[Bug target/29231] New: powerpc libgcc writes code to the stack

[Bug target/29231] New: powerpc libgcc writes code to the stack

[debian-gcc at lists dot debian dot org]

[forwarded from http://bugs.debian.org/382746]

reported for 4.1 SVN 20060608,

  Matthias

__trampoline_setup in /lib/libgcc_s.so.1 puts code on the stack.

This contributes to insecurity on powerpc.

A half-way fix is to mmap a page for this evil crud.
This still violates good practice, needing the OS to
allow either write+execute or a dangerous transition
from write to execute. It'd be an improvement though.
Doing write+execute may be better, allowing the OS
to locate the page within a segment (256 MiB chunk
on PowerPC) which already has executable pages.

A better method would be to supply a page full of
trampoline functions in libgcc. Each function would:

1. examine its own address
2. map from the page of code to a page of data
3. use that data to implement the trampoline

Trampoline setup would thus involve filling in the
data and choosing the matching function to use.

Once libgcc stops putting code on the stack, gcc
needs to mark all executables as not requiring an
executable stack.


-- 
           Summary: powerpc libgcc writes code to the stack
           Product: gcc
           Version: 4.1.2
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: debian-gcc at lists dot debian dot org
GCC target triplet: powerpc-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29231

[Bug middle-end/29231] need a way to produce trampolines not on the stack

[pinskia at gcc dot gnu dot org]

------- Comment #1 from pinskia at gcc dot gnu dot org  2006-09-25 23:53 -------
Really there is no way to fix this without compiler help.


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|normal                      |enhancement
          Component|target                      |middle-end
 GCC target triplet|powerpc-linux-gnu           |
            Summary|powerpc libgcc writes code  |need a way to produce
                   |to the stack                |trampolines not on the stack


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29231

[Bug middle-end/29231] need a way to produce trampolines not on the stack

[geoffk at gcc dot gnu dot org]

------- Comment #2 from geoffk at gcc dot gnu dot org  2006-09-26 00:44 -------
If you tried the page-of-functions idea, what would you do if you'd used all
the functions on the page and needed another one?


-- 

geoffk at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |patch


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29231

[Bug middle-end/29231] need a way to produce trampolines not on the stack

[acahalan at gmail dot com]

------- Comment #3 from acahalan at gmail dot com  2006-09-26 04:06 -------
(In reply to comment #2)
> If you tried the page-of-functions idea, what would you do if you'd used all
> the functions on the page and needed another one?
> 

You'd do the same as if you'd used up all the stack space.
The existing method doesn't handle running out of room,
and I don't see why the requirements would be any different
for this method.


-- 

acahalan at gmail dot com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |acahalan at gmail dot com


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29231

[Bug middle-end/29231] need a way to produce trampolines not on the stack

[pinskia at gcc dot gnu dot org]

------- Comment #4 from pinskia at gcc dot gnu dot org  2009-01-01 21:22 -------
This is why the PowerOpen ABI is good, it does not require stack based
trampolines.


-- 

pinskia at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|patch                       |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=29231

[Bug middle-end/29231] need a way to produce trampolines not on the stack

[iains at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=29231

--- Comment #8 from Iain Sandoe <iains at gcc dot gnu.org> ---
A secondary comment - the wiring up of the built-ins that allocate/deallocate
trampoline entries makes the underlying mechanism opaque to the middle end
consumer.

So, although the current example implementations use mmap / heap, I do not
believe that there is anything preventing an implementation from choosing some
alternate scheme for allocation of tables (e.g. a non-hosted impl could use a
fixed allocation - presumably with a hard fail if that allocation is exceeded.)

[Bug middle-end/29231] need a way to produce trampolines not on the stack

[iains at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=29231

Iain Sandoe <iains at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://gcc.gnu.org/bugzill
                   |                            |a/show_bug.cgi?id=113401

--- Comment #7 from Iain Sandoe <iains at gcc dot gnu.org> ---
Current status.

We have implemented (currently for hosted x86 and aarch64) a heap-based
trampoline approach.

for efficiency heap trampolines are allocated in tables of one page in size (no
pages are allocated until the first trampoline requires one).  Pages are added
and subtracted as the number of trampoline tables increases/decreases.  One
proviso - the first allocated page is sticky (this avoids mmap/etc. churn if
there are a lot of single trampolines required).  Trampoline pages are per
thread.

The mechanism works with platforms that will not allow heap pages to be both
writable and executable at the same time (the page is made temporarily r+w to
make changes and then r+x for operation).  For Darwin, there's a permission
mode "jit" that does something similar.

A new platform needs to supply the libgcc support for example : 

libgcc/config/aarch64/heap-trampoline.c
libgcc/config/aarch64/t-heap-trampoline + a reference to this in
libgcc/config.host

A new platform can elect to default to heap trampolines by adding
HEAP_TRAMPOLINES_INIT=1 to tm_defines in the relevant target section in
gcc/config.gcc

There is currently (pre gcc-14 branch) one unhandled issue which is
reallocation of the last "sticky" trampoline page when a thread exits.

I would say, that (within realistic implementation constraints) we could count
this as fixed.

[Bug middle-end/29231] need a way to produce trampolines not on the stack

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=29231

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |iains at gcc dot gnu.org

--- Comment #6 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Most of the support was added in r14-4821-g28d8c680aaea46 .

Maybe Iain can provide more information on what else is needed to be done if
anything.

[Bug middle-end/29231] need a way to produce trampolines not on the stack

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=29231

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2021-11-28

--- Comment #5 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
.