linux-kernel - Re: [PATCH v3 1/3] bits: introduce fixed-type genmasks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 28 Feb 2024 17:39:21 -0600
From: Lucas De Marchi <lucas.demarchi@...el.com>
To: Yury Norov <yury.norov@...il.com>
CC: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>, Dmitry Baryshkov
	<dmitry.baryshkov@...aro.org>, <linux-kernel@...r.kernel.org>,
	<dri-devel@...ts.freedesktop.org>, Jani Nikula <jani.nikula@...ux.intel.com>,
	<intel-xe@...ts.freedesktop.org>, <intel-gfx@...ts.freedesktop.org>, "Jani
 Nikula" <jani.nikula@...el.com>
Subject: Re: [PATCH v3 1/3] bits: introduce fixed-type genmasks

On Thu, Feb 22, 2024 at 06:49:59AM -0800, Yury Norov wrote:
>On Wed, Feb 21, 2024 at 03:59:06PM -0600, Lucas De Marchi wrote:
>> On Wed, Feb 21, 2024 at 11:04:22PM +0200, Andy Shevchenko wrote:
>> > On Wed, Feb 21, 2024 at 10:30:02PM +0200, Dmitry Baryshkov wrote:
>> > > On Thu, 8 Feb 2024 at 09:45, Lucas De Marchi <lucas.demarchi@...el.com> wrote:
>> >
>> > ...
>> >
>> > > > +#define BITS_PER_TYPE(type)    (sizeof(type) * BITS_PER_BYTE)
>> >
>> > Can sizeof() be used in assembly?
>> >
>> > ...
>> >
>> > > > -#define __GENMASK(h, l) \
>> > > > -       (((~UL(0)) - (UL(1) << (l)) + 1) & \
>> > > > -        (~UL(0) >> (BITS_PER_LONG - 1 - (h))))
>> > > > -#define GENMASK(h, l) \
>> > > > -       (GENMASK_INPUT_CHECK(h, l) + __GENMASK(h, l))
>> >
>> > > > +#define __GENMASK(t, h, l) \
>> > > > +       (GENMASK_INPUT_CHECK(h, l) + \
>> > > > +        (((t)~0ULL - ((t)(1) << (l)) + 1) & \
>> > > > +        ((t)~0ULL >> (BITS_PER_TYPE(t) - 1 - (h)))))
>> >
>> > Nevertheless, the use ~0ULL is not proper assembly, this broke initial
>> > implementation using UL() / ULL().
>>
>> indeed.
>>
>> >
>> >
>> > > > -#define __GENMASK_ULL(h, l) \
>> > > > -       (((~ULL(0)) - (ULL(1) << (l)) + 1) & \
>> > > > -        (~ULL(0) >> (BITS_PER_LONG_LONG - 1 - (h))))
>> > > > -#define GENMASK_ULL(h, l) \
>> > > > -       (GENMASK_INPUT_CHECK(h, l) + __GENMASK_ULL(h, l))
>> >
>> > Ditto.
>>
>> problem here seems actually because of the cast to the final type. My
>> previous impl was avoiding that, but was too verbose compared to this.
>>
>> I will look at reverting this.
>>
>> Lucas De Marchi
>
>The fix is quite straightforward. Can you consider the following
>patch? I tested it for C and x86_64 asm parts, and it compiles well.
>
>Thanks,
>Yury
>
>>From 78b2887eea26f208aac50ae283ba9a4d062bb997 Mon Sep 17 00:00:00 2001
>From: Yury Norov <yury.norov@...il.com>
>Date: Wed, 7 Feb 2024 23:45:19 -0800
>Subject: [PATCH v2] bits: introduce fixed-type GENMASKs
>
>Generalize __GENMASK() to support different types, and implement
>fixed-types versions of GENMASK() based on it. The fixed-type version
>allows more strict checks to the min/max values accepted, which is
>useful for defining registers like implemented by i915 and xe drivers
>with their REG_GENMASK*() macros.
>
>The strict checks rely on shift-count-overflow compiler check to
>fail the build if a number outside of the range allowed is passed.
>Example:
>
>	#define FOO_MASK GENMASK_U32(33, 4)
>
>will generate a warning like:
>
>	../include/linux/bits.h:41:31: error: left shift count >= width of type [-Werror=shift-count-overflow]
>	   41 |          (((t)~0ULL - ((t)(1) << (l)) + 1) & \
>	      |                               ^~
>
>CC: Dmitry Baryshkov <dmitry.baryshkov@...aro.org>	
>Signed-off-by: Yury Norov <yury.norov@...il.com>
>Acked-by: Jani Nikula <jani.nikula@...el.com>
>Reviewed-by: Andi Shyti <andi.shyti@...ux.intel.com>

I build-tested this in x86-64, x86-32 and arm64. I didn't like much the
need to fork the __GENMASK() implementation on the 2 sides of the ifdef
since I think the GENMASK_INPUT_CHECK() should be the one covering the
input checks. However to make it common we'd need to solve 2 problems:
the casts and the sizeof. The sizeof can be passed as arg to
__GENMASK(), however the casts I think would need a __CAST_U8(x)
or the like and sprinkle it everywhere, which would hurt readability.
Not pretty. Or go back to the original submission and make it less
horrible :-/

>
>---
> include/linux/bitops.h |  1 -
> include/linux/bits.h   | 41 ++++++++++++++++++++++++++++-------------
> 2 files changed, 28 insertions(+), 14 deletions(-)
>
>diff --git a/include/linux/bitops.h b/include/linux/bitops.h
>index 2ba557e067fe..1db50c69cfdb 100644
>--- a/include/linux/bitops.h
>+++ b/include/linux/bitops.h
>@@ -15,7 +15,6 @@
> #  define aligned_byte_mask(n) (~0xffUL << (BITS_PER_LONG - 8 - 8*(n)))
> #endif
>
>-#define BITS_PER_TYPE(type)	(sizeof(type) * BITS_PER_BYTE)
> #define BITS_TO_LONGS(nr)	__KERNEL_DIV_ROUND_UP(nr, BITS_PER_TYPE(long))
> #define BITS_TO_U64(nr)		__KERNEL_DIV_ROUND_UP(nr, BITS_PER_TYPE(u64))
> #define BITS_TO_U32(nr)		__KERNEL_DIV_ROUND_UP(nr, BITS_PER_TYPE(u32))
>diff --git a/include/linux/bits.h b/include/linux/bits.h
>index 7c0cf5031abe..f3cf8d5f2b55 100644
>--- a/include/linux/bits.h
>+++ b/include/linux/bits.h
>@@ -6,6 +6,8 @@
> #include <vdso/bits.h>
> #include <asm/bitsperlong.h>
>
>+#define BITS_PER_TYPE(type)	(sizeof(type) * BITS_PER_BYTE)
>+
> #define BIT_MASK(nr)		(UL(1) << ((nr) % BITS_PER_LONG))
> #define BIT_WORD(nr)		((nr) / BITS_PER_LONG)
> #define BIT_ULL_MASK(nr)	(ULL(1) << ((nr) % BITS_PER_LONG_LONG))
>@@ -22,24 +24,37 @@
> #define GENMASK_INPUT_CHECK(h, l) \
> 	(BUILD_BUG_ON_ZERO(__builtin_choose_expr( \
> 		__is_constexpr((l) > (h)), (l) > (h), 0)))
>+#define __GENMASK(t, h, l) \
>+	(GENMASK_INPUT_CHECK(h, l) + \
>+	 (((t)~0ULL - ((t)(1) << (l)) + 1) & \
>+	 ((t)~0ULL >> (BITS_PER_TYPE(t) - 1 - (h)))))
> #else
> /*
>- * BUILD_BUG_ON_ZERO is not available in h files included from asm files,
>- * disable the input check if that is the case.
>+ * BUILD_BUG_ON_ZERO is not available in h files included from asm files.
>+ * Similarly, assembler lacks for C types. So no parameters check in asm.
>+ * It's users' responsibility to provide bitranges within a machine word
>+ * boundaries.
>  */
> #define GENMASK_INPUT_CHECK(h, l) 0
>+#define __GENMASK(t, h, l) \
>+	((~0 - (1 << (l)) + 1) & (~0 >> (BITS_PER_LONG - 1 - (h))))

humn... this builds, but does it work if GENMASK_ULL() is used in
assembly? That BITS_PER_LONG does not match the type width.

Lucas De Marchi

> #endif
>
>-#define __GENMASK(h, l) \
>-	(((~UL(0)) - (UL(1) << (l)) + 1) & \
>-	 (~UL(0) >> (BITS_PER_LONG - 1 - (h))))
>-#define GENMASK(h, l) \
>-	(GENMASK_INPUT_CHECK(h, l) + __GENMASK(h, l))
>-
>-#define __GENMASK_ULL(h, l) \
>-	(((~ULL(0)) - (ULL(1) << (l)) + 1) & \
>-	 (~ULL(0) >> (BITS_PER_LONG_LONG - 1 - (h))))
>-#define GENMASK_ULL(h, l) \
>-	(GENMASK_INPUT_CHECK(h, l) + __GENMASK_ULL(h, l))
>+/*
>+ * Generate a mask for the specified type @t. Additional checks are made to
>+ * guarantee the value returned fits in that type, relying on
>+ * shift-count-overflow compiler check to detect incompatible arguments.
>+ * For example, all these create build errors or warnings:
>+ *
>+ * - GENMASK(15, 20): wrong argument order
>+ * - GENMASK(72, 15): doesn't fit unsigned long
>+ * - GENMASK_U32(33, 15): doesn't fit in a u32
>+ */
>+#define GENMASK(h, l)		__GENMASK(unsigned long,  h, l)
>+#define GENMASK_ULL(h, l)	__GENMASK(unsigned long long, h, l)
>+#define GENMASK_U8(h, l)	__GENMASK(u8,  h, l)
>+#define GENMASK_U16(h, l)	__GENMASK(u16, h, l)
>+#define GENMASK_U32(h, l)	__GENMASK(u32, h, l)
>+#define GENMASK_U64(h, l)	__GENMASK(u64, h, l)
>
> #endif	/* __LINUX_BITS_H */
>-- 
>2.40.1
>