8000 [3.13] gh-128605: Add branch protections for x86_64 in asm_trampoline… · python/cpython@6519257 · GitHub
[go: up one dir, main page]
Skip to content

    • Commit 6519257

    Browse files
    stratakisstratakis
    authored
    [3.13] gh-128605: Add branch protections for x86_64 in asm_trampoline.S (#128606) (#135353)
    Apply Intel Control-flow Technology for x86-64 on asm_trampoline.S. Required for mitigation against return-oriented programming (ROP) and Call or Jump Oriented Programming (COP/JOP) attacks. Manual application is required for the assembly files. See also: https://sourceware.org/annobin/annobin.html/Test-cf-protection.html
    1 parent ffeaeaf commit 6519257

    File tree

    2 files changed

    +26
    -0
    lines changed

    2 files changed

    +26
    -0
    lines changed

    ‎Python/asm_trampoline.S

    Lines changed: 22 additions & 0 deletions
    Original file line numberDiff line numberDiff line change
    @@ -9,6 +9,9 @@
    99
    # }
    1010
    _Py_trampoline_func_start:
    1111
    #ifdef __x86_64__
    12+
    #if defined(__CET__) && (__CET__ & 1)
    13+
    endbr64
    14+
    #endif
    1215
    sub $8, %rsp
    1316
    call *%rcx
    1417
    add $8, %rsp
    @@ -34,3 +37,22 @@ _Py_trampoline_func_start:
    3437
    .globl _Py_trampoline_func_end
    3538
    _Py_trampoline_func_end:
    3639
    .section .note.GNU-stack,"",@progbits
    40+
    # Note for indicating the assembly code supports CET
    41+
    #if defined(__x86_64__) && defined(__CET__) && (__CET__ & 1)
    42+
    .section .note.gnu.property,"a"
    43+
    .align 8
    44+
    .long 1f - 0f
    45+
    .long 4f - 1f
    46+
    .long 5
    47+
    0:
    48+
    .string "GNU"
    49+
    1:
    50+
    .align 8
    51+
    .long 0xc0000002
    52+
    .long 3f - 2f
    53+
    2:
    54+
    .long 0x3
    55+
    3:
    56+
    .align 8
    57+
    4:
    58+
    #endif // __x86_64__

    ‎Python/perf_jit_trampoline.c

    Lines changed: 4 additions & 0 deletions
    Original file line numberDiff line numberDiff line change
    @@ -868,7 +868,11 @@ static void elf_init_ehframe(ELFObjectContext* ctx) {
    868868
    */
    869869
    #ifdef __x86_64__
    870870
    /* x86_64 calling convention unwinding rules */
     64B1
    871+
    # if defined(__CET__) && (__CET__ & 1)
    872+
    DWRF_U8(DWRF_CFA_advance_loc | 8); // Advance location by 8 bytes when CET protection is enabled
    873+
    # else
    871874
    DWRF_U8(DWRF_CFA_advance_loc | 4); // Advance location by 4 bytes
    875+
    # endif
    872876
    DWRF_U8(DWRF_CFA_def_cfa_offset); // Redefine CFA offset
    873877
    DWRF_UV(16); // New offset: SP + 16
    874878
    DWRF_U8(DWRF_CFA_advance_loc | 6); // Advance location by 6 bytes

    0 commit comments

    Comments
     (0)
    0