ProcessExecutableMemory.h (5687B)
1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */ 2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */ 3 /* This Source Code Form is subject to the terms of the Mozilla Public 4 * License, v. 2.0. If a copy of the MPL was not distributed with this 5 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ 6 7 #ifndef jit_ProcessExecutableMemory_h 8 #define jit_ProcessExecutableMemory_h 9 10 #include "util/Poison.h" 11 12 #ifdef XP_IOS 13 # include <BrowserEngineCore/BEMemory.h> 14 #endif 15 16 namespace js { 17 namespace jit { 18 19 // Limit on the number of bytes of executable memory to prevent JIT spraying 20 // attacks. 21 #if JS_BITS_PER_WORD == 32 22 static const size_t MaxCodeBytesPerProcess = 140 * 1024 * 1024; 23 #else 24 // This is the largest number which satisfies various alignment static 25 // asserts that is <= INT32_MAX. If we ever want to increase this, we need to 26 // ensure RtlAddGrowableFunctionTable does the right thing because 27 // RUNTIME_FUNCTION::EndAddress is a (32-bit) DWORD. 28 static const size_t MaxCodeBytesPerProcess = 2044 * 1024 * 1024; 29 #endif 30 31 // Limit on the number of bytes of code memory per buffer. This limit comes 32 // about because we encode an unresolved relative unconditional branch during 33 // assembly as a branch instruction that carries the absolute offset of the next 34 // branch instruction in the chain of branches that all reference the same 35 // unresolved label. For this architecture to work, no branch instruction may 36 // lie at an offset greater than the maximum forward branch distance. This is 37 // true on both ARM and ARM64. 38 // 39 // Notably, even though we know that the offsets thus encoded are always 40 // positive offsets, we use only the positive part of the signed range of the 41 // branch offset. 42 // 43 // On ARM-32, we are limited by BOffImm::IsInRange(), which checks that the 44 // offset is no greater than 2^25-4 in the offset's 26-bit signed field. 45 // 46 // On ARM-64, we are limited by Instruction::ImmBranchMaxForwardOffset(), which 47 // checks that the offset is no greater than 2^27-4 in the offset's 28-bit 48 // signed field. 49 // 50 // On MIPS, there are no limitations because the assembler has to implement 51 // jump chaining to be effective at all (jump offsets are quite small). 52 // 53 // On x86 and x64, there are no limitations here because the assembler 54 // MOZ_CRASHes if the 32-bit offset is exceeded. 55 56 #if defined(JS_CODEGEN_ARM) 57 static const size_t MaxCodeBytesPerBuffer = (1 << 25) - 4; 58 #elif defined(JS_CODEGEN_ARM64) 59 static const size_t MaxCodeBytesPerBuffer = (1 << 27) - 4; 60 #else 61 static const size_t MaxCodeBytesPerBuffer = MaxCodeBytesPerProcess; 62 #endif 63 64 // Executable code is allocated in 64K chunks. ExecutableAllocator uses pools 65 // that are at least this big. Code we allocate does not necessarily have 64K 66 // alignment though. 67 static const size_t ExecutableCodePageSize = 64 * 1024; 68 69 enum class ProtectionSetting { 70 Writable, 71 Executable, 72 }; 73 74 /// Whether the instruction cache must be flushed 75 76 enum class MustFlushICache { No, Yes }; 77 78 [[nodiscard]] extern bool ReprotectRegion(void* start, size_t size, 79 ProtectionSetting protection, 80 MustFlushICache flushICache); 81 82 // Functions called at process start-up/shutdown to initialize/release the 83 // executable memory region. 84 [[nodiscard]] extern bool InitProcessExecutableMemory(); 85 extern void ReleaseProcessExecutableMemory(); 86 87 // Allocate/deallocate executable pages. 88 extern void* AllocateExecutableMemory(size_t bytes, 89 ProtectionSetting protection, 90 MemCheckKind checkKind); 91 extern void DeallocateExecutableMemory(void* addr, size_t bytes); 92 93 // Returns true if we can allocate a few more MB of executable code without 94 // hitting our code limit. This function can be used to stop compiling things 95 // that are optional (like Baseline and Ion code) when we're about to reach the 96 // limit, so we are less likely to OOM or crash. Note that the limit is 97 // per-process, so other threads can also allocate code after we call this 98 // function. 99 extern bool CanLikelyAllocateMoreExecutableMemory(); 100 101 // Returns a rough guess of how much executable memory remains available, 102 // rounded down to MB limit. Note this can fluctuate as other threads within 103 // the process allocate executable memory. 104 extern size_t LikelyAvailableExecutableMemory(); 105 106 // Returns whether |p| is stored in the executable code buffer. 107 extern bool AddressIsInExecutableMemory(const void* p); 108 109 // RWX page permissions are not supported on Apple Silicon. We have to use this 110 // RAII class to temporarily mark JIT memory as writable for the current thread 111 // with pthread_jit_write_protect_np. This class is a no-op on other platforms 112 // (except for some debug assertions). 113 class MOZ_RAII AutoMarkJitCodeWritableForThread { 114 #ifdef DEBUG 115 void checkConstructor(); 116 void checkDestructor(); 117 #else 118 void checkConstructor() {} 119 void checkDestructor() {} 120 #endif 121 122 #if defined(JS_USE_APPLE_FAST_WX) && !defined(XP_IOS) 123 void markExecutable(bool executable); 124 #endif 125 126 public: 127 MOZ_ALWAYS_INLINE_EVEN_DEBUG AutoMarkJitCodeWritableForThread() { 128 #if defined(JS_USE_APPLE_FAST_WX) 129 # if defined(XP_IOS) 130 be_memory_inline_jit_restrict_rwx_to_rw_with_witness(); 131 # else 132 markExecutable(false); 133 # endif 134 #endif 135 checkConstructor(); 136 } 137 MOZ_ALWAYS_INLINE_EVEN_DEBUG ~AutoMarkJitCodeWritableForThread() { 138 #if defined(JS_USE_APPLE_FAST_WX) 139 # if defined(XP_IOS) 140 be_memory_inline_jit_restrict_rwx_to_rx_with_witness(); 141 # else 142 markExecutable(true); 143 # endif 144 #endif 145 checkDestructor(); 146 } 147 }; 148 149 } // namespace jit 150 } // namespace js 151 152 #endif // jit_ProcessExecutableMemory_h