Change in coreboot[master]: crossgcc: Allow GCC to get asan shadow offset at runtime

[Harshit Sharma (Code Review)]

Hello build bot (Jenkins), Patrick Georgi, Paul Menzel, Werner Zeh, 

I'd like you to reexamine a change. Please visit

    https://review.coreboot.org/c/coreboot/+/42794

to look at the new patch set (#17).

Change subject: crossgcc: Allow GCC to get asan shadow offset at runtime
......................................................................

crossgcc: Allow GCC to get asan shadow offset at runtime

Unlike Linux kernel which has a static shadow region layout, we
have multiple stages in coreboot and thus require a different
shadow offset address at each stage. Unfortunately, GCC currently,
only supports adding a static shadow offset at compile time using
-fasan-shadow-offset flag.

For this reason, we enable GCC to determine asan shadow offset
address at runtime using a callback function
__asan_shadow_offset(). This supersedes the need to specify
this address at compile time. GCC then makes use of this shadow
offset to protect stack buffers by inserting red zones around
them.

Some other benefits of having this GCC patch are:
1. We can place the shadow region in a separate linker section with
   all its advantages like automatic fit insurance. This ensures if
   a platform doesn't have enough memory space to hold shadow region,
   the build fails. (However, if we use a fixed shadow offset on a
   platform that actually doesn't have enough memory, it may still
   build without any errors.)
2. We don't modify the memory layout compared to the current one, as
   we are placing the shadow region at the end of the space already
   occupied by the program.
3. We can be much more flexible later if needed (thinking of other
   stages like bootblock).
4. Since, we are appending the shadow buffer to the region already
   occupied, we make efficient use of the limited memory available
   which is highly beneficial when using cache as ram.

Further, we have made sure that if you compile you tree with ASan
enabled but missed this patch, it will end up in the following
compilation error:
"invalid --param name 'asan-use-shadow-offset-callback'"
So, you cannot accidentally enable the feature without having your
compiler patched.

Change-Id: I401631938532a406a6d41e77c6c9716b6b2bf48d
Signed-off-by: Harshit Sharma <[e-mail]>
---
A util/crossgcc/patches/gcc-8.3.0_asan_shadow_offset_callback.patch
1 file changed, 97 insertions(+), 0 deletions(-)


  git pull ssh://review.coreboot.org:29418/coreboot refs/changes/94/42794/17
-- 
To view, visit https://review.coreboot.org/c/coreboot/+/42794
To unsubscribe, or for help writing mail filters, visit https://review.coreboot.org/settings

Gerrit-Project: coreboot
Gerrit-Branch: master
Gerrit-Change-Id: I401631938532a406a6d41e77c6c9716b6b2bf48d
Gerrit-Change-Number: 42794
Gerrit-PatchSet: 17
Gerrit-Owner: Harshit Sharma <[e-mail]>
Gerrit-Reviewer: Patrick Georgi <[e-mail]>
Gerrit-Reviewer: Paul Menzel <[e-mail]>
Gerrit-Reviewer: Werner Zeh <[e-mail]>
Gerrit-Reviewer: build bot (Jenkins) <[e-mail]>
Gerrit-CC: Raul Rangel <[e-mail]>
Gerrit-MessageType: newpatchset