<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<base href="x-msg://3481/"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I just put the first incremental patch up for internal review now and hope to have it committed later today. Another patch or two will follow shortly afterward
to get things in the state we talked about at the hacker session.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">If you want to start talking about the specifics of the more advanced features Ashok has implemented, like memory pool support and pre-reserving memory we can
do that now, but if you prefer to wait until the basic implementation is in place that’s OK too.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">-Andy<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Jim Grosbach [mailto:grosbach@apple.com]
<br>
<b>Sent:</b> Wednesday, November 14, 2012 11:22 AM<br>
<b>To:</b> Thirumurthi, Ashok; Kaylor, Andrew<br>
<b>Cc:</b> Eric Christopher; llvm-commits@cs.uiuc.edu<br>
<b>Subject:</b> Re: [llvm-commits] [PATCH for REVIEW] Secure Memory Manager for MCJIT and RuntimeDyld.<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi Ashok,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">My understanding from the hacker session at the dev conference is that everyone is generally on board with this direction and it's mainly a matter of splitting up the patch a bit to help foster discussion about the different parts of it.
Wanted to go ahead and respond to this email, though, and make sure that matches everyone else's take on things, too. Sound right to you guys?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">-Jim<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Nov 7, 2012, at 7:02 PM, "Thirumurthi, Ashok" <<a href="mailto:ashok.thirumurthi@intel.com">ashok.thirumurthi@intel.com</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Well, there are a few ways to interpret your question. This patch makes SecureMemoryManager the default in lli, and I should probably follow suit in rt-dyld.
For MCJIT, there is no default. That forces users to pick a memory manager and think about whether security is worth the premium. For instance, lldb expression evaluation is a case where security might not figure over speed.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">MCJIT could also have a secure default if a memory manager wasn’t supplied:</span><o:p></o:p></p>
</div>
<div style="margin-left:.5in">
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas">ExecutionEngine *MCJIT::createJIT(Module *M,</span><o:p></o:p></p>
</div>
<div style="margin-left:.5in">
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas"> std::string *ErrorStr,</span><o:p></o:p></p>
</div>
<div style="margin-left:.5in">
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas"> JITMemoryManager *JMM,</span><o:p></o:p></p>
</div>
<div style="margin-left:.5in">
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas"> <span class="apple-converted-space"> </span><span style="color:blue">bool</span><span class="apple-converted-space"> </span>GVsWithCode,</span><o:p></o:p></p>
</div>
<div style="margin-left:.5in">
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas"> TargetMachine *TM) {</span><o:p></o:p></p>
</div>
<div style="margin-left:.5in">
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas"> sys::DynamicLibrary::LoadLibraryPermanently(0, NULL);</span><o:p></o:p></p>
</div>
<div style="margin-left:.5in">
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas"> </span><o:p></o:p></p>
</div>
<div style="margin-left:.5in">
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas"> <span class="apple-converted-space"> </span><span style="color:blue">return</span><span class="apple-converted-space"> </span><span style="color:blue">new</span><span class="apple-converted-space"> </span>MCJIT(M,
TM, JMM, GVsWithCode);</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas">-></span><o:p></o:p></p>
</div>
<div style="margin-left:.5in">
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas"> <span class="apple-converted-space"> </span><span style="color:blue">return</span><span class="apple-converted-space"> </span><span style="color:blue">new</span><span class="apple-converted-space"> </span>MCJIT(M,
TM, JMM ? JMM : CreateDefaultMemManager(), GVsWithCode);</span><o:p></o:p></p>
</div>
<div style="margin-left:.5in">
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas">}</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:Consolas"> </span><o:p></o:p></p>
</div>
<div style="margin-left:.5in">
<p class="MsoNormal" style="text-indent:-.25in"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">-</span><span style="font-size:7.0pt;color:#1F497D"> <span class="apple-converted-space"> </span></span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Ashok</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> </span><o:p></o:p></p>
</div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<div>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span class="apple-converted-space"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> </span></span><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Eric
Christopher [<a href="mailto:echristo@gmail.com"><span style="color:purple">mailto:echristo@gmail.com</span></a>]<span class="apple-converted-space"> </span><br>
<b>Sent:</b><span class="apple-converted-space"> </span>Tuesday, November 06, 2012 6:53 PM<br>
<b>To:</b><span class="apple-converted-space"> </span>Thirumurthi, Ashok<br>
<b>Cc:</b><span class="apple-converted-space"> </span><a href="mailto:llvm-commits@cs.uiuc.edu"><span style="color:purple">llvm-commits@cs.uiuc.edu</span></a>; Jim Grosbach<br>
<b>Subject:</b><span class="apple-converted-space"> </span>Re: [llvm-commits] [PATCH for REVIEW] Secure Memory Manager for MCJIT and RuntimeDyld.</span><o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">I haven't looked at the whole thing yet, but any reason not to make this the default (other than it's slightly more complicated)?<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal">-eric<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Nov 6, 2012 at 8:01 AM, Thirumurthi, Ashok <<a href="mailto:ashok.thirumurthi@intel.com" target="_blank"><span style="color:purple">ashok.thirumurthi@intel.com</span></a>> wrote:<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="color:#1F497D">Currently, RuntimeDyld clients (like MCJIT) cannot restrict the memory protection flags for sections that are read-only, RW or RX. Instead, all sections are loaded into RWX memory. This patch improves the interface
of RTDyldMemoryManager to allow sections to be allocated as RW and later protected as R, RW or RX. In addition, as RuntimeDyld clients may have multiple Modules to load, the interface includes a memory pool ID to pool allocations. This permits RuntimeDyld
clients to free a memory pool without impacting other loads. Finally, as RuntimeDyld loads a full Module, the RWX attributes of all sections are known prior to the first allocation. As a result, the interface includes the facility to log requests for memory.
The goal is to minimize the number of mmap/mprotect calls that must be made to load a Module, while also ensuring that no full page of memory is wasted.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1F497D">As RTDyldMemoryManager is a base class of JITMemoryManager, this patch touches all of the memory managers in the llvm code base.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1F497D">In addition, this patch provides two reference memory managers which can be committed separately. The first, a slightly modified version of SectionMemoryManager, is a trivial memory manager that happily ignores
the call to protectPool. This was previously ripped from lli.cpp and committed with tests in unittests/ExecutionEngine/MCJIT. This memory manager is useful for clients that are more interested in efficiency than security.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1F497D">MCJIT and JIT engines allow the client to specify a JITMemoryManager. Although this unifies the interface between execution engines, MCJIT clients use the methods in the base class RTDyldMemoryManager. SectionMemoryManager
also provides a convenient implementation of pure virtual methods in JITMemoryManager. In particular, SectionMemoryManager is now used by rt-dyld.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1F497D">Alternately, the SecureMemoryManager is a reference memory manager with an implementation of protectPool. This memory manager derives from SectionMemoryManager and provides a single class with functionality
of interest to MCJIT and RuntimeDyld clients. Specifically, requests with the same combination of RWX flags are satisfied by the same allocation. In addition, allocations can be grouped using a pool ID. The patch includes unit tests for all of this functionality.
In addition, this patch modifies lli to use the SecureMemoryManager.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1F497D">Looking forwards, options can be provided for lli and rt-dyld to choose between secure, fast, and remote memory managers. In addition, options can be provided for MCJIT to determine if protectPool will be called.
Finally, MCJIT can be reworked to support multiple Modules.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1F497D">While the patch is large, it has been provided for completeness to support reviews at the hackers workshop at llvm-dev. Reviewers on the list can restrict their comments to the interface or the implementation
as these can easily be performed in two separate commits. Thanks!</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
</div>
<p><span style="color:#1F497D">-</span><span style="font-size:7.0pt;color:#1F497D"> <span class="apple-converted-space"> </span></span><span style="color:#1F497D">Ashok Thirumurthi</span><o:p></o:p></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
llvm-commits mailing list<br>
<a href="mailto:llvm-commits@cs.uiuc.edu"><span style="color:purple">llvm-commits@cs.uiuc.edu</span></a><br>
<a href="http://lists.cs.uiuc.edu/mailman/listinfo/llvm-commits" target="_blank"><span style="color:purple">http://lists.cs.uiuc.edu/mailman/listinfo/llvm-commits</span></a><o:p></o:p></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>