lkml.org 
[lkml]   [2022]   [May]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRE: [RFC PATCH v2 20/21] x86: Add support for CONFIG_CFI_CLANG
Date
From: Sami Tolvanen
> Sent: 13 May 2022 21:22
>
> With CONFIG_CFI_CLANG, the compiler injects a type preamble
> immediately before each function and a check to validate the target
> function type before indirect calls:
>
> ; type preamble
> __cfi_function:
> int3
> int3
> mov <id>, %eax

Interesting - since this code can't be executed there is no
point adding an instruction 'prefix' to the 32bit constant.

> int3
> int3
> function:
> ...
> ; indirect call check
> cmpl    <id>, -6(%r11)
> je .Ltmp1
> ud2
> .Ltmp1:
> call __x86_indirect_thunk_r11
>
> Define the __CFI_TYPE helper macro for manual type annotations in
> assembly code, add error handling for the CFI ud2 traps, and allow
> CONFIG_CFI_CLANG to be selected on x86_64.
>
...
> +
> + /*
> + * The compiler generates the following instruction sequence
> + * for indirect call checks:
> + *
> + *   cmpl    <id>, -6(%reg) ; 7 bytes

If the <id> is between -128 and 127 then an 8bit constant
(sign extended) might be used.
Possibly the compiler forces the assembler to generate the
long form.

There could also be a REX prefix.
That will break any code that tries to use %reg.

> + * je .Ltmp1 ; 2 bytes
> + * ud2 ; <- addr
> + * .Ltmp1:
> + *
> + * Both the type and the target address can be decoded from the
> + * cmpl instruction.
> + */
> + if (copy_from_kernel_nofault(buffer, (void *)regs->ip - 9, MAX_INSN_SIZE))
> + return;
> + if (insn_decode_kernel(&insn, buffer))
> + return;
> + if (insn.opcode.value != 0x81 || X86_MODRM_REG(insn.modrm.value) != 7)
> + return;

Since you are looking for a very specific opcode why bother
calling insn_decode_kernel() - just check for the required (masked)
byte values.

> +
> + *type = insn.immediate.value;
> +
> + offset = insn_get_modrm_rm_off(&insn, regs);

Given the expected instruction, isn't that -6 ??
> + if (offset < 0)
> + return;
> +
> + *target = *(unsigned long *)((void *)regs + offset);

WTF is that calculating??

> +}
...

David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
\
 
 \ /
  Last update: 2022-05-16 10:33    [W:0.311 / U:0.068 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site