Changeset 246022 in webkit

Timestamp:

Jun 2, 2019 1:02:00 PM (5 years ago)

Author:

keith_miller@apple.com

Message:

Reenable Gigacage on ARM64.
​https://bugs.webkit.org/show_bug.cgi?id=198453

Reviewed by Filip Pizlo.

Source/bmalloc:

• bmalloc/Gigacage.h:

Source/JavaScriptCore:

This patch adds back Gigacaging on Apple's ARM64 ports. Unlike the
old Gigacage however, arm64e uses both Gigacaging and PAC. Since
Gigacaging would otherwise strip a PAC failed authenticate bit we
force a load of the pointer into some garbage register.

• dfg/DFGSpeculativeJIT.cpp:

(JSC::DFG::SpeculativeJIT::jumpForTypedArrayIsNeuteredIfOutOfBounds):
(JSC::DFG::SpeculativeJIT::cageTypedArrayStorage):

• ftl/FTLLowerDFGToB3.cpp:

(JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
(JSC::FTL::DFG::LowerDFGToB3::untagArrayPtr):
(JSC::FTL::DFG::LowerDFGToB3::caged):

• jit/AssemblyHelpers.h:

(JSC::AssemblyHelpers::cageConditionally):

• llint/LowLevelInterpreter64.asm:

Source/WTF:

• wtf/CagedPtr.h:

(WTF::CagedPtr::authenticatingLoad):
(WTF::CagedPtr::get const):
(WTF::CagedPtr::getMayBeNull const):

Location:

trunk/Source

Files:

• JavaScriptCore/ChangeLog (modified) (1 diff)
• JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (modified) (4 diffs)
• JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (modified) (4 diffs)
• JavaScriptCore/jit/AssemblyHelpers.h (modified) (2 diffs)
• JavaScriptCore/llint/LowLevelInterpreter64.asm (modified) (1 diff)
• WTF/ChangeLog (modified) (1 diff)
• WTF/wtf/CagedPtr.h (modified) (3 diffs)
• bmalloc/ChangeLog (modified) (1 diff)
• bmalloc/bmalloc/Gigacage.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2019-06-02  Keith Miller  <keith_miller@apple.com>
+
+        Reenable Gigacage on ARM64.
+        https://bugs.webkit.org/show_bug.cgi?id=198453
+
+        Reviewed by Filip Pizlo.
+
+        This patch adds back Gigacaging on Apple's ARM64 ports. Unlike the
+        old Gigacage however, arm64e uses both Gigacaging and PAC. Since
+        Gigacaging would otherwise strip a PAC failed authenticate bit we
+        force a load of the pointer into some garbage register.
+
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::jumpForTypedArrayIsNeuteredIfOutOfBounds):
+        (JSC::DFG::SpeculativeJIT::cageTypedArrayStorage):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileNewTypedArray):
+        (JSC::FTL::DFG::LowerDFGToB3::untagArrayPtr):
+        (JSC::FTL::DFG::LowerDFGToB3::caged):
+        * jit/AssemblyHelpers.h:
+        (JSC::AssemblyHelpers::cageConditionally):
+        * llint/LowLevelInterpreter64.asm:
+
 2019-06-02  Tadeu Zagallo  <tzagallo@apple.com>
 

trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

@@ -2874 +2874 @@
 
             JITCompiler::Jump hasNullVector;
-#if !GIGACAGE_ENABLED && CPU(ARM64E)
+#if CPU(ARM64E)
             {
                 GPRReg scratch = m_jit.scratchRegister();
@@ -2883 +2883 @@
                 hasNullVector = m_jit.branchTestPtr(MacroAssembler::Zero, scratch);
             }
-#else // !GIGACAGE_ENABLED && CPU(ARM64E)
+#else // CPU(ARM64E)
             hasNullVector = m_jit.branchTestPtr(
                 MacroAssembler::Zero,
@@ -6720 +6720 @@
 void SpeculativeJIT::cageTypedArrayStorage(GPRReg baseReg, GPRReg storageReg)
 {
+#if CPU(ARM64E)
+    m_jit.untagArrayPtr(MacroAssembler::Address(baseReg, JSArrayBufferView::offsetOfLength()), storageReg);
+    m_jit.loadPtr(storageReg, m_jit.scratchRegister());
+#else
+    UNUSED_PARAM(baseReg);
+    UNUSED_PARAM(storageReg);
+#endif
+
 #if GIGACAGE_ENABLED
     UNUSED_PARAM(baseReg);
@@ -6733 +6741 @@
     
     m_jit.cage(Gigacage::Primitive, storageReg);
-#elif CPU(ARM64E)
-    m_jit.untagArrayPtr(MacroAssembler::Address(baseReg, JSArrayBufferView::offsetOfLength()), storageReg);
-#else
-    UNUSED_PARAM(baseReg);
-    UNUSED_PARAM(storageReg);
 #endif
 }

trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

@@ -6464 +6464 @@
                 m_heaps.typedArrayProperties);
 
-#if !GIGACAGE_ENABLED && CPU(ARM64E)
+#if CPU(ARM64E)
             {
                 LValue sizePtr = m_out.zeroExtPtr(size);
@@ -14109 +14109 @@
         authenticate->appendSomeRegister(ptr);
         authenticate->append(size, B3::ValueRep(B3::ValueRep::SomeLateRegister));
+        authenticate->numGPScratchRegisters = 1;
         authenticate->setGenerator([=] (CCallHelpers& jit, const StackmapGenerationParams& params) {
             jit.move(params[1].gpr(), params[0].gpr());
             jit.untagArrayPtr(params[2].gpr(), params[0].gpr());
+            // Force a load to check authentication. before it is cleared by Gigacaging later.
+            jit.loadPtr(params[0].gpr(), params.gpScratch(0));
         });
         return authenticate;
@@ -14136 +14139 @@
     LValue caged(Gigacage::Kind kind, LValue ptr, LValue base)
     {
+#if CPU(ARM64E)
+        if (kind == Gigacage::Primitive) {
+            LValue size = m_out.load32(base, m_heaps.JSArrayBufferView_length);
+            ptr = untagArrayPtr(ptr, size);
+        }
+#else
+        UNUSED_PARAM(kind);
+        UNUSED_PARAM(base);
+#endif
+
 #if GIGACAGE_ENABLED
         UNUSED_PARAM(base);
@@ -14166 +14179 @@
         // https://bugs.webkit.org/show_bug.cgi?id=175493
         return m_out.opaque(result);
-#elif CPU(ARM64E)
-        if (kind == Gigacage::Primitive) {
-            LValue size = m_out.load32(base, m_heaps.JSArrayBufferView_length);
-            return untagArrayPtr(ptr, size);
-        }
-
-        return ptr;
-#else
-        UNUSED_PARAM(kind);
-        UNUSED_PARAM(base);
-        return ptr;
 #endif
     }

trunk/Source/JavaScriptCore/jit/AssemblyHelpers.h

@@ -1572 +1572 @@
     void cageConditionally(Gigacage::Kind kind, GPRReg storage, GPRReg scratchOrLength)
     {
+#if CPU(ARM64E)
+        if (kind == Gigacage::Primitive) {
+            untagArrayPtr(scratchOrLength, storage);
+            // Force a load to trap on authentication failure. storage shouldn't be null here.
+            loadPtr(storage, scratchOrLength);
+        }
+#else
+        UNUSED_PARAM(kind);
+        UNUSED_PARAM(storage);
+        UNUSED_PARAM(scratchOrLength);
+#endif
+
 #if GIGACAGE_ENABLED
         if (!Gigacage::isEnabled(kind))
@@ -1584 +1596 @@
         addPtr(scratchOrLength, storage);
         done.link(this);
-#elif CPU(ARM64E)
-        if (kind == Gigacage::Primitive)
-            untagArrayPtr(scratchOrLength, storage);
-#else
-        UNUSED_PARAM(kind);
-        UNUSED_PARAM(storage);
-        UNUSED_PARAM(scratchOrLength);
 #endif
     }

trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm

@@ -435 +435 @@
 macro loadCagedPrimitive(source, dest, scratchOrLength)
     loadp source, dest
+    if ARM64E
+        untagArrayPtr scratchOrLength, dest
+        # Force a load to check PAC before we clear it below.
+        loadp [dest], scratchOrLength
+    end
     if GIGACAGE_ENABLED
         uncage(_g_gigacageBasePtrs + Gigacage::BasePtrs::primitive, constexpr Gigacage::primitiveGigacageMask, dest, scratchOrLength)
-    elsif ARM64E
-        untagArrayPtr scratchOrLength, dest
     end
 end

trunk/Source/WTF/ChangeLog

@@ +1 @@
+2019-06-02  Keith Miller  <keith_miller@apple.com>
+
+        Reenable Gigacage on ARM64.
+        https://bugs.webkit.org/show_bug.cgi?id=198453
+
+        Reviewed by Filip Pizlo.
+
+        * wtf/CagedPtr.h:
+        (WTF::CagedPtr::authenticatingLoad):
+        (WTF::CagedPtr::get const):
+        (WTF::CagedPtr::getMayBeNull const):
+
 2019-05-31  Alex Christensen  <achristensen@webkit.org>
 

trunk/Source/WTF/wtf/CagedPtr.h

@@ -36 +36 @@
 template<Gigacage::Kind passedKind, typename T, bool shouldTag = false, typename PtrTraits = DumbPtrTraits<T>>
 class CagedPtr {
+#if CPU(ARM64E)
+    static void authenticatingLoad(T* ptr)
+    {
+        double result;
+        asm volatile("ldr %[out], [%[in]]"
+            : [out] "=&r"(result)
+            : [in] "r"(ptr) :);
+    }
+#else
+    static void authenticatingLoad(T*) { }
+#endif
+
 public:
     static constexpr Gigacage::Kind kind = passedKind;
@@ -53 +65 @@
         ASSERT(m_ptr);
         T* ptr = PtrTraits::unwrap(m_ptr);
-        if (shouldTag)
+        if (shouldTag) {
             ptr = untagArrayPtr(ptr, size);
+            authenticatingLoad(ptr);
+        }
         return Gigacage::caged(kind, ptr);
     }
@@ -61 +75 @@
     {
         T* ptr = PtrTraits::unwrap(m_ptr);
-        if (shouldTag)
+        if (shouldTag) {
             ptr = untagArrayPtr(ptr, size);
+            if (ptr)
+                authenticatingLoad(ptr);
+        }
         return Gigacage::cagedMayBeNull(kind, ptr);
     }

trunk/Source/bmalloc/ChangeLog

@@ +1 @@
+2019-06-02  Keith Miller  <keith_miller@apple.com>
+
+        Reenable Gigacage on ARM64.
+        https://bugs.webkit.org/show_bug.cgi?id=198453
+
+        Reviewed by Filip Pizlo.
+
+        * bmalloc/Gigacage.h:
+
 2019-05-30  Don Olmstead  <don.olmstead@sony.com>
 

trunk/Source/bmalloc/bmalloc/Gigacage.h

@@ -35 +35 @@
 #include <inttypes.h>
 
-#if ((BOS(DARWIN) || BOS(LINUX)) && BCPU(X86_64))
+#if ((BOS(DARWIN) || BOS(LINUX)) && \
+    (BCPU(X86_64) || (BCPU(ARM64) && !defined(__ILP32__) && (!BPLATFORM(IOS_FAMILY) || BPLATFORM(IOS)))))
 #define GIGACAGE_ENABLED 1
 #else