Skip to content

Flag -Zindirect-branch-cs-prefix (retpoline mitigation) #899

Open
@ojeda

Description

@ojeda

Proposal

Add a new flag to the compiler, -Zindirect-branch-cs-prefix, for x86, equivalent to Clang's and GCC's -mindirect-branch-cs-prefix:

This flag is used in the Linux kernel when the retpoline mitigation is enabled in order to inline more cases (i.e. to replace more retpoline thunk calls (__x86_indirect_thunk*) with lfence; call *%reg). In the Linux kernel, it gets used together with -mindirect-branch=thunk-extern -mindirect-branch-register (GCC) or -mretpoline-external-thunk (Clang) when supported by the C compiler. The rustc equivalent of the main retpoline flags (-Zretpoline, -Zretpoline-external-thunk) have already landed in rustc (rust-lang/rust#116852, rust-lang/rust#135927).

The flag, at least in the Linux kernel, is used only for retpoline builds, and thus one could consider just doing it unconditionally when other retpoline flags are enabled. However, that would mean less flexibility compared to C compilers and other projects (e.g. other kernels) may not support the inlining and thus may not want the prefix to be added to begin with.

Another aspect is whether to have this as a modifier of one of the existing flags or as an independent flag. Matching the naming of existing flags in C compilers (especially when both GCC and Clang already agree) is clearer, especially for niche flags. For instance, in the Linux kernel Makefiles, the C and Rust flags would be assigned in consecutive lines, which makes it clear it is intended to have the same purpose if their name match. On the other hand, it would be less consistent with other rustc flags.

The implementation, including tests, using the -Zindirect-branch-cs-prefix name (i.e. matching GCC and Clang), is already available at rust-lang/rust#140740. The flag is added with the intent of later stabilizing it.

More context:

Cc: @davidtwco

Process

The main points of the Major Change Process are as follows:

  • File an issue describing the proposal.
  • A compiler team member or contributor who is knowledgeable in the area can second by writing @rustbot second.
    • Finding a "second" suffices for internal changes. If however, you are proposing a new public-facing feature, such as a -C flag, then full team check-off is required.
    • Compiler team members can initiate a check-off via @rfcbot fcp merge on either the MCP or the PR.
  • Once an MCP is seconded, the Final Comment Period begins. If no objections are raised after 10 days, the MCP is considered approved.

You can read more about Major Change Proposals on forge.

Metadata

Metadata

Assignees

No one assigned

    Labels

    T-compilerAdd this label so rfcbot knows to poll the compiler teammajor-changeA proposal to make a major change to rustcto-announceAnnounce this issue on triage meeting

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions