Add support for GCC stack protection
authorDouglas Raillard <douglas.raillard@arm.com>
Fri, 24 Feb 2017 18:14:15 +0000 (18:14 +0000)
committerdp-arm <dimitris.papastamos@arm.com>
Fri, 31 Mar 2017 12:58:48 +0000 (13:58 +0100)
commit51faada71a219a8b94cd8d8e423f0f22e9da4d8f
tree402ce88d1f332e3afda2a623a7ec66053deb2d24
parente422f991df48306cd5d9629c4f1ed230b0807fdb
Add support for GCC stack protection

Introduce new build option ENABLE_STACK_PROTECTOR. It enables
compilation of all BL images with one of the GCC -fstack-protector-*
options.

A new platform function plat_get_stack_protector_canary() is introduced.
It returns a value that is used to initialize the canary for stack
corruption detection. Returning a random value will prevent an attacker
from predicting the value and greatly increase the effectiveness of the
protection.

A message is printed at the ERROR level when a stack corruption is
detected.

To be effective, the global data must be stored at an address
lower than the base of the stacks. Failure to do so would allow an
attacker to overwrite the canary as part of an attack which would void
the protection.

FVP implementation of plat_get_stack_protector_canary is weak as
there is no real source of entropy on the FVP. It therefore relies on a
timer's value, which could be predictable.

Change-Id: Icaaee96392733b721fa7c86a81d03660d3c1bc06
Signed-off-by: Douglas Raillard <douglas.raillard@arm.com>
23 files changed:
Makefile
bl1/bl1.ld.S
bl2/aarch32/bl2_entrypoint.S
bl2/aarch64/bl2_entrypoint.S
bl2/bl2.ld.S
bl2u/aarch64/bl2u_entrypoint.S
bl2u/bl2u.ld.S
bl31/bl31.ld.S
bl32/tsp/aarch64/tsp_entrypoint.S
docs/porting-guide.md
docs/user-guide.md
include/common/aarch32/el3_common_macros.S
include/common/aarch64/el3_common_macros.S
include/common/debug.h
include/plat/common/platform.h
lib/stack_protector/aarch32/asm_stack_protector.S [new file with mode: 0644]
lib/stack_protector/aarch64/asm_stack_protector.S [new file with mode: 0644]
lib/stack_protector/stack_protector.c [new file with mode: 0644]
lib/stack_protector/stack_protector.mk [new file with mode: 0644]
make_helpers/defaults.mk
plat/arm/board/fvp/fvp_stack_protector.c [new file with mode: 0644]
plat/arm/board/fvp/platform.mk
plat/mediatek/mt6795/bl31.ld.S