Skip to content

simd_select_bitmask: the 'padding' bits in the mask are just ignored #140034

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 2, 2025

Conversation

RalfJung
Copy link
Member

Fixes #137942: we documented simd_select_bitmask to require the 'padding' bits in the mask (the mask can sometimes be longer than the vector; I am referring to these extra bits as 'padding' here) to be zero, mostly because nobody felt like doing the research for what should be done when they are non-zero. However, codegen is already perfectly happy just ignoring them, so in practice they can have any value. Some of the intrinsic wrappers in stdarch have trouble ensuring that they are zero. So let's just adjust the docs and Miri to permit non-zero 'padding' bits.

Cc @Amanieu @workingjubilee

@rustbot
Copy link
Collaborator

rustbot commented Apr 19, 2025

r? @joboet

rustbot has assigned @joboet.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

@rustbot rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-libs Relevant to the library team, which will review and decide on the PR/issue. labels Apr 19, 2025
@rustbot
Copy link
Collaborator

rustbot commented Apr 19, 2025

Some changes occurred to the platform-builtins intrinsics. Make sure the
LLVM backend as well as portable-simd gets adapted for the changes.

cc @antoyo, @GuillaumeGomez, @bjorn3, @calebzulawski, @programmerjake

The Miri subtree was changed

cc @rust-lang/miri

Some changes occurred to the intrinsics. Make sure the CTFE / Miri interpreter
gets adapted for the changes, if necessary.

cc @rust-lang/miri, @RalfJung, @oli-obk, @lcnr

///
/// The bitmask bit order matches `simd_bitmask`.
///
/// # Safety
/// Padding bits must be all zero.
#[rustc_intrinsic]
#[rustc_nounwind]
pub unsafe fn simd_select_bitmask<M, T>(m: M, yes: T, no: T) -> T;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this still unsafe?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can intrinsics be safe? I think it would be safe with the expected generic arguments but could still raise mono errors

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, we have allowed marking intrinsics as safe for a couple of years now.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Many SIMD intrinsics could be safe, but none are. I don't think this PR is the right place to change that.

@joboet
Copy link
Member

joboet commented Apr 23, 2025

r? @workingjubilee

@rustbot rustbot assigned workingjubilee and unassigned joboet Apr 23, 2025
@workingjubilee
Copy link
Member

workingjubilee commented May 1, 2025

Hmm.

Yeah, this seems good to me.

There was indeed a "wait... what are the semantics if there's ambiguity?" moment combined with "fuck it, make it UB", if I recall correctly. I remember extended arguments about other mask operations, but not this one. Those arguments were about why certain masks should require all-0s or all-1s for masks with elements of 1 or more bytes. Those arguments apply to those cases because whether the bits are taken from the top or bottom shouldn't really matter according to the semantics of those things and the behavior does get hardware specific.

But those arguments can't apply to this one because the operation is on a "per bit" basis here to begin with. I think simd_select_bitmask's case basically got overlooked in the ensuing discussion about the other cases

The only thing I remember being specifically about simd_select_bitmask was worries about bit-endianness being exposed. That concern is different, even if it might jumpscare us again. There are still "padding bits" in that case and we still would ignore them. The "problem" there would be "oops, we forgot that sometimes the bit that is ignored isn't on the end we expected".

Thanks!

@bors r+ rollup

@bors
Copy link
Collaborator

bors commented May 1, 2025

📌 Commit 31cb737 has been approved by workingjubilee

It is now in the queue for this repository.

@bors bors added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels May 1, 2025
Zalathar added a commit to Zalathar/rust that referenced this pull request May 1, 2025
…ng, r=workingjubilee

simd_select_bitmask: the 'padding' bits in the mask are just ignored

Fixes rust-lang#137942: we documented simd_select_bitmask to require the 'padding' bits in the mask (the mask can sometimes be longer than the vector; I am referring to these extra bits as 'padding' here)  to be zero, mostly because nobody felt like doing the research for what should be done when they are non-zero. However, codegen is already perfectly happy just ignoring them, so in practice they can have any value. Some of the intrinsic wrappers in stdarch have trouble ensuring that they are zero. So let's just adjust the docs and Miri to permit non-zero 'padding' bits.

Cc `@Amanieu` `@workingjubilee`
bors added a commit to rust-lang-ci/rust that referenced this pull request May 1, 2025
Rollup of 11 pull requests

Successful merges:

 - rust-lang#134034 (handle paren in macro expand for let-init-else expr)
 - rust-lang#138703 (chore: remove redundant words in comment)
 - rust-lang#139186 (Refactor `diy_float`)
 - rust-lang#139343 (Change signature of File::try_lock and File::try_lock_shared)
 - rust-lang#139780 (docs: Add example to `Iterator::take` with `by_ref`)
 - rust-lang#139802 (Fix some grammar errors and hyperlinks in doc for `trait Allocator`)
 - rust-lang#140034 (simd_select_bitmask: the 'padding' bits in the mask are just ignored)
 - rust-lang#140062 (std: mention `remove_dir_all` can emit `DirectoryNotEmpty` when concurrently written into)
 - rust-lang#140485 (Optimize the codegen for `Span::from_expansion`)
 - rust-lang#140505 (linker: Quote symbol names in .def files)
 - rust-lang#140521 (interpret: better error message for out-of-bounds pointer arithmetic and accesses)

r? `@ghost`
`@rustbot` modify labels: rollup
Zalathar added a commit to Zalathar/rust that referenced this pull request May 1, 2025
…ng, r=workingjubilee

simd_select_bitmask: the 'padding' bits in the mask are just ignored

Fixes rust-lang#137942: we documented simd_select_bitmask to require the 'padding' bits in the mask (the mask can sometimes be longer than the vector; I am referring to these extra bits as 'padding' here)  to be zero, mostly because nobody felt like doing the research for what should be done when they are non-zero. However, codegen is already perfectly happy just ignoring them, so in practice they can have any value. Some of the intrinsic wrappers in stdarch have trouble ensuring that they are zero. So let's just adjust the docs and Miri to permit non-zero 'padding' bits.

Cc ``@Amanieu`` ``@workingjubilee``
bors added a commit to rust-lang-ci/rust that referenced this pull request May 1, 2025
Rollup of 10 pull requests

Successful merges:

 - rust-lang#134034 (handle paren in macro expand for let-init-else expr)
 - rust-lang#138703 (chore: remove redundant words in comment)
 - rust-lang#139186 (Refactor `diy_float`)
 - rust-lang#139343 (Change signature of File::try_lock and File::try_lock_shared)
 - rust-lang#139780 (docs: Add example to `Iterator::take` with `by_ref`)
 - rust-lang#139802 (Fix some grammar errors and hyperlinks in doc for `trait Allocator`)
 - rust-lang#140034 (simd_select_bitmask: the 'padding' bits in the mask are just ignored)
 - rust-lang#140062 (std: mention `remove_dir_all` can emit `DirectoryNotEmpty` when concurrently written into)
 - rust-lang#140485 (Optimize the codegen for `Span::from_expansion`)
 - rust-lang#140521 (interpret: better error message for out-of-bounds pointer arithmetic and accesses)

r? `@ghost`
`@rustbot` modify labels: rollup
GuillaumeGomez added a commit to GuillaumeGomez/rust that referenced this pull request May 1, 2025
…ng, r=workingjubilee

simd_select_bitmask: the 'padding' bits in the mask are just ignored

Fixes rust-lang#137942: we documented simd_select_bitmask to require the 'padding' bits in the mask (the mask can sometimes be longer than the vector; I am referring to these extra bits as 'padding' here)  to be zero, mostly because nobody felt like doing the research for what should be done when they are non-zero. However, codegen is already perfectly happy just ignoring them, so in practice they can have any value. Some of the intrinsic wrappers in stdarch have trouble ensuring that they are zero. So let's just adjust the docs and Miri to permit non-zero 'padding' bits.

Cc ```@Amanieu``` ```@workingjubilee```
bors added a commit to rust-lang-ci/rust that referenced this pull request May 1, 2025
…llaumeGomez

Rollup of 12 pull requests

Successful merges:

 - rust-lang#138703 (chore: remove redundant words in comment)
 - rust-lang#139186 (Refactor `diy_float`)
 - rust-lang#139343 (Change signature of File::try_lock and File::try_lock_shared)
 - rust-lang#139780 (docs: Add example to `Iterator::take` with `by_ref`)
 - rust-lang#139802 (Fix some grammar errors and hyperlinks in doc for `trait Allocator`)
 - rust-lang#140034 (simd_select_bitmask: the 'padding' bits in the mask are just ignored)
 - rust-lang#140062 (std: mention `remove_dir_all` can emit `DirectoryNotEmpty` when concurrently written into)
 - rust-lang#140420 (rustdoc: Fix doctest heuristic for main fn wrapping)
 - rust-lang#140460 (Fix handling of LoongArch target features not supported by LLVM 19)
 - rust-lang#140538 (rustc-dev-guide subtree update)
 - rust-lang#140552 (allow `#[rustc_std_internal_symbol]` in combination with `#[naked]`)
 - rust-lang#140556 (Improve error output in case `nodejs` or `npm` is not installed for rustdoc-gui test suite)

r? `@ghost`
`@rustbot` modify labels: rollup
bors added a commit to rust-lang-ci/rust that referenced this pull request May 2, 2025
…llaumeGomez

Rollup of 12 pull requests

Successful merges:

 - rust-lang#138703 (chore: remove redundant words in comment)
 - rust-lang#139186 (Refactor `diy_float`)
 - rust-lang#139780 (docs: Add example to `Iterator::take` with `by_ref`)
 - rust-lang#139802 (Fix some grammar errors and hyperlinks in doc for `trait Allocator`)
 - rust-lang#140034 (simd_select_bitmask: the 'padding' bits in the mask are just ignored)
 - rust-lang#140062 (std: mention `remove_dir_all` can emit `DirectoryNotEmpty` when concurrently written into)
 - rust-lang#140420 (rustdoc: Fix doctest heuristic for main fn wrapping)
 - rust-lang#140460 (Fix handling of LoongArch target features not supported by LLVM 19)
 - rust-lang#140538 (rustc-dev-guide subtree update)
 - rust-lang#140544 (Clean up "const" situation in format_args!(). )
 - rust-lang#140552 (allow `#[rustc_std_internal_symbol]` in combination with `#[naked]`)
 - rust-lang#140556 (Improve error output in case `nodejs` or `npm` is not installed for rustdoc-gui test suite)

r? `@ghost`
`@rustbot` modify labels: rollup
VlaDexa added a commit to VlaDexa/rust that referenced this pull request May 2, 2025
…ng, r=workingjubilee

simd_select_bitmask: the 'padding' bits in the mask are just ignored

Fixes rust-lang#137942: we documented simd_select_bitmask to require the 'padding' bits in the mask (the mask can sometimes be longer than the vector; I am referring to these extra bits as 'padding' here)  to be zero, mostly because nobody felt like doing the research for what should be done when they are non-zero. However, codegen is already perfectly happy just ignoring them, so in practice they can have any value. Some of the intrinsic wrappers in stdarch have trouble ensuring that they are zero. So let's just adjust the docs and Miri to permit non-zero 'padding' bits.

Cc `@Amanieu` `@workingjubilee`
VlaDexa added a commit to VlaDexa/rust that referenced this pull request May 2, 2025
…uillaumeGomez

Rollup of 12 pull requests

Successful merges:

 - rust-lang#138703 (chore: remove redundant words in comment)
 - rust-lang#139186 (Refactor `diy_float`)
 - rust-lang#139780 (docs: Add example to `Iterator::take` with `by_ref`)
 - rust-lang#139802 (Fix some grammar errors and hyperlinks in doc for `trait Allocator`)
 - rust-lang#140034 (simd_select_bitmask: the 'padding' bits in the mask are just ignored)
 - rust-lang#140062 (std: mention `remove_dir_all` can emit `DirectoryNotEmpty` when concurrently written into)
 - rust-lang#140420 (rustdoc: Fix doctest heuristic for main fn wrapping)
 - rust-lang#140460 (Fix handling of LoongArch target features not supported by LLVM 19)
 - rust-lang#140538 (rustc-dev-guide subtree update)
 - rust-lang#140544 (Clean up "const" situation in format_args!(). )
 - rust-lang#140552 (allow `#[rustc_std_internal_symbol]` in combination with `#[naked]`)
 - rust-lang#140556 (Improve error output in case `nodejs` or `npm` is not installed for rustdoc-gui test suite)

r? `@ghost`
`@rustbot` modify labels: rollup
@bors bors merged commit 5a25a7a into rust-lang:master May 2, 2025
6 checks passed
@rustbot rustbot added this to the 1.88.0 milestone May 2, 2025
rust-timer added a commit to rust-lang-ci/rust that referenced this pull request May 2, 2025
Rollup merge of rust-lang#140034 - RalfJung:simd_select_bitmask-padding, r=workingjubilee

simd_select_bitmask: the 'padding' bits in the mask are just ignored

Fixes rust-lang#137942: we documented simd_select_bitmask to require the 'padding' bits in the mask (the mask can sometimes be longer than the vector; I am referring to these extra bits as 'padding' here)  to be zero, mostly because nobody felt like doing the research for what should be done when they are non-zero. However, codegen is already perfectly happy just ignoring them, so in practice they can have any value. Some of the intrinsic wrappers in stdarch have trouble ensuring that they are zero. So let's just adjust the docs and Miri to permit non-zero 'padding' bits.

Cc ````@Amanieu```` ````@workingjubilee````
@RalfJung RalfJung deleted the simd_select_bitmask-padding branch May 4, 2025 14:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. T-libs Relevant to the library team, which will review and decide on the PR/issue.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Potentially unsound uses of simd_select_bitmask in stdarch
7 participants