Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
From:   Andy Lutomirski <luto@amacapital.net>
Mime-Version: 1.0 (1.0)
Subject: Re: objtool clac/stac handling change..
Date:   Wed, 1 Jul 2020 13:36:22 -0700
Message-Id: <5F1767D0-416A-4BA4-9DFF-E82D1EA3F5EE@amacapital.net>
References: <CAHk-=wizu7DA7EDrsHQLmkTFBvCRxNyPMHaeMDYMF_U75s9RvQ@mail.gmail.com>
Cc:     Andy Lutomirski <luto@kernel.org>,
        Josh Poimboeuf <jpoimboe@redhat.com>,
        Peter Zijlstra <peterz@infradead.org>,
        the arch/x86 maintainers <x86@kernel.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
In-Reply-To: <CAHk-=wizu7DA7EDrsHQLmkTFBvCRxNyPMHaeMDYMF_U75s9RvQ@mail.gmail.com>
To:     Linus Torvalds <torvalds@linux-foundation.org>
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


> On Jul 1, 2020, at 12:35 PM, Linus Torvalds <torvalds@linux-foundation.org=
> wrote:
>=20
> =EF=BB=BFOn Wed, Jul 1, 2020 at 11:29 AM Andy Lutomirski <luto@kernel.org>=
 wrote:
>>=20
>> Do we really want the exception handling to do the CLAC?  Having
>> unsafe_get_user() do CLAC seems surprising to me, and it will break
>> use cases like:
>>=20
>> if (!user_access_begin(...)
>>  goto out;
>>=20
>> ret =3D unsafe_get_user(...);
>>=20
>> user_access_end();
>>=20
>> check ret;
>=20
> That's not how unsafe_get_user() works.
>=20
> unsafe_get_user() always jumps to the error label, it never returns a
> value. So the code is actually now what you claim above, but
>=20
>    if (!user_access_begin(...)
>       goto out;
>=20
>    unsafe_get_user(..., out_fault);
>    user_access_end();
>   .. this is good, use the value we got..
>=20
> out_fault:
>    user_access_end();
> out:
>    return -EFAULT;

Ugh, right. But maybe, with the asm goto magic, we can=E2=80=99t get rid of t=
his. I=E2=80=99ve always disliked the pattern where we enable user access, d=
o a bunch of accesses that branch on error, and finish up. We ought to be ab=
le to do it the way I described and get decent code generation too.

If we do this extable change, we end up with a different mess: some exceptio=
n handlers will clear AC and some won=E2=80=99t.  I=E2=80=99m sure objtool c=
an deal with this with some effort, but I=E2=80=99m not convinced it=E2=80=99=
s worth it.=