]>
Commit | Line | Data |
---|---|---|
b2441318 | 1 | /* SPDX-License-Identifier: GPL-2.0 */ |
60a5317f TH |
2 | /* |
3 | * GCC stack protector support. | |
4 | * | |
5 | * Stack protector works by putting predefined pattern at the start of | |
6 | * the stack frame and verifying that it hasn't been overwritten when | |
7 | * returning from the function. The pattern is called stack canary | |
8 | * and unfortunately gcc requires it to be at a fixed offset from %gs. | |
9 | * On x86_64, the offset is 40 bytes and on x86_32 20 bytes. x86_64 | |
10 | * and x86_32 use segment registers differently and thus handles this | |
11 | * requirement differently. | |
12 | * | |
13 | * On x86_64, %gs is shared by percpu area and stack canary. All | |
14 | * percpu symbols are zero based and %gs points to the base of percpu | |
15 | * area. The first occupant of the percpu area is always | |
16 | * irq_stack_union which contains stack_canary at offset 40. Userland | |
17 | * %gs is always saved and restored on kernel entry and exit using | |
18 | * swapgs, so stack protector doesn't add any complexity there. | |
19 | * | |
20 | * On x86_32, it's slightly more complicated. As in x86_64, %gs is | |
21 | * used for userland TLS. Unfortunately, some processors are much | |
22 | * slower at loading segment registers with different value when | |
23 | * entering and leaving the kernel, so the kernel uses %fs for percpu | |
24 | * area and manages %gs lazily so that %gs is switched only when | |
25 | * necessary, usually during task switch. | |
26 | * | |
27 | * As gcc requires the stack canary at %gs:20, %gs can't be managed | |
28 | * lazily if stack protector is enabled, so the kernel saves and | |
29 | * restores userland %gs on kernel entry and exit. This behavior is | |
30 | * controlled by CONFIG_X86_32_LAZY_GS and accessors are defined in | |
31 | * system.h to hide the details. | |
32 | */ | |
33 | ||
9b5609fd IM |
34 | #ifndef _ASM_STACKPROTECTOR_H |
35 | #define _ASM_STACKPROTECTOR_H 1 | |
36 | ||
76397f72 TH |
37 | #ifdef CONFIG_CC_STACKPROTECTOR |
38 | ||
960a672b | 39 | #include <asm/tsc.h> |
947e76cd | 40 | #include <asm/processor.h> |
76397f72 | 41 | #include <asm/percpu.h> |
60a5317f | 42 | #include <asm/desc.h> |
952f07ec | 43 | |
76397f72 | 44 | #include <linux/random.h> |
952f07ec | 45 | #include <linux/sched.h> |
960a672b | 46 | |
60a5317f TH |
47 | /* |
48 | * 24 byte read-only segment initializer for stack canary. Linker | |
49 | * can't handle the address bit shifting. Address will be set in | |
50 | * head_32 for boot CPU and setup_per_cpu_areas() for others. | |
51 | */ | |
52 | #define GDT_STACK_CANARY_INIT \ | |
1e5de182 | 53 | [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18), |
60a5317f | 54 | |
18aa8bb1 IM |
55 | /* |
56 | * Initialize the stackprotector canary value. | |
57 | * | |
58 | * NOTE: this must only be called from functions that never return, | |
59 | * and it must always be inlined. | |
60 | */ | |
61 | static __always_inline void boot_init_stack_canary(void) | |
62 | { | |
960a672b IM |
63 | u64 canary; |
64 | u64 tsc; | |
65 | ||
60a5317f | 66 | #ifdef CONFIG_X86_64 |
947e76cd | 67 | BUILD_BUG_ON(offsetof(union irq_stack_union, stack_canary) != 40); |
60a5317f | 68 | #endif |
c6e50f93 | 69 | /* |
960a672b IM |
70 | * We both use the random pool and the current TSC as a source |
71 | * of randomness. The TSC only matters for very early init, | |
72 | * there it already has some randomness on most systems. Later | |
73 | * on during the bootup the random pool has true entropy too. | |
18aa8bb1 | 74 | */ |
960a672b | 75 | get_random_bytes(&canary, sizeof(canary)); |
4ea1636b | 76 | tsc = rdtsc(); |
960a672b | 77 | canary += tsc + (tsc << 32UL); |
bf9eb544 | 78 | canary &= CANARY_MASK; |
960a672b IM |
79 | |
80 | current->stack_canary = canary; | |
60a5317f | 81 | #ifdef CONFIG_X86_64 |
c6ae41e7 | 82 | this_cpu_write(irq_stack_union.stack_canary, canary); |
60a5317f | 83 | #else |
c6ae41e7 | 84 | this_cpu_write(stack_canary.canary, canary); |
60a5317f TH |
85 | #endif |
86 | } | |
87 | ||
88 | static inline void setup_stack_canary_segment(int cpu) | |
89 | { | |
90 | #ifdef CONFIG_X86_32 | |
1ea0d14e | 91 | unsigned long canary = (unsigned long)&per_cpu(stack_canary, cpu); |
69218e47 | 92 | struct desc_struct *gdt_table = get_cpu_gdt_rw(cpu); |
60a5317f TH |
93 | struct desc_struct desc; |
94 | ||
95 | desc = gdt_table[GDT_ENTRY_STACK_CANARY]; | |
57594742 | 96 | set_desc_base(&desc, canary); |
60a5317f TH |
97 | write_gdt_entry(gdt_table, GDT_ENTRY_STACK_CANARY, &desc, DESCTYPE_S); |
98 | #endif | |
99 | } | |
100 | ||
101 | static inline void load_stack_canary_segment(void) | |
102 | { | |
103 | #ifdef CONFIG_X86_32 | |
104 | asm("mov %0, %%gs" : : "r" (__KERNEL_STACK_CANARY) : "memory"); | |
105 | #endif | |
106 | } | |
107 | ||
108 | #else /* CC_STACKPROTECTOR */ | |
109 | ||
110 | #define GDT_STACK_CANARY_INIT | |
111 | ||
112 | /* dummy boot_init_stack_canary() is defined in linux/stackprotector.h */ | |
113 | ||
114 | static inline void setup_stack_canary_segment(int cpu) | |
115 | { } | |
116 | ||
117 | static inline void load_stack_canary_segment(void) | |
118 | { | |
119 | #ifdef CONFIG_X86_32 | |
120 | asm volatile ("mov %0, %%gs" : : "r" (0)); | |
121 | #endif | |
18aa8bb1 IM |
122 | } |
123 | ||
76397f72 TH |
124 | #endif /* CC_STACKPROTECTOR */ |
125 | #endif /* _ASM_STACKPROTECTOR_H */ |