The ABI of float types on can be changed by -Ctarget-feature

[RalfJung]

A function that returns an f32/f64 is not ABI-compatible with other functions that have the same signature on i686 when certain target features differ. It looks like one can disable the x87 feature or enable the soft-float and then it will use different ways of passing floating-point arguments.

This is unsound as code calling methods from the standard library would now use the wrong registers to return results. In other words, setting -Ctarget-feature=-x87 or -Ctarget-feature=+soft-float can introduce UB unless the standard library is rebuilt with the same flags. We therefore should reject these flags, to avoid the UB. This issue tracks that problem, and transitioning it to a hard error.

(SIMD types have a similar problem, but we are dealing with that differently. See #116558.)

See #131799 for figuring out which exact target features are affected on which architectures.

[RalfJung]

Cc @rust-lang/opsem

[chorman0773]

FTR, I think the -x87,+softfp and -x87,+sse codegens are wrong for at least the C abi, because Sys-V (and msabi) do prescribe that float/double are returned in st(0) and provide no other alternative - so I think rustc should reject this code in particular.

I actually wanted a similar prohibition retroactively on the simd types, but the x86_64-psabi list did not accept that request.

[workingjubilee]

If I understand @chorman0773 correctly #115476 (comment), then a function that takes/returns an f32/f64 is not ABI-compatible with other functions that have the same signature on i686 when certain target features differ. It looks like one can disable the x87 feature and then it will use different ways of passing floating-point arguments.

This is correct.

So IMO we should consider certain features to be in the required baseline for i686 targets and just error out when they get disabled (or force-enable them, or refuse to codegen things involving floats, or something like that) -- in particular, x87 and sse2.

I believe I have vocalized that this is my desired solution as well.

[chorman0773]

Demonstrating the 3 different ways that rustc returns floats on x86: https://rust.godbolt.org/z/r83MbYh5n.

Although it seems f64 specifically is spared on sse and softfp (not between +x87 and -x87 though). Both cases it's returned in edx:eax (which is weird, I'd expect f64 to get returned in an xmm register otherwise).

[chorman0773]

So IMO we should consider certain features to be in the required baseline for i686 targets and just error out when they get disabled (or force-enable them, or refuse to codegen things involving floats, or something like that) -- in particular, x87 and sse2. Currently it may seem like --target i686-unknown-linux-gnu -C target-feature=-sse2,-sse is a tier 1 target but really it isn't.

Force enabling them (or blanket erroring) on i686-wide would affect kernel mode code that typically disables the FPU and vector extensions to avoid having to save that state every context switch. Refusing to codegen floats is a reasonable alternative, though. For sse in particular, llvm really loves to copy data arround using xmm registers, so this will either cause a #GP(0) when llvm starts putting movupss everywhere, or worse, silently clobber xmm registers when the kernel does something even cleverer with cr4.OSFXSAVE/cr4.OSXSAVE enabled.

[workingjubilee]

Kernel-friendly targets need to be handled specially as always.

[chorman0773]

I was about to say this didn't need O-x86_64, but...
https://rust.godbolt.org/z/EzMhdsqx9

[RalfJung]

I just realized that with #[target_feature] we don't allow disabling features at all. That makes me quite surprised that we allow disabling features on stable with -C target-feature... was that a deliberate mismatch?

---

Force enabling them (or blanket erroring) on i686-wide would affect kernel mode code that typically disables the FPU and vector extensions to avoid having to save that state every context switch.

Force enabling them wouldn't affect that code if it doesn't use any floats. :)

[chorman0773]

Force enabling them wouldn't affect that code if it doesn't use any floats. :)

It does though, especially sse as mentioned.
llvm will happily fold a 16 byte 4 dword mov into movupss, which will #GP(0) if cr4.OSFXSAVE=0.

[RalfJung]

It does though, especially sse as mentioned.

It does?

llvm will happily fold a 16 byte 4 dword mov into movupss, which will #GP(0) if cr4.OSFXSAVE=0.

Bless you? To me it looks like you put the output of pwgen into the editor. ;) Can you explain this in higher-level terms?

[chorman0773]

If you tell llvm that it can use sse instructions, it will completely decide to fold scalar bytewise copies into sse copies and cause a general protection exception in kernel code that isn't configured to allow those instructions.

This is why it's considered undefined behaviour to merely enter code with an unavailable feature available.

[chorman0773]

Example of llvm using movups rather than scalar copies with sse enabled: https://rust.godbolt.org/z/jW8W54sc9

[RalfJung]

If you tell llvm that it can use sse instructions, it will completely decide to fold scalar bytewise copies into sse copies and cause a general protection exception in kernel code that isn't configured to allow those instructions.

Ah, bummer.

That sounds like we want -softfloat/-nofloat targets then. But disabling target features seems to have all sorts of bad side-effects and I wish we never allowed it -- and I wonder to what extend we can take it back...

[chorman0773]

Disabling target features is incredibly useful when writing all kinds of code. Kernel and driver code especially, but I write a lot of "Low-level user mode code" that also somestimes requires finagling with -C target-feature and -C target-cpu.

And sometimes you live before the kernel. A bootloader gratuitously opting arbitrary kernels into cr4.OSXFSAVE is even worse, because the instructions won't trap, just silently clobber user mode state.

[RalfJung]

You are describing a good motivation for a -nofloat/-softfloat target. In fact, we have some -softlofat targets.

You are not describing why we should offer the ability to disable target features, when perfectly valid alternatives exist; alternatives that do not also eat your kitttens. "It is useful" applies to many things that we very deliberately do not let people do because they just cause too many issues.

[workingjubilee]

It is still possible to obtain what is desired for those by switching to an enable-only process, or virtually so (I realize that softfloat is technically a feature one must often disable to get correct codegen).

[chorman0773]

Note: #115919 would make this apply by toggling sse and not x87, which can be done without disabling any features on i586 targets.

[RalfJung]

#115919 could be adjusted to only kick in when the baseline features of the target include SSE. If we do that, does enabling SSE ever affect the ABI of f32/f64? If the answer is "no" then I think the i586 targets are good, right?

For softfloat targets, we'd have to ensure their f32/f64 ABI is unaffected by enabling x87 or SSE, or we have to reject enabling those features. The former should actually be possible, right? I would assume f32 is passed much like i32 and f64 like i64 on those targets, so we can tell LLVM to pass floats as i32/i64 and then we don't have to worry about target features at all?

[RalfJung]

I suspect this is not just an x86 problem. @Dirbaio you mentioned one can enable the use of the FPU on ARM even in soft-float targets, and that is ABI compatible. What target feature is used for that? And what happens when one disables that target feature on a hard-float target?

[Dirbaio]

if you use thumbv7em-none-eabi it passes the floats in r0, r1, ... and uses soft float to add them: https://godbolt.org/z/z5do34E81
if you use thumbv7em-none-eabi but add -Ctarget-feature=+vfp4 it still passes the floats in r0, r1, ... so it's ABI-compatible, but uses the FPU instructions to add them. https://godbolt.org/z/v9Wqoq74s
if you use thumbv7em-none-eabihf it passes floats in the FPU registers (s0, s1...) and uses the FPU to add them. https://godbolt.org/z/3rEn13MnE

[Dirbaio]

And what happens when one disables that target feature on a hard-float target?

hehe, it seems it passes floats in FPU regs, but moves them out to do soft-float maths. So it seems to be correct :) https://godbolt.org/z/4zh9fbE81

+soft-float does cause the ABI to change tho... 😭 https://godbolt.org/z/eT5sf7fec

[RalfJung]

hehe, it seems it passes floats in FPU regs, but moves them out to do soft-float maths. So it seems to be correct :) https://godbolt.org/z/4zh9fbE81

That's awesome. :-) Much better than x86 where the x87 target feature changes ABI...

+soft-float does cause the ABI to change tho... 😭

Yeah, that's kind of expected (IMO a bad design decision by LLVM, but oh well). #129884 will make it an error to toggle soft-float via -Ctarget-feature.

[Dirbaio]

Actually -Ctarget-feature=-vfp2sp,-fpregs also changes the ABI. https://godbolt.org/z/9747PYa1b

That seems a closer equivalent to -x87 in x86. Seems LLVM separates "FPU instructions" and "FPU regs", though both need the hardware to have a FPU.

[RalfJung]

Ah okay, damn. So we need to also block the fpregs target feature then.

[apiraino]

WG-prioritization assigning priority (Zulip discussion).

@rustbot label -I-prioritize +P-high

[RalfJung]

I tried to figure out where in the LLVM sources this happens so that we can be sure to check all the right target features. However, I am a bit stuck...

For ARM, we found soft-float and fpregs can affect the float ABI, and that matches what I see here. However, for x86, things look much less clear... the file is this but GH doesn't show its contents. The (I think) relevant part is

  bool UseX87 = !Subtarget.useSoftFloat() && Subtarget.hasX87();

  // ...

  if (!Subtarget.useSoftFloat() && Subtarget.hasSSE2()) {
    // f16, f32 and f64 use SSE.
    // Set up the FP register classes.
    addRegisterClass(MVT::f16, Subtarget.hasAVX512() ? &X86::FR16XRegClass
                                                     : &X86::FR16RegClass);
    addRegisterClass(MVT::f32, Subtarget.hasAVX512() ? &X86::FR32XRegClass
                                                     : &X86::FR32RegClass);
    addRegisterClass(MVT::f64, Subtarget.hasAVX512() ? &X86::FR64XRegClass
                                                     : &X86::FR64RegClass);

    // ...

  } else if (!Subtarget.useSoftFloat() && Subtarget.hasSSE1() &&
             (UseX87 || Is64Bit)) {
    // Use SSE for f32, x87 for f64.
    // Set up the FP register classes.
    addRegisterClass(MVT::f32, &X86::FR32RegClass);
    if (UseX87)
      addRegisterClass(MVT::f64, &X86::RFP64RegClass);

    // ...

  } else if (UseX87) {
    // f32 and f64 in x87.
    // Set up the FP register classes.
    addRegisterClass(MVT::f64, &X86::RFP64RegClass);
    addRegisterClass(MVT::f32, &X86::RFP32RegClass);

    // ...

  }

This can't be the ABI logic, right? "f16, f32 and f64 use SSE" refers to how FP math is computed. But how does the ABI logic decide whether to use float registers or general-purpose registers?
@nikic do you happen to you the right part of the code for this?

[workingjubilee]

...people edit a 55,000 line file by hand?

[RalfJung]

Turns out on aarch64 we have a stable target feature that can cause ABI trouble: #131058.

[RalfJung]

I made this issue about tracking the unsoundness caused by -Ctarget-issue (so it will be referenced by warnings once #129884 lands), and opened #131799 for gathering the data for all targets about which features affect ABI.