Both GCC and Clang support -fstack-protector feature, which add stack canaries to functions where stack corruption is possible. This series makes possible to use this feature in Xen. I tested this on ARM64 and it is working as intended. Tested both with GCC and Clang. My aim was to enable it on x86 also, but it appears that on x86 GCC stores canary value in TLS, exactly at fs:40, which is hardcoded. As Xen does not setup fs register for itself, any attempt to enable stack protector leads to paging abort. I also tested build-ability for RISCV platform, but didn't tested that it does not break anything, so we will need RISCV maintainer's approval. Volodymyr Babchuk (3): xen: common: add ability to enable stack protector xen: arm: enable stack protector feature xen: riscv: enable stack protector feature Config.mk | 2 +- stubdom/Makefile | 2 ++ tools/firmware/Rules.mk | 2 ++ tools/tests/x86_emulator/testcase.mk | 2 ++ xen/Makefile | 6 ++++++ xen/arch/arm/Kconfig | 1 + xen/arch/arm/setup.c | 3 +++ xen/arch/riscv/Kconfig | 1 + xen/arch/riscv/setup.c | 3 +++ xen/common/Kconfig | 13 ++++++++++++ xen/common/Makefile | 1 + xen/common/stack_protector.c | 16 +++++++++++++++ xen/include/xen/stack_protector.h | 30 ++++++++++++++++++++++++++++ 13 files changed, 81 insertions(+), 1 deletion(-) create mode 100644 xen/common/stack_protector.c create mode 100644 xen/include/xen/stack_protector.h -- 2.47.0 Both GCC and Clang support -fstack-protector feature, which add stack canaries to functions where stack corruption is possible. This patch makes general preparations to enable this feature on different supported architectures: - "-fno-stack-protector" is removed from global config - Added CONFIG_HAS_STACK_PROTECTOR option so each architecture can enable this feature individually - Added user-selectable CONFIG_STACK_PROTECTOR option - Implemented code that sets up random stack canary and a basic handler for stack protector failures Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com> --- Config.mk | 2 +- stubdom/Makefile | 2 ++ tools/firmware/Rules.mk | 2 ++ tools/tests/x86_emulator/testcase.mk | 2 ++ xen/Makefile | 6 ++++++ xen/common/Kconfig | 13 ++++++++++++ xen/common/Makefile | 1 + xen/common/stack_protector.c | 16 +++++++++++++++ xen/include/xen/stack_protector.h | 30 ++++++++++++++++++++++++++++ 9 files changed, 73 insertions(+), 1 deletion(-) create mode 100644 xen/common/stack_protector.c create mode 100644 xen/include/xen/stack_protector.h diff --git a/Config.mk b/Config.mk index XXXXXXX..XXXXXXX 100644 --- a/Config.mk +++ b/Config.mk @@ -XXX,XX +XXX,XX @@ endif APPEND_LDFLAGS += $(foreach i, $(APPEND_LIB), -L$(i)) APPEND_CFLAGS += $(foreach i, $(APPEND_INCLUDES), -I$(i)) -EMBEDDED_EXTRA_CFLAGS := -fno-pie -fno-stack-protector -fno-stack-protector-all +EMBEDDED_EXTRA_CFLAGS := -fno-pie EMBEDDED_EXTRA_CFLAGS += -fno-exceptions -fno-asynchronous-unwind-tables XEN_EXTFILES_URL ?= https://xenbits.xen.org/xen-extfiles diff --git a/stubdom/Makefile b/stubdom/Makefile index XXXXXXX..XXXXXXX 100644 --- a/stubdom/Makefile +++ b/stubdom/Makefile @@ -XXX,XX +XXX,XX @@ TARGET_CFLAGS += $(CFLAGS) TARGET_CPPFLAGS += $(CPPFLAGS) $(call cc-options-add,TARGET_CFLAGS,CC,$(EMBEDDED_EXTRA_CFLAGS)) +$(call cc-option-add,TARGET_CFLAGS,CC,-fno-stack-protector) + # Do not use host headers and libs GCC_INSTALL = $(shell LANG=C gcc -print-search-dirs | sed -n -e 's/install: \(.*\)/\1/p') TARGET_CPPFLAGS += -U __linux__ -U __FreeBSD__ -U __sun__ diff --git a/tools/firmware/Rules.mk b/tools/firmware/Rules.mk index XXXXXXX..XXXXXXX 100644 --- a/tools/firmware/Rules.mk +++ b/tools/firmware/Rules.mk @@ -XXX,XX +XXX,XX @@ $(call cc-options-add,CFLAGS,CC,$(EMBEDDED_EXTRA_CFLAGS)) $(call cc-option-add,CFLAGS,CC,-fcf-protection=none) +$(call cc-option-add,CFLAGS,CC,-fno-stack-protector) + # Do not add the .note.gnu.property section to any of the firmware objects: it # breaks the rombios binary and is not useful for firmware anyway. $(call cc-option-add,CFLAGS,CC,-Wa$$(comma)-mx86-used-note=no) diff --git a/tools/tests/x86_emulator/testcase.mk b/tools/tests/x86_emulator/testcase.mk index XXXXXXX..XXXXXXX 100644 --- a/tools/tests/x86_emulator/testcase.mk +++ b/tools/tests/x86_emulator/testcase.mk @@ -XXX,XX +XXX,XX @@ include $(XEN_ROOT)/tools/Rules.mk $(call cc-options-add,CFLAGS,CC,$(EMBEDDED_EXTRA_CFLAGS)) +$(call cc-option-add,CFLAGS,CC,-fno-stack-protector) + CFLAGS += -fno-builtin -g0 $($(TESTCASE)-cflags) LDFLAGS_DIRECT += $(shell { $(LD) -v --warn-rwx-segments; } >/dev/null 2>&1 && echo --no-warn-rwx-segments) diff --git a/xen/Makefile b/xen/Makefile index XXXXXXX..XXXXXXX 100644 --- a/xen/Makefile +++ b/xen/Makefile @@ -XXX,XX +XXX,XX @@ else CFLAGS_UBSAN := endif +ifeq ($(CONFIG_STACK_PROTECTOR),y) +CFLAGS += -fstack-protector +else +CFLAGS += -fno-stack-protector +endif + ifeq ($(CONFIG_LTO),y) CFLAGS += -flto LDFLAGS-$(CONFIG_CC_IS_CLANG) += -plugin LLVMgold.so diff --git a/xen/common/Kconfig b/xen/common/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/xen/common/Kconfig +++ b/xen/common/Kconfig @@ -XXX,XX +XXX,XX @@ config HAS_UBSAN config HAS_VMAP bool +config HAS_STACK_PROTECTOR + bool + config MEM_ACCESS_ALWAYS_ON bool @@ -XXX,XX +XXX,XX @@ config TRACEBUFFER to be collected at run time for debugging or performance analysis. Memory and execution overhead when not active is minimal. +config STACK_PROTECTOR + bool "Stack protection" + depends on HAS_STACK_PROTECTOR + help + Use compiler's option -fstack-protector (supported both by GCC + and clang) to generate code that checks for corrupted stack + and halts the system in case of any problems. + + Please note that this option will impair performance. + endmenu diff --git a/xen/common/Makefile b/xen/common/Makefile index XXXXXXX..XXXXXXX 100644 --- a/xen/common/Makefile +++ b/xen/common/Makefile @@ -XXX,XX +XXX,XX @@ obj-y += shutdown.o obj-y += softirq.o obj-y += smp.o obj-y += spinlock.o +obj-$(CONFIG_STACK_PROTECTOR) += stack_protector.o obj-y += stop_machine.o obj-y += symbols.o obj-y += tasklet.o diff --git a/xen/common/stack_protector.c b/xen/common/stack_protector.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/xen/common/stack_protector.c @@ -XXX,XX +XXX,XX @@ +// SPDX-License-Identifier: GPL-2.0-only +#include <xen/lib.h> +#include <xen/random.h> + +#ifndef CONFIG_X86 +/* + * GCC uses TLS to store stack canary value on x86. + * All other platforms use this global variable. + */ +unsigned long __stack_chk_guard; +#endif + +void __stack_chk_fail(void) +{ + panic("Detected stack corruption\n"); +} diff --git a/xen/include/xen/stack_protector.h b/xen/include/xen/stack_protector.h new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/xen/include/xen/stack_protector.h @@ -XXX,XX +XXX,XX @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +#ifndef XEN__STACK_PROTECTOR_H +#define XEN__STACK_PROTECTOR_H + +#ifdef CONFIG_STACKPROTECTOR + +#ifndef CONFIG_X86 +extern unsigned long __stack_chk_guard; +#endif + +/* + * This function should be always inlined. Also it should be called + * from a function that never returns. + */ +static inline void boot_stack_chk_guard_setup(void) +{ + __stack_chk_guard = get_random(); + if (BITS_PER_LONG == 64) + __stack_chk_guard |= ((unsigned long)get_random()) << 32; +} + +#else + +static inline void boot_stack_chk_guard_setup(void) {} + +#endif /* CONFIG_STACKPROTECTOR */ + +#endif /* XEN__STACK_PROTECTOR_H */ + -- 2.47.0 Enable previously added CONFIG_STACK_PROTECTOR feature for ARM platform. Here we can call boot_stack_chk_guard_setup() in start_xen() function, because it never returns, so stack protector code will not be triggered because of changed canary. Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com> --- xen/arch/arm/Kconfig | 1 + xen/arch/arm/setup.c | 3 +++ 2 files changed, 4 insertions(+) diff --git a/xen/arch/arm/Kconfig b/xen/arch/arm/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/xen/arch/arm/Kconfig +++ b/xen/arch/arm/Kconfig @@ -XXX,XX +XXX,XX @@ config ARM select HAS_PASSTHROUGH select HAS_UBSAN select IOMMU_FORCE_PT_SHARE + select HAS_STACK_PROTECTOR config ARCH_DEFCONFIG string diff --git a/xen/arch/arm/setup.c b/xen/arch/arm/setup.c index XXXXXXX..XXXXXXX 100644 --- a/xen/arch/arm/setup.c +++ b/xen/arch/arm/setup.c @@ -XXX,XX +XXX,XX @@ #include <xen/domain_page.h> #include <xen/grant_table.h> #include <xen/types.h> +#include <xen/stack_protector.h> #include <xen/string.h> #include <xen/serial.h> #include <xen/sched.h> @@ -XXX,XX +XXX,XX @@ void asmlinkage __init start_xen(unsigned long fdt_paddr) */ system_state = SYS_STATE_boot; + boot_stack_chk_guard_setup(); + if ( acpi_disabled ) { printk("Booting using Device Tree\n"); -- 2.47.0 Enable previously added CONFIG_STACK_PROTECTOR feature for RISC-V platform. Here we can call boot_stack_chk_guard_setup() in start_xen() function, because it never returns, so stack protector code will not be triggered because of changed canary. Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com> --- I tested this patch for buildability, but didn't verified that Xen really boots on RISC-V when this feature is enabled. So I am asking RISC-V maintainers to provide feedback on it. --- xen/arch/riscv/Kconfig | 1 + xen/arch/riscv/setup.c | 3 +++ 2 files changed, 4 insertions(+) diff --git a/xen/arch/riscv/Kconfig b/xen/arch/riscv/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/xen/arch/riscv/Kconfig +++ b/xen/arch/riscv/Kconfig @@ -XXX,XX +XXX,XX @@ config RISCV select HAS_DEVICE_TREE select HAS_PMAP select HAS_VMAP + select HAS_STACK_PROTECTOR config RISCV_64 def_bool y diff --git a/xen/arch/riscv/setup.c b/xen/arch/riscv/setup.c index XXXXXXX..XXXXXXX 100644 --- a/xen/arch/riscv/setup.c +++ b/xen/arch/riscv/setup.c @@ -XXX,XX +XXX,XX @@ #include <xen/init.h> #include <xen/mm.h> #include <xen/shutdown.h> +#include <xen/stack_protector.h> #include <public/version.h> @@ -XXX,XX +XXX,XX @@ void __init noreturn start_xen(unsigned long bootcpu_id, if ( !boot_fdt_info(device_tree_flattened, dtb_addr) ) BUG(); + boot_stack_chk_guard_setup(); + cmdline = boot_fdt_cmdline(device_tree_flattened); printk("Command line: %s\n", cmdline); cmdline_parse(cmdline); -- 2.47.0 Both GCC and Clang support -fstack-protector feature, which add stack canaries to functions where stack corruption is possible. This series makes possible to use this feature in Xen. I tested this on ARM64 and it is working as intended. Tested both with GCC and Clang. It is hard to enable this feature on x86, as GCC stores stack canary in %fs:40 by default, but Xen can't use %fs for various reasons. It is possibly to change stack canary location new newer GCC versions, but this will change minimal GCC requirement, which is also hard due to various reasons. So, this series focus mostly on ARM and RISCV. Changes in v2: - Patch "xen: common: add ability to enable stack protector" was divided into two patches. - Rebase onto Andrew's patch that removes -fno-stack-protector-all - Tested on RISC-V thanks to Oleksii Kurochko - Changes in individual patches covered in their respect commit messages Volodymyr Babchuk (4): common: remove -fno-stack-protector from EMBEDDED_EXTRA_CFLAGS xen: common: add ability to enable stack protector xen: arm: enable stack protector feature xen: riscv: enable stack protector feature Config.mk | 2 +- stubdom/Makefile | 2 ++ tools/firmware/Rules.mk | 2 ++ tools/tests/x86_emulator/testcase.mk | 2 ++ xen/Makefile | 6 ++++++ xen/arch/arm/Kconfig | 1 + xen/arch/arm/setup.c | 3 +++ xen/arch/riscv/Kconfig | 1 + xen/arch/riscv/setup.c | 3 +++ xen/common/Kconfig | 17 ++++++++++++++++ xen/common/Makefile | 1 + xen/common/stack-protector.c | 10 ++++++++++ xen/include/xen/stack-protector.h | 29 ++++++++++++++++++++++++++++ 13 files changed, 78 insertions(+), 1 deletion(-) create mode 100644 xen/common/stack-protector.c create mode 100644 xen/include/xen/stack-protector.h -- 2.47.1 This patch is preparation for making stack protector configurable. First step is to remove -fno-stack-protector flag from EMBEDDED_EXTRA_CFLAGS so separate projects (Hypervisor in this case) can enable/disable this feature by themselves. Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com> --- Changes in v2: - New in v2 --- Config.mk | 2 +- stubdom/Makefile | 2 ++ tools/firmware/Rules.mk | 2 ++ tools/tests/x86_emulator/testcase.mk | 2 ++ xen/Makefile | 2 ++ 5 files changed, 9 insertions(+), 1 deletion(-) diff --git a/Config.mk b/Config.mk index XXXXXXX..XXXXXXX 100644 --- a/Config.mk +++ b/Config.mk @@ -XXX,XX +XXX,XX @@ endif APPEND_LDFLAGS += $(foreach i, $(APPEND_LIB), -L$(i)) APPEND_CFLAGS += $(foreach i, $(APPEND_INCLUDES), -I$(i)) -EMBEDDED_EXTRA_CFLAGS := -fno-pie -fno-stack-protector +EMBEDDED_EXTRA_CFLAGS := -fno-pie EMBEDDED_EXTRA_CFLAGS += -fno-exceptions -fno-asynchronous-unwind-tables XEN_EXTFILES_URL ?= https://xenbits.xen.org/xen-extfiles diff --git a/stubdom/Makefile b/stubdom/Makefile index XXXXXXX..XXXXXXX 100644 --- a/stubdom/Makefile +++ b/stubdom/Makefile @@ -XXX,XX +XXX,XX @@ TARGET_CFLAGS += $(CFLAGS) TARGET_CPPFLAGS += $(CPPFLAGS) $(call cc-options-add,TARGET_CFLAGS,CC,$(EMBEDDED_EXTRA_CFLAGS)) +$(call cc-option-add,TARGET_CFLAGS,CC,-fno-stack-protector) + # Do not use host headers and libs GCC_INSTALL = $(shell LANG=C gcc -print-search-dirs | sed -n -e 's/install: \(.*\)/\1/p') TARGET_CPPFLAGS += -U __linux__ -U __FreeBSD__ -U __sun__ diff --git a/tools/firmware/Rules.mk b/tools/firmware/Rules.mk index XXXXXXX..XXXXXXX 100644 --- a/tools/firmware/Rules.mk +++ b/tools/firmware/Rules.mk @@ -XXX,XX +XXX,XX @@ $(call cc-options-add,CFLAGS,CC,$(EMBEDDED_EXTRA_CFLAGS)) $(call cc-option-add,CFLAGS,CC,-fcf-protection=none) +$(call cc-option-add,CFLAGS,CC,-fno-stack-protector) + # Do not add the .note.gnu.property section to any of the firmware objects: it # breaks the rombios binary and is not useful for firmware anyway. $(call cc-option-add,CFLAGS,CC,-Wa$$(comma)-mx86-used-note=no) diff --git a/tools/tests/x86_emulator/testcase.mk b/tools/tests/x86_emulator/testcase.mk index XXXXXXX..XXXXXXX 100644 --- a/tools/tests/x86_emulator/testcase.mk +++ b/tools/tests/x86_emulator/testcase.mk @@ -XXX,XX +XXX,XX @@ include $(XEN_ROOT)/tools/Rules.mk $(call cc-options-add,CFLAGS,CC,$(EMBEDDED_EXTRA_CFLAGS)) +$(call cc-option-add,CFLAGS,CC,-fno-stack-protector) + CFLAGS += -fno-builtin -g0 $($(TESTCASE)-cflags) LDFLAGS_DIRECT += $(shell { $(LD) -v --warn-rwx-segments; } >/dev/null 2>&1 && echo --no-warn-rwx-segments) diff --git a/xen/Makefile b/xen/Makefile index XXXXXXX..XXXXXXX 100644 --- a/xen/Makefile +++ b/xen/Makefile @@ -XXX,XX +XXX,XX @@ else CFLAGS_UBSAN := endif +CFLAGS += -fno-stack-protector + ifeq ($(CONFIG_LTO),y) CFLAGS += -flto LDFLAGS-$(CONFIG_CC_IS_CLANG) += -plugin LLVMgold.so -- 2.47.1 Both GCC and Clang support -fstack-protector feature, which add stack canaries to functions where stack corruption is possible. This patch makes general preparations to enable this feature on different supported architectures: - Added CONFIG_HAS_STACK_PROTECTOR option so each architecture can enable this feature individually - Added user-selectable CONFIG_STACK_PROTECTOR option - Implemented code that sets up random stack canary and a basic handler for stack protector failures Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com> --- Changes in v2: - Moved changes to EMBEDDED_EXTRA_CFLAGS into separate patch - Renamed stack_protector.c to stack-protector.c - Renamed stack_protector.h to stack-protector.h - Removed #ifdef CONFIG_X86 in stack-protector.h - Updated comment in stack-protector.h (also, we can't call boot_stack_chk_guard_setup() from asm code in general case, because it calls get_random() and get_random() may depend in per_cpu infrastructure, which is initialized later) - Fixed coding style - Moved CONFIG_STACK_PROTECTOR into newly added "Compiler options" submenu - Marked __stack_chk_guard as __ro_after_init --- xen/Makefile | 4 ++++ xen/common/Kconfig | 17 +++++++++++++++++ xen/common/Makefile | 1 + xen/common/stack-protector.c | 10 ++++++++++ xen/include/xen/stack-protector.h | 29 +++++++++++++++++++++++++++++ 5 files changed, 61 insertions(+) create mode 100644 xen/common/stack-protector.c create mode 100644 xen/include/xen/stack-protector.h diff --git a/xen/Makefile b/xen/Makefile index XXXXXXX..XXXXXXX 100644 --- a/xen/Makefile +++ b/xen/Makefile @@ -XXX,XX +XXX,XX @@ else CFLAGS_UBSAN := endif +ifeq ($(CONFIG_STACK_PROTECTOR),y) +CFLAGS += -fstack-protector +else CFLAGS += -fno-stack-protector +endif ifeq ($(CONFIG_LTO),y) CFLAGS += -flto diff --git a/xen/common/Kconfig b/xen/common/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/xen/common/Kconfig +++ b/xen/common/Kconfig @@ -XXX,XX +XXX,XX @@ config HAS_UBSAN config HAS_VMAP bool +config HAS_STACK_PROTECTOR + bool + config MEM_ACCESS_ALWAYS_ON bool @@ -XXX,XX +XXX,XX @@ config SPECULATIVE_HARDEN_LOCK endmenu +menu "Compiler options" + +config STACK_PROTECTOR + bool "Stack protection" + depends on HAS_STACK_PROTECTOR + help + Use compiler's option -fstack-protector (supported both by GCC + and Clang) to generate code that checks for corrupted stack + and halts the system in case of any problems. + + Please note that this option will impair performance. + +endmenu + config DIT_DEFAULT bool "Data Independent Timing default" depends on HAS_DIT diff --git a/xen/common/Makefile b/xen/common/Makefile index XXXXXXX..XXXXXXX 100644 --- a/xen/common/Makefile +++ b/xen/common/Makefile @@ -XXX,XX +XXX,XX @@ obj-y += shutdown.o obj-y += softirq.o obj-y += smp.o obj-y += spinlock.o +obj-$(CONFIG_STACK_PROTECTOR) += stack-protector.o obj-y += stop_machine.o obj-y += symbols.o obj-y += tasklet.o diff --git a/xen/common/stack-protector.c b/xen/common/stack-protector.c new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/xen/common/stack-protector.c @@ -XXX,XX +XXX,XX @@ +// SPDX-License-Identifier: GPL-2.0-only +#include <xen/lib.h> +#include <xen/random.h> + +unsigned long __ro_after_init __stack_chk_guard; + +void __stack_chk_fail(void) +{ + panic("Detected stack corruption\n"); +} diff --git a/xen/include/xen/stack-protector.h b/xen/include/xen/stack-protector.h new file mode 100644 index XXXXXXX..XXXXXXX --- /dev/null +++ b/xen/include/xen/stack-protector.h @@ -XXX,XX +XXX,XX @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +#ifndef XEN__STACK_PROTECTOR_H +#define XEN__STACK_PROTECTOR_H + +#ifdef CONFIG_STACKPROTECTOR + +extern unsigned long __stack_chk_guard; + +/* + * This function should be always inlined. Also it should be called + * from a function that never returns or a function that with + * stack-protector disabled. + */ +static always_inline void boot_stack_chk_guard_setup(void) +{ + __stack_chk_guard = get_random(); + if (BITS_PER_LONG == 64) + __stack_chk_guard |= ((unsigned long)get_random()) << 32; +} + +#else + +static inline void boot_stack_chk_guard_setup(void) {} + +#endif /* CONFIG_STACKPROTECTOR */ + +#endif /* XEN__STACK_PROTECTOR_H */ + -- 2.47.1 Enable previously added CONFIG_STACK_PROTECTOR feature for ARM platform. Here we can call boot_stack_chk_guard_setup() in start_xen() function, because it never returns, so stack protector code will not be triggered because of changed canary. Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com> --- In v2: - Reordered Kconfig entry --- xen/arch/arm/Kconfig | 1 + xen/arch/arm/setup.c | 3 +++ 2 files changed, 4 insertions(+) diff --git a/xen/arch/arm/Kconfig b/xen/arch/arm/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/xen/arch/arm/Kconfig +++ b/xen/arch/arm/Kconfig @@ -XXX,XX +XXX,XX @@ config ARM select HAS_ALTERNATIVE if HAS_VMAP select HAS_DEVICE_TREE select HAS_PASSTHROUGH + select HAS_STACK_PROTECTOR select HAS_UBSAN select IOMMU_FORCE_PT_SHARE diff --git a/xen/arch/arm/setup.c b/xen/arch/arm/setup.c index XXXXXXX..XXXXXXX 100644 --- a/xen/arch/arm/setup.c +++ b/xen/arch/arm/setup.c @@ -XXX,XX +XXX,XX @@ #include <xen/domain_page.h> #include <xen/grant_table.h> #include <xen/types.h> +#include <xen/stack-protector.h> #include <xen/string.h> #include <xen/serial.h> #include <xen/sched.h> @@ -XXX,XX +XXX,XX @@ void asmlinkage __init start_xen(unsigned long fdt_paddr) */ system_state = SYS_STATE_boot; + boot_stack_chk_guard_setup(); + if ( acpi_disabled ) { printk("Booting using Device Tree\n"); -- 2.47.1 Enable previously added CONFIG_STACK_PROTECTOR feature for RISC-V platform. Here we can call boot_stack_chk_guard_setup() in start_xen() function, because it never returns, so stack protector code will not be triggered because of changed canary. Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@epam.com> Tested-by: Oleksii Kurochko <oleksii.kurochko@gmail.com> --- In v2: - Reordered Kconfig entry - Added Oleksii's Tested-by tag --- xen/arch/riscv/Kconfig | 1 + xen/arch/riscv/setup.c | 3 +++ 2 files changed, 4 insertions(+) diff --git a/xen/arch/riscv/Kconfig b/xen/arch/riscv/Kconfig index XXXXXXX..XXXXXXX 100644 --- a/xen/arch/riscv/Kconfig +++ b/xen/arch/riscv/Kconfig @@ -XXX,XX +XXX,XX @@ config RISCV select GENERIC_BUG_FRAME select HAS_DEVICE_TREE select HAS_PMAP + select HAS_STACK_PROTECTOR select HAS_VMAP config RISCV_64 diff --git a/xen/arch/riscv/setup.c b/xen/arch/riscv/setup.c index XXXXXXX..XXXXXXX 100644 --- a/xen/arch/riscv/setup.c +++ b/xen/arch/riscv/setup.c @@ -XXX,XX +XXX,XX @@ #include <xen/init.h> #include <xen/mm.h> #include <xen/shutdown.h> +#include <xen/stack-protector.h> #include <xen/vmap.h> #include <public/version.h> @@ -XXX,XX +XXX,XX @@ void __init noreturn start_xen(unsigned long bootcpu_id, if ( !boot_fdt_info(device_tree_flattened, dtb_addr) ) BUG(); + boot_stack_chk_guard_setup(); + cmdline = boot_fdt_cmdline(device_tree_flattened); printk("Command line: %s\n", cmdline); cmdline_parse(cmdline); -- 2.47.1