]>
Commit | Line | Data |
---|---|---|
b2441318 | 1 | /* SPDX-License-Identifier: GPL-2.0 */ |
60a5317f TH |
2 | /* |
3 | * GCC stack protector support. | |
4 | * | |
5 | * Stack protector works by putting predefined pattern at the start of | |
6 | * the stack frame and verifying that it hasn't been overwritten when | |
7 | * returning from the function. The pattern is called stack canary | |
8 | * and unfortunately gcc requires it to be at a fixed offset from %gs. | |
9 | * On x86_64, the offset is 40 bytes and on x86_32 20 bytes. x86_64 | |
10 | * and x86_32 use segment registers differently and thus handles this | |
11 | * requirement differently. | |
12 | * | |
13 | * On x86_64, %gs is shared by percpu area and stack canary. All | |
14 | * percpu symbols are zero based and %gs points to the base of percpu | |
15 | * area. The first occupant of the percpu area is always | |
e6401c13 | 16 | * fixed_percpu_data which contains stack_canary at offset 40. Userland |
60a5317f TH |
17 | * %gs is always saved and restored on kernel entry and exit using |
18 | * swapgs, so stack protector doesn't add any complexity there. | |
19 | * | |
20 | * On x86_32, it's slightly more complicated. As in x86_64, %gs is | |
21 | * used for userland TLS. Unfortunately, some processors are much | |
22 | * slower at loading segment registers with different value when | |
23 | * entering and leaving the kernel, so the kernel uses %fs for percpu | |
24 | * area and manages %gs lazily so that %gs is switched only when | |
25 | * necessary, usually during task switch. | |
26 | * | |
27 | * As gcc requires the stack canary at %gs:20, %gs can't be managed | |
28 | * lazily if stack protector is enabled, so the kernel saves and | |
29 | * restores userland %gs on kernel entry and exit. This behavior is | |
30 | * controlled by CONFIG_X86_32_LAZY_GS and accessors are defined in | |
31 | * system.h to hide the details. | |
32 | */ | |
33 | ||
9b5609fd IM |
34 | #ifndef _ASM_STACKPROTECTOR_H |
35 | #define _ASM_STACKPROTECTOR_H 1 | |
36 | ||
050e9baa | 37 | #ifdef CONFIG_STACKPROTECTOR |
76397f72 | 38 | |
960a672b | 39 | #include <asm/tsc.h> |
947e76cd | 40 | #include <asm/processor.h> |
76397f72 | 41 | #include <asm/percpu.h> |
60a5317f | 42 | #include <asm/desc.h> |
952f07ec | 43 | |
76397f72 | 44 | #include <linux/random.h> |
952f07ec | 45 | #include <linux/sched.h> |
960a672b | 46 | |
60a5317f TH |
47 | /* |
48 | * 24 byte read-only segment initializer for stack canary. Linker | |
49 | * can't handle the address bit shifting. Address will be set in | |
50 | * head_32 for boot CPU and setup_per_cpu_areas() for others. | |
51 | */ | |
52 | #define GDT_STACK_CANARY_INIT \ | |
1e5de182 | 53 | [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18), |
60a5317f | 54 | |
18aa8bb1 IM |
55 | /* |
56 | * Initialize the stackprotector canary value. | |
57 | * | |
2563fd5e | 58 | * NOTE: this must only be called from functions that never return |
18aa8bb1 | 59 | * and it must always be inlined. |
2563fd5e BP |
60 | * |
61 | * In addition, it should be called from a compilation unit for which | |
62 | * stack protector is disabled. Alternatively, the caller should not end | |
63 | * with a function call which gets tail-call optimized as that would | |
64 | * lead to checking a modified canary value. | |
18aa8bb1 IM |
65 | */ |
66 | static __always_inline void boot_init_stack_canary(void) | |
67 | { | |
960a672b IM |
68 | u64 canary; |
69 | u64 tsc; | |
70 | ||
60a5317f | 71 | #ifdef CONFIG_X86_64 |
e6401c13 | 72 | BUILD_BUG_ON(offsetof(struct fixed_percpu_data, stack_canary) != 40); |
60a5317f | 73 | #endif |
c6e50f93 | 74 | /* |
960a672b IM |
75 | * We both use the random pool and the current TSC as a source |
76 | * of randomness. The TSC only matters for very early init, | |
77 | * there it already has some randomness on most systems. Later | |
78 | * on during the bootup the random pool has true entropy too. | |
18aa8bb1 | 79 | */ |
960a672b | 80 | get_random_bytes(&canary, sizeof(canary)); |
4ea1636b | 81 | tsc = rdtsc(); |
960a672b | 82 | canary += tsc + (tsc << 32UL); |
bf9eb544 | 83 | canary &= CANARY_MASK; |
960a672b IM |
84 | |
85 | current->stack_canary = canary; | |
60a5317f | 86 | #ifdef CONFIG_X86_64 |
e6401c13 | 87 | this_cpu_write(fixed_percpu_data.stack_canary, canary); |
60a5317f | 88 | #else |
c6ae41e7 | 89 | this_cpu_write(stack_canary.canary, canary); |
60a5317f TH |
90 | #endif |
91 | } | |
92 | ||
93 | static inline void setup_stack_canary_segment(int cpu) | |
94 | { | |
95 | #ifdef CONFIG_X86_32 | |
1ea0d14e | 96 | unsigned long canary = (unsigned long)&per_cpu(stack_canary, cpu); |
69218e47 | 97 | struct desc_struct *gdt_table = get_cpu_gdt_rw(cpu); |
60a5317f TH |
98 | struct desc_struct desc; |
99 | ||
100 | desc = gdt_table[GDT_ENTRY_STACK_CANARY]; | |
57594742 | 101 | set_desc_base(&desc, canary); |
60a5317f TH |
102 | write_gdt_entry(gdt_table, GDT_ENTRY_STACK_CANARY, &desc, DESCTYPE_S); |
103 | #endif | |
104 | } | |
105 | ||
106 | static inline void load_stack_canary_segment(void) | |
107 | { | |
108 | #ifdef CONFIG_X86_32 | |
109 | asm("mov %0, %%gs" : : "r" (__KERNEL_STACK_CANARY) : "memory"); | |
110 | #endif | |
111 | } | |
112 | ||
050e9baa | 113 | #else /* STACKPROTECTOR */ |
60a5317f TH |
114 | |
115 | #define GDT_STACK_CANARY_INIT | |
116 | ||
117 | /* dummy boot_init_stack_canary() is defined in linux/stackprotector.h */ | |
118 | ||
119 | static inline void setup_stack_canary_segment(int cpu) | |
120 | { } | |
121 | ||
122 | static inline void load_stack_canary_segment(void) | |
123 | { | |
124 | #ifdef CONFIG_X86_32 | |
125 | asm volatile ("mov %0, %%gs" : : "r" (0)); | |
126 | #endif | |
18aa8bb1 IM |
127 | } |
128 | ||
050e9baa | 129 | #endif /* STACKPROTECTOR */ |
76397f72 | 130 | #endif /* _ASM_STACKPROTECTOR_H */ |