[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v3 0/3] Add stack protector
- To: "xen-devel@xxxxxxxxxxxxxxxxxxxx" <xen-devel@xxxxxxxxxxxxxxxxxxxx>
- From: Volodymyr Babchuk <Volodymyr_Babchuk@xxxxxxxx>
- Date: Wed, 11 Dec 2024 02:04:29 +0000
- Accept-language: en-US
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=epam.com; dmarc=pass action=none header.from=epam.com; dkim=pass header.d=epam.com; arc=none
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=0uyBEB374CkngndbajozsDBZqYCopKoEd2ngGW9fDSo=; b=mscycyAlL259n0oPg0QusTRbSe9jQ6OruQR7hMzDbDgY85ptBQLoa9WBeZJMn7YkXQoR6zRUJd9adso83D9k0ZFVYwn4twC6ehgfQC65TbzAOn++6ZLKEgjslQD92F8rKVVapSgoKix5u7BWLlKlV3XdHDPZWrG4pZtjPma3lLey1opAGDKFYDcErVQUj/+oHeEvv26FBEqkwLmaQ9RhkEvWZWQxoh9YYanCKwjQif7luKnCvb/XSDbVxBIjUQepiWR0Na6PqvLyrkZ6FW+hmjrda2m+uRePKSLSrizBiNZPgYcBiiiyqY3Wv6lxYc7RSFjoV7Btc8s/aFQOYl8RNA==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=ateuc/89uYLq+AWZwc/O/XrrNINlCu1oghvI7Q/QydrfTVCw1DLblhLtS0qnRiV8XE2QCwpzXKAjG+joj4KUG5tt8VFurtq7PoKzi1sPSZ7khxuagjCJpakX5qhdsJPGowY/ofkmJQ28AftkYzxed/P60x/iHVR2AmJGUMQNpt+JJ7luTpgOcR9CihM6is2tqCLWaiM1iI4x5/xblAUAuxzPd56Euy4lxsNtL/fKE8WqEj3tnJtMXx//Ym4HxwU/vHy5RwVjpM/G2Fybt6B8md1QgT5H+kABt4YYmR/+YTHvGoKc/zaTBTJO34jk4Z338dTSSmuMufgGSQHggNi3tA==
- Authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=epam.com;
- Cc: Volodymyr Babchuk <Volodymyr_Babchuk@xxxxxxxx>, Andrew Cooper <andrew.cooper3@xxxxxxxxxx>, Jan Beulich <jbeulich@xxxxxxxx>, Julien Grall <julien@xxxxxxx>, Stefano Stabellini <sstabellini@xxxxxxxxxx>, Anthony PERARD <anthony.perard@xxxxxxxxxx>, Samuel Thibault <samuel.thibault@xxxxxxxxxxxx>, Roger Pau Monné <roger.pau@xxxxxxxxxx>, Bertrand Marquis <bertrand.marquis@xxxxxxx>, Michal Orzel <michal.orzel@xxxxxxx>, Volodymyr Babchuk <Volodymyr_Babchuk@xxxxxxxx>
- Delivery-date: Wed, 11 Dec 2024 02:04:46 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
- Thread-index: AQHbS3EDPfnUwIrgWUmXfq3bo38udA==
- Thread-topic: [PATCH v3 0/3] Add stack protector
Both GCC and Clang support -fstack-protector feature, which add stack
canaries to functions where stack corruption is possible. This series
makes possible to use this feature in Xen. I tested this on ARM64 and
it is working as intended. Tested both with GCC and Clang.
It is hard to enable this feature on x86, as GCC stores stack canary
in %fs:40 by default, but Xen can't use %fs for various reasons. It is
possibly to change stack canary location new newer GCC versions, but
this will change minimal GCC requirement, which is also hard due to
various reasons. So, this series focus mostly on ARM and RISCV.
Changes in v3:
- Removed patch for riscv
- Changes in individual patches are covered in their respect commit
messages
Changes in v2:
- Patch "xen: common: add ability to enable stack protector" was
divided into two patches.
- Rebase onto Andrew's patch that removes -fno-stack-protector-all
- Tested on RISC-V thanks to Oleksii Kurochko
- Changes in individual patches covered in their respect commit
messages
Volodymyr Babchuk (3):
common: remove -fno-stack-protector from EMBEDDED_EXTRA_CFLAGS
xen: common: add ability to enable stack protector
xen: arm: enable stack protector feature
Config.mk | 2 +-
stubdom/Makefile | 3 ++
tools/firmware/Rules.mk | 2 ++
tools/tests/x86_emulator/testcase.mk | 2 +-
xen/Makefile | 6 ++++
xen/arch/arm/Kconfig | 1 +
xen/arch/arm/arm64/head.S | 3 ++
xen/arch/arm/setup.c | 3 ++
xen/common/Kconfig | 15 +++++++++
xen/common/Makefile | 1 +
xen/common/stack-protector.c | 47 ++++++++++++++++++++++++++++
xen/include/asm-generic/random.h | 5 +++
xen/include/xen/stack-protector.h | 30 ++++++++++++++++++
13 files changed, 118 insertions(+), 2 deletions(-)
create mode 100644 xen/common/stack-protector.c
create mode 100644 xen/include/xen/stack-protector.h
--
2.47.1
|
