In a 32-bit SMP kernel, the stack canary is a percpu variable accessed
as %fs:__stack_chk_guard. However, the ABI for PVH entry does not
specify the %fs register state. It currently works because the initial
%fs register is 0x10 for QEMU, which is the same as $PVH_DS_SEL.
%However, for added safety, the percpu should be set up explicitly
%before calling xen_prepare_pvh(), which accesses the stack canary.

Signed-off-by: Hou Wenlong <houwenlong.hwl@antgroup.com>
---
 arch/x86/platform/pvh/head.S | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/x86/platform/pvh/head.S b/arch/x86/platform/pvh/head.S
index c4365a05ab83..cee4dadf5344 100644
--- a/arch/x86/platform/pvh/head.S
+++ b/arch/x86/platform/pvh/head.S
@@ -121,6 +121,10 @@ SYM_CODE_START_LOCAL(pvh_start_xen)
 
 	ljmp $PVH_CS_SEL, $1f
 1:
+	/* Set percpu for stack canary. */
+	mov $PVH_DS_SEL,%eax
+	mov %eax, %fs
+
 	call xen_prepare_pvh
 	mov $_pa(pvh_bootparams), %esi
 
-- 
2.31.1

On Mon, Oct 23, 2023 at 12:10 PM Hou Wenlong
<houwenlong.hwl@antgroup.com> wrote:
>
> In a 32-bit SMP kernel, the stack canary is a percpu variable accessed
> as %fs:__stack_chk_guard. However, the ABI for PVH entry does not
> specify the %fs register state. It currently works because the initial
> %fs register is 0x10 for QEMU, which is the same as $PVH_DS_SEL.

> %However, for added safety, the percpu should be set up explicitly
> %before calling xen_prepare_pvh(), which accesses the stack canary.

Stray leading % in two lines above.

-- 
With Best Regards,
Andy Shevchenko

On Mon, Oct 23, 2023 at 08:02:02PM +0800, Andy Shevchenko wrote:
> On Mon, Oct 23, 2023 at 12:10 PM Hou Wenlong
> <houwenlong.hwl@antgroup.com> wrote:
> >
> > In a 32-bit SMP kernel, the stack canary is a percpu variable accessed
> > as %fs:__stack_chk_guard. However, the ABI for PVH entry does not
> > specify the %fs register state. It currently works because the initial
> > %fs register is 0x10 for QEMU, which is the same as $PVH_DS_SEL.
> 
> > %However, for added safety, the percpu should be set up explicitly
> > %before calling xen_prepare_pvh(), which accesses the stack canary.
> 
> Stray leading % in two lines above.
>
Oh, sorry for that. It was added by mistake by my editor, and I didn't
carefully review it before sending.
 
Thanks!

> -- 
> With Best Regards,
> Andy Shevchenko