102 lines
3.7 KiB
Go
102 lines
3.7 KiB
Go
// Copyright (c) 2026 Petr Balvín <opensource@petrbalvin.org> (https://petrbalvin.org)
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
//go:build amd64 || arm64 || riscv64 || loong64
|
|
|
|
package verify
|
|
|
|
import (
|
|
"encoding/binary"
|
|
"fmt"
|
|
"syscall"
|
|
"unsafe"
|
|
)
|
|
|
|
// CallChecked invokes the function at fnAddr with ABI sentinels and a
|
|
// canary below SP, returning both the argument block (with results) and an
|
|
// ABIReport.
|
|
//
|
|
// The callee is assumed to declare no local frame ($0 in its TEXT
|
|
// directive); use CallCheckedFrame, or Kernel.CallFuncChecked which reads
|
|
// the frame from the image, for a callee with a frame. A callee whose
|
|
// frame extends past the fixed call margin would otherwise trip the canary
|
|
// with perfectly legal writes.
|
|
//
|
|
// Not safe for concurrent use: only one JIT call may be in flight at a
|
|
// time, the trampolines keep the saved registers in package globals.
|
|
//
|
|
// The architecture-specific parts live in abi_<arch>.s: enterJITChecked
|
|
// plants sentinels in the registers the Go ABI fixes across calls (the
|
|
// frame pointer and the goroutine pointer) before switching to the
|
|
// prepared stack, and the raw return trampoline leaveJITCheckedRaw
|
|
// compares them and records violations in abiResult.
|
|
func CallChecked(fnAddr uintptr, args []byte) ([]byte, ABIReport, error) {
|
|
return CallCheckedFrame(fnAddr, args, 0)
|
|
}
|
|
|
|
// CallCheckedFrame is CallChecked with the canary gap sized for a callee
|
|
// that declares a local frame of frame bytes: the canary window is placed
|
|
// below the deepest write a legal kernel may make, its own frame plus the
|
|
// call margin, so only writes that go below the declared frame trip it.
|
|
// Callers that already hold the function layout pass asm.FuncLayout.Frame.
|
|
//
|
|
// Not safe for concurrent use: only one JIT call may be in flight at a
|
|
// time, the trampolines keep the saved registers in package globals.
|
|
func CallCheckedFrame(fnAddr uintptr, args []byte, frame int) ([]byte, ABIReport, error) {
|
|
report := ABIReport{}
|
|
|
|
// Reset the global result.
|
|
abiResult = 0
|
|
|
|
// The gap between the canary window and the entry stack pointer must
|
|
// cover every write a legal kernel makes. Two parts:
|
|
// - frame: the callee's declared local frame, which the ABI lets it
|
|
// write anywhere in [SP-frame, SP).
|
|
// - stackPad (64): the call margin. A kernel may CALL another
|
|
// function, which pushes a return address below the frame and runs
|
|
// a small prologue of its own; 64 bytes covers both. Callees'
|
|
// own frames are not accounted: a kernel calling deep into other
|
|
// frames can write below this gap without detection.
|
|
pad := stackPad + frame
|
|
|
|
// Prepare the stack: [canary][frame gap][leaveJITCheckedRaw][args...]
|
|
totalSize := redZoneSize + pad + 8 + len(args) + 64
|
|
stackMem, err := syscall.Mmap(-1, 0, totalSize,
|
|
syscall.PROT_READ|syscall.PROT_WRITE, syscall.MAP_PRIVATE|syscall.MAP_ANON)
|
|
if err != nil {
|
|
return nil, report, fmt.Errorf("verify: stack mmap: %w", err)
|
|
}
|
|
defer func() { _ = syscall.Munmap(stackMem) }()
|
|
|
|
// Fill the canary window with the detection pattern.
|
|
for i := range redZoneSize {
|
|
stackMem[i] = redZoneFill
|
|
}
|
|
|
|
// Return address and args after the canary and the frame gap.
|
|
retOff := redZoneSize + pad
|
|
binary.LittleEndian.PutUint64(stackMem[retOff:retOff+8], uint64(leaveCheckedPtr))
|
|
copy(stackMem[retOff+8:], args)
|
|
|
|
stackBase := uintptr(unsafe.Pointer(&stackMem[retOff]))
|
|
enterJITChecked(fnAddr, stackBase)
|
|
|
|
// Read the register-clobber result.
|
|
res := abiResult
|
|
report.FPClobbered = res&1 != 0
|
|
report.GClobbered = res&2 != 0
|
|
|
|
// Check the canary window.
|
|
for i := range redZoneSize {
|
|
if stackMem[i] != redZoneFill {
|
|
report.RedZoneHit = true
|
|
break
|
|
}
|
|
}
|
|
|
|
// Copy out the argument area.
|
|
out := make([]byte, len(args))
|
|
copy(out, stackMem[retOff+8:retOff+8+len(args)])
|
|
return out, report, nil
|
|
}
|