2 * Copyright 2012-2016 by the PaX Team <pageexec@freemail.hu>
3 * Copyright 2016 by Emese Revfy <re.emese@gmail.com>
4 * Licensed under the GPL v2
6 * Note: the choice of the license means that the compilation process is
7 * NOT 'eligible' as defined by gcc's library exception to the GPL v3,
8 * but for the kernel it doesn't matter since it doesn't link against
9 * any of the gcc libraries
11 * This gcc plugin helps generate a little bit of entropy from program state,
12 * used throughout the uptime of the kernel. Here is an instrumentation example:
15 * void __latent_entropy test(int argc, char *argv[])
18 * printf("%s: no command arguments :(\n", *argv);
20 * printf("%s: %d command arguments!\n", *argv, args - 1);
24 * void __latent_entropy test(int argc, char *argv[])
26 * // latent_entropy_execute() 1.
27 * unsigned long local_entropy;
28 * // init_local_entropy() 1.
29 * void *local_entropy_frameaddr;
30 * // init_local_entropy() 3.
31 * unsigned long tmp_latent_entropy;
33 * // init_local_entropy() 2.
34 * local_entropy_frameaddr = __builtin_frame_address(0);
35 * local_entropy = (unsigned long) local_entropy_frameaddr;
37 * // init_local_entropy() 4.
38 * tmp_latent_entropy = latent_entropy;
39 * // init_local_entropy() 5.
40 * local_entropy ^= tmp_latent_entropy;
42 * // latent_entropy_execute() 3.
44 * // perturb_local_entropy()
45 * local_entropy += 4623067384293424948;
46 * printf("%s: no command arguments :(\n", *argv);
47 * // perturb_local_entropy()
49 * local_entropy ^= 3896280633962944730;
50 * printf("%s: %d command arguments!\n", *argv, args - 1);
53 * // latent_entropy_execute() 4.
54 * tmp_latent_entropy = rol(tmp_latent_entropy, local_entropy);
55 * latent_entropy = tmp_latent_entropy;
59 * - add ipa pass to identify not explicitly marked candidate functions
60 * - mix in more program state (function arguments/return values,
61 * loop variables, etc)
62 * - more instrumentation control via attribute parameters
68 * -fplugin-arg-latent_entropy_plugin-disable
70 * Attribute: __attribute__((latent_entropy))
71 * The latent_entropy gcc attribute can be only on functions and variables.
72 * If it is on a function then the plugin will instrument it. If the attribute
73 * is on a variable then the plugin will initialize it with a random value.
74 * The variable must be an integer, an integer array type or a structure
75 * with integer fields.
78 #include "gcc-common.h"
80 int plugin_is_GPL_compatible
;
82 static GTY(()) tree latent_entropy_decl
;
84 static struct plugin_info latent_entropy_plugin_info
= {
85 .version
= "201606141920vanilla",
86 .help
= "disable\tturn off latent entropy instrumentation\n",
89 static unsigned HOST_WIDE_INT seed
;
91 * get_random_seed() (this is a GCC function) generates the seed.
92 * This is a simple random generator without any cryptographic security because
93 * the entropy doesn't come from here.
95 static unsigned HOST_WIDE_INT
get_random_const(void)
98 unsigned HOST_WIDE_INT ret
= 0;
100 for (i
= 0; i
< 8 * sizeof(ret
); i
++) {
101 ret
= (ret
<< 1) | (seed
& 1);
104 seed
^= 0xD800000000000000ULL
;
110 static tree
tree_get_random_const(tree type
)
112 unsigned long long mask
;
114 mask
= 1ULL << (TREE_INT_CST_LOW(TYPE_SIZE(type
)) - 1);
115 mask
= 2 * (mask
- 1) + 1;
117 if (TYPE_UNSIGNED(type
))
118 return build_int_cstu(type
, mask
& get_random_const());
119 return build_int_cst(type
, mask
& get_random_const());
122 static tree
handle_latent_entropy_attribute(tree
*node
, tree name
,
128 #if BUILDING_GCC_VERSION <= 4007
129 VEC(constructor_elt
, gc
) *vals
;
131 vec
<constructor_elt
, va_gc
> *vals
;
134 switch (TREE_CODE(*node
)) {
136 *no_add_attrs
= true;
137 error("%qE attribute only applies to functions and variables",
142 if (DECL_INITIAL(*node
)) {
143 *no_add_attrs
= true;
144 error("variable %qD with %qE attribute must not be initialized",
149 if (!TREE_STATIC(*node
)) {
150 *no_add_attrs
= true;
151 error("variable %qD with %qE attribute must not be local",
156 type
= TREE_TYPE(*node
);
157 switch (TREE_CODE(type
)) {
159 *no_add_attrs
= true;
160 error("variable %qD with %qE attribute must be an integer or a fixed length integer array type or a fixed sized structure with integer fields",
165 tree fld
, lst
= TYPE_FIELDS(type
);
166 unsigned int nelt
= 0;
168 for (fld
= lst
; fld
; nelt
++, fld
= TREE_CHAIN(fld
)) {
171 fieldtype
= TREE_TYPE(fld
);
172 if (TREE_CODE(fieldtype
) == INTEGER_TYPE
)
175 *no_add_attrs
= true;
176 error("structure variable %qD with %qE attribute has a non-integer field %qE",
184 #if BUILDING_GCC_VERSION <= 4007
185 vals
= VEC_alloc(constructor_elt
, gc
, nelt
);
187 vec_alloc(vals
, nelt
);
190 for (fld
= lst
; fld
; fld
= TREE_CHAIN(fld
)) {
191 tree random_const
, fld_t
= TREE_TYPE(fld
);
193 random_const
= tree_get_random_const(fld_t
);
194 CONSTRUCTOR_APPEND_ELT(vals
, fld
, random_const
);
197 /* Initialize the fields with random constants */
198 DECL_INITIAL(*node
) = build_constructor(type
, vals
);
202 /* Initialize the variable with a random constant */
204 DECL_INITIAL(*node
) = tree_get_random_const(type
);
208 tree elt_type
, array_size
, elt_size
;
209 unsigned int i
, nelt
;
210 HOST_WIDE_INT array_size_int
, elt_size_int
;
212 elt_type
= TREE_TYPE(type
);
213 elt_size
= TYPE_SIZE_UNIT(TREE_TYPE(type
));
214 array_size
= TYPE_SIZE_UNIT(type
);
216 if (TREE_CODE(elt_type
) != INTEGER_TYPE
|| !array_size
217 || TREE_CODE(array_size
) != INTEGER_CST
) {
218 *no_add_attrs
= true;
219 error("array variable %qD with %qE attribute must be a fixed length integer array type",
224 array_size_int
= TREE_INT_CST_LOW(array_size
);
225 elt_size_int
= TREE_INT_CST_LOW(elt_size
);
226 nelt
= array_size_int
/ elt_size_int
;
228 #if BUILDING_GCC_VERSION <= 4007
229 vals
= VEC_alloc(constructor_elt
, gc
, nelt
);
231 vec_alloc(vals
, nelt
);
234 for (i
= 0; i
< nelt
; i
++) {
235 tree cst
= size_int(i
);
236 tree rand_cst
= tree_get_random_const(elt_type
);
238 CONSTRUCTOR_APPEND_ELT(vals
, cst
, rand_cst
);
242 * Initialize the elements of the array with random
245 DECL_INITIAL(*node
) = build_constructor(type
, vals
);
258 static struct attribute_spec latent_entropy_attr
= {
259 .name
= "latent_entropy",
262 .decl_required
= true,
263 .type_required
= false,
264 .function_type_required
= false,
265 .handler
= handle_latent_entropy_attribute
,
266 #if BUILDING_GCC_VERSION >= 4007
267 .affects_type_identity
= false
271 static void register_attributes(void *event_data __unused
, void *data __unused
)
273 register_attribute(&latent_entropy_attr
);
276 static bool latent_entropy_gate(void)
280 /* don't bother with noreturn functions for now */
281 if (TREE_THIS_VOLATILE(current_function_decl
))
284 /* gcc-4.5 doesn't discover some trivial noreturn functions */
285 if (EDGE_COUNT(EXIT_BLOCK_PTR_FOR_FN(cfun
)->preds
) == 0)
288 list
= DECL_ATTRIBUTES(current_function_decl
);
289 return lookup_attribute("latent_entropy", list
) != NULL_TREE
;
292 static tree
create_var(tree type
, const char *name
)
296 var
= create_tmp_var(type
, name
);
297 add_referenced_var(var
);
298 mark_sym_for_renaming(var
);
303 * Set up the next operation and its constant operand to use in the latent
304 * entropy PRNG. When RHS is specified, the request is for perturbing the
305 * local latent entropy variable, otherwise it is for perturbing the global
306 * latent entropy variable where the two operands are already given by the
307 * local and global latent entropy variables themselves.
309 * The operation is one of add/xor/rol when instrumenting the local entropy
310 * variable and one of add/xor when perturbing the global entropy variable.
311 * Rotation is not used for the latter case because it would transmit less
312 * entropy to the global variable than the other two operations.
314 static enum tree_code
get_op(tree
*rhs
)
316 static enum tree_code op
;
317 unsigned HOST_WIDE_INT random_const
;
319 random_const
= get_random_const();
330 * This code limits the value of random_const to
331 * the size of a wide int for the rotation
333 random_const
&= HOST_BITS_PER_WIDE_INT
- 1;
343 *rhs
= build_int_cstu(unsigned_intDI_type_node
, random_const
);
347 static gimple
create_assign(enum tree_code code
, tree lhs
, tree op1
,
350 return gimple_build_assign_with_ops(code
, lhs
, op1
, op2
);
353 static void perturb_local_entropy(basic_block bb
, tree local_entropy
)
355 gimple_stmt_iterator gsi
;
361 assign
= create_assign(op
, local_entropy
, local_entropy
, rhs
);
362 gsi
= gsi_after_labels(bb
);
363 gsi_insert_before(&gsi
, assign
, GSI_NEW_STMT
);
367 static void __perturb_latent_entropy(gimple_stmt_iterator
*gsi
,
374 /* 1. create temporary copy of latent_entropy */
375 temp
= create_var(unsigned_intDI_type_node
, "tmp_latent_entropy");
378 add_referenced_var(latent_entropy_decl
);
379 mark_sym_for_renaming(latent_entropy_decl
);
380 assign
= gimple_build_assign(temp
, latent_entropy_decl
);
381 gsi_insert_before(gsi
, assign
, GSI_NEW_STMT
);
384 /* 3. ...modify... */
386 assign
= create_assign(op
, temp
, temp
, local_entropy
);
387 gsi_insert_after(gsi
, assign
, GSI_NEW_STMT
);
390 /* 4. ...write latent_entropy */
391 assign
= gimple_build_assign(latent_entropy_decl
, temp
);
392 gsi_insert_after(gsi
, assign
, GSI_NEW_STMT
);
396 static bool handle_tail_calls(basic_block bb
, tree local_entropy
)
398 gimple_stmt_iterator gsi
;
400 for (gsi
= gsi_start_bb(bb
); !gsi_end_p(gsi
); gsi_next(&gsi
)) {
402 gimple stmt
= gsi_stmt(gsi
);
404 if (!is_gimple_call(stmt
))
407 call
= as_a_gcall(stmt
);
408 if (!gimple_call_tail_p(call
))
411 __perturb_latent_entropy(&gsi
, local_entropy
);
418 static void perturb_latent_entropy(tree local_entropy
)
424 gcc_assert(single_pred_p(EXIT_BLOCK_PTR_FOR_FN(cfun
)));
425 last_bb_e
= single_pred_edge(EXIT_BLOCK_PTR_FOR_FN(cfun
));
427 FOR_EACH_EDGE(e
, ei
, last_bb_e
->src
->preds
) {
428 if (ENTRY_BLOCK_PTR_FOR_FN(cfun
) == e
->src
)
430 if (EXIT_BLOCK_PTR_FOR_FN(cfun
) == e
->src
)
433 handle_tail_calls(e
->src
, local_entropy
);
436 last_bb
= single_pred(EXIT_BLOCK_PTR_FOR_FN(cfun
));
437 if (!handle_tail_calls(last_bb
, local_entropy
)) {
438 gimple_stmt_iterator gsi
= gsi_last_bb(last_bb
);
440 __perturb_latent_entropy(&gsi
, local_entropy
);
444 static void init_local_entropy(basic_block bb
, tree local_entropy
)
447 tree frame_addr
, rand_const
, tmp
, fndecl
, udi_frame_addr
;
449 unsigned HOST_WIDE_INT rand_cst
;
450 gimple_stmt_iterator gsi
= gsi_after_labels(bb
);
452 /* 1. create local_entropy_frameaddr */
453 frame_addr
= create_var(ptr_type_node
, "local_entropy_frameaddr");
455 /* 2. local_entropy_frameaddr = __builtin_frame_address() */
456 fndecl
= builtin_decl_implicit(BUILT_IN_FRAME_ADDRESS
);
457 call
= gimple_build_call(fndecl
, 1, integer_zero_node
);
458 gimple_call_set_lhs(call
, frame_addr
);
459 gsi_insert_before(&gsi
, call
, GSI_NEW_STMT
);
462 udi_frame_addr
= fold_convert(unsigned_intDI_type_node
, frame_addr
);
463 assign
= gimple_build_assign(local_entropy
, udi_frame_addr
);
464 gsi_insert_after(&gsi
, assign
, GSI_NEW_STMT
);
467 /* 3. create temporary copy of latent_entropy */
468 tmp
= create_var(unsigned_intDI_type_node
, "tmp_latent_entropy");
470 /* 4. read the global entropy variable into local entropy */
471 add_referenced_var(latent_entropy_decl
);
472 mark_sym_for_renaming(latent_entropy_decl
);
473 assign
= gimple_build_assign(tmp
, latent_entropy_decl
);
474 gsi_insert_after(&gsi
, assign
, GSI_NEW_STMT
);
477 /* 5. mix local_entropy_frameaddr into local entropy */
478 assign
= create_assign(BIT_XOR_EXPR
, local_entropy
, local_entropy
, tmp
);
479 gsi_insert_after(&gsi
, assign
, GSI_NEW_STMT
);
482 rand_cst
= get_random_const();
483 rand_const
= build_int_cstu(unsigned_intDI_type_node
, rand_cst
);
485 assign
= create_assign(op
, local_entropy
, local_entropy
, rand_const
);
486 gsi_insert_after(&gsi
, assign
, GSI_NEW_STMT
);
490 static bool create_latent_entropy_decl(void)
492 varpool_node_ptr node
;
494 if (latent_entropy_decl
!= NULL_TREE
)
497 FOR_EACH_VARIABLE(node
) {
498 tree name
, var
= NODE_DECL(node
);
500 if (DECL_NAME_LENGTH(var
) < sizeof("latent_entropy") - 1)
503 name
= DECL_NAME(var
);
504 if (strcmp(IDENTIFIER_POINTER(name
), "latent_entropy"))
507 latent_entropy_decl
= var
;
511 return latent_entropy_decl
!= NULL_TREE
;
514 static unsigned int latent_entropy_execute(void)
519 if (!create_latent_entropy_decl())
522 /* prepare for step 2 below */
523 gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun
)));
524 bb
= single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun
));
525 if (!single_pred_p(bb
)) {
526 split_edge(single_succ_edge(ENTRY_BLOCK_PTR_FOR_FN(cfun
)));
527 gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun
)));
528 bb
= single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun
));
531 /* 1. create the local entropy variable */
532 local_entropy
= create_var(unsigned_intDI_type_node
, "local_entropy");
534 /* 2. initialize the local entropy variable */
535 init_local_entropy(bb
, local_entropy
);
540 * 3. instrument each BB with an operation on the
541 * local entropy variable
543 while (bb
!= EXIT_BLOCK_PTR_FOR_FN(cfun
)) {
544 perturb_local_entropy(bb
, local_entropy
);
548 /* 4. mix local entropy into the global entropy variable */
549 perturb_latent_entropy(local_entropy
);
553 static void latent_entropy_start_unit(void *gcc_data __unused
,
554 void *user_data __unused
)
559 seed
= get_random_seed(false);
564 /* extern volatile u64 latent_entropy */
565 gcc_assert(TYPE_PRECISION(long_long_unsigned_type_node
) == 64);
566 quals
= TYPE_QUALS(long_long_unsigned_type_node
) | TYPE_QUAL_VOLATILE
;
567 type
= build_qualified_type(long_long_unsigned_type_node
, quals
);
568 id
= get_identifier("latent_entropy");
569 latent_entropy_decl
= build_decl(UNKNOWN_LOCATION
, VAR_DECL
, id
, type
);
571 TREE_STATIC(latent_entropy_decl
) = 1;
572 TREE_PUBLIC(latent_entropy_decl
) = 1;
573 TREE_USED(latent_entropy_decl
) = 1;
574 DECL_PRESERVE_P(latent_entropy_decl
) = 1;
575 TREE_THIS_VOLATILE(latent_entropy_decl
) = 1;
576 DECL_EXTERNAL(latent_entropy_decl
) = 1;
577 DECL_ARTIFICIAL(latent_entropy_decl
) = 1;
578 lang_hooks
.decls
.pushdecl(latent_entropy_decl
);
581 #define PASS_NAME latent_entropy
582 #define PROPERTIES_REQUIRED PROP_gimple_leh | PROP_cfg
583 #define TODO_FLAGS_FINISH TODO_verify_ssa | TODO_verify_stmts | TODO_dump_func \
585 #include "gcc-generate-gimple-pass.h"
587 int plugin_init(struct plugin_name_args
*plugin_info
,
588 struct plugin_gcc_version
*version
)
591 const char * const plugin_name
= plugin_info
->base_name
;
592 const int argc
= plugin_info
->argc
;
593 const struct plugin_argument
* const argv
= plugin_info
->argv
;
596 struct register_pass_info latent_entropy_pass_info
;
598 latent_entropy_pass_info
.pass
= make_latent_entropy_pass();
599 latent_entropy_pass_info
.reference_pass_name
= "optimized";
600 latent_entropy_pass_info
.ref_pass_instance_number
= 1;
601 latent_entropy_pass_info
.pos_op
= PASS_POS_INSERT_BEFORE
;
602 static const struct ggc_root_tab gt_ggc_r_gt_latent_entropy
[] = {
604 .base
= &latent_entropy_decl
,
606 .stride
= sizeof(latent_entropy_decl
),
607 .cb
= >_ggc_mx_tree_node
,
608 .pchw
= >_pch_nx_tree_node
613 if (!plugin_default_version_check(version
, &gcc_version
)) {
614 error(G_("incompatible gcc/plugin versions"));
618 for (i
= 0; i
< argc
; ++i
) {
619 if (!(strcmp(argv
[i
].key
, "disable"))) {
623 error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name
, argv
[i
].key
);
626 register_callback(plugin_name
, PLUGIN_INFO
, NULL
,
627 &latent_entropy_plugin_info
);
629 register_callback(plugin_name
, PLUGIN_START_UNIT
,
630 &latent_entropy_start_unit
, NULL
);
631 register_callback(plugin_name
, PLUGIN_REGISTER_GGC_ROOTS
,
632 NULL
, (void *)>_ggc_r_gt_latent_entropy
);
633 register_callback(plugin_name
, PLUGIN_PASS_MANAGER_SETUP
, NULL
,
634 &latent_entropy_pass_info
);
636 register_callback(plugin_name
, PLUGIN_ATTRIBUTES
, register_attributes
,