Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: b3eceeb22f58375c3ae39ccdc376335e417881fe
https://github.com/WebKit/WebKit/commit/b3eceeb22f58375c3ae39ccdc376335e417881fe
Author: Keith Miller <keith_mil...@apple.com>
Date: 2024-04-05 (Fri, 05 Apr 2024)
Changed paths:
M Source/JavaScriptCore/jsc.cpp
M Source/JavaScriptCore/runtime/InitializeThreading.cpp
M Source/JavaScriptCore/runtime/JSCConfig.cpp
M Source/JavaScriptCore/runtime/JSCConfig.h
M Source/JavaScriptCore/runtime/VM.cpp
M Source/JavaScriptCore/runtime/VMEntryScope.cpp
M Source/JavaScriptCore/runtime/VMTraps.cpp
M Source/JavaScriptCore/tools/JSDollarVM.cpp
M Source/JavaScriptCore/wasm/WasmFaultSignalHandler.cpp
M Source/JavaScriptCore/wasm/WasmFaultSignalHandler.h
M Source/WTF/wtf/PlatformRegisters.cpp
M Source/WTF/wtf/Threading.cpp
M Source/WTF/wtf/WTFConfig.cpp
M Source/WTF/wtf/WTFConfig.h
M Source/WTF/wtf/threads/Signals.cpp
M Source/WTF/wtf/threads/Signals.h
M Source/WTF/wtf/win/SignalsWin.cpp
M
Source/WebKit/GPUProcess/EntryPoint/Cocoa/XPCService/GPUServiceEntryPoint.mm
M
Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in
M Tools/TestWebKitAPI/Tests/WTF/Signals.cpp
Log Message:
-----------
Clean up Signals and remove hardened fallback
https://bugs.webkit.org/show_bug.cgi?id=271766
rdar://125256111
Reviewed by Justin Michaud.
This change does a couple of things:
1) Refactor the signal handler API after https://commits.webkit.org/276579@main
which had mach exception users
pass the mask of exceptions they would ever want to handle at initialization
time (before they register their handler).
Instead the new signal handler API registers our handlers with the kernel at
finalization time. At which point we
have a list of every exception handler added.
2) Remove the finalizeSignalHandlers function and finalize signal handlers when
WTF::Config finalizes.
3) Remove disableSignalHandling function as it never really worked (signals
could still get registered before we called disable)
and we mostly rely on the sandbox to block signals in lockdown mode.
3) Rename SignalHandlers::InitState entries to better reflect the new design
and use it for all configurations not just mach ports.
4) Remove the fallback we added to https://commits.webkit.org/276579@main as a
stopgap for internal folks running on old sandboxes.
5) Remove `isX86BinaryRunningOnARM()` check since that didn't seem to work
anyway. We'll probably have to remove signal handling under
Rosetta as I couldn't get it to work.
6) Save the secret key for our hardened handler in Signals.cpp before
finalization and only let API users see it via presignReturnPCForHandler
so they can't accidentally save it somewhere an attacker could see later. We
also carefully zero it at finalization time after passing
it to the kernel via `task_register_hardened_exception_handler`.
7) Move disabledFreezingForTesting to WTF::Config since that's the config that
actually does the freezing not JSC::Config.
This allows WTF::Config to control finalizing signal handlers.
8) Remove some cases from com.apple.WebKit.WebContent.sb.in to simplify the
profile slightly. We don't need to guard the
`(require-not (webcontent-process-launched))` check on
`ENABLE(BLOCK_SET_EXCEPTION_PORTS)` because we have
`webcontent-process-launched` anywhere we `HAVE(HARDENED_MACH_EXCEPTIONS)`
anyway.
* Source/JavaScriptCore/jsc.cpp:
(main):
(CommandLine::parseArguments):
* Source/JavaScriptCore/runtime/InitializeThreading.cpp:
(JSC::initialize):
* Source/JavaScriptCore/runtime/JSCConfig.cpp:
(JSC::Config::disableFreezingForTesting): Deleted.
* Source/JavaScriptCore/runtime/JSCConfig.h:
(JSC::Config::disableFreezingForTesting):
(JSC::Config::finalize):
(JSC::Config::permanentlyFreeze): Deleted.
* Source/JavaScriptCore/runtime/VM.cpp:
(JSC::VM::VM):
* Source/JavaScriptCore/runtime/VMEntryScope.cpp:
(JSC::VMEntryScope::setUpSlow):
* Source/JavaScriptCore/runtime/VMTraps.cpp:
* Source/JavaScriptCore/tools/JSDollarVM.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION_WITH_ATTRIBUTES):
* Source/JavaScriptCore/wasm/WasmFaultSignalHandler.cpp:
(JSC::Wasm::trapHandler):
(JSC::Wasm::activateSignalingMemory):
(JSC::Wasm::prepareSignalingMemory):
(JSC::Wasm::MachExceptionSigningKey::MachExceptionSigningKey): Deleted.
* Source/JavaScriptCore/wasm/WasmFaultSignalHandler.h:
* Source/WTF/wtf/PlatformRegisters.cpp:
(WTF::threadStatePCInternal):
* Source/WTF/wtf/Threading.cpp:
(WTF::initialize):
* Source/WTF/wtf/WTFConfig.cpp:
(WTF::Config::initialize):
(WTF::Config::finalize):
(WTF::Config::permanentlyFreeze):
(WTF::Config::disableFreezingForTesting):
* Source/WTF/wtf/WTFConfig.h:
* Source/WTF/wtf/threads/Signals.cpp:
(WTF::SignalHandlers::add):
(WTF::SignalHandlers::presignReturnPCForHandler):
(WTF::initMachExceptionHandlerThread):
(WTF::toMachMask):
(WTF::setExceptionPorts):
(WTF::activeThreads):
(WTF::registerThreadForMachExceptionHandling):
(WTF::activateSignalHandlersFor):
(WTF::addSignalHandler):
(WTF::disableSignalHandling):
(WTF::jscSignalHandler):
(WTF::SignalHandlers::initialize):
(WTF::SignalHandlers::finalize):
(WTF::finalizeSignalHandlers): Deleted.
* Source/WTF/wtf/threads/Signals.h:
(WTF::toMachMask): Deleted.
(WTF::initializeSignalHandling): Deleted.
(WTF::disableSignalHandling): Deleted.
* Source/WTF/wtf/win/SignalsWin.cpp:
(WTF::SignalHandlers::add):
(WTF::addSignalHandler):
(WTF::activateSignalHandlersFor):
(WTF::SignalHandlers::initialize):
(WTF::SignalHandlers::finalize):
(WTF::finalizeSignalHandlers): Deleted.
* Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:
Canonical link: https://commits.webkit.org/277136@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
