diff options
| author | Alvin Chang <[email protected]> | 2025-07-03 23:19:57 +0800 |
|---|---|---|
| committer | Anup Patel <[email protected]> | 2025-07-20 20:54:34 +0530 |
| commit | edfbc1285dd9ac624665fe9fa5de26437d61c1eb (patch) | |
| tree | 42840145378dd5c8a2d5195401e9a42f6eeb2dc4 /firmware/objects.mk | |
| parent | ea5abd1f5e33ed3afedc92686ec8bfd00bc49235 (diff) | |
firmware: Initial compiler built-in stack protector support
Add __stack_chk_fail() and __stack_chk_guard variable which are used by
compiler built-in stack protector.
This patch just try to support stack-protector so the value of the stack
guard variable is simply fixed for now. It could be improved by
deriving from a random number generator, such as Zkr extension or any
platform-specific random number sources.
Introduce three configurations for the stack protector:
1. CONFIG_STACK_PROTECTOR to enable the stack protector feature by
providing "-fstack-protector" compiler flag
2. CONFIG_STACK_PROTECTOR_STRONG to provide "-fstack-protector-strong"
3. CONFIG_STACK_PROTECTOR_ALL to provide "-fstack-protector-all"
Instead of fixing the compiler flag of stack-protector feature as
"-fstack-protector", we derive it from the introduced Kconfig
configurations. The compiler flag "stack-protector-cflags-y" is defined
as Makefile "immediately expanded variables" with ":=". Thus, the
stronger configuration of the stack protector can overwrite the
preceding one.
Signed-off-by: Alvin Chang <[email protected]>
Reviewed-by: Yu-Chien Peter Lin <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
Diffstat (limited to 'firmware/objects.mk')
| -rw-r--r-- | firmware/objects.mk | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/firmware/objects.mk b/firmware/objects.mk index a90485d0..bfec4671 100644 --- a/firmware/objects.mk +++ b/firmware/objects.mk @@ -66,3 +66,12 @@ endif ifdef FW_OPTIONS firmware-genflags-y += -DFW_OPTIONS=$(FW_OPTIONS) endif + +ifeq ($(CONFIG_STACK_PROTECTOR),y) +stack-protector-cflags-$(CONFIG_STACK_PROTECTOR) := -fstack-protector +stack-protector-cflags-$(CONFIG_STACK_PROTECTOR_STRONG) := -fstack-protector-strong +stack-protector-cflags-$(CONFIG_STACK_PROTECTOR_ALL) := -fstack-protector-all +else +stack-protector-cflags-y := -fno-stack-protector +endif +firmware-cflags-y += $(stack-protector-cflags-y) |