RFC: Shadow Stack support in glibc

[H.J. Lu]

On Fri, Jun 9, 2017 at 8:58 AM, Szabolcs Nagy <szabolcs.nagy@arm.com> wrote:
> On 09/06/17 16:39, H.J. Lu wrote:
>> Since the __saved_mask field in jmp_buf is unused for x86, replace
>> __saved_mask with a union to save save shadow stack pointer while
>> keeping the size of jmp_buf unchanged.
>>
>>       * sysdeps/x86/setjmp.h: New file.
>
> sigsetjmp/siglongjmp has to save/restore the signal mask
> but the signal mask size on linux is at most 16bytes (?)
> and glibc uses 128 byte sigset_t.
>
> so instead of the union below, i'd expect a solution where
> if !HURD then the first 16bytes of __saved_mask and the rest
> can be accessed separately and the tail bytes are usable
> for target specific data.
>

How about this?  I allocated32 bytes for signal mask:

/* The biggest signal number + 1  */
#define _JUMP_BUF_SIGSET_NSIG 257
/* Number of longs to hold all signals.  */
#define _JUMP_BUF_SIGSET_NWORDS \
  ((_JUMP_BUF_SIGSET_NSIG - 1 + 7) / (8 * sizeof (unsigned long int)))

typedef struct
  {
    unsigned long int __val[_JUMP_BUF_SIGSET_NWORDS];
  } __jmp_buf_sigset_t;

typedef union
  {
    __sigset_t __saved_mask_compat;
    struct
      {
__jmp_buf_sigset_t __saved_mask;
void *__padding[12];
      } __saved;
  } __jmpbuf_target_t;

/* Saved signal mask.  */
#define __saved_mask __target.__saved.__saved_mask

and used

#if _JUMP_BUF_SIGSET_NSIG < _NSIG
# error _JUMP_BUF_SIGSET_NSIG <  _NSIG
#endif

 _Static_assert (sizeof (env[0].__target) == sizeof (__sigset_t),
 "__jmpbuf_target_t == __sigset_t");

to catch any future issues.


-- 
H.J.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Add-bits-setjmp3.h.patch
Type: text/x-patch
Size: 5466 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20170611/ac95523e/attachment.bin>