gcc-plugins: arm-ssp: Prepare for THREAD_INFO_IN_TASK support

We will be enabling THREAD_INFO_IN_TASK support for ARM, which means that we can no longer load the stack canary value by masking the stack pointer and taking the copy that lives in thread_info. Instead, we will be able to load it from the task_struct directly, by using the TPIDRURO register which will hold the current task pointer when THREAD_INFO_IN_TASK is in effect. This is much more straight-forward, and allows us to declutter this code a bit while at it. Note that this means that ARMv6 (non-v6K) SMP systems can no longer use this feature, but those are quite rare to begin with, so this is a reasonable trade off.

Ard Biesheuvel committed 5 years ago

Commit dfbdcda1 parent 6880fa67 files · +8 −39Browse files

Unified · Split

7 files

arch/arm/Kconfig +1 −1
arch/arm/Makefile +1 −4
arch/arm/include/asm/stackprotector.h +0 −2
arch/arm/include/asm/thread_info.h +0 −3
arch/arm/kernel/asm-offsets.c +0 −4
arch/arm/kernel/process.c +0 −4
scripts/gcc-plugins/arm_ssp_per_task_plugin.c +6 −21

arch/arm/Kconfig+1−1

@@ -1600,7 +1600,7 @@ config XEN · 1599 unmodified lines
1600	1600
1601	1601	config STACKPROTECTOR_PER_TASK
1602	1602	bool "Use a unique stack canary value for each task"
1603		− depends on GCC_PLUGINS && STACKPROTECTOR && SMP && !XIP_DEFLATED_DATA
	1603	+ depends on GCC_PLUGINS && STACKPROTECTOR && THREAD_INFO_IN_TASK && !XIP_DEFLATED_DATA
1604	1604	select GCC_PLUGIN_ARM_SSP_PER_TASK
1605	1605	default y
1606	1606	help

arch/arm/Makefile+1−4

@@ -273,11 +273,8 @@ ifeq ($(CONFIG_STACKPROTECTOR_PER_TASK),y) · 272 unmodified lines
273	273	prepare: stack_protector_prepare
274	274	stack_protector_prepare: prepare0
275	275	$(eval SSP_PLUGIN_CFLAGS := \
276		− -fplugin-arg-arm_ssp_per_task_plugin-tso=$(shell \
277		− awk '{if ($$2 == "THREAD_SZ_ORDER") print $$3;}'\
278		− include/generated/asm-offsets.h) \
279	276	-fplugin-arg-arm_ssp_per_task_plugin-offset=$(shell \
280		− awk '{if ($$2 == "TI_STACK_CANARY") print $$3;}'\
	277	+ awk '{if ($$2 == "TSK_STACK_CANARY") print $$3;}'\
281	278	include/generated/asm-offsets.h))
282	279	$(eval KBUILD_CFLAGS += $(SSP_PLUGIN_CFLAGS))
283	280	$(eval GCC_PLUGINS_CFLAGS += $(SSP_PLUGIN_CFLAGS))

arch/arm/include/asm/stackprotector.h+0−2

@@ -39,8 +39,6 @@ static __always_inline void boot_init_stack_canary(void) · 38 unmodified lines
39	39	current->stack_canary = canary;
40	40	#ifndef CONFIG_STACKPROTECTOR_PER_TASK
41	41	__stack_chk_guard = current->stack_canary;
42		−#else
43		− current_thread_info()->stack_canary = current->stack_canary;
44	42	#endif
45	43	}
46	44

arch/arm/include/asm/thread_info.h+0−3

@@ -55,9 +55,6 @@ struct thread_info { · 54 unmodified lines
55	55	struct task_struct task; / main task structure */
56	56	__u32 cpu; /* cpu */
57	57	__u32 cpu_domain; /* cpu domain */
58		−#ifdef CONFIG_STACKPROTECTOR_PER_TASK
59		− unsigned long stack_canary;
60		−#endif
61	58	struct cpu_context_save cpu_context; /* cpu context */
62	59	__u32 abi_syscall; /* ABI type and syscall nr */
63	60	__u8 used_cp[16]; /* thread used copro */

arch/arm/kernel/asm-offsets.c+0−4

@@ -63,10 +63,6 @@ int main(void) · 62 unmodified lines
63	63	#ifdef CONFIG_IWMMXT
64	64	DEFINE(TI_IWMMXT_STATE, offsetof(struct thread_info, fpstate.iwmmxt));
65	65	#endif
66		−#ifdef CONFIG_STACKPROTECTOR_PER_TASK
67		− DEFINE(TI_STACK_CANARY, offsetof(struct thread_info, stack_canary));
68		−#endif
69		− DEFINE(THREAD_SZ_ORDER, THREAD_SIZE_ORDER);
70	66	BLANK();
71	67	DEFINE(S_R0, offsetof(struct pt_regs, ARM_r0));
72	68	DEFINE(S_R1, offsetof(struct pt_regs, ARM_r1));

arch/arm/kernel/process.c+0−4

@@ -269,10 +269,6 @@ int copy_thread(unsigned long clone_flags, unsigned long stack_start, · 268 unmodified lines
269	269
270	270	thread_notify(THREAD_NOTIFY_COPY, thread);
271	271
272		−#ifdef CONFIG_STACKPROTECTOR_PER_TASK
273		− thread->stack_canary = p->stack_canary;
274		−#endif
275		−
276	272	return 0;
277	273	}
278	274

scripts/gcc-plugins/arm_ssp_per_task_plugin.c+6−21

@@ -4,7 +4,7 @@ · 3 unmodified lines
4	4
5	5	__visible int plugin_is_GPL_compatible;
6	6
7		−static unsigned int sp_mask, canary_offset;
	7	+static unsigned int canary_offset;
8	8
9	9	static unsigned int arm_pertask_ssp_rtl_execute(void)
10	10	{
@@ -13,7 +13,7 @@ static unsigned int arm_pertask_ssp_rtl_execute(void) · 2 unmodified lines
13	13	for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
14	14	const char *sym;
15	15	rtx body;
16		− rtx mask, masked_sp;
	16	+ rtx current;
17	17
18	18	/*
19	19	* Find a SET insn involving a SYMBOL_REF to __stack_chk_guard
@@ -30,19 +30,13 @@ static unsigned int arm_pertask_ssp_rtl_execute(void) · 10 unmodified lines
30	30
31	31	/*
32	32	* Replace the source of the SET insn with an expression that
33		− * produces the address of the copy of the stack canary value
34		− * stored in struct thread_info
	33	+ * produces the address of the current task's stack canary value
35	34	*/
36		− mask = GEN_INT(sext_hwi(sp_mask, GET_MODE_PRECISION(Pmode)));
37		− masked_sp = gen_reg_rtx(Pmode);
	35	+ current = gen_reg_rtx(Pmode);
38	36
39		− emit_insn_before(gen_rtx_set(masked_sp,
40		− gen_rtx_AND(Pmode,
41		− stack_pointer_rtx,
42		− mask)),
43		− insn);
	37	+ emit_insn_before(gen_load_tp_hard(current), insn);
44	38
45		− SET_SRC(body) = gen_rtx_PLUS(Pmode, masked_sp,
	39	+ SET_SRC(body) = gen_rtx_PLUS(Pmode, current,
46	40	GEN_INT(canary_offset));
47	41	}
48	42	return 0;
@@ -72,7 +66,6 @@ __visible int plugin_init(struct plugin_name_args *plugin_info, · 23 unmodified lines
72	66	const char * const plugin_name = plugin_info->base_name;
73	67	const int argc = plugin_info->argc;
74	68	const struct plugin_argument *argv = plugin_info->argv;
75		− int tso = 0;
76	69	int i;
77	70
78	71	if (!plugin_default_version_check(version, &gcc_version)) {
@@ -91,11 +84,6 @@ __visible int plugin_init(struct plugin_name_args *plugin_info, · 12 unmodified lines
91	84	return 1;
92	85	}
93	86
94		− if (!strcmp(argv[i].key, "tso")) {
95		− tso = atoi(argv[i].value);
96		− continue;
97		− }
98		−
99	87	if (!strcmp(argv[i].key, "offset")) {
100	88	canary_offset = atoi(argv[i].value);
101	89	continue;
@@ -105,9 +93,6 @@ __visible int plugin_init(struct plugin_name_args *plugin_info, · 3 unmodified lines
105	93	return 1;
106	94	}
107	95
108		− /* create the mask that produces the base of the stack */
109		− sp_mask = ~((1U << (12 + tso)) - 1);
110		−
111	96	PASS_INFO(arm_pertask_ssp_rtl, "expand", 1, PASS_POS_INSERT_AFTER);
112	97
113	98	register_callback(plugin_info->base_name, PLUGIN_PASS_MANAGER_SETUP,