Conversation

Have you seen Samsung's kernel CFI implementation from before they gave up and moved to Google's upstream Clang CFI? It's the most horrifying thing and by that I mean they pass compiled kernel code through a Python script using objdump to add CFI instrumentation as a total hack.
2
17
The only thing they actually implemented in the compiler (still GCC) was adding NOP padding for them to use in their post-processing Python script along with reserving at least one register. Extremely coarse-grained indirect call CFI + ret addr XOR with random value in register.
1
1
So, Clang CFI figures out all the functions that aren't indirectly callable from the fact that their address isn't taken and they aren't exported (works well with -fvisibility=hidden) and then enforces type-based CFI for the indirect calls where that's not the case.
1
1
Check this out: github.com/djb77/samsung- It's horrible. They have GCC reserve 3 registers and output a bunch of NOP instructions for them to use in this horrifying script. The conversation just happened to remind me of this nightmarish thing.
1
3
Could talk about all the sketchy assembly code / instruction parsing and mangling with regular expressions, totally unexplained bit operations, etc. My nitpick is that they import the bisect module but then don't use it and roll their own binary search implementation instead.
3