Respect page allocator hints on Fuchsia

The virtual memory cage supports a fallback mode that attempts to obtain
memory pages within a specific virtual address range by using
PageAllocator hints. However, Prior to this CL, the default
PageAllocator on Fuchsia would ignore hints alltogether, preventing
these mechanisms from working there.

Ultimately, on Fuchsia it would probably be better to manage the virtual
memory cage purely through VMARs instead of actually creating pseudo
mappings just to reserve virtual address space as is currently done
through the PageAllocator. This will require broader changes though, so
in the meantime, sticking to the current PageAllocator API is probably
the best option.

Bug: chromium:1218005
Change-Id: I821cfbb815d81479c3b3310296302addbb9cd8f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3220340Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77398}

src/base/platform/platform-fuchsia.cc

@@ -17,7 +17,7 @@ namespace base {
 
 namespace {
 
-uint32_t GetProtectionFromMemoryPermission(OS::MemoryPermission access) {
+zx_vm_option_t GetProtectionFromMemoryPermission(OS::MemoryPermission access) {
   switch (access) {
     case OS::MemoryPermission::kNoAccess:
     case OS::MemoryPermission::kNoAccessWillJitLater:
@@ -66,10 +66,24 @@ void* OS::Allocate(void* address, size_t size, size_t alignment,
     return nullptr;
   }
 
+  zx_vm_option_t options = GetProtectionFromMemoryPermission(access);
+
+  uint64_t vmar_offset = 0;
+  if (address) {
+    vmar_offset = reinterpret_cast<uint64_t>(address);
+    options |= ZX_VM_SPECIFIC;
+  }
+
   zx_vaddr_t reservation;
-  uint32_t prot = GetProtectionFromMemoryPermission(access);
-  if (zx::vmar::root_self()->map(prot, 0, vmo, 0, request_size, &reservation) !=
-      ZX_OK) {
+  zx_status_t status = zx::vmar::root_self()->map(options, vmar_offset, vmo, 0,
+                                                  request_size, &reservation);
+  if (status != ZX_OK && address != nullptr) {
+    // Retry without the hint, if we supplied one.
+    options &= ~(ZX_VM_SPECIFIC);
+    status = zx::vmar::root_self()->map(options, 0, vmo, 0, request_size,
+                                        &reservation);
+  }
+  if (status != ZX_OK) {
     return nullptr;
   }
 

test/unittests/security/virtual-memory-cage-unittest.cc

@@ -128,10 +128,6 @@ TEST(VirtualMemoryCageTest, PageAllocation) {
   cage.TearDown();
 }
 
-// This test doesn't yet work on Fuchsia as the PageAllocator does not respect
-// hints there, but the fake cage's page allocator relies on them.
-// TODO(saelo) enable this test once the PageAllocator respects hints.
-#if !V8_OS_FUCHSIA
 TEST(VirtualMemoryCageTest, FakeCagePageAllocation) {
   base::PageAllocator page_allocator;
   V8VirtualMemoryCage cage;
@@ -145,7 +141,6 @@ TEST(VirtualMemoryCageTest, FakeCagePageAllocation) {
 
   cage.TearDown();
 }
-#endif  // !V8_OS_FUCHSIA
 
 }  // namespace internal
 }  // namespace v8