You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Jun 28, 2022. It is now read-only.
This issue is primarily due to me working in user space (with transparent return addresses) so long that I've forgotten how function calls, when combined with the virtual register system, introduce some funny issues!
The crux of the issue is that indirect function calls will go through lookup, which requires the VR system. But then the call will push on a return address onto a shifted version of the stack pointer.
The original code for late-mangling calls included this:
It also did some really ugly magic (that combined with ugly later passes in the assembly stage) to pull off getting the right return address in place. In general, the same mangling will be necessary. However, a better solution to how to figure out the return targets needs to be thought through.
For the time being, I'm leaving this on the back-burner until I return to kernel space.
The text was updated successfully, but these errors were encountered:
It might be worth looking into one of the tricks originally used in granary1, where there would be a call to the edge lookup code, and the call itself would be placed somewhere just before the address of the target is computed, but after any "real" instructions from the block.
One problem with this approach is that it is not transparent for things like CALL [RSP], which itself isn't safe unless interrupts are disabled or one is in user space and using the redzone.
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
This issue is primarily due to me working in user space (with transparent return addresses) so long that I've forgotten how function calls, when combined with the virtual register system, introduce some funny issues!
The crux of the issue is that indirect function calls will go through lookup, which requires the VR system. But then the call will push on a return address onto a shifted version of the stack pointer.
The original code for late-mangling calls included this:
granary2/arch/x86-64/assemble/1_mangle.cc
Line 237 in 89ed6fd
It also did some really ugly magic (that combined with ugly later passes in the assembly stage) to pull off getting the right return address in place. In general, the same mangling will be necessary. However, a better solution to how to figure out the return targets needs to be thought through.
For the time being, I'm leaving this on the back-burner until I return to kernel space.
The text was updated successfully, but these errors were encountered: