Trace uint32 FFI ccall returns

Author: Frityet

notes/ffi-callxs-record-gate.md

@@ -19,6 +19,9 @@ The sibling `lj_ccall_jit_i64_gpr()` helper traces exact zero-argument signed
 64-bit integer returns, preserving stock boxed int64 cdata results. Signed
 64-bit argument conversion remains interpreted until the recorder can produce
 the exact ABI value without widening the semantics.
+`lj_ccall_jit_u32_0()` traces exact zero-argument unsigned 32-bit returns as
+Lua numbers, preserving high-bit values without signed truncation. Unsigned
+integer argument conversion remains interpreted.
 The separate `lj_ccall_jit_{num,flt}_fpr()` helpers trace exact double or float
 returns with 0, 1, or 2 same-kind exact FP arguments through the same
 native-state bridge.

notes/ffi-ccall-jit-trampoline.md

@@ -1,15 +1,16 @@
 # FFI C-Call JIT Trampoline
 
 The first traced ordinary FFI C-call slice now records exact void, signed
-32-bit integer, pointer-returning, zero-argument signed 64-bit integer, and
-FP-returning function cdata on x64. The narrow GPR subset accepts 0, 1, or 2
-signed 32-bit integer/pointer arguments, plus exact zero-argument signed 64-bit
-integer returns. The FPR subset accepts 0, 1, or 2 same-kind exact float or
-double arguments. The recorder emits `lj_ccall_jit_void_gpr()`,
-`lj_ccall_jit_i32_gpr()`, `lj_ccall_jit_i64_gpr()`, or
-`lj_ccall_jit_ptr_gpr()` plus a tiny signature code for the GPR argument shape,
-or `lj_ccall_jit_num_fpr()` / `lj_ccall_jit_flt_fpr()` for the FP-only FPR
-shapes.
+32-bit integer, pointer-returning, zero-argument unsigned 32-bit/signed 64-bit
+integer, and FP-returning function cdata on x64. The narrow GPR subset accepts
+0, 1, or 2 signed 32-bit integer/pointer arguments, plus exact zero-argument
+unsigned 32-bit and signed 64-bit integer returns. The FPR subset accepts 0, 1,
+or 2 same-kind exact float or double arguments. The recorder emits
+`lj_ccall_jit_void_gpr()`, `lj_ccall_jit_i32_gpr()`,
+`lj_ccall_jit_i64_gpr()`, or `lj_ccall_jit_ptr_gpr()` plus a tiny signature
+code for the GPR argument shape, `lj_ccall_jit_u32_0()` for high-bit-safe
+unsigned 32-bit results, or `lj_ccall_jit_num_fpr()` /
+`lj_ccall_jit_flt_fpr()` for the FP-only FPR shapes.
 
 This does not enable the old direct `IR_CALLXS` path. Each helper is emitted as
 a side-effecting `IRCALL` with an implicit `lua_State *`; the recorder converts
@@ -23,6 +24,7 @@ The scope is deliberately narrow:
 - exactly 0, 1, or 2 Lua arguments;
 - exact signed 32-bit integer or pointer argument types;
 - void, exact signed 32-bit integer, or pointer return types;
+- zero-argument exact unsigned 32-bit integer returns as Lua numbers;
 - zero-argument exact signed 64-bit integer returns;
 - same-kind exact float/double arguments and exact float/double returns;
 - x64 only;
@@ -32,11 +34,12 @@ The scope is deliberately narrow:
 
 This gives hot `ffi.C.getpid()`, `ffi.C.abs(i)`, small
 `int add(int,int)`-style loops, simple pointer-return/pointer-argument loops,
-side-effecting `void f(...)` loops, zero-argument signed int64 cdata-result
-loops, and FP-only numeric call loops a traced, nonblocking native-state path
-without risking the direct backend `IR_CALLXS` register/result ordering. The
-full direct bridge still needs x64 lowering that brackets the foreign ABI call
-without clobbering argument or result registers.
+side-effecting `void f(...)` loops, zero-argument high-bit uint32 result loops,
+zero-argument signed int64 cdata-result loops, and FP-only numeric call loops a
+traced, nonblocking native-state path without risking the direct backend
+`IR_CALLXS` register/result ordering. The full direct bridge still needs x64
+lowering that brackets the foreign ABI call without clobbering argument or
+result registers.
 
 `tests/t-ffi-ccall-stopreq.c` also heats the shared `sleep_i32` trampoline until
 a trace exists, starts the STOPREQ publisher only after that warmup, and catches

notes/ffi-ccall-native-helpers.md

@@ -30,7 +30,9 @@ This remains infrastructure for a future direct `IR_CALLXS` bridge. The narrow
 signed 32-bit integer, and pointer-returning calls with 0, 1, or 2
 integer/pointer arguments through `IRCALL` helpers using this same native-state
 protocol. `lj_ccall_jit_i64_gpr()` handles exact zero-argument signed 64-bit
-integer returns and preserves boxed int64 cdata results. The sibling
+integer returns and preserves boxed int64 cdata results.
+`lj_ccall_jit_u32_0()` handles exact zero-argument unsigned 32-bit integer
+returns as Lua numbers without high-bit truncation. The sibling
 `lj_ccall_jit_{num,flt}_fpr()` helpers trace exact double or float returns with
 0, 1, or 2 same-kind exact FP arguments. Broad traced ordinary FFI C calls
 remain disabled by `LJ_FFI_RECORD_CALLS=0` because x64 `IR_CALLXS` lowering

notes/m7.md

@@ -1557,6 +1557,8 @@ FFI C-call JIT trampoline:
   integer/pointer arguments now records through the
   `lj_ccall_jit_{void,i32,ptr}_gpr()` side-effecting `IRCALL` helpers with an
   implicit `lua_State *` and a small signature code for the GPR argument shape.
+  Exact zero-argument unsigned 32-bit integer returns record through
+  `lj_ccall_jit_u32_0()` and return Lua numbers, including high-bit values.
   Exact zero-argument signed 64-bit integer returns record through
   `lj_ccall_jit_i64_gpr()` and keep the normal boxed int64 cdata result.
   Exact FP-returning function cdata with 0, 1, or 2 same-kind exact float or
@@ -1565,20 +1567,21 @@ FFI C-call JIT trampoline:
   The helpers enter native state around the foreign call, leave through
   `lj_ccall_native_leave()`, and check fresh STOPREQ before returning zero Lua
   results, a preserved 32-bit integer, a preserved pointer, or a preserved FP
-  result, and box zero-argument signed 64-bit integer results as regular int64
-  cdata.
+  result, return zero-argument unsigned 32-bit integer results as Lua numbers,
+  and box zero-argument signed 64-bit integer results as regular int64 cdata.
 - The dormant direct `LJ_FFI_RECORD_CALLS`/`IR_CALLXS` path remains hard-gated;
   varargs, functions with more than two arguments, non-GPR argument/return
   shapes outside the exact signed 32-bit integer/pointer subset, and
   callback-blacklisted functions still fall back to the interpreted ccall path.
 - `tests/t-ffi-ccall-native.lua` now requires `ffi.C.getpid()`, `ffi.C.abs()`,
   shared-library `int add2(int,int)`, shared-library `int sleep_ms(int)`,
-  shared-library zero-argument signed-int64 probes, shared-library FP-returning probes,
+  shared-library zero-argument unsigned-int32/signed-int64 probes,
+  shared-library FP-returning probes,
   shared-library void-returning side-effect probes, and shared-library
   pointer-return/pointer-argument probes to trace, verifies GC does not block
   while the traced sleep helper is native, and keeps a negative assertion that
   unsupported pointer/size multi-argument `poll()` and unsigned 32-bit C-call
-  signatures remain off trace.
+  signatures with arguments remain off trace.
 - `tests/t-ffi-ccall-stopreq.c` now reuses the shared sleep helper to verify a
   fresh STOPREQ published during a traced trampoline call is delivered through
   the trace snapshot and caught by Lua `pcall()`.

src/lj_ccall.c

@@ -1392,6 +1392,19 @@ int32_t lj_ccall_jit_i32_gpr(lua_State *L, void *func, uintptr_t a,
   return ret;
 }
 
+double lj_ccall_jit_u32_0(lua_State *L, void *func)
+{
+  CTState *cts = ctype_cts(L);
+  CCallNativeState native;
+  uint32_t actions, ret;
+  lj_ccall_native_save(L, &native);
+  lj_ccall_native_enter(L, &native, func);
+  ret = ((uint32_t (*)(void))(uintptr_t)func)();
+  actions = lj_ccall_native_leave(L, cts, &native, func);
+  lj_ccall_native_checkstop(L, actions, &native);
+  return (double)ret;
+}
+
 int64_t lj_ccall_jit_i64_gpr(lua_State *L, void *func, int64_t a,
 			     int64_t b, uint32_t sig)
 {

src/lj_ccall.h

@@ -227,6 +227,7 @@ LJ_FUNC void lj_ccall_jit_void_gpr(lua_State *L, void *func,
 				   uintptr_t a, uintptr_t b, uint32_t sig);
 LJ_FUNC int32_t lj_ccall_jit_i32_gpr(lua_State *L, void *func,
 				     uintptr_t a, uintptr_t b, uint32_t sig);
+LJ_FUNC double lj_ccall_jit_u32_0(lua_State *L, void *func);
 LJ_FUNC int64_t lj_ccall_jit_i64_gpr(lua_State *L, void *func,
 				     int64_t a, int64_t b, uint32_t sig);
 LJ_FUNC void *lj_ccall_jit_ptr_gpr(lua_State *L, void *func,

src/lj_crecord.c

@@ -2437,6 +2437,52 @@ static int crec_call_jit_i64_kind(CTInfo info, CTSize size)
   return ctype_isinteger(info) && size == 8 && !(info & CTF_UNSIGNED);
 }
 
+static int crec_call_jit_u32_0(jit_State *J, RecordFFData *rd, CTState *cts,
+			       CType *ct, CTInfo info, GCcdata *cd,
+			       IRType tp, CTSize fsz)
+{
+  CType ctrsnap, ctfcopy;
+  CType *ctr, *ctf;
+  CTypeID fid;
+  CTInfo ctr_info, ctfinfo;
+  TRef func;
+  MSize narg = 0;
+
+  if ((info & CTF_VARARG))
+    return 0;
+  while (J->base[1+narg]) {
+    if (narg >= 1)
+      return 0;
+    narg++;
+  }
+  if (narg != 0)
+    return 0;
+
+  ctr = crec_ctype_rawchild(J, cts, ct, &ctrsnap);
+  ctr_info = ctype_info_acq(ctr);
+  if (!ctype_isinteger(ctr_info) || ctype_size_acq(ctr) != 4 ||
+      !(ctr_info & CTF_UNSIGNED))
+    return 0;
+
+  fid = ctype_sib_acq(ct);
+  while (fid) {
+    ctf = crec_ctype_snapshot(J, cts, fid, &ctfcopy);
+    ctfinfo = ctype_info_acq(ctf);
+    if (!ctype_isattrib(ctfinfo)) break;
+    fid = ctype_sib_acq(ctf);
+  }
+  if (fid)
+    return 0;
+
+  if (lj_ctype_cb_isblacklisted(cts, cdata_getptr(cdataptr(cd), fsz)))
+    lj_trace_err(J, LJ_TRERR_BLACKL);
+
+  func = emitir(IRT(IR_FLOAD, tp), J->base[0], IRFL_CDATA_PTR);
+  J->base[0] = lj_ir_call(J, IRCALL_lj_ccall_jit_u32_0, func);
+  J->needsnap = 1;
+  return 1;
+}
+
 static int crec_call_jit_i64_gpr(jit_State *J, RecordFFData *rd, CTState *cts,
 				 CType *ct, CTInfo info, GCcdata *cd,
 				 IRType tp, CTSize fsz)
@@ -2611,6 +2657,8 @@ static int crec_call(jit_State *J, RecordFFData *rd, GCcdata *cd)
       return 1;
     if (crec_call_jit_flt_fpr(J, rd, cts, ct, info, cd, tp, fsz))
       return 1;
+    if (crec_call_jit_u32_0(J, rd, cts, ct, info, cd, tp, fsz))
+      return 1;
     if (crec_call_jit_i64_gpr(J, rd, cts, ct, info, cd, tp, fsz))
       return 1;
     if (crec_call_jit_gpr(J, rd, cts, ct, info, cd, tp, fsz))

src/lj_ircall.h

@@ -269,6 +269,7 @@ typedef struct CCallInfo {
   _(FFI,	lj_vm_errno,		0,   S, INT, CCI_NOFPRCLOBBER) \
   _(FFI,	lj_ccall_jit_void_gpr,	5,   S, NIL, CCI_L|CCI_T) \
   _(FFI,	lj_ccall_jit_i32_gpr,	5,   S, INT, CCI_L|CCI_T) \
+  _(FFI,	lj_ccall_jit_u32_0,	2,   S, NUM, CCI_L|CCI_T) \
   _(FFI,	lj_ccall_jit_i64_gpr,	5,   S, I64, CCI_L|CCI_T) \
   _(FFI,	lj_ccall_jit_ptr_gpr,	5,   S, PTR, CCI_L|CCI_T) \
   _(FFI,	lj_ccall_jit_num_fpr,	5,   S, NUM, CCI_L|CCI_T) \

tests/t-ffi-ccall-jit-lib.c

@@ -85,6 +85,11 @@ unsigned int lj_m7_ccall_jit_u32(unsigned int a)
   return a + 1u;
 }
 
+uint32_t lj_m7_ccall_jit_u32_0(void)
+{
+  return 0xf0000001u;
+}
+
 int *lj_m7_ccall_jit_ptr0(void)
 {
   return lj_m7_ccall_jit_values;

tests/t-ffi-ccall-native.lua

@@ -19,6 +19,7 @@ int lj_m7_ccall_jit_void_count_i32(void);
 void lj_m7_ccall_jit_void0(void);
 void lj_m7_ccall_jit_store_i32(int *, int);
 unsigned int lj_m7_ccall_jit_u32(unsigned int);
+uint32_t lj_m7_ccall_jit_u32_0(void);
 int *lj_m7_ccall_jit_ptr0(void);
 int lj_m7_ccall_jit_ptr_read_i32(int *);
 int lj_m7_ccall_jit_ptr_sum_i32(int *, int *);
@@ -151,6 +152,7 @@ do
     local void0 = lib.lj_m7_ccall_jit_void0
     local store_i32 = lib.lj_m7_ccall_jit_store_i32
     local u32 = lib.lj_m7_ccall_jit_u32
+    local u32_0 = lib.lj_m7_ccall_jit_u32_0
     local ptr0 = lib.lj_m7_ccall_jit_ptr0
     local ptr_read_i32 = lib.lj_m7_ccall_jit_ptr_read_i32
     local ptr_sum_i32 = lib.lj_m7_ccall_jit_ptr_sum_i32
@@ -235,6 +237,13 @@ do
       end
       return r
     end
+    local function run_u32_0(n)
+      local r = 0
+      for _ = 1, n do
+	r = r + u32_0()
+      end
+      return r
+    end
     local function run_ptr0(n)
       local p
       for _ = 1, n do
@@ -337,6 +346,11 @@ do
     assert(run_u32(80) == 80 * 8)
     assert(trace_count() == 0, "unsigned int FFI calls must keep stock semantics off trace")
 
+    jit.flush()
+    jit.opt.start("hotloop=1", "hotexit=1")
+    assert(run_u32_0(80) == 80 * 0xf0000001)
+    assert(trace_count() > 0, "shared void->uint32_t FFI call loop should trace")
+
     jit.flush()
     jit.opt.start("hotloop=1", "hotexit=1")
     assert(run_ptr0(80) == 33)