lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20250221183437.1e2b5b94@pumpkin>
Date: Fri, 21 Feb 2025 18:34:37 +0000
From: David Laight <david.laight.linux@...il.com>
To: Jan Engelhardt <ej@...i.de>
Cc: "H. Peter Anvin" <hpa@...or.com>, Greg KH <gregkh@...uxfoundation.org>,
 Boqun Feng <boqun.feng@...il.com>, Miguel Ojeda
 <miguel.ojeda.sandonis@...il.com>, Christoph Hellwig <hch@...radead.org>,
 rust-for-linux <rust-for-linux@...r.kernel.org>, Linus Torvalds
 <torvalds@...ux-foundation.org>, David Airlie <airlied@...il.com>,
 linux-kernel@...r.kernel.org, ksummit@...ts.linux.dev
Subject: Re: C aggregate passing (Rust kernel policy)

On Thu, 20 Feb 2025 16:17:07 +0100 (CET)
Jan Engelhardt <ej@...i.de> wrote:

> On Thursday 2025-02-20 14:23, H. Peter Anvin wrote:
> >
> >People writing C seem to have a real aversion for using structures
> >as values (arguments, return values or assignments) even though that
> >has been valid since at least C90 and can genuinely produce better
> >code in some cases.  
> 
> The aversion stems from compilers producing "worse" ASM to this
> date, as in this case for example:
> 
> ```c
> #include <sys/stat.h>
> extern struct stat fff();
> struct stat __attribute__((noinline)) fff()
> {
>         struct stat sb = {};
>         stat(".", &sb);
>         return sb;
> }
> ```
> 
> Build as C++ and C and compare.
> 
> $ g++-15 -std=c++23 -O2 -x c++ -c x.c && objdump -Mintel -d x.o
> $ gcc-15 -std=c23 -O2 -c x.c && objdump -Mintel -d x.o
> 
> Returning aggregates in C++ is often implemented with a secret extra
> pointer argument passed to the function. The C backend does not
> perform that kind of transformation automatically. I surmise ABI reasons.

Have you really looked at the generated code?
For anything non-trivial if gets truly horrid.

To pass a class by value the compiler has to call the C++ copy-operator to
generate a deep copy prior to the call, and then call the destructor after
the function returns - compare against passing a pointer to an existing
item (and not letting it be written to).

Returning a class member is probably worse and leads to nasty bugs.
In general the called code will have to do a deep copy from the item
being returned and then (quite likely) call the destructor for the
local variable being returned (if a function always returns a specific
local then the caller-provided temporary might be usable).
The calling code now has a temporary local variable that is going
to go out of scope (and be destructed) very shortly - I think the
next sequence point.
So you have lots of constructors, copy-operators and destructors
being called.
Then you get code like:
	const char *foo = data.func().c_str();
very easily written looks fine, but foo points to garbage.

I've been going through some c++ code pretty much removing all the
places that classes get returned by value.
You can return a reference - that doesn't go out of scope.
Or, since most of the culprits are short std::string, replace them by char[].
Code is better, shorter, and actually less buggy.
(Apart from the fact that c++ makes it hard to ensure all the non-class
members are initialised.)

As Linus said, most modern ABI pass short structures in one or two registers
(or stack slots).
But aggregate returns are always done by passing a hidden pointer argument.
It is annoying that double-sized integers (u64 on 32bit and u128 on 64bit)
are returned in a register pair - but similar sized structures have to be
returned by value.
It is possible to get around this with #defines that convert the value
to a big integer (etc) - but I don't remember that actually being done.

	David




Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ