public inbox for libc-alpha@sourceware.org
 help / color / mirror / Atom feed
From: Boshi Wang <wangboshi@huawei.com>
To: Andrew Pinski <pinskia@gmail.com>
Cc: <libc-alpha@sourceware.org>, Szabolcs Nagy <szabolcs.nagy@arm.com>
Subject: Re: [RFC][PATCH] AArch64: use movz/movk instead of literal pools in start.S
Date: Tue, 12 Sep 2017 08:54:00 -0000	[thread overview]
Message-ID: <68118bc5-fd76-1fd1-b6cf-e9d2c82e8537@huawei.com> (raw)
In-Reply-To: <CA+=Sn1n7edmzjTSDatyY1tfi3Lz70m3XjeXfgKbgDt_GCZE2NQ@mail.gmail.com>

On 2017/9/11 17:09, Andrew Pinski wrote:
> On Thu, Sep 7, 2017 at 12:33 AM, wangboshi <wangboshi@huawei.com> wrote:
>> eXecute-Only Memory (XOM) is a protection mechanism against some ROP
>> attacks. XOM sets the code as executable and unreadable, so the access to
>> any data, like literal pools, in the code section causes the fault with XOM.
>> The compiler can disable literal pools for C source files, but not for
>> assembly files, so I use movz/movk instead of literal pools in start.S for
>> XOM.
>>
>> I add MOVL macro with movz/movk instructions like movl pseudo-instruction in
>> armasm, and use the macro instead of literal pools.
> I have a few comments about the overall design:
> I don't know if this is a good idea, can the kernel override XOM anyways?
> That is if you do write(N, &main, 1024);
> That will write the main function out to the file?
Thank you for your comments. They alert me.
Kernels for different architectures own different behaviors because XOM depends on different hardware features in different architectures. All of kernels don't check the buffer directly. In x64 with mpk, the hardware will stop read operation from the buffer because of XOM, but the write only returns a failure and the program still runs. The current kernel for AArch64 overrides XOM. The example works in AArch64, and doesn't work in X64.
Your example shows the weakness, but I think that it's not easy to exploit that with some existing protection mechanisms, like W^X and ASLR, and itself of XOM. So XOM is still valuable. Of course, I will try to fix the problem.
Thank you.
>
> I have one comment about the implementation too.
>
>>
>> 2017-09-07  Wang Boshi  <wangboshi@huawei.com>
>>
>>      * sysdeps/aarch64/start.S: Use MOVL instead of literal pools.
>>      * sysdeps/aarch64/sysdep.h (MOVL): Add MOVL macro.
>>
>> diff --git a/sysdeps/aarch64/start.S b/sysdeps/aarch64/start.S
>> index df1c642..51e8e82 100644
>> --- a/sysdeps/aarch64/start.S
>> +++ b/sysdeps/aarch64/start.S
>> @@ -71,9 +71,9 @@ _start:
>>       ldr     PTR_REG (4), [x4, #:got_lo12:__libc_csu_fini]
>>   #else
>>       /* Set up the other arguments in registers */
>> -    ldr    PTR_REG (0), =main
>> -    ldr    PTR_REG (3), =__libc_csu_init
>> -    ldr    PTR_REG (4), =__libc_csu_fini
>> +    MOVL(0, main)
>> +    MOVL(3, __libc_csu_init)
>> +    MOVL(4, __libc_csu_fini)
>>   #endif
>>
>>       /* __libc_start_main (main, argc, argv, init, fini, rtld_fini,
>> diff --git a/sysdeps/aarch64/sysdep.h b/sysdeps/aarch64/sysdep.h
>> index a749a70..0a11b57 100644
>> --- a/sysdeps/aarch64/sysdep.h
>> +++ b/sysdeps/aarch64/sysdep.h
>> @@ -137,6 +137,20 @@
>>       ldr    PTR_REG (T), [x##T, #:got_lo12:EXPR];    \
>>       OP    PTR_REG (R), [x##T];
>>
>> +/* Load an immediate into R.
>> +   Note R is a register number and not a register name. */
>> +#ifdef __LP64__
>> +# define MOVL(n, name)                    \
>> +    movz    PTR_REG(n), #:abs_g3:name;        \
>> +    movk    PTR_REG(n), #:abs_g2_nc:name;        \
>> +    movk    PTR_REG(n), #:abs_g1_nc:name;        \
>> +    movk    PTR_REG(n), #:abs_g0_nc:name;
>> +#else
>> +# define MOVL(n, name)                    \
>> +    movz    PTR_REG(n), #:abs_g1:name;        \
>> +    movk    PTR_REG(n), #:abs_g0_nc:name;
>> +#endif
> Since PTR_REG is defined only based on __LP64__ already why don't you just do:
> #ifdef __LP64__
> # define MOVL(n, name)                    \
>      movz    x##n, #:abs_g3:name;        \
>      movk    x##n, #:abs_g2_nc:name;        \
>      movk    x##n, #:abs_g1_nc:name;        \
>      movk    x##n, #:abs_g0_nc:name;
> #else
> # define MOVL(n, name)                    \
>      movz    w##n, #:abs_g1:name;        \
>      movk    w##n, #:abs_g0_nc:name;
> #endif
I think PTR_REG is more meaningful.
Thanks.
>
> Thanks,
> Andrew
>
>> +
>>   /* Since C identifiers are not normally prefixed with an underscore
>>      on this system, the asm identifier `syscall_error' intrudes on the
>>      C name space.  Make sure we use an innocuous name.  */
>>
>>


  parent reply	other threads:[~2017-09-12  8:54 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-09-07  7:34 wangboshi
2017-09-07 11:43 ` Florian Weimer
2017-09-11  8:58   ` Szabolcs Nagy
2017-09-11  9:09 ` Andrew Pinski
2017-09-11  9:24   ` Szabolcs Nagy
2017-09-12  8:54   ` Boshi Wang [this message]
2017-09-11  9:11 ` Szabolcs Nagy
     [not found]   ` <336560e5-c9de-08bc-c850-28994cac2c33@huawei.com>
2017-09-14  8:35     ` Szabolcs Nagy
2017-09-15  1:16       ` Boshi Wang
2017-09-18 17:21         ` Szabolcs Nagy

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=68118bc5-fd76-1fd1-b6cf-e9d2c82e8537@huawei.com \
    --to=wangboshi@huawei.com \
    --cc=libc-alpha@sourceware.org \
    --cc=pinskia@gmail.com \
    --cc=szabolcs.nagy@arm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).