From nobody Tue Dec 30 14:34:19 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4B1F4C2BB3F for ; Wed, 15 Nov 2023 17:37:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231668AbjKORh4 (ORCPT ); Wed, 15 Nov 2023 12:37:56 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60880 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232718AbjKORhl (ORCPT ); Wed, 15 Nov 2023 12:37:41 -0500 Received: from mail-qk1-x729.google.com (mail-qk1-x729.google.com [IPv6:2607:f8b0:4864:20::729]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 55161D48 for ; Wed, 15 Nov 2023 09:37:37 -0800 (PST) Received: by mail-qk1-x729.google.com with SMTP id af79cd13be357-7781bc3783fso459166285a.1 for ; Wed, 15 Nov 2023 09:37:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1700069855; x=1700674655; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=gtJ0rnAMMvu0qTTk2sGNJank9S4dE7egD/BT6LvuAOM=; b=gZeJ++nom6xVXbXIMXz0VIkKa1sAncCLIlYj5JtTC6ePRGw1xXyrHFGZeR57E4HkYf LXiO7bo8V8oDvcthsUmZjxHf6nZvQfEYIQVEYAiIyfGerfrKT8smaru22mDbg0wD0Jt/ GVlyaNs7LPjluOGEjcG/4+2UTtn6BN77TkJMemuJIFzHQbm2D1IV/LC0t3prAsaUOy5Y nW/hNZY5hRyG+dFTylA+y/Jb902iDMAWa+06XF7qb73UgwwOv6fzMA4bwwghxTNZvDWb hq3FTPYA6ixXGgnbXEhnwrzQv07ZEQCX6MJ9oXZOad4m/W/AhKTikbbYeRDKmWeRA9Qa 7EXw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1700069855; x=1700674655; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=gtJ0rnAMMvu0qTTk2sGNJank9S4dE7egD/BT6LvuAOM=; b=rgRM/B2JDIRYdUsIyA3MDPyGKLt+hHQwy8nWZ4/BfUvDg6NU4tvDU+VkS9UwQX7Eh6 vW/tJ9e2Mc31494eEab2q3TMqetODSEDymBuc5ogZoPJpV24orrWSMZSqnINqt+/WhoU hhCqKL0gI+wQKPdwrNFC1Yz37kuDkKUMDROj//vGVTG+dAm2eVOjz5O37/yuoa51NiTz r9/WU8BW+PuqKNrAJQDhfoECA3NllpfYX1Gb5YGOHXMS9Vysrb0IWeCu3tFO0oUU4O8C IXVw1IVKKB/qxnBH5CYiCxP6LAQidBDeHDLsFKAlBctwqcdiNu3yxKUUpEeoWCh4Thy/ C19A== X-Gm-Message-State: AOJu0YwDpYXAgZKBB48PqzGVVYT8B8dLSw8JdxTXr08xEaxgZ5atKo2+ h/CCR9ncJp28BcTaRQ6TxMWQGRF6Bw== X-Google-Smtp-Source: AGHT+IGoyEoIHIylVJJPlxpgTBEFasM2YeujOc6F2/G6+EUfcXBIXlq9zuNoBlNn/MVBwRskr5jCng== X-Received: by 2002:a05:620a:29c8:b0:76f:1d46:4a9f with SMTP id s8-20020a05620a29c800b0076f1d464a9fmr5982220qkp.4.1700069855299; Wed, 15 Nov 2023 09:37:35 -0800 (PST) Received: from citadel.lan ([2600:6c4a:4d3f:6d5c::1019]) by smtp.gmail.com with ESMTPSA id x20-20020a05620a0b5400b0077bda014d8esm3260099qkg.87.2023.11.15.09.37.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Nov 2023 09:37:34 -0800 (PST) From: Brian Gerst To: linux-kernel@vger.kernel.org, x86@kernel.org Cc: Ingo Molnar , Thomas Gleixner , Borislav Petkov , "H . Peter Anvin" , Peter Zijlstra , Uros Bizjak , David.Laight@aculab.com, Brian Gerst Subject: [PATCH v3 08/14] x86/stackprotector/64: Convert to normal percpu variable Date: Wed, 15 Nov 2023 12:37:02 -0500 Message-ID: <20231115173708.108316-9-brgerst@gmail.com> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20231115173708.108316-1-brgerst@gmail.com> References: <20231115173708.108316-1-brgerst@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Older versions of GCC fixed the location of the stack protector canary at %gs:40. This constraint forced the percpu section to be linked at virtual address 0 so that the canary could be the first data object in the percpu section. Supporting the zero-based percpu section requires additional code to handle relocations for RIP-relative references to percpu data, extra complexity to kallsyms, and workarounds for linker bugs due to the use of absolute symbols. Use compiler options to redefine the stack protector location if supported, otherwise use objtool. This will remove the contraint that the percpu section must be zero-based. Signed-off-by: Brian Gerst --- arch/x86/Kconfig | 11 ++++---- arch/x86/Makefile | 21 ++++++++++------ arch/x86/entry/entry_64.S | 2 +- arch/x86/include/asm/processor.h | 16 ++---------- arch/x86/include/asm/stackprotector.h | 36 ++++----------------------- arch/x86/kernel/asm-offsets_64.c | 6 ----- arch/x86/kernel/cpu/common.c | 4 +-- arch/x86/kernel/head_64.S | 3 +-- arch/x86/xen/xen-head.S | 3 +-- 9 files changed, 30 insertions(+), 72 deletions(-) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 6cee46127fd2..83404b741c0a 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -266,7 +266,7 @@ config X86 select HAVE_FUNCTION_ARG_ACCESS_API select HAVE_SETUP_PER_CPU_AREA select HAVE_SOFTIRQ_ON_OWN_STACK - select HAVE_STACKPROTECTOR if CC_HAS_SANE_STACKPROTECTOR + select HAVE_STACKPROTECTOR if X86_64 || CC_HAS_SANE_STACKPROTECTOR select HAVE_STACK_VALIDATION if HAVE_OBJTOOL select HAVE_STATIC_CALL select HAVE_STATIC_CALL_INLINE if HAVE_OBJTOOL @@ -410,15 +410,14 @@ config PGTABLE_LEVELS =20 config CC_HAS_SANE_STACKPROTECTOR bool - default y if 64BIT + default $(cc-option,-mstack-protector-guard-reg=3Dgs -mstack-protector-gu= ard-symbol=3D__stack_chk_guard) if 64BIT default $(cc-option,-mstack-protector-guard-reg=3Dfs -mstack-protector-gu= ard-symbol=3D__stack_chk_guard) - help - We have to make sure stack protector is unconditionally disabled if - the compiler does not allow control of the segment and symbol. =20 config STACKPROTECTOR_OBJTOOL bool - default n + depends on X86_64 && STACKPROTECTOR + default !CC_HAS_SANE_STACKPROTECTOR + prompt "Debug objtool stack protector conversion" if CC_HAS_SANE_STACKPRO= TECTOR && DEBUG_KERNEL =20 menu "Processor type and features" =20 diff --git a/arch/x86/Makefile b/arch/x86/Makefile index 1a068de12a56..06a79361e88f 100644 --- a/arch/x86/Makefile +++ b/arch/x86/Makefile @@ -112,13 +112,7 @@ ifeq ($(CONFIG_X86_32),y) # temporary until string.h is fixed KBUILD_CFLAGS +=3D -ffreestanding =20 - ifeq ($(CONFIG_STACKPROTECTOR),y) - ifeq ($(CONFIG_SMP),y) - KBUILD_CFLAGS +=3D -mstack-protector-guard-reg=3Dfs -mstack-protector-g= uard-symbol=3D__stack_chk_guard - else - KBUILD_CFLAGS +=3D -mstack-protector-guard=3Dglobal - endif - endif + percpu_seg :=3D fs else BITS :=3D 64 UTS_MACHINE :=3D x86_64 @@ -168,6 +162,19 @@ else KBUILD_CFLAGS +=3D -mcmodel=3Dkernel KBUILD_RUSTFLAGS +=3D -Cno-redzone=3Dy KBUILD_RUSTFLAGS +=3D -Ccode-model=3Dkernel + + percpu_seg :=3D gs +endif + +ifeq ($(CONFIG_STACKPROTECTOR),y) + ifneq ($(CONFIG_STACKPROTECTOR_OBJTOOL),y) + ifeq ($(CONFIG_SMP),y) + KBUILD_CFLAGS +=3D -mstack-protector-guard-reg=3D$(percpu_seg) + KBUILD_CFLAGS +=3D -mstack-protector-guard-symbol=3D__stack_chk_guard + else + KBUILD_CFLAGS +=3D -mstack-protector-guard=3Dglobal + endif + endif endif =20 # diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S index 1a88ad8a7b48..cddcc236aaae 100644 --- a/arch/x86/entry/entry_64.S +++ b/arch/x86/entry/entry_64.S @@ -190,7 +190,7 @@ SYM_FUNC_START(__switch_to_asm) =20 #ifdef CONFIG_STACKPROTECTOR movq TASK_stack_canary(%rsi), %rbx - movq %rbx, PER_CPU_VAR(fixed_percpu_data + FIXED_stack_canary) + movq %rbx, PER_CPU_VAR(__stack_chk_guard) #endif =20 /* diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/proces= sor.h index 061aa86b4662..3ee091225904 100644 --- a/arch/x86/include/asm/processor.h +++ b/arch/x86/include/asm/processor.h @@ -394,16 +394,8 @@ struct irq_stack { =20 #ifdef CONFIG_X86_64 struct fixed_percpu_data { - /* - * GCC hardcodes the stack canary as %gs:40. Since the - * irq_stack is the object at %gs:0, we reserve the bottom - * 48 bytes of the irq stack for the canary. - * - * Once we are willing to require -mstack-protector-guard-symbol=3D - * support for x86_64 stackprotector, we can get rid of this. - */ char gs_base[40]; - unsigned long stack_canary; + unsigned long reserved; }; =20 DECLARE_PER_CPU_FIRST(struct fixed_percpu_data, fixed_percpu_data) __visib= le; @@ -418,11 +410,7 @@ extern asmlinkage void entry_SYSCALL32_ignore(void); =20 /* Save actual FS/GS selectors and bases to current->thread */ void current_save_fsgs(void); -#else /* X86_64 */ -#ifdef CONFIG_STACKPROTECTOR -DECLARE_PER_CPU(unsigned long, __stack_chk_guard); -#endif -#endif /* !X86_64 */ +#endif /* X86_64 */ =20 struct perf_event; =20 diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/s= tackprotector.h index 00473a650f51..d43fb589fcf6 100644 --- a/arch/x86/include/asm/stackprotector.h +++ b/arch/x86/include/asm/stackprotector.h @@ -2,26 +2,10 @@ /* * GCC stack protector support. * - * Stack protector works by putting predefined pattern at the start of + * Stack protector works by putting a predefined pattern at the start of * the stack frame and verifying that it hasn't been overwritten when - * returning from the function. The pattern is called stack canary - * and unfortunately gcc historically required it to be at a fixed offset - * from the percpu segment base. On x86_64, the offset is 40 bytes. - * - * The same segment is shared by percpu area and stack canary. On - * x86_64, percpu symbols are zero based and %gs (64-bit) points to the - * base of percpu area. The first occupant of the percpu area is always - * fixed_percpu_data which contains stack_canary at the appropriate - * offset. On x86_32, the stack canary is just a regular percpu - * variable. - * - * Putting percpu data in %fs on 32-bit is a minor optimization compared to - * using %gs. Since 32-bit userspace normally has %fs =3D=3D 0, we are li= kely - * to load 0 into %fs on exit to usermode, whereas with percpu data in - * %gs, we are likely to load a non-null %gs on return to user mode. - * - * Once we are willing to require GCC 8.1 or better for 64-bit stackprotec= tor - * support, we can remove some of this complexity. + * returning from the function. The pattern is called the stack canary + * and is a unique value for each task. */ =20 #ifndef _ASM_STACKPROTECTOR_H @@ -36,6 +20,8 @@ =20 #include =20 +DECLARE_PER_CPU(unsigned long, __stack_chk_guard); + /* * Initialize the stackprotector canary value. * @@ -51,25 +37,13 @@ static __always_inline void boot_init_stack_canary(void) { unsigned long canary =3D get_random_canary(); =20 -#ifdef CONFIG_X86_64 - BUILD_BUG_ON(offsetof(struct fixed_percpu_data, stack_canary) !=3D 40); -#endif - current->stack_canary =3D canary; -#ifdef CONFIG_X86_64 - this_cpu_write(fixed_percpu_data.stack_canary, canary); -#else this_cpu_write(__stack_chk_guard, canary); -#endif } =20 static inline void cpu_init_stack_canary(int cpu, struct task_struct *idle) { -#ifdef CONFIG_X86_64 - per_cpu(fixed_percpu_data.stack_canary, cpu) =3D idle->stack_canary; -#else per_cpu(__stack_chk_guard, cpu) =3D idle->stack_canary; -#endif } =20 #else /* STACKPROTECTOR */ diff --git a/arch/x86/kernel/asm-offsets_64.c b/arch/x86/kernel/asm-offsets= _64.c index bb65371ea9df..590b6cd0eac0 100644 --- a/arch/x86/kernel/asm-offsets_64.c +++ b/arch/x86/kernel/asm-offsets_64.c @@ -54,11 +54,5 @@ int main(void) BLANK(); #undef ENTRY =20 - BLANK(); - -#ifdef CONFIG_STACKPROTECTOR - OFFSET(FIXED_stack_canary, fixed_percpu_data, stack_canary); - BLANK(); -#endif return 0; } diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index 4d4b87c6885d..b5b1d95b1399 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -2111,15 +2111,13 @@ void syscall_init(void) X86_EFLAGS_AC|X86_EFLAGS_ID); } =20 -#else /* CONFIG_X86_64 */ +#endif /* CONFIG_X86_64 */ =20 #ifdef CONFIG_STACKPROTECTOR DEFINE_PER_CPU(unsigned long, __stack_chk_guard); EXPORT_PER_CPU_SYMBOL(__stack_chk_guard); #endif =20 -#endif /* CONFIG_X86_64 */ - /* * Clear all 6 debug registers: */ diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S index 3dcabbc49149..0d94d2a091fe 100644 --- a/arch/x86/kernel/head_64.S +++ b/arch/x86/kernel/head_64.S @@ -345,8 +345,7 @@ SYM_INNER_LABEL(secondary_startup_64_no_verify, SYM_L_G= LOBAL) =20 /* Set up %gs. * - * The base of %gs always points to fixed_percpu_data. If the - * stack protector canary is enabled, it is located at %gs:40. + * The base of %gs always points to fixed_percpu_data. * Note that, on SMP, the boot cpu uses init data section until * the per cpu areas are set up. */ diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S index a0ea285878db..30f27e757354 100644 --- a/arch/x86/xen/xen-head.S +++ b/arch/x86/xen/xen-head.S @@ -53,8 +53,7 @@ SYM_CODE_START(startup_xen) =20 /* Set up %gs. * - * The base of %gs always points to fixed_percpu_data. If the - * stack protector canary is enabled, it is located at %gs:40. + * The base of %gs always points to fixed_percpu_data. * Note that, on SMP, the boot cpu uses init data section until * the per cpu areas are set up. */ --=20 2.41.0