stack guard page

Author: Sangho Lee

litebox_shim_optee/src/lib.rs

@@ -269,6 +269,7 @@ impl OpteeShim {
                 ta_entry_point: Cell::new(0),
                 ta_stack_base_addr: Cell::new(0),
                 ta_prepared: Cell::new(false),
+                #[cfg(target_arch = "x86_64")]
                 stack_guard_page_addr: Cell::new(0),
             },
         };
@@ -836,6 +837,11 @@ impl Task {
     }
 
     /// Allocate and initialize the page backing the x86-64 stack-guard slot.
+    ///
+    /// The x86-64 toolchain emits stack-protector accesses to `%fs:0x28`.
+    /// Normally glibc or musl initializes that ABI slot before application code
+    /// runs. OP-TEE TAs use neither runtime, so the shim must provide and
+    /// initialize the slot before entering a protected TA.
     fn allocate_stack_guard_page(&self) -> Result<(), ElfLoaderError> {
         use litebox::platform::CrngProvider as _;
 
@@ -853,6 +859,9 @@ impl Task {
             })?;
         let mut guard = [0u8; core::mem::size_of::<usize>()];
         self.global.platform.fill_bytes_crng(&mut guard);
+        // Terminator-canary convention (matches glibc `_dl_setup_stack_chk_guard`):
+        // zero the lowest-addressed byte of the guard to stop the overflow by C string func.
+        guard[0] = 0;
         page.copy_from_slice(loader::ta_stack::ABI_STACK_GUARD_FS_OFFSET, &guard)
             .ok_or(ElfLoaderError::InvalidStackAddr)?;
         self.sys_mprotect(page, PAGE_SIZE, ProtFlags::PROT_READ)
@@ -1348,6 +1357,7 @@ struct Task {
     /// Whether the TA has been prepared
     ta_prepared: Cell<bool>,
     /// Base address of the read-only page containing the stack guard.
+    #[cfg(target_arch = "x86_64")]
     stack_guard_page_addr: Cell<usize>,
     // TODO: OP-TEE supports global, persistent objects across sessions. Add these maps if needed.
 }
@@ -1513,6 +1523,7 @@ mod test_utils {
                 ta_entry_point: Cell::new(0),
                 ta_stack_base_addr: Cell::new(0),
                 ta_prepared: Cell::new(false),
+                #[cfg(target_arch = "x86_64")]
                 stack_guard_page_addr: Cell::new(0),
             }
         }

litebox_shim_optee/src/loader/ta_stack.rs

@@ -79,9 +79,6 @@ pub struct TaStack {
     num_params: usize,
     /// Position where LdelfArg was pushed (if any)
     ldelf_arg_pos: Option<usize>,
-    #[cfg(target_arch = "x86_64")]
-    /// Position where the TA stack canary was pushed (if any).
-    canary_pos: Option<usize>,
 }
 
 impl TaStack {
@@ -104,7 +101,6 @@ impl TaStack {
             params: UteeParams::new(),
             num_params: 0,
             ldelf_arg_pos: None,
-            canary_pos: None,
         })
     }
 
@@ -122,14 +118,6 @@ impl TaStack {
         self.stack_top.as_usize() + self.len - core::mem::size_of::<UteeParams>()
     }
 
-    /// Get the address of the TA stack canary pushed by [`Self::init`].
-    /// Returns `None` if no canary has been pushed yet.
-    #[cfg(target_arch = "x86_64")]
-    #[expect(dead_code, reason = "retained with the existing stack canary")]
-    pub(crate) fn canary_addr(&self) -> Option<usize> {
-        self.canary_pos.map(|pos| self.stack_top.as_usize() + pos)
-    }
-
     /// Get the address of `LdelfArg` on the stack.
     ///
     /// Returns the actual address where `LdelfArg` was pushed via `init_with_ldelf_arg`.
@@ -153,16 +141,6 @@ impl TaStack {
         Some(())
     }
 
-    /// Push the TA stack canary and record its address.
-    fn push_canary(&mut self, canary: &[u8; 16]) -> Option<()> {
-        self.push_bytes(canary)?;
-        #[cfg(target_arch = "x86_64")]
-        {
-            self.canary_pos = Some(self.pos);
-        }
-        Some(())
-    }
-
     /// Zero the unused stack region before a new session writes its parameters,
     /// to avoid leaking leftover data from a prior session whose stack region was recycled.
     /// The trailing `UteeParams` slot is left untouched here because
@@ -298,7 +276,7 @@ impl TaStack {
         // Random 16-byte stack canary
         let mut canary = [0u8; 16];
         <Platform as litebox::platform::CrngProvider>::fill_bytes_crng(platform, &mut canary);
-        self.push_canary(&canary)?;
+        self.push_bytes(&canary)?;
 
         // `reenter_thread` *jumps* into the TA entry point (which is a function) rather than
         // calls it. Adjust the stack pointer to ensure post-call stack alignment.

litebox_shim_optee/src/syscalls/tests.rs

@@ -42,24 +42,6 @@ fn test_cryp_random_number_generate() {
     assert!(result.is_ok() && buf != [0u8; 16]);
 }
 
-#[test]
-fn test_stack_guard_page_is_initialized() {
-    use litebox::platform::RawConstPointer as _;
-
-    let task = init_platform();
-    task.allocate_stack_guard_page().unwrap();
-
-    let base = task.stack_guard_page_addr.get();
-    assert_ne!(base, 0);
-    assert_eq!(base % litebox::mm::linux::PAGE_SIZE, 0);
-    let guard = crate::UserConstPtr::<usize>::from_usize(
-        base + crate::loader::ta_stack::ABI_STACK_GUARD_FS_OFFSET,
-    )
-    .read_at_offset(0)
-    .unwrap();
-    assert_ne!(guard, 0);
-}
-
 #[test]
 fn test_sys_get_time_system_is_monotonic() {
     use litebox::platform::RawConstPointer as _;