From 5233175b06531f9c12dcd33eb7b2757678734a2a Mon Sep 17 00:00:00 2001 From: Chris Fallin Date: Fri, 17 Dec 2021 11:58:06 -0800 Subject: [PATCH] Use SipHasher rather than SHA-512 for ISLE manifest. Fixes #3609. It turns out that `sha2` is a nontrivial dependency for Cranelift in many contexts, partly because it pulls in a number of other crates as well. One option is to remove the hash check under certain circumstances, as implemented in #3616. However, this is undesirable for other reasons: having different dependency options in Wasmtime in particular for crates.io vs. local builds is not really possible, and so either we still have the higher build cost in Wasmtime, or we turn off the checks by default, which goes against the original intent of ensuring developer safety (no mysterious stale-source bugs). This PR uses `SipHash` instead, which is built into the standard library. `SipHash` is deprecated, but it's fixed and deterministic (across runs and across Rust versions), which is what we need, unlike the suggested replacement `std::collections::hash_map::DefaultHasher`. The result is only 64 bits, and is not cryptographically secure, but we never needed that; we just need a simple check to indicate when we forget a `rebuild-isle`. --- Cargo.lock | 1 - cranelift/codegen/Cargo.toml | 1 - cranelift/codegen/build.rs | 30 +++++++++++++++---- .../lower/isle/generated_code.manifest | 8 ++--- .../x64/lower/isle/generated_code.manifest | 8 ++--- 5 files changed, 33 insertions(+), 15 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index d493499286..d87df3e5d1 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -547,7 +547,6 @@ dependencies = [ "miette", "regalloc", "serde", - "sha2", "smallvec", "souper-ir", "target-lexicon", diff --git a/cranelift/codegen/Cargo.toml b/cranelift/codegen/Cargo.toml index 77d34bbfb9..eee830039e 100644 --- a/cranelift/codegen/Cargo.toml +++ b/cranelift/codegen/Cargo.toml @@ -37,7 +37,6 @@ criterion = "0.3" cranelift-codegen-meta = { path = "meta", version = "0.79.0" } cranelift-isle = { path = "../isle/isle", version = "=0.79.0", optional = true } miette = { version = "3", features = ["fancy"], optional = true } -sha2 = "0.9.8" [features] default = ["std", "unwind"] diff --git a/cranelift/codegen/build.rs b/cranelift/codegen/build.rs index d900b92fa4..8eac58e8d9 100644 --- a/cranelift/codegen/build.rs +++ b/cranelift/codegen/build.rs @@ -16,7 +16,6 @@ use cranelift_codegen_meta as meta; -use sha2::{Digest, Sha512}; use std::env; use std::io::Read; use std::process; @@ -163,7 +162,28 @@ impl IsleCompilation { /// `.manifest` and use it to verify that a /// rebuild was done if necessary. fn compute_manifest(&self) -> Result> { + // We use the deprecated SipHasher from std::hash in order to verify + // that ISLE sources haven't changed since the generated source was + // last regenerated. + // + // We use this instead of a stronger and more usual content hash, like + // SHA-{160,256,512}, because it's built into the standard library and + // we don't want to pull in a separate crate. We try to keep Cranelift + // crate dependencies as intentionally small as possible. In fact, we + // used to use the `sha2` crate for SHA-512 and this turns out to be + // undesirable for downstream consumers (see #3609). + // + // Why not the recommended replacement + // `std::collections::hash_map::DefaultHasher`? Because we need the + // hash to be deterministic, both between runs (i.e., not seeded with + // random state) and across Rust versions. + // + // If `SipHasher` is ever actually removed from `std`, we'll need to + // find a new option, either a very small crate or something else + // that's built-in. + #![allow(deprecated)] use std::fmt::Write; + use std::hash::{Hasher, SipHasher}; let mut manifest = String::new(); @@ -176,11 +196,11 @@ impl IsleCompilation { // to `\r\n`; canonicalize the source that we hash to // Unix-style (`\n`) so hashes will match. let content = content.replace("\r\n", "\n"); - // One line in the manifest: . - let mut hasher = Sha512::default(); - hasher.update(content.as_bytes()); + // One line in the manifest: . + let mut hasher = SipHasher::new_with_keys(0, 0); // fixed keys for determinism + hasher.write(content.as_bytes()); let filename = format!("{}", filename.display()).replace("\\", "/"); - writeln!(&mut manifest, "{} {:x}", filename, hasher.finalize())?; + writeln!(&mut manifest, "{} {:x}", filename, hasher.finish())?; } Ok(manifest) diff --git a/cranelift/codegen/src/isa/aarch64/lower/isle/generated_code.manifest b/cranelift/codegen/src/isa/aarch64/lower/isle/generated_code.manifest index 0de7cc8720..ed8ffaabb4 100644 --- a/cranelift/codegen/src/isa/aarch64/lower/isle/generated_code.manifest +++ b/cranelift/codegen/src/isa/aarch64/lower/isle/generated_code.manifest @@ -1,4 +1,4 @@ -src/clif.isle be1359b4b6b153f378517c1dd95cd80f4a6bed0c7b86eaba11c088fd71b7bfe80a3c868ace245b2da0bfbbd6ded262ea9576c8e0eeacbf89d03c34a17a709602 -src/prelude.isle 15c8dd937171bd0f619179e219422d43af0eb0ef9a6e88f23b2aa55776712e27342309dd3a4441876b2dfec7f16ce7fe13b3a926ace89b25cfc9577e7b1d1578 -src/isa/aarch64/inst.isle a6921329a85a252b8059657056ee0c4477304dff461bd58c39133a2870666b23a34c911be55e25e7887074cb54b640ff09998730af09b3c1ba792f434309af24 -src/isa/aarch64/lower.isle 3cc84f8e3907818da7e0cbb4afe7f269da7090f3d504c74ecf02ef57463b281f4a320e52656d9397720ec8e4af98c1ecea05c4ffbe3f0c4126af4ed95d2734cc +src/clif.isle f176ef3bba99365 +src/prelude.isle babc931e5dc5b4cf +src/isa/aarch64/inst.isle abbd648f4a0b479a +src/isa/aarch64/lower.isle c46d0692df0a9c0d diff --git a/cranelift/codegen/src/isa/x64/lower/isle/generated_code.manifest b/cranelift/codegen/src/isa/x64/lower/isle/generated_code.manifest index 72f336c4ea..ed5f6a1c0b 100644 --- a/cranelift/codegen/src/isa/x64/lower/isle/generated_code.manifest +++ b/cranelift/codegen/src/isa/x64/lower/isle/generated_code.manifest @@ -1,4 +1,4 @@ -src/clif.isle be1359b4b6b153f378517c1dd95cd80f4a6bed0c7b86eaba11c088fd71b7bfe80a3c868ace245b2da0bfbbd6ded262ea9576c8e0eeacbf89d03c34a17a709602 -src/prelude.isle 15c8dd937171bd0f619179e219422d43af0eb0ef9a6e88f23b2aa55776712e27342309dd3a4441876b2dfec7f16ce7fe13b3a926ace89b25cfc9577e7b1d1578 -src/isa/x64/inst.isle 1a44ccc0c2cad90447762848461fcae714216ef058d42bdba89330a6008061526e92bbf1c17055c465b20fc75d98d1faa34feda8b22fa7ae0504a0f808798b41 -src/isa/x64/lower.isle c7943201b32e9eb9726466e8cc417f7e84c4c4052de31e05ab6e0ad7502a587cf1d7d9835703c4ff5a506390f7a0668741e7f3feaa1edda6396571a425949fc9 +src/clif.isle f176ef3bba99365 +src/prelude.isle babc931e5dc5b4cf +src/isa/x64/inst.isle fb5d3ac8e68c46d2 +src/isa/x64/lower.isle d39e01add89178d5