From patchwork Thu Jan 9 16:02:46 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Julien Thierry X-Patchwork-Id: 11326339 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id A7305138D for ; Thu, 9 Jan 2020 19:32:53 +0000 (UTC) Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.kernel.org (Postfix) with SMTP id 936CC2051A for ; Thu, 9 Jan 2020 19:32:52 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="RARJ8a4K" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 936CC2051A Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kernel-hardening-return-17557-patchwork-kernel-hardening=patchwork.kernel.org@lists.openwall.com Received: (qmail 7564 invoked by uid 550); 9 Jan 2020 19:32:50 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Delivered-To: moderator for kernel-hardening@lists.openwall.com Received: (qmail 1939 invoked from network); 9 Jan 2020 16:08:39 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1578586106; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=rIO2h9KrEYPabWRX3TDhKhoqSrg8+Z2neV2hGtzX3p0=; b=RARJ8a4KEW5xHl9SZK2Fil1zMQgZcN3Ke/qDaVUka6nWDBgWiXCDtmCcEXydtQty2KyA/1 CoePmhUmH3bK0iOmXL9fRcvxPdZZ0aIcuCSDWWQyo4rORgMABIuR+QNO9p4F4Lc47RRAr0 7YveBhvAnHJG87+sWw+MU295nAT+Wzo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=XdbyLSo/LKwv0IS4UY8BmEznN2tnAhqPqp9PsERe1ZM=; b=NE7J3dq2TeL/U4+I1tGLg7yDd7w4Oh5ApN+QWzHb9E5i2rAuBIM4qNfINS0bF8ewFF HDDfVgZ7eyb+wdDWYk+6oDQu+fsem4xsN/eYDQmjeQdOAeU5IISZw3BMjw4R4aHhWpeT 8eDid8/8IlkRbNBaxSLU7lvzdIZ8gVV6TVruZWk2YnEiPzd0h0CUUxlfNs+SJIJl/3NY hBWv5LCsAHjMfN6DsBVsAK/y7MujbuOvyE7wuDFgLudNIPEqWH8e8YP1ygPbj+Zz4639 5R4W9yddHFY6wF9b4m+ZCfXZFI8OR5u8s0rJuIz//FDXmJq1y0ZyF1hunM7GCVdocwQU QDXg== X-Gm-Message-State: APjAAAUaBN3Lr4ytBG3ecAZk6NcluITcoD7St0F+MJe5DHP0+NDeLnKX EDroTeqrQKDEpxGrI2BlfJy/Ho5ra52SGYSg0L3MDx8gd5/zRDsVubKiVeEBPKYgr4tZnrvb18E Iz23kSe9B2iuU6/Oyk41CGR64MMOqWZJrrw== X-Received: by 2002:a7b:c935:: with SMTP id h21mr5629110wml.173.1578586100899; Thu, 09 Jan 2020 08:08:20 -0800 (PST) X-Google-Smtp-Source: APXvYqybaGwF2SifAH/vF/5c/Zg4lZFldMQtCNPmw+l0nkZ5ezrMFKLX54upiO65e6Aqyi7sdLTdig== X-Received: by 2002:a7b:c935:: with SMTP id h21mr5629084wml.173.1578586100669; Thu, 09 Jan 2020 08:08:20 -0800 (PST) From: Julien Thierry To: linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org Cc: jpoimboe@redhat.com, peterz@infradead.org, raphael.gault@arm.com, catalin.marinas@arm.com, will@kernel.org, Julien Thierry , Masahiro Yamada , Michal Marek , Kees Cook , Emese Revfy , linux-kbuild@vger.kernel.org, kernel-hardening@lists.openwall.com Subject: [RFC v5 43/57] gcc-plugins: objtool: Add plugin to detect switch table on arm64 Date: Thu, 9 Jan 2020 16:02:46 +0000 Message-Id: <20200109160300.26150-44-jthierry@redhat.com> X-Mailer: git-send-email 2.21.1 In-Reply-To: <20200109160300.26150-1-jthierry@redhat.com> References: <20200109160300.26150-1-jthierry@redhat.com> MIME-Version: 1.0 X-MC-Unique: 95rmweW2OMiDK0b4Dbx5hQ-1 X-Mimecast-Spam-Score: 0 From: Raphael Gault This plugins comes into play before the final 2 RTL passes of GCC and detects switch-tables that are to be outputed in the ELF and writes information in an ".discard.switch_table_info" section which will be used by objtool. Signed-off-by: Raphael Gault [J.T.: Change section name to store switch table information, Make plugin Kconfig be selected rather than opt-in by user, Add a relocation in the switch_table_info that points to the jump operation itself] Signed-off-by: Julien Thierry Cc: Masahiro Yamada Cc: Michal Marek Cc: Kees Cook Cc: Emese Revfy Cc: linux-kbuild@vger.kernel.org Cc: kernel-hardening@lists.openwall.com --- arch/arm64/Kconfig | 1 + scripts/Makefile.gcc-plugins | 2 + scripts/gcc-plugins/Kconfig | 4 + .../arm64_switch_table_detection_plugin.c | 94 +++++++++++++++++++ 4 files changed, 101 insertions(+) create mode 100644 scripts/gcc-plugins/arm64_switch_table_detection_plugin.c -- 2.21.0 diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index b1b4476ddb83..a7b2116d5d13 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -90,6 +90,7 @@ config ARM64 select DMA_DIRECT_REMAP select EDAC_SUPPORT select FRAME_POINTER + select GCC_PLUGIN_SWITCH_TABLES if STACK_VALIDATION select GENERIC_ALLOCATOR select GENERIC_ARCH_TOPOLOGY select GENERIC_CLOCKEVENTS diff --git a/scripts/Makefile.gcc-plugins b/scripts/Makefile.gcc-plugins index 5f7df50cfe7a..a56736df9dc2 100644 --- a/scripts/Makefile.gcc-plugins +++ b/scripts/Makefile.gcc-plugins @@ -44,6 +44,8 @@ ifdef CONFIG_GCC_PLUGIN_ARM_SSP_PER_TASK endif export DISABLE_ARM_SSP_PER_TASK_PLUGIN +gcc-plugin-$(CONFIG_GCC_PLUGIN_SWITCH_TABLES) += arm64_switch_table_detection_plugin.so + # All the plugin CFLAGS are collected here in case a build target needs to # filter them out of the KBUILD_CFLAGS. GCC_PLUGINS_CFLAGS := $(strip $(addprefix -fplugin=$(objtree)/scripts/gcc-plugins/, $(gcc-plugin-y)) $(gcc-plugin-cflags-y)) diff --git a/scripts/gcc-plugins/Kconfig b/scripts/gcc-plugins/Kconfig index e3569543bdac..f50047939660 100644 --- a/scripts/gcc-plugins/Kconfig +++ b/scripts/gcc-plugins/Kconfig @@ -112,4 +112,8 @@ config GCC_PLUGIN_ARM_SSP_PER_TASK bool depends on GCC_PLUGINS && ARM +config GCC_PLUGIN_SWITCH_TABLES + bool + depends on GCC_PLUGINS && ARM64 + endif diff --git a/scripts/gcc-plugins/arm64_switch_table_detection_plugin.c b/scripts/gcc-plugins/arm64_switch_table_detection_plugin.c new file mode 100644 index 000000000000..9b8b2ec6a3c8 --- /dev/null +++ b/scripts/gcc-plugins/arm64_switch_table_detection_plugin.c @@ -0,0 +1,94 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include +#include "gcc-common.h" + +__visible int plugin_is_GPL_compatible; + +#define GEN_QUAD(rtx) assemble_integer_with_op(".quad ", rtx) + +/* + * Create an array of metadata for each jump table found in the rtl. + * The metadata contains: + * - A pointer to the table of offsets used for the actual branch + * - A pointer to first instruction of the group getting expanded into an + * acutal jump + * - The number of entries in the table of offsets + * - Whether the offsets in the table are signed or not + */ +static unsigned int arm64_switchtbl_rtl_execute(void) +{ + rtx_insn *insn; + rtx_insn *labelp = NULL; + rtx_jump_table_data *tablep = NULL; + section *swt_sec; + section *curr_sec = current_function_section(); + + swt_sec = get_section(".discard.switch_table_info", + SECTION_EXCLUDE | SECTION_COMMON, NULL); + + for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) { + /* + * Find a tablejump_p INSN (using a dispatch table) + */ + if (!tablejump_p(insn, &labelp, &tablep)) + continue; + + if (labelp && tablep) { + rtx_code_label *label_to_jump; + + /* + * GCC is a bit touchy about adding the label right + * before the jump rtx_insn as it modifies the + * basic_block created for the jump table. + * Make sure we create the label before the whole + * basic_block of the jump table. + */ + label_to_jump = gen_label_rtx(); + SET_LABEL_KIND(label_to_jump, LABEL_NORMAL); + emit_label_before(label_to_jump, insn); + /* Force label to be kept, apparently LABEL_PRESERVE_P is an rvalue :) */ + LABEL_PRESERVE_P(label_to_jump) = 1; + + switch_to_section(swt_sec); + GEN_QUAD(gen_rtx_LABEL_REF(Pmode, labelp)); + GEN_QUAD(gen_rtx_LABEL_REF(Pmode, label_to_jump)); + GEN_QUAD(GEN_INT(GET_NUM_ELEM(tablep->get_labels()))); + GEN_QUAD(GEN_INT(ADDR_DIFF_VEC_FLAGS(tablep).offset_unsigned)); + switch_to_section(curr_sec); + + /* + * Scheduler isn't very happy about leaving labels in + * the middle of jump table basic blocks. + */ + delete_insn(label_to_jump); + } + } + return 0; +} + +#define PASS_NAME arm64_switchtbl_rtl + +#define NO_GATE +#include "gcc-generate-rtl-pass.h" + +__visible int plugin_init(struct plugin_name_args *plugin_info, + struct plugin_gcc_version *version) +{ + const char * const plugin_name = plugin_info->base_name; + int tso = 0; + int i; + + if (!plugin_default_version_check(version, &gcc_version)) { + error(G_("incompatible gcc/plugin versions")); + return 1; + } + + PASS_INFO(arm64_switchtbl_rtl, "expand", 1, + PASS_POS_INSERT_AFTER); + + register_callback(plugin_info->base_name, PLUGIN_PASS_MANAGER_SETUP, + NULL, &arm64_switchtbl_rtl_pass_info); + + return 0; +}