These machine-dependent inline string functions have never been on by default, and even if they were a good idea at the time they were introduced, they haven't really been touched in ten to fifteen years and probably aren't a good idea on current-gen processors. Current thinking is that this class of optimization is best left to the compiler. * bits/string.h, string/bits/string.h * sysdeps/aarch64/bits/string.h * sysdeps/m68k/m680x0/m68020/bits/string.h * sysdeps/s390/bits/string.h, sysdeps/sparc/bits/string.h * sysdeps/x86/bits/string.h: Delete file. * string/string.h: Don't include bits/string.h. * string/bits/string3.h: Rename to bits/string_fortified.h. No need to undef various symbols that the removed headers might have defined as macros. * string/Makefile (headers): Remove bits/string.h, change bits/string3.h to bits/string_fortified.h. * string/string-inlines.c: Update commentary. Remove definitions of various macros that nothing looks at anymore. Don't directly include bits/string.h. Set _STRING_INLINE_unaligned here, based on compiler-predefined macros. * string/strncat.c: If STRNCAT is not defined, or STRNCAT_PRIMARY _is_ defined, provide internal hidden alias __strncat. * include/string.h: Declare internal hidden alias __strncat. Only forward __stpcpy to __builtin_stpcpy if __NO_STRING_INLINES is not defined. * include/bits/string3.h: Rename to bits/string_fortified.h, update to match above. * sysdeps/i386/string-inlines.c: Define compat symbols for everything formerly defined by sysdeps/x86/bits/string.h. Make existing definitions into compat symbols as well. Remove some no-longer-necessary messing around with macros. * sysdeps/powerpc/powerpc32/power4/multiarch/mempcpy.c * sysdeps/powerpc/powerpc64/multiarch/mempcpy.c * sysdeps/powerpc/powerpc64/multiarch/stpcpy.c * sysdeps/s390/multiarch/mempcpy.c No need to define _HAVE_STRING_ARCH_mempcpy. Do define __NO_STRING_INLINES and NO_MEMPCPY_STPCPY_REDIRECT. * sysdeps/i386/i686/multiarch/strncat-c.c * sysdeps/s390/multiarch/strncat-c.c * sysdeps/x86_64/multiarch/strncat-c.c Define STRNCAT_PRIMARY. Don't change definition of libc_hidden_def.
Commit 38765ab68f329fd moved the bzero, bcopy, and explicit_bzero fortified macros to a common header (strings_fortified.h). However the side effect is a fortified explicit_bzero is defined when including only strings.h. This patch moves back the fortified explicit_bzero definition to strings3.h header. Checked on x86_64-linux-gnu. * string/bits/strings_fortified.h (explicit_bzero): Move back to .. * string/bits/string3.h: ... here.
As described in BZ#20558, bzero and bcopy declaration can only benefit from fortified macros when decl came from string.h and when __USE_MISC is defined (default behaviour). This is due no standard includes those functions in string.h, so they are only declared if __USE_MISC is defined (as pointed out in comment 4). However fortification should be orthogona to other features test macros, i.e, any function should be fortified if that function is declared. To fix this behavior, the patch moved the bzero, bcopy, and __explicit_bzero_chk to a common header (string/bits/strings_fortified.h) and explicit fortified inclusion macros similar to string.h is added on strings.h. This allows to get fortified declarions by only including strings.h. Checked on x86_64-linux-gnu and along on a bootstrap installation to check if the fortified are correctly triggered with example from bug report. [BZ #20558] * string/bits/string3.h [__USE_MISC] (bcopy): Move to strings_fortified.h. [__USE_MISC] (bzero): Likewise. [__USE_MISC] (explicit_bzero): Likewise. * string/strings.h: Include strings_fortified.h. * string/Makefile (headers): Add strings_fortified.h. * string/bits/strings_fortified.h: New file. * include/bits/strings_fortified.h: Likewise.
explicit_bzero(s, n) is the same as memset(s, 0, n), except that the compiler is not allowed to delete a call to explicit_bzero even if the memory pointed to by 's' is dead after the call. Right now, this effect is achieved externally by having explicit_bzero be a function whose semantics are unknown to the compiler, and internally, with a no-op asm statement that clobbers memory. This does mean that small explicit_bzero operations cannot be expanded inline as small memset operations can, but on the other hand, small memset operations do get deleted by the compiler. Hopefully full compiler support for explicit_bzero will happen relatively soon. There are two new tests: test-explicit_bzero.c verifies the visible semantics in the same way as the existing test-bzero.c, and tst-xbzero-opt.c verifies the not-being-optimized-out property. The latter is conceptually based on a test written by Matthew Dempsky for the OpenBSD regression suite. The crypt() implementation has an immediate use for this new feature. We avoid having to add a GLIBC_PRIVATE alias for explicit_bzero by running all of libcrypt's calls through the fortified variant, __explicit_bzero_chk, which is in the impl namespace anyway. Currently I'm not aware of anything in libc proper that needs this, but the glue is all in place if it does become necessary. The legacy DES implementation wasn't bothering to clear its buffers, so I added that, mostly for consistency's sake. * string/explicit_bzero.c: New routine. * string/test-explicit_bzero.c, string/tst-xbzero-opt.c: New tests. * string/Makefile (routines, strop-tests, tests): Add them. * string/test-memset.c: Add ifdeffage for testing explicit_bzero. * string/string.h [__USE_MISC]: Declare explicit_bzero. * debug/explicit_bzero_chk.c: New routine. * debug/Makefile (routines): Add it. * debug/tst-chk1.c: Test fortification of explicit_bzero. * string/bits/string3.h: Fortify explicit_bzero. * manual/string.texi: Document explicit_bzero. * NEWS: Mention addition of explicit_bzero. * crypt/crypt-entry.c (__crypt_r): Clear key-dependent intermediate data before returning, using explicit_bzero. * crypt/md5-crypt.c (__md5_crypt_r): Likewise. * crypt/sha256-crypt.c (__sha256_crypt_r): Likewise. * crypt/sha512-crypt.c (__sha512_crypt_r): Likewise. * include/string.h: Redirect internal uses of explicit_bzero to __explicit_bzero_chk[_internal]. * string/Versions [GLIBC_2.25]: Add explicit_bzero. * debug/Versions [GLIBC_2.25]: Add __explicit_bzero_chk. * sysdeps/arm/nacl/libc.abilist * sysdeps/unix/sysv/linux/aarch64/libc.abilist * sysdeps/unix/sysv/linux/alpha/libc.abilist * sysdeps/unix/sysv/linux/arm/libc.abilist * sysdeps/unix/sysv/linux/hppa/libc.abilist * sysdeps/unix/sysv/linux/i386/libc.abilist * sysdeps/unix/sysv/linux/ia64/libc.abilist * sysdeps/unix/sysv/linux/m68k/coldfire/libc.abilist * sysdeps/unix/sysv/linux/m68k/m680x0/libc.abilist * sysdeps/unix/sysv/linux/microblaze/libc.abilist * sysdeps/unix/sysv/linux/mips/mips32/fpu/libc.abilist * sysdeps/unix/sysv/linux/mips/mips32/nofpu/libc.abilist * sysdeps/unix/sysv/linux/mips/mips64/n32/libc.abilist * sysdeps/unix/sysv/linux/mips/mips64/n64/libc.abilist * sysdeps/unix/sysv/linux/nios2/libc.abilist * sysdeps/unix/sysv/linux/powerpc/powerpc32/fpu/libc.abilist * sysdeps/unix/sysv/linux/powerpc/powerpc32/nofpu/libc.abilist * sysdeps/unix/sysv/linux/powerpc/powerpc64/libc-le.abilist * sysdeps/unix/sysv/linux/powerpc/powerpc64/libc.abilist * sysdeps/unix/sysv/linux/s390/s390-32/libc.abilist * sysdeps/unix/sysv/linux/s390/s390-64/libc.abilist * sysdeps/unix/sysv/linux/sh/libc.abilist * sysdeps/unix/sysv/linux/sparc/sparc32/libc.abilist * sysdeps/unix/sysv/linux/sparc/sparc64/libc.abilist * sysdeps/unix/sysv/linux/tile/tilegx/tilegx32/libc.abilist * sysdeps/unix/sysv/linux/tile/tilegx/tilegx64/libc.abilist * sysdeps/unix/sysv/linux/tile/tilepro/libc.abilist * sysdeps/unix/sysv/linux/x86_64/64/libc.abilist * sysdeps/unix/sysv/linux/x86_64/x32/libc.abilist: Add entries for explicit_bzero and __explicit_bzero_chk.
The new check-installed-headers rule check now complains with C++ comment from string3.h with: ../string/bits/string3.h:129:1: error: C++ style comments are not allowed in ISO C90 // XXX We have no corresponding builtin yet. Let use old C style comment to make compiler happy in old modes. Tested on x86_64. * string/bits/string3.h: Remove C++ style comments.
I think the last clause of the conditional, || __n <= __bos (__dest) may be backward. The code should call the runtime-checking function if __n is not constant, or if __n is known to be LARGER than the size of the destination.
gcc now warns when the arguments to memset may have been accidentally transposed (i.e. length set to zero instead of the byte), so we don't need that bit of the code in glibc headers anymore. Tested on x86_64. Coe generated by gcc 4.8 is identical with or without the patch. I also tested gcc master, which does not result in any new failures. It does fail quite a few FORTIFY_SOURCE tests, but those failures are not due to this patch.