Re: [PATCH] arm64: Add config to limit user space to 47bits

From: Alexander Graf
Date: Wed Jul 13 2016 - 12:14:49 EST

On 07/13/2016 05:59 PM, Ard Biesheuvel wrote:
On 13 July 2016 at 17:42, Alexander Graf <agraf@xxxxxxx> wrote:
Some user space applications are known to break with 48 bits virtual
known by whom? At least I wasn't aware of it, so could you please
share some examples?

Sure! Known to me so far are:

* mozjs17
* mozjs24
* mozjs38
* js-1.8.5
* java-1.7 (older JITs, fixed in newer ones)

I'm not sure if there are more, but the fact that I've run into this problem more than once doesn't make me incredibly happy :).

address space. As interim step until the world is healed and everyone
embraces correct code, this patch allows to only expose 47 bits of
virtual address space to user space.

Is this a code generation/toolchain issue?

mozjs uses a single 64bit value to combine doubles, ints and pointers into a single variable. It is very smart and uses the upper 17 bits for metadata such as "which type of variable is this". Coincidentally those bits happen to overlap the "double is an infinite number" bits, so that you can also express a NaN with it. When using such a value, the upper 17 bits get masked out.

That one was fixed upstream by force allocating the javascript heap starting at a fixed location which is below 47 bits.

js-1.8.5 has the same as above, but also uses pointers to .rodata as javascript pointers, so it doesn't only use the heap, it also uses pointers to the library itself, which gets mapped high up the address space. I don't have a solution for that one yet.

IcedTea for java-1.7 had a bug where it incorrectly caused an overflow when trying to calculating a relative adrp offset from <address high up> to <address really low>, so that the resulting pointer had the upper bits set as 1s. That one is long fixed upstream, we only ran into it because we used an ancient IcedTea snapshot.

My main concern however is with code that I do not know is broken today.