Re: [RFC PATCH 05/28] x86: Define the stack protector guard symbol explicitly

From: Uros Bizjak
Date: Fri Oct 04 2024 - 06:02:15 EST


On Wed, Sep 25, 2024 at 5:02 PM Ard Biesheuvel <ardb+git@xxxxxxxxxx> wrote:
>
> From: Ard Biesheuvel <ardb@xxxxxxxxxx>
>
> Specify the guard symbol for the stack cookie explicitly, rather than
> positioning it exactly 40 bytes into the per-CPU area. Doing so removes
> the need for the per-CPU region to be absolute rather than relative to
> the placement of the per-CPU template region in the kernel image, and
> this allows the special handling for absolute per-CPU symbols to be
> removed entirely.
>
> This is a worthwhile cleanup in itself, but it is also a prerequisite
> for PIE codegen and PIE linking, which can replace our bespoke and
> rather clunky runtime relocation handling.
>
> Signed-off-by: Ard Biesheuvel <ardb@xxxxxxxxxx>
> ---
> arch/x86/Makefile | 4 ++++
> arch/x86/include/asm/init.h | 2 +-
> arch/x86/include/asm/processor.h | 11 +++--------
> arch/x86/include/asm/stackprotector.h | 4 ----
> tools/perf/util/annotate.c | 4 ++--
> 5 files changed, 10 insertions(+), 15 deletions(-)
>
> diff --git a/arch/x86/Makefile b/arch/x86/Makefile
> index 6b3fe6e2aadd..b78b7623a4a9 100644
> --- a/arch/x86/Makefile
> +++ b/arch/x86/Makefile
> @@ -193,6 +193,10 @@ else
> KBUILD_RUSTFLAGS += -Cno-redzone=y
> KBUILD_RUSTFLAGS += -Ccode-model=kernel
>
> + ifeq ($(CONFIG_STACKPROTECTOR),y)
> + KBUILD_CFLAGS += -mstack-protector-guard-symbol=fixed_percpu_data

Looking at:

> + * Since the irq_stack is the object at %gs:0, the bottom 8 bytes of
> + * the irq stack are reserved for the canary.

Please note that %gs:0 can also be achieved with
-mstack-protector-guard-offset=0

Uros.