Skip to content

Commit 7256b13

Browse files
committed
Add support for indirect branch tracking (IBT)
Gcc already support IBT for most of the C code. This commit support IBT for: 1. JIT Add endbr32/64 instruction in Dynasm. Insert endbr32/64 in indirect branch target for jitted code. 2. Fiber Add endbr in assembly. Inform compiler jump_fcontext may return via indirect branch. Quote from Linux 5.18 git log: Indirect branch tracking (IBT) is available since Intel Tigerlake (11th gen) and Sapphire Rapids. It's also available on some AMD cpus. IBT is hardware based, forward edge Control-Flow-Integrity mechanism where any indirect CALL/JMP must target an ENDBR instruction or suffer #CP. Signed-off-by: Chen, Hu <hu1.chen@intel.com>
1 parent dc9c00b commit 7256b13

File tree

5 files changed

+57
-8
lines changed

5 files changed

+57
-8
lines changed

Zend/asm/jump_x86_64_sysv_elf_gas.S

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
.type jump_fcontext,@function
3131
.align 16
3232
jump_fcontext:
33+
endbr64
3334
leaq -0x38(%rsp), %rsp /* prepare stack */
3435

3536
#if !defined(BOOST_USE_TSX)

Zend/asm/make_x86_64_sysv_elf_gas.S

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
.type make_fcontext,@function
3131
.align 16
3232
make_fcontext:
33+
endbr64
3334
/* first arg of make_fcontext() == top of context-stack */
3435
movq %rdi, %rax
3536

@@ -66,11 +67,13 @@ make_fcontext:
6667
trampoline:
6768
/* store return address on stack */
6869
/* fix stack alignment */
70+
endbr64
6971
push %rbp
7072
/* jump to context-function */
7173
jmp *%rbx
7274

7375
finish:
76+
endbr64
7477
/* exit code is zero */
7578
xorq %rdi, %rdi
7679
/* exit application */

Zend/zend_fibers.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,7 @@ typedef struct {
141141

142142
/* These functions are defined in assembler files provided by boost.context (located in "Zend/asm"). */
143143
extern void *make_fcontext(void *sp, size_t size, void (*fn)(boost_context_data));
144-
extern boost_context_data jump_fcontext(void *to, zend_fiber_transfer *transfer);
144+
extern boost_context_data jump_fcontext(void *to, zend_fiber_transfer *transfer) __attribute__ ((__indirect_return__));
145145
#endif
146146

147147
ZEND_API zend_class_entry *zend_ce_fiber;

ext/opcache/jit/dynasm/dasm_x86.lua

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1147,6 +1147,8 @@ local map_op = {
11471147
rep_0 = "F3",
11481148
repe_0 = "F3",
11491149
repz_0 = "F3",
1150+
endbr32_0 = "F30F1EFB",
1151+
endbr64_0 = "F30F1EFA",
11501152
-- F4: *hlt
11511153
cmc_0 = "F5",
11521154
-- F6: test... mb,i; div... mb

0 commit comments

Comments
 (0)