Implement FFI_EXEC_TRAMPOLINE_TABLE allocator for iOS/ARM.

This provides working closure support on iOS/ARM devices where
PROT_WRITE|PROT_EXEC is not permitted. The code passes basic
smoke tests, but requires further review.
This commit is contained in:
Landon Fuller
2010-09-19 14:36:45 -07:00
parent b00ff3e98f
commit 83038cf24a
3 changed files with 219 additions and 83 deletions

View File

@@ -273,6 +273,220 @@ ffi_prep_incoming_args_SYSV(char *stack, void **rvalue,
/* How to make a trampoline. */
#if FFI_EXEC_TRAMPOLINE_TABLE
#include <mach/mach.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
extern void *ffi_closure_trampoline_table_page;
typedef struct ffi_trampoline_table ffi_trampoline_table;
typedef struct ffi_trampoline_table_entry ffi_trampoline_table_entry;
struct ffi_trampoline_table {
/* contigious writable and executable pages */
vm_address_t config_page;
vm_address_t trampoline_page;
/* free list tracking */
uint16_t free_count;
ffi_trampoline_table_entry *free_list;
ffi_trampoline_table_entry *free_list_pool;
ffi_trampoline_table *prev;
ffi_trampoline_table *next;
};
struct ffi_trampoline_table_entry {
void *(*trampoline)();
ffi_trampoline_table_entry *next;
};
/* Override the standard architecture trampoline size */
// XXX TODO - Fix
#undef FFI_TRAMPOLINE_SIZE
#define FFI_TRAMPOLINE_SIZE 12
/* The trampoline configuration is placed at 4080 bytes prior to the trampoline's entry point */
#define FFI_TRAMPOLINE_CODELOC_CONFIG(codeloc) ((void **) (((uint8_t *) codeloc) - 4080));
/* The first 16 bytes of the config page are unused, as they are unaddressable from the trampoline page. */
#define FFI_TRAMPOLINE_CONFIG_PAGE_OFFSET 16
/* Total number of trampolines that fit in one trampoline table */
#define FFI_TRAMPOLINE_COUNT ((PAGE_SIZE - FFI_TRAMPOLINE_CONFIG_PAGE_OFFSET) / FFI_TRAMPOLINE_SIZE)
static pthread_mutex_t ffi_trampoline_lock = PTHREAD_MUTEX_INITIALIZER;
static ffi_trampoline_table *ffi_trampoline_tables = NULL;
static ffi_trampoline_table *
ffi_trampoline_table_alloc ()
{
ffi_trampoline_table *table = NULL;
/* Loop until we can allocate two contigious pages */
while (table == NULL) {
vm_address_t config_page = 0x0;
kern_return_t kt;
/* Try to allocate two pages */
kt = vm_allocate (mach_task_self (), &config_page, PAGE_SIZE*2, VM_FLAGS_ANYWHERE);
if (kt != KERN_SUCCESS) {
fprintf(stderr, "vm_allocate() failure: %d at %s:%d\n", kt, __FILE__, __LINE__);
break;
}
/* Now drop the second half of the allocation to make room for the trampoline table */
vm_address_t trampoline_page = config_page+PAGE_SIZE;
kt = vm_deallocate (mach_task_self (), trampoline_page, PAGE_SIZE);
if (kt != KERN_SUCCESS) {
fprintf(stderr, "vm_deallocate() failure: %d at %s:%d\n", kt, __FILE__, __LINE__);
break;
}
/* Remap the trampoline table to directly follow the config page */
vm_prot_t cur_prot;
vm_prot_t max_prot;
kt = vm_remap (mach_task_self (), &trampoline_page, PAGE_SIZE, 0x0, FALSE, mach_task_self (), (vm_address_t) &ffi_closure_trampoline_table_page, FALSE, &cur_prot, &max_prot, VM_INHERIT_SHARE);
/* If we lost access to the destination trampoline page, drop our config allocation mapping and retry */
if (kt != KERN_SUCCESS) {
/* Log unexpected failures */
if (kt != KERN_NO_SPACE) {
fprintf(stderr, "vm_remap() failure: %d at %s:%d\n", kt, __FILE__, __LINE__);
}
vm_deallocate (mach_task_self (), config_page, PAGE_SIZE);
continue;
}
/* We have valid trampoline and config pages */
table = calloc (1, sizeof(ffi_trampoline_table));
table->free_count = FFI_TRAMPOLINE_COUNT;
table->config_page = config_page;
table->trampoline_page = trampoline_page;
/* Create and initialize the free list */
table->free_list_pool = calloc(FFI_TRAMPOLINE_COUNT, sizeof(ffi_trampoline_table_entry));
uint16_t i;
for (i = 0; i < table->free_count; i++) {
ffi_trampoline_table_entry *entry = &table->free_list_pool[i];
entry->trampoline = (void *) (table->trampoline_page + (i * FFI_TRAMPOLINE_SIZE));
if (i < table->free_count - 1)
entry->next = &table->free_list_pool[i+1];
}
table->free_list = table->free_list_pool;
}
return table;
}
void *
ffi_closure_alloc (size_t size, void **code)
{
/* Create the closure */
ffi_closure *closure = malloc(size);
if (closure == NULL)
return NULL;
pthread_mutex_lock(&ffi_trampoline_lock);
/* Check for an active trampoline table with available entries. */
ffi_trampoline_table *table = ffi_trampoline_tables;
if (table == NULL || table->free_list == NULL) {
table = ffi_trampoline_table_alloc ();
if (table == NULL) {
free(closure);
return NULL;
}
/* Insert the new table at the top of the list */
table->next = ffi_trampoline_tables;
if (table->next != NULL)
table->next->prev = table;
ffi_trampoline_tables = table;
}
/* Claim the free entry */
ffi_trampoline_table_entry *entry = ffi_trampoline_tables->free_list;
ffi_trampoline_tables->free_list = entry->next;
ffi_trampoline_tables->free_count--;
entry->next = NULL;
pthread_mutex_unlock(&ffi_trampoline_lock);
/* Initialize the return values */
*code = entry->trampoline;
closure->trampoline_table = table;
closure->trampoline_table_entry = entry;
return closure;
}
void
ffi_closure_free (void *ptr)
{
ffi_closure *closure = ptr;
pthread_mutex_lock(&ffi_trampoline_lock);
/* Fetch the table and entry references */
ffi_trampoline_table *table = closure->trampoline_table;
ffi_trampoline_table_entry *entry = closure->trampoline_table_entry;
/* Return the entry to the free list */
entry->next = table->free_list;
table->free_list = entry;
table->free_count++;
/* If all trampolines within this table are free, and at least one other table exists, deallocate
* the table */
if (table->free_count == FFI_TRAMPOLINE_COUNT && ffi_trampoline_tables != table) {
/* Remove from the list */
if (table->prev != NULL)
table->prev->next = table->next;
if (table->next != NULL)
table->next->prev = table->prev;
/* Deallocate pages */
kern_return_t kt;
kt = vm_deallocate (mach_task_self (), table->config_page, PAGE_SIZE);
if (kt != KERN_SUCCESS)
fprintf(stderr, "vm_deallocate() failure: %d at %s:%d\n", kt, __FILE__, __LINE__);
kt = vm_deallocate (mach_task_self (), table->trampoline_page, PAGE_SIZE);
if (kt != KERN_SUCCESS)
fprintf(stderr, "vm_deallocate() failure: %d at %s:%d\n", kt, __FILE__, __LINE__);
/* Deallocate free list */
free (table->free_list_pool);
free (table);
} else if (ffi_trampoline_tables != table) {
/* Otherwise, bump this table to the top of the list */
table->prev = NULL;
table->next = ffi_trampoline_tables;
if (ffi_trampoline_tables != NULL)
ffi_trampoline_tables->prev = table;
ffi_trampoline_tables = table;
}
pthread_mutex_unlock (&ffi_trampoline_lock);
/* Free the closure */
free (closure);
}
#else
#define FFI_INIT_TRAMPOLINE(TRAMP,FUN,CTX) \
({ unsigned char *__tramp = (unsigned char*)(TRAMP); \
unsigned int __fun = (unsigned int)(FUN); \
@@ -285,6 +499,7 @@ ffi_prep_incoming_args_SYSV(char *stack, void **rvalue,
__clear_cache((&__tramp[0]), (&__tramp[19])); \
})
#endif
/* the cif must already be prep'ed */
@@ -298,8 +513,7 @@ ffi_prep_closure_loc (ffi_closure* closure,
FFI_ASSERT (cif->abi == FFI_SYSV);
#if FFI_EXEC_TRAMPOLINE_TABLE
// XXX - hardcoded offset
void **config = (void **) (((uint8_t *) codeloc) - 4080);
void **config = FFI_TRAMPOLINE_CODELOC_CONFIG(codeloc);
config[0] = closure;
config[1] = ffi_closure_SYSV;
#else

View File

@@ -3,8 +3,8 @@
.text
.align 12
.globl _ffi_closure_trampoline_table
_ffi_closure_trampoline_table:
.globl _ffi_closure_trampoline_table_page
_ffi_closure_trampoline_table_page:
// trampoline
// Save to stack

View File

@@ -65,85 +65,7 @@
# if FFI_EXEC_TRAMPOLINE_TABLE
// XXX - non-thread-safe, non-portable implementation, intended for initial testing
#include <mach/mach.h>
#include <stdio.h>
#include <stdlib.h>
extern void *ffi_closure_trampoline_table;
static void *tramp_table = NULL;
static void **config_table = NULL;
static int tramp_table_free = 0;
void *
ffi_closure_alloc (size_t size, void **code)
{
if (!code)
return NULL;
/* Allocate our config page and remap the trampoline table */
while (tramp_table == NULL) {
vm_address_t config_page = 0x0;
kern_return_t kt;
/* Try to allocate two pages */
kt = vm_allocate(mach_task_self(), &config_page, PAGE_SIZE*2, VM_FLAGS_ANYWHERE);
if (kt != KERN_SUCCESS) {
fprintf(stderr, "vm_allocate() failure: %d at %s:%d\n", kt, __FILE__, __LINE__);
break;
}
/* Now drop the second half of the allocation to make room for the trampoline table */
kt = vm_deallocate(mach_task_self(), config_page+PAGE_SIZE, PAGE_SIZE);
if (kt != KERN_SUCCESS) {
fprintf(stderr, "vm_deallocate() failure: %d at %s:%d\n", kt, __FILE__, __LINE__);
break;
}
/* Remap the trampoline table to directly follow the config page */
vm_address_t table_page = config_page+PAGE_SIZE;
vm_prot_t cur_prot;
vm_prot_t max_prot;
kt = vm_remap(mach_task_self(), &table_page, PAGE_SIZE, 0x0, FALSE, mach_task_self(), (vm_address_t) &ffi_closure_trampoline_table, FALSE, &cur_prot, &max_prot, VM_INHERIT_SHARE);
/* If we lost access to the destination trampoline page, drop our config allocation mapping and retry */
if (kt != KERN_SUCCESS) {
/* Log unexpected failures */
if (kt != KERN_NO_SPACE) {
fprintf(stderr, "vm_remap() failure: %d at %s:%d\n", kt, __FILE__, __LINE__);
}
vm_deallocate(mach_task_self(), config_page, PAGE_SIZE);
continue;
}
tramp_table = (void *) table_page;
config_table = (void **) config_page;
config_table += 4; // XXX - there's a 16 byte offset into the config page on ARM
fprintf(stderr, "[DEBUG] Allocated config page at %p, trampoline page at %p, configs start at %p\n", (void *) config_page, (void *) table_page, config_table);
}
/* Check for permanent allocation failure */
if (tramp_table == NULL)
return *code = NULL;
*code = tramp_table + (3 * tramp_table_free);
tramp_table_free++;
void *closure = malloc(size);
return closure;
}
void
ffi_closure_free (void *ptr)
{
// TODO
//free (ptr);
}
// Per-target implementation; It's unclear what can reasonable be shared between two OS/architecture implementations.
# elif FFI_MMAP_EXEC_WRIT /* !FFI_EXEC_TRAMPOLINE_TABLE */