Missing mianipulation of return address
Missing mianipulation of return address
Posted Jun 26, 2018 5:10 UTC (Tue) by luto (subscriber, #39314)In reply to: Missing mianipulation of return address by jreiser
Parent article: Kernel support for control-flow enforcement
Implementing PUSHRA may require special hardware. Consider PUSHRA mem; CALL. The CPU wants to speculatively execute CALL before the PUSHRA argument becomes available. To do that, either the CPU can push garbage to the return stack, in which case the instruction would be almost useless, or PUSHRA would need to reserve a return stack slot and fill it later. The latter might be fairly intrusive to a CPU design.
POPRA reg/mem seems silly. A POPRA that simply discards a return stack entry and has no effect on RSP seems better. Also, speculative execution of PUSHRA might not even be supportable by conventional return stack hardware.
Also, why are you assigning your hypothetical instructions opcodes at all, let alone single-byte opcodes?