linux-kernel - Re: static_branch/jump

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 22 Apr 2021 13:31:51 -0500
From:   Segher Boessenkool <segher@...nel.crashing.org>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     David Malcolm <dmalcolm@...hat.com>,
        Ard Biesheuvel <ardb@...nel.org>,
        linux-toolchains@...r.kernel.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Jason Baron <jbaron@...mai.com>,
        "Steven Rostedt (VMware)" <rostedt@...dmis.org>,
        yuanzhaoxiong@...du.com
Subject: Re: static_branch/jump_label vs branch merging

On Thu, Apr 22, 2021 at 07:49:23PM +0200, Peter Zijlstra wrote:
> On Thu, Apr 22, 2021 at 12:08:20PM -0500, Segher Boessenkool wrote:
> > On Thu, Apr 22, 2021 at 01:48:39PM +0200, Peter Zijlstra wrote:
> > > Can we please have a __pure__ attribute that is prescriptive and not a
> > > hint the compiler is free to ignore for $raisins ?
> > 
> > What does that mean?  What actual semantics do you want it to have?
> 
> I want a function marked as pure to be treated as such, unconditionally.
> 
> > The "pure" attribute means the compiler can assume this function does
> > not have side effects.  But in general (and in practice in many cases)
> > there is no way the compiler can actually check that, if that is what
> > you were asking for.
> 
> Right, so currently the pure attribute gets ignored by the compiler
> because of various reasons, one of them being an asm volatile ("") being
> present somewhere inside it (AFAIU).

In general, the compiler only sees the *declaration* of the function, so
it cannot do such a thing.

> Does this mean we can have invalid code generation when we faultily
> mark things pure? Yes, but then it's our own damn fault for sticking on
> pure in the first place.

Nope, you have undefined behaviour in that case, and you get to keep
all N pieces, the compiler cannot do anything wrong in such a case :-)

> In short; I want pure (or really_pure if you want a second attribute) to

You cannot make the meaning of "pure" different from what it has been
historically, because existing programs will no longer build (or worse,
start behaving differently).

> be a do-what-I-tell-you-already and not a
> only-if-you-think-you-can-prove-I-didn't-make-a-mistake kinda knob. A
> little bit like inline vs always_inline.

It sounds like you want it to behave like attribute((pure)) already is
documented as doing.  Please open a PR?  https://gcc.gnu.org/bugs.html
(We need buildable stand-alone example code, with what flags to use, and
something like what should happen and what did happen).

> > And any such checking will depend on optimisation level and related
> > flags, making that a no-go anyway.
> 
> Realistically I'm only bothered about -O2 and up since that's what we
> build the kernel with. Obviously one doesn't care about optimizations
> being lost when build with -O0.

GCC is used for other things as well, not just for building Linux ;-)


Segher