[PATCH v2] arm64: Add ASM modifier for xN register operands

[PATCH v2] arm64: Add ASM modifier for xN register operands

[Matthias Kaehlcke]

Many inline assembly statements don't include the 'x' modifier when
using xN registers as operands. This is perfectly valid, however it
causes clang to raise warnings like this:

warning: value size does not match register size specified by the
  constraint and modifier [-Wasm-operand-widths]
...
arch/arm64/include/asm/barrier.h:62:23: note: expanded from macro
  '__smp_store_release'
    asm volatile ("stlr %1, %0"

Add the modifiers to keep clang happy.

Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
---
Changes in v2:
- also add modifiers to multiline ASM statements in include/asm/
  {atomic_ll_sc.h,irqflags.h,pgtable.h,uaccess.h,word-at-a-time.h}
  that were missed on v1

 arch/arm64/include/asm/arch_gicv3.h     |  2 +-
 arch/arm64/include/asm/atomic_ll_sc.h   | 36 ++++++++++++++++-----------------
 arch/arm64/include/asm/barrier.h        |  4 ++--
 arch/arm64/include/asm/io.h             | 24 +++++++++++-----------
 arch/arm64/include/asm/irqflags.h       | 10 ++++-----
 arch/arm64/include/asm/kvm_hyp.h        | 10 ++++-----
 arch/arm64/include/asm/kvm_mmu.h        | 12 +++++------
 arch/arm64/include/asm/percpu.h         |  4 ++--
 arch/arm64/include/asm/pgtable.h        | 20 +++++++++---------
 arch/arm64/include/asm/sysreg.h         |  4 ++--
 arch/arm64/include/asm/uaccess.h        | 14 ++++++-------
 arch/arm64/include/asm/word-at-a-time.h | 14 ++++++-------
 arch/arm64/kernel/armv8_deprecated.c    |  4 ++--
 arch/arm64/kernel/probes/kprobes.c      |  2 +-
 arch/arm64/kvm/hyp/switch.c             |  4 ++--
 15 files changed, 82 insertions(+), 82 deletions(-)

diff --git a/arch/arm64/include/asm/arch_gicv3.h b/arch/arm64/include/asm/arch_gicv3.h
index f37e3a21f6e7..ba54e5bee885 100644
--- a/arch/arm64/include/asm/arch_gicv3.h
+++ b/arch/arm64/include/asm/arch_gicv3.h
@@ -166,7 +166,7 @@ static inline void gic_write_sre(u32 val)
 
 static inline void gic_write_bpr1(u32 val)
 {
-	asm volatile("msr_s " __stringify(ICC_BPR1_EL1) ", %0" : : "r" (val));
+	asm volatile("msr_s " __stringify(ICC_BPR1_EL1) ", %x0" : : "r" (val));
 }
 
 #define gic_read_typer(c)		readq_relaxed(c)
diff --git a/arch/arm64/include/asm/atomic_ll_sc.h b/arch/arm64/include/asm/atomic_ll_sc.h
index f819fdcff1ac..81f0088e3f11 100644
--- a/arch/arm64/include/asm/atomic_ll_sc.h
+++ b/arch/arm64/include/asm/atomic_ll_sc.h
@@ -140,9 +140,9 @@ __LL_SC_PREFIX(atomic64_##op(long i, atomic64_t *v))			\
 									\
 	asm volatile("// atomic64_" #op "\n"				\
 "	prfm	pstl1strm, %2\n"					\
-"1:	ldxr	%0, %2\n"						\
-"	" #asm_op "	%0, %0, %3\n"					\
-"	stxr	%w1, %0, %2\n"						\
+"1:	ldxr	%x0, %2\n"						\
+"	" #asm_op "	%x0, %x0, %3\n"					\
+"	stxr	%w1, %x0, %2\n"						\
 "	cbnz	%w1, 1b"						\
 	: "=&r" (result), "=&r" (tmp), "+Q" (v->counter)		\
 	: "Ir" (i));							\
@@ -158,9 +158,9 @@ __LL_SC_PREFIX(atomic64_##op##_return##name(long i, atomic64_t *v))	\
 									\
 	asm volatile("// atomic64_" #op "_return" #name "\n"		\
 "	prfm	pstl1strm, %2\n"					\
-"1:	ld" #acq "xr	%0, %2\n"					\
-"	" #asm_op "	%0, %0, %3\n"					\
-"	st" #rel "xr	%w1, %0, %2\n"					\
+"1:	ld" #acq "xr	%x0, %2\n"					\
+"	" #asm_op "	%x0, %x0, %3\n"					\
+"	st" #rel "xr	%w1, %x0, %2\n"					\
 "	cbnz	%w1, 1b\n"						\
 "	" #mb								\
 	: "=&r" (result), "=&r" (tmp), "+Q" (v->counter)		\
@@ -180,9 +180,9 @@ __LL_SC_PREFIX(atomic64_fetch_##op##name(long i, atomic64_t *v))	\
 									\
 	asm volatile("// atomic64_fetch_" #op #name "\n"		\
 "	prfm	pstl1strm, %3\n"					\
-"1:	ld" #acq "xr	%0, %3\n"					\
-"	" #asm_op "	%1, %0, %4\n"					\
-"	st" #rel "xr	%w2, %1, %3\n"					\
+"1:	ld" #acq "xr	%x0, %3\n"					\
+"	" #asm_op "	%x1, %x0, %4\n"					\
+"	st" #rel "xr	%w2, %x1, %3\n"					\
 "	cbnz	%w2, 1b\n"						\
 "	" #mb								\
 	: "=&r" (result), "=&r" (val), "=&r" (tmp), "+Q" (v->counter)	\
@@ -233,10 +233,10 @@ __LL_SC_PREFIX(atomic64_dec_if_positive(atomic64_t *v))
 
 	asm volatile("// atomic64_dec_if_positive\n"
 "	prfm	pstl1strm, %2\n"
-"1:	ldxr	%0, %2\n"
-"	subs	%0, %0, #1\n"
+"1:	ldxr	%x0, %2\n"
+"	subs	%x0, %x0, #1\n"
 "	b.lt	2f\n"
-"	stlxr	%w1, %0, %2\n"
+"	stlxr	%w1, %x0, %2\n"
 "	cbnz	%w1, 1b\n"
 "	dmb	ish\n"
 "2:"
@@ -306,12 +306,12 @@ __LL_SC_PREFIX(__cmpxchg_double##name(unsigned long old1,		\
 									\
 	asm volatile("// __cmpxchg_double" #name "\n"			\
 	"	prfm	pstl1strm, %2\n"				\
-	"1:	ldxp	%0, %1, %2\n"					\
-	"	eor	%0, %0, %3\n"					\
-	"	eor	%1, %1, %4\n"					\
-	"	orr	%1, %0, %1\n"					\
-	"	cbnz	%1, 2f\n"					\
-	"	st" #rel "xp	%w0, %5, %6, %2\n"			\
+	"1:	ldxp	%x0, %x1, %2\n"					\
+	"	eor	%x0, %x0, %x3\n"				\
+	"	eor	%x1, %x1, %x4\n"				\
+	"	orr	%x1, %x0, %x1\n"				\
+	"	cbnz	%x1, 2f\n"					\
+	"	st" #rel "xp	%w0, %x5, %x6, %2\n"			\
 	"	cbnz	%w0, 1b\n"					\
 	"	" #mb "\n"						\
 	"2:"								\
diff --git a/arch/arm64/include/asm/barrier.h b/arch/arm64/include/asm/barrier.h
index 4e0497f581a0..bc167eeda9e4 100644
--- a/arch/arm64/include/asm/barrier.h
+++ b/arch/arm64/include/asm/barrier.h
@@ -59,7 +59,7 @@ do {									\
 				: "=Q" (*p) : "r" (v) : "memory");	\
 		break;							\
 	case 8:								\
-		asm volatile ("stlr %1, %0"				\
+		asm volatile ("stlr %x1, %0"				\
 				: "=Q" (*p) : "r" (v) : "memory");	\
 		break;							\
 	}								\
@@ -86,7 +86,7 @@ do {									\
 			: "Q" (*p) : "memory");				\
 		break;							\
 	case 8:								\
-		asm volatile ("ldar %0, %1"				\
+		asm volatile ("ldar %x0, %1"				\
 			: "=r" (*(__u64 *)__u.__c)			\
 			: "Q" (*p) : "memory");				\
 		break;							\
diff --git a/arch/arm64/include/asm/io.h b/arch/arm64/include/asm/io.h
index 0c00c87bb9dd..021e1733da0c 100644
--- a/arch/arm64/include/asm/io.h
+++ b/arch/arm64/include/asm/io.h
@@ -39,33 +39,33 @@
 #define __raw_writeb __raw_writeb
 static inline void __raw_writeb(u8 val, volatile void __iomem *addr)
 {
-	asm volatile("strb %w0, [%1]" : : "rZ" (val), "r" (addr));
+	asm volatile("strb %w0, [%x1]" : : "rZ" (val), "r" (addr));
 }
 
 #define __raw_writew __raw_writew
 static inline void __raw_writew(u16 val, volatile void __iomem *addr)
 {
-	asm volatile("strh %w0, [%1]" : : "rZ" (val), "r" (addr));
+	asm volatile("strh %w0, [%x1]" : : "rZ" (val), "r" (addr));
 }
 
 #define __raw_writel __raw_writel
 static inline void __raw_writel(u32 val, volatile void __iomem *addr)
 {
-	asm volatile("str %w0, [%1]" : : "rZ" (val), "r" (addr));
+	asm volatile("str %w0, [%x1]" : : "rZ" (val), "r" (addr));
 }
 
 #define __raw_writeq __raw_writeq
 static inline void __raw_writeq(u64 val, volatile void __iomem *addr)
 {
-	asm volatile("str %x0, [%1]" : : "rZ" (val), "r" (addr));
+	asm volatile("str %x0, [%x1]" : : "rZ" (val), "r" (addr));
 }
 
 #define __raw_readb __raw_readb
 static inline u8 __raw_readb(const volatile void __iomem *addr)
 {
 	u8 val;
-	asm volatile(ALTERNATIVE("ldrb %w0, [%1]",
-				 "ldarb %w0, [%1]",
+	asm volatile(ALTERNATIVE("ldrb %w0, [%x1]",
+				 "ldarb %w0, [%x1]",
 				 ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE)
 		     : "=r" (val) : "r" (addr));
 	return val;
@@ -76,8 +76,8 @@ static inline u16 __raw_readw(const volatile void __iomem *addr)
 {
 	u16 val;
 
-	asm volatile(ALTERNATIVE("ldrh %w0, [%1]",
-				 "ldarh %w0, [%1]",
+	asm volatile(ALTERNATIVE("ldrh %w0, [%x1]",
+				 "ldarh %w0, [%x1]",
 				 ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE)
 		     : "=r" (val) : "r" (addr));
 	return val;
@@ -87,8 +87,8 @@ static inline u16 __raw_readw(const volatile void __iomem *addr)
 static inline u32 __raw_readl(const volatile void __iomem *addr)
 {
 	u32 val;
-	asm volatile(ALTERNATIVE("ldr %w0, [%1]",
-				 "ldar %w0, [%1]",
+	asm volatile(ALTERNATIVE("ldr %w0, [%x1]",
+				 "ldar %w0, [%x1]",
 				 ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE)
 		     : "=r" (val) : "r" (addr));
 	return val;
@@ -98,8 +98,8 @@ static inline u32 __raw_readl(const volatile void __iomem *addr)
 static inline u64 __raw_readq(const volatile void __iomem *addr)
 {
 	u64 val;
-	asm volatile(ALTERNATIVE("ldr %0, [%1]",
-				 "ldar %0, [%1]",
+	asm volatile(ALTERNATIVE("ldr %x0, [%x1]",
+				 "ldar %x0, [%x1]",
 				 ARM64_WORKAROUND_DEVICE_LOAD_ACQUIRE)
 		     : "=r" (val) : "r" (addr));
 	return val;
diff --git a/arch/arm64/include/asm/irqflags.h b/arch/arm64/include/asm/irqflags.h
index 8c581281fa12..b30d9373c4dc 100644
--- a/arch/arm64/include/asm/irqflags.h
+++ b/arch/arm64/include/asm/irqflags.h
@@ -27,7 +27,7 @@ static inline unsigned long arch_local_irq_save(void)
 {
 	unsigned long flags;
 	asm volatile(
-		"mrs	%0, daif		// arch_local_irq_save\n"
+		"mrs	%x0, daif		// arch_local_irq_save\n"
 		"msr	daifset, #2"
 		: "=r" (flags)
 		:
@@ -66,7 +66,7 @@ static inline unsigned long arch_local_save_flags(void)
 {
 	unsigned long flags;
 	asm volatile(
-		"mrs	%0, daif		// arch_local_save_flags"
+		"mrs	%x0, daif		// arch_local_save_flags"
 		: "=r" (flags)
 		:
 		: "memory");
@@ -79,7 +79,7 @@ static inline unsigned long arch_local_save_flags(void)
 static inline void arch_local_irq_restore(unsigned long flags)
 {
 	asm volatile(
-		"msr	daif, %0		// arch_local_irq_restore"
+		"msr	daif, %x0		// arch_local_irq_restore"
 	:
 	: "r" (flags)
 	: "memory");
@@ -97,7 +97,7 @@ static inline int arch_irqs_disabled_flags(unsigned long flags)
 	do {								\
 		typecheck(unsigned long, flags);			\
 		asm volatile(						\
-		"mrs    %0, daif		// local_dbg_save\n"	\
+		"mrs    %x0, daif		// local_dbg_save\n"	\
 		"msr    daifset, #8"					\
 		: "=r" (flags) : : "memory");				\
 	} while (0)
@@ -106,7 +106,7 @@ static inline int arch_irqs_disabled_flags(unsigned long flags)
 	do {								\
 		typecheck(unsigned long, flags);			\
 		asm volatile(						\
-		"msr    daif, %0		// local_dbg_restore\n"	\
+		"msr    daif, %x0		// local_dbg_restore\n"	\
 		: : "r" (flags) : "memory");				\
 	} while (0)
 
diff --git a/arch/arm64/include/asm/kvm_hyp.h b/arch/arm64/include/asm/kvm_hyp.h
index b18e852d27e8..ee872d9aded5 100644
--- a/arch/arm64/include/asm/kvm_hyp.h
+++ b/arch/arm64/include/asm/kvm_hyp.h
@@ -28,8 +28,8 @@
 #define read_sysreg_elx(r,nvh,vh)					\
 	({								\
 		u64 reg;						\
-		asm volatile(ALTERNATIVE("mrs %0, " __stringify(r##nvh),\
-					 "mrs_s %0, " __stringify(r##vh),\
+		asm volatile(ALTERNATIVE("mrs %x0, " __stringify(r##nvh),\
+					 "mrs_s %x0, " __stringify(r##vh),\
 					 ARM64_HAS_VIRT_HOST_EXTN)	\
 			     : "=r" (reg));				\
 		reg;							\
@@ -52,8 +52,8 @@
 #define read_sysreg_el2(r)						\
 	({								\
 		u64 reg;						\
-		asm volatile(ALTERNATIVE("mrs %0, " __stringify(r##_EL2),\
-					 "mrs %0, " __stringify(r##_EL1),\
+		asm volatile(ALTERNATIVE("mrs %x0, " __stringify(r##_EL2),\
+					 "mrs %x0, " __stringify(r##_EL1),\
 					 ARM64_HAS_VIRT_HOST_EXTN)	\
 			     : "=r" (reg));				\
 		reg;							\
@@ -115,7 +115,7 @@ typeof(orig) * __hyp_text fname(void)					\
 {									\
 	typeof(alt) *val = orig;					\
 	asm volatile(ALTERNATIVE("nop		\n",			\
-				 "mov	%0, %1	\n",			\
+				 "mov	%x0, %x1\n",			\
 				 cond)					\
 		     : "+r" (val) : "r" (alt));				\
 	return val;							\
diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
index ed1246014901..7692a13efe8e 100644
--- a/arch/arm64/include/asm/kvm_mmu.h
+++ b/arch/arm64/include/asm/kvm_mmu.h
@@ -115,13 +115,13 @@ alternative_else_nop_endif
 
 static inline unsigned long __kern_hyp_va(unsigned long v)
 {
-	asm volatile(ALTERNATIVE("and %0, %0, %1",
+	asm volatile(ALTERNATIVE("and %x0, %x0, %1",
 				 "nop",
 				 ARM64_HAS_VIRT_HOST_EXTN)
 		     : "+r" (v)
 		     : "i" (HYP_PAGE_OFFSET_HIGH_MASK));
 	asm volatile(ALTERNATIVE("nop",
-				 "and %0, %0, %1",
+				 "and %x0, %x0, %1",
 				 ARM64_HYP_OFFSET_LOW)
 		     : "+r" (v)
 		     : "i" (HYP_PAGE_OFFSET_LOW_MASK));
@@ -181,10 +181,10 @@ static inline void kvm_set_s2pte_readonly(pte_t *pte)
 
 	asm volatile("//	kvm_set_s2pte_readonly\n"
 	"	prfm	pstl1strm, %2\n"
-	"1:	ldxr	%0, %2\n"
-	"	and	%0, %0, %3		// clear PTE_S2_RDWR\n"
-	"	orr	%0, %0, %4		// set PTE_S2_RDONLY\n"
-	"	stxr	%w1, %0, %2\n"
+	"1:	ldxr	%x0, %2\n"
+	"	and	%x0, %x0, %3		// clear PTE_S2_RDWR\n"
+	"	orr	%x0, %x0, %4		// set PTE_S2_RDONLY\n"
+	"	stxr	%w1, %x0, %2\n"
 	"	cbnz	%w1, 1b\n"
 	: "=&r" (pteval), "=&r" (tmp), "+Q" (pte_val(*pte))
 	: "L" (~PTE_S2_RDWR), "L" (PTE_S2_RDONLY));
diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h
index 3bd498e4de4c..52be13171fec 100644
--- a/arch/arm64/include/asm/percpu.h
+++ b/arch/arm64/include/asm/percpu.h
@@ -20,7 +20,7 @@
 
 static inline void set_my_cpu_offset(unsigned long off)
 {
-	asm volatile("msr tpidr_el1, %0" :: "r" (off) : "memory");
+	asm volatile("msr tpidr_el1, %x0" :: "r" (off) : "memory");
 }
 
 static inline unsigned long __my_cpu_offset(void)
@@ -31,7 +31,7 @@ static inline unsigned long __my_cpu_offset(void)
 	 * We want to allow caching the value, so avoid using volatile and
 	 * instead use a fake stack read to hazard against barrier().
 	 */
-	asm("mrs %0, tpidr_el1" : "=r" (off) :
+	asm("mrs %x0, tpidr_el1" : "=r" (off) :
 		"Q" (*(const unsigned long *)current_stack_pointer));
 
 	return off;
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 0eef6064bf3b..0035fdc25cbe 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -588,10 +588,10 @@ static inline int __ptep_test_and_clear_young(pte_t *ptep)
 
 	asm volatile("//	__ptep_test_and_clear_young\n"
 	"	prfm	pstl1strm, %2\n"
-	"1:	ldxr	%0, %2\n"
+	"1:	ldxr	%x0, %2\n"
 	"	ubfx	%w3, %w0, %5, #1	// extract PTE_AF (young)\n"
-	"	and	%0, %0, %4		// clear PTE_AF\n"
-	"	stxr	%w1, %0, %2\n"
+	"	and	%x0, %x0, %4		// clear PTE_AF\n"
+	"	stxr	%w1, %x0, %2\n"
 	"	cbnz	%w1, 1b\n"
 	: "=&r" (pteval), "=&r" (tmp), "+Q" (pte_val(*ptep)), "=&r" (res)
 	: "L" (~PTE_AF), "I" (ilog2(PTE_AF)));
@@ -625,7 +625,7 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm,
 
 	asm volatile("//	ptep_get_and_clear\n"
 	"	prfm	pstl1strm, %2\n"
-	"1:	ldxr	%0, %2\n"
+	"1:	ldxr	%x0, %2\n"
 	"	stxr	%w1, xzr, %2\n"
 	"	cbnz	%w1, 1b\n"
 	: "=&r" (old_pteval), "=&r" (tmp), "+Q" (pte_val(*ptep)));
@@ -654,12 +654,12 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addres
 
 	asm volatile("//	ptep_set_wrprotect\n"
 	"	prfm	pstl1strm, %2\n"
-	"1:	ldxr	%0, %2\n"
-	"	tst	%0, %4			// check for hw dirty (!PTE_RDONLY)\n"
-	"	csel	%1, %3, xzr, eq		// set PTE_DIRTY|PTE_RDONLY if dirty\n"
-	"	orr	%0, %0, %1		// if !dirty, PTE_RDONLY is already set\n"
-	"	and	%0, %0, %5		// clear PTE_WRITE/PTE_DBM\n"
-	"	stxr	%w1, %0, %2\n"
+	"1:	ldxr	%x0, %2\n"
+	"	tst	%x0, %4			// check for hw dirty (!PTE_RDONLY)\n"
+	"	csel	%x1, %x3, xzr, eq	// set PTE_DIRTY|PTE_RDONLY if dirty\n"
+	"	orr	%x0, %x0, %x1		// if !dirty, PTE_RDONLY is already set\n"
+	"	and	%x0, %x0, %5		// clear PTE_WRITE/PTE_DBM\n"
+	"	stxr	%w1, %x0, %2\n"
 	"	cbnz	%w1, 1b\n"
 	: "=&r" (pteval), "=&r" (tmp), "+Q" (pte_val(*ptep))
 	: "r" (PTE_DIRTY|PTE_RDONLY), "L" (PTE_RDONLY), "L" (~PTE_WRITE)
diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
index ac24b6e798b1..dd7768e114e3 100644
--- a/arch/arm64/include/asm/sysreg.h
+++ b/arch/arm64/include/asm/sysreg.h
@@ -309,7 +309,7 @@ asm(
  */
 #define read_sysreg(r) ({					\
 	u64 __val;						\
-	asm volatile("mrs %0, " __stringify(r) : "=r" (__val));	\
+	asm volatile("mrs %x0, " __stringify(r) : "=r" (__val));	\
 	__val;							\
 })
 
@@ -329,7 +329,7 @@ asm(
  */
 #define read_sysreg_s(r) ({						\
 	u64 __val;							\
-	asm volatile("mrs_s %0, " __stringify(r) : "=r" (__val));	\
+	asm volatile("mrs_s %x0, " __stringify(r) : "=r" (__val));	\
 	__val;								\
 })
 
diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
index 5308d696311b..4b683b81efa3 100644
--- a/arch/arm64/include/asm/uaccess.h
+++ b/arch/arm64/include/asm/uaccess.h
@@ -97,7 +97,7 @@ static inline void set_fs(mm_segment_t fs)
 ({									\
 	unsigned long flag, roksum;					\
 	__chk_user_ptr(addr);						\
-	asm("adds %1, %1, %3; ccmp %1, %4, #2, cc; cset %0, ls"		\
+	asm("adds %x1, %x1, %3; ccmp %1, %x4, #2, cc; cset %x0, ls"	\
 		: "=&r" (flag), "=&r" (roksum)				\
 		: "1" (addr), "Ir" (size),				\
 		  "r" (current_thread_info()->addr_limit)		\
@@ -224,8 +224,8 @@ static inline void uaccess_enable_not_uao(void)
  */
 #define __get_user_asm(instr, alt_instr, reg, x, addr, err, feature)	\
 	asm volatile(							\
-	"1:"ALTERNATIVE(instr "     " reg "1, [%2]\n",			\
-			alt_instr " " reg "1, [%2]\n", feature)		\
+	"1:"ALTERNATIVE(instr "     " reg "1, [%x2]\n",			\
+			alt_instr " " reg "1, [%x2]\n", feature)	\
 	"2:\n"								\
 	"	.section .fixup, \"ax\"\n"				\
 	"	.align	2\n"						\
@@ -256,7 +256,7 @@ do {									\
 			       (err), ARM64_HAS_UAO);			\
 		break;							\
 	case 8:								\
-		__get_user_asm("ldr", "ldtr", "%",  __gu_val, (ptr),	\
+		__get_user_asm("ldr", "ldtr", "%x",  __gu_val, (ptr),	\
 			       (err), ARM64_HAS_UAO);			\
 		break;							\
 	default:							\
@@ -292,8 +292,8 @@ do {									\
 
 #define __put_user_asm(instr, alt_instr, reg, x, addr, err, feature)	\
 	asm volatile(							\
-	"1:"ALTERNATIVE(instr "     " reg "1, [%2]\n",			\
-			alt_instr " " reg "1, [%2]\n", feature)		\
+	"1:"ALTERNATIVE(instr "     " reg "1, [%x2]\n",			\
+			alt_instr " " reg "1, [%x2]\n", feature)	\
 	"2:\n"								\
 	"	.section .fixup,\"ax\"\n"				\
 	"	.align	2\n"						\
@@ -323,7 +323,7 @@ do {									\
 			       (err), ARM64_HAS_UAO);			\
 		break;							\
 	case 8:								\
-		__put_user_asm("str", "sttr", "%", __pu_val, (ptr),	\
+		__put_user_asm("str", "sttr", "%x", __pu_val, (ptr),	\
 			       (err), ARM64_HAS_UAO);			\
 		break;							\
 	default:							\
diff --git a/arch/arm64/include/asm/word-at-a-time.h b/arch/arm64/include/asm/word-at-a-time.h
index b0d708ff7f4e..ab884d35780c 100644
--- a/arch/arm64/include/asm/word-at-a-time.h
+++ b/arch/arm64/include/asm/word-at-a-time.h
@@ -68,18 +68,18 @@ static inline unsigned long load_unaligned_zeropad(const void *addr)
 
 	/* Load word from unaligned pointer addr */
 	asm(
-	"1:	ldr	%0, %3\n"
+	"1:	ldr	%x0, %3\n"
 	"2:\n"
 	"	.pushsection .fixup,\"ax\"\n"
 	"	.align 2\n"
-	"3:	and	%1, %2, #0x7\n"
-	"	bic	%2, %2, #0x7\n"
-	"	ldr	%0, [%2]\n"
-	"	lsl	%1, %1, #0x3\n"
+	"3:	and	%x1, %x2, #0x7\n"
+	"	bic	%x2, %x2, #0x7\n"
+	"	ldr	%x0, [%x2]\n"
+	"	lsl	%x1, %x1, #0x3\n"
 #ifndef __AARCH64EB__
-	"	lsr	%0, %0, %1\n"
+	"	lsr	%x0, %x0, %x1\n"
 #else
-	"	lsl	%0, %0, %1\n"
+	"	lsl	%x0, %x0, %x1\n"
 #endif
 	"	b	2b\n"
 	"	.popsection\n"
diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c
index 657977e77ec8..a82d5259aab1 100644
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -288,8 +288,8 @@ do {								\
 	uaccess_enable();					\
 	__asm__ __volatile__(					\
 	"	mov		%w3, %w7\n"			\
-	"0:	ldxr"B"		%w2, [%4]\n"			\
-	"1:	stxr"B"		%w0, %w1, [%4]\n"		\
+	"0:	ldxr"B"		%w2, [%x4]\n"			\
+	"1:	stxr"B"		%w0, %w1, [%x4]\n"		\
 	"	cbz		%w0, 2f\n"			\
 	"	sub		%w3, %w3, #1\n"			\
 	"	cbnz		%w3, 0b\n"			\
diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
index c5c45942fb6e..237b0e2e3364 100644
--- a/arch/arm64/kernel/probes/kprobes.c
+++ b/arch/arm64/kernel/probes/kprobes.c
@@ -495,7 +495,7 @@ void __kprobes jprobe_return(void)
 	 * -a special PC to identify it from the other kprobes.
 	 * -restore stack addr to original saved pt_regs
 	 */
-	asm volatile("				mov sp, %0	\n"
+	asm volatile("				mov sp, %x0	\n"
 		     "jprobe_return_break:	brk %1		\n"
 		     :
 		     : "r" (kcb->jprobe_saved_regs.sp),
diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c
index aede1658aeda..cf22fbe3cf06 100644
--- a/arch/arm64/kvm/hyp/switch.c
+++ b/arch/arm64/kvm/hyp/switch.c
@@ -212,7 +212,7 @@ static bool __hyp_text __translate_far_to_hpfar(u64 far, u64 *hpfar)
 	 * saved the guest context yet, and we may return early...
 	 */
 	par = read_sysreg(par_el1);
-	asm volatile("at s1e1r, %0" : : "r" (far));
+	asm volatile("at s1e1r, %x0" : : "r" (far));
 	isb();
 
 	tmp = read_sysreg(par_el1);
@@ -388,7 +388,7 @@ static void __hyp_text __hyp_call_panic_nvhe(u64 spsr, u64 elr, u64 par)
 	 * making sure it is a kernel address and not a PC-relative
 	 * reference.
 	 */
-	asm volatile("ldr %0, =__hyp_panic_string" : "=r" (str_va));
+	asm volatile("ldr %x0, =__hyp_panic_string" : "=r" (str_va));
 
 	__hyp_do_panic(str_va,
 		       spsr,  elr,
-- 
2.13.0.rc0.306.g87b477812d-goog

Re: [PATCH v2] arm64: Add ASM modifier for xN register operands

[Mark Rutland]

Hi,

On Wed, Apr 26, 2017 at 02:46:16PM -0700, Matthias Kaehlcke wrote:
> Many inline assembly statements don't include the 'x' modifier when
> using xN registers as operands. This is perfectly valid, however it
> causes clang to raise warnings like this:
> 
> warning: value size does not match register size specified by the
>   constraint and modifier [-Wasm-operand-widths]
> ...
> arch/arm64/include/asm/barrier.h:62:23: note: expanded from macro
>   '__smp_store_release'
>     asm volatile ("stlr %1, %0"
> 
> Add the modifiers to keep clang happy.

If we're going to make this consistent, it would make sense to similarly
annotate 'w' regs. That will make it easier going forward to enforce a
policy that registers are suitably annotated.

Also, there's a risk that we silently mask a bug here, for which clang's
warning is legitimate, so we need to review this very carefully...

> 
> Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
> ---
> Changes in v2:
> - also add modifiers to multiline ASM statements in include/asm/
>   {atomic_ll_sc.h,irqflags.h,pgtable.h,uaccess.h,word-at-a-time.h}
>   that were missed on v1
> 
>  arch/arm64/include/asm/arch_gicv3.h     |  2 +-
>  arch/arm64/include/asm/atomic_ll_sc.h   | 36 ++++++++++++++++-----------------
>  arch/arm64/include/asm/barrier.h        |  4 ++--
>  arch/arm64/include/asm/io.h             | 24 +++++++++++-----------
>  arch/arm64/include/asm/irqflags.h       | 10 ++++-----
>  arch/arm64/include/asm/kvm_hyp.h        | 10 ++++-----
>  arch/arm64/include/asm/kvm_mmu.h        | 12 +++++------
>  arch/arm64/include/asm/percpu.h         |  4 ++--
>  arch/arm64/include/asm/pgtable.h        | 20 +++++++++---------
>  arch/arm64/include/asm/sysreg.h         |  4 ++--
>  arch/arm64/include/asm/uaccess.h        | 14 ++++++-------
>  arch/arm64/include/asm/word-at-a-time.h | 14 ++++++-------
>  arch/arm64/kernel/armv8_deprecated.c    |  4 ++--
>  arch/arm64/kernel/probes/kprobes.c      |  2 +-
>  arch/arm64/kvm/hyp/switch.c             |  4 ++--
>  15 files changed, 82 insertions(+), 82 deletions(-)

... to that end, could you split these into a few patches?

That way, knowledgeable people can focus their review on the code they
understand.

That doesn't need to be a patch per file; all the KVM bits can be
collated in one patch, for example. However, the atomics, kvm, and
uaccess+word-at-a-time bits should certainly be separate patches given
their (existing) complexity.

Otherwise, I have a couple of comments below.

> diff --git a/arch/arm64/include/asm/arch_gicv3.h b/arch/arm64/include/asm/arch_gicv3.h
> index f37e3a21f6e7..ba54e5bee885 100644
> --- a/arch/arm64/include/asm/arch_gicv3.h
> +++ b/arch/arm64/include/asm/arch_gicv3.h
> @@ -166,7 +166,7 @@ static inline void gic_write_sre(u32 val)
>  
>  static inline void gic_write_bpr1(u32 val)
>  {
> -	asm volatile("msr_s " __stringify(ICC_BPR1_EL1) ", %0" : : "r" (val));
> +	asm volatile("msr_s " __stringify(ICC_BPR1_EL1) ", %x0" : : "r" (val));
>  }

Please make this use write_sysreg_s() instead, i.e.

static inline void gic_write_bpr1(u32 val)
{
	write_sysreg_s(var, ICC_BPR1_EL1);
}

... that uses the 'x' modifier internally, and it's what we do for the
other GIC sysreg accesors.

This accessor was missed by commit:

  d44ffa5ae70a15a1 ("irqchip/gic-v3: Convert arm64 GIC accessors to {read,write}_sysreg_s")

... because it was added concurrently by commitL

  91ef84428a86b75a ("irqchip/gic-v3: Reset BPR during initialization")

... i.e. it was not deliberately omitted.

[...]

> -	asm volatile("strb %w0, [%1]" : : "rZ" (val), "r" (addr));
> +	asm volatile("strb %w0, [%x1]" : : "rZ" (val), "r" (addr));

In general, the '[%xN]' pattern looks *very* suspicious to me. Any
address must be 64-bit, so this would mask a legitimate warning.

Given the prototype of this function the code if fine either way, but
were we to refactor things (e.g. making this a macro), that might not be
true.

... so I'm not sure it make sense to alter instances used for addresses.

Thanks,
Mark.

Re: [PATCH v2] arm64: Add ASM modifier for xN register operands

[Matthias Kaehlcke]

Hi Mark,

Thanks for your comments.

El Thu, Apr 27, 2017 at 12:02:56PM +0100 Mark Rutland ha dit:

> Hi,
> 
> On Wed, Apr 26, 2017 at 02:46:16PM -0700, Matthias Kaehlcke wrote:
> > Many inline assembly statements don't include the 'x' modifier when
> > using xN registers as operands. This is perfectly valid, however it
> > causes clang to raise warnings like this:
> > 
> > warning: value size does not match register size specified by the
> >   constraint and modifier [-Wasm-operand-widths]
> > ...
> > arch/arm64/include/asm/barrier.h:62:23: note: expanded from macro
> >   '__smp_store_release'
> >     asm volatile ("stlr %1, %0"
> > 
> > Add the modifiers to keep clang happy.
> 
> If we're going to make this consistent, it would make sense to similarly
> annotate 'w' regs. That will make it easier going forward to enforce a
> policy that registers are suitably annotated.

Ok

> Also, there's a risk that we silently mask a bug here, for which clang's
> warning is legitimate, so we need to review this very carefully...
>
> > Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
> > ---
> > Changes in v2:
> > - also add modifiers to multiline ASM statements in include/asm/
> >   {atomic_ll_sc.h,irqflags.h,pgtable.h,uaccess.h,word-at-a-time.h}
> >   that were missed on v1
> > 
> >  arch/arm64/include/asm/arch_gicv3.h     |  2 +-
> >  arch/arm64/include/asm/atomic_ll_sc.h   | 36 ++++++++++++++++-----------------
> >  arch/arm64/include/asm/barrier.h        |  4 ++--
> >  arch/arm64/include/asm/io.h             | 24 +++++++++++-----------
> >  arch/arm64/include/asm/irqflags.h       | 10 ++++-----
> >  arch/arm64/include/asm/kvm_hyp.h        | 10 ++++-----
> >  arch/arm64/include/asm/kvm_mmu.h        | 12 +++++------
> >  arch/arm64/include/asm/percpu.h         |  4 ++--
> >  arch/arm64/include/asm/pgtable.h        | 20 +++++++++---------
> >  arch/arm64/include/asm/sysreg.h         |  4 ++--
> >  arch/arm64/include/asm/uaccess.h        | 14 ++++++-------
> >  arch/arm64/include/asm/word-at-a-time.h | 14 ++++++-------
> >  arch/arm64/kernel/armv8_deprecated.c    |  4 ++--
> >  arch/arm64/kernel/probes/kprobes.c      |  2 +-
> >  arch/arm64/kvm/hyp/switch.c             |  4 ++--
> >  15 files changed, 82 insertions(+), 82 deletions(-)
> 
> ... to that end, could you split these into a few patches?
> 
> That way, knowledgeable people can focus their review on the code they
> understand.
> 
> That doesn't need to be a patch per file; all the KVM bits can be
> collated in one patch, for example. However, the atomics, kvm, and
> uaccess+word-at-a-time bits should certainly be separate patches given
> their (existing) complexity.

I agree the patch is too large, I considered to split it up but wasn't
sure where to draw the line(s). Will try to find halfway reasonable
batches :)

> Otherwise, I have a couple of comments below.
> 
> > diff --git a/arch/arm64/include/asm/arch_gicv3.h b/arch/arm64/include/asm/arch_gicv3.h
> > index f37e3a21f6e7..ba54e5bee885 100644
> > --- a/arch/arm64/include/asm/arch_gicv3.h
> > +++ b/arch/arm64/include/asm/arch_gicv3.h
> > @@ -166,7 +166,7 @@ static inline void gic_write_sre(u32 val)
> >  
> >  static inline void gic_write_bpr1(u32 val)
> >  {
> > -	asm volatile("msr_s " __stringify(ICC_BPR1_EL1) ", %0" : : "r" (val));
> > +	asm volatile("msr_s " __stringify(ICC_BPR1_EL1) ", %x0" : : "r" (val));
> >  }
> 
> Please make this use write_sysreg_s() instead, i.e.
> 
> static inline void gic_write_bpr1(u32 val)
> {
> 	write_sysreg_s(var, ICC_BPR1_EL1);
> }
> 
> ... that uses the 'x' modifier internally, and it's what we do for the
> other GIC sysreg accesors.
> 
> This accessor was missed by commit:
> 
>   d44ffa5ae70a15a1 ("irqchip/gic-v3: Convert arm64 GIC accessors to {read,write}_sysreg_s")
> 
> ... because it was added concurrently by commitL
> 
>   91ef84428a86b75a ("irqchip/gic-v3: Reset BPR during initialization")
> 
> ... i.e. it was not deliberately omitted.

Will do

> [...]
> 
> > -	asm volatile("strb %w0, [%1]" : : "rZ" (val), "r" (addr));
> > +	asm volatile("strb %w0, [%x1]" : : "rZ" (val), "r" (addr));
> 
> In general, the '[%xN]' pattern looks *very* suspicious to me. Any
> address must be 64-bit, so this would mask a legitimate warning.
> 
> Given the prototype of this function the code if fine either way, but
> were we to refactor things (e.g. making this a macro), that might not be
> true.
> 
> ... so I'm not sure it make sense to alter instances used for addresses.

Good point, I'll leave instances dealing with addresses untouched for now.

Cheers

Matthias

Re: [PATCH v2] arm64: Add ASM modifier for xN register operands

[Ard Biesheuvel]

On 27 April 2017 at 23:52, Matthias Kaehlcke <mka@chromium.org> wrote:
> Hi Mark,
>
> Thanks for your comments.
>
> El Thu, Apr 27, 2017 at 12:02:56PM +0100 Mark Rutland ha dit:
>
>> Hi,
>>
>> On Wed, Apr 26, 2017 at 02:46:16PM -0700, Matthias Kaehlcke wrote:
>> > Many inline assembly statements don't include the 'x' modifier when
>> > using xN registers as operands. This is perfectly valid, however it
>> > causes clang to raise warnings like this:
>> >
>> > warning: value size does not match register size specified by the
>> >   constraint and modifier [-Wasm-operand-widths]
>> > ...
>> > arch/arm64/include/asm/barrier.h:62:23: note: expanded from macro
>> >   '__smp_store_release'
>> >     asm volatile ("stlr %1, %0"
>> >
>> > Add the modifiers to keep clang happy.
>>
>> If we're going to make this consistent, it would make sense to similarly
>> annotate 'w' regs. That will make it easier going forward to enforce a
>> policy that registers are suitably annotated.
>
> Ok
>
>> Also, there's a risk that we silently mask a bug here, for which clang's
>> warning is legitimate, so we need to review this very carefully...
>>
>> > Signed-off-by: Matthias Kaehlcke <mka@chromium.org>
>> > ---
>> > Changes in v2:
>> > - also add modifiers to multiline ASM statements in include/asm/
>> >   {atomic_ll_sc.h,irqflags.h,pgtable.h,uaccess.h,word-at-a-time.h}
>> >   that were missed on v1
>> >
>> >  arch/arm64/include/asm/arch_gicv3.h     |  2 +-
>> >  arch/arm64/include/asm/atomic_ll_sc.h   | 36 ++++++++++++++++-----------------
>> >  arch/arm64/include/asm/barrier.h        |  4 ++--
>> >  arch/arm64/include/asm/io.h             | 24 +++++++++++-----------
>> >  arch/arm64/include/asm/irqflags.h       | 10 ++++-----
>> >  arch/arm64/include/asm/kvm_hyp.h        | 10 ++++-----
>> >  arch/arm64/include/asm/kvm_mmu.h        | 12 +++++------
>> >  arch/arm64/include/asm/percpu.h         |  4 ++--
>> >  arch/arm64/include/asm/pgtable.h        | 20 +++++++++---------
>> >  arch/arm64/include/asm/sysreg.h         |  4 ++--
>> >  arch/arm64/include/asm/uaccess.h        | 14 ++++++-------
>> >  arch/arm64/include/asm/word-at-a-time.h | 14 ++++++-------
>> >  arch/arm64/kernel/armv8_deprecated.c    |  4 ++--
>> >  arch/arm64/kernel/probes/kprobes.c      |  2 +-
>> >  arch/arm64/kvm/hyp/switch.c             |  4 ++--
>> >  15 files changed, 82 insertions(+), 82 deletions(-)
>>
>> ... to that end, could you split these into a few patches?
>>
>> That way, knowledgeable people can focus their review on the code they
>> understand.
>>
>> That doesn't need to be a patch per file; all the KVM bits can be
>> collated in one patch, for example. However, the atomics, kvm, and
>> uaccess+word-at-a-time bits should certainly be separate patches given
>> their (existing) complexity.
>
> I agree the patch is too large, I considered to split it up but wasn't
> sure where to draw the line(s). Will try to find halfway reasonable
> batches :)
>
>> Otherwise, I have a couple of comments below.
>>
>> > diff --git a/arch/arm64/include/asm/arch_gicv3.h b/arch/arm64/include/asm/arch_gicv3.h
>> > index f37e3a21f6e7..ba54e5bee885 100644
>> > --- a/arch/arm64/include/asm/arch_gicv3.h
>> > +++ b/arch/arm64/include/asm/arch_gicv3.h
>> > @@ -166,7 +166,7 @@ static inline void gic_write_sre(u32 val)
>> >
>> >  static inline void gic_write_bpr1(u32 val)
>> >  {
>> > -   asm volatile("msr_s " __stringify(ICC_BPR1_EL1) ", %0" : : "r" (val));
>> > +   asm volatile("msr_s " __stringify(ICC_BPR1_EL1) ", %x0" : : "r" (val));
>> >  }
>>
>> Please make this use write_sysreg_s() instead, i.e.
>>
>> static inline void gic_write_bpr1(u32 val)
>> {
>>       write_sysreg_s(var, ICC_BPR1_EL1);
>> }
>>
>> ... that uses the 'x' modifier internally, and it's what we do for the
>> other GIC sysreg accesors.
>>
>> This accessor was missed by commit:
>>
>>   d44ffa5ae70a15a1 ("irqchip/gic-v3: Convert arm64 GIC accessors to {read,write}_sysreg_s")
>>
>> ... because it was added concurrently by commitL
>>
>>   91ef84428a86b75a ("irqchip/gic-v3: Reset BPR during initialization")
>>
>> ... i.e. it was not deliberately omitted.
>
> Will do
>
>> [...]
>>
>> > -   asm volatile("strb %w0, [%1]" : : "rZ" (val), "r" (addr));
>> > +   asm volatile("strb %w0, [%x1]" : : "rZ" (val), "r" (addr));
>>
>> In general, the '[%xN]' pattern looks *very* suspicious to me. Any
>> address must be 64-bit, so this would mask a legitimate warning.
>>
>> Given the prototype of this function the code if fine either way, but
>> were we to refactor things (e.g. making this a macro), that might not be
>> true.
>>
>> ... so I'm not sure it make sense to alter instances used for addresses.
>
> Good point, I'll leave instances dealing with addresses untouched for now.
>

OK, I am confused now. We started this thread under the assumption
that all unqualified placeholders are warned about by Clang. Given
that this appears not to be the case, could we please first find out
what causes the warnings? Is it necessary at all to add the x
modifiers for 64-bit types?

Re: [PATCH v2] arm64: Add ASM modifier for xN register operands

[Mark Rutland]

On Fri, Apr 28, 2017 at 08:18:52AM +0100, Ard Biesheuvel wrote:
> On 27 April 2017 at 23:52, Matthias Kaehlcke <mka@chromium.org> wrote:
> > El Thu, Apr 27, 2017 at 12:02:56PM +0100 Mark Rutland ha dit:
> >> On Wed, Apr 26, 2017 at 02:46:16PM -0700, Matthias Kaehlcke wrote:

> >> > -   asm volatile("strb %w0, [%1]" : : "rZ" (val), "r" (addr));
> >> > +   asm volatile("strb %w0, [%x1]" : : "rZ" (val), "r" (addr));
> >>
> >> In general, the '[%xN]' pattern looks *very* suspicious to me. Any
> >> address must be 64-bit, so this would mask a legitimate warning.
> >>
> >> Given the prototype of this function the code if fine either way, but
> >> were we to refactor things (e.g. making this a macro), that might not be
> >> true.
> >>
> >> ... so I'm not sure it make sense to alter instances used for addresses.
> >
> > Good point, I'll leave instances dealing with addresses untouched for now.
> >
> 
> OK, I am confused now. We started this thread under the assumption
> that all unqualified placeholders are warned about by Clang. Given
> that this appears not to be the case, could we please first find out
> what causes the warnings?

Yes please.

> Is it necessary at all to add the x modifiers for 64-bit types?

Having delved a little deeper, I think this is actively harmful, and
clang's warning indicates potential problems even when compiling with
GCC.

The below test simulates how we might write to control regs and so on,
with a mov in asm simulating something like an msr.

---->8----
#include <stdio.h>

static inline unsigned long generate_val(void)
{
        unsigned long val;

        /* hide value generation from GCC */
        asm (
                "movn %0, #0"
                : "=r" (val)
        );

        return val;
}

static inline unsigned long use_val_32(unsigned int in)
{
        unsigned long out;

	/* simulate what we might write to a sysreg */
        asm (
                "mov %x0, %x1"
                : "=r" (out)
                : "r" (in)
        );

        return out;
}

int main(int argc, char *argv)
{
        printf("32-bit val is: 0x%016lx\n", use_val_32(generate_val()));

        return 0;
}
---->8----

Depending on optimization level, bits that we do not expect can flow through:

$ gcc test.c -o test
$ ./test
32-bit val is: 0x00000000ffffffff
$ gcc test.c -O1 -o test
$ ./test
32-bit val is: 0xffffffffffffffff
$ gcc test.c -O2 -o test
$ ./test
32-bit val is: 0xffffffffffffffff

... that could be disastrous depending on how the result was used.

With "in" cast to an unsigned long, the compiler realises it needs to perform
any necessary truncation itself:

$ gcc test.c -o test
$ ./test
32-bit val is: 0x00000000ffffffff
$ gcc test.c -O1 -o test
$ ./test
32-bit val is: 0x00000000ffffffff
$ gcc test.c -O2 -o test
$ ./test
32-bit val is: 0x00000000ffffffff
$ gcc test.c -O3 -o test
$ ./test
32-bit val is: 0x00000000ffffffff

I think that the correct fix is to use intermediate 64-bit variables, or
casts, so that the compiler *must* use an x register, and consequently
guarantees that all 64-bits of the register are as we expect.

Thanks,
Mark.

Re: [PATCH v2] arm64: Add ASM modifier for xN register operands

[Ard Biesheuvel]

On 28 April 2017 at 10:53, Mark Rutland <mark.rutland@arm.com> wrote:
> On Fri, Apr 28, 2017 at 08:18:52AM +0100, Ard Biesheuvel wrote:
>> On 27 April 2017 at 23:52, Matthias Kaehlcke <mka@chromium.org> wrote:
>> > El Thu, Apr 27, 2017 at 12:02:56PM +0100 Mark Rutland ha dit:
>> >> On Wed, Apr 26, 2017 at 02:46:16PM -0700, Matthias Kaehlcke wrote:
>
>> >> > -   asm volatile("strb %w0, [%1]" : : "rZ" (val), "r" (addr));
>> >> > +   asm volatile("strb %w0, [%x1]" : : "rZ" (val), "r" (addr));
>> >>
>> >> In general, the '[%xN]' pattern looks *very* suspicious to me. Any
>> >> address must be 64-bit, so this would mask a legitimate warning.
>> >>
>> >> Given the prototype of this function the code if fine either way, but
>> >> were we to refactor things (e.g. making this a macro), that might not be
>> >> true.
>> >>
>> >> ... so I'm not sure it make sense to alter instances used for addresses.
>> >
>> > Good point, I'll leave instances dealing with addresses untouched for now.
>> >
>>
>> OK, I am confused now. We started this thread under the assumption
>> that all unqualified placeholders are warned about by Clang. Given
>> that this appears not to be the case, could we please first find out
>> what causes the warnings?
>
> Yes please.
>
>> Is it necessary at all to add the x modifiers for 64-bit types?
>
> Having delved a little deeper, I think this is actively harmful, and
> clang's warning indicates potential problems even when compiling with
> GCC.
>
> The below test simulates how we might write to control regs and so on,
> with a mov in asm simulating something like an msr.
>
> ---->8----
> #include <stdio.h>
>
> static inline unsigned long generate_val(void)
> {
>         unsigned long val;
>
>         /* hide value generation from GCC */
>         asm (
>                 "movn %0, #0"
>                 : "=r" (val)
>         );
>
>         return val;
> }
>
> static inline unsigned long use_val_32(unsigned int in)
> {
>         unsigned long out;
>
>         /* simulate what we might write to a sysreg */
>         asm (
>                 "mov %x0, %x1"
>                 : "=r" (out)
>                 : "r" (in)
>         );
>
>         return out;
> }
>
> int main(int argc, char *argv)
> {
>         printf("32-bit val is: 0x%016lx\n", use_val_32(generate_val()));
>
>         return 0;
> }
> ---->8----
>
> Depending on optimization level, bits that we do not expect can flow through:
>
> $ gcc test.c -o test
> $ ./test
> 32-bit val is: 0x00000000ffffffff
> $ gcc test.c -O1 -o test
> $ ./test
> 32-bit val is: 0xffffffffffffffff
> $ gcc test.c -O2 -o test
> $ ./test
> 32-bit val is: 0xffffffffffffffff
>
> ... that could be disastrous depending on how the result was used.
>
> With "in" cast to an unsigned long, the compiler realises it needs to perform
> any necessary truncation itself:
>
> $ gcc test.c -o test
> $ ./test
> 32-bit val is: 0x00000000ffffffff
> $ gcc test.c -O1 -o test
> $ ./test
> 32-bit val is: 0x00000000ffffffff
> $ gcc test.c -O2 -o test
> $ ./test
> 32-bit val is: 0x00000000ffffffff
> $ gcc test.c -O3 -o test
> $ ./test
> 32-bit val is: 0x00000000ffffffff
>
> I think that the correct fix is to use intermediate 64-bit variables, or
> casts, so that the compiler *must* use an x register, and consequently
> guarantees that all 64-bits of the register are as we expect.
>

But do we care about those top bits when writing a 32-bit system
register from a X register?

Re: [PATCH v2] arm64: Add ASM modifier for xN register operands

[Mark Rutland]

On Fri, Apr 28, 2017 at 11:20:21AM +0100, Ard Biesheuvel wrote:
> On 28 April 2017 at 10:53, Mark Rutland <mark.rutland@arm.com> wrote:
> > On Fri, Apr 28, 2017 at 08:18:52AM +0100, Ard Biesheuvel wrote:
> >> On 27 April 2017 at 23:52, Matthias Kaehlcke <mka@chromium.org> wrote:
> >> > El Thu, Apr 27, 2017 at 12:02:56PM +0100 Mark Rutland ha dit:
> >> >> On Wed, Apr 26, 2017 at 02:46:16PM -0700, Matthias Kaehlcke wrote:
> >
> >> >> > -   asm volatile("strb %w0, [%1]" : : "rZ" (val), "r" (addr));
> >> >> > +   asm volatile("strb %w0, [%x1]" : : "rZ" (val), "r" (addr));
> >> >>
> >> >> In general, the '[%xN]' pattern looks *very* suspicious to me. Any
> >> >> address must be 64-bit, so this would mask a legitimate warning.
> >> >>
> >> >> Given the prototype of this function the code if fine either way, but
> >> >> were we to refactor things (e.g. making this a macro), that might not be
> >> >> true.
> >> >>
> >> >> ... so I'm not sure it make sense to alter instances used for addresses.
> >> >
> >> > Good point, I'll leave instances dealing with addresses untouched for now.
> >> >
> >>
> >> OK, I am confused now. We started this thread under the assumption
> >> that all unqualified placeholders are warned about by Clang. Given
> >> that this appears not to be the case, could we please first find out
> >> what causes the warnings?
> >
> > Yes please.
> >
> >> Is it necessary at all to add the x modifiers for 64-bit types?
> >
> > Having delved a little deeper, I think this is actively harmful, and
> > clang's warning indicates potential problems even when compiling with
> > GCC.
> >
> > The below test simulates how we might write to control regs and so on,
> > with a mov in asm simulating something like an msr.
> >
> > ---->8----
> > #include <stdio.h>
> >
> > static inline unsigned long generate_val(void)
> > {
> >         unsigned long val;
> >
> >         /* hide value generation from GCC */
> >         asm (
> >                 "movn %0, #0"
> >                 : "=r" (val)
> >         );
> >
> >         return val;
> > }
> >
> > static inline unsigned long use_val_32(unsigned int in)
> > {
> >         unsigned long out;
> >
> >         /* simulate what we might write to a sysreg */
> >         asm (
> >                 "mov %x0, %x1"
> >                 : "=r" (out)
> >                 : "r" (in)
> >         );
> >
> >         return out;
> > }
> >
> > int main(int argc, char *argv)
> > {
> >         printf("32-bit val is: 0x%016lx\n", use_val_32(generate_val()));
> >
> >         return 0;
> > }
> > ---->8----
> >
> > Depending on optimization level, bits that we do not expect can flow through:
> >
> > $ gcc test.c -o test
> > $ ./test
> > 32-bit val is: 0x00000000ffffffff
> > $ gcc test.c -O1 -o test
> > $ ./test
> > 32-bit val is: 0xffffffffffffffff
> > $ gcc test.c -O2 -o test
> > $ ./test
> > 32-bit val is: 0xffffffffffffffff
> >
> > ... that could be disastrous depending on how the result was used.
> >
> > With "in" cast to an unsigned long, the compiler realises it needs to perform
> > any necessary truncation itself:
> >
> > $ gcc test.c -o test
> > $ ./test
> > 32-bit val is: 0x00000000ffffffff
> > $ gcc test.c -O1 -o test
> > $ ./test
> > 32-bit val is: 0x00000000ffffffff
> > $ gcc test.c -O2 -o test
> > $ ./test
> > 32-bit val is: 0x00000000ffffffff
> > $ gcc test.c -O3 -o test
> > $ ./test
> > 32-bit val is: 0x00000000ffffffff
> >
> > I think that the correct fix is to use intermediate 64-bit variables, or
> > casts, so that the compiler *must* use an x register, and consequently
> > guarantees that all 64-bits of the register are as we expect.
> 
> But do we care about those top bits when writing a 32-bit system
> register from a X register?

Well, that only means the upper 32 bits are RES0, so yes. They could
gain a meaning on some future HW.

For sysregs, write_sysreg*() already solves this, as there's an implicit
cast to unsigned long via the function prototype. The 'x' modifier there
is only to ensure xzr can be used.

... however, this is a problem for any asm, as it can take input bits we
don't expect, and consequently generate output that we don't expect.
There's a potential functional correctness issue.

We need the precise set of warnings so that for each case we can
determine whether there is a potential issue today, or whether something
else protects us.

Thanks,
Mark.

Re: [PATCH v2] arm64: Add ASM modifier for xN register operands

[Mark Rutland]

On Fri, Apr 28, 2017 at 08:18:52AM +0100, Ard Biesheuvel wrote:
> On 27 April 2017 at 23:52, Matthias Kaehlcke <mka@chromium.org> wrote:
> > El Thu, Apr 27, 2017 at 12:02:56PM +0100 Mark Rutland ha dit:
> >> On Wed, Apr 26, 2017 at 02:46:16PM -0700, Matthias Kaehlcke wrote:
> >> > Many inline assembly statements don't include the 'x' modifier when
> >> > using xN registers as operands. This is perfectly valid, however it
> >> > causes clang to raise warnings like this:
> >> >
> >> > warning: value size does not match register size specified by the
> >> >   constraint and modifier [-Wasm-operand-widths]

[...]

> >> > -   asm volatile("strb %w0, [%1]" : : "rZ" (val), "r" (addr));
> >> > +   asm volatile("strb %w0, [%x1]" : : "rZ" (val), "r" (addr));
> >>
> >> In general, the '[%xN]' pattern looks *very* suspicious to me. Any
> >> address must be 64-bit, so this would mask a legitimate warning.
> >>
> >> Given the prototype of this function the code if fine either way, but
> >> were we to refactor things (e.g. making this a macro), that might not be
> >> true.
> >>
> >> ... so I'm not sure it make sense to alter instances used for addresses.
> >
> > Good point, I'll leave instances dealing with addresses untouched for now.
> >
> 
> OK, I am confused now. We started this thread under the assumption
> that all unqualified placeholders are warned about by Clang. Given
> that this appears not to be the case, could we please first find out
> what causes the warnings? Is it necessary at all to add the x
> modifiers for 64-bit types?

FWIW, I grabbed a clang 4.0.0 binary and had a play.

It looks like clang only warns when an operand is less than 64 bits
wide, and there is no 'x' or 'w' modifier. Pointers a 64 bits wide, so
never produce a warning.

As far as I can tell, applying to both integers and pointers:

* GCC and clang always treat %N as meaning xN for an r constraint, and
  you need to use %wN to get wN.

* If an operand type is 64 bits in size, clang will not produce a warning
  regarding the operand size.

* If an x or w modifier is used, clang will not produce a warning
  regarding the operand size, regardless of whether it matches the
  register size. Clang is happy for %wN to be used on a pointer type.

* If an operand type is less than 64 bits in size, and neither an x or
  w modifier is used, clang will produce a warning as above.

* If an operand type is greater than 64 bits in size, clang encounters
  an internal error.

Given that, I think we *should not* use the x modifier to suppress this
warning, as I think for those cases we have a potential bug as outlined
in my prior reply.

Instead, we should use a temporary 64-bit variable (or cast input
operands to 64-bit), which avoids that and makes clang happy.

I've included my test below. Note that clang will produce other errors for
invalid asm (e.g. for mov w0, x0).

Thanks,
Mark.

---->8----
#define TEST(t, w1, w2)                 \
t foo_##t##w1##_##w2(t a, t b)          \
{                                       \
        asm (                           \
        "mov %" #w1 "0, %" #w2 "1"      \
        : "=r" (a) : "r" (b)            \
        );                              \
                                        \
        return a;                       \
}

#define TEST_TYPE(t)                    \
        TEST(t,  ,  )                   \
        TEST(t, w,  )                   \
        TEST(t, w, w)                   \
        TEST(t, w, x)                   \
        TEST(t, x,  )                   \
        TEST(t, x, w)                   \
        TEST(t, x, x)                   \

TEST_TYPE(int)

TEST_TYPE(long)

typedef long * longp;
TEST_TYPE(longp)

TEST_TYPE(__int128)

Re: [PATCH v2] arm64: Add ASM modifier for xN register operands

[Ard Biesheuvel]

On 28 April 2017 at 15:33, Mark Rutland <mark.rutland@arm.com> wrote:
> On Fri, Apr 28, 2017 at 08:18:52AM +0100, Ard Biesheuvel wrote:
>> On 27 April 2017 at 23:52, Matthias Kaehlcke <mka@chromium.org> wrote:
>> > El Thu, Apr 27, 2017 at 12:02:56PM +0100 Mark Rutland ha dit:
>> >> On Wed, Apr 26, 2017 at 02:46:16PM -0700, Matthias Kaehlcke wrote:
>> >> > Many inline assembly statements don't include the 'x' modifier when
>> >> > using xN registers as operands. This is perfectly valid, however it
>> >> > causes clang to raise warnings like this:
>> >> >
>> >> > warning: value size does not match register size specified by the
>> >> >   constraint and modifier [-Wasm-operand-widths]
>
> [...]
>
>> >> > -   asm volatile("strb %w0, [%1]" : : "rZ" (val), "r" (addr));
>> >> > +   asm volatile("strb %w0, [%x1]" : : "rZ" (val), "r" (addr));
>> >>
>> >> In general, the '[%xN]' pattern looks *very* suspicious to me. Any
>> >> address must be 64-bit, so this would mask a legitimate warning.
>> >>
>> >> Given the prototype of this function the code if fine either way, but
>> >> were we to refactor things (e.g. making this a macro), that might not be
>> >> true.
>> >>
>> >> ... so I'm not sure it make sense to alter instances used for addresses.
>> >
>> > Good point, I'll leave instances dealing with addresses untouched for now.
>> >
>>
>> OK, I am confused now. We started this thread under the assumption
>> that all unqualified placeholders are warned about by Clang. Given
>> that this appears not to be the case, could we please first find out
>> what causes the warnings? Is it necessary at all to add the x
>> modifiers for 64-bit types?
>
> FWIW, I grabbed a clang 4.0.0 binary and had a play.
>
> It looks like clang only warns when an operand is less than 64 bits
> wide, and there is no 'x' or 'w' modifier. Pointers a 64 bits wide, so
> never produce a warning.
>
> As far as I can tell, applying to both integers and pointers:
>
> * GCC and clang always treat %N as meaning xN for an r constraint, and
>   you need to use %wN to get wN.
>

OK, good. That is a departure from previous behavior of Clang, which
was causing build errors before due to the fact that msr/mrs
instructions involving 32-bit values must still use x registers.

> * If an operand type is 64 bits in size, clang will not produce a warning
>   regarding the operand size.
>
> * If an x or w modifier is used, clang will not produce a warning
>   regarding the operand size, regardless of whether it matches the
>   register size. Clang is happy for %wN to be used on a pointer type.
>
> * If an operand type is less than 64 bits in size, and neither an x or
>   w modifier is used, clang will produce a warning as above.
>
> * If an operand type is greater than 64 bits in size, clang encounters
>   an internal error.
>
> Given that, I think we *should not* use the x modifier to suppress this
> warning, as I think for those cases we have a potential bug as outlined
> in my prior reply.
>
> Instead, we should use a temporary 64-bit variable (or cast input
> operands to 64-bit), which avoids that and makes clang happy.
>

Yes, I think that makes sense.

> I've included my test below. Note that clang will produce other errors for
> invalid asm (e.g. for mov w0, x0).
>
> Thanks,
> Mark.
>
> ---->8----
> #define TEST(t, w1, w2)                 \
> t foo_##t##w1##_##w2(t a, t b)          \
> {                                       \
>         asm (                           \
>         "mov %" #w1 "0, %" #w2 "1"      \
>         : "=r" (a) : "r" (b)            \
>         );                              \
>                                         \
>         return a;                       \
> }
>
> #define TEST_TYPE(t)                    \
>         TEST(t,  ,  )                   \
>         TEST(t, w,  )                   \
>         TEST(t, w, w)                   \
>         TEST(t, w, x)                   \
>         TEST(t, x,  )                   \
>         TEST(t, x, w)                   \
>         TEST(t, x, x)                   \
>
> TEST_TYPE(int)
>
> TEST_TYPE(long)
>
> typedef long * longp;
> TEST_TYPE(longp)
>
> TEST_TYPE(__int128)

Re: [PATCH v2] arm64: Add ASM modifier for xN register operands

[Will Deacon]

On Fri, Apr 28, 2017 at 03:43:56PM +0100, Ard Biesheuvel wrote:
> On 28 April 2017 at 15:33, Mark Rutland <mark.rutland@arm.com> wrote:
> > On Fri, Apr 28, 2017 at 08:18:52AM +0100, Ard Biesheuvel wrote:
> OK, good. That is a departure from previous behavior of Clang, which
> was causing build errors before due to the fact that msr/mrs
> instructions involving 32-bit values must still use x registers.
> 
> > * If an operand type is 64 bits in size, clang will not produce a warning
> >   regarding the operand size.
> >
> > * If an x or w modifier is used, clang will not produce a warning
> >   regarding the operand size, regardless of whether it matches the
> >   register size. Clang is happy for %wN to be used on a pointer type.
> >
> > * If an operand type is less than 64 bits in size, and neither an x or
> >   w modifier is used, clang will produce a warning as above.
> >
> > * If an operand type is greater than 64 bits in size, clang encounters
> >   an internal error.
> >
> > Given that, I think we *should not* use the x modifier to suppress this
> > warning, as I think for those cases we have a potential bug as outlined
> > in my prior reply.
> >
> > Instead, we should use a temporary 64-bit variable (or cast input
> > operands to 64-bit), which avoids that and makes clang happy.
> >
> 
> Yes, I think that makes sense.

Likewise, we could even raise a feature request against GCC because these
warnings actually sound useful. Thanks for getting to the bottom of this.

Will

Re: [PATCH v2] arm64: Add ASM modifier for xN register operands

[Matthias Kaehlcke]

El Fri, Apr 28, 2017 at 03:33:33PM +0100 Mark Rutland ha dit:

> On Fri, Apr 28, 2017 at 08:18:52AM +0100, Ard Biesheuvel wrote:
> > On 27 April 2017 at 23:52, Matthias Kaehlcke <mka@chromium.org> wrote:
> > > El Thu, Apr 27, 2017 at 12:02:56PM +0100 Mark Rutland ha dit:
> > >> On Wed, Apr 26, 2017 at 02:46:16PM -0700, Matthias Kaehlcke wrote:
> > >> > Many inline assembly statements don't include the 'x' modifier when
> > >> > using xN registers as operands. This is perfectly valid, however it
> > >> > causes clang to raise warnings like this:
> > >> >
> > >> > warning: value size does not match register size specified by the
> > >> >   constraint and modifier [-Wasm-operand-widths]
> 
> [...]
> 
> > >> > -   asm volatile("strb %w0, [%1]" : : "rZ" (val), "r" (addr));
> > >> > +   asm volatile("strb %w0, [%x1]" : : "rZ" (val), "r" (addr));
> > >>
> > >> In general, the '[%xN]' pattern looks *very* suspicious to me. Any
> > >> address must be 64-bit, so this would mask a legitimate warning.
> > >>
> > >> Given the prototype of this function the code if fine either way, but
> > >> were we to refactor things (e.g. making this a macro), that might not be
> > >> true.
> > >>
> > >> ... so I'm not sure it make sense to alter instances used for addresses.
> > >
> > > Good point, I'll leave instances dealing with addresses untouched for now.
> > >
> > 
> > OK, I am confused now. We started this thread under the assumption
> > that all unqualified placeholders are warned about by Clang. Given
> > that this appears not to be the case, could we please first find out
> > what causes the warnings? Is it necessary at all to add the x
> > modifiers for 64-bit types?
> 
> FWIW, I grabbed a clang 4.0.0 binary and had a play.
> 
> It looks like clang only warns when an operand is less than 64 bits
> wide, and there is no 'x' or 'w' modifier. Pointers a 64 bits wide, so
> never produce a warning.
> 
> As far as I can tell, applying to both integers and pointers:
> 
> * GCC and clang always treat %N as meaning xN for an r constraint, and
>   you need to use %wN to get wN.
> 
> * If an operand type is 64 bits in size, clang will not produce a warning
>   regarding the operand size.
> 
> * If an x or w modifier is used, clang will not produce a warning
>   regarding the operand size, regardless of whether it matches the
>   register size. Clang is happy for %wN to be used on a pointer type.
> 
> * If an operand type is less than 64 bits in size, and neither an x or
>   w modifier is used, clang will produce a warning as above.
> 
> * If an operand type is greater than 64 bits in size, clang encounters
>   an internal error.
> 
> Given that, I think we *should not* use the x modifier to suppress this
> warning, as I think for those cases we have a potential bug as outlined
> in my prior reply.
> 
> Instead, we should use a temporary 64-bit variable (or cast input
> operands to 64-bit), which avoids that and makes clang happy.
> 
> I've included my test below. Note that clang will produce other errors for
> invalid asm (e.g. for mov w0, x0).

Thanks for your investigation!

I apologize for the noise, my expertise with inline assembly is
extremely limited, and admittedly I need a bit of handholding in this
area. Not without reason changes like this or the prefetch code are at
the very top of my clang stack (i.e. postponed until the other less
scary issues were solved). Hopefully the discussion was still useful.

I'll prepare a short patch that only fixes the warnings encountered in
my build in the way you suggested.

Thanks

Matthias