Commit | Line | Data |
---|---|---|
60a5317f TH |
1 | /* |
2 | * GCC stack protector support. | |
3 | * | |
4 | * Stack protector works by putting predefined pattern at the start of | |
5 | * the stack frame and verifying that it hasn't been overwritten when | |
6 | * returning from the function. The pattern is called stack canary | |
7 | * and unfortunately gcc requires it to be at a fixed offset from %gs. | |
8 | * On x86_64, the offset is 40 bytes and on x86_32 20 bytes. x86_64 | |
9 | * and x86_32 use segment registers differently and thus handles this | |
10 | * requirement differently. | |
11 | * | |
12 | * On x86_64, %gs is shared by percpu area and stack canary. All | |
13 | * percpu symbols are zero based and %gs points to the base of percpu | |
14 | * area. The first occupant of the percpu area is always | |
15 | * irq_stack_union which contains stack_canary at offset 40. Userland | |
16 | * %gs is always saved and restored on kernel entry and exit using | |
17 | * swapgs, so stack protector doesn't add any complexity there. | |
18 | * | |
19 | * On x86_32, it's slightly more complicated. As in x86_64, %gs is | |
20 | * used for userland TLS. Unfortunately, some processors are much | |
21 | * slower at loading segment registers with different value when | |
22 | * entering and leaving the kernel, so the kernel uses %fs for percpu | |
23 | * area and manages %gs lazily so that %gs is switched only when | |
24 | * necessary, usually during task switch. | |
25 | * | |
26 | * As gcc requires the stack canary at %gs:20, %gs can't be managed | |
27 | * lazily if stack protector is enabled, so the kernel saves and | |
28 | * restores userland %gs on kernel entry and exit. This behavior is | |
29 | * controlled by CONFIG_X86_32_LAZY_GS and accessors are defined in | |
30 | * system.h to hide the details. | |
31 | */ | |
32 | ||
9b5609fd IM |
33 | #ifndef _ASM_STACKPROTECTOR_H |
34 | #define _ASM_STACKPROTECTOR_H 1 | |
35 | ||
76397f72 TH |
36 | #ifdef CONFIG_CC_STACKPROTECTOR |
37 | ||
960a672b | 38 | #include <asm/tsc.h> |
947e76cd | 39 | #include <asm/processor.h> |
76397f72 | 40 | #include <asm/percpu.h> |
60a5317f | 41 | #include <asm/desc.h> |
952f07ec | 42 | |
76397f72 | 43 | #include <linux/random.h> |
952f07ec | 44 | #include <linux/sched.h> |
960a672b | 45 | |
60a5317f TH |
46 | /* |
47 | * 24 byte read-only segment initializer for stack canary. Linker | |
48 | * can't handle the address bit shifting. Address will be set in | |
49 | * head_32 for boot CPU and setup_per_cpu_areas() for others. | |
50 | */ | |
51 | #define GDT_STACK_CANARY_INIT \ | |
1e5de182 | 52 | [GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18), |
60a5317f | 53 | |
18aa8bb1 IM |
54 | /* |
55 | * Initialize the stackprotector canary value. | |
56 | * | |
57 | * NOTE: this must only be called from functions that never return, | |
58 | * and it must always be inlined. | |
59 | */ | |
60 | static __always_inline void boot_init_stack_canary(void) | |
61 | { | |
960a672b IM |
62 | u64 canary; |
63 | u64 tsc; | |
64 | ||
60a5317f | 65 | #ifdef CONFIG_X86_64 |
947e76cd | 66 | BUILD_BUG_ON(offsetof(union irq_stack_union, stack_canary) != 40); |
60a5317f | 67 | #endif |
c6e50f93 | 68 | /* |
960a672b IM |
69 | * We both use the random pool and the current TSC as a source |
70 | * of randomness. The TSC only matters for very early init, | |
71 | * there it already has some randomness on most systems. Later | |
72 | * on during the bootup the random pool has true entropy too. | |
18aa8bb1 | 73 | */ |
960a672b IM |
74 | get_random_bytes(&canary, sizeof(canary)); |
75 | tsc = __native_read_tsc(); | |
76 | canary += tsc + (tsc << 32UL); | |
77 | ||
78 | current->stack_canary = canary; | |
60a5317f | 79 | #ifdef CONFIG_X86_64 |
c6ae41e7 | 80 | this_cpu_write(irq_stack_union.stack_canary, canary); |
60a5317f | 81 | #else |
c6ae41e7 | 82 | this_cpu_write(stack_canary.canary, canary); |
60a5317f TH |
83 | #endif |
84 | } | |
85 | ||
86 | static inline void setup_stack_canary_segment(int cpu) | |
87 | { | |
88 | #ifdef CONFIG_X86_32 | |
1ea0d14e | 89 | unsigned long canary = (unsigned long)&per_cpu(stack_canary, cpu); |
60a5317f TH |
90 | struct desc_struct *gdt_table = get_cpu_gdt_table(cpu); |
91 | struct desc_struct desc; | |
92 | ||
93 | desc = gdt_table[GDT_ENTRY_STACK_CANARY]; | |
57594742 | 94 | set_desc_base(&desc, canary); |
60a5317f TH |
95 | write_gdt_entry(gdt_table, GDT_ENTRY_STACK_CANARY, &desc, DESCTYPE_S); |
96 | #endif | |
97 | } | |
98 | ||
99 | static inline void load_stack_canary_segment(void) | |
100 | { | |
101 | #ifdef CONFIG_X86_32 | |
102 | asm("mov %0, %%gs" : : "r" (__KERNEL_STACK_CANARY) : "memory"); | |
103 | #endif | |
104 | } | |
105 | ||
106 | #else /* CC_STACKPROTECTOR */ | |
107 | ||
108 | #define GDT_STACK_CANARY_INIT | |
109 | ||
110 | /* dummy boot_init_stack_canary() is defined in linux/stackprotector.h */ | |
111 | ||
112 | static inline void setup_stack_canary_segment(int cpu) | |
113 | { } | |
114 | ||
115 | static inline void load_stack_canary_segment(void) | |
116 | { | |
117 | #ifdef CONFIG_X86_32 | |
118 | asm volatile ("mov %0, %%gs" : : "r" (0)); | |
119 | #endif | |
18aa8bb1 IM |
120 | } |
121 | ||
76397f72 TH |
122 | #endif /* CC_STACKPROTECTOR */ |
123 | #endif /* _ASM_STACKPROTECTOR_H */ |