diff --git a/kernel/src/cpu/boot.s b/kernel/src/cpu/boot.s
new file mode 100644
index 0000000..23c98a9
--- /dev/null
+++ b/kernel/src/cpu/boot.s
@@ -0,0 +1,19 @@
+rdrand:
+  rdrand %rax
+  jnc rdrand
+  ret
+.global _start
+_start:
+  mov %rcx, %rdi
+  mov $stack, %rsp
+  call rdrand
+  mov %rax, __stack_chk_guard
+  call main
+.section .bss
+.align 8
+.global __stack_chk_guard
+__stack_chk_guard:
+.skip 8
+.align 16
+.skip 0x100000
+stack:
diff --git a/kernel/src/main.rs b/kernel/src/main.rs
index 4f0fa91..de23f80 100644
--- a/kernel/src/main.rs
+++ b/kernel/src/main.rs
@@ -25,20 +25,7 @@ mod sys;
 static ALLOC: LockedHeap = LockedHeap::empty();
 pub static RSDP_ADDRESS: Once<u64> = Once::new();
 
-global_asm!(
-    "
-    .global _start
-    _start:
-    mov %rcx, %rdi
-    mov $stack, %rsp
-    call main
-    .section .bss
-    .align 16
-    .skip 0x100000
-    stack:
-    ",
-    options(att_syntax)
-);
+global_asm!(include_str!("cpu/boot.s"), options(att_syntax));
 
 #[no_mangle]
 extern "C" fn main(temp_loader_struct: *const LoaderStruct) -> ! {
@@ -55,11 +42,11 @@ extern "C" fn main(temp_loader_struct: *const LoaderStruct) -> ! {
     if loader_struct.magic != LOADER_STRUCT_MAGIC {
         panic!("Invalid bootloader struct");
     }
-    RSDP_ADDRESS.call_once(|| loader_struct.rsdp_address);
     setup_gdt();
     setup_idt();
     setup_paging(&loader_struct, loader_struct.phys_kernel_start, loader_struct.phys_heap_start);
     disable_pic();
+    RSDP_ADDRESS.call_once(|| loader_struct.rsdp_address);
     loop {
         hlt();
     }
@@ -72,3 +59,7 @@ fn panic(info: &PanicInfo) -> ! {
         hlt();
     }
 }
+#[no_mangle]
+extern "C" fn __stack_chk_fail() {
+    panic!("Stack smashing detected");
+}
diff --git a/lib/acpica-build/Makefile b/lib/acpica-build/Makefile
index 66eee9f..2ef8423 100644
--- a/lib/acpica-build/Makefile
+++ b/lib/acpica-build/Makefile
@@ -3,7 +3,7 @@ COMPONENTS:=dispatcher events executer hardware namespace parser resources table
 CFILES:=$(foreach comp, $(COMPONENTS), $(wildcard ../acpica/source/components/$(comp)/*.c))
 OFILES:=$(patsubst %.c, %.o, $(CFILES))
 CC:=clang
-CFLAGS:=--target=x86_64-elf -ffreestanding -mcmodel=kernel -mno-red-zone -mno-mmx -mno-sse -mno-sse2 -O2 -I. -I../acpica/source/include -DACPI_LIBRARY -D__linux__
+CFLAGS:=--target=x86_64-elf -ffreestanding -mcmodel=kernel -mno-red-zone -mno-mmx -mno-sse -mno-sse2 -fstack-protector-strong -O2 -I. -I../acpica/source/include -DACPI_LIBRARY -D__linux__
 
 libacpica.a: $(OFILES)
 	llvm-ar rcD $@ $^
diff --git a/qemu.sh b/qemu.sh
index 361092d..a9e38f2 100755
--- a/qemu.sh
+++ b/qemu.sh
@@ -2,4 +2,4 @@
 # shellcheck disable=SC2068
 set -e
 ./build.sh
-qemu-system-x86_64 -M q35 -m 256M -L /usr/share/OVMF -bios OVMF_CODE.fd -drive file=img/os.img,format=raw $@
+qemu-system-x86_64 -M q35 -cpu qemu64,+rdrand -m 256M -L /usr/share/OVMF -bios OVMF_CODE.fd -drive file=img/os.img,format=raw $@