6

Going through the gcc documentation, I stumbled into the builtin function __builtin___clear_cache.

— Built-in Function: void __builtin___clear_cache (char *begin, char *end) This function is used to flush the processor's instruction cache for the region of memory between begin inclusive and end exclusive. Some targets require that the instruction cache be flushed, after modifying memory containing code, in order to obtain deterministic behavior.

If the target does not require instruction cache flushes, __builtin___clear_cache has no effect. Otherwise either instructions are emitted in-line to clear the instruction cache or a call to the __clear_cache function in libgcc is made.

I find this interesting, but surprising. In many cases, a large number of the instructions for the current stack is stored in the L1 cache (instruction cache). So it would seem at first glance that this builtin could corrupt significantly the flow of our program, by making it wipe out the next instructions on the stack.

Does this instruction also repopulates the part of the stack that was in the L1 cache?

This seems unlikely. If it does not, then I suppose the onus is on the user to use the right begin and end arguments, so as to not corrupt our process. In practice, how could one find what the right begin and end to use?

DevShark
  • 8,558
  • 9
  • 32
  • 56

1 Answers1

5

It is just emitting some weird machine instruction[s] on target processors requiring them (x86 don't need that).

Think of __builtin___clear_cache as a "portable" (to GCC and compatible compilers) way to flush the instruction cache (e.g. in some JIT library).

In practice, how could one find what the right begin and end to use?

To be safe, I would use that on some page range (e.g. obtained with sysconf(_SC_PAGESIZE)....), so usually a 4Kbyte aligned memory range (multiple of 4Kbyte). Otherwise, you want some target specific trick to find the cache line width...

On Linux, you might read /proc/cpuinfo and use the cache_alignment & cache_size lines to get a more precise cache line size and alignment.

BTW, a code using __builtin__clear_cache is very likely to be (for other reasons) target machine specific, so it has or knows some machine parameters (and that should include cache size & alignment).

Basile Starynkevitch
  • 223,805
  • 18
  • 296
  • 547
  • 2
    Turns out `__builtin___clear_cache` *is* needed on x86 as a compiler memory barrier, to make gcc realize that the "dead" stores were actually writing code, and need to happen before a cast to a function pointer. See https://codegolf.stackexchange.com/questions/160100/the-repetitive-byte-counter/160236#160236 for why I wrote https://godbolt.org/g/pGXn3B, which repeats `dec eax` M times then appends a `ret`. Without `__builtin___clear_cache` or a compiler memory barrier like `asm("":::"memory");`, the `memset` is optimized away so it's just `call` to the malloc return without storing first. – Peter Cordes Mar 25 '18 at 20:43
  • I think `__builtin___clear_cache` is supposed to work if you just use it on the exact range of bytes you wrote and now want to execute. If it needs to know about cache-line size, it will figure it out itself, right? – Peter Cordes Mar 25 '18 at 20:46
  • @PeterCordes It looks like that's actually related to the use of `malloc` to allocate the memory, rather than to being on x86. In particular, if I replace `malloc(M+1)` with `mmap(NULL, M+1, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);`, then the dead-store optimization doesn't happen even without `__builtin___clear_cache`. – Joseph Sible-Reinstate Monica Sep 02 '19 at 16:28
  • 2
    @Joseph no. Gcc knows about malloc (private memory nothing else has a pointer to). That enables the optimization where it can't prove it's safe with mmap. But happening to work != totally safe and correct. – Peter Cordes Sep 08 '19 at 21:36