Attachment 127065 Details for Bug 97611 – build: Generate fixed closures

[patch] build: Generate fixed closures

build-Generate-fixed-closures.patch (text/plain), 13.61 KB, created by Daiki Ueno on 2016-10-06 13:40:52 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Daiki Ueno

Created: 2016-10-06 13:40:52 UTC

Size: 13.61 KB

patch

obsolete

>From e1bf870f42e594c3d70d1f9f5dc2661208fdd124 Mon Sep 17 00:00:00 2001
>From: Daiki Ueno <dueno@redhat.com>
>Date: Sun, 28 Aug 2016 08:37:12 +0200
>Subject: [PATCH] build: Generate fixed closures
>
>libffi's closure support may fail at run time, if the caller program is
>under a stricter SELinux policy.  In that case, fallback to use a
>pre-compiled closures.
>https://bugzilla.redhat.com/show_bug.cgi?id=1271501
>
>https://bugs.freedesktop.org/show_bug.cgi?id=97611
>---
> configure.ac           |   8 ++++
> p11-kit/Makefile.am    |   8 ++++
> p11-kit/gen-wrapper.py | 113 +++++++++++++++++++++++++++++++++++++++++++++++--
> p11-kit/modules.c      |  36 ++++++++++++++++
> p11-kit/virtual.c      |  66 +++++++++++++++++++++++++++++
> p11-kit/virtual.h      |   6 +++
> 6 files changed, 233 insertions(+), 4 deletions(-)
>
>diff --git a/configure.ac b/configure.ac
>index fcd162f..dce1f3c 100644
>--- a/configure.ac
>+++ b/configure.ac
>@@ -211,6 +211,14 @@ fi
> 
> AM_CONDITIONAL(WITH_FFI, test "$with_libffi" = "yes")
> 
>+AC_ARG_WITH([fixed-closure],
>+            [AS_HELP_STRING([--with-fixed-closure=integer], [Precompile fallback closures if libffi closures are not available])],
>+            [fixed_closure=$withval],
>+            [fixed_closure=64])
>+
>+AC_DEFINE_UNQUOTED(P11_VIRTUAL_MAX_FIXED, [$fixed_closure], [The number of fallback closures compiled in])
>+AC_SUBST(fixed_closure)
>+
> # --------------------------------------------------------------------
> # Hash implementation
> 
>diff --git a/p11-kit/Makefile.am b/p11-kit/Makefile.am
>index 6b68773..e34401e 100644
>--- a/p11-kit/Makefile.am
>+++ b/p11-kit/Makefile.am
>@@ -11,6 +11,7 @@ inc_HEADERS += \
> closure_sources = \
> 	p11-kit/virtual-base.c \
> 	p11-kit/virtual-stack.c \
>+	p11-kit/virtual-fixed.c \
> 	$(NULL)
> 
> BUILT_SOURCES = $(closure_sources)
>@@ -27,6 +28,13 @@ p11-kit/virtual-stack.c: common/pkcs11.h common/pkcs11i.h p11-kit/gen-wrapper.py
> 		$(srcdir)/common/pkcs11.h $(srcdir)/common/pkcs11i.h; \
> 		} > $@-t && mv $@-t $@
> 
>+p11-kit/virtual-fixed.c: common/pkcs11.h common/pkcs11i.h p11-kit/gen-wrapper.py
>+	$(AM_V_GEN) { echo '/* DO NOT EDIT! GENERATED AUTOMATICALLY! */'; \
>+		$(PYTHON) $(srcdir)/p11-kit/gen-wrapper.py fixed \
>+		-n $(fixed_closure) \
>+		$(srcdir)/common/pkcs11.h $(srcdir)/common/pkcs11i.h; \
>+		} > $@-t && mv $@-t $@
>+
> MODULE_SRCS = \
> 	p11-kit/util.c \
> 	p11-kit/conf.c p11-kit/conf.h \
>diff --git a/p11-kit/gen-wrapper.py b/p11-kit/gen-wrapper.py
>index eeae806..a42155d 100644
>--- a/p11-kit/gen-wrapper.py
>+++ b/p11-kit/gen-wrapper.py
>@@ -142,7 +142,8 @@ P11_INDENT_RE = re.compile(r' {8}')
> 
> Config = typing.NamedTuple('Config',
>                            [('parser', Parser),
>-                            ('exclude', [str])])
>+                            ('exclude', [str]),
>+                            ('fixed_number', int)])
> 
> def format_type(type):
>     if not type.endswith('*') and not type.endswith(' '):
>@@ -278,9 +279,110 @@ ${initializer_list}
>     def wrapper_function_name(self, function):
>         return 'stack_C_{function}'.format(function=function.name)
> 
>+class FixedFunctionTemplate(FunctionTemplate):
>+    def __init__(self):
>+        super(FixedFunctionTemplate, self).__init__('''\
>+static CK_RV \\
>+${wrapper_function_name} (${arglist}) \\
>+{ \\
>+	CK_FUNCTION_LIST *bound; \\
>+	Wrapper *wrapper; \\
>+	CK_X_FUNCTION_LIST *funcs; \\
>+	bound = _p11_modules_get_fixed_closure (fixed_index); \\
>+	return_val_if_fail (bound != NULL, CKR_GENERAL_ERROR); \\
>+	wrapper = (Wrapper *) bound; \\
>+	funcs = &wrapper->virt->funcs; \\
>+	return funcs->C_${function_name} (funcs, ${args}); \\
>+} \\
>+\\''')
>+
>+    @property
>+    def arglist(self):
>+        return ', \\\n'.join(super(FixedFunctionTemplate, self).get_arglist()).strip()
>+
>+class FixedFileTemplate(FileTemplate):
>+    def __init__(self, config):
>+        super(FixedFileTemplate, self).__init__('''\
>+#define P11_VIRTUAL_FIXED_FUNCTIONS(fixed_index) \\
>+${function_list}
>+static CK_RV \\
>+fixed ## fixed_index ## _C_GetFunctionList (CK_FUNCTION_LIST_PTR_PTR list);
>+
>+#define P11_VIRTUAL_FIXED_GET_FUNCTION_LIST(fixed_index) \\
>+static CK_RV \\
>+fixed ## fixed_index ## _C_GetFunctionList (CK_FUNCTION_LIST_PTR_PTR list) \\
>+{ \\
>+	*list = &p11_virtual_fixed[fixed_index]; \\
>+        return CKR_OK; \\
>+}
>+
>+#define P11_VIRTUAL_FIXED_INITIALIZER(fixed_index) \\
>+{ \\
>+	{ CRYPTOKI_VERSION_MAJOR, CRYPTOKI_VERSION_MINOR },  /* version */ \\
>+${initializer_list} \\
>+}
>+
>+${fixed_function_list}
>+
>+CK_FUNCTION_LIST p11_virtual_fixed[P11_VIRTUAL_MAX_FIXED] = {
>+${fixed_initializer_list}
>+};
>+
>+${fixed_get_function_list}
>+''',
>+        FixedFunctionTemplate(),
>+        config)
>+        self.__short_functions = {
>+            'GetFunctionStatus': 'short_C_GetFunctionStatus',
>+            'CancelFunction': 'short_C_CancelFunction',
>+            'GetFunctionList': 'fixed ## fixed_index ## _C_GetFunctionList'
>+        }
>+
>+    def wrapper_function_name(self, function):
>+        return 'fixed ## fixed_index ## _C_{function}'.format(function=function.name)
>+
>+    @property
>+    def fixed_function_list(self):
>+        initializers = ['P11_VIRTUAL_FIXED_FUNCTIONS({fixed_index})'.format(fixed_index=fixed_index) for fixed_index in range(0, self.config.fixed_number)]
>+        return '\n'.join(initializers)
>+
>+    @property
>+    def fixed_initializer_list(self):
>+        initializers = ['\tP11_VIRTUAL_FIXED_INITIALIZER({fixed_index})'.format(fixed_index=fixed_index) for fixed_index in range(0, self.config.fixed_number)]
>+        return ',\n'.join(initializers)
>+
>+    @property
>+    def fixed_get_function_list(self):
>+        initializers = ['P11_VIRTUAL_FIXED_GET_FUNCTION_LIST({fixed_index})'.format(fixed_index=fixed_index) for fixed_index in range(0, self.config.fixed_number)]
>+        return '\n'.join(initializers)
>+
>+    @property
>+    def function_list(self):
>+        result = list()
>+        for function in self.config.parser.functions:
>+            if function.name in self.config.exclude:
>+                continue
>+            if function.name in self.__short_functions:
>+                continue
>+            result.append(self.function_template.substitute(function=function,
>+                                                            wrapper_function_name=self.wrapper_function_name(function)))
>+        return '\n'.join(result)
>+
>+    @property
>+    def initializer_list(self):
>+        result = list()
>+        for function in self.config.parser.functions:
>+            short_function_name = self.__short_functions.get(function.name)
>+            if short_function_name:
>+                result.append('\t' + short_function_name)
>+            else:
>+                result.append('\t' + self.wrapper_function_name(function))
>+        return ', \\\n'.join(result)
>+
> P11_TEMPLATE = {
>     'base': BaseFileTemplate,
>-    'stack': StackFileTemplate
>+    'stack': StackFileTemplate,
>+    'fixed': FixedFileTemplate
> }
> 
> if __name__ == '__main__':
>@@ -288,12 +390,15 @@ if __name__ == '__main__':
>     import argparse
> 
>     parser = argparse.ArgumentParser(description='gen-wrapper')
>-    parser.add_argument('template', choices=['base', 'stack'],
>+    parser.add_argument('template', choices=['base', 'stack', 'fixed'],
>                         help='name of the template')
>     parser.add_argument('pkcs11', type=argparse.FileType('r'),
>                         help='the pkcs11.h header file')
>     parser.add_argument('pkcs11i', type=argparse.FileType('r'),
>                         help='the pkcs11i.h header file')
>+    parser.add_argument('-n', '--fixed-number', type=int,
>+                        default=64,
>+                        help='exclude functions')
>     parser.add_argument('-x', '--exclude', action='append', type=str,
>                         default=[],
>                         help='exclude functions')
>@@ -302,5 +407,5 @@ if __name__ == '__main__':
>     parser = Parser()
>     parser.parse(args.pkcs11, args.pkcs11i)
>     template = P11_TEMPLATE[args.template]
>-    config = Config(parser, args.exclude)
>+    config = Config(parser, args.exclude, args.fixed_number)
>     print(template(config).substitute())
>diff --git a/p11-kit/modules.c b/p11-kit/modules.c
>index 6e15c1d..dcca7f6 100644
>--- a/p11-kit/modules.c
>+++ b/p11-kit/modules.c
>@@ -172,6 +172,7 @@ static struct _Shared {
> 	p11_dict *unmanaged_by_funcs;
> 	p11_dict *managed_by_closure;
> 	p11_dict *config;
>+	CK_FUNCTION_LIST *fixed_closures[P11_VIRTUAL_MAX_FIXED];
> } gl = { NULL, NULL };
> 
> /* These are global variables to be overridden in tests */
>@@ -1783,6 +1784,8 @@ release_module_inlock_rentrant (CK_FUNCTION_LIST *module,
> 
> 	/* See if a managed module, and finalize if so */
> 	if (p11_virtual_is_wrapper (module)) {
>+		size_t index;
>+
> 		mod = p11_dict_get (gl.managed_by_closure, module);
> 		if (mod != NULL) {
> 			if (!p11_dict_remove (gl.managed_by_closure, module))
>@@ -1790,6 +1793,12 @@ release_module_inlock_rentrant (CK_FUNCTION_LIST *module,
> 			p11_virtual_unwrap (module);
> 		}
> 
>+		for (index = 0; index < P11_VIRTUAL_MAX_FIXED; index++) {
>+			if (gl.fixed_closures[index] == module) {
>+				gl.fixed_closures[index] = NULL;
>+				break;
>+			}
>+		}
> 	/* If an unmanaged module then caller should have finalized */
> 	} else {
> 		mod = p11_dict_get (gl.unmanaged_by_funcs, module);
>@@ -1865,6 +1874,21 @@ prepare_module_inlock_reentrant (Module *mod,
> 		}
> 
> 		*module = p11_virtual_wrap (virt, destroyer);
>+		if (!*module) {
>+			size_t index;
>+
>+			for (index = 0; index < P11_VIRTUAL_MAX_FIXED; index++)
>+				if (gl.fixed_closures[index] == NULL)
>+					break;
>+			if (index >= P11_VIRTUAL_MAX_FIXED) {
>+				p11_message ("maximum number of closures (%d) is exceeded",
>+					     P11_VIRTUAL_MAX_FIXED);
>+				return CKR_GENERAL_ERROR;
>+			}
>+			*module = p11_virtual_wrap_fixed (virt, index, destroyer);
>+			if (*module)
>+				gl.fixed_closures[index] = *module;
>+		}
> 		return_val_if_fail (*module != NULL, CKR_GENERAL_ERROR);
> 
> 		if (!p11_dict_set (gl.managed_by_closure, *module, mod))
>@@ -2702,3 +2726,15 @@ p11_kit_load_initialize_module (const char *module_path,
> 	p11_debug ("out: %lu", rv);
> 	return rv;
> }
>+
>+CK_FUNCTION_LIST *
>+_p11_modules_get_fixed_closure (int index)
>+{
>+	return_val_if_fail (0 <= index && index < P11_VIRTUAL_MAX_FIXED, NULL);
>+
>+	/*
>+	 * No need to protect this access by p11_lock(); because
>+	 * reading a single aligned memory word is atomic.
>+	 */
>+	return gl.fixed_closures[index];
>+}
>diff --git a/p11-kit/virtual.c b/p11-kit/virtual.c
>index d6d6c8d..8809f95 100644
>--- a/p11-kit/virtual.c
>+++ b/p11-kit/virtual.c
>@@ -932,6 +932,7 @@ binding_C_GenerateRandom (ffi_cif *cif,
> 
> #endif /* WITH_FFI */
> 
>+#include "p11-kit/virtual-fixed.c"
> #include "p11-kit/virtual-stack.c"
> #include "p11-kit/virtual-base.c"
> 
>@@ -1184,6 +1185,45 @@ init_wrapper_funcs (Wrapper *wrapper)
> 	return true;
> }
> 
>+static bool
>+init_wrapper_funcs_fixed (Wrapper *wrapper, CK_FUNCTION_LIST *fixed)
>+{
>+	const FunctionInfo *info;
>+	void **bound_to, **bound_from;
>+	int i;
>+
>+	for (i = 0; function_info[i].name != NULL; i++) {
>+		info = function_info + i;
>+
>+		/* Address to where we're placing the bound function */
>+		bound_to = &STRUCT_MEMBER (void *, &wrapper->bound, info->module_offset);
>+		bound_from = &STRUCT_MEMBER (void *, fixed, info->module_offset);
>+
>+		/*
>+		 * See if we can just shoot straight through to the module function
>+		 * without wrapping at all. If all the stacked virtual modules just
>+		 * fall through, then this returns the original module function.
>+		 */
>+		if (!lookup_fall_through (wrapper->virt, info, bound_to))
>+			*bound_to = *bound_from;
>+	}
>+
>+	/* Always bind the C_GetFunctionList function itself */
>+	wrapper->bound.C_GetFunctionList = fixed->C_GetFunctionList;
>+
>+	/*
>+	 * These functions are used as a marker to indicate whether this is
>+	 * one of our CK_FUNCTION_LIST_PTR sets of functions or not. These
>+	 * functions are defined to always have the same standard implementation
>+	 * in PKCS#11 2.x so we don't need to call through to the base for
>+	 * these guys.
>+	 */
>+	wrapper->bound.C_CancelFunction = short_C_CancelFunction;
>+	wrapper->bound.C_GetFunctionStatus = short_C_GetFunctionStatus;
>+
>+	return true;
>+}
>+
> #if LIBFFI_FREE_CLOSURES
> static void
> uninit_wrapper_funcs (Wrapper *wrapper)
>@@ -1220,6 +1260,32 @@ p11_virtual_wrap (p11_virtual *virt,
> 	return &wrapper->bound;
> }
> 
>+CK_FUNCTION_LIST *
>+p11_virtual_wrap_fixed (p11_virtual *virt,
>+			size_t index,
>+			p11_destroyer destroyer)
>+{
>+	Wrapper *wrapper;
>+
>+	return_val_if_fail (virt != NULL, NULL);
>+
>+	wrapper = calloc (1, sizeof (Wrapper));
>+	return_val_if_fail (wrapper != NULL, NULL);
>+
>+	wrapper->virt = virt;
>+	wrapper->destroyer = destroyer;
>+	wrapper->bound.version.major = CRYPTOKI_VERSION_MAJOR;
>+	wrapper->bound.version.minor = CRYPTOKI_VERSION_MINOR;
>+
>+	if (!init_wrapper_funcs_fixed (wrapper, &p11_virtual_fixed[index]))
>+		return_val_if_reached (NULL);
>+
>+	assert ((void *)wrapper == (void *)&wrapper->bound);
>+	assert (p11_virtual_is_wrapper (&wrapper->bound));
>+	assert (wrapper->bound.C_GetFunctionList != NULL);
>+	return &wrapper->bound;
>+}
>+
> bool
> p11_virtual_can_wrap (void)
> {
>diff --git a/p11-kit/virtual.h b/p11-kit/virtual.h
>index 97d2a7c..2f43fc2 100644
>--- a/p11-kit/virtual.h
>+++ b/p11-kit/virtual.h
>@@ -61,8 +61,14 @@ bool                    p11_virtual_can_wrap   (void);
> CK_FUNCTION_LIST *      p11_virtual_wrap       (p11_virtual *virt,
>                                                 p11_destroyer destroyer);
> 
>+CK_FUNCTION_LIST *      p11_virtual_wrap_fixed (p11_virtual *virt,
>+                                                size_t index,
>+                                                p11_destroyer destroyer);
>+
> bool                    p11_virtual_is_wrapper (CK_FUNCTION_LIST *module);
> 
> void                    p11_virtual_unwrap     (CK_FUNCTION_LIST *module);
> 
>+CK_FUNCTION_LIST *      _p11_modules_get_fixed_closure (int index);
>+
> #endif /* __P11_VIRTUAL_H__ */
>-- 
>2.7.4

Actions: View | Splinter Review

Attachments on bug 97611: 126241 | 126242 | 127064 | 127065

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.