diff options
| author | Igor Zamyatin <igor.zamyatin@intel.com> | 2015-07-09 06:50:12 -0700 |
|---|---|---|
| committer | H.J. Lu <hjl.tools@gmail.com> | 2015-07-09 06:50:12 -0700 |
| commit | 14c5cbabc2d11004ab223ae5eae761ddf83ef99e (patch) | |
| tree | ee8516f9bb7f2e9435d05641dfa415e795f7b65e /sysdeps/x86_64 | |
| parent | 632b3db8e2ba1f454872f7ebe1335966f8161c43 (diff) | |
| download | glibc-14c5cbabc2d11004ab223ae5eae761ddf83ef99e.tar.gz glibc-14c5cbabc2d11004ab223ae5eae761ddf83ef99e.tar.xz glibc-14c5cbabc2d11004ab223ae5eae761ddf83ef99e.zip | |
Preserve bound registers for pointer pass/return
We need to save/restore bound registers and add a BND prefix before branches in _dl_runtime_profile so that bound registers for pointer pass and return are preserved when LD_AUDIT is used. [BZ #18134] * sysdeps/i386/configure.ac: Set HAVE_MPX_SUPPORT. * sysdeps/i386/configure: Regenerated. * sysdeps/i386/dl-trampoline.S (PRESERVE_BND_REGS_PREFIX): New. (_dl_runtime_profile): Save and restore Intel MPX return bound registers when calling _dl_call_pltexit. Add PRESERVE_BND_REGS_PREFIX before return. * sysdeps/i386/link-defines.sym (LRV_BND0_OFFSET): New. (LRV_BND1_OFFSET): Likewise. * sysdeps/x86/bits/link.h (La_i86_retval): Add lrv_bnd0 and lrv_bnd1. * sysdeps/x86_64/dl-trampoline.S (_dl_runtime_profile): Fix typo in bndmov encoding. * sysdeps/x86_64/dl-trampoline.h: Properly save and restore Intel MPX bound registers. Add PRESERVE_BND_REGS_PREFIX before branch instructions to preserve bounds.
Diffstat (limited to 'sysdeps/x86_64')
| -rw-r--r-- | sysdeps/x86_64/dl-trampoline.S | 4 | ||||
| -rw-r--r-- | sysdeps/x86_64/dl-trampoline.h | 41 |
2 files changed, 25 insertions, 20 deletions
diff --git a/sysdeps/x86_64/dl-trampoline.S b/sysdeps/x86_64/dl-trampoline.S index 5f9b35dc3f..b151d3566d 100644 --- a/sysdeps/x86_64/dl-trampoline.S +++ b/sysdeps/x86_64/dl-trampoline.S @@ -206,8 +206,8 @@ _dl_runtime_profile: # else .byte 0x66,0x0f,0x1b,0x84,0x24;.long (LR_BND_OFFSET) .byte 0x66,0x0f,0x1b,0x8c,0x24;.long (LR_BND_OFFSET + BND_SIZE) - .byte 0x66,0x0f,0x1b,0x84,0x24;.long (LR_BND_OFFSET + BND_SIZE*2) - .byte 0x66,0x0f,0x1b,0x8c,0x24;.long (LR_BND_OFFSET + BND_SIZE*3) + .byte 0x66,0x0f,0x1b,0x94,0x24;.long (LR_BND_OFFSET + BND_SIZE*2) + .byte 0x66,0x0f,0x1b,0x9c,0x24;.long (LR_BND_OFFSET + BND_SIZE*3) # endif # endif diff --git a/sysdeps/x86_64/dl-trampoline.h b/sysdeps/x86_64/dl-trampoline.h index 0e5a6fb611..d542428ac2 100644 --- a/sysdeps/x86_64/dl-trampoline.h +++ b/sysdeps/x86_64/dl-trampoline.h @@ -63,20 +63,6 @@ movaps (LR_XMM_OFFSET + XMM_SIZE*6)(%rsp), %xmm6 movaps (LR_XMM_OFFSET + XMM_SIZE*7)(%rsp), %xmm7 -#ifndef __ILP32__ -# ifdef HAVE_MPX_SUPPORT - bndmov (LR_BND_OFFSET)(%rsp), %bnd0 # Restore bound - bndmov (LR_BND_OFFSET + BND_SIZE)(%rsp), %bnd1 # registers. - bndmov (LR_BND_OFFSET + BND_SIZE*2)(%rsp), %bnd2 - bndmov (LR_BND_OFFSET + BND_SIZE*3)(%rsp), %bnd3 -# else - .byte 0x66,0x0f,0x1a,0x84,0x24;.long (LR_BND_OFFSET) - .byte 0x66,0x0f,0x1a,0x8c,0x24;.long (LR_BND_OFFSET + BND_SIZE) - .byte 0x66,0x0f,0x1a,0x94,0x24;.long (LR_BND_OFFSET + BND_SIZE*2) - .byte 0x66,0x0f,0x1a,0x9c,0x24;.long (LR_BND_OFFSET + BND_SIZE*3) -# endif -#endif - #ifdef RESTORE_AVX /* Check if any xmm0-xmm7 registers are changed by audit module. */ @@ -154,8 +140,24 @@ 1: #endif + +#ifndef __ILP32__ +# ifdef HAVE_MPX_SUPPORT + bndmov (LR_BND_OFFSET)(%rsp), %bnd0 # Restore bound + bndmov (LR_BND_OFFSET + BND_SIZE)(%rsp), %bnd1 # registers. + bndmov (LR_BND_OFFSET + BND_SIZE*2)(%rsp), %bnd2 + bndmov (LR_BND_OFFSET + BND_SIZE*3)(%rsp), %bnd3 +# else + .byte 0x66,0x0f,0x1a,0x84,0x24;.long (LR_BND_OFFSET) + .byte 0x66,0x0f,0x1a,0x8c,0x24;.long (LR_BND_OFFSET + BND_SIZE) + .byte 0x66,0x0f,0x1a,0x94,0x24;.long (LR_BND_OFFSET + BND_SIZE*2) + .byte 0x66,0x0f,0x1a,0x9c,0x24;.long (LR_BND_OFFSET + BND_SIZE*3) +# endif +#endif + mov 16(%rbx), %R10_LP # Anything in framesize? test %R10_LP, %R10_LP + PRESERVE_BND_REGS_PREFIX jns 3f /* There's nothing in the frame size, so there @@ -174,6 +176,7 @@ addq $48, %rsp # Adjust the stack to the return value # (eats the reloc index and link_map) cfi_adjust_cfa_offset(-48) + PRESERVE_BND_REGS_PREFIX jmp *%r11 # Jump to function address. 3: @@ -200,6 +203,7 @@ movq 32(%rdi), %rsi movq 40(%rdi), %rdi + PRESERVE_BND_REGS_PREFIX call *%r11 mov 24(%rbx), %rsp # Drop the copied stack content @@ -280,11 +284,11 @@ #ifndef __ILP32__ # ifdef HAVE_MPX_SUPPORT - bndmov LRV_BND0_OFFSET(%rcx), %bnd0 # Restore bound registers. - bndmov LRV_BND1_OFFSET(%rcx), %bnd1 + bndmov LRV_BND0_OFFSET(%rsp), %bnd0 # Restore bound registers. + bndmov LRV_BND1_OFFSET(%rsp), %bnd1 # else - .byte 0x66,0x0f,0x1a,0x81;.long (LRV_BND0_OFFSET) - .byte 0x66,0x0f,0x1a,0x89;.long (LRV_BND1_OFFSET) + .byte 0x66,0x0f,0x1a,0x84,0x24;.long (LRV_BND0_OFFSET) + .byte 0x66,0x0f,0x1a,0x8c,0x24;.long (LRV_BND1_OFFSET) # endif #endif @@ -299,6 +303,7 @@ addq $48, %rsp # Adjust the stack to the return value # (eats the reloc index and link_map) cfi_adjust_cfa_offset(-48) + PRESERVE_BND_REGS_PREFIX retq #ifdef MORE_CODE |