Compare commits

...

5 Commits

Author SHA1 Message Date
Igor Munkin
550112ddc1
Merge d969cb9c31 into eec7a8016c 2025-04-14 22:07:40 +08:00
Mike Pall
eec7a8016c Prevent Clang UB 'optimization' which breaks integerness checks.
Thanks to Kacper Michajłow. #1351 #1355
2025-04-10 22:53:50 +02:00
Mike Pall
51d4c26ec7 ARM: Fix soft-float math.min()/math.max().
Reported by Dong Jianqiang. #1356
2025-04-10 22:45:38 +02:00
Mike Pall
c262976486 ARM64: Fix pass-by-value struct calling conventions.
Reported by AnthonyK213. #1357
2025-04-10 22:06:47 +02:00
Igor Munkin
d969cb9c31
Prevent Lua VM re-entry through JIT trace.
JIT recording semantics assumes FFI calls are leaf regarding the LuaJIT
VM: if the execution exited Lua world through FFI machinery it is not
re-entering Lua world again.

However, there is a way to break this assumption via FFI: one can
re-enter LuaJIT VM via Lua C API used within the particular C routine
called via FFI. As a result the following host stack mix is created:
| Lua-FFI -> C routine -> Lua-C API -> Lua VM

This sort of re-entrancy is not supported by LuaJIT tracing compiler.
@mraleph named such kind of the call stack an "FFI sandwich" in the
tarantool/tarantool#4427.

This changeset introduces the mechanism for Lua-C API callbacks similar
to the one implemented for Lua-FFI: trace recording is aborted when the
execution re-enters LuaJIT VM. If re-enter is detected while running the
particular mcode, the runtime finishes its execution with EXIT_FAILURE
code and calls panic routine prior to the exit.

Co-authored-by: Vyacheslav Egorov <vegorov@google.com>
Co-authored-by: Sergey Ostanevich <sergos@tarantool.org>
Signed-off-by: Igor Munkin <imun@cpan.org>
2024-02-21 19:30:34 +03:00
6 changed files with 43 additions and 8 deletions

View File

@ -302,6 +302,9 @@ endif
ifneq (,$(INSTALL_LJLIBD))
TARGET_XCFLAGS+= -DLUA_LJDIR=\"$(INSTALL_LJLIBD)\"
endif
ifeq (,$(shell $(TARGET_CC) -o /dev/null -c -x c /dev/null -fno-strict-float-cast-overflow 2>/dev/null || echo 1))
TARGET_XCFLAGS+= -fno-strict-float-cast-overflow
endif
##############################################################################
# Target system detection.

View File

@ -92,6 +92,18 @@ static GCtab *getcurrenv(lua_State *L)
return fn->c.gct == ~LJ_TFUNC ? tabref(fn->c.env) : tabref(L->env);
}
static void check_vm_sandwich(lua_State *L)
{
global_State *g = G(L);
/* Forbid Lua world re-entry while running the trace */
if (tvref(g->jit_base)) {
setstrV(L, L->top++, lj_err_str(L, LJ_ERR_JITREVM));
if (g->panic) g->panic(L);
exit(EXIT_FAILURE);
}
lj_trace_abort(g); /* Never record across Lua VM entrance */
}
/* -- Miscellaneous API functions ----------------------------------------- */
LUA_API int lua_status(lua_State *L)
@ -318,6 +330,7 @@ LUA_API int lua_equal(lua_State *L, int idx1, int idx2)
return (int)(uintptr_t)base;
} else {
L->top = base+2;
check_vm_sandwich(L);
lj_vm_call(L, base, 1+1);
L->top -= 2+LJ_FR2;
return tvistruecond(L->top+1+LJ_FR2);
@ -341,6 +354,7 @@ LUA_API int lua_lessthan(lua_State *L, int idx1, int idx2)
return (int)(uintptr_t)base;
} else {
L->top = base+2;
check_vm_sandwich(L);
lj_vm_call(L, base, 1+1);
L->top -= 2+LJ_FR2;
return tvistruecond(L->top+1+LJ_FR2);
@ -786,6 +800,7 @@ LUA_API void lua_concat(lua_State *L, int n)
}
n -= (int)(L->top - (top - 2*LJ_FR2));
L->top = top+2;
check_vm_sandwich(L);
lj_vm_call(L, top, 1+1);
L->top -= 1+LJ_FR2;
copyTV(L, L->top-1, L->top+LJ_FR2);
@ -805,6 +820,7 @@ LUA_API void lua_gettable(lua_State *L, int idx)
cTValue *v = lj_meta_tget(L, t, L->top-1);
if (v == NULL) {
L->top += 2;
check_vm_sandwich(L);
lj_vm_call(L, L->top-2, 1+1);
L->top -= 2+LJ_FR2;
v = L->top+1+LJ_FR2;
@ -820,6 +836,7 @@ LUA_API void lua_getfield(lua_State *L, int idx, const char *k)
v = lj_meta_tget(L, t, &key);
if (v == NULL) {
L->top += 2;
check_vm_sandwich(L);
lj_vm_call(L, L->top-2, 1+1);
L->top -= 2+LJ_FR2;
v = L->top+1+LJ_FR2;
@ -978,6 +995,7 @@ LUA_API void lua_settable(lua_State *L, int idx)
TValue *base = L->top;
copyTV(L, base+2, base-3-2*LJ_FR2);
L->top = base+3;
check_vm_sandwich(L);
lj_vm_call(L, base, 0+1);
L->top -= 3+LJ_FR2;
}
@ -998,6 +1016,7 @@ LUA_API void lua_setfield(lua_State *L, int idx, const char *k)
TValue *base = L->top;
copyTV(L, base+2, base-3-2*LJ_FR2);
L->top = base+3;
check_vm_sandwich(L);
lj_vm_call(L, base, 0+1);
L->top -= 2+LJ_FR2;
}
@ -1130,6 +1149,7 @@ LUA_API void lua_call(lua_State *L, int nargs, int nresults)
lj_checkapi(L->status == LUA_OK || L->status == LUA_ERRERR,
"thread called in wrong state %d", L->status);
lj_checkapi_slot(nargs+1);
check_vm_sandwich(L);
lj_vm_call(L, api_call_base(L, nargs), nresults+1);
}
@ -1148,6 +1168,7 @@ LUA_API int lua_pcall(lua_State *L, int nargs, int nresults, int errfunc)
cTValue *o = index2adr_stack(L, errfunc);
ef = savestack(L, o);
}
check_vm_sandwich(L);
status = lj_vm_pcall(L, api_call_base(L, nargs), nresults+1, ef);
if (status) hook_restore(g, oldh);
return status;
@ -1176,6 +1197,7 @@ LUA_API int lua_cpcall(lua_State *L, lua_CFunction func, void *ud)
int status;
lj_checkapi(L->status == LUA_OK || L->status == LUA_ERRERR,
"thread called in wrong state %d", L->status);
check_vm_sandwich(L);
status = lj_vm_cpcall(L, func, ud, cpcall);
if (status) hook_restore(g, oldh);
return status;
@ -1188,6 +1210,7 @@ LUALIB_API int luaL_callmeta(lua_State *L, int idx, const char *field)
if (LJ_FR2) setnilV(top++);
copyTV(L, top++, index2adr(L, idx));
L->top = top;
check_vm_sandwich(L);
lj_vm_call(L, top-1, 1+1);
return 1;
}

View File

@ -1927,7 +1927,7 @@ static void asm_hiop(ASMState *as, IRIns *ir)
} else if ((ir-1)->o == IR_MIN || (ir-1)->o == IR_MAX) {
as->curins--; /* Always skip the loword min/max. */
if (uselo || usehi)
asm_sfpmin_max(as, ir-1, (ir-1)->o == IR_MIN ? CC_PL : CC_LE);
asm_sfpmin_max(as, ir-1, (ir-1)->o == IR_MIN ? CC_HS : CC_LS);
return;
#elif LJ_HASFFI
} else if ((ir-1)->o == IR_CONV) {

View File

@ -781,17 +781,24 @@ static unsigned int ccall_classify_struct(CTState *cts, CType *ct)
{
CTSize sz = ct->size;
unsigned int r = 0, n = 0, isu = (ct->info & CTF_UNION);
while (ct->sib) {
while (ct->sib && n <= 4) {
unsigned int m = 1;
CType *sct;
ct = ctype_get(cts, ct->sib);
if (ctype_isfield(ct->info)) {
sct = ctype_rawchild(cts, ct);
if (ctype_isarray(sct->info)) {
CType *cct = ctype_rawchild(cts, sct);
if (!cct->size) continue;
m = sct->size / cct->size;
sct = cct;
}
if (ctype_isfp(sct->info)) {
r |= sct->size;
if (!isu) n++; else if (n == 0) n = 1;
if (!isu) n += m; else if (n < m) n = m;
} else if (ctype_iscomplex(sct->info)) {
r |= (sct->size >> 1);
if (!isu) n += 2; else if (n < 2) n = 2;
if (!isu) n += 2*m; else if (n < 2*m) n = 2*m;
} else if (ctype_isstruct(sct->info)) {
goto substruct;
} else {
@ -803,10 +810,11 @@ static unsigned int ccall_classify_struct(CTState *cts, CType *ct)
sct = ctype_rawchild(cts, ct);
substruct:
if (sct->size > 0) {
unsigned int s = ccall_classify_struct(cts, sct);
unsigned int s = ccall_classify_struct(cts, sct), sn;
if (s <= 1) goto noth;
r |= (s & 255);
if (!isu) n += (s >> 8); else if (n < (s >>8)) n = (s >> 8);
sn = (s >> 8) * m;
if (!isu) n += sn; else if (n < sn) n = sn;
}
}
}

View File

@ -110,6 +110,7 @@ ERRDEF(NOJIT, "no JIT compiler for this architecture (yet)")
ERRDEF(NOJIT, "JIT compiler permanently disabled by build option")
#endif
ERRDEF(JITOPT, "unknown or malformed optimization flag " LUA_QS)
ERRDEF(JITREVM, "Lua VM re-entry is detected while executing the trace")
/* Lexer/parser errors. */
ERRDEF(XMODE, "attempt to load chunk with wrong mode")

View File

@ -1717,8 +1717,8 @@ static void build_subroutines(BuildCtx *ctx)
|.endif
|.endmacro
|
| math_minmax math_min, gt, pl
| math_minmax math_max, lt, le
| math_minmax math_min, gt, hs
| math_minmax math_max, lt, ls
|
|//-- String library -----------------------------------------------------
|