lkml.org 
[lkml]   [2021]   [Nov]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] static_call,x86: Robustify trampoline patching
    On Tue, Nov 02, 2021 at 07:18:53PM +0100, Ard Biesheuvel wrote:

    > > The range check isn't fundamental to CFI, having a check is the
    > > important thing AFAIU.
    >
    > Agreed. If the call site has a direct branch, it doesn't need the range check.

    That, from the earlier email:

    | And have the actual indirect callsite look like:
    |
    | # r11 - &foo
    | ALTERNATIVE_2 "cs call __x86_indirect_thunk_r11",
    | "cs call __x86_indirect_cfi_deadbeef", X86_FEATURE_CFI
    | "cs call __x86_indirect_ibt_deadbeef", X86_FEATURE_IBT

    So the callsite has a direct call to the hash-specific and cfi-type
    specific thunk, which then does an (indirect) tail-call.

    The CFI one does the hash check in the thunk and jumps to the function
    proper, the IBT one on does it in the landing-pad.

    The !CFI one ignore it all and simply does an indirect call (retpoline
    aided or otherwise) to the function proper -- in which case we can free
    all the thunks.

    \
     
     \ /
      Last update: 2021-11-02 22:49    [W:4.031 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site