Add program property and PLT for CFI extension #417

kito-cheng · 2024-01-04T08:27:16Z

We introduce .note.gnu.property section to store infomations that linker or runtime system may use, and we define two bit for landing pad and shadow stack.

Those two bit will checked by loader - and use that info to enable the landing pad checking and/or shadow stack feature.

kito-cheng · 2024-01-04T08:28:07Z

cc @ved-rivos

riscv-elf.adoc

rui314 · 2024-01-05T07:40:53Z

My concern about this proposal is that, with the 32-bit bitmap, we can't have more than 32 extensions. That might be OK for x86-64 that is controlled only by Intel and AMD, but it is likely that we would have way more extensions than x86-64 for RISC-V. I'm not sure even 64 bits is enough. Maybe we should avoid the bitmap completely?

kito-cheng · 2024-01-05T08:06:15Z

@rui314
GNU property is kind of key-value structure, key is 32 bit integer, and we have 536,870,912 can use for the key per the definition of GNU_PROPERTY_LOPROC and GNU_PROPERTY_HIPROC.

/* Processor-specific semantics, lo */
#define GNU_PROPERTY_LOPROC                     0xc0000000
/* Processor-specific semantics, hi */
#define GNU_PROPERTY_HIPROC                     0xdfffffff

So we have 536,870,912 * 32 rather than only 32-bit bitmap :)

rui314 · 2024-01-05T08:58:39Z

@kito-cheng Ah, you are right. Even though I've implemented the feature to the linker, I forgot the actual on-file format. Thank you for pointing that out!

MaskRay · 2024-01-08T00:43:22Z

Thanks for the proposal. On Arm/x86, if all relocatable files contain .note.gnu.property (which contains NT_GNU_PROPERTY_TYPE_0 notes) with the GNU_PROPERTY_X86_FEATURE_1_IBT bit set, the linker will mark the output as compatible with the feature. Assembly files often lack .note.gnu.property, making the CFI features difficult to deploy...

That said, this is most viable proposal. Defining GNU program property looks good for x86/Arm parity.

You may want to mention that n_type is NT_GNU_PROPERTY_TYPE_0.

Add property for CFI extension

"property" is a heavily overloaded term. Consider "program property" or just use .note.gnu.property to be more specific.

sorear · 2024-02-18T18:43:13Z

@kito-cheng Isn't the usefulness of this degraded by the fact that we only allocate 1 32-bit property instead of the ~ 3 * 32768 allocated on x86? When we start to use the next bitmap, an old linker won't be able to propagate it, and so on.

We introduce .note.gnu.property section to store infomations that linker or runtime system may use, and we define 4 program property classes to specifying the merge semantics, it's used for forward compatibility in linker implementations, allowing linker can correctly handle program property types even if they are not recognized. We don't define any program property within this PR, it would be separate PR like #417

kito-cheng · 2024-02-26T09:03:06Z

Split base program property part into #428

We introduce .note.gnu.property section to store infomations that linker or runtime system may use, and we define 4 program property classes to specifying the merge semantics, it's used for forward compatibility in linker implementations, allowing linker can correctly handle program property types even if they are not recognized. We don't define any program property within this PR, it would be separate PR like #417

kito-cheng · 2024-02-26T09:59:23Z

ChangeLog:

Based on Add program property #428
Rename GNU_PROPERTY_RISCV_FEATURE_1_ZICFILP to GNU_PROPERTY_RISCV_FEATURE_1_CFI_LP_SIMPLE
Rename GNU_PROPERTY_RISCV_FEATURE_1_ZICFISS to GNU_PROPERTY_RISCV_FEATURE_1_CFI_SS
Explicitly specify the labeling scheme in GNU_PROPERTY_RISCV_FEATURE_1_CFI_LP_SIMPLE, label will always set to 1.

riscv-elf.adoc

kito-cheng · 2024-02-26T13:52:18Z

Changes:

Explicitly specify the labeling scheme in GNU_PROPERTY_RISCV_FEATURE_1_CFI_LP_SIMPLE, label will always set to 0.
Add simple landing pad PLT.
Add DT_RISCV_SIMPLE_LP_PLT to mark this object use simple landing pad PLT.

We introduce .note.gnu.property section to store infomations that linker or runtime system may use, and we define 4 program property classes to specifying the merge semantics, it's used for forward compatibility in linker implementations, allowing linker can correctly handle program property types even if they are not recognized. We don't define any program property within this PR, it would be separate PR like #417

This patch implements simple landing pad labels [0]. When Zicfilp enabled, this patch inserts `lpad 0` at the beginning of basic blocks which are possible to be landed by indirect jumps. This patch also supports option riscv-landing-pad-label to make users cpable to set nonzero fixed labels. Using nonzero fixed label force setting t2 before indirect jumps. It's less portable but more strict than original implementation. [0]: riscv-non-isa/riscv-elf-psabi-doc#417

This patch is based on llvm#91855. This patch inserts simple landing pad ([pr])before indirct jumps. And also make option riscv-landing-pad-label influence this feature. [pr]: riscv-non-isa/riscv-elf-psabi-doc#417

We introduce .note.gnu.property section to store infomations that linker or runtime system may use, and we define 4 program property classes to specifying the merge semantics, it's used for forward compatibility in linker implementations, allowing linker can correctly handle program property types even if they are not recognized. We don't define any program property within this PR, it would be separate PR like #417

Define two bit for landing pad and shadow stack, and we plan to defined third bit `GNU_PROPERTY_RISCV_FEATURE_1_CFI_LP_COMPLEX` for complex labeling scheme.

Changes: - Rename `GNU_PROPERTY_RISCV_FEATURE_1_CFI_LP_SIMPLE` to `GNU_PROPERTY_RISCV_FEATURE_1_CFI_LP_UNLABELED` - Fix wrong offset in the first PLT stubs for the simple landing pad PLT.

kito-cheng · 2024-07-17T08:03:15Z

Changes:

Rename GNU_PROPERTY_RISCV_FEATURE_1_CFI_LP_SIMPLE to GNU_PROPERTY_RISCV_FEATURE_1_CFI_LP_UNLABELED
Fix wrong offset in the first PLT stubs for the simple landing pad PLT.

This patch implements simple landing pad labels [0]. When Zicfilp enabled, this patch inserts `lpad 0` at the beginning of basic blocks which are possible to be landed by indirect jumps. This patch also supports option riscv-landing-pad-label to make users cpable to set nonzero fixed labels. Using nonzero fixed label force setting t2 before indirect jumps. It's less portable but more strict than original implementation. [0]: riscv-non-isa/riscv-elf-psabi-doc#417

This is cherry-picked from upstream pr #91860. This patch is based on #91855. This patch inserts simple landing pad ([pr])before indirct jumps. And also make option riscv-landing-pad-label influence this feature. [pr]: riscv-non-isa/riscv-elf-psabi-doc#417

This patch implements simple landing pad labels [0]. When Zicfilp enabled, this patch inserts `lpad 0` at the beginning of basic blocks which are possible to be landed by indirect jumps. This patch also supports option riscv-landing-pad-label to make users cpable to set nonzero fixed labels. Using nonzero fixed label force setting t2 before indirect jumps. It's less portable but more strict than original implementation. [0]: riscv-non-isa/riscv-elf-psabi-doc#417

This patch is based on llvm#91855. This patch inserts simple landing pad ([pr])before indirct jumps. And also make option riscv-landing-pad-label influence this feature. [pr]: riscv-non-isa/riscv-elf-psabi-doc#417

This patch implements simple landing pad labels ([pr]). When Zicfilp enabled, this patch inserts `lpad 0` at the beginning of basic blocks which are possible to be landed by indirect jumps. This patch also supports option riscv-landing-pad-label to make users cpable to set nonzero fixed labels. Using nonzero fixed label force setting t2 before indirect jumps. It's less portable but more strict than original implementation. [pr]: riscv-non-isa/riscv-elf-psabi-doc#417

This patch is based on llvm#91855. This patch inserts simple landing pad ([pr])before indirct jumps. And also make option riscv-landing-pad-label influence this feature. [pr]: riscv-non-isa/riscv-elf-psabi-doc#417

This patch implements simple landing pad labels ([pr]). When Zicfilp enabled, this patch inserts `lpad 0` at the beginning of basic blocks which are possible to be landed by indirect jumps. This patch also supports option riscv-landing-pad-label to make users cpable to set nonzero fixed labels. Using nonzero fixed label force setting t2 before indirect jumps. It's less portable but more strict than original implementation. [pr]: riscv-non-isa/riscv-elf-psabi-doc#417

…91860) This patch is based on #91855. This patch inserts simple landing pad ([pr])before indirct jumps. And this also make option riscv-landing-pad-label influence this feature. [pr]: riscv-non-isa/riscv-elf-psabi-doc#417

This patch implements simple landing pad labels ([pr]). When Zicfilp enabled, this patch inserts `lpad 0` at the beginning of basic blocks which are possible to be landed by indirect jumps. This patch also supports option riscv-landing-pad-label to make users cpable to set nonzero fixed labels. Using nonzero fixed label force setting t2 before indirect jumps. It's less portable but more strict than original implementation. [pr]: riscv-non-isa/riscv-elf-psabi-doc#417

…lvm#91860) This patch is based on llvm#91855. This patch inserts simple landing pad ([pr])before indirct jumps. And this also make option riscv-landing-pad-label influence this feature. [pr]: riscv-non-isa/riscv-elf-psabi-doc#417

kito-cheng requested review from asb, rui314, MaskRay, jrtc27, aswaterman and Nelson1225 January 4, 2024 08:27

ved-rivos reviewed Jan 4, 2024

View reviewed changes

riscv-elf.adoc Outdated Show resolved Hide resolved

ved-rivos reviewed Jan 4, 2024

View reviewed changes

riscv-elf.adoc Outdated Show resolved Hide resolved

ved-rivos reviewed Jan 4, 2024

View reviewed changes

riscv-elf.adoc Show resolved Hide resolved

kito-cheng changed the title ~~Add property for CFI extension~~ Add program property for CFI extension Jan 11, 2024

kito-cheng mentioned this pull request Feb 2, 2024

Allocate e_flags for landing pad and shadow stack #395

Closed

topperc mentioned this pull request Feb 5, 2024

[RISCV] Add Zicfiss support to the shadow call stack implementation. llvm/llvm-project#68075

Merged

SuHo-llrr mentioned this pull request Feb 15, 2024

[RISCV] Support .note.gnu.property for enable Zicfiss and Zicfilp extension llvm/llvm-project#77414

Open

kito-cheng mentioned this pull request Feb 26, 2024

Add program property #428

Merged

kito-cheng changed the base branch from master to prog-prop February 26, 2024 09:56

kito-cheng force-pushed the cfi-prop branch from 1e785fa to 6b5ef1b Compare February 26, 2024 09:57

ved-rivos reviewed Feb 26, 2024

View reviewed changes

riscv-elf.adoc Outdated Show resolved Hide resolved

kito-cheng force-pushed the cfi-prop branch from 59ceceb to 6016e63 Compare February 26, 2024 12:43

kito-cheng changed the title ~~Add program property for CFI extension~~ Add program property and PLT for CFI extension Feb 26, 2024

kito-cheng force-pushed the cfi-prop branch from c992d06 to be1260b Compare July 16, 2024 14:02

kito-cheng force-pushed the prog-prop branch from 31ba3a1 to 9ee857d Compare July 16, 2024 14:03

kito-cheng added 7 commits July 17, 2024 15:45

Add program property for CFI extension

e033d40

Define two bit for landing pad and shadow stack, and we plan to defined third bit `GNU_PROPERTY_RISCV_FEATURE_1_CFI_LP_COMPLEX` for complex labeling scheme.

Tweak table layout

42b788a

Update simple labeling scheme to use 0

e329ce7

Add simple landing pad PLT

281d12e

Drop DT_RISCV_SIMPLE_LP_PLT

21f36c4

Add one more nop for alignment

a56680d

Minor revision

a2ce820

Changes: - Rename `GNU_PROPERTY_RISCV_FEATURE_1_CFI_LP_SIMPLE` to `GNU_PROPERTY_RISCV_FEATURE_1_CFI_LP_UNLABELED` - Fix wrong offset in the first PLT stubs for the simple landing pad PLT.

kito-cheng force-pushed the cfi-prop branch from be1260b to a2ce820 Compare July 17, 2024 08:02

Base automatically changed from prog-prop to master August 2, 2024 06:48

kito-cheng mentioned this pull request Sep 5, 2024

Add options for enable code gen with CFI `-fcf-protection=[full|branc… riscv-non-isa/riscv-toolchain-conventions#54

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add program property and PLT for CFI extension #417

Add program property and PLT for CFI extension #417

kito-cheng commented Jan 4, 2024

kito-cheng commented Jan 4, 2024

rui314 commented Jan 5, 2024

kito-cheng commented Jan 5, 2024

rui314 commented Jan 5, 2024

MaskRay commented Jan 8, 2024 •

edited

Loading

sorear commented Feb 18, 2024

kito-cheng commented Feb 26, 2024

kito-cheng commented Feb 26, 2024

kito-cheng commented Feb 26, 2024

kito-cheng commented Jul 17, 2024

Add program property and PLT for CFI extension #417

Are you sure you want to change the base?

Add program property and PLT for CFI extension #417

Conversation

kito-cheng commented Jan 4, 2024

kito-cheng commented Jan 4, 2024

rui314 commented Jan 5, 2024

kito-cheng commented Jan 5, 2024

rui314 commented Jan 5, 2024

MaskRay commented Jan 8, 2024 • edited Loading

sorear commented Feb 18, 2024

kito-cheng commented Feb 26, 2024

kito-cheng commented Feb 26, 2024

kito-cheng commented Feb 26, 2024

kito-cheng commented Jul 17, 2024

MaskRay commented Jan 8, 2024 •

edited

Loading