Changeset 260223 in webkit


Ignore:
Timestamp:
Apr 16, 2020 3:35:23 PM (4 years ago)
Author:
mark.lam@apple.com
Message:

[Re-landing] Use more PAC diversity for JIT probe code.
​https://bugs.webkit.org/show_bug.cgi?id=210252
<rdar://problem/54490367>

Reviewed by Keith Miller.

Introducing new PtrTags:

JITProbePtrTag - for the client probe function.
JITProbeTrampolinePtrTag - for calling the ctiMasmProbeTrampoline.
JITProbeExecutorPtrTag - for calling the probe executor.

Currently, this is only the Probe::executeProbe().

JITProbeStackInitializationFunctionPtrTag - for calling the optional stack

initialization function that the client probe function may set.

We'll now use these in the JIT probe mechanism instead of adopting the default
CFunctionPtrTag.

Fixed an assert in MacroAssemblerARM64.cpp which does not apply to non ARM64E
builds.

  • assembler/MacroAssembler.cpp:

(JSC::MacroAssembler::probe):

  • assembler/MacroAssemblerARM64.cpp:

(JSC::MacroAssembler::probe):

  • assembler/MacroAssemblerPrinter.h:

(JSC::MacroAssembler::print):

  • assembler/ProbeContext.h:
  • runtime/JSCPtrTag.h:
  • tools/JSDollarVM.cpp:

(JSC::callWithStackSizeProbeFunction):

  • wasm/WasmAirIRGenerator.cpp:

(JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck):

  • wasm/WasmB3IRGenerator.cpp:

(JSC::Wasm::B3IRGenerator::emitLoopTierUpCheck):

Location:
trunk/Source/JavaScriptCore
Files:
9 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r260222 r260223  
     12020-04-16  Mark Lam  <mark.lam@apple.com>
     2
     3        [Re-landing] Use more PAC diversity for JIT probe code.
     4        https://bugs.webkit.org/show_bug.cgi?id=210252
     5        <rdar://problem/54490367>
     6
     7        Reviewed by Keith Miller.
     8
     9        Introducing new PtrTags:
     10            JITProbePtrTag - for the client probe function.
     11            JITProbeTrampolinePtrTag - for calling the ctiMasmProbeTrampoline.
     12            JITProbeExecutorPtrTag - for calling the probe executor.
     13                Currently, this is only the Probe::executeProbe().
     14            JITProbeStackInitializationFunctionPtrTag - for calling the optional stack
     15                initialization function that the client probe function may set.
     16
     17        We'll now use these in the JIT probe mechanism instead of adopting the default
     18        CFunctionPtrTag.
     19
     20        Fixed an assert in MacroAssemblerARM64.cpp which does not apply to non ARM64E
     21        builds.
     22
     23        * assembler/MacroAssembler.cpp:
     24        (JSC::MacroAssembler::probe):
     25        * assembler/MacroAssemblerARM64.cpp:
     26        (JSC::MacroAssembler::probe):
     27        * assembler/MacroAssemblerPrinter.h:
     28        (JSC::MacroAssembler::print):
     29        * assembler/ProbeContext.h:
     30        * runtime/JSCPtrTag.h:
     31        * tools/JSDollarVM.cpp:
     32        (JSC::callWithStackSizeProbeFunction):
     33        * wasm/WasmAirIRGenerator.cpp:
     34        (JSC::Wasm::AirIRGenerator::emitLoopTierUpCheck):
     35        * wasm/WasmB3IRGenerator.cpp:
     36        (JSC::Wasm::B3IRGenerator::emitLoopTierUpCheck):
     37
    1382020-04-16  Mark Lam  <mark.lam@apple.com>
    239

  • trunk/Source/JavaScriptCore/assembler/MacroAssembler.cpp

    r260222 r260223  
    2929#if ENABLE(ASSEMBLER)
    3030
     31#include "JSCPtrTag.h"
    3132#include "Options.h"
    3233#include "ProbeContext.h"
    … …  
    5657void MacroAssembler::probe(Function<void(Probe::Context&)> func)
    5758{
    58     probe(stdFunctionCallback, new Function<void(Probe::Context&)>(WTFMove(func)));
     59    probe(tagCFunction<JITProbePtrTag>(stdFunctionCallback), new Function<void(Probe::Context&)>(WTFMove(func)));
    5960}
     61
    6062#endif // ENABLE(MASM_PROBE)
    6163

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerARM64.cpp

    r260222 r260223  
    2929#include "MacroAssembler.h"
    3030
     31#include "JSCPtrTag.h"
    3132#include "ProbeContext.h"
    3233#include <wtf/InlineASM.h>
    … …  
    298299static_assert(!(sizeof(LRRestorationRecord) & 0xf), "LRRestorationRecord must be 16-byte aligned");
    299300
     301#if CPU(ARM64E)
     302#define JIT_PROBE_EXECUTOR_PTR_TAG 0x28de
     303#define JIT_PROBE_STACK_INITIALIZATION_FUNCTION_PTR_TAG 0x315c
     304static_assert(JIT_PROBE_EXECUTOR_PTR_TAG == JITProbeExecutorPtrTag);
     305static_assert(JIT_PROBE_STACK_INITIALIZATION_FUNCTION_PTR_TAG == JITProbeStackInitializationFunctionPtrTag);
     306#endif
     307
    300308// We use x29 and x30 instead of fp and lr because GCC's inline assembler does not recognize fp and lr.
    301309// See https://bugs.webkit.org/show_bug.cgi?id=175512 for details.
    … …  
    383391    "mov       x0, sp" "\n" // Set the Probe::State* arg.
    384392#if CPU(ARM64E)
    385     "blraaz    x28" "\n" // Call the probe handler.
     393    "movz      lr, #" STRINGIZE_VALUE_OF(JIT_PROBE_EXECUTOR_PTR_TAG) "\n"
     394    "blrab     x28, lr" "\n" // Call the probe handler.
    386395#else
    387396    "blr       x28" "\n" // Call the probe handler.
    … …  
    423432    "mov       x0, x27" "\n" // Set the Probe::State* arg.
    424433#if CPU(ARM64E)
    425     "blraaz    x2" "\n" // Call the initializeStackFunction (loaded into x2 above).
     434    "movz      lr, #" STRINGIZE_VALUE_OF(JIT_PROBE_STACK_INITIALIZATION_FUNCTION_PTR_TAG) "\n"
     435    "blrab     x2, lr" "\n" // Call the initializeStackFunction (loaded into x2 above).all the probe handler.
    426436#else
    427437    "blr       x2" "\n" // Call the initializeStackFunction (loaded into x2 above).
    … …  
    532542    storePair64(x26, x27, sp, TrustedImm32(offsetof(IncomingProbeRecord, x26)));
    533543    storePair64(x28, x30, sp, TrustedImm32(offsetof(IncomingProbeRecord, x28))); // Note: x30 is lr.
    534     move(TrustedImmPtr(reinterpret_cast<void*>(ctiMasmProbeTrampoline)), x26);
    535     move(TrustedImmPtr(reinterpret_cast<void*>(Probe::executeProbe)), x28);
     544    move(TrustedImmPtr(tagCFunction<JITProbeTrampolinePtrTag>(ctiMasmProbeTrampoline)), x26);
     545    move(TrustedImmPtr(tagCFunction<JITProbeExecutorPtrTag>(Probe::executeProbe)), x28);
     546#if CPU(ARM64E)
     547    ASSERT(isTaggedWith(function, JITProbePtrTag));
     548#endif
    536549    move(TrustedImmPtr(reinterpret_cast<void*>(function)), x24);
    537550    move(TrustedImmPtr(arg), x25);
    538     call(x26, CFunctionPtrTag);
     551    call(x26, JITProbeTrampolinePtrTag);
    539552
    540553    // ctiMasmProbeTrampoline should have restored every register except for lr and the sp.
    … …  
    578591
    579592#endif // ENABLE(ASSEMBLER) && CPU(ARM64)
    580 

  • trunk/Source/JavaScriptCore/assembler/MacroAssemblerPrinter.h

    r260222 r260223  
    2626#pragma once
    2727
     28#include "JSCPtrTag.h"
    2829#include "MacroAssembler.h"
    2930#include "Printer.h"
    … …  
    233234{
    234235    auto printRecordList = Printer::makePrintRecordList(std::forward<Arguments>(arguments)...);
    235     probe(Printer::printCallback, printRecordList);
     236    probe(tagCFunction<JITProbePtrTag>(Printer::printCallback), printRecordList);
    236237}
    237238
    238239inline void MacroAssembler::print(Printer::PrintRecordList* printRecordList)
    239240{
    240     probe(Printer::printCallback, printRecordList);
     241    probe(tagCFunction<JITProbePtrTag>(Printer::printCallback), printRecordList);
    241242}
    242243

  • trunk/Source/JavaScriptCore/assembler/ProbeContext.h

    r260222 r260223  
    176176typedef void (*StackInitializationFunction)(State*);
    177177
     178#if CPU(ARM64E)
     179#define PROBE_FUNCTION_PTRAUTH __ptrauth(ptrauth_key_process_dependent_code, 0, JITProbePtrTag)
     180#define PROBE_STACK_INITIALIZATION_FUNCTION_PTRAUTH __ptrauth(ptrauth_key_process_dependent_code, 0, JITProbeStackInitializationFunctionPtrTag)
     181#else
     182#define PROBE_FUNCTION_PTRAUTH
     183#define PROBE_STACK_INITIALIZATION_FUNCTION_PTRAUTH
     184#endif
     185
    178186struct State {
    179     Probe::Function probeFunction;
     187    Probe::Function PROBE_FUNCTION_PTRAUTH probeFunction;
    180188    void* arg;
    181     StackInitializationFunction initializeStackFunction;
     189    StackInitializationFunction PROBE_STACK_INITIALIZATION_FUNCTION_PTRAUTH initializeStackFunction;
    182190    void* initializeStackArg;
    183191    CPUState cpu;

  • trunk/Source/JavaScriptCore/runtime/JSCPtrTag.h

    r260222 r260223  
    4040    v(ExceptionHandlerPtrTag) \
    4141    v(ExecutableMemoryPtrTag) \
     42    v(JITProbePtrTag) \
     43    v(JITProbeTrampolinePtrTag) \
     44    v(JITProbeExecutorPtrTag) \
     45    v(JITProbeStackInitializationFunctionPtrTag) \
    4246    v(JITThunkPtrTag) \
    4347    v(JITStubRoutinePtrTag) \

  • trunk/Source/JavaScriptCore/tools/JSDollarVM.cpp

    r260222 r260223  
    11/*
    2  * Copyright (C) 2015-2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2015-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    21372137{
    21382138    JSGlobalObject* globalObject = bitwise_cast<JSGlobalObject*>(state->arg);
    2139     JSFunction* function = bitwise_cast<JSFunction*>(state->probeFunction);
     2139    // The bits loaded from state->probeFunction will be tagged like
     2140    // a C function. So, we'll need to untag it to extract the bits
     2141    // for the JSFunction*.
     2142    JSFunction* function = bitwise_cast<JSFunction*>(untagCodePtr<CFunctionPtrTag>(state->probeFunction));
    21402143    state->initializeStackFunction = nullptr;
    21412144    state->initializeStackArg = nullptr;

  • trunk/Source/JavaScriptCore/wasm/WasmAirIRGenerator.cpp

    r260222 r260223  
    11/*
    2  * Copyright (C) 2019 Apple Inc. All rights reserved.
     2 * Copyright (C) 2019-2020 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    18271827            tierUp.link(&jit);
    18281828
    1829             jit.probe(operationWasmTriggerOSREntryNow, osrEntryDataPtr);
     1829            jit.probe(tagCFunction<JITProbePtrTag>(operationWasmTriggerOSREntryNow), osrEntryDataPtr);
    18301830            jit.branchTestPtr(CCallHelpers::Zero, GPRInfo::argumentGPR0).linkTo(tierUpResume, &jit);
    18311831            jit.farJump(GPRInfo::argumentGPR1, WasmEntryPtrTag);

  • trunk/Source/JavaScriptCore/wasm/WasmB3IRGenerator.cpp

    r260222 r260223  
    13391339            tierUp.link(&jit);
    13401340
    1341             jit.probe(operationWasmTriggerOSREntryNow, osrEntryDataPtr);
     1341            jit.probe(tagCFunction<JITProbePtrTag>(operationWasmTriggerOSREntryNow), osrEntryDataPtr);
    13421342            jit.branchTestPtr(CCallHelpers::Zero, GPRInfo::argumentGPR0).linkTo(tierUpResume, &jit);
    13431343            jit.farJump(GPRInfo::argumentGPR1, WasmEntryPtrTag);
Note: See TracChangeset for help on using the changeset viewer.