src/lj_mcode.c

   1 /*
   2 ** Machine code management.
   3 ** Copyright (C) 2005-2011 Mike Pall. See Copyright Notice in luajit.h
   4 */
   5
   6 #define lj_mcode_c
   7 #define LUA_CORE
   8
   9 #include "lj_obj.h"
  10
  11 #if LJ_HASJIT
  12
  13 #include "lj_gc.h"
  14 #include "lj_jit.h"
  15 #include "lj_mcode.h"
  16 #include "lj_trace.h"
  17 #include "lj_dispatch.h"
  18 #include "lj_vm.h"
  19
  20 /* -- OS-specific functions ----------------------------------------------- */
  21
  22 #if LJ_TARGET_WINDOWS
  23
  24 #define WIN32_LEAN_AND_MEAN
  25 #include <windows.h>
  26
  27 #define MCPROT_RW       PAGE_READWRITE
  28 #define MCPROT_RX       PAGE_EXECUTE_READ
  29 #define MCPROT_RWX      PAGE_EXECUTE_READWRITE
  30
  31 static void *mcode_alloc_at(jit_State *J, uintptr_t hint, size_t sz, DWORD prot)
  32 {
  33   void *p = VirtualAlloc((void *)hint, sz,
  34                          MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN, prot);
  35   if (!p && !hint)
  36     lj_trace_err(J, LJ_TRERR_MCODEAL);
  37   return p;
  38 }
  39
  40 static void mcode_free(jit_State *J, void *p, size_t sz)
  41 {
  42   UNUSED(J); UNUSED(sz);
  43   VirtualFree(p, 0, MEM_RELEASE);
  44 }
  45
  46 static void mcode_setprot(void *p, size_t sz, DWORD prot)
  47 {
  48   DWORD oprot;
  49   VirtualProtect(p, sz, prot, &oprot);
  50 }
  51
  52 #elif LJ_TARGET_POSIX
  53
  54 #include <sys/mman.h>
  55
  56 #ifndef MAP_ANONYMOUS
  57 #define MAP_ANONYMOUS   MAP_ANON
  58 #endif
  59
  60 #define MCPROT_RW       (PROT_READ|PROT_WRITE)
  61 #define MCPROT_RX       (PROT_READ|PROT_EXEC)
  62 #define MCPROT_RWX      (PROT_READ|PROT_WRITE|PROT_EXEC)
  63
  64 static void *mcode_alloc_at(jit_State *J, uintptr_t hint, size_t sz, int prot)
  65 {
  66   void *p = mmap((void *)hint, sz, prot, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
  67   if (p == MAP_FAILED && !hint)
  68     lj_trace_err(J, LJ_TRERR_MCODEAL);
  69   return p;
  70 }
  71
  72 static void mcode_free(jit_State *J, void *p, size_t sz)
  73 {
  74   UNUSED(J);
  75   munmap(p, sz);
  76 }
  77
  78 static void mcode_setprot(void *p, size_t sz, int prot)
  79 {
  80   mprotect(p, sz, prot);
  81 }
  82
  83 #elif LJ_64
  84
  85 #error "Missing OS support for explicit placement of executable memory"
  86
  87 #else
  88
  89 /* Fallback allocator. This will fail if memory is not executable by default. */
  90 #define LUAJIT_UNPROTECT_MCODE
  91 #define MCPROT_RW       0
  92 #define MCPROT_RX       0
  93 #define MCPROT_RWX      0
  94
  95 static void *mcode_alloc_at(jit_State *J, uintptr_t hint, size_t sz, int prot)
  96 {
  97   UNUSED(hint); UNUSED(prot);
  98   return lj_mem_new(J->L, sz);
  99 }
 100
 101 static void mcode_free(jit_State *J, void *p, size_t sz)
 102 {
 103   lj_mem_free(J2G(J), p, sz);
 104 }
 105
 106 #define mcode_setprot(p, sz, prot)      UNUSED(p)
 107
 108 #endif
 109
 110 /* -- MCode area protection ----------------------------------------------- */
 111
 112 /* Define this ONLY if the page protection twiddling becomes a bottleneck. */
 113 #ifdef LUAJIT_UNPROTECT_MCODE
 114
 115 /* It's generally considered to be a potential security risk to have
 116 ** pages with simultaneous write *and* execute access in a process.
 117 **
 118 ** Do not even think about using this mode for server processes or
 119 ** apps handling untrusted external data (such as a browser).
 120 **
 121 ** The security risk is not in LuaJIT itself -- but if an adversary finds
 122 ** any *other* flaw in your C application logic, then any RWX memory page
 123 ** simplifies writing an exploit considerably.
 124 */
 125 #define MCPROT_GEN      MCPROT_RWX
 126 #define MCPROT_RUN      MCPROT_RWX
 127
 128 static void mcode_protect(jit_State *J, int prot)
 129 {
 130   UNUSED(J); UNUSED(prot);
 131 }
 132
 133 #else
 134
 135 /* This is the default behaviour and much safer:
 136 **
 137 ** Most of the time the memory pages holding machine code are executable,
 138 ** but NONE of them is writable.
 139 **
 140 ** The current memory area is marked read-write (but NOT executable) only
 141 ** during the short time window while the assembler generates machine code.
 142 */
 143 #define MCPROT_GEN      MCPROT_RW
 144 #define MCPROT_RUN      MCPROT_RX
 145
 146 /* Change protection of MCode area. */
 147 static void mcode_protect(jit_State *J, int prot)
 148 {
 149   if (J->mcprot != prot) {
 150     mcode_setprot(J->mcarea, J->szmcarea, prot);
 151     J->mcprot = prot;
 152   }
 153 }
 154
 155 #endif
 156
 157 /* -- MCode area allocation ----------------------------------------------- */
 158
 159 #if LJ_TARGET_X64
 160 #define mcode_validptr(p)       ((p) && (uintptr_t)(p) < (uintptr_t)1<<47)
 161 #else
 162 #define mcode_validptr(p)       ((p) && (uintptr_t)(p) < 0xffff0000)
 163 #endif
 164
 165 #ifdef LJ_TARGET_JUMPRANGE
 166
 167 /* Get memory within relative jump distance of our code in 64 bit mode. */
 168 static void *mcode_alloc(jit_State *J, size_t sz)
 169 {
 170   /* Target an address in the static assembler code (64K aligned).
 171   ** Try addresses within a distance of target-range/2+1MB..target+range/2-1MB.
 172   */
 173   uintptr_t target = (uintptr_t)(void *)lj_vm_exit_handler & ~(uintptr_t)0xffff;
 174   const uintptr_t range = (1u << LJ_TARGET_JUMPRANGE) - (1u << 21);
 175   /* First try a contiguous area below the last one. */
 176   uintptr_t hint = J->mcarea ? (uintptr_t)J->mcarea - sz : 0;
 177   int i;
 178   for (i = 0; i < 32; i++) {  /* 32 attempts ought to be enough ... */
 179     if (mcode_validptr(hint)) {
 180       void *p = mcode_alloc_at(J, hint, sz, MCPROT_GEN);
 181
 182       if (mcode_validptr(p)) {
 183         if ((uintptr_t)p + sz - target < range || target - (uintptr_t)p < range)
 184           return p;
 185         mcode_free(J, p, sz);  /* Free badly placed area. */
 186       }
 187     }
 188     /* Next try probing pseudo-random addresses. */
 189     do {
 190       hint = (0x78fb ^ LJ_PRNG_BITS(J, 15)) << 16;  /* 64K aligned. */
 191     } while (!(hint + sz < range));
 192     hint = target + hint - (range>>1);
 193   }
 194   lj_trace_err(J, LJ_TRERR_MCODEAL);  /* Give up. OS probably ignores hints? */
 195   return NULL;
 196 }
 197
 198 #else
 199
 200 /* All memory addresses are reachable by relative jumps. */
 201 #define mcode_alloc(J, sz)      mcode_alloc_at((J), 0, (sz), MCPROT_GEN)
 202
 203 #endif
 204
 205 /* -- MCode area management ----------------------------------------------- */
 206
 207 /* Linked list of MCode areas. */
 208 typedef struct MCLink {
 209   MCode *next;          /* Next area. */
 210   size_t size;          /* Size of current area. */
 211 } MCLink;
 212
 213 /* Allocate a new MCode area. */
 214 static void mcode_allocarea(jit_State *J)
 215 {
 216   MCode *oldarea = J->mcarea;
 217   size_t sz = (size_t)J->param[JIT_P_sizemcode] << 10;
 218   sz = (sz + LJ_PAGESIZE-1) & ~(size_t)(LJ_PAGESIZE - 1);
 219   J->mcarea = (MCode *)mcode_alloc(J, sz);
 220   J->szmcarea = sz;
 221   J->mcprot = MCPROT_GEN;
 222   J->mctop = (MCode *)((char *)J->mcarea + J->szmcarea);
 223   J->mcbot = (MCode *)((char *)J->mcarea + sizeof(MCLink));
 224   ((MCLink *)J->mcarea)->next = oldarea;
 225   ((MCLink *)J->mcarea)->size = sz;
 226   J->szallmcarea += sz;
 227 }
 228
 229 /* Free all MCode areas. */
 230 void lj_mcode_free(jit_State *J)
 231 {
 232   MCode *mc = J->mcarea;
 233   J->mcarea = NULL;
 234   J->szallmcarea = 0;
 235   while (mc) {
 236     MCode *next = ((MCLink *)mc)->next;
 237     mcode_free(J, mc, ((MCLink *)mc)->size);
 238     mc = next;
 239   }
 240 }
 241
 242 /* -- MCode transactions -------------------------------------------------- */
 243
 244 /* Reserve the remainder of the current MCode area. */
 245 MCode *lj_mcode_reserve(jit_State *J, MCode **lim)
 246 {
 247   if (!J->mcarea)
 248     mcode_allocarea(J);
 249   else
 250     mcode_protect(J, MCPROT_GEN);
 251   *lim = J->mcbot;
 252   return J->mctop;
 253 }
 254
 255 /* Commit the top part of the current MCode area. */
 256 void lj_mcode_commit(jit_State *J, MCode *top)
 257 {
 258   J->mctop = top;
 259   mcode_protect(J, MCPROT_RUN);
 260 }
 261
 262 /* Abort the reservation. */
 263 void lj_mcode_abort(jit_State *J)
 264 {
 265   mcode_protect(J, MCPROT_RUN);
 266 }
 267
 268 /* Set/reset protection to allow patching of MCode areas. */
 269 MCode *lj_mcode_patch(jit_State *J, MCode *ptr, int finish)
 270 {
 271 #ifdef LUAJIT_UNPROTECT_MCODE
 272   UNUSED(J); UNUSED(ptr); UNUSED(finish);
 273   return NULL;
 274 #else
 275   if (finish) {
 276     if (J->mcarea == ptr)
 277       mcode_protect(J, MCPROT_RUN);
 278     else
 279       mcode_setprot(ptr, ((MCLink *)ptr)->size, MCPROT_RUN);
 280     return NULL;
 281   } else {
 282     MCode *mc = J->mcarea;
 283     /* Try current area first to use the protection cache. */
 284     if (ptr >= mc && ptr < (MCode *)((char *)mc + J->szmcarea)) {
 285       mcode_protect(J, MCPROT_GEN);
 286       return mc;
 287     }
 288     /* Otherwise search through the list of MCode areas. */
 289     for (;;) {
 290       mc = ((MCLink *)mc)->next;
 291       lua_assert(mc != NULL);
 292       if (ptr >= mc && ptr < (MCode *)((char *)mc + ((MCLink *)mc)->size)) {
 293         mcode_setprot(mc, ((MCLink *)mc)->size, MCPROT_GEN);
 294         return mc;
 295       }
 296     }
 297   }
 298 #endif
 299 }
 300
 301 /* Limit of MCode reservation reached. */
 302 void lj_mcode_limiterr(jit_State *J, size_t need)
 303 {
 304   size_t sizemcode, maxmcode;
 305   lj_mcode_abort(J);
 306   sizemcode = (size_t)J->param[JIT_P_sizemcode] << 10;
 307   sizemcode = (sizemcode + LJ_PAGESIZE-1) & ~(size_t)(LJ_PAGESIZE - 1);
 308   maxmcode = (size_t)J->param[JIT_P_maxmcode] << 10;
 309   if ((size_t)need > sizemcode)
 310     lj_trace_err(J, LJ_TRERR_MCODEOV);  /* Too long for any area. */
 311   if (J->szallmcarea + sizemcode > maxmcode)
 312     lj_trace_err(J, LJ_TRERR_MCODEAL);
 313   mcode_allocarea(J);
 314   lj_trace_err(J, LJ_TRERR_MCODELM);  /* Retry with new area. */
 315 }
 316
 317 #endif