Re: [PATCH V2] [X86] Fix potential issue on memmove

Re: [PATCH V2] [X86] Fix potential issue on memmove

[Namhyung Kim]

> --- a/arch/x86/lib/memcpy_32.c
> +++ b/arch/x86/lib/memcpy_32.c
> @@ -25,19 +25,35 @@ void *memmove(void *dest, const void *src, size_t n)
>	int d0, d1, d2;
> 
> 	if (dest < src) {
> -		memcpy(dest, src, n);
> +		if ((dest + n) < src)
> +			 return memcpy(dest, src, n);
> +		else
> +			__asm__ __volatile__(
> +				"rep\n\t"
> +				"movsb\n\t"
> +				: "=&c" (d0), "=&S" (d1), "=&D" (d2)
> +				:"0" (n),
> +				 "1" (src),
> +				 "2" (dest)
> +				:"memory");
> +
> 	} else {
> -		__asm__ __volatile__(
> -			"std\n\t"
> -			"rep\n\t"
> -			"movsb\n\t"
> -			"cld"
> -			: "=&c" (d0), "=&S" (d1), "=&D" (d2)
> -			:"0" (n),
> -			 "1" (n-1+src),
> -			 "2" (n-1+dest)
> -			:"memory");
> +		if((src + count) < dest)
> +			return memcpy(dest, src, count);

'count' should be 'n'.

-- 
Regards,
Namhyung Kim

RE: [PATCH V2] [X86] Fix potential issue on memmove

[Ma, Ling]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset="utf-8", Size: 1379 bytes --]

Thanks, I will fix it in next version.

> -----Original Message-----
> From: Namhyung Kim [mailto:namhyung@gmail.com]
> Sent: Thursday, August 12, 2010 2:49 PM
> To: Ma, Ling
> Cc: hpa@zytor.com; tglx@linutronix.de; linux-kernel@vger.kernel.org;
> mingo@elte.hu
> Subject: Re: [PATCH V2] [X86] Fix potential issue on memmove
> 
> > --- a/arch/x86/lib/memcpy_32.c
> > +++ b/arch/x86/lib/memcpy_32.c
> > @@ -25,19 +25,35 @@ void *memmove(void *dest, const void *src, size_t
> n)
> >	int d0, d1, d2;
> >
> > 	if (dest < src) {
> > -		memcpy(dest, src, n);
> > +		if ((dest + n) < src)
> > +			 return memcpy(dest, src, n);
> > +		else
> > +			__asm__ __volatile__(
> > +				"rep\n\t"
> > +				"movsb\n\t"
> > +				: "=&c" (d0), "=&S" (d1), "=&D" (d2)
> > +				:"0" (n),
> > +				 "1" (src),
> > +				 "2" (dest)
> > +				:"memory");
> > +
> > 	} else {
> > -		__asm__ __volatile__(
> > -			"std\n\t"
> > -			"rep\n\t"
> > -			"movsb\n\t"
> > -			"cld"
> > -			: "=&c" (d0), "=&S" (d1), "=&D" (d2)
> > -			:"0" (n),
> > -			 "1" (n-1+src),
> > -			 "2" (n-1+dest)
> > -			:"memory");
> > +		if((src + count) < dest)
> > +			return memcpy(dest, src, count);
> 
> 'count' should be 'n'.
> 
> --
> Regards,
> Namhyung Kim
> 

ÿôèº{.nÇ+‰·Ÿ®‰­†+%ŠËÿ±éݶ\x17¥Šwÿº{.nÇ+‰·¥Š{±þG«éÿŠ{ayº\x1dʇڙë,j\a­¢f£¢·hšïêÿ‘êçz_è®\x03(­éšŽŠÝ¢j"ú\x1a¶^[m§ÿÿ¾\a«þG«éÿ¢¸?™¨è­Ú&£ø§~á¶iO•æ¬z·švØ^\x14\x04\x1a¶^[m§ÿÿÃ\fÿ¶ìÿ¢¸?–I¥

Re: [PATCH V2] [X86] Fix potential issue on memmove

[H. Peter Anvin]

On 08/11/2010 11:52 PM, Ma, Ling wrote:
> Thanks, I will fix it in next version.

Also, please split this into two patches -- one for fixing memmove, and
the other for re-enabling the alias avoidance in memcpy.
	
	-hpa

-- 
H. Peter Anvin, Intel Open Source Technology Center
I work for Intel.  I don't speak on their behalf.

Re: [PATCH V2] [X86] Fix potential issue on memmove

[H. Peter Anvin]

On 08/12/2010 07:15 AM, H. Peter Anvin wrote:
> On 08/11/2010 11:52 PM, Ma, Ling wrote:
>> Thanks, I will fix it in next version.
> 
> Also, please split this into two patches -- one for fixing memmove, and
> the other for re-enabling the alias avoidance in memcpy.
> 	
> 	-hpa
> 

Nevermind, the patch doesn't actually contain the x86/mem patch.

It's rather confusing to put "re-active patch id
a1e5278e40f16a4611264f8da9e557c16cb6f6ed" for a patch that was caught in
testing rather than ever included; it doesn't even exist under that
patch ID anymore.

	-hpa

[PATCH V2] [X86] Fix potential issue on memmove

[ling.ma]

From: root <root@glibc-nhm.localdomain>

memmove allow source and destination address to be overlap, 
but no limitation for memcpy. So memmove use forward or
backward copy mode to handle src > dest and dest > src cases respectively.
However memcpy has not address overlap, it may use any copy mode
theoretically. Our original memmove will call memcpy and assume
it must use forward copy mode, otherwise the system will crash,
it is potential issue. The patch avoid assumption, meanwhile
re-active patch id a1e5278e40f16a4611264f8da9e557c16cb6f6ed,
which will use forward/backward copy mode according to offset address.

Signed-off-by: Ma Ling <ling.ma@intel.com>
---
In this version we try to keep and optimize original memmove.

 arch/x86/lib/memcpy_32.c  |   38 ++++++++++++++++++++++++++----------
 arch/x86/lib/memmove_64.c |   46 ++++++++++++++++++++++++++++++++++++++++----
 2 files changed, 68 insertions(+), 16 deletions(-)

diff --git a/arch/x86/lib/memcpy_32.c b/arch/x86/lib/memcpy_32.c
index 5415a9d..be424df 100644
--- a/arch/x86/lib/memcpy_32.c
+++ b/arch/x86/lib/memcpy_32.c
@@ -25,19 +25,35 @@ void *memmove(void *dest, const void *src, size_t n)
 	int d0, d1, d2;
 
 	if (dest < src) {
-		memcpy(dest, src, n);
+		if ((dest + n) < src)
+			 return memcpy(dest, src, n);
+		else
+			__asm__ __volatile__(
+				"rep\n\t"
+				"movsb\n\t"
+				: "=&c" (d0), "=&S" (d1), "=&D" (d2)
+				:"0" (n),
+				 "1" (src),
+				 "2" (dest)
+				:"memory");
+
 	} else {
-		__asm__ __volatile__(
-			"std\n\t"
-			"rep\n\t"
-			"movsb\n\t"
-			"cld"
-			: "=&c" (d0), "=&S" (d1), "=&D" (d2)
-			:"0" (n),
-			 "1" (n-1+src),
-			 "2" (n-1+dest)
-			:"memory");
+
+		if((src + count) < dest)
+			return memcpy(dest, src, count);
+		else
+			__asm__ __volatile__(
+				"std\n\t"
+				"rep\n\t"
+				"movsb\n\t"
+				"cld"
+				: "=&c" (d0), "=&S" (d1), "=&D" (d2)
+				:"0" (n),
+				 "1" (n-1+src),
+				 "2" (n-1+dest)
+				:"memory");
 	}
+
 	return dest;
 }
 EXPORT_SYMBOL(memmove);
diff --git a/arch/x86/lib/memmove_64.c b/arch/x86/lib/memmove_64.c
index 0a33909..ecacc4b 100644
--- a/arch/x86/lib/memmove_64.c
+++ b/arch/x86/lib/memmove_64.c
@@ -8,13 +8,49 @@
 #undef memmove
 void *memmove(void *dest, const void *src, size_t count)
 {
+	unsigned long d0, d1, d2, d3;
 	if (dest < src) {
-		return memcpy(dest, src, count);
+		if ((dest + count) < src)
+			 return memcpy(dest, src, count);
+		else
+			__asm__ __volatile__(
+				"movq %0, %3\n\t"
+				"shr $3, %0\n\t"
+				"andq $7, %3\n\t"
+				"rep\n\t"
+				"movsq\n\t"
+				"movq %3, %0\n\t"
+				"rep\n\t"
+				"movsb"
+				: "=&c" (d0), "=&S" (d1), "=&D" (d2), "=r" (d3)
+				:"0" (count),
+				 "1" (src),
+				 "2" (dest)
+				:"memory");
 	} else {
-		char *p = dest + count;
-		const char *s = src + count;
-		while (count--)
-			*--p = *--s;
+		if((src + count) < dest)
+			return memcpy(dest, src, count);
+		else
+			__asm__ __volatile__(
+				"movq %0, %3\n\t"
+				"lea -8(%1, %0), %1\n\t"
+				"lea -8(%2, %0), %2\n\t"
+				"shr $3, %0\n\t"
+				"andq $7, %3\n\t"
+				"std\n\t"
+				"rep\n\t"
+				"movsq\n\t"
+				"lea 7(%1), %1\n\t"
+				"lea 7(%2), %2\n\t"
+				"movq %3, %0\n\t"
+				"rep\n\t"
+				"movsb\n\t"
+				"cld"
+				: "=&c" (d0), "=&S" (d1), "=&D" (d2), "=r" (d3)
+				:"0" (count),
+				 "1" (src),
+				 "2" (dest)
+				:"memory");
 	}
 	return dest;
 }
-- 
1.6.5.2