RFR: 8234930: Use MAP_JIT when allocating pages for code cache on macOS [v2]

[Thomas Stuefe]

On Tue, 6 Oct 2020 13:40:22 GMT, Anton Kozlov <akozlov at openjdk.org> wrote:

>> Please review an updated RFR from https://mail.openjdk.java.net/pipermail/hotspot-runtime-dev/2020-August/041463.html
>> 
>> On macOS, MAP_JIT cannot be used with MAP_FIXED[1]. So pd_reserve_memory have to provide MAP_JIT for mmap(NULL,
>> PROT_NONE), the function was made aware of exec permissions.
>> For executable and data regions, pd_commit_memory only unlocks the memory with mprotect, this should make no difference
>> compared with old code.
>> For data regions, pd_uncommit_memory still uses a new overlapping anonymous mmap which returns pages to the OS and
>> immediately reflects this in diagnostic tools like ps.  For executable regions it would require MAP_FIXED|MAP_JIT, so
>> instead madvise(MADV_FREE)+mprotect(PROT_NONE) are used. They should also allow OS to reclaim pages, but apparently
>> this does not happen immediately. In practice, it should not be a problem for executable regions, as codecache does not
>> shrink (if I haven't missed anything, by the implementation and in principle).  Tested:
>> * local tier1
>> * jdk-submit
>> * codesign[2] with hardened runtime and allow-jit but without
>> allow-unsigned-executable-memory entitlements[3] produce a working bundle.
>> 
>> (adding GC group as suggested by @dholmes-ora)
>> 
>> 
>> [1] https://github.com/apple/darwin-xnu/blob/master/bsd/kern/kern_mman.c#L227
>> [2]
>>  
>>   codesign \
>>     --sign - \
>>     --options runtime \
>>     --entitlements ents.plist \
>>     --timestamp \
>>     $J/bin/* $J/lib/server/*.dylib $J/lib/*.dylib
>> [3]
>>   <?xml version="1.0" encoding="UTF-8"?>
>>   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
>>   <plist version="1.0">
>>     <dict>
>>       <key>com.apple.security.cs.allow-jit</key>
>>       <true/>
>>       <key>com.apple.security.cs.disable-library-validation</key>
>>       <true/>
>>       <key>com.apple.security.cs.allow-dyld-environment-variables</key>
>>       <true/>
>>     </dict>
>>   </plist>
>
> Anton Kozlov has updated the pull request with a new target base due to a merge or a rebase. The pull request now
> contains four commits:
>  - Minimal working example, no uncommit
>  - Merge remote-tracking branch 'upstream/master' into 8234930
>  - Revert "Use MAP_JIT for CodeCache pages"
>    
>    This reverts commit 114d9cffd62cab42790b65091648fe75345c4533.
>  - Use MAP_JIT for CodeCache pages

src/hotspot/os/bsd/os_bsd.cpp line 2010:

> 2008:   return ::mprotect(addr, size, PROT_NONE) == 0;
> 2009: #elif defined(__APPLE__)
> 2010:   if (false) {

I'm confused, how would this work?

-------------

PR: https://git.openjdk.java.net/jdk/pull/294