[Buildroot] [PATCH] boot/arm-trusted-firmware: fix SSP disable in v2.2

[Buildroot] [PATCH] boot/arm-trusted-firmware: fix SSP disable in v2.2

[Baruch Siach via buildroot]

ATF version 2.2 and older does not disable SSP when
ENABLE_STACK_PROTECTOR is not set. This is because the compiler enables
SSP by default, and ATF does not pass -fno-stack-protector to the
compiler. Upstream commit 7af195e29a42 ("Disable stack protection
explicitly") fixed the issue for v2.3 and newer.

Add -fno-stack-protector in CFLAGS when
BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP is not set to fix older ATF
versions.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/3301821171

Cc: Dick Olsson <hi@senzilla.io>
Cc: Sergey Matyukevich <geomatsi@gmail.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
---
 boot/arm-trusted-firmware/arm-trusted-firmware.mk | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/boot/arm-trusted-firmware/arm-trusted-firmware.mk b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
index 34d7d80243d4..1164c8141061 100644
--- a/boot/arm-trusted-firmware/arm-trusted-firmware.mk
+++ b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
@@ -67,11 +67,17 @@ ARM_TRUSTED_FIRMWARE_MAKE_OPTS += \
 ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP),y)
 ARM_TRUSTED_FIRMWARE_MAKE_OPTS += \
 	ENABLE_STACK_PROTECTOR=$(call qstrip,$(BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP_LEVEL))
+else
+ARM_TRUSTED_FIRMWARE_CFLAGS += -fno-stack-protector
+endif
+
+ifeq ($(BR2_PIC_PIE),y)
+ARM_TRUSTED_FIRMWARE_CFLAGS += -fno-PIE
 endif
 
 ARM_TRUSTED_FIRMWARE_MAKE_ENV += \
 	$(TARGET_MAKE_ENV) \
-	$(if $(BR2_PIC_PIE),CFLAGS="-fno-PIE")
+	CFLAGS="$(ARM_TRUSTED_FIRMWARE_CFLAGS)"
 
 ifeq ($(BR2_ARM_CPU_ARMV7A),y)
 ARM_TRUSTED_FIRMWARE_MAKE_OPTS += ARM_ARCH_MAJOR=7
-- 
2.35.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] boot/arm-trusted-firmware: fix SSP disable in v2.2

[Thomas Petazzoni via buildroot]

On Sun, 13 Nov 2022 21:09:54 +0200
Baruch Siach via buildroot <buildroot@buildroot.org> wrote:

> ATF version 2.2 and older does not disable SSP when
> ENABLE_STACK_PROTECTOR is not set. This is because the compiler enables
> SSP by default, and ATF does not pass -fno-stack-protector to the
> compiler. Upstream commit 7af195e29a42 ("Disable stack protection
> explicitly") fixed the issue for v2.3 and newer.
> 
> Add -fno-stack-protector in CFLAGS when
> BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP is not set to fix older ATF
> versions.
> 
> Fixes:
> https://gitlab.com/buildroot.org/buildroot/-/jobs/3301821171
> 
> Cc: Dick Olsson <hi@senzilla.io>
> Cc: Sergey Matyukevich <geomatsi@gmail.com>
> Signed-off-by: Baruch Siach <baruch@tkos.co.il>
> ---
>  boot/arm-trusted-firmware/arm-trusted-firmware.mk | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)

Applied to master, thanks for having looked so quickly at this issue!

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] boot/arm-trusted-firmware: fix SSP disable in v2.2

[Peter Korsgaard]

>>>>> "Baruch" == Baruch Siach via buildroot <buildroot@buildroot.org> writes:

 > ATF version 2.2 and older does not disable SSP when
 > ENABLE_STACK_PROTECTOR is not set. This is because the compiler enables
 > SSP by default, and ATF does not pass -fno-stack-protector to the
 > compiler. Upstream commit 7af195e29a42 ("Disable stack protection
 > explicitly") fixed the issue for v2.3 and newer.

 > Add -fno-stack-protector in CFLAGS when
 > BR2_TARGET_ARM_TRUSTED_FIRMWARE_SSP is not set to fix older ATF
 > versions.

 > Fixes:
 > https://gitlab.com/buildroot.org/buildroot/-/jobs/3301821171

 > Cc: Dick Olsson <hi@senzilla.io>
 > Cc: Sergey Matyukevich <geomatsi@gmail.com>
 > Signed-off-by: Baruch Siach <baruch@tkos.co.il>

Committed to 2022.08.x and 2022.02.x, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot