@amritk/nish-x86_64-linux 0.16.0 → 0.18.0

package/runtime/runtime.c

@@ -79,8 +79,12 @@ _Static_assert(offsetof(struct nish_arena, off) == 8, "the inlined allocator bum
 _Static_assert(offsetof(struct nish_arena, cap) == 16, "the inlined allocator reads field 2");
 _Static_assert(offsetof(struct nish_arena, chunks) == 24, "arena layout is ABI");
 
+/* `fputs` rather than one `write`: libc's own loop finishes a short write,
+   which a bare `write` would cut off (docs/security/runtime.md, RT-11), and
+   stderr is unbuffered, so the message leaves before `_exit`. A C host that
+   gives stderr a buffer of its own would lose it here. */
 static NISH_COLD void nish_die(const char *msg) {
-  (void)!write(2, msg, strlen(msg));
+  fputs(msg, stderr);
   _exit(1);
 }
 /* A function rather than a macro around `nish_die`: seven call sites each
@@ -214,7 +218,7 @@ nish_str *nish_str_concat(const nish_str *a, const nish_str *b) {
   s->len = len;
   memcpy(s->data, a->data, a->len);
   memcpy(s->data + a->len, b->data, b->len);
-  s->data[s->len] = 0;
+  s->data[len] = 0;
   return s;
 }
 
@@ -247,24 +251,47 @@ _Bool nish_str_at(const nish_str *s, int64_t at, const nish_str *sub) {
    exactly such a header from `examples/strings.ts`, and the interop tests
    caught runtime.c picking it up and inheriting `nish.h` through it. A C host
    would hit the same. A fifth of the time is not worth making the runtime
-   sensitive to its includer's `-I` paths. */
-int64_t nish_str_index_of(const nish_str *s, const nish_str *sub) {
-  if (sub->len == 0) return 0;
-  if (sub->len > s->len) return -1;
-  const char *p = s->data, *end = s->data + s->len - sub->len + 1;
-  while (p < end) {
-    const char *c = memchr(p, sub->data[0], (size_t)(end - p));
-    if (!c) return -1;
-    if (memcmp(c + 1, sub->data + 1, sub->len - 1) == 0) return (int64_t)(c - s->data);
-    p = c + 1;
+   sensitive to its includer's `-I` paths.
+
+   `s.indexOf(sub, from)` is the same search from byte `from`, and
+   `s.indexOf(sub)` is it from 0: one loop, not two. The compiler clamps `from`
+   into [0, s.length] first, as JavaScript does, with `llvm.smin`/`smax` where
+   LLVM can fold them, so the clamp costs this file nothing; an empty needle
+   answers that clamped `from`. The clamp is a precondition: a caller that
+   skips it never reads outside the string, but gets -1 for a non-empty needle
+   (a negative `from` reads as one past the end) and `from` itself, unchanged,
+   for an empty one. */
+int64_t nish_str_index_of_from(const nish_str *s, const nish_str *sub, int64_t from) {
+  uint64_t at = (uint64_t)from;
+  if (sub->len == 0) return from;
+  while (at <= s->len && sub->len <= s->len - at) {
+    const char *c = memchr(s->data + at, sub->data[0], s->len - at - sub->len + 1);
+    if (!c) break;
+    at = (uint64_t)(c - s->data);
+    if (memcmp(c + 1, sub->data + 1, sub->len - 1) == 0) return (int64_t)at;
+    at++;
   }
   return -1;
 }
+int64_t nish_str_index_of(const nish_str *s, const nish_str *sub) { return nish_str_index_of_from(s, sub, 0); }
 
 /* `console.log` / `console.error` / `write` / `writeError` and the message of
-   `panic`: fd 1 or 2, with or without the trailing newline. */
+   `panic`: fd 1 or 2, with or without the trailing newline.
+
+   A pipe or a socket can take part of a long string and answer the count it
+   took: a signal that lands mid-write ends the call early, and a full pipe
+   does the same. So the bytes are written until all of them are out, or until
+   a write fails (docs/security/runtime.md, RT-11). A failure still ends the
+   output, `EAGAIN` on a non-blocking stdout included, since spinning on it
+   would burn a core. `EINTR` is not retried here: it needs a handler
+   installed without `SA_RESTART`, and the only one this runtime installs
+   (runtime-host.c) has it, so an interrupted write either restarts in the
+   kernel or comes back short. The newline needs no loop: one byte is never
+   written in part. */
 void nish_write(const nish_str *s, int32_t fd, _Bool newline) {
-  (void)!write(fd, s->data, s->len);
+  uint64_t done = 0;
+  ssize_t k;
+  while (done < s->len && (k = write(fd, s->data + done, s->len - done)) > 0) done += k;
   if (newline) (void)!write(fd, "\n", 1);
 }
 /* console.log(s) */
@@ -1203,6 +1230,20 @@ __attribute__((noinline)) void nish_array_grow(nish_array *a, uint64_t elem_size
   a->cap = cap;
 }
 
+/* `secureZero(bytes)` (#385): every byte of the array set to zero, in stores
+ * no optimisation may remove. A `memset` here would be a dead store wherever
+ * the buffer's life ends straight after the call -- a key in a frame that
+ * returns, a block that is freed -- and links use `-flto`, which inlines this
+ * body into that caller and lets dead-store elimination see it. Each store goes
+ * through a `volatile` pointer, so each is behaviour the C standard keeps
+ * whatever the optimiser can see, and `noinline` keeps the call itself in the
+ * binary for a reader of the disassembly. A byte at a time, because a secret
+ * is a key or a scalar of tens of bytes, not a buffer worth a vector loop. */
+__attribute__((noinline)) void nish_wipe(nish_array *bytes) {
+  volatile char *p = bytes->data;
+  for (uint64_t i = 0; i < bytes->len; i++) p[i] = 0;
+}
+
 void nish_panic_index(uint64_t idx, uint64_t len) {
   dprintf(2, "index out of range: %" PRIu64 " >= %" PRIu64 "\n", idx, len);
   _exit(1);
@@ -1221,7 +1262,14 @@ void nish_panic_slice(int64_t start, int64_t end, int64_t len) {
   _exit(1);
 }
 
-/* ---- Checked division (Rust semantics): the failed-check path */
-void nish_panic_div(_Bool by_zero) {
-  nish_die(by_zero ? "attempt to divide by zero\n" : "attempt to divide with overflow\n");
-}
+/* ---- Checked arithmetic (Rust semantics): the failed-check paths. One table
+   for both panics, because each message is "attempt to <what>" and the two
+   functions then share everything but the index. `nish_panic_overflow`'s `op`
+   is the operator whose `llvm.s*.with.overflow` flagged: 0 add, 1 subtract,
+   2 multiply, 3 negate, the order `src/emit-ops.ts` numbers them in. */
+static const char *const nish_arith_panics[6] = {
+  "attempt to add with overflow\n",      "attempt to subtract with overflow\n",
+  "attempt to multiply with overflow\n", "attempt to negate with overflow\n",
+  "attempt to divide with overflow\n",   "attempt to divide by zero\n"};
+void nish_panic_overflow(uint32_t op) { nish_die(nish_arith_panics[op]); }
+void nish_panic_div(_Bool by_zero) { nish_panic_overflow(4 + by_zero); }

package/runtime/shim.mjs

@@ -123,6 +123,52 @@ export function ctEq(a, b) {
   return (a ^ b) === 0 ? 0xffffffff : 0;
 }
 
+/**
+ * `nish:secret` (docs/LANGUAGE.md, "Secrets"). Natively the compiler holds a
+ * `Secret` to its rules and `wipe` is a volatile store of zeros; here the rules
+ * have already been checked by the compiler or by nobody, so a `Secret` is a
+ * plain wrapper and `wipe` zero-fills what it holds. `runtime/nish.mjs`
+ * resolves the `nish:secret` specifier to this module, so these are its
+ * exports by name. A zero-fill under Node promises nothing about copies the
+ * engine made, which is the native wipe's whole point and is not claimed here.
+ */
+export class Secret {
+  constructor(value) {
+    this.value = value;
+  }
+}
+
+export function secret(value) {
+  return new Secret(value);
+}
+
+export function expose(s, f) {
+  return f(s.value);
+}
+
+export function exposeWith(s, arg, f) {
+  return f(s.value, arg);
+}
+
+/** Zero an array of integers, or every integer field of a record: `0` for a number, `0n` for an `i64` or `u64`. */
+function zeroFill(target) {
+  if (Array.isArray(target) || ArrayBuffer.isView(target)) {
+    for (let i = 0; i < target.length; i++) {
+      target[i] = typeof target[i] === "bigint" ? 0n : 0;
+    }
+    return;
+  }
+  for (const key of Object.keys(target)) {
+    const field = target[key];
+    if (typeof field === "bigint") target[key] = 0n;
+    else if (typeof field === "number") target[key] = 0;
+  }
+}
+
+export function wipe(target) {
+  zeroFill(target instanceof Secret ? target.value : target);
+}
+
 /** Wrap a BigInt to the i64 range: every i64 `+ - * /` and unary minus goes through here. */
 export function wrapI64(x) {
   return BigInt.asIntN(64, x);
@@ -497,9 +543,22 @@ export function readFileBytesSync(path) {
   }
 }
 
+/**
+ * The flags `runtime-os.c` opens a file it writes with, `O_NOFOLLOW` included
+ * (docs/security/runtime.md, RT-4): a symbolic link as the last component of
+ * the path is refused rather than followed, so `writeFileSync`,
+ * `appendFileSync` and `spawnSyncTo` fail here where they fail natively. Node's
+ * `"w"` and `"a"` follow the link. A link among the directories on the way is
+ * still followed, as it is natively. Windows has no `O_NOFOLLOW`, and there the
+ * flag is 0.
+ */
+const { O_WRONLY, O_CREAT, O_TRUNC, O_APPEND, O_NOFOLLOW = 0 } = fs.constants;
+const WRITE_FLAGS = O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW;
+const APPEND_FLAGS = O_WRONLY | O_CREAT | O_APPEND | O_NOFOLLOW;
+
 export function writeFileSync(path, data) {
   try {
-    fs.writeFileSync(path, data, "utf8");
+    fs.writeFileSync(path, data, { encoding: "utf8", flag: WRITE_FLAGS });
   } catch {
     ioFail("write", path);
   }
@@ -507,7 +566,7 @@ export function writeFileSync(path, data) {
 
 export function appendFileSync(path, data) {
   try {
-    fs.appendFileSync(path, data, "utf8");
+    fs.appendFileSync(path, data, { encoding: "utf8", flag: APPEND_FLAGS });
   } catch {
     ioFail("write", path);
   }
@@ -623,8 +682,9 @@ export function getenv(name) {
  *
  * `out` and `err` are paths for the child's stdout and stderr, and an **empty**
  * string leaves that stream inherited. Each file is created or truncated at
- * 0644, which is what `"w"` asks `open(2)` for (`O_WRONLY | O_CREAT | O_TRUNC`)
- * and what the runtime's file actions ask for. The descriptors opened here are
+ * 0644 with `WRITE_FLAGS`, which is what the runtime's file actions ask for:
+ * `O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW`, so a symbolic link at the path
+ * is refused and the answer is -1, on both sides. The descriptors opened here are
  * closed again whichever way the child went; natively the child opens them and
  * its exit drops them.
  */
@@ -633,7 +693,7 @@ function spawnImpl(argv, out, err) {
   const opened = [];
   const stream = (target) => {
     if (target.length === 0) return "inherit";
-    const fd = fs.openSync(target, "w", 0o644);
+    const fd = fs.openSync(target, WRITE_FLAGS, 0o644);
     opened.push(fd);
     return fd;
   };
@@ -696,6 +756,51 @@ export function statMtimeSync(path) {
   return st.mtimeMs;
 }
 
+/**
+ * The RT-9 owner checks (#386): `lstatOwnerModeSync(path)` is the owner's uid
+ * in the high 32 bits and `st_mode` in the low 32 of one `lstat`, so a
+ * symbolic link answers for itself, or -1 when the path does not resolve or
+ * holds a NUL; `geteuid()` is the effective uid; `isExecutableSync(path)` is
+ * `access(path, X_OK)`. Each answers what `runtime-host.c` answers, the two
+ * `i64`s as BigInts because that is how an `i64` is held on this side. Node's
+ * `fs` throws on a NUL in a path where the runtime names nothing, so the
+ * `catch` is what makes the two agree there too.
+ */
+export function lstatOwnerModeSync(path) {
+  try {
+    const st = fs.lstatSync(path);
+    return BigInt.asIntN(64, (BigInt(st.uid >>> 0) << 32n) | BigInt(st.mode >>> 0));
+  } catch {
+    return -1n;
+  }
+}
+
+export function geteuid() {
+  return BigInt(process.geteuid());
+}
+
+export function isExecutableSync(path) {
+  try {
+    fs.accessSync(path, fs.constants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * `secureZero(bytes)` (#385): every element set to zero, which is what the
+ * native `nish_wipe` leaves. Nothing here can drop a store to an array the
+ * caller still holds, so a loop is the whole of it. What it cannot promise is
+ * what the native build does: a collector that moved the array may have left a
+ * copy of the old bytes behind, and JavaScript has no way to reach it.
+ */
+export function secureZero(bytes) {
+  for (let i = 0; i < bytes.length; i++) {
+    bytes[i] = 0;
+  }
+}
+
 /**
  * Node's own fill, taken before `runtime/nish.mjs` puts the one below in its
  * place on the same object: `webcrypto` is the global `crypto`.
@@ -807,3 +912,7 @@ export function arenaUsed() { return 0; }
 export function arenaMark() { return 0; }
 export function arenaRelease() {}
 export function arenaReset() {}
+/** `using a = arena()`: a disposable whose disposal does nothing, because there is no arena to release. */
+export function arena() {
+  return { [Symbol.dispose]() {} };
+}

package/scripts/build.sh

@@ -1,15 +1,16 @@
 #!/usr/bin/env bash
 # Build an Nish .ll module (plus optional C sources) into a native binary.
 #
-#   scripts/build.sh <module.ll> [more .ll/.c files...] -o <out> [--profile debug|speed|size|wasm]
+#   scripts/build.sh <module.ll> [more .ll/.c files...] -o <out> [--profile debug|speed|size|wasm|wasi|napi]
 #
-# The C runtime is five translation units and is named as one: an input
+# The C runtime is six translation units and is named as one: an input
 # <dir>/runtime.c also compiles <dir>/runtime-os.c, the half that wraps the
 # system calls (files, directories, subprocesses, the environment, the clock),
 # <dir>/runtime-parallel.c, the half that divides a range of work across
 # threads, <dir>/runtime-host.c, the wall clock, entropy, file times and
-# signals, and <dir>/runtime-net.c, the sockets of `nish:net`. Each of those
-# files says why they are compiled and measured apart.
+# signals, <dir>/runtime-net.c, the sockets of `nish:net`, and
+# <dir>/runtime-simd.c, the byte searches that read a vector at a time. Each of
+# those files says why they are compiled and measured apart.
 #
 # Profiles:
 #   debug  clang defaults: no optimisation, symbols kept. The "before" number.
@@ -20,8 +21,6 @@
 #          load it from Node. Add runtime/runtime-wasm.c to the inputs when a
 #          function uses arrays (the arena and the array cold paths, no libc);
 #          strings and I/O still need a WASI runtime and are not available.
-#   wasm   wasm32 freestanding module exporting every non-internal function
-#          (for modules that do not use the C runtime); load it from Node.
 #   wasi   wasm32-wasi command module: runtime.c linked against wasi-libc, so
 #          string programs run under any WASI host (`_start` runs `main`;
 #          `node examples/wasi-host.mjs app.wasm args...`). Needs a WASI
@@ -78,18 +77,21 @@ while [ $# -gt 0 ]; do
     --pgo-use)
       [ -f "$2" ] || { echo "error: --pgo-use: profile '$2' not found (run the instrumented binary, then llvm-profdata merge)" >&2; exit 2; }
       pgo=("-fprofile-use=$2"); shift 2 ;;
-    -h|--help) sed -n '2,41p' "$0"; exit 0 ;;
+    -h|--help) sed -n '2,42p' "$0"; exit 0 ;;
     *) inputs+=("$1"); shift ;;
   esac
 done
 [ ${#inputs[@]} -gt 0 ] || { echo "error: no input files" >&2; exit 2; }
 [ -n "$out" ] || { echo "error: -o <out> is required" >&2; exit 2; }
 
-# The runtime is five translation units, and a caller names one: whoever passes
+# The runtime is six translation units, and a caller names one: whoever passes
 # <dir>/runtime.c gets <dir>/runtime-os.c, <dir>/runtime-parallel.c,
-# <dir>/runtime-host.c and <dir>/runtime-net.c compiled beside it. They were one file until the operating-system half was split out
-# for its own size budget, and the parallel half followed for the same reason
-# (each file's header comment says why), and a link line is where those splits
+# <dir>/runtime-host.c, <dir>/runtime-net.c and <dir>/runtime-simd.c compiled
+# beside it, on every profile, wasi included: runtime-simd.c takes its scalar
+# path there unless the build adds -msimd128. They were one file until the
+# operating-system half was split out for its own size budget, and the parallel
+# half followed for the same reason (each file's header comment says why), and
+# a link line is where those splits
 # would otherwise leak: `nish --link` builds its command line in
 # src/compile.ts, the published package's recipe in every document and
 # README names runtime.c, and a user's own clang line does too. Pairing them
@@ -99,7 +101,7 @@ done
 for i in ${inputs[@]+"${inputs[@]}"}; do
   case "$i" in
     */runtime.c|runtime.c)
-      for half in runtime-os.c runtime-parallel.c runtime-host.c runtime-net.c; do
+      for half in runtime-os.c runtime-parallel.c runtime-host.c runtime-net.c runtime-simd.c; do
         side="${i%runtime.c}$half"
         have=0
         for j in "${inputs[@]}"; do