<div dir="ltr">Hi Ben,<div class="gmail_extra"><br><div class="gmail_quote">On Fri, Dec 23, 2016 at 8:03 PM, Ben Coman <span dir="ltr"><<a href="mailto:btc@openinworld.com" target="_blank">btc@openinworld.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5"><br>
On Sat, Dec 24, 2016 at 2:33 AM, Holger Freyther <<a href="mailto:holger@freyther.de">holger@freyther.de</a>> wrote:<br>
><br>
><br>
><br>
> > On 23 Dec 2016, at 01:46, Ben Coman <<a href="mailto:btc@openinworld.com">btc@openinworld.com</a>> wrote:<br>
> ><br>
> > Just curious about the behaviour and performance of mprotect and VirtualProtect. Would it be feasible to use on each FFI callout so that aberrant memory access from C code cannot corrupt the Smalltalk Image, but generate an exception that could be handled in-Image?<br>
><br>
> Hi Ben,<br>
><br>
> * syscall overhead (e.g. mprotect is not part of the VDSO)<br>
> * lock/unlock of Page Table Entries (PTEs)<br>
> * walking page table entries<br>
> * modifying page table entries<br>
> * merging/combining virtual memory areas now (allocation)<br>
> * cache/tlb being invalidated<br>
><br>
><br>
> E.g. for FreeBSD the chain is like this with a lot of details on the way<br>
><br>
> * sys_mprotect[1] the syscall after the dispatch<br>
> * vm_map_protect[2] for the VM subsystem<br>
> * AMD64's pmap_protect[3] implementation various ways to invalidate the TLB in it<br>
><br>
> holger<br>
><br>
><br>
><br>
> [1] <a href="https://github.com/freebsd/freebsd/blob/releng/10.3/sys/vm/vm_mmap.c#L657" rel="noreferrer" target="_blank">https://github.com/freebsd/<wbr>freebsd/blob/releng/10.3/sys/<wbr>vm/vm_mmap.c#L657</a><br>
> [2] <a href="https://github.com/freebsd/freebsd/blob/releng/10.3/sys/vm/vm_map.c#L1924" rel="noreferrer" target="_blank">https://github.com/freebsd/<wbr>freebsd/blob/releng/10.3/sys/<wbr>vm/vm_map.c#L1924</a><br>
> [3] <a href="https://github.com/freebsd/freebsd/blob/releng/10.3/sys/amd64/amd64/pmap.c#L3906" rel="noreferrer" target="_blank">https://github.com/freebsd/<wbr>freebsd/blob/releng/10.3/sys/<wbr>amd64/amd64/pmap.c#L3906</a><br>
<br>
<br>
</div></div>Thanks Holger. A bit hard to soak up in a first sitting, but<br>
interesting to get a feel for how it works under the covers.<br>
I summarised the loops, so it seems it needs to modify every page table entry.<br>
<br>
sys_mprotect()<br>
<br>
vm_map_protect()<br>
/* Make a first pass to check for protection violations.*/<br>
while ((current != &map->header) && (current->start < end))<br>
{... current = current->next; ...}<br>
<br>
/* Do an accounting pass for private read-only mappings that now<br>
will do cow due to allowed write (e.g. debugger sets breakpoint on<br>
text segment) */<br>
for (current = entry; (current != &map->header) &&<br>
(current->start < end); current = current->next)<br>
{...}<br>
<br>
/* Go back and fix up protections. [Note that clipping is not<br>
necessary the second time.] */<br>
current = entry;<br>
while ((current != &map->header) && (current->start < end))<br>
{<br>
...<br>
pmap_protect()<br>
for (; sva < eva; sva = va_next) {<br>
va_next = (sva + NBPDR) & ~PDRMASK;<br>
for (pte = pmap_pde_to_pte(pde, sva); sva != va_next;<br>
pte++, sva += PAGE_SIZE)<br>
{...flip page table bits...}<br>
current = current->next;<br>
}<br>
<br>
The documentation of variables in the code there is not great. I'm<br>
guessing at variable purposes...<br>
sva = start virtual address<br>
eva = end virtual address<br>
pte = page table entry<br>
NBPDR=number bytes / page directory<br>
<br>
So maybe useful for debugging, but not practical for every FFI call (??)<br></blockquote><div><br></div><div>Well, even if it was only switched on for debugging one would need to /not/ protect pages containing objects passed through the FFI to be written to. I don't see an easy way of doing this. One might think one only had to scan the objects in the current FFI call and not protect them. But how would one distinguish between those just read from and those written to?</div><div><br></div><div>Also Spur's support for pinned objects means that one can pass pinned objects out to foreign code and allow the foreign code to access the object after the call returns. I don't know how to not protect these objects. If one starts to make exceptions for all objects in the current call and all pinned objects pretty soon one has lots of the heap unprotected.</div><div><br></div><div>But there's another principle here. While a debugging idea may seem really useful its best not to implement it until one really needs it. Debugging features add complexity and if done wrong can introduce differences between normal and debug behaviour. There's an opportunity cost I'n implementing them. So let's not add debug features until we really need them.</div><div><br></div><div>Happy solstice!</div></div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><span style="font-size:small;border-collapse:separate"><div>_,,,^..^,,,_<br></div><div>best, Eliot</div></span></div></div></div>
</div></div>