Stabilize -Zno-jump-tables into -Cjump-tables=bool

[pmur]

I propose stabilizing the -Zno-jump-tables option into -Cjump-tables=.

-Zno-jump-tables stabilization report

What is the RFC for this feature and what changes have occurred to the user-facing design since the RFC was finalized?

No RFC was created for this option. This was a narrowly scoped option introduced in #105812 to support code generation requirements of the x86-64 linux kernel, and eventually other targets as Rust For Linux grows.

The tracking is #116592.

What behavior are we committing to that has been controversial? Summarize the major arguments pro/con.

The behavior of this flag is well defined, and mimics the existing -fno-jump-tables option currently available with LLVM and GCC.

• What should the flag name be?
  As introduced, this option was named -Zno-jump-tables. However, other major toolchains allow both positive and negative variants of this option to toggle this feature. Renaming the option to -Cjump-tables=<bool> makes this option consistent, and if for some reason, expandable to other arguments in the future. Notably, many LLVM targets have a configurable and different thresholds for when to lower into a jump table.

Are there extensions to this feature that remain unstable? How do we know that we are not accidentally committing to those.

No. This option is used exclusively to gate a very specific class of optimization.

Summarize the major parts of the implementation and provide links into the code (or to PRs)

• The original PR Add -Zno-jump-tables #105812 by @ojeda
• The stabilized CLI option is parsed as a bool:
  https://github.com/pmur/rust/blob/68bfda9025ccb2778e2606e12e8021b9918f40d3/compiler/rustc_session/src/options.rs#L2025-L2026
• This options adds an attribute to each llvm function via:
  https://github.com/pmur/rust/blob/68bfda9025ccb2778e2606e12e8021b9918f40d3/compiler/rustc_codegen_llvm/src/attributes.rs#L210-L215
• Finally, the rustc book is updated with the new option:
  https://github.com/pmur/rust/blob/68bfda9025ccb2778e2606e12e8021b9918f40d3/src/doc/rustc/src/codegen-options/index.md?plain=1#L212-L223

Has a call-for-testing period been conducted? If so, what feedback was received?

No. The option has originally created is being used by Rust For Linux to build the x86-64 kernel without issue.

What outstanding bugs in the issue tracker involve this feature? Are they stabilization-blocking?

There are no outstanding issues.

Summarize contributors to the feature by name for recognition and assuredness that people involved in the feature agree with stabilization

• @ojeda implemented this feature in Extend -Zdump-mir output with two-phase borrow info #105815 as -Zno-jump-tables.
• @tgross35 created and maintained the tracking issue Tracking Issue for no-jump-tables #116592, and provided feedback about the naming of the cli option.

What FIXMEs are still in the code for that feature and why is it ok to leave them there?

There are none.

What static checks are done that are needed to prevent undefined behavior?

This option cannot cause undefined behavior. It is a boolean option with well defined behavior in both cases.

In what way does this feature interact with the reference/specification, and are those edits prepared?

This adds a new cli option to rustc. The documentation is updated, and the unstable documentation cleaned up in this PR.

Does this feature introduce new expressions and can they produce temporaries? What are the lifetimes of those temporaries?

No.

What other unstable features may be exposed by this feature?

None.

What is tooling support like for this feature, w.r.t rustdoc, clippy, rust-analzyer, rustfmt, etc.?

No support is required from other rust tooling.

Open Items

• Are there objections renaming -Zno-jump-tables to -Cjump-tables=<bool>?
• Is it desirable to keep -Zno-jump-tables for a period of time?

---

Closes #116592

[rustbot]

r? @lcnr

rustbot has assigned @lcnr.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

[jieyouxu]

Question [GUARANTEE 1/3]: is this intended to be a hint, or a guarantee?

[pmur]

This is guarantee for the crate being compiled. No attempts are made to verify the entire link unit is compiled with this flag.

I think that is OK. It may be desirable for some crates to control this option. A jump table isn't always a more performant optimization (such was my experience when experimenting with them on Go/PPC64).

[tgross35]

Maybe it's worth mentioning in the docs that:

• This can be enabled for a single crate if you are interested in controlling this for performance reasons
• If you are going after IBT concerns, it probably needs to be enabled for all crates in the graph
• Pre-built std may not meet your requirements

(Great questions btw Jieyou)

[jieyouxu]

Yeah, this is why I asked, because depending on what you are aiming for, perf-only versus security concerns might want different levels of guarantees (or don't need guarantees).

[jieyouxu]

Question:

This option enables the -fno-jump-tables flag for LLVM, which makes the codegen backend avoid generating jump tables when lowering switches.

This option adds the LLVM no-jump-tables=true attribute to every function.

The option can be used to help provide protection against jump-oriented-programming (JOP) attacks, such as with the linux kernel's IBT.

How does this interact with pre-compiled std? I.e. can you mix downstream user crates compiled with -Cjump-tables=no versus a pre-compiled std compiled and distributed with -Cjump-tables=yes?

[pmur]

It should link without issue. Disabling this codegen optimization should have no effect on ABI.

[jieyouxu]

Discussion [GUARANTEE 3/3]: If the flag is intended to be a hint, then this sentence can be a bit misleading, because we may not always guarantee it. We may want to slightly caveat this wording to not convey a "false promise" so to speak.

Or, if a user do want such protection, then do they need to enforce it over the whole crate graph?

[pmur]

The flag should be guarantee anything compiled with jump tables turned off does not contain jump tables. It would be up to the user to enforce this dependency beyond the individual crate.

I think it might be better to remove this statement entirely. Maybe it would be better rewriten as:

Disabling jump tables can be used to help provide protection against
jump-oriented-programming (JOP) attacks. However, this option makes
no guarantee any precompiled or external dependencies are compiled 
with or without jump tables.

[jieyouxu]

Discussion: Hm, what happens if a different cg backend is selected?

cc @GuillaumeGomez @antoyo

[antoyo]

It is not implemented yet in cg_gcc, but I guess it could be by sending -fno-jump-tables with context.add_driver_option("-fno-jump-tables") or context.add_command_line_option("-fno-jump-tables").

[pmur]

Should this be implemented for the other backends before stabilizing?

[tgross35]

I don't think we need to block on it, though it may be worth a note. For GCC it should be a simple check here

rust/compiler/rustc_codegen_gcc/src/base.rs

Line 96 in fe55364

fn module_codegen(

, I think it should be fine to add a commit doing that to this PR if you're up for it.

(assuming Antoni is okay with doing it here rather than the submodule repo to avoid dancing also dancing around the name change).

Cc @bjorn3 for cranelift

[bjorn3]

Cranelift doesn't have support emission of jump tables for the br_table instruction. Avoiding emitting br_table itself may be feasible, but would require a cranelift-frontend change. FWIW cg_clif silently ignores many of these flags already.

[antoyo]

(assuming Antoni is okay with doing it here rather than the submodule repo to avoid dancing also dancing around the name change).

I'm OK with this.

[pmur]

Adding support to the gcc backend seems straightforward. What is the difference between using add_driver_option vs add_command_line_option? The former did inhibit jump tables when I tested it.

[tgross35]

It looks like maybe precedence? https://gcc.gnu.org/onlinedocs/jit/topics/contexts.html#c.gcc_jit_context_add_command_line_option

[antoyo]

Some options won't work if not using the correct function. If it works, all is good.

[jieyouxu]

Question [GUARANTEE 2/3]: This wording reads like a guarantee -- but is it? Can we make that guarantee?

[pmur]

It should, though that is entirely dependent on the codegen backend to honor it.

More accurately, this should be reworded as the LLVM codegen backend. However, it seems relatively trivial to pass this through to the gcc backend too.

[jieyouxu]

Question: I'm assuming that if you inspect the assembly of an actual hello world binary that uses std in some way, then you might see jump stables still? 🤔

[pmur]

Yes, if they exist and are included when linking. That is expected, though unintuitive to someone unfamiliar with the rust build system.

[jieyouxu]

Are there objections renaming -Zno-jump-tables to -Zjump-tables=?

Not having double-negatives is very nice 👍

Is it desirable to keep -Zno-jump-tables for a period of time?

No, I rather not have to keep around an unstable flag as an alias to a stable flag, that's very weird.

[ojeda]

Not having double-negatives is very nice 👍

The current flag (i.e. the GCC/Clang naming) has no double negatives, i.e. it does not take a parameter. If it did, then yeah, it wouldn't be great.

[tgross35]

It's not a single-option flag for the C compilers: -fjump-tables is a legal option (and the default), -fno-jump-tables is just its inverted value. As-is, if we wanted to pass the positive option to rustc it would mean something like -Cno-jump-tables=false which has the double negative.

Unfortunately we do have a few flags that didn't remove the C-style no- prefix, e.g. -Cno-redzone=false, but I don't think we should follow that precedent. (Honestly we should probably consider deprecating that one in favor of a new -Credzone=....)

[ojeda]

@tgross35 Not sure if you are replying to @jieyouxu or me. If you are replying to me, then I am confused, because that is what I was saying.

[tgross35]

It was in response to your comment about the CC flag: I'm saying that there is no double negative in that case specifically because -fno-jump-tables is already inverted (from -fjump-tables), not necessarily because it doesn't take any options.

I think we're in agreement, I'm just making a point that we aren't actually consistent with the C compilers currently because our base flag is "no-jump-tables" while theirs is "jump-tables" (and we don't treat no- as a prefix to flip boolean flags).

[jieyouxu]

(Yeah for better or worse, the rustc flags sometimes accept too many different forms of "on"/"off" that make it confusing...)

[ojeda]

It was in response to your comment about the CC flag

My comment (and @jieyouxu's, given the quote) was referring to the current Rust flag, not the C one. In any case, I think you are talking from an implementation point of view, but I think the user interface is what matters: -fx existing or not does not change anything regarding double negatives on e.g. -fno-x and whether compilers auto-implement negatives or not (and what is the "base option" etc.) is orthogonal.

So what I was trying to say with my original comment is that there is no double negative with the current Rust interface, because the OP comment sounded ambiguous to me, i.e. there is no double negative being removed w.r.t. the current state. It is only because we want the flexibility of a parameter that the issue is introduced if we kept the name.

[ojeda]

Thanks for this!

and eventually other targets as Rust For Linux grows

Yeah, it may get used for other things. Apart from what I mentioned in the original PR, I see LoongArch also uses it since a year ago (so I assume it should be passed for Rust too there, Cc @chenhuacai in case there is a reason not to).

Are there objections renaming -Zno-jump-tables to -Zjump-tables=<bool>?

I assume you mean -C for the latter, i.e. we are going directly from -Zno-jump-tables to -Cjump-tables rather than one more step -- that is what the PR seems to do, right? Otherwise, we will need to support 3 names on the kernel side, which isn't great.

As for the name change, it seems fine -- the usual argument for using the current name is to keep it close to GCC's and Clang's flags, which always helps, but here it is obvious, i.e. we are not changing other parts of the name or grouping different flags into a new one or things like that.

Is it desirable to keep -Zno-jump-tables for a period of time?

I think it is fine either way for us.

If the old flag isn't there, we may get a kernel build error here in this PR, in which case I can give you a commit to fix it.

[pmur]

I assume you mean -C for the latter, i.e. we are going directly from -Zno-jump-tables to -Cjump-tables rather than one more step -- that is what the PR seems to do, right? Otherwise, we will need to support 3 names on the kernel side, which isn't great.

Yes. I've updated the report. The PR intentionally contains a commit to rename -Zno-jump-tables to -Zjump-tables=, but I think that detail is ultimately irrelevant. I don't think anyone wants to support 3 names.

[rustbot]

Some changes occurred in compiler/rustc_codegen_gcc

cc @antoyo, @GuillaumeGomez