Add support for stack-protector
Add support for stack protector for UBOOT, SPL, and TPL as well as new pytest for stackprotector Signed-off-by: Joel Peshkin <joel.peshkin@broadcom.com> Adjust UEFI build flags. Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
This commit is contained in:
Joel Peshkin
Tom Rini
parent
1598c83ece
commit
4e9bce1243
@ -1062,6 +1062,13 @@ F: include/sqfs.h
|
||||
F: cmd/sqfs.c
|
||||
F: test/py/tests/test_fs/test_squashfs/
|
||||
|
||||
STACKPROTECTOR
|
||||
M: Joel Peshkin <joel.peshkin@broadcom.com>
|
||||
S: Maintained
|
||||
F: common/stackprot.c
|
||||
F: cmd/stackprot_test.c
|
||||
F: test/py/tests/test_stackprotector.py
|
||||
|
||||
TARGET_BCMNS3
|
||||
M: Bharat Gooty <bharat.gooty@broadcom.com>
|
||||
M: Rayagonda Kokatanur <rayagonda.kokatanur@broadcom.com>
|
||||
|
||||
5
Makefile
5
Makefile
@ -676,7 +676,12 @@ else
|
||||
KBUILD_CFLAGS += -O2
|
||||
endif
|
||||
|
||||
ifeq ($(CONFIG_STACKPROTECTOR),y)
|
||||
KBUILD_CFLAGS += $(call cc-option,-fstack-protector-strong)
|
||||
CFLAGS_EFI += $(call cc-option,-fno-stack-protector)
|
||||
else
|
||||
KBUILD_CFLAGS += $(call cc-option,-fno-stack-protector)
|
||||
endif
|
||||
KBUILD_CFLAGS += $(call cc-option,-fno-delete-null-pointer-checks)
|
||||
|
||||
# disable stringop warnings in gcc 8+
|
||||
|
||||
@ -11,7 +11,8 @@ CONFIG_STANDALONE_LOAD_ADDR = 0xc100000
|
||||
endif
|
||||
endif
|
||||
|
||||
CFLAGS_NON_EFI := -fno-pic -ffixed-r9 -ffunction-sections -fdata-sections
|
||||
CFLAGS_NON_EFI := -fno-pic -ffixed-r9 -ffunction-sections -fdata-sections \
|
||||
-fstack-protector-strong
|
||||
CFLAGS_EFI := -fpic -fshort-wchar
|
||||
|
||||
LDFLAGS_FINAL += --gc-sections
|
||||
|
||||
@ -27,6 +27,7 @@ obj-$(CONFIG_SPL_BUILD) += spl.o
|
||||
obj-y += fdt_fixup.o
|
||||
|
||||
# For building EFI apps
|
||||
CFLAGS_NON_EFI := -fstack-protector-strong
|
||||
CFLAGS_$(EFI_CRT0) := $(CFLAGS_EFI)
|
||||
CFLAGS_REMOVE_$(EFI_CRT0) := $(CFLAGS_NON_EFI)
|
||||
|
||||
|
||||
@ -42,7 +42,7 @@ OBJCOPYFLAGS_EFI := -j .text -j .sdata -j .data -j .dynamic -j .dynsym \
|
||||
# Compiler flags to be added when building UEFI applications
|
||||
CFLAGS_EFI := -fpic -fshort-wchar
|
||||
# Compiler flags to be removed when building UEFI applications
|
||||
CFLAGS_NON_EFI := -mregparm=3
|
||||
CFLAGS_NON_EFI := -mregparm=3 -fstack-protector-strong
|
||||
|
||||
ifeq ($(CONFIG_EFI_STUB_64BIT),)
|
||||
CFLAGS_EFI += $(call cc-option, -mno-red-zone)
|
||||
|
||||
@ -2325,6 +2325,15 @@ config CMD_AVB
|
||||
avb read_part_hex - read data from partition and output to stdout
|
||||
avb write_part - write data to partition
|
||||
avb verify - run full verification chain
|
||||
|
||||
config CMD_STACKPROTECTOR_TEST
|
||||
bool "Test command for stack protector"
|
||||
depends on STACKPROTECTOR
|
||||
help
|
||||
Enable stackprot_test command
|
||||
The stackprot_test command will force a stack overrun to test
|
||||
the stack smashing detection mechanisms.
|
||||
|
||||
endmenu
|
||||
|
||||
config CMD_UBI
|
||||
|
||||
@ -144,6 +144,7 @@ obj-$(CONFIG_CMD_SPI) += spi.o
|
||||
obj-$(CONFIG_CMD_STRINGS) += strings.o
|
||||
obj-$(CONFIG_CMD_SMC) += smccc.o
|
||||
obj-$(CONFIG_CMD_SYSBOOT) += sysboot.o pxe_utils.o
|
||||
obj-$(CONFIG_CMD_STACKPROTECTOR_TEST) += stackprot_test.o
|
||||
obj-$(CONFIG_CMD_TERMINAL) += terminal.o
|
||||
obj-$(CONFIG_CMD_TIME) += time.o
|
||||
obj-$(CONFIG_CMD_TIMER) += timer.o
|
||||
|
||||
19
cmd/stackprot_test.c
Normal file
19
cmd/stackprot_test.c
Normal file
@ -0,0 +1,19 @@
|
||||
// SPDX-License-Identifier: GPL-2.0+
|
||||
/*
|
||||
* Copyright 2021 Broadcom
|
||||
*/
|
||||
|
||||
#include <common.h>
|
||||
#include <command.h>
|
||||
|
||||
static int do_test_stackprot_fail(struct cmd_tbl *cmdtp, int flag, int argc,
|
||||
char *const argv[])
|
||||
{
|
||||
char a[128];
|
||||
|
||||
memset(a, 0xa5, 512);
|
||||
return 0;
|
||||
}
|
||||
|
||||
U_BOOT_CMD(stackprot_test, 1, 1, do_test_stackprot_fail,
|
||||
"test stack protector fail", "");
|
||||
@ -618,6 +618,23 @@ config TPL_HASH
|
||||
and the algorithms it supports are defined in common/hash.c. See
|
||||
also CMD_HASH for command-line access.
|
||||
|
||||
config STACKPROTECTOR
|
||||
bool "Stack Protector buffer overflow detection"
|
||||
default n
|
||||
help
|
||||
Enable stack smash detection through compiler's stack-protector
|
||||
canary logic
|
||||
|
||||
config SPL_STACKPROTECTOR
|
||||
bool "Stack Protector buffer overflow detection for SPL"
|
||||
depends on STACKPROTECTOR && SPL
|
||||
default n
|
||||
|
||||
config TPL_STACKPROTECTOR
|
||||
bool "Stack Protector buffer overflow detection for TPL"
|
||||
depends on STACKPROTECTOR && TPL
|
||||
default n
|
||||
|
||||
endmenu
|
||||
|
||||
menu "Update support"
|
||||
|
||||
@ -137,6 +137,7 @@ obj-$(CONFIG_CMD_LOADB) += xyzModem.o
|
||||
obj-$(CONFIG_$(SPL_TPL_)YMODEM_SUPPORT) += xyzModem.o
|
||||
|
||||
obj-$(CONFIG_AVB_VERIFY) += avb_verify.o
|
||||
obj-$(CONFIG_$(SPL_TPL_)STACKPROTECTOR) += stackprot.o
|
||||
obj-$(CONFIG_SCP03) += scp03.o
|
||||
|
||||
obj-$(CONFIG_QFW) += qfw.o
|
||||
|
||||
20
common/stackprot.c
Normal file
20
common/stackprot.c
Normal file
@ -0,0 +1,20 @@
|
||||
// SPDX-License-Identifier: GPL-2.0+
|
||||
/*
|
||||
* Copyright 2021 Broadcom
|
||||
*/
|
||||
|
||||
#include <common.h>
|
||||
#include <asm/global_data.h>
|
||||
|
||||
DECLARE_GLOBAL_DATA_PTR;
|
||||
|
||||
unsigned long __stack_chk_guard = (unsigned long)(0xfeedf00ddeadbeef & ~0UL);
|
||||
|
||||
void __stack_chk_fail(void)
|
||||
{
|
||||
void *ra;
|
||||
|
||||
ra = __builtin_extract_return_addr(__builtin_return_address(0));
|
||||
panic("Stack smashing detected in function:\n%p relocated from %p",
|
||||
ra, ra - gd->reloc_off);
|
||||
}
|
||||
@ -25,6 +25,7 @@ CONFIG_LOG_SYSLOG=y
|
||||
CONFIG_LOG_ERROR_RETURN=y
|
||||
CONFIG_DISPLAY_BOARDINFO_LATE=y
|
||||
CONFIG_MISC_INIT_F=y
|
||||
CONFIG_STACKPROTECTOR=y
|
||||
CONFIG_ANDROID_AB=y
|
||||
CONFIG_CMD_CPU=y
|
||||
CONFIG_CMD_LICENSE=y
|
||||
@ -97,6 +98,7 @@ CONFIG_CMD_CRAMFS=y
|
||||
CONFIG_CMD_EXT4_WRITE=y
|
||||
CONFIG_CMD_SQUASHFS=y
|
||||
CONFIG_CMD_MTDPARTS=y
|
||||
CONFIG_CMD_STACKPROTECTOR_TEST=y
|
||||
CONFIG_MAC_PARTITION=y
|
||||
CONFIG_AMIGA_PARTITION=y
|
||||
CONFIG_OF_CONTROL=y
|
||||
|
||||
@ -67,6 +67,12 @@ include $(srctree)/scripts/Makefile.lib
|
||||
KBUILD_CFLAGS += -ffunction-sections -fdata-sections
|
||||
LDFLAGS_FINAL += --gc-sections
|
||||
|
||||
ifeq ($(CONFIG_$(SPL_TPL_)STACKPROTECTOR),y)
|
||||
KBUILD_CFLAGS += -fstack-protector-strong
|
||||
else
|
||||
KBUILD_CFLAGS += -fno-stack-protector
|
||||
endif
|
||||
|
||||
# FIX ME
|
||||
cpp_flags := $(KBUILD_CPPFLAGS) $(PLATFORM_CPPFLAGS) $(UBOOTINCLUDE) \
|
||||
$(NOSTDINC_FLAGS)
|
||||
|
||||
14
test/py/tests/test_stackprotector.py
Normal file
14
test/py/tests/test_stackprotector.py
Normal file
@ -0,0 +1,14 @@
|
||||
# SPDX-License-Identifier: GPL-2.0
|
||||
# Copyright (c) 2021 Broadcom
|
||||
|
||||
import pytest
|
||||
import signal
|
||||
|
||||
@pytest.mark.buildconfigspec('cmd_stackprotector_test')
|
||||
def test_stackprotector(u_boot_console):
|
||||
"""Test that the stackprotector function works."""
|
||||
|
||||
u_boot_console.run_command('stackprot_test',wait_for_prompt=False)
|
||||
expected_response = 'Stack smashing detected'
|
||||
u_boot_console.wait_for(expected_response)
|
||||
u_boot_console.restart_uboot()
|
||||
Loading…
Reference in New Issue
Block a user