Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(157)

Issue 1206723003: Function Layout, Global Variable Layout and Pooled Constants Layout Reordering (Closed)

Created:
5 years, 6 months ago by qining
Modified:
5 years, 6 months ago
CC:
native-client-reviews_googlegroups.com
Base URL:
https://chromium.googlesource.com/native_client/pnacl-subzero.git@master
Target Ref:
refs/heads/master
Visibility:
Public.

Description

Function Layout, Global Variable Layout and Pooled Constants Layout Reordering PURPOSE: The purpose of function layout reordering is to defend against code-reuse attacks as the location of code blocks will be various among different binaries. The layout reordering for global variables and pooled constants can be considered as static data randomization. This is to stop memory corruption attacks by randomizing the locations of the static data. After function layout reordering, the order of function blocks in TEXT section will be randomized. Global variable reordering randomize the order of global variables, and pooled constant reordering randomize the order of pooled constants. Note the order of constant pools won’t be affected and all pooled constants will remain in their original constant pools. USAGE: -reorder-functions: bool type command line option, enables function layout shuffling in TEXT section. Note when -threads=0 is set, function reordering will be forced off. -reorder-functions-window-size: uint32 type command line option, specify the length of the shuffling queue. Note -reorder-functions-window-size=0 or 1 means no shuffling applied to functions. -reorder-global-variables: bool type command line option, enables global variables shuffling. -reorder-pooled-constants: bool type command line option, enables pooled constants shuffling. APPROACH: Randomization is introduced at the code emission time. We use a shuffling method to randomize the emission of function code, global variables and pooled constants. For function code emission, we also introduce “window size” as a parameter to control the size of the function holding buffer for shuffling. Window size 1 and 0 mean no shuffling applied, and a value higher than the number of translated functions means holding all the functions and shuffling them before emitting any of them. IMPLEMENTATION: Function reordering: GlobalContext::emitItems(): Call RandomShuffle() routine to shuffle a specific part of the Pending vector. Global variable reorder: GlobalContext::lowerGlobals(const IceString &SectionSuffix): Call RandomShuffle() routine upon declaration list: Globals. Pooled constant reordering: TargetDataX8632::emitConstantPool(GlobalContext *Ctx): Add call to RandomShuffle() to shuffle the constant pool to be emitted. This is for asm output. ELFObjectWriter::writeConstantPool(Type Tu): Add call to RandomShuffle() to shuffle the constant pool before emitting it. This is only for elf output. ISSUES: The initialization of global variables are emitted along with function code, all of them are considered as EmitterWorkItem. However, we do need to first emit global variables to keep the block profiling workflow untouched. To fulfill this, a “kind” check is added in the while loop of GlobalContext::emitItems(). The “if” statement at line 480 shows the workaround of this issue. BUG= R=jpp@chromium.org, jvoung@chromium.org, stichnot@chromium.org Committed: https://gerrit.chromium.org/gerrit/gitweb?p=native_client/pnacl-subzero.git;a=commit;h=7cd5351c07806a1bc7ba1c1aec3380f7b715bda8

Patch Set 1 #

Total comments: 17

Patch Set 2 : fixed some comments in patch set 1 #

Total comments: 25

Patch Set 3 : #

Total comments: 8

Patch Set 4 : #

Total comments: 23

Patch Set 5 : #

Total comments: 4

Patch Set 6 : #

Total comments: 2

Patch Set 7 : #

Unified diffs Side-by-side diffs Delta from patch set Stats (+400 lines, -94 lines) Patch
M src/IceClFlags.h View 1 2 3 5 chunks +26 lines, -5 lines 0 comments Download
M src/IceClFlags.cpp View 1 2 3 4 4 chunks +43 lines, -1 line 0 comments Download
M src/IceConverter.cpp View 1 2 3 4 1 chunk +0 lines, -1 line 0 comments Download
M src/IceELFObjectWriter.cpp View 1 2 3 4 2 chunks +8 lines, -1 line 0 comments Download
M src/IceGlobalContext.cpp View 1 2 3 4 5 6 3 chunks +110 lines, -54 lines 0 comments Download
M src/IceGlobalInits.cpp View 1 2 3 4 1 chunk +0 lines, -1 line 0 comments Download
M src/IceTargetLoweringX8632.cpp View 1 2 3 4 1 chunk +8 lines, -0 lines 0 comments Download
M src/IceTargetLoweringX86BaseImpl.h View 1 2 3 4 1 chunk +0 lines, -1 line 0 comments Download
A tests_lit/llvm2ice_tests/reorder-functions.ll View 1 2 3 4 5 1 chunk +90 lines, -0 lines 0 comments Download
A tests_lit/llvm2ice_tests/reorder-global-variables.ll View 1 2 3 4 1 chunk +72 lines, -0 lines 0 comments Download
A + tests_lit/llvm2ice_tests/reorder-pooled-constants.ll View 1 2 3 4 5 2 chunks +43 lines, -30 lines 0 comments Download

Messages

Total messages: 21 (2 generated)
qining
Changes in IceCompileServer.cpp, IceTargetLoweringX8664.h and IceTargetLoweringX86BaseImpl.h are introduced by clang-format.
5 years, 6 months ago (2015-06-24 00:09:27 UTC) #2
John
A few comments to get you started (I had to leave as soon as I ...
5 years, 6 months ago (2015-06-24 00:24:00 UTC) #3
qining
There is problem about capturing the variables for lambda functions. Ctx, and RNG are both ...
5 years, 6 months ago (2015-06-24 01:20:40 UTC) #4
John
https://codereview.chromium.org/1206723003/diff/1/src/IceELFObjectWriter.cpp File src/IceELFObjectWriter.cpp (right): https://codereview.chromium.org/1206723003/diff/1/src/IceELFObjectWriter.cpp#newcode514 src/IceELFObjectWriter.cpp:514: RandomShuffle(Pool.begin(), Pool.end(), [this](uint64_t N) { On 2015/06/24 01:20:40, qining ...
5 years, 6 months ago (2015-06-24 08:15:55 UTC) #5
qining
Fixed some comments in patch set 3. https://codereview.chromium.org/1206723003/diff/20001/src/IceGlobalContext.cpp File src/IceGlobalContext.cpp (right): https://codereview.chromium.org/1206723003/diff/20001/src/IceGlobalContext.cpp#newcode439 src/IceGlobalContext.cpp:439: const uint32_t ...
5 years, 6 months ago (2015-06-24 17:17:20 UTC) #6
John
lgtm wait until others lgtm this too. https://codereview.chromium.org/1206723003/diff/20001/src/IceGlobalContext.cpp File src/IceGlobalContext.cpp (right): https://codereview.chromium.org/1206723003/diff/20001/src/IceGlobalContext.cpp#newcode455 src/IceGlobalContext.cpp:455: uint32_t ItemSeq ...
5 years, 6 months ago (2015-06-24 17:31:49 UTC) #7
jvoung (off chromium)
https://codereview.chromium.org/1206723003/diff/20001/src/IceClFlags.h File src/IceClFlags.h (right): https://codereview.chromium.org/1206723003/diff/20001/src/IceClFlags.h#newcode254 src/IceClFlags.h:254: bool ReorderFunctions; We had previously grouped all of the ...
5 years, 6 months ago (2015-06-24 17:36:37 UTC) #8
qining
Updated with patch set 3. https://codereview.chromium.org/1206723003/diff/20001/src/IceClFlags.h File src/IceClFlags.h (right): https://codereview.chromium.org/1206723003/diff/20001/src/IceClFlags.h#newcode254 src/IceClFlags.h:254: bool ReorderFunctions; On 2015/06/24 ...
5 years, 6 months ago (2015-06-24 20:18:56 UTC) #10
jvoung (off chromium)
otherwise LGTM https://codereview.chromium.org/1206723003/diff/60001/src/IceClFlags.h File src/IceClFlags.h (right): https://codereview.chromium.org/1206723003/diff/60001/src/IceClFlags.h#newcode239 src/IceClFlags.h:239: size_t NumTranslationThreads; // 0 means completely sequential ...
5 years, 6 months ago (2015-06-24 21:26:24 UTC) #11
qining
Move back the NumTranslationThreads and RandomSeed to their original location. https://codereview.chromium.org/1206723003/diff/60001/src/IceClFlags.h File src/IceClFlags.h (right): https://codereview.chromium.org/1206723003/diff/60001/src/IceClFlags.h#newcode239 ...
5 years, 6 months ago (2015-06-24 23:22:34 UTC) #12
Jim Stichnoth
https://codereview.chromium.org/1206723003/diff/60001/src/IceClFlags.cpp File src/IceClFlags.cpp (right): https://codereview.chromium.org/1206723003/diff/60001/src/IceClFlags.cpp#newcode296 src/IceClFlags.cpp:296: // Command line option for turing on global variable ...
5 years, 6 months ago (2015-06-25 13:20:59 UTC) #13
qining
Updated in patch set 5. https://codereview.chromium.org/1206723003/diff/60001/src/IceClFlags.cpp File src/IceClFlags.cpp (right): https://codereview.chromium.org/1206723003/diff/60001/src/IceClFlags.cpp#newcode296 src/IceClFlags.cpp:296: // Command line option ...
5 years, 6 months ago (2015-06-25 21:10:11 UTC) #14
Jim Stichnoth
https://codereview.chromium.org/1206723003/diff/80001/src/IceGlobalContext.cpp File src/IceGlobalContext.cpp (right): https://codereview.chromium.org/1206723003/diff/80001/src/IceGlobalContext.cpp#newcode439 src/IceGlobalContext.cpp:439: const uint32_t ShuffleWindowSize = On 2015/06/25 21:10:10, qining wrote: ...
5 years, 6 months ago (2015-06-26 01:54:57 UTC) #15
qining
Updated with patch set 6. https://codereview.chromium.org/1206723003/diff/80001/src/IceGlobalContext.cpp File src/IceGlobalContext.cpp (right): https://codereview.chromium.org/1206723003/diff/80001/src/IceGlobalContext.cpp#newcode439 src/IceGlobalContext.cpp:439: const uint32_t ShuffleWindowSize = ...
5 years, 6 months ago (2015-06-26 03:16:08 UTC) #16
Jim Stichnoth
otherwise lgtm https://codereview.chromium.org/1206723003/diff/120001/src/IceGlobalContext.cpp File src/IceGlobalContext.cpp (right): https://codereview.chromium.org/1206723003/diff/120001/src/IceGlobalContext.cpp#newcode32 src/IceGlobalContext.cpp:32: #include <algorithm> Sort this alphabetically, i.e. above ...
5 years, 6 months ago (2015-06-26 06:14:42 UTC) #17
Jim Stichnoth
Forgot to mention - the title of the CL (both the Subject field and the ...
5 years, 6 months ago (2015-06-26 06:17:37 UTC) #18
qining
Changed the title and first line in description to 79-character long. Updated in patch set ...
5 years, 6 months ago (2015-06-26 16:19:44 UTC) #19
qining
https://codereview.chromium.org/1206723003/diff/120001/src/IceGlobalContext.cpp File src/IceGlobalContext.cpp (right): https://codereview.chromium.org/1206723003/diff/120001/src/IceGlobalContext.cpp#newcode32 src/IceGlobalContext.cpp:32: #include <algorithm> On 2015/06/26 06:14:42, stichnot wrote: > Sort ...
5 years, 6 months ago (2015-06-26 16:20:14 UTC) #20
qining
5 years, 6 months ago (2015-06-26 16:36:07 UTC) #21
Message was sent while issue was closed.
Committed patchset #7 (id:140001) manually as
7cd5351c07806a1bc7ba1c1aec3380f7b715bda8 (presubmit successful).

Powered by Google App Engine
This is Rietveld 408576698