Synthesizing JIT Compilers for In-Kernel DSLs

Abstract

Modern operating systems allow user-space applications to submit code for kernel execution through the use of in-kernel domain specific languages (DSLs). Applications use these DSLs to customize system policies and add new functionality. For performance, the kernel executes them via just-in-time (JIT) compilation. The correctness of these JITs is crucial for the security of the kernel: bugs in in-kernel JITs have led to numerous critical issues and patches. This paper presents JitSynth, the first tool for synthesizing verified JITs for in-kernel DSLs. JitSynth takes as input interpreters for the source DSL and the target instruction set architecture. Given these interpreters, and a mapping from source to target states, JitSynth synthesizes a verified JIT compiler from the source to the target. Our key idea is to formulate this synthesis problem as one of synthesizing a perinstruction compiler for abstract register machines. Our core technical contribution is a new compiler metasketch that enables JitSynth to efficiently explore the resulting synthesis search space. To evaluate Jit-Synth, we use it to synthesize a JIT from eBPF to RISC-V and compare to a recently developed Linux JIT. The synthesized JIT avoids all known bugs in the Linux JIT, with an average slowdown of 1.82× in the performance of the generated code. We also use JitSynth to synthesize JITs for two additional source-target pairs. The results show that JitSynth offers a promising new way to develop verified JITs for in-kernel DSLs.

Approximate Bit Dependency Analysis to Identify Program Synthesis Problems as Infeasible

“…As we are not aware of a benchmark of infeasible synthesis problems, we use specifications from four sources: The bit vector rewrite rules of Nötzli et al [16], the code optimizations of Buchwald [3], the test cases in the public repository of Sasnauskas et al [18] without undefined behavior, and the Syntax Guided Synthesis competition benchmark [1]. As we are restricted to bit vector specifications with a single equality constraint and without precondition, this yields 26 + 56 + 23 + 19 = 124 specifications.…”

“…a user-specified cost model that assigns a cost to each operation. Such a problem lies at the heart of many applications [5,[17][18][19]. Later, we supply the generated synthesis problems to a second synthesizer.…”

“…Its ability to create a program that implements a specification function and consists of some given bit vector operations has recently propelled research in computer programming. For example, program synthesizers craft instruction selection rules in compilers [4], superoptimize code [18], generate code for unusual architectures [17], optimize machine learning kernels [5], or enumerate rewrite rules for SMT solvers [16]. As it is often not a priori known which and how many operations to use for a synthesized program, some applications formulate multiple synthesis problems that differ in the used operations [4] or in the length of the program [18].…”

“…For example, program synthesizers craft instruction selection rules in compilers [4], superoptimize code [18], generate code for unusual architectures [17], optimize machine learning kernels [5], or enumerate rewrite rules for SMT solvers [16]. As it is often not a priori known which and how many operations to use for a synthesized program, some applications formulate multiple synthesis problems that differ in the used operations [4] or in the length of the program [18]. Other works search over a collection of synthesis tasks [2] or generate synthesis problems based on a symbolic execution of a program [14].…”

Petr4: formal foundations for p4 data planes

“…Another line of recent work has focused on eBPF, the packet-processing framework supported in the Linux kernel. The JitK compiler [Wang et al 2014] uses a machineverified just-in-time compiler to generate code that is guaranteed to satisfy the safety conditions enforced by the kernel verifier, while JitSynth leverages program synthesis [Geffen et al 2020].…”