From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 5DC20464E99; Thu, 16 Jan 2025 16:36:40 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 5DC20464E99 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1737034600; bh=EHNgQzdoQOHH/G8jTnx/5PVx9/B6LkKI/3rmrY4WCCg=; h=To:Date:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:Cc:From; b=HEA4c7+kR62btZNpJ+VbULd+BvKHk6OeiU3DbHw8mLdthkQkU0A/HEccg9NWSYXWO 1STs1paD+wThXu6zq7W9PRw2JTWpFKUJwCYFxBycFyxzu5nxLBjHs/Tcn+2KZUtEmp 3zk1BJC+pb2sCw4eeTGqHRxlTueYvtgAtDpMTiwc= Received: from send194.i.mail.ru (send194.i.mail.ru [95.163.59.33]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id AE8F6464E99 for ; Thu, 16 Jan 2025 16:36:38 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org AE8F6464E99 Received: by exim-smtp-6758d5575c-4bxgt with esmtpa (envelope-from ) id 1tYQ33-00000000KVX-2gw8; Thu, 16 Jan 2025 16:36:38 +0300 To: Sergey Bronnikov Date: Thu, 16 Jan 2025 16:35:59 +0300 Message-ID: <20250116133559.2686-1-skaplun@tarantool.org> X-Mailer: git-send-email 2.47.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-7564579A: 78E4E2B564C1792B X-77F55803: 4F1203BC0FB41BD9CAF828D4DCE9EB95CD45B2FAC57533DFAC46AA3685CEE193182A05F5380850407533F0EE9613E6483DE06ABAFEAF67054BAAA08B56511FD91FCF1133F96F8FB71BB5EE8A55BF1B9C X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7560ADFC8AADDC107EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637205505A8D8EF484BEA1F7E6F0F101C6723150C8DA25C47586E58E00D9D99D84E1BDDB23E98D2D38BC08E230531AC9C90913FC9327BAB7883A6FA110E3E49D3080ADEF9EBDEBCF261A471835C12D1D9774AD6D5ED66289B5278DA827A17800CE7ABB305BD10C6E5099FA2833FD35BB23D2EF20D2F80756B5F868A13BD56FB6657A471835C12D1D977725E5C173C3A84C3E97D2AE7161E217F117882F4460429728AD0CFFFB425014E868A13BD56FB6657E2021AF6380DFAD1A18204E546F3947CB11811A4A51E3B096D1867E19FE1407959CC434672EE6371089D37D7C0E48F6C8AA50765F7900637C970FD8DF19C51D2EFF80C71ABB335746BA297DBC24807EABDAD6C7F3747799A X-C1DE0DAB: 0D63561A33F958A53DCF41869028FF8C5002B1117B3ED6968010054ECDCF044D957033528158102E823CB91A9FED034534781492E4B8EEAD7B290D7AC426432BC79554A2A72441328621D336A7BC284946AD531847A6065A535571D14F44ED41 X-C8649E89: 1C3962B70DF3F0ADE00A9FD3E00BEEDF77DD89D51EBB7742D3581295AF09D3DF87807E0823442EA2ED31085941D9CD0AF7F820E7B07EA4CF50C6892CBF4305E7C77013202F7B8106A72B76D2B34B21ED98B46A096EDEDF0A212E5196DFD6A13F8239A89FD99B18755302F25037C0BEC83C439BB9ACC64B73DC01FE3155BEC4745F4332CA8FE04980913E6812662D5F2A5EAB5682573093F7837F15F2B5E4A70B33F2C28C22F508233FCF178C6DD14203 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojyistvkELW9otnHYvQrOhyw== X-DA7885C5: CFE28D84F46FCA8CF255D290C0D534F91425D360DC7B0FF16BD826CB517CFDEB4714DC19716DBA9F5B1A4C17EAA7BC4BEF2421ABFA55128DAF83EF9164C44C7E X-Mailru-Sender: 689FA8AB762F739381B31377CF4CA219CCD756D7479390A52B553F02310501D2BFB75C1D17CD0DD7E49D44BB4BD9522A059A1ED8796F048DB274557F927329BE89D5A3BC2B10C37545BD1C3CC395C826B4A721A3011E896F X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit] x86/x64: Add more red zone checks to assembler backend. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall Thanks to Peter Cawley. (cherry picked from commit d854d00ce94b274359e5181bed13e977420daf5c) Assembling some instructions (like `IR_CONV int.num`, for example) with many mcode to be emitted may overflow the `MCLIM_REDZONE` (64) at once due to the huge mcode emitting. For example `IR_CONV` in this test requires 66 bytes of the machine code: | cvttsd2si r15d, xmm5 | xorps xmm9, xmm9 | cvtsi2sd xmm9, r15d | ucomisd xmm5, xmm9 | jnz 0x11edb00e5 ->37 | jpe 0x11edb00e5 ->37 | mov [rsp+0x80], r15d | mov r15, [rsp+0xe8] | movsd xmm9, [rsp+0xe0] | movsd xmm5, [rsp+0xd8] The reproducer needs sufficient register pressure as to immediately spill the result of the instruction to the stack and then reload the three registers used by the instruction, and to have chosen enough registers with numbers >=8 (because shaving off a REX prefix [1] or two would get 66 back down to <= `MCLIM_REDZONE`), and to be using lots of spill slots (because memory offsets <= 0x7f are shorter to encode compared to those >= 0x80. So, each reload instruction consumes 9 bytes. This makes this reproducer unstable (regarding the register allocator changes). Thus, only original test case is added as a regression test. This patch adds the red zone overflow checks more often for the IRs with many instructions to be emitted. Sergey Kaplun: * added the description and the test for the problem [1]: https://wiki.osdev.org/X86-64_Instruction_Encoding#REX_prefix Part of tarantool/tarantool#10709 --- Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1116-redzones-checks Related issues: * https://github.com/tarantool/tarantool/issues/10709 * https://github.com/LuaJIT/LuaJIT/issues/1116 src/lj_asm_x86.h | 8 +- .../lj-1116-redzones-checks.test.lua | 118 ++++++++++++++++++ 2 files changed, 124 insertions(+), 2 deletions(-) create mode 100644 test/tarantool-tests/lj-1116-redzones-checks.test.lua diff --git a/src/lj_asm_x86.h b/src/lj_asm_x86.h index a96bc2e7..4ae721a4 100644 --- a/src/lj_asm_x86.h +++ b/src/lj_asm_x86.h @@ -794,6 +794,7 @@ static void asm_tointg(ASMState *as, IRIns *ir, Reg left) emit_rr(as, XO_UCOMISD, left, tmp); emit_rr(as, XO_CVTSI2SD, tmp, dest); emit_rr(as, XO_XORPS, tmp, tmp); /* Avoid partial register stall. */ + checkmclim(as); emit_rr(as, XO_CVTTSD2SI, dest, left); /* Can't fuse since left is needed twice. */ } @@ -836,6 +837,7 @@ static void asm_conv(ASMState *as, IRIns *ir) emit_rr(as, XO_SUBSD, dest, bias); /* Subtract 2^52+2^51 bias. */ emit_rr(as, XO_XORPS, dest, bias); /* Merge bias and integer. */ emit_rma(as, XO_MOVSD, bias, k); + checkmclim(as); emit_mrm(as, XO_MOVD, dest, asm_fuseload(as, lref, RSET_GPR)); return; } else { /* Integer to FP conversion. */ @@ -1151,6 +1153,7 @@ static void asm_href(ASMState *as, IRIns *ir, IROp merge) asm_guardcc(as, CC_E); else emit_sjcc(as, CC_E, l_end); + checkmclim(as); if (irt_isnum(kt)) { if (isk) { /* Assumes -0.0 is already canonicalized to +0.0. */ @@ -1210,7 +1213,6 @@ static void asm_href(ASMState *as, IRIns *ir, IROp merge) #endif } emit_sfixup(as, l_loop); - checkmclim(as); #if LJ_GC64 if (!isk && irt_isaddr(kt)) { emit_rr(as, XO_OR, tmp|REX_64, key); @@ -1242,6 +1244,7 @@ static void asm_href(ASMState *as, IRIns *ir, IROp merge) emit_rr(as, XO_ARITH(XOg_SUB), dest, tmp); emit_shifti(as, XOg_ROL, tmp, HASH_ROT3); emit_rr(as, XO_ARITH(XOg_XOR), dest, tmp); + checkmclim(as); emit_shifti(as, XOg_ROL, dest, HASH_ROT2); emit_rr(as, XO_ARITH(XOg_SUB), tmp, dest); emit_shifti(as, XOg_ROL, dest, HASH_ROT1); @@ -1259,7 +1262,6 @@ static void asm_href(ASMState *as, IRIns *ir, IROp merge) } else { emit_rr(as, XO_MOV, tmp, key); #if LJ_GC64 - checkmclim(as); emit_gri(as, XG_ARITHi(XOg_XOR), dest, irt_toitype(kt) << 15); if ((as->flags & JIT_F_BMI2)) { emit_i8(as, 32); @@ -1530,6 +1532,7 @@ static void asm_ahuvload(ASMState *as, IRIns *ir) if (irt_islightud(ir->t)) { Reg dest = asm_load_lightud64(as, ir, 1); if (ra_hasreg(dest)) { + checkmclim(as); asm_fuseahuref(as, ir->op1, RSET_GPR); emit_mrm(as, XO_MOV, dest|REX_64, RID_MRM); } @@ -1574,6 +1577,7 @@ static void asm_ahuvload(ASMState *as, IRIns *ir) if (LJ_64 && irt_type(ir->t) >= IRT_NUM) { lj_assertA(irt_isinteger(ir->t) || irt_isnum(ir->t), "bad load type %d", irt_type(ir->t)); + checkmclim(as); #if LJ_GC64 emit_u32(as, LJ_TISNUM << 15); #else diff --git a/test/tarantool-tests/lj-1116-redzones-checks.test.lua b/test/tarantool-tests/lj-1116-redzones-checks.test.lua new file mode 100644 index 00000000..70062ec9 --- /dev/null +++ b/test/tarantool-tests/lj-1116-redzones-checks.test.lua @@ -0,0 +1,118 @@ +local tap = require('tap') +-- Test file to demonstrate mcode area overflow during recording a +-- trace with the high FPR pressure. +-- See also, https://github.com/LuaJIT/LuaJIT/issues/1116. +-- +-- XXX: Test fails only with GC64 enabled before the commit. +local test = tap.test('lj-1116-redzones-checks'):skipcond({ + ['Test requires JIT enabled'] = not jit.status(), +}) + +test:plan(1) + +jit.opt.start('hotloop=1') + +-- XXX: This test snippet was originally created by the fuzzer. +-- See https://oss-fuzz.com/testcase-detail/5622965122170880. +-- +-- Unfortunately, it's impossible to reduce the testcase further. +-- Before the patch, assembling some instructions (like `IR_CONV +-- int.num`, for example) with many mcode to be emitted may +-- overflow the `MCLIM_REDZONE` (64) at once due to the huge +-- mcode emitting. +-- For example `IR_CONV` in this test requires 66 bytes of the +-- machine code: +-- | cvttsd2si r15d, xmm5 +-- | xorps xmm9, xmm9 +-- | cvtsi2sd xmm9, r15d +-- | ucomisd xmm5, xmm9 +-- | jnz 0x11edb00e5 ->37 +-- | jpe 0x11edb00e5 ->37 +-- | mov [rsp+0x80], r15d +-- | mov r15, [rsp+0xe8] +-- | movsd xmm9, [rsp+0xe0] +-- | movsd xmm5, [rsp+0xd8] +-- +-- The reproducer needs sufficient register pressure as to +-- immediately spill the result of the instruction to the stack +-- and then reload the three registers used by the instruction, +-- and to have chosen enough registers with numbers >=8 (because +-- shaving off a REX prefix [1] or two would get 66 back down +-- to <= `MCLIM_REDZONE`), and to be using lots of spill slots +-- (because memory offsets <= 0x7f are shorter to encode compared +-- to those >= 0x80. So, each reload instruction consumes 9 bytes. +-- This makes this reproducer unstable (regarding the register +-- allocator changes). So, lets use this as a regression test. +-- +-- [1]: https://wiki.osdev.org/X86-64_Instruction_Encoding#REX_prefix + +_G.a = 0 +_G.b = 0 +_G.c = 0 +_G.d = 0 +_G.e = 0 +_G.f = 0 +_G.g = 0 +_G.h = 0 +-- Skip `i`. +_G.j = 0 +_G.k = 0 +_G.l = 0 +_G.m = 0 +_G.n = 0 +_G.o = 0 +_G.p = 0 +_G.q = 0 +_G.r = 0 +_G.s = 0 +_G.t = 0 +_G.u = 0 +_G.v = 0 +_G.w = 0 +_G.x = 0 +_G.y = 0 +_G.z = 0 + +-- XXX: Need here not 4, but 4.5 top border of the cycle to create +-- FPR pressure. +for i = 1, 4.5 do + _G.a = _G.a + 1 + _G.b = _G.b + 1 + _G.c = _G.c + 1 + _G.d = _G.d + 1 + for _ = i, 2 do + _G.e = _G.e + 1 + end + -- Here we emit `IR_CONV int.num`. This loop is inlined. + -- Assertion failed after emitting the variant part of the + -- big loop. + for _ = 2, i do + _G.f = _G.f + 1 + _G.g = _G.g + 1 + _G.h = _G.h + 1 + _G.j = _G.j + 1 + _G.k = _G.k + 1 + _G.l = _G.l + 1 + end + _G.m = _G.m + 1 + _G.n = _G.n + 1 + _G.o = _G.o + 1 + _G.p = _G.p + 1 + _G.q = _G.q + 1 + _G.r = _G.r + 1 + _G.s = _G.s + 1 + _G.t = _G.t + 1 + _G.u = _G.u + 1 + _G.v = _G.v + 1 + for _ = i, 2.1 do + _G.aa = _G.a + _G.w = _G.w + 1 + _G.x = _G.x + 1 + _G.y = _G.y + 1 + _G.z = _G.z + 1 + end +end + +test:ok(true, 'no mcode limit assertion failed during recording') + +test:done(true) -- 2.47.1