Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ba07b609dde3d292264be5576a7daa415475eaf2
https://github.com/WebKit/WebKit/commit/ba07b609dde3d292264be5576a7daa415475eaf2
Author: Keith Miller <keith_mil...@apple.com>
Date: 2024-04-17 (Wed, 17 Apr 2024)
Changed paths:
M Source/JavaScriptCore/jsc.cpp
M Source/JavaScriptCore/runtime/InitializeThreading.cpp
M Source/JavaScriptCore/runtime/JSCConfig.cpp
M Source/JavaScriptCore/runtime/JSCConfig.h
M Source/JavaScriptCore/runtime/VM.cpp
M Source/JavaScriptCore/runtime/VMEntryScope.cpp
M Source/JavaScriptCore/runtime/VMTraps.cpp
M Source/JavaScriptCore/tools/JSDollarVM.cpp
M Source/JavaScriptCore/wasm/WasmFaultSignalHandler.cpp
M Source/JavaScriptCore/wasm/WasmFaultSignalHandler.h
M Source/WTF/wtf/PlatformRegisters.cpp
M Source/WTF/wtf/Threading.cpp
M Source/WTF/wtf/WTFConfig.cpp
M Source/WTF/wtf/WTFConfig.h
M Source/WTF/wtf/threads/Signals.cpp
M Source/WTF/wtf/threads/Signals.h
M Source/WTF/wtf/win/SignalsWin.cpp
M
Source/WebKit/GPUProcess/EntryPoint/Cocoa/XPCService/GPUServiceEntryPoint.mm
M
Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in
M Tools/DumpRenderTree/mac/DumpRenderTree.mm
M Tools/TestWebKitAPI/Tests/WTF/Signals.cpp
Log Message:
-----------
Cleanup hardened mach exceptions and formalize fallback
https://bugs.webkit.org/show_bug.cgi?id=272839
rdar://126634499
Reviewed by Yusuke Suzuki.
This change does a couple of things:
1) Refactor the signal handler API after https://commits.webkit.org/276579@main
which had mach exception users
pass the mask of exceptions they would ever want to handle at initialization
time (before they register their handler).
Instead the new signal handler API registers our handlers with the kernel at
finalization time. At which point we
have a list of every exception handler added.
2) Remove the finalizeSignalHandlers function and finalize signal handlers when
WTF::Config finalizes.
3) Remove disableSignalHandling function as it never really worked (signals
could still get registered before we called disable)
and we mostly rely on the sandbox to block signals in lockdown mode.
3) Rename SignalHandlers::InitState entries to better reflect the new design
and use it for all configurations not just mach ports.
4) Formalized the fallback added in https://commits.webkit.org/276579@main we
need it for JSC API users that don't have the hardened API
in their sandbox.
5) Remove `isX86BinaryRunningOnARM()` check since that didn't seem to work
anyway. We'll probably have to remove signal handling under
Rosetta as I couldn't get it to work.
6) Save the secret key for our hardened handler in Signals.cpp before
finalization and only let API users see it via presignReturnPCForHandler
so they can't accidentally save it somewhere an attacker could see later. We
also carefully zero it at finalization time after passing
it to the kernel via `task_register_hardened_exception_handler`.
7) Move disabledFreezingForTesting to WTF::Config since that's the config that
actually does the freezing not JSC::Config.
This allows WTF::Config to control finalizing signal handlers.
8) Remove some cases from com.apple.WebKit.WebContent.sb.in to simplify the
profile slightly. We don't need to guard the
`(require-not (webcontent-process-launched))` check on
`ENABLE(BLOCK_SET_EXCEPTION_PORTS)` because we have
`webcontent-process-launched` anywhere we `HAVE(HARDENED_MACH_EXCEPTIONS)`
anyway.
* Source/JavaScriptCore/jsc.cpp:
(main):
(CommandLine::parseArguments):
* Source/JavaScriptCore/runtime/InitializeThreading.cpp:
(JSC::initialize):
* Source/JavaScriptCore/runtime/JSCConfig.cpp:
(JSC::Config::disableFreezingForTesting): Deleted.
* Source/JavaScriptCore/runtime/JSCConfig.h:
(JSC::Config::disableFreezingForTesting):
(JSC::Config::finalize):
(JSC::Config::permanentlyFreeze): Deleted.
* Source/JavaScriptCore/runtime/VM.cpp:
(JSC::VM::VM):
* Source/JavaScriptCore/runtime/VMEntryScope.cpp:
(JSC::VMEntryScope::setUpSlow):
* Source/JavaScriptCore/runtime/VMTraps.cpp:
* Source/JavaScriptCore/tools/JSDollarVM.cpp:
(JSC::JSC_DEFINE_HOST_FUNCTION_WITH_ATTRIBUTES):
* Source/JavaScriptCore/wasm/WasmFaultSignalHandler.cpp:
(JSC::Wasm::trapHandler):
(JSC::Wasm::activateSignalingMemory):
(JSC::Wasm::prepareSignalingMemory):
(JSC::Wasm::MachExceptionSigningKey::MachExceptionSigningKey): Deleted.
* Source/JavaScriptCore/wasm/WasmFaultSignalHandler.h:
* Source/WTF/wtf/PlatformRegisters.cpp:
(WTF::threadStatePCInternal):
* Source/WTF/wtf/Threading.cpp:
(WTF::initialize):
* Source/WTF/wtf/WTFConfig.cpp:
(WTF::Config::initialize):
(WTF::Config::finalize):
(WTF::Config::permanentlyFreeze):
(WTF::Config::disableFreezingForTesting):
* Source/WTF/wtf/WTFConfig.h:
* Source/WTF/wtf/threads/Signals.cpp:
(WTF::SignalHandlers::add):
(WTF::SignalHandlers::presignReturnPCForHandler):
(WTF::initMachExceptionHandlerThread):
(WTF::toMachMask):
(WTF::setExceptionPorts):
(WTF::activeThreads):
(WTF::registerThreadForMachExceptionHandling):
(WTF::activateSignalHandlersFor):
(WTF::addSignalHandler):
(WTF::jscSignalHandler):
(WTF::SignalHandlers::initialize):
(WTF::SignalHandlers::finalize):
(WTF::finalizeSignalHandlers): Deleted.
* Source/WTF/wtf/threads/Signals.h:
(WTF::toMachMask): Deleted.
(WTF::initializeSignalHandling): Deleted.
(WTF::disableSignalHandling): Deleted.
* Source/WTF/wtf/win/SignalsWin.cpp:
(WTF::SignalHandlers::add):
(WTF::addSignalHandler):
(WTF::activateSignalHandlersFor):
(WTF::SignalHandlers::initialize):
(WTF::SignalHandlers::finalize):
(WTF::finalizeSignalHandlers): Deleted.
* Source/WebKit/GPUProcess/EntryPoint/Cocoa/XPCService/GPUServiceEntryPoint.mm:
(GPU_SERVICE_INITIALIZER):
* Source/WebKit/Resources/SandboxProfiles/ios/com.apple.WebKit.WebContent.sb.in:
* Tools/TestWebKitAPI/Tests/WTF/Signals.cpp:
(TEST(Signals, SignalsWorkOnExit)):
(TEST(Signals, SignalsAccessFault)):
Canonical link: https://commits.webkit.org/277648@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
