linux-kernel - [PATCH 1/2] ppc64le live patch: clear out storage location(s) in mini stack frame

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160309172821.GC27913@lst.de>
Date:	Wed, 9 Mar 2016 18:28:21 +0100
From:	Torsten Duwe <duwe@....de>
To:	Petr Mladek <pmladek@...e.com>
Cc:	jeyu@...hat.com, jkosina@...e.cz, jikos@...nel.org,
	linux-kernel@...r.kernel.org, rostedt@...dmis.org,
	kamalesh@...ux.vnet.ibm.com, linuxppc-dev@...abs.org,
	live-patching@...r.kernel.org, mbenes@...e.cz
Subject: [PATCH 1/2] ppc64le live patch: clear out storage location(s) in
	mini stack frame

This can be applied on top of Petr Mladek's v4 rework of the ppc64le
live patching. Inspired by Balbir Singh's v5, information about the
callee's r2 is stored in a "reserved" 32 bit location in the caller's
stack frame, instead of 64 bits in the newly created mini frame 24(r1).

It only needs to work for a local call, when caller's TOC == callee's
TOC, and along with the return address (LR) it's all within a 4GiB
range (+-31 bits). If the original call already was global, we are
allowed to restore any nonsense into r2, because the global caller
will restore its TOC anyway from the ABI compliant location 24(r1)
right after return.

Signed-off-by: Torsten Duwe <duwe@...e.de>
---

This is only the preparation for dumping the mini stack frame.
It shouldn't break anything, bisecting-wise.

--- a/arch/powerpc/kernel/entry_64.S
+++ b/arch/powerpc/kernel/entry_64.S
@@ -1284,8 +1284,9 @@ ftrace_call:
 	 * lr and LRSAVE(r1) contain the address of klp_return_helper.
 	 * We loaded ctr with the address of the patched function earlier
 	 */
+	subf    r0, r0, r2      /* Calculate offset from current TOC to LR */
+	stw     r0, 12(r1)      /* and save it in CR+4 */      
 	stdu	r1, -32(r1)	/* open new mini stack frame */
-	std	r2, 24(r1)	/* save TOC now, unconditionally. */
 	bl	5f
 5:	mflr	r12
 	addi	r12, r12, (klp_return_helper + 4 - .)@l
@@ -1323,9 +1324,10 @@ _GLOBAL(ftrace_stub)
  * maybe inserting a klp_return_helper frame or not.
 */
 klp_return_helper:
-	ld	r2, 24(r1)	/* restore TOC (saved by ftrace_caller) */
 	addi r1, r1, 32		/* destroy mini stack frame */
+	lwa     r2, 12(r1)      /* Load from CR+4, offset of TOC w.r.t LR */
 	ld	r0, LRSAVE(r1)	/* get the real return address */
+	add     r2, r2, r0      /* Add the current LR to offset */
 	mtlr	r0
 	blr
 #endif