Skip to content

LATX, fix: Preserve 16K permission checks with a cached fast path - #425

Open
ganjue66da wants to merge 8 commits into
lat-opensource:masterfrom
ganjue66da:codex/minke-16k-write-checks
Open

LATX, fix: Preserve 16K permission checks with a cached fast path#425
ganjue66da wants to merge 8 commits into
lat-opensource:masterfrom
ganjue66da:codex/minke-16k-write-checks

Conversation

@ganjue66da

@ganjue66da ganjue66da commented Aug 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary / 变更说明

Preserve the cached permission-check fast path needed by
Minke.MI.Organ.exe on 16K LoongArch hosts while enforcing guest 4K
permissions for instrumented accesses.

A readable/writable guest page can share a host page with a protected
guest page. The merged host mapping alone cannot enforce that boundary.
Global checks now cover reads as well as writes, and the 32-bit cached
path checks both the first and final guest page of each instrumented
access. A crossing fault reports the first inaccessible byte rather than
the access endpoint.

  • LATX_MT=1: consult exact guest-page flags when the host page has mixed
    permissions for the requested access type.
  • LATX_MT=2: always consult cached guest-page flags on the 32-bit 16K path.
  • LATX_MT=0: leave global instrumentation disabled. The existing explicit
    LATX_MINKE_16K_PAGE_CHECK option retains selective Minke write checks.
  • Both enabled policies retain cache lookups instead of interval-tree walks
    on the 32-bit 16K path.
  • Correct alignment accounting in push/pop fault-state recovery, exposed
    by the permission instrumentation's generated code.
  • Add an i386 regression that checks signal code, fault address, instruction
    pointer and stack pointer. The runner accepts a prebuilt fixture through
    LATX_16K_PERMISSION_FIXTURE; actual compilation failures are errors.

The series separates the original fast-path/application changes, read
permission restoration, policy selection, crossing checks, fault recovery,
fault address correction and test-runner correction into focused commits.

Validation / 验证

Final patched latx-i386 built on host 58 (16K LoongArch pages).
Binary SHA-256:
63b71760c2a771e56a94199832a213f5f09c6df8de4f29a90fc6bfac01b96a06.

  • Built the static i386 fixture on the x86 host with GCC; all six cases
    passed natively.
  • On 58, all six cases passed under each of LATX_MT=1 and LATX_MT=2:
    protected read, crossing vector write, protected write at a nonzero page
    offset, crossing read, valid access, and a fault after pushes.
  • Verified the stronger regression detects the previous incorrect crossing
    fault address. Earlier control runs with LATX_MT=0 allowed the protected
    read and crossing write to proceed.
  • Meson targeted integration test passed using the prebuilt fixture:
    1 passed, 0 failed, 0 skipped.
  • Existing mprotect-4k-test and
    lock-cmpxchg8b-on-page-no-write-unalign passed in both enabled modes.
  • Injected fixture compilation failure propagated status 42; an invalid
    prebuilt fixture failed with status 1.
  • Commit-message, author/DCO and whitespace checks passed.

Remaining validation: the final revision has not rerun the medical
application GUI/startup timing comparison or the full build matrix. A broad
test rebuild on 58 encountered pre-existing unused-variable/function errors
in tests/unit/test-x11-async-handler.c under -Werror; the translator was
built separately and the targeted integration test used --no-rebuild.
Earlier login-window and full-matrix results apply to the original PR
revision, not to this final revision.

Checklist / 检查项

  • I have read CONTRIBUTING.md.
  • Every commit contains a DCO sign-off matching its author.
  • Relevant build/test results and remaining validation are included.

@ganjue66da
LATX, opt: Accelerate 16K write permission checks
3a53a1e 
The LATX_MT compatibility path walks the page-flags interval tree for
every instrumented memory access.  That is too expensive for
applications which need exact guest 4K write checks on a 16K host.

Allocate compact byte tables for guest 4K writability and mixed host
16K pages only after LATX_MT is enabled.  Generated stores normally
need one table lookup and consult the exact 4K entry only for mixed host
pages.  Disabled configurations retain no large tables or CPU state
pointers and emit no additional guest memory checks.

Do not enable LATX_MT automatically.  Default translations remain
uninstrumented, while affected applications can opt in explicitly.

Tests:
- default and LATX_MT=1 atomic-lock-stress-test
- LATX_MT=1 Minke.MI.Organ.exe reached the rendered login window

Signed-off-by: Wenqiang Wei <weiwenqiang@mail.ustc.edu.cn>
@ganjue66da
LATX, fix: Check mixed 16K writes for Minke
2ee0fee 
Minke.MI.Organ.exe uses a fixed Wine helper and small generated code
mappings whose stores may cross guest 4K permission boundaries on a
16K host.  Without precise checks, a write can miss the fault needed to
create a shadow page and the application fails during startup.

Add the explicit LATX_MINKE_16K_PAGE_CHECK option.  On a 16K host it is
accepted only for Minke.MI.Organ.exe, allocates the application TB map,
and instruments the fixed helper page and small executable mappings
recorded by mmap and mprotect.  Other applications and disabled
configurations remain on the normal uninstrumented path.

This avoids the global LATX_MT cost while retaining the precise write
fault where the application requires it.

Tests:
- 16K host: selective checks reached the rendered login window with
  LATX_MT=0
- 4K host: default and explicit-option atomic-lock-stress-test

Signed-off-by: Wenqiang Wei <weiwenqiang@mail.ustc.edu.cn>
@ganjue66da
ganjue66da force-pushed the codex/minke-16k-write-checks branch from 9159bd7 to 2ee0fee Compare August 25, 2026 03:55
@ganjue66da
LATX, fix: Preserve guest read permissions on 16K hosts
fd869d2 
The global memory-check option skipped every read in the 32-bit 16K
path. A readable guest page could therefore expose a neighboring
PROT_NONE page through the merged host mapping.

Cache guest permission bits and record mixed permissions separately
for each access type. Check reads in global mode while retaining the
write-only scope of the Minke-specific instrumentation.

Signed-off-by: Wenqiang Wei <weiwenqiang@mail.ustc.edu.cn>
@ganjue66da
LATX, feat: Select sparse or strict cached permission checks
8379f70 
Define LATX_MT=1 as sparse mixed-page checks and LATX_MT=2 as direct
guest-page checks. Both policies use the permission cache on 16K
hosts. Restrict the option to the documented range and expose the
available policies in command-line help.

Signed-off-by: Wenqiang Wei <weiwenqiang@mail.ustc.edu.cn>
@ganjue66da
LATX, fix: Check the final guest page of memory accesses
753ed20 
Checking only the starting address misses accesses that cross from a
permitted guest 4K page into a protected page within one host mapping.

Pass access widths from scalar, vector and atomic memory emitters.
Check the final byte as well as the first before emitting the access
in the 32-bit 16K cached path. Add a focused i386 regression for mixed
read permissions and a vector write across a guest-page boundary.

Tests:
- Static i386 fixture built on x86 and run on the 16K LoongArch host:
  protected read and crossing write returned SIGSEGV in MT modes 1/2.

Signed-off-by: Wenqiang Wei <weiwenqiang@mail.ustc.edu.cn>
@ganjue66da
LATX, fix: Account for alignment during fault-state recovery
7c22528 
The push/pop recovery walk assumes a fixed alignment expansion.
Permission instrumentation uses four-instruction alignment, so the
walk can miscount host instructions and run past the regenerated IR2
list while delivering a guest fault.

Calculate padding from the alignment operand and current host offset,
including prior pseudo instructions and stack optimizations.

Signed-off-by: Wenqiang Wei <weiwenqiang@mail.ustc.edu.cn>
@ganjue66da
LATX, fix: Report the first inaccessible byte for crossing accesses
366490b 
The final-page permission check leaves the access endpoint in the
address used to report a guest fault. A 16-byte store starting four
bytes before a protected page reports that page plus eleven bytes.

Report the final guest page's start on that failure path. Retain the
original address when the initial-page check fails. Extend the i386
regression to check signal code, fault address, EIP and ESP, including
crossing reads, writes, a pushed stack and valid accesses.

Tests:
- Native i386 fixture on x86: all six cases passed.
- 16K LoongArch host: all six cases passed with LATX_MT=1 and =2.

Signed-off-by: Wenqiang Wei <weiwenqiang@mail.ustc.edu.cn>
@ganjue66da
LATX, fix: Distinguish missing fixture tools from build failures
88161b3 
Accept LATX_16K_PERMISSION_FIXTURE for an executable built on an x86
host. Otherwise check for clang and ld.lld before compilation, and
propagate compilation failures instead of converting them to skips.

Tests:
- 58: Meson permission regression passed with the prebuilt fixture;
  no tests skipped.
- Injected compiler failure propagated status 42.
- Invalid prebuilt fixture failed with status 1.

Signed-off-by: Wenqiang Wei <weiwenqiang@mail.ustc.edu.cn>
@ganjue66da ganjue66da changed the title LATX, fix: Handle mixed 16K writes for Minke LATX, fix: Preserve 16K permission checks with a cached fast path Sep 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ganjue66da