5

All I was able to find out about the %gs register is, that it seems to be a free to use register on >32bit x86 architectures. It seems that a gs_change is executed before any system-call. Can someone point me to a documentation how this register is used for? — I assume its a register used for kernel-/user-mode switches.

The background of my question is, that I try to understand a kernel stack trace and what exactly happened.

The stack trace was produced from the flush process that reached the /proc/sys/kernel/hung_task_timeout_secs.

Improve this question

2 Answers 2

Reset to default
4

It seems %gs is reserved for GCC'c stack protection feature on x86 Linux kernel with CONFIG_CC_STACKPROTECTOR enabled in order to set up stack canaries. You can see some explanation at arch/x86/include/asm/stackportector.h.

Improve this answer
1
  • "On x86_64, %gs is shared by percpu area and stack canary."
    – sourcejedi
    Nov 17, 2016 at 12:44
2

As explained here:

https://lists.archive.carbon60.com/linux/kernel/970025

and here:

https://bromiumlabs.wordpress.com/2015/02/02/exploiting-badiret-vulnerability-cve-2014-9322-linux-kernel-privilege-escalation/

GS register is used to differentiate between usermode and kernel mode range of address, after adding the relevant logical address component.

The instruction swapgs is used to swap the GS register with the MSR values, and only in privileged mode this can be done.

For example, swapgs must always be done during the start of the IDT handler and after it, so that kernel mode memory is used.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .