Skip to content

Conversation

@Achierius
Copy link
Contributor

@Achierius Achierius commented Oct 1, 2025

f3dd285

[libpas] Implement primary support for MTE
https://bugs.webkit.org/show_bug.cgi?id=299488
rdar://161273712

Reviewed by Daniel Liu.

As announced on September 9th, the SoCs used in the next generation of
iPhones will include support for ARM'S Memory Tagging Extension
functionality. As part of Apple's MIE (Memory Integrity Enforcement)
feature, libpas should thus implement support for MTE and related
memory-safety functionality to ensure that WebKit is up to par with the
new memory safety standards set by the rest of the system.

In particular, this patch ensures that when possible we allocate memory
with backing MTE tag pages and tag allocations made within them prior to
returning allocation memory to the caller. Not all memory can be tagged
this way: in particular, objects >= 32K and objects which may be
referenced via compact pointers cannot be MTE tagged. There are other
exceptions as well, depending on process/object-type/platform.
It also implements a variety of hardening strategies to further
strengthen the feature and prevent certain well-known kinds of attacks.

Trying this again, since the previous attempt caused build breakages
in certain configurations.

Canonical link: https://commits.webkit.org/300960@main

ec076f6

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows Apple Internal
❌ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win ✅ 🛠 ios-apple
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2 ❌ 🧪 win-tests ✅ 🛠 mac-apple
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe ✅ 🛠 vision-apple
✅ 🧪 webkitpy ✅ 🧪 ios-wk2-wpt ✅ 🧪 mac-wk1 ✅ 🛠 wpe-cairo
✅ 🛠 🧪 jsc ✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk
✅ 🛠 🧪 jsc-arm64 ✅ 🛠 vision ✅ 🧪 mac-AS-debug-wk2 ✅ 🧪 gtk-wk2
✅ 🛠 vision-sim ✅ 🧪 mac-wk2-stress ✅ 🧪 api-gtk
✅ 🛠 🧪 merge ✅ 🧪 vision-wk2 ✅ 🧪 mac-intel-wk2 ✅ 🛠 playstation
✅ 🛠 tv ✅ 🛠 mac-safer-cpp ❌ 🛠 jsc-armv7
✅ 🛠 tv-sim ❌ 🧪 jsc-armv7-tests
✅ 🛠 watch
✅ 🛠 watch-sim

@Achierius Achierius requested review from a team, JonWBedard and gsnedders as code owners October 1, 2025 18:23
@Achierius Achierius self-assigned this Oct 1, 2025
@Achierius Achierius added the New Bugs Unclassified bugs are placed in this component until the correct component can be determined. label Oct 1, 2025
@Achierius Achierius force-pushed the eng/incorporate-mte_3 branch from 12c8dce to f7641af Compare October 1, 2025 19:31
@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Oct 1, 2025
Copy link
Contributor

@danlliu danlliu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

r=me

@Achierius Achierius removed the merging-blocked Applied to prevent a change from being merged label Oct 3, 2025
@Achierius Achierius force-pushed the eng/incorporate-mte_3 branch from f7641af to ec076f6 Compare October 3, 2025 05:43
@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Oct 3, 2025
@Achierius Achierius added merge-queue Applied to send a pull request to merge-queue and removed merging-blocked Applied to prevent a change from being merged merge-queue Applied to send a pull request to merge-queue labels Oct 3, 2025
https://bugs.webkit.org/show_bug.cgi?id=299488
rdar://161273712

Reviewed by Daniel Liu.

As announced on September 9th, the SoCs used in the next generation of
iPhones will include support for ARM'S Memory Tagging Extension
functionality. As part of Apple's MIE (Memory Integrity Enforcement)
feature, libpas should thus implement support for MTE and related
memory-safety functionality to ensure that WebKit is up to par with the
new memory safety standards set by the rest of the system.

In particular, this patch ensures that when possible we allocate memory
with backing MTE tag pages and tag allocations made within them prior to
returning allocation memory to the caller. Not all memory can be tagged
this way: in particular, objects >= 32K and objects which may be
referenced via compact pointers cannot be MTE tagged. There are other
exceptions as well, depending on process/object-type/platform.
It also implements a variety of hardening strategies to further
strengthen the feature and prevent certain well-known kinds of attacks.

Trying this again, since the previous attempt caused build breakages
in certain configurations.

Canonical link: https://commits.webkit.org/300960@main
@webkit-commit-queue
Copy link
Collaborator

Committed 300960@main (f3dd285): https://commits.webkit.org/300960@main

Reviewed commits have been landed. Closing PR #51633 and removing active labels.

@webkit-commit-queue webkit-commit-queue merged commit f3dd285 into WebKit:main Oct 3, 2025
@webkit-commit-queue webkit-commit-queue removed the merge-queue Applied to send a pull request to merge-queue label Oct 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

New Bugs Unclassified bugs are placed in this component until the correct component can be determined.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants