2

All I was able to find out about the %gs register is, that it seems to be a free to use register on >32bit x86 architectures. It seems that a gs_change is executed before any system-call. Can someone point me to a documentation how this register is used for? — I assume its a register used for kernel-/user-mode switches.

The background of my question is, that I try to understand a kernel stack trace and what exactly happened.

The stack trace was produced from the flush process that reached the /proc/sys/kernel/hung_task_timeout_secs.

1

It seems %gs is reserved for GCC'c stack protection feature on x86 Linux kernel with CONFIG_CC_STACKPROTECTOR enabled in order to set up stack canaries. You can see some explanation at arch/x86/include/asm/stackportector.h.

  • "On x86_64, %gs is shared by percpu area and stack canary." – sourcejedi Nov 17 '16 at 12:44
2

As explained here:

http://www.gossamer-threads.com/lists/linux/kernel/970025

and here:

https://labs.bromium.com/2015/02/02/exploiting-badiret-vulnerability-cve-2014-9322-linux-kernel-privilege-escalation/

GS register is used to differentiate between usermode and kernel mode range of address, after adding the relevant logical address component.

The instruction swapgs is used to swap the GS register with the MSR values, and only in privileged mode this can be done.

For example, swapgs must always be done during the start of the IDT handler and after it, so that kernel mode memory is used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.