449ece383b
This is a reland of commit 9d31f8663a
There were issues with --future flag implications on M1.
Original change's description:
> [rwx][mac] Support fast W^X permission switching on Apple Silicon (M1)
>
> ... for V8 code space. The feature is currently disabled.
>
> In order to use fast W^X permission switching we must allocate
> executable pages with readable writable executable permissions (RWX).
> However, MacOS on ARM64 ("Apple M1"/Apple Silicon) prohibits further
> permission changing of RWX memory pages. This means that the code page
> headers must be allocated with RWX permissions too because otherwise
> it wouldn't be possible to allocate a large code page over the freed
> regular code page and vice versa.
>
> When enabled, the new machinery works as follows:
>
> 1) when memory region is reserved for allocating executable pages, the
> whole region is committed with RWX permissions and then decommitted,
> 2) since reconfiguration of RWX page permissions is not allowed on
> MacOS on ARM64 ("Apple M1"/Apple Silicon), there must be no attempts
> to change them,
> 3) the request to set RWX permissions in the executable page region
> just recommits the pages without changing permissions (see (1), they
> were already allocated as RWX and then discarded),
> 4) in order to make executable pages inaccessible one must use
> OS::DiscardSystemPages() instead of OS::DecommitPages() or
> setting permissions to kNoAccess because the latter two are not
> allowed by the MacOS (see (2)).
> 5) since code space page headers are allocated as RWX pages it's also
> necessary to switch between W^X modes when updating the data in the
> page headers (i.e. when marking, updating stats, wiring pages in
> lists, etc.). The new CodePageHeaderModificationScope class is used
> in the respective places. On unrelated configurations it's a no-op.
>
> The fast permission switching can't be used for V8 configuration with
> enabled pointer compression and disabled external code space because
> a) the pointer compression cage has to be reserved with MAP_JIT flag
> which is too expensive,
> b) in case of shared pointer compression cage if the code range will
> be deleted while the cage is still alive then attempt to configure
> permissions of pages that were previously set to RWX will fail.
>
> This also CL extends the unmapper unit tests with permissions tracking
> for discarded pages.
>
> Bug: v8:12797
> Change-Id: Idb28cbc481306477589eee9962d2e75167d87c61
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3579303
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80238}
Bug: v8:12797
Change-Id: I0fe86666f31bad37d7074e217555c95900d2afba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610433
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80259}
123 lines
4.4 KiB
C++
123 lines
4.4 KiB
C++
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
#ifndef V8_TEST_COMMON_ASSEMBLER_TESTER_H_
|
|
#define V8_TEST_COMMON_ASSEMBLER_TESTER_H_
|
|
|
|
#include <memory>
|
|
|
|
#include "src/codegen/assembler.h"
|
|
#include "src/codegen/code-desc.h"
|
|
#include "src/common/code-memory-access-inl.h"
|
|
|
|
namespace v8 {
|
|
namespace internal {
|
|
|
|
class TestingAssemblerBuffer : public AssemblerBuffer {
|
|
public:
|
|
TestingAssemblerBuffer(size_t requested, void* address,
|
|
JitPermission jit_permission = JitPermission::kNoJit)
|
|
: protection_reconfiguration_is_allowed_(true) {
|
|
size_t page_size = v8::internal::AllocatePageSize();
|
|
size_t alloc_size = RoundUp(requested, page_size);
|
|
CHECK_GE(kMaxInt, alloc_size);
|
|
reservation_ = VirtualMemory(GetPlatformPageAllocator(), alloc_size,
|
|
address, page_size, jit_permission);
|
|
CHECK(reservation_.IsReserved());
|
|
MakeWritable();
|
|
}
|
|
|
|
~TestingAssemblerBuffer() override { reservation_.Free(); }
|
|
|
|
byte* start() const override {
|
|
return reinterpret_cast<byte*>(reservation_.address());
|
|
}
|
|
|
|
int size() const override { return static_cast<int>(reservation_.size()); }
|
|
|
|
std::unique_ptr<AssemblerBuffer> Grow(int new_size) override {
|
|
FATAL("Cannot grow TestingAssemblerBuffer");
|
|
}
|
|
|
|
std::unique_ptr<AssemblerBuffer> CreateView() const {
|
|
return ExternalAssemblerBuffer(start(), size());
|
|
}
|
|
|
|
void MakeExecutable() {
|
|
// Flush the instruction cache as part of making the buffer executable.
|
|
// Note: we do this before setting permissions to ReadExecute because on
|
|
// some older ARM kernels there is a bug which causes an access error on
|
|
// cache flush instructions to trigger access error on non-writable memory.
|
|
// See https://bugs.chromium.org/p/v8/issues/detail?id=8157
|
|
FlushInstructionCache(start(), size());
|
|
|
|
if (protection_reconfiguration_is_allowed_) {
|
|
bool result = SetPermissions(GetPlatformPageAllocator(), start(), size(),
|
|
v8::PageAllocator::kReadExecute);
|
|
CHECK(result);
|
|
}
|
|
}
|
|
|
|
void MakeWritable() {
|
|
if (protection_reconfiguration_is_allowed_) {
|
|
bool result = SetPermissions(GetPlatformPageAllocator(), start(), size(),
|
|
v8::PageAllocator::kReadWrite);
|
|
CHECK(result);
|
|
}
|
|
}
|
|
|
|
void MakeWritableAndExecutable() {
|
|
bool result = SetPermissions(GetPlatformPageAllocator(), start(), size(),
|
|
v8::PageAllocator::kReadWriteExecute);
|
|
CHECK(result);
|
|
// Once buffer protection is set to RWX it might not be allowed to be
|
|
// changed anymore.
|
|
protection_reconfiguration_is_allowed_ =
|
|
!V8_HEAP_USE_PTHREAD_JIT_WRITE_PROTECT &&
|
|
protection_reconfiguration_is_allowed_;
|
|
}
|
|
|
|
private:
|
|
VirtualMemory reservation_;
|
|
bool protection_reconfiguration_is_allowed_;
|
|
};
|
|
|
|
// This scope class is mostly necesasry for arm64 tests running on Apple Silicon
|
|
// (M1) which prohibits reconfiguration of page permissions for RWX pages.
|
|
// Instead of altering the page permissions one must flip the X-W state by
|
|
// calling pthread_jit_write_protect_np() function.
|
|
// See RwxMemoryWriteScope for details.
|
|
class V8_NODISCARD AssemblerBufferWriteScope final {
|
|
public:
|
|
explicit AssemblerBufferWriteScope(TestingAssemblerBuffer& buffer)
|
|
: buffer_(buffer) {
|
|
buffer_.MakeWritable();
|
|
}
|
|
|
|
~AssemblerBufferWriteScope() { buffer_.MakeExecutable(); }
|
|
|
|
// Disable copy constructor and copy-assignment operator, since this manages
|
|
// a resource and implicit copying of the scope can yield surprising errors.
|
|
AssemblerBufferWriteScope(const AssemblerBufferWriteScope&) = delete;
|
|
AssemblerBufferWriteScope& operator=(const AssemblerBufferWriteScope&) =
|
|
delete;
|
|
|
|
private:
|
|
RwxMemoryWriteScopeForTesting rwx_write_scope_;
|
|
TestingAssemblerBuffer& buffer_;
|
|
};
|
|
|
|
static inline std::unique_ptr<TestingAssemblerBuffer> AllocateAssemblerBuffer(
|
|
size_t requested = v8::internal::AssemblerBase::kDefaultBufferSize,
|
|
void* address = nullptr,
|
|
JitPermission jit_permission = JitPermission::kMapAsJittable) {
|
|
return std::make_unique<TestingAssemblerBuffer>(requested, address,
|
|
jit_permission);
|
|
}
|
|
|
|
} // namespace internal
|
|
} // namespace v8
|
|
|
|
#endif // V8_TEST_COMMON_ASSEMBLER_TESTER_H_
|