linux-kernel - Re: [PATCH v5 08/16] x86/stackprotector/64: Convert to normal percpu variable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMzpN2h05N+KZzpFY6YXZjMViK+_U9gks36mOfRJpSOMY-Xm5A@mail.gmail.com>
Date: Sat, 15 Feb 2025 12:38:21 -0500
From: Brian Gerst <brgerst@...il.com>
To: Borislav Petkov <bp@...en8.de>
Cc: linux-kernel@...r.kernel.org, x86@...nel.org, 
	Ingo Molnar <mingo@...nel.org>, "H . Peter Anvin" <hpa@...or.com>, Thomas Gleixner <tglx@...utronix.de>, 
	Ard Biesheuvel <ardb@...nel.org>, Uros Bizjak <ubizjak@...il.com>
Subject: Re: [PATCH v5 08/16] x86/stackprotector/64: Convert to normal percpu variable

On Sat, Feb 15, 2025 at 9:27 AM Borislav Petkov <bp@...en8.de> wrote:
>
> On Tue, Nov 05, 2024 at 10:57:53AM -0500, Brian Gerst wrote:
> > Older versions of GCC fixed the location of the stack protector canary
> > at %gs:40.  This constraint forced the percpu section to be linked at
> > absolute address 0 so that the canary could be the first data object in
> > the percpu section.  Supporting the zero-based percpu section requires
> > additional code to handle relocations for RIP-relative references to
> > percpu data, extra complexity to kallsyms, and workarounds for linker
> > bugs due to the use of absolute symbols.
> >
> > GCC 8.1 supports redefining where the canary is located, allowng it to
> > become a normal percpu variable instead of at a fixed location.  This
> > removes the contraint that the percpu section must be zero-based.
>
> Unknown word [contraint] in commit message.
> Suggestions: ['constraint',...
>
> Use a spellchecker for your commit messages please.
>
> > diff --git a/arch/x86/Makefile b/arch/x86/Makefile
> > index 5b773b34768d..88a1705366f9 100644
> > --- a/arch/x86/Makefile
> > +++ b/arch/x86/Makefile
> > @@ -140,14 +140,7 @@ ifeq ($(CONFIG_X86_32),y)
> >          # temporary until string.h is fixed
> >          KBUILD_CFLAGS += -ffreestanding
> >
> > -    ifeq ($(CONFIG_STACKPROTECTOR),y)
> > -        ifeq ($(CONFIG_SMP),y)
> > -            KBUILD_CFLAGS += -mstack-protector-guard-reg=fs \
> > -                             -mstack-protector-guard-symbol=__ref_stack_chk_guard
> > -        else
> > -            KBUILD_CFLAGS += -mstack-protector-guard=global
> > -        endif
> > -    endif
> > +        percpu_seg := fs
>
> Any particular reason this var is not in all caps like the rest of the vars in
> this file?
>
>         PERCPU_SEG := fs

The convention appears to me to be that all caps are used for global
variables used by the core build scripts and/or exported to
subdirectory makefiles, whereas lower case is for local variables.

PS.  Please comment on the most recent patch series, v6.



Brian Gerst