re-enable JIT for ZTS builds on Apple Silicon

[realFlowControl]

Fixes #13400

For __APPLE__ && __aarch64__ && ZTS, this PR moves the JIT buffer out of the OPcache shared memory and creates a dedicated mapping.

Background

OPcache JIT is currently disabled for ZTS builds on Apple Silicon. The JIT buffer normally lives at the end of OPcache's MAP_SHARED | MAP_ANON allocation. In ZTS, one thread may generate code while another executes existing code, so the buffer must remain executable while it is writable.

Apple Silicon rejects RWX anonymous mappings with EPERM. Apple's supported solution is MAP_JIT with pthread_jit_write_protect_np(), which provides per-thread write protection, but macOS rejects MAP_JIT | MAP_SHARED with EINVAL. The existing combined OPcache/JIT mapping won't work on Apple Silicon.

[henderkes]

I don't know if this was in response to my mail, but thank you 😄

[realFlowControl]

I don't know if this was in response to my mail, but thank you 😄

Actually yes, haha. I knew that this should work, I just was not working on it and then reading your mail reminded me of it 👍

[arnaud-lb]

Could you clarify if MAP_JIT can be used freely without an com.apple.security.cs.allow-jit entitlement?

[bwoebi]

The com.apple.security.cs.allow-jit entitlement is required only when an app adopts the Hardened Runtime capability.

As per https://developer.apple.com/documentation/apple-silicon/porting-just-in-time-compilers-to-apple-silicon.

i.e. it's not relevant to non-app store executables.

[arnaud-lb]

Would it be feasible to unify all __APPLE__ code variations?

[realFlowControl]

Technically the split could be done for all macOS builds, but the protection path cannot be unified. pthread_jit_write_protect_supported_np() is supported on Apple Silicon but returns false on Intel, where the existing shared RWX transition works.

[arnaud-lb]

This makes sense. Can we merge the ZEND_JIT_USE_APPLE_MAP_JIT and HAVE_PTHREAD_JIT_WRITE_PROTECT_NP variations?

[realFlowControl]

Nice finding, I cleaned it up in 8f51da2 . I also change the config.m4 to fail on invalid combinations. I think it makes more sense to explicitly fail compared to implicitly just disable JIT.

[arnaud-lb]

Thank you for the changes. There are also cases where we call pthread_jit_write_protect_np() outside of ZEND_JIT_USE_APPLE_MAP_JIT, but that's probably not reachable?

php-src/ext/opcache/jit/zend_jit.c

Lines 3528 to 3536 in 8f51da2

	#ifdef ZEND_JIT_USE_APPLE_MAP_JIT
	pthread_jit_write_protect_np(0);
	#elif defined(HAVE_MPROTECT)
	if (!(JIT_G(debug) & (ZEND_JIT_DEBUG_GDB|ZEND_JIT_DEBUG_PERF_DUMP))) {
	int opts = PROT_READ | PROT_WRITE;
	# ifdef ZTS
	# ifdef HAVE_PTHREAD_JIT_WRITE_PROTECT_NP
	if (zend_write_protect) {
	pthread_jit_write_protect_np(0);