1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright 2012-2016 by the PaX Team <pageexec@freemail.hu>
4 * Copyright 2016 by Emese Revfy <re.emese@gmail.com>
6 * Note: the choice of the license means that the compilation process is
7 * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
8 * but for the kernel it doesn't matter since it doesn't link against
9 * any of the gcc libraries
11 * This gcc plugin helps generate a little bit of entropy from program state,
12 * used throughout the uptime of the kernel. Here is an instrumentation example:
15 * void __latent_entropy test(int argc, char *argv[])
18 * printf("%s: no command arguments :(\n", *argv);
20 * printf("%s: %d command arguments!\n", *argv, argc - 1);
24 * void __latent_entropy test(int argc, char *argv[])
26 * // latent_entropy_execute() 1.
27 * unsigned long local_entropy;
28 * // init_local_entropy() 1.
29 * void *local_entropy_frameaddr;
30 * // init_local_entropy() 3.
31 * unsigned long tmp_latent_entropy;
33 * // init_local_entropy() 2.
34 * local_entropy_frameaddr = __builtin_frame_address(0);
35 * local_entropy = (unsigned long) local_entropy_frameaddr;
37 * // init_local_entropy() 4.
38 * tmp_latent_entropy = latent_entropy;
39 * // init_local_entropy() 5.
40 * local_entropy ^= tmp_latent_entropy;
42 * // latent_entropy_execute() 3.
44 * // perturb_local_entropy()
45 * local_entropy += 4623067384293424948;
46 * printf("%s: no command arguments :(\n", *argv);
47 * // perturb_local_entropy()
49 * local_entropy ^= 3896280633962944730;
50 * printf("%s: %d command arguments!\n", *argv, argc - 1);
53 * // latent_entropy_execute() 4.
54 * tmp_latent_entropy = rol(tmp_latent_entropy, local_entropy);
55 * latent_entropy = tmp_latent_entropy;
59 * - add ipa pass to identify not explicitly marked candidate functions
60 * - mix in more program state (function arguments/return values,
61 * loop variables, etc)
62 * - more instrumentation control via attribute parameters
68 * -fplugin-arg-latent_entropy_plugin-disable
70 * Attribute: __attribute__((latent_entropy))
71 * The latent_entropy gcc attribute can be only on functions and variables.
72 * If it is on a function then the plugin will instrument it. If the attribute
73 * is on a variable then the plugin will initialize it with a random value.
74 * The variable must be an integer, an integer array type or a structure
75 * with integer fields.
78 #include "gcc-common.h"
80 __visible
int plugin_is_GPL_compatible
;
82 static GTY(()) tree latent_entropy_decl
;
84 static struct plugin_info latent_entropy_plugin_info
= {
85 .version
= PLUGIN_VERSION
,
86 .help
= "disable\tturn off latent entropy instrumentation\n",
89 static unsigned HOST_WIDE_INT deterministic_seed
;
90 static unsigned HOST_WIDE_INT rnd_buf
[32];
91 static size_t rnd_idx
= ARRAY_SIZE(rnd_buf
);
92 static int urandom_fd
= -1;
94 static unsigned HOST_WIDE_INT
get_random_const(void)
96 if (deterministic_seed
) {
97 unsigned HOST_WIDE_INT w
= deterministic_seed
;
101 deterministic_seed
= w
;
102 return deterministic_seed
;
105 if (urandom_fd
< 0) {
106 urandom_fd
= open("/dev/urandom", O_RDONLY
);
107 gcc_assert(urandom_fd
>= 0);
109 if (rnd_idx
>= ARRAY_SIZE(rnd_buf
)) {
110 gcc_assert(read(urandom_fd
, rnd_buf
, sizeof(rnd_buf
)) == sizeof(rnd_buf
));
113 return rnd_buf
[rnd_idx
++];
116 static tree
tree_get_random_const(tree type
)
118 unsigned long long mask
;
120 mask
= 1ULL << (TREE_INT_CST_LOW(TYPE_SIZE(type
)) - 1);
121 mask
= 2 * (mask
- 1) + 1;
123 if (TYPE_UNSIGNED(type
))
124 return build_int_cstu(type
, mask
& get_random_const());
125 return build_int_cst(type
, mask
& get_random_const());
128 static tree
handle_latent_entropy_attribute(tree
*node
, tree name
,
134 vec
<constructor_elt
, va_gc
> *vals
;
136 switch (TREE_CODE(*node
)) {
138 *no_add_attrs
= true;
139 error("%qE attribute only applies to functions and variables",
144 if (DECL_INITIAL(*node
)) {
145 *no_add_attrs
= true;
146 error("variable %qD with %qE attribute must not be initialized",
151 if (!TREE_STATIC(*node
)) {
152 *no_add_attrs
= true;
153 error("variable %qD with %qE attribute must not be local",
158 type
= TREE_TYPE(*node
);
159 switch (TREE_CODE(type
)) {
161 *no_add_attrs
= true;
162 error("variable %qD with %qE attribute must be an integer or a fixed length integer array type or a fixed sized structure with integer fields",
167 tree fld
, lst
= TYPE_FIELDS(type
);
168 unsigned int nelt
= 0;
170 for (fld
= lst
; fld
; nelt
++, fld
= TREE_CHAIN(fld
)) {
173 fieldtype
= TREE_TYPE(fld
);
174 if (TREE_CODE(fieldtype
) == INTEGER_TYPE
)
177 *no_add_attrs
= true;
178 error("structure variable %qD with %qE attribute has a non-integer field %qE",
186 vec_alloc(vals
, nelt
);
188 for (fld
= lst
; fld
; fld
= TREE_CHAIN(fld
)) {
189 tree random_const
, fld_t
= TREE_TYPE(fld
);
191 random_const
= tree_get_random_const(fld_t
);
192 CONSTRUCTOR_APPEND_ELT(vals
, fld
, random_const
);
195 /* Initialize the fields with random constants */
196 DECL_INITIAL(*node
) = build_constructor(type
, vals
);
200 /* Initialize the variable with a random constant */
202 DECL_INITIAL(*node
) = tree_get_random_const(type
);
206 tree elt_type
, array_size
, elt_size
;
207 unsigned int i
, nelt
;
208 HOST_WIDE_INT array_size_int
, elt_size_int
;
210 elt_type
= TREE_TYPE(type
);
211 elt_size
= TYPE_SIZE_UNIT(TREE_TYPE(type
));
212 array_size
= TYPE_SIZE_UNIT(type
);
214 if (TREE_CODE(elt_type
) != INTEGER_TYPE
|| !array_size
215 || TREE_CODE(array_size
) != INTEGER_CST
) {
216 *no_add_attrs
= true;
217 error("array variable %qD with %qE attribute must be a fixed length integer array type",
222 array_size_int
= TREE_INT_CST_LOW(array_size
);
223 elt_size_int
= TREE_INT_CST_LOW(elt_size
);
224 nelt
= array_size_int
/ elt_size_int
;
226 vec_alloc(vals
, nelt
);
228 for (i
= 0; i
< nelt
; i
++) {
229 tree cst
= size_int(i
);
230 tree rand_cst
= tree_get_random_const(elt_type
);
232 CONSTRUCTOR_APPEND_ELT(vals
, cst
, rand_cst
);
236 * Initialize the elements of the array with random
239 DECL_INITIAL(*node
) = build_constructor(type
, vals
);
252 static struct attribute_spec latent_entropy_attr
= { };
254 static void register_attributes(void *event_data __unused
, void *data __unused
)
256 latent_entropy_attr
.name
= "latent_entropy";
257 latent_entropy_attr
.decl_required
= true;
258 latent_entropy_attr
.handler
= handle_latent_entropy_attribute
;
260 register_attribute(&latent_entropy_attr
);
263 static bool latent_entropy_gate(void)
267 /* don't bother with noreturn functions for now */
268 if (TREE_THIS_VOLATILE(current_function_decl
))
271 /* gcc-4.5 doesn't discover some trivial noreturn functions */
272 if (EDGE_COUNT(EXIT_BLOCK_PTR_FOR_FN(cfun
)->preds
) == 0)
275 list
= DECL_ATTRIBUTES(current_function_decl
);
276 return lookup_attribute("latent_entropy", list
) != NULL_TREE
;
279 static tree
create_var(tree type
, const char *name
)
283 var
= create_tmp_var(type
, name
);
284 add_referenced_var(var
);
285 mark_sym_for_renaming(var
);
290 * Set up the next operation and its constant operand to use in the latent
291 * entropy PRNG. When RHS is specified, the request is for perturbing the
292 * local latent entropy variable, otherwise it is for perturbing the global
293 * latent entropy variable where the two operands are already given by the
294 * local and global latent entropy variables themselves.
296 * The operation is one of add/xor/rol when instrumenting the local entropy
297 * variable and one of add/xor when perturbing the global entropy variable.
298 * Rotation is not used for the latter case because it would transmit less
299 * entropy to the global variable than the other two operations.
301 static enum tree_code
get_op(tree
*rhs
)
303 static enum tree_code op
;
304 unsigned HOST_WIDE_INT random_const
;
306 random_const
= get_random_const();
317 * This code limits the value of random_const to
318 * the size of a long for the rotation
320 random_const
%= TYPE_PRECISION(long_unsigned_type_node
);
330 *rhs
= build_int_cstu(long_unsigned_type_node
, random_const
);
334 static gimple
create_assign(enum tree_code code
, tree lhs
, tree op1
,
337 return gimple_build_assign_with_ops(code
, lhs
, op1
, op2
);
340 static void perturb_local_entropy(basic_block bb
, tree local_entropy
)
342 gimple_stmt_iterator gsi
;
348 assign
= create_assign(op
, local_entropy
, local_entropy
, rhs
);
349 gsi
= gsi_after_labels(bb
);
350 gsi_insert_before(&gsi
, assign
, GSI_NEW_STMT
);
354 static void __perturb_latent_entropy(gimple_stmt_iterator
*gsi
,
361 /* 1. create temporary copy of latent_entropy */
362 temp
= create_var(long_unsigned_type_node
, "temp_latent_entropy");
365 add_referenced_var(latent_entropy_decl
);
366 mark_sym_for_renaming(latent_entropy_decl
);
367 assign
= gimple_build_assign(temp
, latent_entropy_decl
);
368 gsi_insert_before(gsi
, assign
, GSI_NEW_STMT
);
371 /* 3. ...modify... */
373 assign
= create_assign(op
, temp
, temp
, local_entropy
);
374 gsi_insert_after(gsi
, assign
, GSI_NEW_STMT
);
377 /* 4. ...write latent_entropy */
378 assign
= gimple_build_assign(latent_entropy_decl
, temp
);
379 gsi_insert_after(gsi
, assign
, GSI_NEW_STMT
);
383 static bool handle_tail_calls(basic_block bb
, tree local_entropy
)
385 gimple_stmt_iterator gsi
;
387 for (gsi
= gsi_start_bb(bb
); !gsi_end_p(gsi
); gsi_next(&gsi
)) {
389 gimple stmt
= gsi_stmt(gsi
);
391 if (!is_gimple_call(stmt
))
394 call
= as_a_gcall(stmt
);
395 if (!gimple_call_tail_p(call
))
398 __perturb_latent_entropy(&gsi
, local_entropy
);
405 static void perturb_latent_entropy(tree local_entropy
)
411 gcc_assert(single_pred_p(EXIT_BLOCK_PTR_FOR_FN(cfun
)));
412 last_bb_e
= single_pred_edge(EXIT_BLOCK_PTR_FOR_FN(cfun
));
414 FOR_EACH_EDGE(e
, ei
, last_bb_e
->src
->preds
) {
415 if (ENTRY_BLOCK_PTR_FOR_FN(cfun
) == e
->src
)
417 if (EXIT_BLOCK_PTR_FOR_FN(cfun
) == e
->src
)
420 handle_tail_calls(e
->src
, local_entropy
);
423 last_bb
= single_pred(EXIT_BLOCK_PTR_FOR_FN(cfun
));
424 if (!handle_tail_calls(last_bb
, local_entropy
)) {
425 gimple_stmt_iterator gsi
= gsi_last_bb(last_bb
);
427 __perturb_latent_entropy(&gsi
, local_entropy
);
431 static void init_local_entropy(basic_block bb
, tree local_entropy
)
434 tree frame_addr
, rand_const
, tmp
, fndecl
, udi_frame_addr
;
436 unsigned HOST_WIDE_INT rand_cst
;
437 gimple_stmt_iterator gsi
= gsi_after_labels(bb
);
439 /* 1. create local_entropy_frameaddr */
440 frame_addr
= create_var(ptr_type_node
, "local_entropy_frameaddr");
442 /* 2. local_entropy_frameaddr = __builtin_frame_address() */
443 fndecl
= builtin_decl_implicit(BUILT_IN_FRAME_ADDRESS
);
444 call
= gimple_build_call(fndecl
, 1, integer_zero_node
);
445 gimple_call_set_lhs(call
, frame_addr
);
446 gsi_insert_before(&gsi
, call
, GSI_NEW_STMT
);
449 udi_frame_addr
= fold_convert(long_unsigned_type_node
, frame_addr
);
450 assign
= gimple_build_assign(local_entropy
, udi_frame_addr
);
451 gsi_insert_after(&gsi
, assign
, GSI_NEW_STMT
);
454 /* 3. create temporary copy of latent_entropy */
455 tmp
= create_var(long_unsigned_type_node
, "temp_latent_entropy");
457 /* 4. read the global entropy variable into local entropy */
458 add_referenced_var(latent_entropy_decl
);
459 mark_sym_for_renaming(latent_entropy_decl
);
460 assign
= gimple_build_assign(tmp
, latent_entropy_decl
);
461 gsi_insert_after(&gsi
, assign
, GSI_NEW_STMT
);
464 /* 5. mix local_entropy_frameaddr into local entropy */
465 assign
= create_assign(BIT_XOR_EXPR
, local_entropy
, local_entropy
, tmp
);
466 gsi_insert_after(&gsi
, assign
, GSI_NEW_STMT
);
469 rand_cst
= get_random_const();
470 rand_const
= build_int_cstu(long_unsigned_type_node
, rand_cst
);
472 assign
= create_assign(op
, local_entropy
, local_entropy
, rand_const
);
473 gsi_insert_after(&gsi
, assign
, GSI_NEW_STMT
);
477 static bool create_latent_entropy_decl(void)
479 varpool_node_ptr node
;
481 if (latent_entropy_decl
!= NULL_TREE
)
484 FOR_EACH_VARIABLE(node
) {
485 tree name
, var
= NODE_DECL(node
);
487 if (DECL_NAME_LENGTH(var
) < sizeof("latent_entropy") - 1)
490 name
= DECL_NAME(var
);
491 if (strcmp(IDENTIFIER_POINTER(name
), "latent_entropy"))
494 latent_entropy_decl
= var
;
498 return latent_entropy_decl
!= NULL_TREE
;
501 static unsigned int latent_entropy_execute(void)
506 if (!create_latent_entropy_decl())
509 /* prepare for step 2 below */
510 gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun
)));
511 bb
= single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun
));
512 if (!single_pred_p(bb
)) {
513 split_edge(single_succ_edge(ENTRY_BLOCK_PTR_FOR_FN(cfun
)));
514 gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun
)));
515 bb
= single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun
));
518 /* 1. create the local entropy variable */
519 local_entropy
= create_var(long_unsigned_type_node
, "local_entropy");
521 /* 2. initialize the local entropy variable */
522 init_local_entropy(bb
, local_entropy
);
527 * 3. instrument each BB with an operation on the
528 * local entropy variable
530 while (bb
!= EXIT_BLOCK_PTR_FOR_FN(cfun
)) {
531 perturb_local_entropy(bb
, local_entropy
);
535 /* 4. mix local entropy into the global entropy variable */
536 perturb_latent_entropy(local_entropy
);
540 static void latent_entropy_start_unit(void *gcc_data __unused
,
541 void *user_data __unused
)
549 /* extern volatile unsigned long latent_entropy */
550 quals
= TYPE_QUALS(long_unsigned_type_node
) | TYPE_QUAL_VOLATILE
;
551 type
= build_qualified_type(long_unsigned_type_node
, quals
);
552 id
= get_identifier("latent_entropy");
553 latent_entropy_decl
= build_decl(UNKNOWN_LOCATION
, VAR_DECL
, id
, type
);
555 TREE_STATIC(latent_entropy_decl
) = 1;
556 TREE_PUBLIC(latent_entropy_decl
) = 1;
557 TREE_USED(latent_entropy_decl
) = 1;
558 DECL_PRESERVE_P(latent_entropy_decl
) = 1;
559 TREE_THIS_VOLATILE(latent_entropy_decl
) = 1;
560 DECL_EXTERNAL(latent_entropy_decl
) = 1;
561 DECL_ARTIFICIAL(latent_entropy_decl
) = 1;
562 lang_hooks
.decls
.pushdecl(latent_entropy_decl
);
565 #define PASS_NAME latent_entropy
566 #define PROPERTIES_REQUIRED PROP_gimple_leh | PROP_cfg
567 #define TODO_FLAGS_FINISH TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func \
569 #include "gcc-generate-gimple-pass.h"
571 __visible
int plugin_init(struct plugin_name_args
*plugin_info
,
572 struct plugin_gcc_version
*version
)
575 const char * const plugin_name
= plugin_info
->base_name
;
576 const int argc
= plugin_info
->argc
;
577 const struct plugin_argument
* const argv
= plugin_info
->argv
;
581 * Call get_random_seed() with noinit=true, so that this returns
582 * 0 in the case where no seed has been passed via -frandom-seed.
584 deterministic_seed
= get_random_seed(true);
586 static const struct ggc_root_tab gt_ggc_r_gt_latent_entropy
[] = {
588 .base
= &latent_entropy_decl
,
590 .stride
= sizeof(latent_entropy_decl
),
591 .cb
= >_ggc_mx_tree_node
,
592 .pchw
= >_pch_nx_tree_node
597 PASS_INFO(latent_entropy
, "optimized", 1, PASS_POS_INSERT_BEFORE
);
599 if (!plugin_default_version_check(version
, &gcc_version
)) {
600 error(G_("incompatible gcc/plugin versions"));
604 for (i
= 0; i
< argc
; ++i
) {
605 if (!(strcmp(argv
[i
].key
, "disable"))) {
609 error(G_("unknown option '-fplugin-arg-%s-%s'"), plugin_name
, argv
[i
].key
);
612 register_callback(plugin_name
, PLUGIN_INFO
, NULL
,
613 &latent_entropy_plugin_info
);
615 register_callback(plugin_name
, PLUGIN_START_UNIT
,
616 &latent_entropy_start_unit
, NULL
);
617 register_callback(plugin_name
, PLUGIN_REGISTER_GGC_ROOTS
,
618 NULL
, (void *)>_ggc_r_gt_latent_entropy
);
619 register_callback(plugin_name
, PLUGIN_PASS_MANAGER_SETUP
, NULL
,
620 &latent_entropy_pass_info
);
622 register_callback(plugin_name
, PLUGIN_ATTRIBUTES
, register_attributes
,