linux-kernel - Re: annotating jump tables (Re: [PATCH v2 5/5] LoongArch: Enable jump table with GCC for objtool)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20241128005653.st7xwkv2gry2chlc@jpoimboe>
Date: Wed, 27 Nov 2024 16:56:53 -0800
From: Josh Poimboeuf <jpoimboe@...hat.com>
To: Ard Biesheuvel <ardb@...nel.org>
Cc: Nick Desaulniers <ndesaulniers@...gle.com>,
	Tiezhu Yang <yangtiezhu@...ngson.cn>,
	Xi Ruoyao <xry111@...111.site>,
	Peter Zijlstra <peterz@...radead.org>,
	Huacai Chen <chenhuacai@...nel.org>, loongarch@...ts.linux.dev,
	linux-kernel@...r.kernel.org, linux-toolchains@...r.kernel.org,
	Jan Beulich <jbeulich@...e.com>,
	"Jose E. Marchesi" <jemarch@....org>, Kees Cook <kees@...nel.org>
Subject: Re: annotating jump tables (Re: [PATCH v2 5/5] LoongArch: Enable
 jump table with GCC for objtool)

On Thu, Nov 14, 2024 at 07:13:18PM +0100, Ard Biesheuvel wrote:
> > Looks like this was added to clang in:
> > https://github.com/llvm/llvm-project/pull/102411
> >
> > A comment in llvm/lib/Target/LoongArch/LoongArchAsmPrinter.cpp
> > describes the scheme:
> > +  // Emit an additional section to store the correlation info as pairs of
> > +  // addresses, each pair contains the address of a jump instruction (jr) and
> > +  // the address of the jump table.
> >
> > Ard had a prototype in:
> > https://github.com/llvm/llvm-project/pull/112606
> > which used relocations rather than a discardable section.
> 
> Thanks for the cc.
> 
> I haven't followed up yet because doing this generically is not
> straight-forward. The main issue is that AArch64 jump tables could be
> emitted into .text with scaled offsets, e.g.,
> 
> adr  x16, .Ljumptable
> ldrb w17, [x16, xN] // xN is the lookup index
> add  x16, x16, w17, sxtw #2  // x16 += 4 * x17
> br   x16
> 
> .Ljumptable:
> .byte (dest0 - .Ljumptable) >> 2
> .byte (dest1 - .Ljumptable) >> 2
> .byte (dest2 - .Ljumptable) >> 2
> .byte (dest3 - .Ljumptable) >> 2
> 
> So just emitting a relocation at the call site and a symbol covering
> the jump table might work for x86, but if we want some that works in
> general, we'll have to come up with some format that describes in more
> detail how to infer the potential destinations of an indirect call it
> is known to be a limited set at compile time.

Loongarch is emitting an array of (insn_ptr, jump_table_ptr) tuples
in .discard.tablejump_annotate.  Would that work more generically?

Even better it would also emit the jump table size.

-- 
Josh