From patchwork Wed Dec 11 02:04:30 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Volodymyr Babchuk X-Patchwork-Id: 13902747 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 4CB32E7717F for ; Wed, 11 Dec 2024 02:04:55 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.853575.1266993 (Exim 4.92) (envelope-from ) id 1tLC5e-0004oR-7a; Wed, 11 Dec 2024 02:04:38 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 853575.1266993; Wed, 11 Dec 2024 02:04:38 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1tLC5e-0004oK-43; Wed, 11 Dec 2024 02:04:38 +0000 Received: by outflank-mailman (input) for mailman id 853575; Wed, 11 Dec 2024 02:04:37 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1tLC5d-0004a4-8x for xen-devel@lists.xenproject.org; Wed, 11 Dec 2024 02:04:37 +0000 Received: from EUR02-VI1-obe.outbound.protection.outlook.com (mail-vi1eur02on2060a.outbound.protection.outlook.com [2a01:111:f403:2607::60a]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 4575a80b-b764-11ef-a0d5-8be0dac302b0; Wed, 11 Dec 2024 03:04:36 +0100 (CET) Received: from GV1PR03MB10456.eurprd03.prod.outlook.com (2603:10a6:150:16a::21) by AS8PR03MB9365.eurprd03.prod.outlook.com (2603:10a6:20b:57d::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8230.18; Wed, 11 Dec 2024 02:04:31 +0000 Received: from GV1PR03MB10456.eurprd03.prod.outlook.com ([fe80::a41e:5aa8:e298:757e]) by GV1PR03MB10456.eurprd03.prod.outlook.com ([fe80::a41e:5aa8:e298:757e%7]) with mapi id 15.20.8251.008; Wed, 11 Dec 2024 02:04:31 +0000 X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 4575a80b-b764-11ef-a0d5-8be0dac302b0 ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=uqsXJqDz9igsmEp6Br/L++gm0CBerS4O09IZEZUzmZaGtkTlELYnajTMtHIHPfrvTjgF0Rt5miJwN8Oz7sUzUESdeqQPUyoT011L5VUIcvnJi2asQ90vSYZUrqXrn77yBTh4+0ammVNAQLNUfn0lYhdkVZfufV5C4+Iimufx+h3GBBBrEwhx+EfQ7xecRk9pp8Pg3oQyeC9Lcm3FcgcpVpXfYWO3ZTeyK7jZ4RdJxx4t+ixzmmFOk4DXhlV9opKY2wO8o80/25YL45N72L+/6jzOaput/MdAF/epkZL9MRrwP4SgxNfLLy7+b+5oAfX6vOFriocGLFux8NiUvx0fpQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=+SBVbnyLD0YPGsHrZbGEmWYLQu4GIjmGITJeCVcu8vk=; b=fNnkVxVw61t8Oa3qbWWo0MTbeD1J+F9g8mZoiq1lSTPfGWpYWpyCX2DuvOE1VYL3lYWvdA6Ger8EYjl2GDdloG7w4QUGSck3vxOg0MHZDK5jH0mf+q01UykhqtUU0wxOfquD47S/vnf4Evb/j7yLi6Ik4onHqh7Ep4dXzNjmNR4b1Cecl8osIhfQk/sIkxAlIFD7kObW36haeHAWIm6eI9ozUY0M3z+WLVyGGXPcIQ5f753c5oP6NHk/Bpsm3RBso8dC+DToX1lyQ7PsulIgu2Jj6sDu9NZUL+uk4toPLbsGks2jaVO9Zo2xBJJw0NsJsX2gOj3EZpQSe91CbWYW4w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=epam.com; dmarc=pass action=none header.from=epam.com; dkim=pass header.d=epam.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=epam.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=+SBVbnyLD0YPGsHrZbGEmWYLQu4GIjmGITJeCVcu8vk=; b=UEGY2LCgSvh5EQ5iIwGEdFVE5kWvND8GihaXi7iBdGpNihebU/yBumi8K/qkaoPdbsmRfkWlfEBWzwrb+c942lB3AjabfJkrAwt7KYH5wdAoS37312zZpDHL8OzS/vKMe4ghXN53DtPXINjO12v/8ITm9chAA/H7F5E5V2vErCX4r21nULKWofbz0qe3mxiS22ld774XjeQyH010BguCwH7UHQJjObHhmQVbJCmVqPYQMqVY+CDPwlohEN/n4f1UhS8gBw0TJY2mB2vnQHc4FunkwWCJPLx4kfQIuCX4JZqu5jbDdYXuB//HbdVIo6H4eaZRteYnYxPgqiRhGHVwlw== From: Volodymyr Babchuk To: "xen-devel@lists.xenproject.org" CC: Volodymyr Babchuk , Andrew Cooper , Jan Beulich , Julien Grall , Stefano Stabellini , Anthony PERARD , Samuel Thibault , =?iso-8859-1?q?Roger_Pau_Mo?= =?iso-8859-1?q?nn=E9?= Subject: [PATCH v3 1/3] common: remove -fno-stack-protector from EMBEDDED_EXTRA_CFLAGS Thread-Topic: [PATCH v3 1/3] common: remove -fno-stack-protector from EMBEDDED_EXTRA_CFLAGS Thread-Index: AQHbS3EDx5+OWqJotkip8Dq3lsA6Cw== Date: Wed, 11 Dec 2024 02:04:30 +0000 Message-ID: <20241211020424.401614-2-volodymyr_babchuk@epam.com> References: <20241211020424.401614-1-volodymyr_babchuk@epam.com> In-Reply-To: <20241211020424.401614-1-volodymyr_babchuk@epam.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-mailer: git-send-email 2.47.1 authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=epam.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV1PR03MB10456:EE_|AS8PR03MB9365:EE_ x-ms-office365-filtering-correlation-id: 85d67761-3a4e-4e58-b5df-08dd19882702 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|376014|1800799024|366016|38070700018; x-microsoft-antispam-message-info: =?iso-8859-1?q?L7L4DO48bdEtrdL4IhxWVjAp2n?= =?iso-8859-1?q?ULU1eNfoeBmhimrjO6nwT0Ty4lCfIUHelzrxNAcfPgYzpaUA9O068zUKgLae?= =?iso-8859-1?q?pD92YUHkDvuFOBoJw81LgiDnKjjimdzqCSfkokaCioqW4Pb0n5SXdTUMPxfm?= =?iso-8859-1?q?Dv/egPB06H1SRQJUAHEqPEw6juLVNwWsEYk8vZoprUwsiCssZuBEV0y2BfBf?= =?iso-8859-1?q?miHgKVuOe8eLP36hcqJiUSMc6lsOfaVvazwSAm90sGXJLesj7sjRya3JJIQm?= =?iso-8859-1?q?fnr5cObn1/S5Zvz3Tw2kNg2XAE+NC0PNu4xyYEqGO4lKwvZ2/Q3thSAr77eF?= =?iso-8859-1?q?KXR6x1QKH38MskWKsIpBOXb+g7L8AAwUtA8I0kw+nc2SXVx96uLQIA9QfpSR?= =?iso-8859-1?q?Q+aFVkrEJbmX3F0juR6CkIsAWrQ588NOMF609kF8igvstOuE+XFVYUUqpfWz?= =?iso-8859-1?q?SlHZ2wHJVKopbx2H5HNm5r3XJ1n5K4ztfErdYVPbZC2humGuS/LS0bs6eRSd?= =?iso-8859-1?q?ZhFsY7l/7rw2d4nAc0wOhun5xMNnuBXZczlX9U73DDzcoOqpUaF1twIi/4iF?= =?iso-8859-1?q?9LXlEIRCjqKigu53pFLUEomMkAb4oJ2x57uUNneqn/aDOHBxJdenGkAKltEv?= =?iso-8859-1?q?29eTwpDSIroEwtED5u3Z8fgqZtA6ajoZlZQGoapivFiUEaOSjzR/F8uF1ok4?= =?iso-8859-1?q?bMdl3ntmFN2hW5OP0btMiUdHuCx9Snw1FIHEyKEj9/dkcQ4aU/x2sDcbk0om?= =?iso-8859-1?q?enneTiBe33Bmn6lkEbw5IP1zw881z+Lo5rxJrF6yvVe5uCZnJcGyevyDDPVI?= =?iso-8859-1?q?EZoswz/Co5ygKpt1Pp37Wwm0fVXRH8WylxhdChmL3RQH1MAajuSJfTfWM7Qj?= =?iso-8859-1?q?A5gLxJvpUvD/Usg+h1aW82QV/HSJlj0NxNhj4USQEqj+AnKrgNtllITj2nti?= =?iso-8859-1?q?p+IjA/B8r5fTYqPs+Q16AyeaLTaN5ZDCnb8Uq8/ZxxIu7U2dTo1ixPCnJJQh?= =?iso-8859-1?q?H48HtBhVu0462O/dMgBpJEQhCtLv+IUsjuwY50DjJSo30toDIosKDBaTIydD?= =?iso-8859-1?q?wX0qYIwgUCN4cszWHQ+naqxzgwAMcou/CMWgoIvC1//P+Wpfq0hDZjNuuhT4?= =?iso-8859-1?q?sfvBBvhgZs+SPQDh8OFF0XpnZux7s662YcgC92dEflP7HNYv+yrkisEt7/+5?= =?iso-8859-1?q?J7adeXzOvO0eStXFnl5XKuVxvY0mfUzp0jQrwtSiKzAxnFBfXytZM+8ofZ4f?= =?iso-8859-1?q?gh0YJloqims3+74Bb5R2C4jetggANV4tuUn9zRFVGlobIRkwiZIl3vmx9sin?= =?iso-8859-1?q?KdXJ0NwLHwvqlS4+u7KrsfBSH+/s40ORGtrtbH6aJvV1i57eDDjXjKeELZEo?= =?iso-8859-1?q?dksvKcEmkFWEfD28wu3FEv7BVrFycBUPtjPrNswGi8AhSnPKpYsTZIDSJBsV?= =?iso-8859-1?q?O/R32j2runrd3ERqvYDwfcWA=3D=3D?= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV1PR03MB10456.eurprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(1800799024)(366016)(38070700018);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?q?PBTosIs+MohPGckGf68nIKs?= =?iso-8859-1?q?dSyx47ohfCF9DAwZDWDcReFgw4aGrZMR6/3l2tJjEO64ODzszXl4u6YmXsZZ?= =?iso-8859-1?q?8rscfLQOqCOMcIKpyXzPZgSu/EK9K7hloKKeQKgmkaBuUClN5h2epe1quwzJ?= =?iso-8859-1?q?ZXVCBBRg4vWQsJ+TxVOJKGW7zQemRsTSfYuyzQOmeLXu6Q4wWUp40tvs32oj?= =?iso-8859-1?q?ZOZlwKAizW/ZHJjAQGCdSlvTENvfLQQ5qSvqa2bUc41XM9FmwG2XAYsUuJVM?= =?iso-8859-1?q?SlhbvciRmbGY3aXw8Pga+TLksI7xZJur4Nc2CMIPyWHDTCVTNboLUYn/GtZp?= =?iso-8859-1?q?YQ+LKPefPIn1YhcsfMlulsiOgumHqDQTiDt3/idP5Z+MjAYctAtWapvl0GoV?= =?iso-8859-1?q?q4WVLX4vZcIITUK24ZN2jEMEn3mEAZHaPzrJ+DlXl7lPKVvkfuUL0//XHCOh?= =?iso-8859-1?q?HHiSg4REKwdliSteMdWrUHLaPK6SczRIMZfrLWwUWK7r1o1TUcW6ZOv1TBr9?= =?iso-8859-1?q?qohCqsNhqcMhHjDri+yNBlODKO/3WZ4/qsr1LtvcSXasEjX0C1BxqRMCRr6u?= =?iso-8859-1?q?JLKYaUD92dUVbRzrJNU3BSgmegnoidJUF9ut/OubQVfII54r8otjwv5OtonO?= =?iso-8859-1?q?bwALzH8Ca82IdI3pp519gpe51wcMRMHzreDfC2UXQ/S2qcuj9oEdaZc0B2Xq?= =?iso-8859-1?q?htHZkEjvtETt+PI6a4FU1oxbOxSRtXp39+v4L5MDAUjoHMTjfNIB4Yf/xFde?= =?iso-8859-1?q?MV2cCrdltribxJ7lFCmZuJsHQehNRYkGrWLCUDZypj2xQ2+LzLYQMjP73tcr?= =?iso-8859-1?q?c6s9Okbq6R/2Kp4+4Irc547ejsMDrE/hTN8ykaO3uumcIZFpqDKb8X6u6d1L?= =?iso-8859-1?q?EgMSUyGU/5yajxCrazxdwz+KWBGHqamaE9xc4gUJ+FDzPRX6wnsBVfwfDP3d?= =?iso-8859-1?q?fEGV2gpsCDqK0zpSQ4kVfKT5H52s57DpghFDwHt52/srUCBLdX+iamjuJ6Xj?= =?iso-8859-1?q?DaXLufoL8bVitj7lMZv5eUucHhoXdpctcQeYp6MruvXzdaTUWlegZtGGxpng?= =?iso-8859-1?q?CfWRmo2vvZ7FxC11APNsXO8/x2kAWT1eW/jwDZb2tFOatmkonuLgYnwdbzoj?= =?iso-8859-1?q?d86UDE/rQvfxXkW/TIzn2TDcVvk13QH0ZA0cdLeYOck2zz7IR6vVMz7DTccN?= =?iso-8859-1?q?xKfC2/omyuLTmuULK8neTeuLGTq5VMWfCvvjFA/KYTB3FRIVsdwFhyx5kERg?= =?iso-8859-1?q?DtghIceb/7AOEgrI5qO5kgflrwPdkCmfwgpcSuxvaPZMG5bon7ICwmMG8b4M?= =?iso-8859-1?q?a29Zi3TStvlfgzR3EMPih2Z75uYb3kA/ikjZreirVhKxMx/AHGF+EePH+Ksd?= =?iso-8859-1?q?+OHPKBmjaJ1PWi9Iq+bOCAjVeuU28AfsnrusihxvBZ+nyq/PgXxKWuOnEl71?= =?iso-8859-1?q?AfGekKOzcDrbvSYlcFlUNdC3yLGsrjTCRVz6EiVu0siZHo08jvCUH9/Xsiwf?= =?iso-8859-1?q?fVedHsluRvX6gMfm+BfbsyktTg5/TDP0yKQB6o34vXrdrRMrBuclfQ/s3YJY?= =?iso-8859-1?q?KqUJ4LaVS1E9LCzs3qfaBBrcLJ9w2U6SJIZR6i5Mb3sOSP048ojnuDdsGsin?= =?iso-8859-1?q?7YixpGjP8LR2ZFlxMZuT8+V127+I5/Z1P12HoHQ=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: epam.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV1PR03MB10456.eurprd03.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 85d67761-3a4e-4e58-b5df-08dd19882702 X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Dec 2024 02:04:30.2690 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: b41b72d0-4e9f-4c26-8a69-f949f367c91d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: igq6fdkktG3Hpo2lOAzuztof057LWBbvvv0PG0S6RVCspnQ8jEb6JE7NBfnlucAI3cv7bVYgk7MT6NrrXqXHp+LJ+KTLdL+Qx7ERui52vd4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR03MB9365 This patch is preparation for making stack protector configurable. First step is to remove -fno-stack-protector flag from EMBEDDED_EXTRA_CFLAGS so separate components (Hypervisor in this case) can enable/disable this feature by themselves. Signed-off-by: Volodymyr Babchuk Reviewed-by: Jan Beulich --- Changes in v3: - Reword commit message - Use CFLAGS += instead of cc-optios-add Changes in v2: - New in v2 --- Config.mk | 2 +- stubdom/Makefile | 3 +++ tools/firmware/Rules.mk | 2 ++ tools/tests/x86_emulator/testcase.mk | 2 +- xen/Makefile | 2 ++ 5 files changed, 9 insertions(+), 2 deletions(-) diff --git a/Config.mk b/Config.mk index fa0414055b..c9fef4659f 100644 --- a/Config.mk +++ b/Config.mk @@ -190,7 +190,7 @@ endif APPEND_LDFLAGS += $(foreach i, $(APPEND_LIB), -L$(i)) APPEND_CFLAGS += $(foreach i, $(APPEND_INCLUDES), -I$(i)) -EMBEDDED_EXTRA_CFLAGS := -fno-pie -fno-stack-protector +EMBEDDED_EXTRA_CFLAGS := -fno-pie EMBEDDED_EXTRA_CFLAGS += -fno-exceptions -fno-asynchronous-unwind-tables XEN_EXTFILES_URL ?= https://xenbits.xen.org/xen-extfiles diff --git a/stubdom/Makefile b/stubdom/Makefile index 2a81af28a1..4c9186499d 100644 --- a/stubdom/Makefile +++ b/stubdom/Makefile @@ -14,6 +14,8 @@ export debug=y # Moved from config/StdGNU.mk CFLAGS += -O1 -fno-omit-frame-pointer +CFLAGS += -fno-stack-protector + ifeq (,$(findstring clean,$(MAKECMDGOALS))) ifeq ($(wildcard $(MINI_OS)/Config.mk),) $(error Please run 'make mini-os-dir' in top-level directory) @@ -54,6 +56,7 @@ TARGET_CFLAGS += $(CFLAGS) TARGET_CPPFLAGS += $(CPPFLAGS) $(call cc-options-add,TARGET_CFLAGS,CC,$(EMBEDDED_EXTRA_CFLAGS)) + # Do not use host headers and libs GCC_INSTALL = $(shell LANG=C gcc -print-search-dirs | sed -n -e 's/install: \(.*\)/\1/p') TARGET_CPPFLAGS += -U __linux__ -U __FreeBSD__ -U __sun__ diff --git a/tools/firmware/Rules.mk b/tools/firmware/Rules.mk index d3482c9ec4..be2692695d 100644 --- a/tools/firmware/Rules.mk +++ b/tools/firmware/Rules.mk @@ -11,6 +11,8 @@ ifneq ($(debug),y) CFLAGS += -DNDEBUG endif +CFLAGS += -fno-stack-protector + $(call cc-options-add,CFLAGS,CC,$(EMBEDDED_EXTRA_CFLAGS)) $(call cc-option-add,CFLAGS,CC,-fcf-protection=none) diff --git a/tools/tests/x86_emulator/testcase.mk b/tools/tests/x86_emulator/testcase.mk index fc95e24589..7875b95d7c 100644 --- a/tools/tests/x86_emulator/testcase.mk +++ b/tools/tests/x86_emulator/testcase.mk @@ -4,7 +4,7 @@ include $(XEN_ROOT)/tools/Rules.mk $(call cc-options-add,CFLAGS,CC,$(EMBEDDED_EXTRA_CFLAGS)) -CFLAGS += -fno-builtin -g0 $($(TESTCASE)-cflags) +CFLAGS += -fno-builtin -fno-stack-protector -g0 $($(TESTCASE)-cflags) LDFLAGS_DIRECT += $(shell { $(LD) -v --warn-rwx-segments; } >/dev/null 2>&1 && echo --no-warn-rwx-segments) diff --git a/xen/Makefile b/xen/Makefile index 2e1a925c84..34ed8c0fc7 100644 --- a/xen/Makefile +++ b/xen/Makefile @@ -432,6 +432,8 @@ else CFLAGS_UBSAN := endif +CFLAGS += -fno-stack-protector + ifeq ($(CONFIG_LTO),y) CFLAGS += -flto LDFLAGS-$(CONFIG_CC_IS_CLANG) += -plugin LLVMgold.so From patchwork Wed Dec 11 02:04:30 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Volodymyr Babchuk X-Patchwork-Id: 13902748 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 6D79BE77182 for ; Wed, 11 Dec 2024 02:04:56 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.853577.1267010 (Exim 4.92) (envelope-from ) id 1tLC5f-00059P-UM; Wed, 11 Dec 2024 02:04:39 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 853577.1267010; Wed, 11 Dec 2024 02:04:39 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1tLC5f-00057Z-Nq; Wed, 11 Dec 2024 02:04:39 +0000 Received: by outflank-mailman (input) for mailman id 853577; Wed, 11 Dec 2024 02:04:39 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1tLC5f-0004a4-9a for xen-devel@lists.xenproject.org; Wed, 11 Dec 2024 02:04:39 +0000 Received: from EUR02-VI1-obe.outbound.protection.outlook.com (mail-vi1eur02on2060a.outbound.protection.outlook.com [2a01:111:f403:2607::60a]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 460fbfa0-b764-11ef-a0d5-8be0dac302b0; Wed, 11 Dec 2024 03:04:37 +0100 (CET) Received: from GV1PR03MB10456.eurprd03.prod.outlook.com (2603:10a6:150:16a::21) by AS8PR03MB9365.eurprd03.prod.outlook.com (2603:10a6:20b:57d::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8230.18; Wed, 11 Dec 2024 02:04:32 +0000 Received: from GV1PR03MB10456.eurprd03.prod.outlook.com ([fe80::a41e:5aa8:e298:757e]) by GV1PR03MB10456.eurprd03.prod.outlook.com ([fe80::a41e:5aa8:e298:757e%7]) with mapi id 15.20.8251.008; Wed, 11 Dec 2024 02:04:32 +0000 X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 460fbfa0-b764-11ef-a0d5-8be0dac302b0 ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=OT78h65K4E9xQWiZ7n65iJPNFV5XhFzfqBj/3omUeJ1E7tD5XIX/iESfZPfJgAhdPz3mNc3oD93nH+xpI4dsAWYjXZX826XXTRbrKTd0iqUDrLLuGKHpzFeljWh15O1yUIsD8PUKwhhMHzmlf0Dhx/yntGuiEEg+V1cKnI9avH9t6RiiBGo6tARkFEqaWwKBmruCaQ0vLeZxhV7XE9tAkSCATU5txi0EfEbso+YgpXMg6Jb762k8YOMd2+ar5ycPdPC17GyvnNJfmlzAK38T60J0krsOXvL8KnMTPdwlXndtWXqZ1t0z5rmJ5bHUC1mWPJbvc0YJKBuAXaBlqVbV6w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=pj/nhgXuxO2BrnIrOHAoc56dHIEuF1g5kUOJqX9YgsA=; b=jj/Yg9F6HmwqkQUL7de8jIcL0uvlOvloUL5Iwi55RDBK//mWk84i2NoTfEe+DWCG3Fto+E0O78Qy5aiHo215vd+R+Lxsu2QLSYBblOCy1xHaeRtAMJNxr4u9Vn5uW6KpJ+OoIzbzKU03jXm7dOJ7mBK/wOs/s8GDdDk0tTuceYUwBEpJK8h2iidsgloy5y7I5JIegWv+O6llB1pqXV+UYjVs3cpJPldGaCYxTXfCt/gTa7q1q/0PbUk+Ax+YUhCsboNSSQdInLkqGlQt1okTbFjqx+p4QqIx4rbxTnksL6DaL//aZLllwqUa4BFSyWXDHqdBON0vLKcCtuCpzQEePQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=epam.com; dmarc=pass action=none header.from=epam.com; dkim=pass header.d=epam.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=epam.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=pj/nhgXuxO2BrnIrOHAoc56dHIEuF1g5kUOJqX9YgsA=; b=voZhMb8qzCJ/xuIwjPXo29EdKK3USyXGlLVRvi4HbLfS76lDjLS6pube1vTzaqyiRm2sCtVdx5p3E3JrW8KkQEXUCcGGJryKQziGxo0djoO27X+omimlfRBXiKZvtqxofwSxNN2k0O+4XFywx8sbERuW1gSx5COv6J+Cq/JPJX3O3It0UEb3C9wkqzFKyAPvKrx3Tjt+0l6lXSDNDFPCO3LO5i6Vt9sgTd0O65Bl1IwI6C8oEcOd1k2kmQ1LjgCaFxBrMA530BN5MJfTxsHYNBIucnqHIc9KXK786tD8pEXOrwjOOH/qsYUzQ1onNfTRT+ZnmYglk8ROOs+iOmqdgQ== From: Volodymyr Babchuk To: "xen-devel@lists.xenproject.org" CC: Volodymyr Babchuk , Andrew Cooper , Jan Beulich , Julien Grall , Stefano Stabellini Subject: [PATCH v3 2/3] xen: common: add ability to enable stack protector Thread-Topic: [PATCH v3 2/3] xen: common: add ability to enable stack protector Thread-Index: AQHbS3ED5ZENsqu4Z0+AIfWfHmGdmQ== Date: Wed, 11 Dec 2024 02:04:30 +0000 Message-ID: <20241211020424.401614-3-volodymyr_babchuk@epam.com> References: <20241211020424.401614-1-volodymyr_babchuk@epam.com> In-Reply-To: <20241211020424.401614-1-volodymyr_babchuk@epam.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-mailer: git-send-email 2.47.1 authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=epam.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV1PR03MB10456:EE_|AS8PR03MB9365:EE_ x-ms-office365-filtering-correlation-id: 52bfae58-3baa-4e48-f333-08dd19882730 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|376014|1800799024|366016|38070700018; x-microsoft-antispam-message-info: =?utf-8?q?2zC2uVdISaqerX37xUCpuZ8SAc/0175?= =?utf-8?q?nzmomehcoLOo+nuzgE1jQcySZo7VPyUNOmlJpnUqTXAhQaTkhdH2wt+gsXIjodO2f?= =?utf-8?q?Dnt5xoos9e1ADsyWaAUWRf3w7nbJowi9p+lK7YlDgQhwNd/7AVsbyJiUEEqX58da+?= =?utf-8?q?JrauBKfzdww/mSSij0pefEpn/TkaW4azEx7lmc4X3vWlaoKIBtV8U8aQ9zP/NH/fo?= =?utf-8?q?yiRqz9xj+U/o/S6d87AgZGqnB2xGMWKUBC8zednOhah8/EdWnfa7fBxeq46jkMVdR?= =?utf-8?q?es3IFS5wafLEK29k1OvbLzSLi54LLqr5+SaC88kt09nnIgYzAvQI+z0X1B4RBjR8d?= =?utf-8?q?+WmpFQ2zHU7YQlAc84uIrH/Bc7+Wwnf6ejLZyKVaotam4g9OjqAKEvp5xHs2IBUTe?= =?utf-8?q?7W+rebPWycqNnSfn4rGhv/W7uCbsjrLfp1KBiVA1YTcgnfTECFqDWtGoADcVMV452?= =?utf-8?q?stS+ofgUpkUaoPnSOv+V/boZEnC7DhxRcUiOGIqylbQVv7R4oToypP0ZeOgIPy3Qd?= =?utf-8?q?CFxWHcXWRj4nlUHq1RrDNgwqFdrYdJJ6RZVvmrJ48sFLgOzrNOSRMaxzC54iu/BEc?= =?utf-8?q?HK58IExzipygkptdieq/iWNGDq1QQ+Z6Kb0R22BdMs8WunDPRPGKrXmDXkVdZeQig?= =?utf-8?q?OYxuu2CS9WqCDPETbytBJxszXAOEnmtnjOjCmnne2Y3ci+2j9Qt1+zIV2hW4lKBZQ?= =?utf-8?q?4dXwPJc3OUz/x7rK+KCWQ9G3+nN5YUOr6r+hZHSw+zNyOZlRMjU9Si9VQzId5rpZP?= =?utf-8?q?VWkoLpyhJnERKDREwSe7MeMSgNCzChIKH//UicZb0G8BuNTDnBFcekljR32KArXlF?= =?utf-8?q?5IPPYSFKUiRF+S3029mbOpKWiDfYZwocIfL78b8gOnNzqlzPIi+NE4cyeTnD7QGp2?= =?utf-8?q?DO5Z+mjKXtAVMrKndsKWIxKhLdQ5MTg14gXf+xjJVfso/Z0QFnh4jGaY+qRoHUiJI?= =?utf-8?q?xUvLAf8S2c8zQdjjdeX4zcCDbzhj/yGZppCp/70r7R8zWboJvwW/YhDWMv4+aMR4l?= =?utf-8?q?/Il0WdStWk14oit4JYjqjxhxX8DTKGUazxVaj/pGjqBwXNKoDtdxsTAE5//ZsKFXi?= =?utf-8?q?c1sBj0XL31Rr20+8LAph0dYTxu98dDiLeCUnJWpZUWo9kgjW/q87WcNzSnZS2n2of?= =?utf-8?q?9oDC6MD646YX0iSpbnmnUrj6W6KwUvGq+2IMi/WOiOEf7kD/IaMQgP+sB3aDNWCV2?= =?utf-8?q?zTdLLi0g2uJrlNORq6WO3dq/2iW4BF1ZQ9Pb3I+W8J6LvdDQeWjqReNXa9gRtY8xV?= =?utf-8?q?t4OvjK8OOppaOhAx//g31fKRpEgKWNS/Q9z3jjcyLzJ7qCVSNXZne2uP0VrCPPKzd?= =?utf-8?q?MiyjEAveQidUBcFe5t5b2I8TnIbxjhv2CA=3D=3D?= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV1PR03MB10456.eurprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(1800799024)(366016)(38070700018);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?utf-8?q?nMBXr13SY2srg16owXQL60VC1JF8?= =?utf-8?q?MBrV4hy/0rAVrerSbbZF0ddd5OczqJqQYVeGrr2HC4ZGQYUVAHN7pWDw4vqo7lMcb?= =?utf-8?q?j4ks3dcmSQ093FLnjO2Hlkit3buFgTJuEhSnOPyucGYN9aWRh364/+/4tpsOsnGnV?= =?utf-8?q?7L+BYGqZL/lqHiw+YIDowgKUs77FQKCYepmBckhdJyqDMb4YZ6FNcR/hedlAdg/VW?= =?utf-8?q?hnB+WgQu4vfiVjm35wvFTLKVpvlokPqs4oBaet/npy5DzoVjb0Yn03UCoZoZl12ES?= =?utf-8?q?aiQ8IldLIy3ja7ublpgkVnu6FlOzDrVOoHgDqRs8zYW1BjQtiRKn1jVkJc2VwbcGD?= =?utf-8?q?qJovCoRn9eYAz2WO+8riet7NcGI7wMSDluLmT3WNTbGJRxyJ0OapBr2xS/NEAaq88?= =?utf-8?q?R8jKd4AkAXS8zKkqjKg+g0wy3c24Zqzuom7MxXp49QDDHMNHUpMSSVAu1+EIT7i0n?= =?utf-8?q?36iQz6TwNrDgeqM0/lzT8RZjAStfQM49oWzbk0ycLBAPGTHdyNA4gQVq/p9PnJq4G?= =?utf-8?q?wCLc+Yj6fuO8cbxcYiYE5YM3QF6iQZ1GNNZQ0k74FZqUylUx/pgEziLsdYcJhC4kk?= =?utf-8?q?Bvzl1SKrKhtZzIRtVtBvNpw0xNuP/e0hh49nQPfMxZ67C8CwFqksOobpi8Wytkmrx?= =?utf-8?q?EAMBnBkW4BAfW2aQgx85w2C4D3taxk29D1xw/uUYCxU9G0BF/NahXnjmVuv3sK67F?= =?utf-8?q?lfXN8QjDbvP70tJAcdIxuShEbZTusiS5ryJpIKr1P8mLjlS5FdIV3BJ7+Wgvudb54?= =?utf-8?q?myYKtImVAQ7E6eHOkDEtMtDrALeXiPflnDoUZ7doO81aDnLBIh/i4u8G9bXDvFVI4?= =?utf-8?q?B2rxn34UpQEVfdG3dYxQby02KSLe8EZasmqEW7LTvgAdz5uzfsyEfKYrOdmY6HoV7?= =?utf-8?q?9wRysAM/PtDcuq20ktvW9GgEFBgRYojsRkEhcASDfL3MbtUTPg2GTUmraEPXLcoq+?= =?utf-8?q?Zw2l3bpLTob6lVndwLO8OjpHw4Ky81tJDm4jYyez0Aq9nUHR2VYm6rq1eM8whqQDw?= =?utf-8?q?TNS0ZUcS9qUPIXe9MFLb7ETVRIvGy7Ym6dH5S0WWR5xqtomxUPFfPP+3ux5avbrqu?= =?utf-8?q?FmcHsQKxiOi0o7GV5Z9hDxgjSzIKgoWAbB/kmutrmmSeRNQ1GrB3FTijB4+qOJPx5?= =?utf-8?q?itg5cFXHLu2C9afhTIKVlxx0mlvknqja1AAbJc1a2s4/8ywRqRjeS4UAHsftIPRdF?= =?utf-8?q?rU7OoBo588L2ElcT847rQis9m9+sZpvoajGnzyt9/p7cskZry4cKIAKqhin5LDfgR?= =?utf-8?q?DijRiTeFqGj367AdN16aZkjGt2rjq4WYRA7fLML6WWeADUgwIr0QvlYESKXXrnuCd?= =?utf-8?q?PqWyteymOAXFZzk+P5UTopm6k5U1g2mUzhKgHxmW9RGNarXlKQb4hVYytcxU/e1xZ?= =?utf-8?q?+7ERtw/BzrbL22yt3q2BSNXGHUMfm7/B/AEl2c+isYjHnTwLu543kUFA3HBpxNS05?= =?utf-8?q?nfCfPcblovBkJE1O1FGHI5XR+wwsHS3xF3o7yPAY7tyUxzd6qqgYXU3QRcsSkZjMT?= =?utf-8?q?VN0U3wdOnV1pO9EyQfGExzruFBrmIjPvGg=3D=3D?= Content-ID: <549BB8EE78CD0E44856ABAF33634CF3D@eurprd03.prod.outlook.com> MIME-Version: 1.0 X-OriginatorOrg: epam.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV1PR03MB10456.eurprd03.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 52bfae58-3baa-4e48-f333-08dd19882730 X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Dec 2024 02:04:30.6083 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: b41b72d0-4e9f-4c26-8a69-f949f367c91d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: und5uM0Y6qfmy3kFhAOaLA9gHjBVUXlMDrlOS+vGfshN3Oq4ZaX+4xv7sbS8L4ooynsDL9zxC7aB33VeiLtD7EqLE87kLpWA7qV0Pg0r9/Q= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR03MB9365 Both GCC and Clang support -fstack-protector feature, which add stack canaries to functions where stack corruption is possible. This patch makes general preparations to enable this feature on different supported architectures: - Added CONFIG_HAS_STACK_PROTECTOR option so each architecture can enable this feature individually - Added user-selectable CONFIG_STACK_PROTECTOR option - Implemented code that sets up random stack canary and a basic handler for stack protector failures Stack guard value is initialized in three phases: 1. Pre-defined randomly-selected value. 2. Early use of linear congruent random number generator. It relies on get_cycles() being available very early. If get_cycles() returns zero, it would leave pre-defined value from the previous step. Even when get_cycles() is available, it's return value may be easily predicted, especially on embedded systems, where boot time is quite consistent. 3. After hypervisor is sufficiently initialized, stack guard can be set-up with get_random() function, which is expected to provide better randomness. Also this patch adds comment to asm-generic/random.h about stack protector dependency on it. Signed-off-by: Volodymyr Babchuk --- Changes in v3: - Fixed coding style in stack-protector.h - Extended panic() message - Included missed random.h - Renamed Kconfig option - Used Andrew's suggestion for the Kconfig help text - Added "asmlinkage" attribute to __stack_chk_fail() to make Eclair happy - Initial stack guard value is random - Added LCG to generate stack guard value at early boot stages - Added comment to asm-generic/random.h about dependencies - Extended the commit message Changes in v2: - Moved changes to EMBEDDED_EXTRA_CFLAGS into separate patch - Renamed stack_protector.c to stack-protector.c - Renamed stack_protector.h to stack-protector.h - Removed #ifdef CONFIG_X86 in stack-protector.h - Updated comment in stack-protector.h (also, we can't call boot_stack_chk_guard_setup() from asm code in general case, because it calls get_random() and get_random() may depend in per_cpu infrastructure, which is initialized later) - Fixed coding style - Moved CONFIG_STACK_PROTECTOR into newly added "Compiler options" submenu - Marked __stack_chk_guard as __ro_after_init --- xen/Makefile | 4 +++ xen/common/Kconfig | 15 ++++++++++ xen/common/Makefile | 1 + xen/common/stack-protector.c | 47 +++++++++++++++++++++++++++++++ xen/include/asm-generic/random.h | 5 ++++ xen/include/xen/stack-protector.h | 30 ++++++++++++++++++++ 6 files changed, 102 insertions(+) create mode 100644 xen/common/stack-protector.c create mode 100644 xen/include/xen/stack-protector.h diff --git a/xen/Makefile b/xen/Makefile index 34ed8c0fc7..0de0101fd0 100644 --- a/xen/Makefile +++ b/xen/Makefile @@ -432,7 +432,11 @@ else CFLAGS_UBSAN := endif +ifeq ($(CONFIG_STACK_PROTECTOR),y) +CFLAGS += -fstack-protector +else CFLAGS += -fno-stack-protector +endif ifeq ($(CONFIG_LTO),y) CFLAGS += -flto diff --git a/xen/common/Kconfig b/xen/common/Kconfig index 90268d9249..5676339a66 100644 --- a/xen/common/Kconfig +++ b/xen/common/Kconfig @@ -86,6 +86,9 @@ config HAS_UBSAN config HAS_VMAP bool +config HAS_STACK_PROTECTOR + bool + config MEM_ACCESS_ALWAYS_ON bool @@ -213,6 +216,18 @@ config SPECULATIVE_HARDEN_LOCK endmenu +menu "Compiler options" + +config STACK_PROTECTOR + bool "Stack protector" + depends on HAS_STACK_PROTECTOR + help + Enable the Stack Protector compiler hardening option. This inserts a + canary value in the stack frame of functions, and performs an integrity + check on exit. + +endmenu + config DIT_DEFAULT bool "Data Independent Timing default" depends on HAS_DIT diff --git a/xen/common/Makefile b/xen/common/Makefile index b279b09bfb..ceb5b2f32b 100644 --- a/xen/common/Makefile +++ b/xen/common/Makefile @@ -45,6 +45,7 @@ obj-y += shutdown.o obj-y += softirq.o obj-y += smp.o obj-y += spinlock.o +obj-$(CONFIG_STACK_PROTECTOR) += stack-protector.o obj-y += stop_machine.o obj-y += symbols.o obj-y += tasklet.o diff --git a/xen/common/stack-protector.c b/xen/common/stack-protector.c new file mode 100644 index 0000000000..922511555f --- /dev/null +++ b/xen/common/stack-protector.c @@ -0,0 +1,47 @@ +// SPDX-License-Identifier: GPL-2.0-only +#include +#include +#include +#include + +/* + * Initial value is chosen by a fair dice roll. + * It will be updated during boot process. + */ +#if BITS_PER_LONG == 32 +unsigned long __ro_after_init __stack_chk_guard = 0xdd2cc927UL; +#else +unsigned long __ro_after_init __stack_chk_guard = 0x2d853605a4d9a09cUL; +#endif + +/* This function should be called from ASM only */ +void __init asmlinkage boot_stack_chk_guard_setup_early(void) +{ + /* + * Linear congruent generator (X_n+1 = X_n * a + c). + * + * Constant is taken from "Tables Of Linear Congruential + * Generators Of Different Sizes And Good Lattice Structure" by + * Pierre L’Ecuyer. + */ +#if BITS_PER_LONG == 32 + const unsigned long a = 2891336453UL; +#else + const unsigned long a = 2862933555777941757UL; +#endif + const unsigned long c = 1; + + unsigned long cycles = get_cycles(); + + /* Use the initial value if we can't generate random one */ + if ( !cycles ) + return; + + __stack_chk_guard = cycles * a + c; +} + +void asmlinkage __stack_chk_fail(void) +{ + panic("Stack Protector integrity violation identified in %ps\n", + __builtin_return_address(0)); +} diff --git a/xen/include/asm-generic/random.h b/xen/include/asm-generic/random.h index d0d35dd217..7f6d8790c4 100644 --- a/xen/include/asm-generic/random.h +++ b/xen/include/asm-generic/random.h @@ -2,6 +2,11 @@ #ifndef __ASM_GENERIC_RANDOM_H__ #define __ASM_GENERIC_RANDOM_H__ +/* + * When implementing arch_get_random(), please make sure that + * it can provide random data before stack protector is initialized + * (i.e. before boot_stack_chk_guard_setup() is called). + */ static inline unsigned int arch_get_random(void) { return 0; diff --git a/xen/include/xen/stack-protector.h b/xen/include/xen/stack-protector.h new file mode 100644 index 0000000000..bd324d9003 --- /dev/null +++ b/xen/include/xen/stack-protector.h @@ -0,0 +1,30 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +#ifndef XEN__STACK_PROTECTOR_H +#define XEN__STACK_PROTECTOR_H + +#ifdef CONFIG_STACK_PROTECTOR + +#include + +extern unsigned long __stack_chk_guard; + +/* + * This function should be always inlined. Also it should be called + * from a function that never returns or a function that has + * stack-protector disabled. + */ +static always_inline void boot_stack_chk_guard_setup(void) +{ + __stack_chk_guard = get_random(); + if (BITS_PER_LONG == 64) + __stack_chk_guard |= ((unsigned long)get_random()) << 32; +} + +#else + +static inline void boot_stack_chk_guard_setup(void) {} + +#endif /* CONFIG_STACK_PROTECTOR */ + +#endif /* XEN__STACK_PROTECTOR_H */ From patchwork Wed Dec 11 02:04:30 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Volodymyr Babchuk X-Patchwork-Id: 13902750 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 36E0FE77183 for ; Wed, 11 Dec 2024 02:04:57 +0000 (UTC) Received: from list by lists.xenproject.org with outflank-mailman.853576.1267003 (Exim 4.92) (envelope-from ) id 1tLC5f-00052i-Dt; Wed, 11 Dec 2024 02:04:39 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 853576.1267003; Wed, 11 Dec 2024 02:04:39 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1tLC5f-00052b-Ab; Wed, 11 Dec 2024 02:04:39 +0000 Received: by outflank-mailman (input) for mailman id 853576; Wed, 11 Dec 2024 02:04:38 +0000 Received: from se1-gles-sth1-in.inumbo.com ([159.253.27.254] helo=se1-gles-sth1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1tLC5e-0004a4-9E for xen-devel@lists.xenproject.org; Wed, 11 Dec 2024 02:04:38 +0000 Received: from EUR02-VI1-obe.outbound.protection.outlook.com (mail-vi1eur02on2060a.outbound.protection.outlook.com [2a01:111:f403:2607::60a]) by se1-gles-sth1.inumbo.com (Halon) with ESMTPS id 45c0db06-b764-11ef-a0d5-8be0dac302b0; Wed, 11 Dec 2024 03:04:36 +0100 (CET) Received: from GV1PR03MB10456.eurprd03.prod.outlook.com (2603:10a6:150:16a::21) by AS8PR03MB9365.eurprd03.prod.outlook.com (2603:10a6:20b:57d::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8230.18; Wed, 11 Dec 2024 02:04:32 +0000 Received: from GV1PR03MB10456.eurprd03.prod.outlook.com ([fe80::a41e:5aa8:e298:757e]) by GV1PR03MB10456.eurprd03.prod.outlook.com ([fe80::a41e:5aa8:e298:757e%7]) with mapi id 15.20.8251.008; Wed, 11 Dec 2024 02:04:32 +0000 X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 45c0db06-b764-11ef-a0d5-8be0dac302b0 ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=ge1XlQbgH1UdvXJE/zBdwMM2tr9pint8/IVqDbnY23Vuc2xRCSaSH/mcrW1GSGysffF99uWSk4PDlRnXeKD6lVFgbuRCyNzrnd+xmCtAvb+TSmHgjz4r6JTZqPVtNjOt0+7mHAHNKCuti40MUM2phKD9Lrhf4atS6ggaqMIIAZX6QMa7gTPcPJ0eKQR3cMf7UVZQTnxEhGj/IrGPkRr7ti87mVehX+8vLpy54caluz2bLNzn49skrcQM9JD1egXOdl9/xmrX1iJzJfMDaryFugzAuF7xyPEitUqEVOMB+PaLjPX5DOiEn6jNxEz78/38sMfZiZgFf/iYniGSEHcBqw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=7IPKT9OsPoDBg5bm90YN85uCTHQcge+IDT3Vd6o2ITA=; b=kfdsdpr1YmBYed+3+BE0uKapBXpbhffr3W5CNd6dCGqrreqdWdxrrFWkDpRf1DWv+2lSWhR5rjRtu9m/tAEfCJ5qj9spQ4o6P3vGC5HlwJEtqji3vij/XkZuDkfpeynhNBx4BYlQUy0BIM+kg8TJQPFOAsJmaOQ4uW0ukRI2B0liQWyGZtdgKpaDzdknKAb6r8VBQaO6K5EBLD4FG8p5880w1n9+vO5yghBrVTOANrN91H0y8Moyx8LLrOrcGg4L190522IkmNccS+ItTYKUysXcnwstYiNUe8euND81/6ja76Pose3sTR7AfN0c7ojDnBs70/sCzqkXacTW14YjLw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=epam.com; dmarc=pass action=none header.from=epam.com; dkim=pass header.d=epam.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=epam.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7IPKT9OsPoDBg5bm90YN85uCTHQcge+IDT3Vd6o2ITA=; b=Md2K9cE77jlIxbt/OCJj1y8uelR4NjHUlqevPKRQ+vu2sNlDKg09O/RH93HYfhIW8pXHQ8if3cvKYui2w4SxuuzHZZ0MlHEXUGG1PWLhgGs9eKh10YV+SoRtOc6qPcJREQoiwrlE9y2ZLQ94Iu6fdaHOga10DSU6BU+Q2TdCR+4BOLfj1U1uad/a5uvk80fewSfZCOfSWJQUNDmMZ6ztLcjlSUR6HSRoNWzr+PfHBHmE/6dOnID516fvbvxxAVlGPt0EQox5aEMssaGMbRleWLRpOzft0X1wD98+EeMWW3dmQ36Lcwc4jjbwYWnBl8iq34ccDmD7iA9lxqnP0vIoFQ== From: Volodymyr Babchuk To: "xen-devel@lists.xenproject.org" CC: Volodymyr Babchuk , Stefano Stabellini , Julien Grall , Bertrand Marquis , Michal Orzel , Volodymyr Babchuk Subject: [PATCH v3 3/3] xen: arm: enable stack protector feature Thread-Topic: [PATCH v3 3/3] xen: arm: enable stack protector feature Thread-Index: AQHbS3EEEJvy+ytb5UyNE3P+n1UzAQ== Date: Wed, 11 Dec 2024 02:04:30 +0000 Message-ID: <20241211020424.401614-4-volodymyr_babchuk@epam.com> References: <20241211020424.401614-1-volodymyr_babchuk@epam.com> In-Reply-To: <20241211020424.401614-1-volodymyr_babchuk@epam.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-mailer: git-send-email 2.47.1 authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=epam.com; x-ms-publictraffictype: Email x-ms-traffictypediagnostic: GV1PR03MB10456:EE_|AS8PR03MB9365:EE_ x-ms-office365-filtering-correlation-id: 6e5c4183-8777-428b-92d9-08dd19882762 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|376014|1800799024|366016|38070700018; x-microsoft-antispam-message-info: =?iso-8859-1?q?hVPl6/Ig6716rtq6aoGkm0navV?= =?iso-8859-1?q?KZuwGYQAQfGQDQ5qvOEGDaEHdMqHJgeFGPwI8OLIkbc+jkWs99X2LjPtj9KO?= =?iso-8859-1?q?nKhmDReD8mexFAWRMuwDbG9jeGYS+0cJA78ULyDF40yh9Dcsv0cpb41ee/S2?= =?iso-8859-1?q?6kbdzDr5BpBC3c8hmWFKS94Hg/SXCB/pMjexRwzfWwcCUgET/8rX+LUPnYFj?= =?iso-8859-1?q?NTNdBDtTb0pWjYm0dlZ/SWBePLn0xq+kpmxOjVcBMqyfDnePdccZ3gHJVAY/?= =?iso-8859-1?q?HRP1LmL8ctHUU9geD1xU8df7GejT7VZD3FherS5mvtsTUentO+RuP/aORLyV?= =?iso-8859-1?q?lQwYlsEH0bkxOFAImXJL+akoEkHml2Nnm+9Zx1EoIno50k+GNO/91Nh4h5n7?= =?iso-8859-1?q?ri2cdIKBJSnmWZOzPHt8cJx+FO5MO6Pny89Jvml5cK8hvUcL++3XuyNXAxCW?= =?iso-8859-1?q?Qqg8eyyJvX/qawRTETmy66BXEV00n0mDv5YyPk5HAS4FxxBXzWJ2btBPL3zJ?= =?iso-8859-1?q?yEXhGh8T9GxSVI5eb0dnnkyLYrvTlEw0Hl7+WYOyNHukMvJaHfhZQ6R2huvz?= =?iso-8859-1?q?elWFEzZRMAiQagTNB4JWNn2bj2oE1/MBXOJI84RV+lqsFhajtmPvrRnonUIT?= =?iso-8859-1?q?PY0sI2bpnDNXnpXzGPryn9POE/xaOBNa+9XGyDnxcSDv5GDJ69jJ0DYGjguN?= =?iso-8859-1?q?DHc5J4DFcco+4Rau2wDWauLH4MokpkIm0nI9vdbuCOUfb8HQoZhp2LXwONm+?= =?iso-8859-1?q?1GusTnKa1yj82dhoDojS/sJRM5P68+MNZEhOPVaEDv6dyP4rL2/n8yHKPCtm?= =?iso-8859-1?q?ecvCTF5jmW1eAOjIlLCcKvzYYqZWJpv8Vz9ZGWfPiuB381N15lDgf39Z7zuL?= =?iso-8859-1?q?GlXg+FG8R4rz7kE+kS1NT1uvYn177uxMRQfwVKVoF7mbJbV6D59o+E7xXX9H?= =?iso-8859-1?q?KaVH+41C4hatC8ijX1bW/0W936H9UmhvzPHswOUddDRnZIvL/3aGQCro9bYb?= =?iso-8859-1?q?86kSI2sC58dKtxay67zGN+pj1HqsDellkizvjlaVvXgoT0BiBrWtJZc/TnkZ?= =?iso-8859-1?q?esuD0ANdGWmj0tjszUWJyfn7O8Rfob1mTKmk0+PWCvDvSR522K7+2LhgIYYX?= =?iso-8859-1?q?H9XqAZ/4uIjZd9f0ukTwUZxbf2kLSJSqkmCvOchzq4rjVlZVrAmj6SnH+sAf?= =?iso-8859-1?q?jwHVhyJSFqhFiXIyyqLX1Dpf8lcyRVpkTSugA+lT7WYbZcT9xQtWeyFX+eAo?= =?iso-8859-1?q?5zrJ5J2FKxqQGVrf2yIKRaBWo3KRTaqYaxoLX19pcaS+seFaq1euQdQQMpK4?= =?iso-8859-1?q?YeUy7bMFQYk1wyx70OaaKIhrEY4tmqFxcKZF7ipPWn6xJO76qWr46nsWzWfM?= =?iso-8859-1?q?cV1xyT6zeGIxcAjB37U/JfEJ+mkXNaVydVmLWU/kEMOOZTZQ3WpXEjXtduOG?= =?iso-8859-1?q?bkYdu0DDUSNuE/YCn5rN5APA=3D=3D?= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:GV1PR03MB10456.eurprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(1800799024)(366016)(38070700018);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?q?pD0sBpJOYKmmehoupz++PSw?= =?iso-8859-1?q?ernoJYdJl7f/12ljuTNjBL+cCWLEbiaOyKpfX06RlqffU1/UaP68ZmOTRB4A?= =?iso-8859-1?q?gc1ch0p05s5tQl6xe70h8z6/7CJhPxyQuhu3duBBbcSVLPklkSIZu/tc3O03?= =?iso-8859-1?q?RFQwldGryTUc+rcMUbEAkMQ5yKa3twrQJoLg7HhH8gGM4+S4ZyDfJH+iQSN3?= =?iso-8859-1?q?N7XCTWFBPKZqxVKTvQBJvtEogFbfULXGJ56YeqgBTy32d4r+UmMR3mhEyMoq?= =?iso-8859-1?q?A9a+1lgm0Rr5ShNij1ZbnAUhs+FRYyBYuLdHMgeBSC5h3DNmD0Kg5Argwrmw?= =?iso-8859-1?q?lV6gCKXaN7+isJTDlKfh2l6B+x9npubACfSUhveIil+IkOfbVN5umiMzX6ri?= =?iso-8859-1?q?SFER6Gv5xMzntFBObOoU/SXAn8WdFiIoLINJJ+A4YOMUjazPLqLLpwwNVKFo?= =?iso-8859-1?q?xn2o1k8KbadQjdEGUuEQ7sHe8RQ42/O50vR/bMuLgUIpF4sae6ctA47VgflV?= =?iso-8859-1?q?55or4/4fTo1Fs0E+oDwdKnwnE9RTXbwSD3a2WBDWv5nAedQKpiRnJ2MTujH1?= =?iso-8859-1?q?LG3qw4KKx5CBW57GahHTWE244AM0dGByes6WWbqwrcPlx7KEUCphNWkIWlyZ?= =?iso-8859-1?q?nPohnnYHV44DjEjjJ06UOZum0iJSEiCMRIHZfz0rlEyEWVzjVQK/Ws40PXYj?= =?iso-8859-1?q?pifCLXBr4X1+Xjp2N1UtS89JK+3kfcQk31KTXOsmjXyOvQgEV/wvz56f9fM9?= =?iso-8859-1?q?y+JB5gzogOyzzmBChNnfUh1DsQ/0r02u659H6/Jnmm2SS+qUxcbKUp83zhpj?= =?iso-8859-1?q?Iq9jK0PuzaRXAnG5p/urHoSqtl3cF/Ai+z6s4FP2YdEiJq/HnlKyvnY3LLt1?= =?iso-8859-1?q?6/v/jOKJpklWDpqF3uqlNm9gRTPglx/TQc94r73z7frM26fHxqomk4Chj0ES?= =?iso-8859-1?q?zpfDT/mbloAXkKTV2V9biRHNxpZysk72ZVyLJjFQj7aAML7EPuQrpCu7nVdZ?= =?iso-8859-1?q?7wUZ0IThgRIMWckp63z9BTkq3/dr5txWbldybmo+pd4/UGEes9rPjCmt0mIr?= =?iso-8859-1?q?ns++oFlwZIAXJW2QPQm/rMR/FS6VkVlNJpAX5Pn8OpJ7XMAOjLcMMWLicVj8?= =?iso-8859-1?q?WOIhv85orc2eAT4joa3//8ORPPmCA9h7O9xYP+Ct4ZLvBEIFJKfQjIj9wkCb?= =?iso-8859-1?q?KZYHECQ/wTAH8UuJp5KZt/D80bz/Mf2PQrKfv/FjSjZwH8P0u1NX5611CZP5?= =?iso-8859-1?q?WBTtgFVChVWpedM6Co/jUK3M5Bqs6u12yk0x3QcTLW+OwktJzo3H0QEQDGYr?= =?iso-8859-1?q?04MGs9R4JAf7Y1wntO9GJ54gmgPttKQL4a3TD0W34Q7sXIpSpstsLhGenk1B?= =?iso-8859-1?q?NKW/X1KxJlGlUSF9uN7OlcOEma4q8cs+uUiP1sl/Xq0whhu/STxmrGqFaRTS?= =?iso-8859-1?q?cndeTVWSCAI4GkrkMf3jRLpPa8gBu/qvm10iVn5ErQgcWYwK9kLYrCf5CJHr?= =?iso-8859-1?q?s6XED0ASphsFNSGa0szWyrpnCst4/h2V/cE1o35c36L9YrvC6Xv9Uzx607ai?= =?iso-8859-1?q?ukzwQALs+H6nnfSaU7E6DXCtTbp7yk8kTxqbz1+IvdFG8iipinlU8vMiNvrW?= =?iso-8859-1?q?eM+NDvheWs2gikKki4GK9E8ueN/hIX9u8NM7VCw=3D=3D?= MIME-Version: 1.0 X-OriginatorOrg: epam.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: GV1PR03MB10456.eurprd03.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6e5c4183-8777-428b-92d9-08dd19882762 X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Dec 2024 02:04:30.8888 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: b41b72d0-4e9f-4c26-8a69-f949f367c91d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: ABwBQlfrdAtLHOy924ucylAJfEmT8zySnjxFlbC8bJt3K7r+4+xW0i5gchVFJoI04RqNInswVjiYE0mHdZ1PSH6gRGOIrfa2w0LwCkX89Es= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR03MB9365 Enable previously added CONFIG_STACK_PROTECTOR feature for ARM platform. We initialize stack protector in two stages: from head.S using boot_stack_chk_guard_setup_early() function and from start_xen() using boot_stack_chk_guard_setup(). This ensures that all C code from the very beginning can use stack protector. We call boot_stack_chk_guard_setup() only after time subsystem was initialized to make sure that generic random number generator will be working properly. Signed-off-by: Volodymyr Babchuk --- In v3: - Call boot_stack_chk_guard_setup_early from head.S to ensure that stack is protected from early boot stages - Call boot_stack_chk_guard_setup() later, when time subsystem is sufficiently initialized to provide values for the random number generator. In v2: - Reordered Kconfig entry --- xen/arch/arm/Kconfig | 1 + xen/arch/arm/arm64/head.S | 3 +++ xen/arch/arm/setup.c | 3 +++ 3 files changed, 7 insertions(+) diff --git a/xen/arch/arm/Kconfig b/xen/arch/arm/Kconfig index 23bbc91aad..a24c88c327 100644 --- a/xen/arch/arm/Kconfig +++ b/xen/arch/arm/Kconfig @@ -16,6 +16,7 @@ config ARM select HAS_ALTERNATIVE if HAS_VMAP select HAS_DEVICE_TREE select HAS_PASSTHROUGH + select HAS_STACK_PROTECTOR select HAS_UBSAN select IOMMU_FORCE_PT_SHARE diff --git a/xen/arch/arm/arm64/head.S b/xen/arch/arm/arm64/head.S index 72c7b24498..535969e9c0 100644 --- a/xen/arch/arm/arm64/head.S +++ b/xen/arch/arm/arm64/head.S @@ -250,6 +250,9 @@ real_start_efi: #endif PRINT("- Boot CPU booting -\r\n") +#ifdef CONFIG_STACK_PROTECTOR + bl boot_stack_chk_guard_setup_early +#endif bl check_cpu_mode bl cpu_init diff --git a/xen/arch/arm/setup.c b/xen/arch/arm/setup.c index 2e27af4560..3587baab21 100644 --- a/xen/arch/arm/setup.c +++ b/xen/arch/arm/setup.c @@ -13,6 +13,7 @@ #include #include #include +#include #include #include #include @@ -359,6 +360,8 @@ void asmlinkage __init start_xen(unsigned long fdt_paddr) preinit_xen_time(); + boot_stack_chk_guard_setup(); + gic_preinit(); uart_init();