From 3697f01a3906815cbbbe8927f50045163976c1db Mon Sep 17 00:00:00 2001
From: Felix Morgner <felix.morgner@ost.ch>
Date: Fri, 4 Sep 2026 22:15:18 +0200
Subject: build: enable stack frame size diagnostics

It has been observed that certain call-chains are too large for a 4 KiB
kernel stack. While we have increased the stack on x86-64 to 8 KiB, it
seems desirable to enable diagnostics that warn us of large stack
frames.

This changeset introduces 3 new CMake configuration options, two of
which are considered internal:

TEACHOS_STACK_FRAME_LIMIT:

  The size limit of in bytes we are willing to accepts for any given
  stack frame. Defaults to "0", meaning the internal defaults are used
  per build configuration.

TEACHOS_STACK_FRAME_LIMIT_DEBUG:
TEACHOS_STACK_FRAME_LIMIT_RELEASE:

  !!internal!!

  The default stack frame size limit in bytes, per configuration, if no
  user specified stack frame size limit was defined at configure time.
---
 CMakeLists.txt | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

(limited to 'CMakeLists.txt')

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 830da817..34738e18 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -46,6 +46,15 @@ option(TEACHOS_ENABLE_TEST_TSAN "Enable TSan for the test executable" OFF)
 set(ACPI_ENABLE_TEST_COVERAGE ${TEACHOS_ENABLE_TEST_COVERAGE})
 set(KSTD_ENABLE_TEST_COVERAGE ${TEACHOS_ENABLE_TEST_COVERAGE})
 
+set(CACHE{TEACHOS_STACK_FRAME_LIMIT}
+  TYPE STRING
+  HELP "The maximum allowed stack frame size in bytes."
+  VALUE "0"
+)
+
+set(CACHE{TEACHOS_STACK_FRAME_LIMIT_DEBUG} TYPE INTERNAL VALUE "3072")
+set(CACHE{TEACHOS_STACK_FRAME_LIMIT_RELEASE} TYPE INTERNAL VALUE "1280")
+
 #[============================================================================[
 # Global Build System Configuration
 #]============================================================================]
@@ -69,6 +78,27 @@ add_compile_options(
   "$<$<CXX_COMPILER_ID:GNU>:-pedantic-errors>"
 )
 
+if(NOT BUILD_TESTING)
+  if(TEACHOS_STACK_FRAME_LIMIT)
+    set(STACK_FRAME_LIMIT "${TEACHOS_STACK_FRAME_LIMIT}")
+  else()
+    set(STACK_FRAME_LIMIT "$<IF:$<CONFIG:Debug>,${TEACHOS_STACK_FRAME_LIMIT_DEBUG},${TEACHOS_STACK_FRAME_LIMIT_RELEASE}>")
+  endif()
+
+  add_compile_options(
+    "$<$<CXX_COMPILER_ID:GNU>:-fstack-usage>"
+    "$<$<CXX_COMPILER_ID:GNU>:-Wframe-larger-than=${STACK_FRAME_LIMIT}>"
+  )
+
+  add_link_options(
+    "$<$<CXX_COMPILER_ID:GNU>:-fstack-usage>"
+    "$<$<CXX_COMPILER_ID:GNU>:-Wframe-larger-than=${STACK_FRAME_LIMIT}>"
+    "$<$<CXX_COMPILER_ID:GNU>:-Werror=frame-larger-than=${STACK_FRAME_LIMIT}>"
+  )
+
+  unset(STACK_FRAME_LIMIT)
+endif()
+
 #[============================================================================[
 # Global Linting Configuration
 #]============================================================================]
-- 
cgit v1.2.3


From 9f544dea5dbcdb92f614c6092a60e81d3398b8da Mon Sep 17 00:00:00 2001
From: Felix Morgner <felix.morgner@ost.ch>
Date: Sat, 5 Sep 2026 13:19:25 +0200
Subject: build: enable strong stack protector

---
 CMakeLists.txt | 1 +
 1 file changed, 1 insertion(+)

(limited to 'CMakeLists.txt')

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 34738e18..8f622050 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -76,6 +76,7 @@ add_compile_options(
   "$<$<CXX_COMPILER_ID:GNU>:-Wextra>"
   "$<$<CXX_COMPILER_ID:GNU>:-Werror>"
   "$<$<CXX_COMPILER_ID:GNU>:-pedantic-errors>"
+  "$<$<CXX_COMPILER_ID:GNU>:-fstack-protector-strong>"
 )
 
 if(NOT BUILD_TESTING)
-- 
cgit v1.2.3