2 * Copyright 2012-2016 by the PaX Team <pageexec@freemail.hu>
3 * Copyright 2016 by Emese Revfy <re.emese@gmail.com>
4 * Licensed under the GPL v2
6 * Note: the choice of the license means that the compilation process is
7 * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
8 * but for the kernel it doesn't matter since it doesn't link against
9 * any of the gcc libraries
11 * This gcc plugin helps generate a little bit of entropy from program state,
12 * used throughout the uptime of the kernel. Here is an instrumentation example:
15 * void __latent_entropy test(int argc, char *argv[])
18 * printf("%s: no command arguments :(\n", *argv);
20 * printf("%s: %d command arguments!\n", *argv, args - 1);
24 * void __latent_entropy test(int argc, char *argv[])
26 * // latent_entropy_execute() 1.
27 * unsigned long local_entropy;
28 * // init_local_entropy() 1.
29 * void *local_entropy_frameaddr;
30 * // init_local_entropy() 3.
31 * unsigned long tmp_latent_entropy;
33 * // init_local_entropy() 2.
34 * local_entropy_frameaddr = __builtin_frame_address(0);
35 * local_entropy = (unsigned long) local_entropy_frameaddr;
37 * // init_local_entropy() 4.
38 * tmp_latent_entropy = latent_entropy;
39 * // init_local_entropy() 5.
40 * local_entropy ^= tmp_latent_entropy;
42 * // latent_entropy_execute() 3.
44 * // perturb_local_entropy()
45 * local_entropy += 4623067384293424948;
46 * printf("%s: no command arguments :(\n", *argv);
47 * // perturb_local_entropy()
49 * local_entropy ^= 3896280633962944730;
50 * printf("%s: %d command arguments!\n", *argv, args - 1);
53 * // latent_entropy_execute() 4.
54 * tmp_latent_entropy = rol(tmp_latent_entropy, local_entropy);
55 * latent_entropy = tmp_latent_entropy;
59 * - add ipa pass to identify not explicitly marked candidate functions
60 * - mix in more program state (function arguments/return values,
61 * loop variables, etc)
62 * - more instrumentation control via attribute parameters
68 * -fplugin-arg-latent_entropy_plugin-disable
70 * Attribute: __attribute__((latent_entropy))
71 * The latent_entropy gcc attribute can be only on functions and variables.
72 * If it is on a function then the plugin will instrument it. If the attribute
73 * is on a variable then the plugin will initialize it with a random value.
74 * The variable must be an integer, an integer array type or a structure
75 * with integer fields.
78 #include "gcc-common.h"
80 __visible
int plugin_is_GPL_compatible
;
82 static GTY(()) tree latent_entropy_decl
;
84 static struct plugin_info latent_entropy_plugin_info
= {
85 .version
= "201606141920vanilla",
86 .help
= "disable\tturn off latent entropy instrumentation\n",
89 static unsigned HOST_WIDE_INT seed
;
91 * get_random_seed() (this is a GCC function) generates the seed.
92 * This is a simple random generator without any cryptographic security because
93 * the entropy doesn't come from here.
95 static unsigned HOST_WIDE_INT
get_random_const(void)
98 unsigned HOST_WIDE_INT ret
= 0;
100 for (i
= 0; i
< 8 * sizeof(ret
); i
++) {
101 ret
= (ret
<< 1) | (seed
& 1);
104 seed
^= 0xD800000000000000ULL
;
110 static tree
tree_get_random_const(tree type
)
112 unsigned long long mask
;
114 mask
= 1ULL << (TREE_INT_CST_LOW(TYPE_SIZE(type
)) - 1);
115 mask
= 2 * (mask
- 1) + 1;
117 if (TYPE_UNSIGNED(type
))
118 return build_int_cstu(type
, mask
& get_random_const());
119 return build_int_cst(type
, mask
& get_random_const());
122 static tree
handle_latent_entropy_attribute(tree
*node
, tree name
,
128 #if BUILDING_GCC_VERSION <= 4007
129 VEC(constructor_elt
, gc
) *vals
;
131 vec
<constructor_elt
, va_gc
> *vals
;
134 switch (TREE_CODE(*node
)) {
136 *no_add_attrs
= true;
137 error("%qE attribute only applies to functions and variables",
142 if (DECL_INITIAL(*node
)) {
143 *no_add_attrs
= true;
144 error("variable %qD with %qE attribute must not be initialized",
149 if (!TREE_STATIC(*node
)) {
150 *no_add_attrs
= true;
151 error("variable %qD with %qE attribute must not be local",
156 type
= TREE_TYPE(*node
);
157 switch (TREE_CODE(type
)) {
159 *no_add_attrs
= true;
160 error("variable %qD with %qE attribute must be an integer or a fixed length integer array type or a fixed sized structure with integer fields",
165 tree fld
, lst
= TYPE_FIELDS(type
);
166 unsigned int nelt
= 0;
168 for (fld
= lst
; fld
; nelt
++, fld
= TREE_CHAIN(fld
)) {
171 fieldtype
= TREE_TYPE(fld
);
172 if (TREE_CODE(fieldtype
) == INTEGER_TYPE
)
175 *no_add_attrs
= true;
176 error("structure variable %qD with %qE attribute has a non-integer field %qE",
184 #if BUILDING_GCC_VERSION <= 4007
185 vals
= VEC_alloc(constructor_elt
, gc
, nelt
);
187 vec_alloc(vals
, nelt
);
190 for (fld
= lst
; fld
; fld
= TREE_CHAIN(fld
)) {
191 tree random_const
, fld_t
= TREE_TYPE(fld
);
193 random_const
= tree_get_random_const(fld_t
);
194 CONSTRUCTOR_APPEND_ELT(vals
, fld
, random_const
);
197 /* Initialize the fields with random constants */
198 DECL_INITIAL(*node
) = build_constructor(type
, vals
);
202 /* Initialize the variable with a random constant */
204 DECL_INITIAL(*node
) = tree_get_random_const(type
);
208 tree elt_type
, array_size
, elt_size
;
209 unsigned int i
, nelt
;
210 HOST_WIDE_INT array_size_int
, elt_size_int
;
212 elt_type
= TREE_TYPE(type
);
213 elt_size
= TYPE_SIZE_UNIT(TREE_TYPE(type
));
214 array_size
= TYPE_SIZE_UNIT(type
);
216 if (TREE_CODE(elt_type
) != INTEGER_TYPE
|| !array_size
217 || TREE_CODE(array_size
) != INTEGER_CST
) {
218 *no_add_attrs
= true;
219 error("array variable %qD with %qE attribute must be a fixed length integer array type",
224 array_size_int
= TREE_INT_CST_LOW(array_size
);
225 elt_size_int
= TREE_INT_CST_LOW(elt_size
);
226 nelt
= array_size_int
/ elt_size_int
;
228 #if BUILDING_GCC_VERSION <= 4007
229 vals
= VEC_alloc(constructor_elt
, gc
, nelt
);
231 vec_alloc(vals
, nelt
);
234 for (i
= 0; i
< nelt
; i
++) {
235 tree cst
= size_int(i
);
236 tree rand_cst
= tree_get_random_const(elt_type
);
238 CONSTRUCTOR_APPEND_ELT(vals
, cst
, rand_cst
);
242 * Initialize the elements of the array with random
245 DECL_INITIAL(*node
) = build_constructor(type
, vals
);
258 static struct attribute_spec latent_entropy_attr
= { };
260 static void register_attributes(void *event_data __unused
, void *data __unused
)
262 latent_entropy_attr
.name
= "latent_entropy";
263 latent_entropy_attr
.decl_required
= true;
264 latent_entropy_attr
.handler
= handle_latent_entropy_attribute
;
266 register_attribute(&latent_entropy_attr
);
269 static bool latent_entropy_gate(void)
273 /* don't bother with noreturn functions for now */
274 if (TREE_THIS_VOLATILE(current_function_decl
))
277 /* gcc-4.5 doesn't discover some trivial noreturn functions */
278 if (EDGE_COUNT(EXIT_BLOCK_PTR_FOR_FN(cfun
)->preds
) == 0)
281 list
= DECL_ATTRIBUTES(current_function_decl
);
282 return lookup_attribute("latent_entropy", list
) != NULL_TREE
;
285 static tree
create_var(tree type
, const char *name
)
289 var
= create_tmp_var(type
, name
);
290 add_referenced_var(var
);
291 mark_sym_for_renaming(var
);
296 * Set up the next operation and its constant operand to use in the latent
297 * entropy PRNG. When RHS is specified, the request is for perturbing the
298 * local latent entropy variable, otherwise it is for perturbing the global
299 * latent entropy variable where the two operands are already given by the
300 * local and global latent entropy variables themselves.
302 * The operation is one of add/xor/rol when instrumenting the local entropy
303 * variable and one of add/xor when perturbing the global entropy variable.
304 * Rotation is not used for the latter case because it would transmit less
305 * entropy to the global variable than the other two operations.
307 static enum tree_code
get_op(tree
*rhs
)
309 static enum tree_code op
;
310 unsigned HOST_WIDE_INT random_const
;
312 random_const
= get_random_const();
323 * This code limits the value of random_const to
324 * the size of a long for the rotation
326 random_const
%= TYPE_PRECISION(long_unsigned_type_node
);
336 *rhs
= build_int_cstu(long_unsigned_type_node
, random_const
);
340 static gimple
create_assign(enum tree_code code
, tree lhs
, tree op1
,
343 return gimple_build_assign_with_ops(code
, lhs
, op1
, op2
);
346 static void perturb_local_entropy(basic_block bb
, tree local_entropy
)
348 gimple_stmt_iterator gsi
;
354 assign
= create_assign(op
, local_entropy
, local_entropy
, rhs
);
355 gsi
= gsi_after_labels(bb
);
356 gsi_insert_before(&gsi
, assign
, GSI_NEW_STMT
);
360 static void __perturb_latent_entropy(gimple_stmt_iterator
*gsi
,
367 /* 1. create temporary copy of latent_entropy */
368 temp
= create_var(long_unsigned_type_node
, "temp_latent_entropy");
371 add_referenced_var(latent_entropy_decl
);
372 mark_sym_for_renaming(latent_entropy_decl
);
373 assign
= gimple_build_assign(temp
, latent_entropy_decl
);
374 gsi_insert_before(gsi
, assign
, GSI_NEW_STMT
);
377 /* 3. ...modify... */
379 assign
= create_assign(op
, temp
, temp
, local_entropy
);
380 gsi_insert_after(gsi
, assign
, GSI_NEW_STMT
);
383 /* 4. ...write latent_entropy */
384 assign
= gimple_build_assign(latent_entropy_decl
, temp
);
385 gsi_insert_after(gsi
, assign
, GSI_NEW_STMT
);
389 static bool handle_tail_calls(basic_block bb
, tree local_entropy
)
391 gimple_stmt_iterator gsi
;
393 for (gsi
= gsi_start_bb(bb
); !gsi_end_p(gsi
); gsi_next(&gsi
)) {
395 gimple stmt
= gsi_stmt(gsi
);
397 if (!is_gimple_call(stmt
))
400 call
= as_a_gcall(stmt
);
401 if (!gimple_call_tail_p(call
))
404 __perturb_latent_entropy(&gsi
, local_entropy
);
411 static void perturb_latent_entropy(tree local_entropy
)
417 gcc_assert(single_pred_p(EXIT_BLOCK_PTR_FOR_FN(cfun
)));
418 last_bb_e
= single_pred_edge(EXIT_BLOCK_PTR_FOR_FN(cfun
));
420 FOR_EACH_EDGE(e
, ei
, last_bb_e
->src
->preds
) {
421 if (ENTRY_BLOCK_PTR_FOR_FN(cfun
) == e
->src
)
423 if (EXIT_BLOCK_PTR_FOR_FN(cfun
) == e
->src
)
426 handle_tail_calls(e
->src
, local_entropy
);
429 last_bb
= single_pred(EXIT_BLOCK_PTR_FOR_FN(cfun
));
430 if (!handle_tail_calls(last_bb
, local_entropy
)) {
431 gimple_stmt_iterator gsi
= gsi_last_bb(last_bb
);
433 __perturb_latent_entropy(&gsi
, local_entropy
);
437 static void init_local_entropy(basic_block bb
, tree local_entropy
)
440 tree frame_addr
, rand_const
, tmp
, fndecl
, udi_frame_addr
;
442 unsigned HOST_WIDE_INT rand_cst
;
443 gimple_stmt_iterator gsi
= gsi_after_labels(bb
);
445 /* 1. create local_entropy_frameaddr */
446 frame_addr
= create_var(ptr_type_node
, "local_entropy_frameaddr");
448 /* 2. local_entropy_frameaddr = __builtin_frame_address() */
449 fndecl
= builtin_decl_implicit(BUILT_IN_FRAME_ADDRESS
);
450 call
= gimple_build_call(fndecl
, 1, integer_zero_node
);
451 gimple_call_set_lhs(call
, frame_addr
);
452 gsi_insert_before(&gsi
, call
, GSI_NEW_STMT
);
455 udi_frame_addr
= fold_convert(long_unsigned_type_node
, frame_addr
);
456 assign
= gimple_build_assign(local_entropy
, udi_frame_addr
);
457 gsi_insert_after(&gsi
, assign
, GSI_NEW_STMT
);
460 /* 3. create temporary copy of latent_entropy */
461 tmp
= create_var(long_unsigned_type_node
, "temp_latent_entropy");
463 /* 4. read the global entropy variable into local entropy */
464 add_referenced_var(latent_entropy_decl
);
465 mark_sym_for_renaming(latent_entropy_decl
);
466 assign
= gimple_build_assign(tmp
, latent_entropy_decl
);
467 gsi_insert_after(&gsi
, assign
, GSI_NEW_STMT
);
470 /* 5. mix local_entropy_frameaddr into local entropy */
471 assign
= create_assign(BIT_XOR_EXPR
, local_entropy
, local_entropy
, tmp
);
472 gsi_insert_after(&gsi
, assign
, GSI_NEW_STMT
);
475 rand_cst
= get_random_const();
476 rand_const
= build_int_cstu(long_unsigned_type_node
, rand_cst
);
478 assign
= create_assign(op
, local_entropy
, local_entropy
, rand_const
);
479 gsi_insert_after(&gsi
, assign
, GSI_NEW_STMT
);
483 static bool create_latent_entropy_decl(void)
485 varpool_node_ptr node
;
487 if (latent_entropy_decl
!= NULL_TREE
)
490 FOR_EACH_VARIABLE(node
) {
491 tree name
, var
= NODE_DECL(node
);
493 if (DECL_NAME_LENGTH(var
) < sizeof("latent_entropy") - 1)
496 name
= DECL_NAME(var
);
497 if (strcmp(IDENTIFIER_POINTER(name
), "latent_entropy"))
500 latent_entropy_decl
= var
;
504 return latent_entropy_decl
!= NULL_TREE
;
507 static unsigned int latent_entropy_execute(void)
512 if (!create_latent_entropy_decl())
515 /* prepare for step 2 below */
516 gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun
)));
517 bb
= single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun
));
518 if (!single_pred_p(bb
)) {
519 split_edge(single_succ_edge(ENTRY_BLOCK_PTR_FOR_FN(cfun
)));
520 gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun
)));
521 bb
= single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun
));
524 /* 1. create the local entropy variable */
525 local_entropy
= create_var(long_unsigned_type_node
, "local_entropy");
527 /* 2. initialize the local entropy variable */
528 init_local_entropy(bb
, local_entropy
);
533 * 3. instrument each BB with an operation on the
534 * local entropy variable
536 while (bb
!= EXIT_BLOCK_PTR_FOR_FN(cfun
)) {
537 perturb_local_entropy(bb
, local_entropy
);
541 /* 4. mix local entropy into the global entropy variable */
542 perturb_latent_entropy(local_entropy
);
546 static void latent_entropy_start_unit(void *gcc_data __unused
,
547 void *user_data __unused
)
552 seed
= get_random_seed(false);
557 /* extern volatile unsigned long latent_entropy */
558 quals
= TYPE_QUALS(long_unsigned_type_node
) | TYPE_QUAL_VOLATILE
;
559 type
= build_qualified_type(long_unsigned_type_node
, quals
);
560 id
= get_identifier("latent_entropy");
561 latent_entropy_decl
= build_decl(UNKNOWN_LOCATION
, VAR_DECL
, id
, type
);
563 TREE_STATIC(latent_entropy_decl
) = 1;
564 TREE_PUBLIC(latent_entropy_decl
) = 1;
565 TREE_USED(latent_entropy_decl
) = 1;
566 DECL_PRESERVE_P(latent_entropy_decl
) = 1;
567 TREE_THIS_VOLATILE(latent_entropy_decl
) = 1;
568 DECL_EXTERNAL(latent_entropy_decl
) = 1;
569 DECL_ARTIFICIAL(latent_entropy_decl
) = 1;
570 lang_hooks
.decls
.pushdecl(latent_entropy_decl
);
573 #define PASS_NAME latent_entropy
574 #define PROPERTIES_REQUIRED PROP_gimple_leh | PROP_cfg
575 #define TODO_FLAGS_FINISH TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func \
577 #include "gcc-generate-gimple-pass.h"
579 __visible
int plugin_init(struct plugin_name_args
*plugin_info
,
580 struct plugin_gcc_version
*version
)
583 const char * const plugin_name
= plugin_info
->base_name
;
584 const int argc
= plugin_info
->argc
;
585 const struct plugin_argument
* const argv
= plugin_info
->argv
;
588 static const struct ggc_root_tab gt_ggc_r_gt_latent_entropy
[] = {
590 .base
= &latent_entropy_decl
,
592 .stride
= sizeof(latent_entropy_decl
),
593 .cb
= >_ggc_mx_tree_node
,
594 .pchw
= >_pch_nx_tree_node
599 PASS_INFO(latent_entropy
, "optimized", 1, PASS_POS_INSERT_BEFORE
);
601 if (!plugin_default_version_check(version
, &gcc_version
)) {
602 error(G_("incompatible gcc/plugin versions"));
606 for (i
= 0; i
< argc
; ++i
) {
607 if (!(strcmp(argv
[i
].key
, "disable"))) {
611 error(G_("unknown option '-fplugin-arg-%s-%s'"), plugin_name
, argv
[i
].key
);
614 register_callback(plugin_name
, PLUGIN_INFO
, NULL
,
615 &latent_entropy_plugin_info
);
617 register_callback(plugin_name
, PLUGIN_START_UNIT
,
618 &latent_entropy_start_unit
, NULL
);
619 register_callback(plugin_name
, PLUGIN_REGISTER_GGC_ROOTS
,
620 NULL
, (void *)>_ggc_r_gt_latent_entropy
);
621 register_callback(plugin_name
, PLUGIN_PASS_MANAGER_SETUP
, NULL
,
622 &latent_entropy_pass_info
);
624 register_callback(plugin_name
, PLUGIN_ATTRIBUTES
, register_attributes
,