• Thibaud Michaud's avatar
    [wasm][x64] Fix OSR shadow stack violation · 06a2c2e0
    Thibaud Michaud authored
    We currently allow OSR (On-Stack Replacement) of arbitrarily deep return
    addresses. This is in direct violation of Intel CET's shadow stack,
    which we plan to enable eventually.
    
    This change works around this by postponing OSR until after we return to
    the old code. The main changes are:
    - Reserve a slot in Liftoff frames to store the OSR target,
    - Skip the return address modification, and instead store the new code
    pointer in the dedicated slot,
    - Upon returning to the old code, check the slot and do an indirect jump
    to the new code if needed.
    
    CET also prevents indirect jumps to arbitrary locations, so the last
    point is also a CET violation. Valid indirect jump targets must be
    marked with the ENDBRANCH instruction, which I will do in a follow-up
    CL.
    
    Bug: v8:11654
    Change-Id: I6925005211aa95d60803b9409e3c07c7c226b25c
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826127
    Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
    Reviewed-by: 's avatarClemens Backes <clemensb@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#73977}
    06a2c2e0
wasm-debug.cc 49 KB