architecture: document ASLR and compiler-instrumented stack canaries#288
architecture: document ASLR and compiler-instrumented stack canaries#288raymo200915 wants to merge 2 commits into
Conversation
Document compiler-instrumented stack canaries.
The new page covers OP-TEE core and user mode TA stack protector
support, including the RISC-V-specific implementation details based
on the following optee_os commits:
45507d1093f7 ("Add support for compiler stack protector")
19662e417055 ("ta: apply __no_stack_protector to __ta_entry() or __ta_entry_c()")
71ee6d2a2b8a ("core: riscv: support random stack canaries for stack protector")
Signed-off-by: Raymond Mao <raymond.mao@riscstar.com>
Document ASLR.
The new page covers OP-TEE core and user mode TA ASLR, including the
RISC-V-specific implementation details based on the following optee_os
commits:
7dfff1313980 ("core: user_ta: implement ASLR for TAs")
170e9084a84f ("core: add support for CFG_CORE_ASLR")
87372da451d4 ("Enable ASLR by default")
591e93e99ded ("core: riscv: kernel: provide link.mk")
e90887e3f478 ("core: riscv: implement get_aslr_seed() function")
Signed-off-by: Raymond Mao <raymond.mao@riscstar.com>
jforissier
left a comment
jforissier
left a comment
There was a problem hiding this comment.
Hi @raymo200915, thanks for the patch. A few comments below.
| @@ -0,0 +1,184 @@ | |||
| .. _aslr: | |||
There was a problem hiding this comment.
Since this is heavily focused on RISC-V I suggest renaming the file to aslr_riscv.rst
| .. note:: | ||
|
|
||
| The options themselves are generic. This page only records the | ||
| RISC-V-specific implementation details. |
There was a problem hiding this comment.
'only' is a bit strong IMO. I'd prefer:
The options themselves are generic. This page also highlights the current RISC-V implementation where it differs from the generic code.
| string-based overwrite patterns. | ||
|
|
||
| When ``CFG_NS_VIRTUALIZATION=y``, the same helper uses a fixed value instead | ||
| because the Nexus core RNG is not initialized yet. |
There was a problem hiding this comment.
It would be nice to be more explicit that it is important to override the weak implementation when NS virt is enabled. How about:
With
CFG_NS_VIRTUALIZATION=y, the default weak implementation cannot use the core RNG at that point and falls back to a fixed value, while printing a warning. Platforms using virtualization should overrideplat_get_random_stack_canaries()if compiler stack protection or stack boundary canaries are required.
| * - ``CFG_CORE_STACK_PROTECTOR_ALL`` | ||
| - ``-fstack-protector-all`` | ||
| - ``core/core.mk`` | ||
| - ``n`` |
There was a problem hiding this comment.
These CFG_ flags are actually defined in mk/config.mk
3 participants
Add two new architecture documents:
architecture/aslr.rstarchitecture/stack_canaries.rstand add both to
architecture/index.rst.The new pages document: