From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.6 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 17F42C38A2A for ; Fri, 8 May 2020 11:47:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id ED72420A8B for ; Fri, 8 May 2020 11:47:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588938440; bh=t1Iwu24XFt/a9NpFSyEL3vQir1AT95eNfYgPSI3dRXk=; h=Date:From:To:Cc:Subject:References:In-Reply-To:List-ID:From; b=TSsOX14JsbEIcp08A+JV0L4KGNcn4Eznb0M6ans4kb6bnuuZ8ECwOFyKf20ttPM4x EdW2Pi+kjAZlbCaMz7OZx0bOxdTrUgPQs6MzVZZRhWidguf5wvSpE3kxVNK5DMzPyV GMLAIR8KSYIeAOcoCXpzmzR/GnW1mzPNUPrY/AY0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726864AbgEHLrR (ORCPT ); Fri, 8 May 2020 07:47:17 -0400 Received: from mail.kernel.org ([198.145.29.99]:41932 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726618AbgEHLrR (ORCPT ); Fri, 8 May 2020 07:47:17 -0400 Received: from willie-the-truck (236.31.169.217.in-addr.arpa [217.169.31.236]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4AF1C208DB; Fri, 8 May 2020 11:47:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1588938436; bh=t1Iwu24XFt/a9NpFSyEL3vQir1AT95eNfYgPSI3dRXk=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=Fbr0ksTlgIL5FTsuoGevS/1Dfx/6oKLeeINEHrjnfmHHcaDmHd5vjhSs6V/18OxQl d87ngXBx/xymM9BE8xEn5y929HYpCE0cwOKixvFuxVhneks1P992dmKU3twX75N40j S/0gFC6NylCeiDyMUntAk0xuU23GFqIAXLPGpZOc= Date: Fri, 8 May 2020 12:47:10 +0100 From: Will Deacon To: Luke Nelson Cc: Marc Zyngier , Luke Nelson , bpf , Xi Wang , Catalin Marinas , Daniel Borkmann , Alexei Starovoitov , Zi Shen Lim , Martin KaFai Lau , Song Liu , Yonghong Song , Andrii Nakryiko , John Fastabend , KP Singh , Mark Rutland , Greg Kroah-Hartman , Thomas Gleixner , linux-arm-kernel@lists.infradead.org, open list , Networking , clang-built-linux@googlegroups.com Subject: Re: [RFC PATCH bpf-next 1/3] arm64: insn: Fix two bugs in encoding 32-bit logical immediates Message-ID: <20200508114709.GB16247@willie-the-truck> References: <20200507010504.26352-1-luke.r.nels@gmail.com> <20200507010504.26352-2-luke.r.nels@gmail.com> <20200507082934.GA28215@willie-the-truck> <20200507101224.33a44d71@why> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Thu, May 07, 2020 at 02:48:07PM -0700, Luke Nelson wrote: > Thanks for the comments! Responses below: > > > It's a bit grotty spreading the checks out now. How about we tweak things > > slightly along the lines of: > > > > > > diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c > > index 4a9e773a177f..60ec788eaf33 100644 > > --- a/arch/arm64/kernel/insn.c > > +++ b/arch/arm64/kernel/insn.c > > [...] > > Agreed; this new version looks much cleaner. I re-ran all the tests / > verification and everything seems good. Would you like me to submit a > v2 of this series with this new code? Yes, please! And please include Daniel's acks on the BPF changes too. It's a public holiday here in the UK today, but I can pick this up next week. > >> We tested the new code against llvm-mc with all 1,302 encodable 32-bit > >> logical immediates and all 5,334 encodable 64-bit logical immediates. > > > > That, on its own, is awesome information. Do you have any pointer on > > how to set this up? > > Sure! The process of running the tests is pretty involved, but I'll > describe it below and give some links here. > > We found the bugs in insn.c while adding support for logical immediates > to the BPF JIT and verifying the changes with our tool, Serval: > https://github.com/uw-unsat/serval-bpf. The basic idea for how we tested / > verified logical immediates is the following: > > First, we have a Python script [1] for generating every encodable > logical immediate and the corresponding instruction fields that encode > that immediate. The script validates the list by checking that llvm-mc > decodes each instruction back to the expected immediate. > > Next, we use the list [2] from the first step to check a Racket > translation [3] of the logical immediate encoding function in insn.c. > We found the second mask bug by noticing that some (encodable) 32-bit > immediates were being rejected by the encoding function. > > Last, we use the Racket translation of the encoding function to verify > the correctness of the BPF JIT implementation [4], i.e., the JIT > correctly compiles BPF_{AND,OR,XOR,JSET} BPF_K instructions to arm64 > instructions with equivalent semantics. We found the first bug as the > verifier complained that the function was producing invalid encodings > for 32-bit -1 immediates, and we were able to reproduce a kernel crash > using the BPF tests. > > We manually translated the C code to Racket because our verifier, Serval, > currently only works on Racket code. Nice! Two things: (1) I really think you should give a talk on this at a Linux conference (2) Did you look at any instruction generation functions other than the logical immediate encoding function? Cheers, Will