Libffi accomodate CFI pattern

Author: matneu

truffle/src/libffi/patches/linux-amd64-musl-swcfi/swcfi-0002-Add-support-__SANDBOX_SWCFI__-in-unix64.S-and-win64.patch renamed to truffle/src/libffi/patches/linux-amd64-musl-swcfi/swcfi-0002-Add-support-__SANDBOX_CFI__-in-unix64.S-and-win64.patch

@@ -1,14 +1,18 @@
-From 4900a67c4daabedbf83b563d77830c3f1c6eb599 Mon Sep 17 00:00:00 2001
-From: Gilles Duboscq <gilles.m.duboscq@oracle.com>
-Date: Wed, 23 Apr 2025 18:45:10 +0200
-Subject: [PATCH 2/3] Add support __SANDBOX_SWCFI__ in unix64.S and win64.S
+From 0e770017b54a270b80a4c696703e79560f263541 Mon Sep 17 00:00:00 2001
+From: Matthias Neugschwandtner <matthias.neugschwandtner@oracle.com>
+Date: Wed, 10 Sep 2025 14:54:12 +0200
+Subject: [PATCH 2/3] Add support __SANDBOX_CFI__ in unix64.S and win64.S
+
+This mode adds a check for jump targets to match the ENDBR64 instruction.
+The check is either performed entirely in software, or supported by the CPU.
+
+Co-authored-by: Gilles Duboscq <gilles.m.duboscq@oracle.com>
 
-This mode requires a software check for jump targets.
 ---
  src/x86/internal64.h |  4 +++
- src/x86/unix64.S     | 30 ++++++++++++++++++++
- src/x86/win64.S      | 65 +++++++++++++++++++++++++++++++++++++++++++-
- 3 files changed, 98 insertions(+), 1 deletion(-)
+ src/x86/unix64.S     | 54 +++++++++++++++++++++++++++++--
+ src/x86/win64.S      | 77 +++++++++++++++++++++++++++++++++++++++++++-
+ 3 files changed, 131 insertions(+), 4 deletions(-)
 
 diff --git a/src/x86/internal64.h b/src/x86/internal64.h
 index 282b408..7142645 100644
@@ -27,10 +31,25 @@ index 282b408..7142645 100644
  #define UNIX64_TRAMP_SIZE	32
  #endif
 diff --git a/src/x86/unix64.S b/src/x86/unix64.S
-index d9c5bd4..10d9c8d 100644
+index d9c5bd4..3239ea3 100644
 --- a/src/x86/unix64.S
 +++ b/src/x86/unix64.S
-@@ -98,6 +98,13 @@ L(ret_from_load_sse):
+@@ -39,7 +39,13 @@
+    actual table.  The entry points into the table are all 8 bytes.
+    The use of ORG asserts that we're at the correct location.  */
+ /* ??? The clang assembler doesn't handle .org with symbolic expressions.  */
+-#ifdef __CET__
++#ifdef __SANDBOX_SWCFI__
++/* Increase slot size to accomodate ENDBR64 (+4 bytes) and SWCFI pattern (+24 bytes) for ret.  */
++# define E(BASE, X)	.balign 8; .org BASE + (X) * 40
++#elif defined __SANDBOX_HWCFI__
++/* Increase slot size to accomodate ENDBR64 (+4 bytes) and HWCFI pattern (+6 bytes) for ret.  */
++# define E(BASE, X)	.balign 8; .org BASE + (X) * 24
++#elif defined __CET__
+ /* Double slot size to 16 byte to add 4 bytes of ENDBR64.  */
+ # define E(BASE, X)	.balign 8; .org BASE + X * 16
+ #elif defined(__clang__) || defined(__APPLE__) || (defined (__sun__) && defined(__svr4__))
+@@ -98,6 +104,13 @@ L(ret_from_load_sse):
 
  	/* Deallocate the reg arg area, except for r10, then load via pop.  */
  	leaq	0xb8(%r10), %rsp
@@ -44,7 +63,19 @@ index d9c5bd4..10d9c8d 100644
  	popq	%r10
 
  	/* Call the user function.  */
-@@ -126,6 +133,13 @@ L(UW2):
+@@ -119,13 +132,24 @@ L(UW2):
+ 	movzbl	%cl, %r10d
+ 	leaq	L(store_table)(%rip), %r11
+ 	ja	L(sa)
+-#ifdef __CET__
++#ifdef __SANDBOX_SWCFI__
++	lea (%r10, %r10, 4), %r10
++#elif defined __SANDBOX_HWCFI__
++	lea (%r10, %r10, 2), %r10
++#elif defined __CET__
+ 	/* NB: Originally, each slot is 8 byte.  4 bytes of ENDBR64 +
+ 	   4 bytes NOP padding double slot size to 16 bytes.  */
+ 	addl	%r10d, %r10d
  #endif
  	leaq	(%r11, %r10, 8), %r10
 
@@ -58,7 +89,18 @@ index d9c5bd4..10d9c8d 100644
  	/* Prep for the structure cases: scratch area in redzone.  */
  	leaq	-20(%rsp), %rsi
  	jmp	*%r10
-@@ -318,6 +332,13 @@ L(UW10):
+@@ -312,12 +336,25 @@ L(UW10):
+ 	movzbl	%al, %r10d
+ 	leaq	L(load_table)(%rip), %r11
+ 	ja	L(la)
+-#ifdef __CET__
++#ifdef __SANDBOX_SWCFI__
++	lea (%r10, %r10, 4), %r10
++#elif defined __SANDBOX_HWCFI__
++	lea (%r10, %r10, 2), %r10
++#elif defined __CET__
+ 	/* NB: Originally, each slot is 8 byte.  4 bytes of ENDBR64 +
+ 	   4 bytes NOP padding double slot size to 16 bytes.  */
  	addl	%r10d, %r10d
  #endif
  	leaq	(%r11, %r10, 8), %r10
@@ -68,11 +110,13 @@ index d9c5bd4..10d9c8d 100644
 +	jz	1f
 +	int3
 +1:
++#elif defined __SANDBOX_HWCFI__
++	test  %r10, (%r10)
 +#endif
  	leaq	ffi_closure_RED_RVALUE(%rsp), %rsi
  	jmp	*%r10
 
-@@ -538,6 +559,15 @@ C(trampoline_code_table):
+@@ -538,6 +575,17 @@ C(trampoline_code_table):
  	movl	X86_CODE_OFFSET(%rip), %r10d	/* Copy code into %r10 */
  #else
  	movq	X86_CODE_OFFSET(%rip), %r10	/* Copy code into %r10 */
@@ -85,26 +129,31 @@ index d9c5bd4..10d9c8d 100644
 +	int3
 +1:
 +	popq	%rdi
++#elif defined __SANDBOX_HWCFI__
++	test  %r10, (%r10)
  #endif
  	jmp	*%r10				/* Jump to code */
  	.align	8
 diff --git a/src/x86/win64.S b/src/x86/win64.S
-index 58ec6a1..d1a180a 100644
+index 58ec6a1..8b142d9 100644
 --- a/src/x86/win64.S
 +++ b/src/x86/win64.S
-@@ -27,7 +27,10 @@
+@@ -27,7 +27,13 @@
     actual table.  The entry points into the table are all 8 bytes.
     The use of ORG asserts that we're at the correct location.  */
  /* ??? The clang assembler doesn't handle .org with symbolic expressions.  */
 -#if defined(__clang__) || defined(__APPLE__) || (defined (__sun__) && defined(__svr4__))
 +#ifdef __SANDBOX_SWCFI__
-+/* Triple slot size to 24 byte to add ENDBR64 and jump for ret.  */
++/* Increase slot size to accomodate ENDBR64 (+4 bytes) and SWCFI pattern (+24 bytes) for ret.  */
++# define E(BASE, X)	.balign 8; .org BASE + (X) * 40
++#elif defined __SANDBOX_HWCFI__
++/* Increase slot size to accomodate ENDBR64 (+4 bytes) and HWCFI pattern (+6 bytes) for ret.  */
 +# define E(BASE, X)	.balign 8; .org BASE + (X) * 24
 +#elif defined(__clang__) || defined(__APPLE__) || (defined (__sun__) && defined(__svr4__))
  # define E(BASE, X)	.balign 8
  #else
  # define E(BASE, X)	.balign 8; .org BASE + (X) * 8
-@@ -73,18 +76,58 @@ C(ffi_call_win64):
+@@ -73,18 +79,67 @@ C(ffi_call_win64):
  	movq	24(%rsp), %r9
  	movsd	24(%rsp), %xmm3
 
@@ -118,6 +167,10 @@ index 58ec6a1..d1a180a 100644
 +1:
 +	popq	%r10
 +	call	*%r11
++#elif defined  __SANDBOX_HWCFI__
++	movq	16(%rbp), %r11
++	test  %r11, (%r11)
++	call	*%r11
 +#else
  	call	*16(%rbp)
 +#endif
@@ -127,19 +180,24 @@ index 58ec6a1..d1a180a 100644
  	leaq	0f(%rip), %r10
  	cmpl	$FFI_TYPE_SMALL_STRUCT_4B, %ecx
 +
-+#ifdef __SANDBOX_SWCFI__
-+	/* avoid leave in this mode, use larger slots (3*8) */
++#ifdef __SANDBOX_CFI__
++	/* avoid leave in this mode, use larger slots (5*8) */
 +	ja	99f
-+	movl	%ecx, %r11d
-+	addl	%ecx, %ecx
-+	addl	%r11d, %ecx
++#ifdef __SANDBOX_SWCFI__
++	lea (%rcx, %rcx, 4), %rcx
 +	leaq	(%r10, %rcx, 8), %r10
 +	movl	(%r10), %ecx
 +	addl	$0x5e1f00d, %ecx
 +	jz	1f
 +	int3
 +1:
 +	jmp	*%r10
++#elif defined  __SANDBOX_HWCFI__
++	lea (%rcx, %rcx, 2), %rcx
++	leaq	(%r10, %rcx, 8), %r10
++	test  %r10, (%r10)
++	jmp	*%r10
++#endif /* SWCFI/HWCFI */
 +
 +#define jmp_target		\
 +	_CET_ENDBR
@@ -163,7 +221,7 @@ index 58ec6a1..d1a180a 100644
  #define epilogue		\
  	leaveq;			\
  	cfi_remember_state;	\
-@@ -92,66 +135,86 @@ C(ffi_call_win64):
+@@ -92,66 +147,86 @@ C(ffi_call_win64):
  	cfi_restore(%rbp);	\
  	ret;			\
  	cfi_restore_state
@@ -251,5 +309,5 @@ index 58ec6a1..d1a180a 100644
  	epilogue
 
 -- 
-2.43.0
+2.34.1