[PATCH] powerpc64le: ROP changes for clone/clone3

[Adhemerval Zanella Netto]

On 09/10/24 15:44, Peter Bergner wrote:
> On 10/7/24 2:48 PM, Florian Weimer wrote:
>>> Store/Retrieve ROP pointer in Red zone
>>
>> Could you spill lr to a nonvolatile register instead?  If I read
>> Documentation/powerpc/syscall64-abi.rst along with the ELF psABI
>> correctly, r14 to r31 should be available.  If you spill to a
>> register, no ROP protection will be needed.
> 
> That is true, but if we use a non-volatile to save the LR, then we
> need to save and restore that non-volatile around the usage where
> it holds the LR value.  Is that any better than just emitting the
> hashst/hashchk?

Do we really need ROP-mitigation on clone/clone3? The initial stack
frame is only created so the child can save its TOC (so the initial
thread function seems as a normal execution flow), and the LR won't
be used to return after the thread function returns (pthread_create
will issue exit).