From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/8668 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: [PATCHv3 1/3] fix matching errors for overwritten registers in x86 CFI generation script Date: Wed, 14 Oct 2015 15:14:08 -0400 Message-ID: <20151014191408.GU8645@brightrain.aerifal.cx> References: <1444735732-12265-1-git-send-email-alexinbeijing@gmail.com> <20151013224204.GT8645@brightrain.aerifal.cx> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1444850078 11859 80.91.229.3 (14 Oct 2015 19:14:38 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Wed, 14 Oct 2015 19:14:38 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-8680-gllmg-musl=m.gmane.org@lists.openwall.com Wed Oct 14 21:14:25 2015 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1ZmRVI-0002W5-RJ for gllmg-musl@m.gmane.org; Wed, 14 Oct 2015 21:14:24 +0200 Original-Received: (qmail 3774 invoked by uid 550); 14 Oct 2015 19:14:22 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 3753 invoked from network); 14 Oct 2015 19:14:21 -0000 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Original-Sender: Rich Felker Xref: news.gmane.org gmane.linux.lib.musl.general:8668 Archived-At: On Wed, Oct 14, 2015 at 12:21:05PM +0200, Alex wrote: > On Wed, Oct 14, 2015 at 12:42 AM, Rich Felker wrote: > > > On Tue, Oct 13, 2015 at 01:28:50PM +0200, Alex Dowad wrote: > > > Here is the latest iteration. I have merged 2 previously separate > > commits, and > > > fixed up the matching of registers (for the purpose of identifying > > overwritten > > > registers). > > > > > > As usual, thanks for the feedback. AD > > > > Thanks! I'm committing them all now. I'm sorry for not catching this > > before -- I realized that the index register thing was also an > > existing bug in mov handling, not just a new bug added in the operand > > order patch, so I split it out into a separate commit. I did basic > > regression testing on i386 (making sure gdb backtrace from syscalls > > still works) and tested that the x86_64 also seems to work (it does). > > Thanks! > > This has been an interesting exercise so far. Is there any other arch which > you think it would be worthwhile to develop a CFI generation script for? It > should be something which has enough users to avoid problems with bitrot. CFI is probably a lot less interesting on archs where you have a plenty registers not to need to manipulate stack frames in asm functions, since in that case the debugger mostly works fine without CFI. I don't know right off which of the other archs have significant amounts of asm that adjusts the stack pointer, but you could go through and check them. Having ABI info for them all would be helpful; I'm pasting my draft ABI reference (which might have errors) below. Rich aarch64 ... x30 lr x31 zr or pc arm r0-r3 args/ret r4-r11 saved r12 temp (ip scratch) r13 sp r14 lr r15 pc microblaze r0 zero r1 sp r2 ro sda r3-r4 ret r5-r10 args r11-12 temp r13 rw sda r14 syscall ret addr r15 function ret addr r16 break ret addr r17 exception ret addr r18 assembler temp r19-r20 saved r21 thread pointer r21-r31 saved mips (http://www.inf.ed.ac.uk/teaching/courses/car/Notes/slide03.pdf) $0 zero $1 at (assembler temp) $2-$3 ret (aka v0-v1) $4-$7 args (aka a0-a3) $8-$15 temp (aka t0-t7) $16-$23 saved (aka s0-s7 $24 temp (aka t8) $25 function call addr (aka t9) $26-$27 kernel use $28 gp, call-clobbered $29 sp $30 fp $31 ra or1k (openrisc-arch-1.1-rev0.pdf p.335) r0 zero r1 sp r2 fp r3-r8 args r9 lr r11,r12 retval (lo,hi) r10 thread pointer r14-r30(even) saved r13-r31(odd) temp powerpc (http://www.csd.uwo.ca/~mburrel/stuff/ppc-asm.html http://devpit.org/wiki/Debugging_PowerPC_ELF_Binaries) 0 temp 1 sp 2 toc (thread pointer) 3 ret, arg0 4-10 args 11-12 temp 13-31 saved lr (not gpr; use mtlr/mflr) 30 got 11 plt temp ctr plt temp superh (http://www.st.com/st-web-ui/static/active/en/resource/technical/document/reference_manual/CD17839242.pdf p.9) (http://shared-ptr.com/sh_insns.html) r0-r3 ret r2 struct ret addr r4-r7 args r8-r13 saved r12 gp (saved) r14 fp (saved) r15 sp pr lr gbr thread ptr