]>
Commit | Line | Data |
---|---|---|
60a5317f TH |
1 | /* |
2 | * GCC stack protector support. | |
3 | * | |
4 | * Stack protector works by putting predefined pattern at the start of | |
5 | * the stack frame and verifying that it hasn't been overwritten when | |
6 | * returning from the function. The pattern is called stack canary | |
7 | * and unfortunately gcc requires it to be at a fixed offset from %gs. | |
8 | * On x86_64, the offset is 40 bytes and on x86_32 20 bytes. x86_64 | |
9 | * and x86_32 use segment registers differently and thus handles this | |
10 | * requirement differently. | |
11 | * | |
12 | * On x86_64, %gs is shared by percpu area and stack canary. All | |
13 | * percpu symbols are zero based and %gs points to the base of percpu | |
14 | * area. The first occupant of the percpu area is always | |
15 | * irq_stack_union which contains stack_canary at offset 40. Userland | |
16 | * %gs is always saved and restored on kernel entry and exit using | |
17 | * swapgs, so stack protector doesn't add any complexity there. | |
18 | * | |
19 | * On x86_32, it's slightly more complicated. As in x86_64, %gs is | |
20 | * used for userland TLS. Unfortunately, some processors are much | |
21 | * slower at loading segment registers with different value when | |
22 | * entering and leaving the kernel, so the kernel uses %fs for percpu | |
23 | * area and manages %gs lazily so that %gs is switched only when | |
24 | * necessary, usually during task switch. | |
25 | * | |
26 | * As gcc requires the stack canary at %gs:20, %gs can't be managed | |
27 | * lazily if stack protector is enabled, so the kernel saves and | |
28 | * restores userland %gs on kernel entry and exit. This behavior is | |
29 | * controlled by CONFIG_X86_32_LAZY_GS and accessors are defined in | |
30 | * system.h to hide the details. | |
31 | */ | |
32 | ||
9b5609fd IM |
33 | #ifndef _ASM_STACKPROTECTOR_H |
34 | #define _ASM_STACKPROTECTOR_H 1 | |
35 | ||
76397f72 TH |
36 | #ifdef CONFIG_CC_STACKPROTECTOR |
37 | ||
960a672b | 38 | #include <asm/tsc.h> |
947e76cd | 39 | #include <asm/processor.h> |
76397f72 | 40 | #include <asm/percpu.h> |
60a5317f TH |
41 | #include <asm/system.h> |
42 | #include <asm/desc.h> | |
76397f72 | 43 | #include <linux/random.h> |
960a672b | 44 | |
60a5317f TH |
45 | /* |
46 | * 24 byte read-only segment initializer for stack canary. Linker | |
47 | * can't handle the address bit shifting. Address will be set in | |
48 | * head_32 for boot CPU and setup_per_cpu_areas() for others. | |
49 | */ | |
50 | #define GDT_STACK_CANARY_INIT \ | |
51 | [GDT_ENTRY_STACK_CANARY] = { { { 0x00000018, 0x00409000 } } }, | |
52 | ||
18aa8bb1 IM |
53 | /* |
54 | * Initialize the stackprotector canary value. | |
55 | * | |
56 | * NOTE: this must only be called from functions that never return, | |
57 | * and it must always be inlined. | |
58 | */ | |
59 | static __always_inline void boot_init_stack_canary(void) | |
60 | { | |
960a672b IM |
61 | u64 canary; |
62 | u64 tsc; | |
63 | ||
60a5317f | 64 | #ifdef CONFIG_X86_64 |
947e76cd | 65 | BUILD_BUG_ON(offsetof(union irq_stack_union, stack_canary) != 40); |
60a5317f | 66 | #endif |
c6e50f93 | 67 | /* |
960a672b IM |
68 | * We both use the random pool and the current TSC as a source |
69 | * of randomness. The TSC only matters for very early init, | |
70 | * there it already has some randomness on most systems. Later | |
71 | * on during the bootup the random pool has true entropy too. | |
18aa8bb1 | 72 | */ |
960a672b IM |
73 | get_random_bytes(&canary, sizeof(canary)); |
74 | tsc = __native_read_tsc(); | |
75 | canary += tsc + (tsc << 32UL); | |
76 | ||
77 | current->stack_canary = canary; | |
60a5317f | 78 | #ifdef CONFIG_X86_64 |
947e76cd | 79 | percpu_write(irq_stack_union.stack_canary, canary); |
60a5317f TH |
80 | #else |
81 | percpu_write(stack_canary, canary); | |
82 | #endif | |
83 | } | |
84 | ||
85 | static inline void setup_stack_canary_segment(int cpu) | |
86 | { | |
87 | #ifdef CONFIG_X86_32 | |
5c79d2a5 | 88 | unsigned long canary = (unsigned long)&per_cpu(stack_canary, cpu) - 20; |
60a5317f TH |
89 | struct desc_struct *gdt_table = get_cpu_gdt_table(cpu); |
90 | struct desc_struct desc; | |
91 | ||
92 | desc = gdt_table[GDT_ENTRY_STACK_CANARY]; | |
93 | desc.base0 = canary & 0xffff; | |
94 | desc.base1 = (canary >> 16) & 0xff; | |
95 | desc.base2 = (canary >> 24) & 0xff; | |
96 | write_gdt_entry(gdt_table, GDT_ENTRY_STACK_CANARY, &desc, DESCTYPE_S); | |
97 | #endif | |
98 | } | |
99 | ||
100 | static inline void load_stack_canary_segment(void) | |
101 | { | |
102 | #ifdef CONFIG_X86_32 | |
103 | asm("mov %0, %%gs" : : "r" (__KERNEL_STACK_CANARY) : "memory"); | |
104 | #endif | |
105 | } | |
106 | ||
107 | #else /* CC_STACKPROTECTOR */ | |
108 | ||
109 | #define GDT_STACK_CANARY_INIT | |
110 | ||
111 | /* dummy boot_init_stack_canary() is defined in linux/stackprotector.h */ | |
112 | ||
113 | static inline void setup_stack_canary_segment(int cpu) | |
114 | { } | |
115 | ||
116 | static inline void load_stack_canary_segment(void) | |
117 | { | |
118 | #ifdef CONFIG_X86_32 | |
119 | asm volatile ("mov %0, %%gs" : : "r" (0)); | |
120 | #endif | |
18aa8bb1 IM |
121 | } |
122 | ||
76397f72 TH |
123 | #endif /* CC_STACKPROTECTOR */ |
124 | #endif /* _ASM_STACKPROTECTOR_H */ |