Fix stack protector

[mbrousset-ledger]

Description

There were two problems in the initial stack protector implementation :

• canary was not correctly initialized because entry point was forced with ENTRY(main);
• during libcalls, caller's BSS was entirely wiped included canary.
  The second problem could not be detected during tests as canary was not initialized.

The idea of this fix is to have the correct entry point whether building with SSP.
Also, moving canary out of bss with appropriate pic adaptation.

Changes include

• Bugfix (non-breaking change that solves an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (change that is not backwards-compatible and/or changes current functionality)
• Tests
• Documentation
• Other (for changes that might not fit in any category)

Breaking changes

Please complete this section if any breaking changes have been made, otherwise delete it.

Additional comments

Please post additional comments in this section if you have them, otherwise delete it.

Auto cherry-pick in API_LEVEL

If requested to port the commits from this PR on a dedicated API_LEVEL branch,
select the targeted one(s), or add new references if not listed:

[x] TARGET_API_LEVEL: API_LEVEL_26

This will only create the PR with cherry-picks, ready to be reviewed and merged.

Remember:

• The merge will ALWAYS be a manual operation.
• It is possible the cherry-picks don't apply correctly, mainly if previous commits have been forgotten.
• In case of failure, there is no other solution than redo the operation manually...

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.00%. Comparing base (e604aba) to head (fc00006).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1650   +/-   ##
=======================================
  Coverage   92.00%   92.00%           
=======================================
  Files          39       39           
  Lines        4653     4653           
  Branches      597      597           
=======================================
  Hits         4281     4281           
  Misses        258      258           
  Partials      114      114           

Flag	Coverage Δ
unittests	92.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fbeutin-ledger]

Also needs more text in the __stack_chk_guard generation code to explain how it behaves with os_lib_call
Maybe also reroll if == 0 🤔

[mbrousset-ledger]

__wrap___stack_chk_init documentation already mentions it skips canary generation during libcall

[iartemov-ledger]

Tested with app-bitcoin built as:

make -C . -j DEBUG=1 ENABLE_STACK_PROTECTOR=1 TARGET=flex BOLOS_SDK=/tmp/my-sdk/

against the current SDK.

it works with Speculos and with the real physical device:

echo "EF01000000" | python3 -m ledgerblue.runScript --apdu
HID => ef01000000
HID <= 4ccad0829000
<= Clear bytearray(b'L\xca\xd0\x82')

Need still to test it with swap.

[iartemov-ledger]

Tested successfully with app-exchange on real Flex device.
reproduce.txt

[mbrousset-ledger]

Currently, CI is failing because of rust apps as this PR adds a _ram symbol for pic relocation. the rust sdk needs it as well, this is done here and requires rust sdk release cc @yogh333.