. */
- ldp A_l, A_h, [src, #-16]
- ldp B_l, B_h, [src, #-32]
- ldp C_l, C_h, [src, #-48]
- ldp D_l, D_h, [src, #-64]!
-1:
- /*
- * interlace the load of next 64 bytes data block with store of the last
- * loaded 64 bytes data.
- */
- stp A_l, A_h, [dst, #-16]
- ldp A_l, A_h, [src, #-16]
- stp B_l, B_h, [dst, #-32]
- ldp B_l, B_h, [src, #-32]
- stp C_l, C_h, [dst, #-48]
- ldp C_l, C_h, [src, #-48]
- stp D_l, D_h, [dst, #-64]!
- ldp D_l, D_h, [src, #-64]!
- subs count, count, #64
- b.ge 1b
- stp A_l, A_h, [dst, #-16]
- stp B_l, B_h, [dst, #-32]
- stp C_l, C_h, [dst, #-48]
- stp D_l, D_h, [dst, #-64]!
+ ldp E_l, E_h, [src, 48]
+ stp A_l, A_h, [dstend, -16]
+ ldp A_l, A_h, [src, 32]
+ stp B_l, B_h, [dstend, -32]
+ ldp B_l, B_h, [src, 16]
+ stp C_l, C_h, [dstend, -48]
+ ldp C_l, C_h, [src]
+ stp D_l, D_h, [dstend, -64]
+ stp E_l, E_h, [dstin, 48]
+ stp A_l, A_h, [dstin, 32]
+ stp B_l, B_h, [dstin, 16]
+ stp C_l, C_h, [dstin]
+3: ret

- tst count, #0x3f
- b.ne .Ltail63
- ret
SYM_FUNC_END_PI(memmove)
EXPORT_SYMBOL(memmove)
SYM_FUNC_END_ALIAS(__memmove)
--
2.17.1