mirror of
https://github.com/python/cpython.git
synced 2025-07-23 11:15:24 +00:00
[3.13] gh-128605: Add branch protections for x86_64 in asm_trampoline.S (GH-128606) (GH-135077) (#135083)
[3.14] gh-128605: Add branch protections for x86_64 in asm_trampoline.S (GH-128606) (GH-135077)
Apply Intel Control-flow Technology for x86-64 on asm_trampoline.S.
Required for mitigation against return-oriented programming (ROP)
and Call or Jump Oriented Programming (COP/JOP) attacks.
Manual application is required for the assembly files.
See also: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html
(cherry picked from commit 899cca6dbf
)
Co-authored-by: stratakis <cstratak@redhat.com>
This commit is contained in:
parent
b0c9c192f1
commit
9f3d99967c
2 changed files with 27 additions and 0 deletions
|
@ -9,6 +9,9 @@
|
||||||
# }
|
# }
|
||||||
_Py_trampoline_func_start:
|
_Py_trampoline_func_start:
|
||||||
#ifdef __x86_64__
|
#ifdef __x86_64__
|
||||||
|
#if defined(__CET__) && (__CET__ & 1)
|
||||||
|
endbr64
|
||||||
|
#endif
|
||||||
sub $8, %rsp
|
sub $8, %rsp
|
||||||
call *%rcx
|
call *%rcx
|
||||||
add $8, %rsp
|
add $8, %rsp
|
||||||
|
@ -34,3 +37,22 @@ _Py_trampoline_func_start:
|
||||||
.globl _Py_trampoline_func_end
|
.globl _Py_trampoline_func_end
|
||||||
_Py_trampoline_func_end:
|
_Py_trampoline_func_end:
|
||||||
.section .note.GNU-stack,"",@progbits
|
.section .note.GNU-stack,"",@progbits
|
||||||
|
# Note for indicating the assembly code supports CET
|
||||||
|
#if defined(__x86_64__) && defined(__CET__) && (__CET__ & 1)
|
||||||
|
.section .note.gnu.property,"a"
|
||||||
|
.align 8
|
||||||
|
.long 1f - 0f
|
||||||
|
.long 4f - 1f
|
||||||
|
.long 5
|
||||||
|
0:
|
||||||
|
.string "GNU"
|
||||||
|
1:
|
||||||
|
.align 8
|
||||||
|
.long 0xc0000002
|
||||||
|
.long 3f - 2f
|
||||||
|
2:
|
||||||
|
.long 0x3
|
||||||
|
3:
|
||||||
|
.align 8
|
||||||
|
4:
|
||||||
|
#endif // __x86_64__
|
||||||
|
|
|
@ -472,6 +472,11 @@ elf_init_ehframe(ELFObjectContext* ctx)
|
||||||
DWRF_U8(0); /* Augmentation data. */
|
DWRF_U8(0); /* Augmentation data. */
|
||||||
/* Registers saved in CFRAME. */
|
/* Registers saved in CFRAME. */
|
||||||
#ifdef __x86_64__
|
#ifdef __x86_64__
|
||||||
|
# if defined(__CET__) && (__CET__ & 1)
|
||||||
|
DWRF_U8(DWRF_CFA_advance_loc | 8);
|
||||||
|
# else
|
||||||
|
DWRF_U8(DWRF_CFA_advance_loc | 4);
|
||||||
|
# endif
|
||||||
DWRF_U8(DWRF_CFA_advance_loc | 4);
|
DWRF_U8(DWRF_CFA_advance_loc | 4);
|
||||||
DWRF_U8(DWRF_CFA_def_cfa_offset); DWRF_UV(16);
|
DWRF_U8(DWRF_CFA_def_cfa_offset); DWRF_UV(16);
|
||||||
DWRF_U8(DWRF_CFA_advance_loc | 6);
|
DWRF_U8(DWRF_CFA_advance_loc | 6);
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue