gcc-plugins: Remove ARM_SSP_PER_TASK plugin

As part of trying to remove GCC plugins from Linux, drop the ARM_SSP_PER_TASK plugin. The feature is available upstream since GCC 12, so anyone needing newer kernels with per-task ssp can update their compiler[1].

Suggested-by Arnd Bergmann <[email protected]>

Link https://lore.kernel.org/all/[email protected]/ [1] open here

Signed-off-by Kees Cook <[email protected]>

---
Cc: Ard Biesheuvel <[email protected]>
Cc: Chris Packham <[email protected]>
Cc: Douglas Anderson <[email protected]>
Cc: Russell King <[email protected]>
Cc: Masahiro Yamada <[email protected]>
Cc: Nathan Chancellor <[email protected]>
Cc: Nicolas Schier <[email protected]>
Cc: "Russell King (Oracle)" <[email protected]>
Cc: Linus Walleij <[email protected]>
Cc: Andrew Davis <[email protected]>
Cc: Seung-Woo Kim <[email protected]>
Cc: Xin Li <[email protected]>
Cc: Jinjie Ruan <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]

---
 arch/arm/Kconfig                              |   3 +-
 arch/arm/boot/compressed/Makefile             |   2 +-
 scripts/Makefile.gcc-plugins                  |   6 -
 scripts/gcc-plugins/Kconfig                   |   4 -
 scripts/gcc-plugins/arm_ssp_per_task_plugin.c | 107 ------------------
 5 files changed, 2 insertions(+), 120 deletions(-)
 delete mode 100644 scripts/gcc-plugins/arm_ssp_per_task_plugin.c

arch/arm/Kconfig +1 -2

index 835b5f100e92..6f037edf0f41 100644
@@ -1379,8 +1379,7 @@ config CC_HAVE_STACKPROTECTOR_TLS
 config STACKPROTECTOR_PER_TASK
        bool "Use a unique stack canary value for each task"
        depends on STACKPROTECTOR && CURRENT_POINTER_IN_TPIDRURO && !XIP_DEFLATED_DATA
-       depends on GCC_PLUGINS || CC_HAVE_STACKPROTECTOR_TLS
-       select GCC_PLUGIN_ARM_SSP_PER_TASK if !CC_HAVE_STACKPROTECTOR_TLS
+       depends on CC_HAVE_STACKPROTECTOR_TLS
        default y
        help
          Due to the fact that GCC uses an ordinary symbol reference from

arch/arm/boot/compressed/Makefile +1 -1

index 945b5975fce2..d61369b1eabe 100644
@@ -96,7 +96,7 @@ KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
 
 ccflags-y := -fpic $(call cc-option,-mno-single-pic-base,) -fno-builtin \
             -I$(srctree)/scripts/dtc/libfdt -fno-stack-protector \
-            -I$(obj) $(DISABLE_ARM_SSP_PER_TASK_PLUGIN)
+            -I$(obj)
 ccflags-remove-$(CONFIG_FUNCTION_TRACER) += -pg
 asflags-y := -DZIMAGE
 

scripts/Makefile.gcc-plugins +0 -6

index 6da109d563a5..194122d969a8 100644
@@ -36,12 +36,6 @@ ifdef CONFIG_GCC_PLUGIN_STACKLEAK
 endif
 export DISABLE_STACKLEAK_PLUGIN
 
-gcc-plugin-$(CONFIG_GCC_PLUGIN_ARM_SSP_PER_TASK) += arm_ssp_per_task_plugin.so
-ifdef CONFIG_GCC_PLUGIN_ARM_SSP_PER_TASK
-    DISABLE_ARM_SSP_PER_TASK_PLUGIN += -fplugin-arg-arm_ssp_per_task_plugin-disable
-endif
-export DISABLE_ARM_SSP_PER_TASK_PLUGIN
-
 # All the plugin CFLAGS are collected here in case a build target needs to
 # filter them out of the KBUILD_CFLAGS.
 GCC_PLUGINS_CFLAGS := $(strip $(addprefix -fplugin=$(objtree)/scripts/gcc-plugins/, $(gcc-plugin-y)) $(gcc-plugin-cflags-y))

scripts/gcc-plugins/Kconfig +0 -4

index ba868d1eef3d..6b34ba19358d 100644
@@ -36,8 +36,4 @@ config GCC_PLUGIN_LATENT_ENTROPY
           * https://grsecurity.net/
           * https://pax.grsecurity.net/
 
-config GCC_PLUGIN_ARM_SSP_PER_TASK
-       bool
-       depends on GCC_PLUGINS && ARM
-
 endif

scripts/gcc-plugins/arm_ssp_per_task_plugin.c deleted +0 -108

deleted file mode 100644
index 7328d037f975..000000000000
@@ -1,107 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-
-#include "gcc-common.h"
-
-__visible int plugin_is_GPL_compatible;
-
-static unsigned int canary_offset;
-
-static unsigned int arm_pertask_ssp_rtl_execute(void)
-{
-       rtx_insn *insn;
-
-       for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
-               const char *sym;
-               rtx body;
-               rtx current;
-
-               /*
-                * Find a SET insn involving a SYMBOL_REF to __stack_chk_guard
-                */
-               if (!INSN_P(insn))
-                       continue;
-               body = PATTERN(insn);
-               if (GET_CODE(body) != SET ||
-                   GET_CODE(SET_SRC(body)) != SYMBOL_REF)
-                       continue;
-               sym = XSTR(SET_SRC(body), 0);
-               if (strcmp(sym, "__stack_chk_guard"))
-                       continue;
-
-               /*
-                * Replace the source of the SET insn with an expression that
-                * produces the address of the current task's stack canary value
-                */
-               current = gen_reg_rtx(Pmode);
-
-               emit_insn_before(gen_load_tp_hard(current), insn);
-
-               SET_SRC(body) = gen_rtx_PLUS(Pmode, current,
-                                            GEN_INT(canary_offset));
-       }
-       return 0;
-}
-
-#define PASS_NAME arm_pertask_ssp_rtl
-
-#define NO_GATE
-#include "gcc-generate-rtl-pass.h"
-
-#if BUILDING_GCC_VERSION >= 9000
-static bool no(void)
-{
-       return false;
-}
-
-static void arm_pertask_ssp_start_unit(void *gcc_data, void *user_data)
-{
-       targetm.have_stack_protect_combined_set = no;
-       targetm.have_stack_protect_combined_test = no;
-}
-#endif
-
-__visible int plugin_init(struct plugin_name_args *plugin_info,
-                         struct plugin_gcc_version *version)
-{
-       const char * const plugin_name = plugin_info->base_name;
-       const int argc = plugin_info->argc;
-       const struct plugin_argument *argv = plugin_info->argv;
-       int i;
-
-       if (!plugin_default_version_check(version, &gcc_version)) {
-               error(G_("incompatible gcc/plugin versions"));
-               return 1;
-       }
-
-       for (i = 0; i < argc; ++i) {
-               if (!strcmp(argv[i].key, "disable"))
-                       return 0;
-
-               /* all remaining options require a value */
-               if (!argv[i].value) {
-                       error(G_("no value supplied for option '-fplugin-arg-%s-%s'"),
-                             plugin_name, argv[i].key);
-                       return 1;
-               }
-
-               if (!strcmp(argv[i].key, "offset")) {
-                       canary_offset = atoi(argv[i].value);
-                       continue;
-               }
-               error(G_("unknown option '-fplugin-arg-%s-%s'"),
-                     plugin_name, argv[i].key);
-               return 1;
-       }
-
-       PASS_INFO(arm_pertask_ssp_rtl, "expand", 1, PASS_POS_INSERT_AFTER);
-
-       register_callback(plugin_info->base_name, PLUGIN_PASS_MANAGER_SETUP,
-                         NULL, &arm_pertask_ssp_rtl_pass_info);
-
-#if BUILDING_GCC_VERSION >= 9000
-       register_callback(plugin_info->base_name, PLUGIN_START_UNIT,
-                         arm_pertask_ssp_start_unit, NULL);
-#endif
-
-       return 0;
-}
--

2.34.1

Quoted 6 lines · Kees Cook

As part of trying to remove GCC plugins from Linux, drop the ARM_SSP_PER_TASK plugin. The feature is available upstream since GCC 12, so anyone needing newer kernels with per-task ssp can update their compiler[1].

Quoted 3 lines

Suggested-by Arnd Bergmann <[email protected]>

Link https://lore.kernel.org/all/[email protected]/ [1] open here

Signed-off-by Kees Cook <[email protected]>

Acked-by Ard Biesheuvel <[email protected]>