729824 - Land JIT hardening nop insertion

Status: RESOLVED WONTFIX

(Core :: JavaScript Engine, defect)

Description

[Chris Leary [:cdleary] (not checking bugmail)]

Attachment: 0. Factor out a random number generator interface.

Initial RNG patch cleans up the kind of gross randomization reuse from the prior patch and makes a centralized RNG for JIT hardening in the JSRuntime that can be seeded at program startup.

Comment 1

[Chris Leary [:cdleary] (not checking bugmail)]

Attachment: 3. Shell option for seeding randomization.

Patches 1 and 2 were just rebased from dmandelin's reviews -- this lets us seed the hardening via a shell option for maximum reproducibility WRT try failures. I also fixed some of the uses of print-like-a-function in jit-tests.py because it bugged me. :-)

Comment 2

[Chris Leary [:cdleary] (not checking bugmail)]

Attachment: 2.5. Use the RNG as the hardening enabler.

Simple change, but different enough it probably needs an r+ to land.

Comment 3

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 600213 [details] [diff] [review]
2.5. Use the RNG as the hardening enabler.

Review of attachment 600213 [details] [diff] [review]:
-----------------------------------------------------------------

::: js/src/assembler/assembler/MacroAssemblerX86.h
@@ +220,5 @@
>  
>      Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
>      {
>          {
> +            AutoUnharden au(this);

Do these calls need to appear in relevant places in X64.h and the ARM macro assembler?

Comment 4

[Till Schneidereit [:till]]

Mass-reassigning cdleary's bugs to default. He won't work on any of them, anymore. I guess, at least.

@cdleary: shout if you take issue with this.

Comment 5

[Tom Ritter [:tjr]]

I don't think NOP Insertion is valuable enough to implement, as it can be bypassed readily. If anyone wants to debate about, feel free to comment or re-open.

Comment 6

[Tom Ritter [:tjr]]

See Also: https://github.com/Microsoft/ChakraCore/blob/39f7ce4f882088d05f87e4eb32fa60e5b2dabaad/lib/Backend/Security.cpp#L163

Chakra's InsertNops

Comment 7

[Lars T Hansen [:lth]]

FWIW, we use nop insertion for fuzzing (as it tends to find bugs related to branch targeting, incorrectly not-fused code sequences, and so on); the ARM back-end implements support for it, though probably not elaborate enough for JIT hardening.