From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <dev-bounces@dpdk.org> Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 13AA1A0534; Tue, 4 Feb 2020 13:57:49 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 5ACF41C12F; Tue, 4 Feb 2020 13:57:48 +0100 (CET) Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [207.211.31.120]) by dpdk.org (Postfix) with ESMTP id 0AC4E1C115 for <dev@dpdk.org>; Tue, 4 Feb 2020 13:57:46 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1580821066; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:autocrypt:autocrypt; bh=QwPO3vHJ4s0jx7KDhNFXbkAW4Gsua+fBJNo93iI1upA=; b=d+Iai+VvG/436efK2Y/fb9BUcwcp/SEZoTFWFzx4TSjQ0/jSeGMMPow/C3J8gNYxRdqKyv mSrOM+Yky6Wccgf+obBz/8E7XUEdi62MQGzwK1r14dIQbSd/tPjeakiwMVV4MjtnR94Y6h RBl7sJKGetL7dI4k/5j5cAU0uORNK2A= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-103-aBZtXqLqMOKaJTX-juTJpw-1; Tue, 04 Feb 2020 07:57:42 -0500 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 46C46801E6C; Tue, 4 Feb 2020 12:57:39 +0000 (UTC) Received: from [10.33.36.105] (unknown [10.33.36.105]) by smtp.corp.redhat.com (Postfix) with ESMTP id 83F895D9CA; Tue, 4 Feb 2020 12:57:32 +0000 (UTC) To: Thomas Monjalon <thomas@monjalon.net>, David Marchand <david.marchand@redhat.com>, nhorman@tuxdriver.com, bluca@debian.org, Ray Kinsella <mdr@ashroe.eu>, dev@dpdk.org, Akhil Goyal <akhil.goyal@nxp.com>, "Trahe, Fiona" <fiona.trahe@intel.com>, Ferruh Yigit <ferruh.yigit@intel.com> Cc: "Ananyev, Konstantin" <konstantin.ananyev@intel.com>, Anoob Joseph <anoobj@marvell.com>, "Kusztal, ArkadiuszX" <arkadiuszx.kusztal@intel.com>, "Richardson, Bruce" <bruce.richardson@intel.com>, "Mcnamara, John" <john.mcnamara@intel.com>, dodji@seketeli.net, Andrew Rybchenko <arybchenko@solarflare.com>, aconole@redhat.com References: <20191220152058.10739-1-david.marchand@redhat.com> <4ed777ce-8320-4636-2c9c-62bb96b66392@ashroe.eu> <2546229.NgBsaNRSFp@xps> <6660180.4vTCxPXJkl@xps> From: Kevin Traynor <ktraynor@redhat.com> Autocrypt: addr=ktraynor@redhat.com; keydata= mQINBF2J2awBEADUEPNhgNI+nJNgiTAUcw4YIgVXEoHlsNPyyzG1BEXkWXALy0Y3fNTiw6+r ltWDkF9jzL9kfkecgQ67itGfk1OaBXgSGKuw1PUpxAwX2Bi76LAR6M5OsyGM9TSVVQwARalz hMwRBIZPzPc7or6Pw7jAOJ8SQGJ1Zlp1YJCjrvpe87V1tH/LY8Wnxn/EuoseFmWILAQZAtYS tGjcrAgYn3SPMLR1B0BP5bTBY06vWQjiufH8drenfDnMJAzuBdG1mqjnTqCjULZ3Hunv4xqZ aMnkvL/K5Tj1c12Oe4930EE53LrXIBUltRg5mBudSWHnC7twjH0082HH9f963Z/2UI63SFIT iUvRvAzJYytgy7XnWLQ0+goZBADKYfolOuC0H8VgCaux8u8KFF28Dy+N6TV2KI58jTlyg1Zu l7QwykZpnOkJFiy37Gfbu3YEOzO72cP/S7/A+zvuqkxi63jyEkd+FY99vLt/HN2MUZwRmKDw UPbLkmrs8WU01/POVsqDcfvz7vu2St8hqqTiSIdQGS2zyTKB2/DvPSM3jws3udkIYSuhn+X4 QBiV6lkVZ7DSE6a065gnAauAql+b32Eymy+xnG5jCt1tR+0Cp2VZYCR9OU2gmomUKBDoX/He pSgED01CqYPNjN+TddirwmQX7ep4DtXc8FWvv2g/pq9WZFQk2QARAQABtCNLZXZpbiBUcmF5 bm9yIDxrdHJheW5vckByZWRoYXQuY29tPokCTgQTAQgAOBYhBAoiOaH51tHF7VYtEI9CINER a+yJBQJdidmsAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEI9CINERa+yJoxIP/3VF 2TIgW4ckxhRFCvFu/606bnvCPie88ake4uWVWMAWwcMc4fKEltRWRCpkSVOwgqoMHnyHxK5r kOKzx2CLJMX5TgTMfKzPuaBDHngHLUzl2DStpBzrod0cVg5TShdmmfjY61uxRJKz+DlSkwgJ riADdVF5PPosQXTkKSGf2ombpTGpx/pue9ocjnr3x4SDpRLlnooM6Jf/3Y3Ib4jX6HPEyWuY b+owIIk9y2nRRGPQ6jbqAhsrXd9V+77UL0QuGWloMuKMZFbNg8hbu7X5aFijAbfxj4YUgojS ba7gfGZQan8h32A9KGQWrmsCBc3j2GqEPsX0r05X7cn7WL6IOPgQJ5EiQ7PlazQYVLrvZg9B n0GKK0k6895mLG0ZZ5v/qajOPF52etSmvFD1WUPb4OqaHqGA9ZtMpaKFRt7Y6rpXqKNU1xzW F5KjbTPtTb9WF3An8dciVv+AYUI7totkZYkWvQtgss8lfaX3NKUvXLVxqK0z3dQyr7rF/tYz PneTKypSksjCgaEBLSrsRmM5zKfe7tSNF/fDntfIq/029Jtcw29TcWEP57peNu6TtejewQD9 sTI+oqiXvW2D5l7LNUDYG8eMJp2oT7I0ZSBRvwcbmjH0DtN/bXCCFfCvk8Yic68F3tV1ctix wQARVKDBhT30uCxycRWojCYqTgNJJS71uQINBF2J2awBEADP57PR2IpSYBeNSrsAjeIcsahE N4SQP2C4s50S8QEWAUhqMRI7WNv5cfeef0nDvcl1IUA6oz5SokbcsbMa+mRgaNF4N5KikWTO LPYxq2YVJoXwJ+tKmNzyOLFUIfFJ4NBJZple5dTfWzD00Dbb19Mri1hy1mWMqNTPGBee1+hw Qcp6n3mmGECvajs8G5A7NyXbwL8ihN7HX9D01ucD62b4G03yKe2g/hvKgcdUVmhCldJlF27I 2fSR9tDxH9pZqRODY4rjbFZEey/vWKXqjE+DQ8AtMSEaDfFe5D+i4Aw6erWQ3Wr+DwZt1/7G dIAElGA/q90T1ENVwJX9y7fsQssawKYYdDqURHCl5JuDXI+VXUypExipUUT5SPycMmbLsx0D iKEqPPDQWKxkIDVKqj2+EhamSuJznZUwBLJKn0h4zrIWiXWUy07lRwtVuhaDXhF3GfW+5W/x wAg7Qg3w00ASsb/XTHBIhMnenKDfS7ihtQA8SacwX8ySdxb+15XPyiplM979qBQ0mhnilulm MIJzEf/JxoYR5huuj4f1PFqqrsP06Dl+YGB7dQZp3IKggS5c3/TAynARRg9N89UsDXNtp7X0 tgIPFF5k6fnHE0J5O64GYHeTqN/1aE6dAEOV9WrGzQAJxU9ipikb8jKAWXzLewRIKGmoPcRZ WdB0NmIjmQARAQABiQI2BBgBCAAgFiEECiI5ofnW0cXtVi0Qj0Ig0RFr7IkFAl2J2awCGwwA CgkQj0Ig0RFr7IkkORAAl/NbX93WK5MEoRw7/DaPTo/Lo6Pj1XMeSqGyACigHK/452UDvlEH NjNJMzYYrNIjMtEmN9VVCfjT38CSca7mpGQVwchc0mC7QSPAETLCS+UacVf/Kwxz5FfkEUUw UT7A+uyVOIgW3d9ldlRzkHA2czonSSgTQU+i2g6DM4ha+BuQb4byAXH6HQHt/Zh1J64z0ohH v6iGsCzCY/sMWF8+LEGSnzMGRCLiiwSF0vJBHbzWK68fANaF4gBV0Z/+6tQRFN7YMhj/INmk qgvHj1ZzHFNtirjMGPRxoZs51YoLQM/aBPxKrnmXThx1ufH+0L6sGmFTugiDt0XSEkC5reH7 a+VhQ1VTFFQrClA8NmDSPzFeuhru4ryaaDHO+uEB16cNHxHrQtlP/2hts2JM5lwkZRWJ5A57 h8eDEIK5be47T85NVHfuTaboNRmgg1HygVejhGUtt69u/0MVRg/roUTa0FyEbNsvz4qAecyW yWzMcVrcGJDQLC9JLKEpoyUF6gdTKaiDL2Vao4+XRIA3Y57b6MO35a3HuzAv7+i5Z0mnDEJO XxXqTOmKYpMIGexzM/PtuA0712sT1abG9tAJ17ao/B7cqMW5IkKkalemFbWfI2unns4Papvo tk9igVqyp6EJDU98z5TJioCVojwK2laDaoIjTJk9YYv3iwCsqPd5feU= Message-ID: <ae99f1ac-057b-e524-8609-46b8c1f97ffe@redhat.com> Date: Tue, 4 Feb 2020 12:57:31 +0000 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1 MIME-Version: 1.0 In-Reply-To: <6660180.4vTCxPXJkl@xps> Content-Language: en-US X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-MC-Unique: aBZtXqLqMOKaJTX-juTJpw-1 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Subject: Re: [dpdk-dev] [PATCH v2 4/4] add ABI checks X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions <dev.dpdk.org> List-Unsubscribe: <https://mails.dpdk.org/options/dev>, <mailto:dev-request@dpdk.org?subject=unsubscribe> List-Archive: <http://mails.dpdk.org/archives/dev/> List-Post: <mailto:dev@dpdk.org> List-Help: <mailto:dev-request@dpdk.org?subject=help> List-Subscribe: <https://mails.dpdk.org/listinfo/dev>, <mailto:dev-request@dpdk.org?subject=subscribe> Errors-To: dev-bounces@dpdk.org Sender: "dev" <dev-bounces@dpdk.org> On 04/02/2020 10:24, Thomas Monjalon wrote: > RED FLAG >=20 > I don't see a lot of reactions, so I summarize the issue. > We need action TODAY! >=20 > API makes think that rte_cryptodev_info_get() cannot return > a value >=3D 3 (RTE_CRYPTO_AEAD_LIST_END in 19.11). > Current 20.02 returns 3 (RTE_CRYPTO_AEAD_CHACHA20_POLY1305). > The ABI compatibility contract is broken currently. >=20 > There are 3 possible outcomes: >=20 > a) Change the API comments and backport to 19.11.1 > The details are discussed between Ferruh and me. > Either put responsibility on API user (with explicit comment), > or expose ABI extension allowance with a new API max value. > In both cases, this is breaking the implicit contract of 19.11.0. > This option can be chosen only if release and ABI maintainers > vote for it. >=20 > b) Revert Chacha-Poly from 20.02-rc2. >=20 > c) Add versioned function rte_cryptodev_info_get_v1911() > which calls rte_cryptodev_info_get() and filters out > RTE_CRYPTO_AEAD_CHACHA20_POLY1305 capability. > So Chacha-Poly capability would be seen and usable only > if compiling with DPDK 20.02. >=20 Maybe a separate version of rte_cryptodev_get_aead_algo_enum() also needed to handle chacha string differently. > I hope it is clear what are the actions for everybody: > - ABI and release maintainers must say yes or no to the proposal (a) My 2c for a) is No. > - In the meantime, crypto team must send a patch for the proposal (c) > - If (a) and (c) are not possible at the end of today, I will take (b) >=20 > Note: do not say it is too short for (c), as it was possible to work > on such solution since the issue was exposed on last Wednesday. >=20 Could it be reverted today if necessary and re-added later in the release cycle? It seems like something modular that should not invalidate earlier testing. >=20 > 03/02/2020 22:07, Thomas Monjalon: >> 03/02/2020 19:55, Ray Kinsella: >>> On 03/02/2020 17:34, Thomas Monjalon wrote: >>>> 03/02/2020 18:09, Thomas Monjalon: >>>>> 03/02/2020 10:30, Ferruh Yigit: >>>>>> On 2/2/2020 2:41 PM, Ananyev, Konstantin wrote: >>>>>>> 02/02/2020 14:05, Thomas Monjalon: >>>>>>>> 31/01/2020 15:16, Trahe, Fiona: >>>>>>>>> On 1/30/2020 8:18 PM, Thomas Monjalon wrote: >>>>>>>>>> If library give higher value than expected by the application, >>>>>>>>>> if the application uses this value as array index, >>>>>>>>>> there can be an access out of bounds. >>>>>>>>> >>>>>>>>> [Fiona] All asymmetric APIs are experimental so above shouldn't b= e a problem. >>>>>>>>> But for the same issue with sym crypto below, I believe Ferruh's = explanation makes >>>>>>>>> sense and I don't see how there can be an API breakage. >>>>>>>>> So if an application hasn't compiled against the new lib it will = be still using the old value >>>>>>>>> which will be within bounds. If it's picking up the higher new va= lue from the lib it must >>>>>>>>> have been compiled against the lib so shouldn't have problems. >>>>>>>> >>>>>>>> You say there is no ABI issue because the application will be re-c= ompiled >>>>>>>> for the updated library. Indeed, compilation fixes compatibility i= ssues. >>>>>>>> But this is not relevant for ABI compatibility. >>>>>>>> ABI compatibility means we can upgrade the library without recompi= ling >>>>>>>> the application and it must work. >>>>>>>> You think it is a false positive because you assume the applicatio= n >>>>>>>> "picks" the new value. I think you miss the case where the new val= ue >>>>>>>> is returned by a function in the upgraded library. >>>>>>>> >>>>>>>>> There are also no structs on the API which contain arrays using t= his >>>>>>>>> for sizing, so I don't see an opportunity for an appl to have a >>>>>>>>> mismatch in memory addresses. >>>>>>>> >>>>>>>> Let me demonstrate where the API may "use" the new value >>>>>>>> RTE_CRYPTO_AEAD_CHACHA20_POLY1305 and how it impacts the applicati= on. >>>>>>>> >>>>>>>> Once upon a time a DPDK application counting the number of devices >>>>>>>> supporting each AEAD algo (in order to find the best supported alg= o). >>>>>>>> It is done in an array indexed by algo id: >>>>>>>> int aead_dev_count[RTE_CRYPTO_AEAD_LIST_END]; >>>>>>>> The application is compiled with DPDK 19.11, >>>>>>>> where RTE_CRYPTO_AEAD_LIST_END =3D 3. >>>>>>>> So the size of the application array aead_dev_count is 3. >>>>>>>> This binary is run with DPDK 20.02, >>>>>>>> where RTE_CRYPTO_AEAD_CHACHA20_POLY1305 =3D 3. >>>>>>>> When calling rte_cryptodev_info_get() on a device QAT_GEN3, >>>>>>>> rte_cryptodev_info.capabilities.sym.aead.algo is set to >>>>>>>> RTE_CRYPTO_AEAD_CHACHA20_POLY1305 (=3D 3). >>>>>>>> The application uses this value: >>>>>>>> ++ aead_dev_count[info.capabilities.sym.aead.algo]; >>>>>>>> The application is crashing because of out of bound access. >>>>>>> >>>>>>> I'd say this is an example of bad written app. >>>>>>> It probably should check that returned by library value doesn't >>>>>>> exceed its internal array size. >>>>>> >>>>>> +1 >>>>>> >>>>>> Application should ignore values >=3D MAX. >>>>> >>>>> Of course, blaming the API user is a lot easier than looking at the A= PI. >>>>> Here the API has RTE_CRYPTO_AEAD_LIST_END which can be understood >>>>> as the max value for the application. >>>>> Value ranges are part of the ABI compatibility contract. >>>>> It seems you expect the application developer to be aware that >>>>> DPDK could return a higher value, so the application should >>>>> check every enum values after calling an API. CRAZY. >>>>> >>>>> When we decide to announce an ABI compatibility and do some marketing= , >>>>> everyone is OK. But when we need to really make our ABI compatible, >>>>> I see little or no effort. DISAPPOINTING. >>>>> >>>>>> Do you suggest we don't extend any enum or define between ABI breaka= ge releases >>>>>> to be sure bad written applications not affected? >>>>> >>>>> I suggest we must consider not breaking any assumption made on the AP= I. >>>>> Here we are breaking the enum range because nothing mentions _LIST_EN= D >>>>> is not really the absolute end of the enum. >>>>> The solution is to make the change below in 20.02 + backport in 19.11= .1: >>>> >>>> Thinking twice, merging such change before 20.11 is breaking the >>>> ABI assumption based on the API 19.11.0. >>>> I ask the release maintainers (Luca, Kevin, David and me) and >>>> the ABI maintainers (Neil and Ray) to vote for a or b solution: >>>> =09a) add comment and LIST_MAX as below in 20.02 + 19.11.1 >>> >>> That would still be an ABI breakage though right. >>> >>>> =09b) wait 20.11 and revert Chacha-Poly from 20.02 >>> >>> Thanks for analysis above Fiona, Ferruh and all.=20 >>> >>> That is a nasty one alright - there is no "good" answer here. >>> I agree with Ferruh's sentiments overall, we should rethink this API fo= r 20.11.=20 >>> Could do without an enumeration? >>> >>> There a c) though right. >>> We could work around the issue by api versioning rte_cryptodev_info_get= () and friends. >>> So they only support/acknowledge the existence of Chacha-Poly for appli= cations build against > 20.02. >> >> I agree there is a c) as I proposed in another email: >> http://mails.dpdk.org/archives/dev/2020-February/156919.html >> " >> In this case, the proper solution is to implement >> rte_cryptodev_info_get_v1911() so it filters out >> RTE_CRYPTO_AEAD_CHACHA20_POLY1305 capability. >> With this solution, an application compiled with DPDK 19.11 will keep >> seeing the same range as before, while a 20.02 application could >> see and use ChachaPoly. >> " >> >>> It would be painful I know. >> >> Not so painful in my opinion. >> Just need to call rte_cryptodev_info_get() from >> rte_cryptodev_info_get_v1911() and filter the value >> in the 19.11 range: [0..AES_GCM]. >> >>> It would also mean that Chacha-Poly would only be available to >>> those building against >=3D 20.02. >> >> Yes exactly. >> >> The addition of comments and LIST_MAX like below are still valid >> to avoid versioning after 20.11. >> >>>>> - _LIST_END >>>>> + _LIST_END, /* an ABI-compatible version may increase this value */ >>>>> + _LIST_MAX =3D _LIST_END + 42 /* room for ABI-compatible additions *= / >>>>> }; >>>>> >>>>> Then *_LIST_END values could be ignored by libabigail with such a cha= nge. >> >> In order to avoid ABI check complaining, the best is to completely >> remove LIST_END in DPDK 20.11. >> >> >>>>> If such a patch is not done by tomorrow, I will have to revert >>>>> Chacha-Poly commits before 20.02-rc2, because >>>>> >>>>> 1/ LIST_END, without any comment, means "size of range" >>>>> 2/ we do not blame users for undocumented ABI changes >>>>> 3/ we respect the ABI compatibility contract >=20 >=20 >=20