[PATCH] lib: utils: Initial compiler built-in stack protector support

[Anup Patel]

On Sat, May 3, 2025 at 9:49 PM Alvin Chang <alvinga at andestech.com> wrote:
>
> Add stack_protector.c which defines the stack guard variable and the
> function which will be referenced by compiler built-in stack protector.
>
> This patch just try to support stack-protector so the value of the stack
> guard variable is simply fixed for now. It could be improved by
> deriving from a random number generator, such as Zkr extension or any
> platform-specific random number sources.
>
> Introduce three configurations for the stack protector:
> 1. CONFIG_STACK_PROTECTOR to enable the stack protector feature by
>    providing "-fstack-protector" compiler flag
> 2. CONFIG_STACK_PROTECTOR_STRONG to provide "-fstack-protector-strong"
> 3. CONFIG_STACK_PROTECTOR_ALL to provide "-fstack-protector-all"
>
> Instead of fixing the compiler flag of stack-protector feature as
> "-fstack-protector", we derive it from the introduced Kconfig
> configurations. The compiler flag "stack-protector-cflags-y" is defined
> as Makefile "immediately expanded variables" with ":=". Thus, the
> stronger configuration of the stack protector can overwrite the
> preceding one.
>
> Signed-off-by: Alvin Chang <alvinga at andestech.com>
> ---
>  Makefile                                    |  3 ++-
>  lib/utils/Kconfig                           |  2 ++
>  lib/utils/stack_protector/Kconfig           | 28 +++++++++++++++++++++
>  lib/utils/stack_protector/objects.mk        | 18 +++++++++++++
>  lib/utils/stack_protector/stack_protector.c | 18 +++++++++++++
>  5 files changed, 68 insertions(+), 1 deletion(-)
>  create mode 100644 lib/utils/stack_protector/Kconfig
>  create mode 100644 lib/utils/stack_protector/objects.mk
>  create mode 100644 lib/utils/stack_protector/stack_protector.c

Overall, this looks fine but I makes sense to have the stack protector
implementation as firmware thingy so move this under firmware/
and use $(firmware-cflags-y) instead of introducing a separate
$(stack-protector-cflags-y).

Also, please make sure it works well with DEBUG=1

Regards,
Anup

>
> diff --git a/Makefile b/Makefile
> index e90836c..eae6d16 100644
> --- a/Makefile
> +++ b/Makefile
> @@ -360,7 +360,7 @@ GENFLAGS    +=      $(libsbiutils-genflags-y)
>  GENFLAGS       +=      $(platform-genflags-y)
>  GENFLAGS       +=      $(firmware-genflags-y)
>
> -CFLAGS         =       -g -Wall -Werror -ffreestanding -nostdlib -fno-stack-protector -fno-strict-aliasing -ffunction-sections -fdata-sections
> +CFLAGS         =       -g -Wall -Werror -ffreestanding -nostdlib -fno-strict-aliasing -ffunction-sections -fdata-sections
>  CFLAGS         +=      -fno-omit-frame-pointer -fno-optimize-sibling-calls
>  # Optionally supported flags
>  ifeq ($(CC_SUPPORT_VECTOR),y)
> @@ -379,6 +379,7 @@ CFLAGS              +=      $(GENFLAGS)
>  CFLAGS         +=      $(platform-cflags-y)
>  CFLAGS         +=      -fPIE -pie
>  CFLAGS         +=      $(firmware-cflags-y)
> +CFLAGS         +=      $(stack-protector-cflags-y)
>
>  CPPFLAGS       +=      $(GENFLAGS)
>  CPPFLAGS       +=      $(platform-cppflags-y)
> diff --git a/lib/utils/Kconfig b/lib/utils/Kconfig
> index 901ba56..40e5633 100644
> --- a/lib/utils/Kconfig
> +++ b/lib/utils/Kconfig
> @@ -26,6 +26,8 @@ source "$(OPENSBI_SRC_DIR)/lib/utils/reset/Kconfig"
>
>  source "$(OPENSBI_SRC_DIR)/lib/utils/serial/Kconfig"
>
> +source "$(OPENSBI_SRC_DIR)/lib/utils/stack_protector/Kconfig"
> +
>  source "$(OPENSBI_SRC_DIR)/lib/utils/suspend/Kconfig"
>
>  source "$(OPENSBI_SRC_DIR)/lib/utils/sys/Kconfig"
> diff --git a/lib/utils/stack_protector/Kconfig b/lib/utils/stack_protector/Kconfig
> new file mode 100644
> index 0000000..c1fee19
> --- /dev/null
> +++ b/lib/utils/stack_protector/Kconfig
> @@ -0,0 +1,28 @@
> +# SPDX-License-Identifier: BSD-2-Clause
> +
> +menu "Stack Protector Support"
> +
> +config STACK_PROTECTOR
> +       bool "Stack Protector buffer overflow detection"
> +       default n
> +       help
> +         This option turns on the "stack-protector" compiler feature.
> +
> +config STACK_PROTECTOR_STRONG
> +       bool "Strong Stack Protector"
> +       depends on STACK_PROTECTOR
> +       default n
> +       help
> +         Turn on the "stack-protector" with "-fstack-protector-strong" option.
> +         Like -fstack-protector but includes additional functions to be
> +         protected.
> +
> +config STACK_PROTECTOR_ALL
> +       bool "Almighty Stack Protector"
> +       depends on STACK_PROTECTOR
> +       default n
> +       help
> +         Turn on the "stack-protector" with "-fstack-protector-all" option.
> +         Like -fstack-protector except that all functions are protected.
> +
> +endmenu
> diff --git a/lib/utils/stack_protector/objects.mk b/lib/utils/stack_protector/objects.mk
> new file mode 100644
> index 0000000..d7563e3
> --- /dev/null
> +++ b/lib/utils/stack_protector/objects.mk
> @@ -0,0 +1,18 @@
> +#
> +# SPDX-License-Identifier: BSD-2-Clause
> +#
> +# Copyright (c) 2025 Andes Technology Corporation
> +#
> +# Authors:
> +#   Alvin Chang <alvinga at andestech.com>
> +#
> +
> +libsbiutils-objs-$(CONFIG_STACK_PROTECTOR) += stack_protector/stack_protector.o
> +
> +ifeq ($(CONFIG_STACK_PROTECTOR),y)
> +stack-protector-cflags-$(CONFIG_STACK_PROTECTOR) := -fstack-protector
> +stack-protector-cflags-$(CONFIG_STACK_PROTECTOR_STRONG) := -fstack-protector-strong
> +stack-protector-cflags-$(CONFIG_STACK_PROTECTOR_ALL) := -fstack-protector-all
> +else
> +stack-protector-cflags-y := -fno-stack-protector
> +endif
> diff --git a/lib/utils/stack_protector/stack_protector.c b/lib/utils/stack_protector/stack_protector.c
> new file mode 100644
> index 0000000..3088421
> --- /dev/null
> +++ b/lib/utils/stack_protector/stack_protector.c
> @@ -0,0 +1,18 @@
> +/*
> + * SPDX-License-Identifier: BSD-2-Clause
> + *
> + * Copyright (c) 2025 Andes Technology Corporation
> + *
> + * Authors:
> + *   Alvin Chang <alvinga at andestech.com>
> + */
> +
> +#include <sbi/sbi_console.h>
> +#include <sbi/sbi_types.h>
> +
> +void *__stack_chk_guard = (void *)0x95B5FF5AUL;
> +
> +void __noreturn __stack_chk_fail(void)
> +{
> +       sbi_panic("Stack corruption detected\n");
> +}
> --
> 2.43.0
>