Skip to content
This repository has been archived by the owner on Jun 28, 2022. It is now read-only.

Re-enable support for indirect function calls when using non-transparent returns. #89

Open
pgoodman opened this issue Dec 29, 2014 · 1 comment

Comments

@pgoodman
Copy link
Member

This issue is primarily due to me working in user space (with transparent return addresses) so long that I've forgotten how function calls, when combined with the virtual register system, introduce some funny issues!

The crux of the issue is that indirect function calls will go through lookup, which requires the VR system. But then the call will push on a return address onto a shifted version of the stack pointer.

The original code for late-mangling calls included this:

// Mangle an indirect function call.

It also did some really ugly magic (that combined with ugly later passes in the assembly stage) to pull off getting the right return address in place. In general, the same mangling will be necessary. However, a better solution to how to figure out the return targets needs to be thought through.

For the time being, I'm leaving this on the back-burner until I return to kernel space.

@pgoodman
Copy link
Member Author

It might be worth looking into one of the tricks originally used in granary1, where there would be a call to the edge lookup code, and the call itself would be placed somewhere just before the address of the target is computed, but after any "real" instructions from the block.

One problem with this approach is that it is not transparent for things like CALL [RSP], which itself isn't safe unless interrupts are disabled or one is in user space and using the redzone.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

1 participant