libgcc/strub.c

   1 /* Stack scrubbing infrastructure
   2    Copyright (C) 2021-2024 Free Software Foundation, Inc.
   3    Contributed by Alexandre Oliva <oliva@adacore.com>
   4
   5 This file is part of GCC.
   6
   7 GCC is free software; you can redistribute it and/or modify it under
   8 the terms of the GNU General Public License as published by the Free
   9 Software Foundation; either version 3, or (at your option) any later
  10 version.
  11
  12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
  13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
  14 FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  15 for more details.
  16
  17 Under Section 7 of GPL version 3, you are granted additional
  18 permissions described in the GCC Runtime Library Exception, version
  19 3.1, as published by the Free Software Foundation.
  20
  21 You should have received a copy of the GNU General Public License and
  22 a copy of the GCC Runtime Library Exception along with this program;
  23 see the files COPYING3 and COPYING.RUNTIME respectively.  If not, see
  24 <http://www.gnu.org/licenses/>.  */
  25
  26 #include "tconfig.h"
  27 #include "tsystem.h"
  28 #include "coretypes.h"
  29 #include "tm.h"
  30 #include "libgcc_tm.h"
  31 #include "libgcc2.h"
  32
  33 #if ! STACK_GROWS_DOWNWARD
  34 # define TOPS >
  35 #else
  36 # define TOPS <
  37 #endif
  38
  39 /* Make sure these builtins won't be inlined, even with LTO.  */
  40 #define ATTRIBUTE_NOINLINE \
  41   __attribute__ ((__noinline__, __noclone__, __noipa__))
  42
  43 #define ATTRIBUTE_STRUB_CALLABLE \
  44   __attribute__ ((__strub__ ("callable"))) ATTRIBUTE_NOINLINE
  45
  46 /* Enter a stack scrubbing context, initializing the watermark to the caller's
  47    stack address.  */
  48 void ATTRIBUTE_STRUB_CALLABLE
  49 __strub_enter (void **watermark)
  50 {
  51   *watermark = __builtin_frame_address (0);
  52 }
  53
  54 /* Update the watermark within a stack scrubbing context with the current stack
  55    pointer.  */
  56 void ATTRIBUTE_STRUB_CALLABLE
  57 __strub_update (void **watermark)
  58 {
  59   void *sp = __builtin_frame_address (0);
  60
  61   if (sp TOPS *watermark)
  62     *watermark = sp;
  63 }
  64
  65 #if TARGET_STRUB_USE_DYNAMIC_ARRAY && ! defined TARGET_STRUB_MAY_USE_MEMSET
  66 # define TARGET_STRUB_MAY_USE_MEMSET 1
  67 #endif
  68
  69 #if defined __x86_64__ && __OPTIMIZE__
  70 # define TARGET_STRUB_DISABLE_RED_ZONE \
  71   /* __attribute__ ((__target__ ("no-red-zone"))) // not needed when optimizing */
  72 #elif !defined RED_ZONE_SIZE || defined __i386__
  73 # define TARGET_STRUB_DISABLE_RED_ZONE
  74 #endif
  75
  76 #ifndef TARGET_STRUB_DISABLE_RED_ZONE
  77 /* Dummy function, called to force the caller to not be a leaf function, so
  78    that it can't use the red zone.  */
  79 static void ATTRIBUTE_STRUB_CALLABLE
  80 __strub_dummy_force_no_leaf (void)
  81 {
  82 }
  83 #endif
  84
  85 /* Leave a stack scrubbing context, clearing the stack between its top and
  86    *MARK.  */
  87 void ATTRIBUTE_STRUB_CALLABLE
  88 #if ! TARGET_STRUB_MAY_USE_MEMSET
  89 __attribute__ ((__optimize__ ("-fno-tree-loop-distribute-patterns")))
  90 #endif
  91 #ifdef TARGET_STRUB_DISABLE_RED_ZONE
  92 TARGET_STRUB_DISABLE_RED_ZONE
  93 #endif
  94 __strub_leave (void **mark)
  95 {
  96   void *sp = __builtin_stack_address ();
  97
  98   void **base, **end;
  99 #if ! STACK_GROWS_DOWNWARD
 100   base = sp; /* ??? Do we need an offset here?  */
 101   end = *mark;
 102 #else
 103   base = *mark;
 104   end = sp; /* ??? Does any platform require an offset here?  */
 105 #endif
 106
 107   if (! (base < end))
 108     return;
 109
 110 #if TARGET_STRUB_USE_DYNAMIC_ARRAY
 111   /* Compute the length without assuming the pointers are both sufficiently
 112      aligned.  They should be, but pointer differences expected to be exact may
 113      yield unexpected results when the assumption doesn't hold.  Given the
 114      potential security implications, compute the length without that
 115      expectation.  If the pointers are misaligned, we may leave a partial
 116      unscrubbed word behind.  */
 117   ptrdiff_t len = ((char *)end - (char *)base) / sizeof (void *);
 118   /* Allocate a dynamically-sized array covering the desired range, so that we
 119      can safely call memset on it.  */
 120   void *ptr[len];
 121   base = &ptr[0];
 122   end = &ptr[len];
 123 #elifndef TARGET_STRUB_DISABLE_RED_ZONE
 124   /* Prevent the use of the red zone, by making this function non-leaf through
 125      an unreachable call that, because of the asm stmt, the compiler will
 126      consider reachable.  */
 127   asm goto ("" : : : : no_leaf);
 128   if (0)
 129     {
 130     no_leaf:
 131       __strub_dummy_force_no_leaf ();
 132       return;
 133     }
 134 #endif
 135
 136   /* ldist may turn these loops into a memset (thus the conditional
 137      -fno-tree-loop-distribute-patterns above).  Without the dynamic array
 138      above, that call would likely be unsafe: possibly tail-called, and likely
 139      scribbling over its own stack frame.  */
 140 #if ! STACK_GROWS_DOWNWARD
 141   do
 142     *base++ = 0;
 143   while (base < end);
 144   /* Make sure the stack overwrites are not optimized away.  */
 145   asm ("" : : "m" (end[0]));
 146 #else
 147   do
 148     *--end = 0;
 149   while (base < end);
 150   /* Make sure the stack overwrites are not optimized away.  */
 151   asm ("" : : "m" (base[0]));
 152 #endif
 153 }