Date: Sat, 11 Apr 2015 05:18:28 -0400 From: Yue Chen <ychen.contact@gmail.com> To: freebsd-arch@freebsd.org Subject: Situations about PC values in kernel data segments Message-ID: <CAKtBrB6g5fR_tvT=KwrER4_VGfYB-fF-2DWmm1vMDpZ55qb2qg@mail.gmail.com>
next in thread | raw e-mail | index | archive | help
Dear all, We are working on a project about OS security. We wonder in which situations the program counter (PC) value (e.g., the value in %RIP on x86_64, i.e, instruction address) could be in kernel (module) data segments (including stack, heap, etc.). Here we mainly care about the address/value that are NOT function entry points since there exist a number of function pointers. Also, we only consider the normal cases because one can write arbitrary values into a variable/pointer. And we mainly consider i386, AMD64 and ARM. Here are some situations I can think about: function/interrupt/exception/syscall return address on stack; switch/case jump table target; page fault handler (pcb_onfault on *BSD); restartable atomic sequences (RAS) registry; thread/process context structure like Task state segment (TSS), process control block (PCB) and thread control block (TCB); situations for debugging purposes (e.g., like those in ``segment not present'' exception handler). Additionally, does any of these addresses have offset formats or special encodings? For example, on x86_64, we may use 32-bit RIP-relative (addressing) offset to represent a 64-bit full address. In glibc's setjmp/longjmp jmp_buf, they use a special encoding (PTR_MANGLE) for saved register values. Best thanks and regards, Yue
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAKtBrB6g5fR_tvT=KwrER4_VGfYB-fF-2DWmm1vMDpZ55qb2qg>