From patchwork Mon Nov 23 09:57:12 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Christoph Muellner X-Patchwork-Id: 1404706 Return-Path: X-Original-To: incoming-buildroot@patchwork.ozlabs.org Delivered-To: patchwork-incoming-buildroot@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=busybox.net (client-ip=140.211.166.136; helo=silver.osuosl.org; envelope-from=buildroot-bounces@busybox.net; receiver=) Authentication-Results: ozlabs.org; dmarc=none (p=none dis=none) header.from=theobroma-systems.com Received: from silver.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4CfjHs0zyLz9sRK for ; Mon, 23 Nov 2020 20:57:29 +1100 (AEDT) Received: from localhost (localhost [127.0.0.1]) by silver.osuosl.org (Postfix) with ESMTP id 6BEA92047F; Mon, 23 Nov 2020 09:57:27 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from silver.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4biiLymjdL6f; Mon, 23 Nov 2020 09:57:25 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by silver.osuosl.org (Postfix) with ESMTP id E685C20483; Mon, 23 Nov 2020 09:57:24 +0000 (UTC) X-Original-To: buildroot@lists.busybox.net Delivered-To: buildroot@osuosl.org Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by ash.osuosl.org (Postfix) with ESMTP id 2EF0B1BF2BC for ; Mon, 23 Nov 2020 09:57:23 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id 26AB786722 for ; Mon, 23 Nov 2020 09:57:23 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WqZPfa2fq7nW for ; Mon, 23 Nov 2020 09:57:22 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail.theobroma-systems.com (vegas.theobroma-systems.com [144.76.126.164]) by whitealder.osuosl.org (Postfix) with ESMTPS id 28BBD866B1 for ; Mon, 23 Nov 2020 09:57:22 +0000 (UTC) Received: from ip092042140082.rev.nessus.at ([92.42.140.82]:54994 helo=localhost.localdomain) by mail.theobroma-systems.com with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1kh8b0-0007ac-M9; Mon, 23 Nov 2020 10:57:18 +0100 From: =?utf-8?q?Christoph_M=C3=BCllner?= To: buildroot@buildroot.org Date: Mon, 23 Nov 2020 10:57:12 +0100 Message-Id: <20201123095712.3447912-1-christoph.muellner@theobroma-systems.com> X-Mailer: git-send-email 2.28.0 MIME-Version: 1.0 Subject: [Buildroot] [PATCH v3 1/1] boot/arm-trusted-firmware: Forward stack protection configuration X-BeenThere: buildroot@busybox.net X-Mailman-Version: 2.1.29 Precedence: list List-Id: Discussion and development of buildroot List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Heiko Stuebner , Sergey Matyukevich , =?utf-8?q?Christoph_M=C3=BCllner?= Errors-To: buildroot-bounces@busybox.net Sender: "buildroot" TF-A supports stack smashing protection (-fstack-protector-*). However, it currenlty silently disables that feature with -fno-stack-protector in case ENABLE_STACK_PROTECTOR is not set during build time. As documented in the TF-A user guide, the flag ENABLE_STACK_PROTECTOR is required to enable stack protection support. When enabled the symbols for the stack protector (e.g. __stack_chk_guard) are built. So in case we see that BR2_SSP_* is enabled, let's enable the corresponding build flag for TF-A as documented in the TF-A user guide. Tested on a Rockchip PX30 based system (TF-A v2.2 and upstream/master). Signed-off-by: Christoph Müllner --- boot/arm-trusted-firmware/arm-trusted-firmware.mk | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/boot/arm-trusted-firmware/arm-trusted-firmware.mk b/boot/arm-trusted-firmware/arm-trusted-firmware.mk index a3553e36cf..0597cecf71 100644 --- a/boot/arm-trusted-firmware/arm-trusted-firmware.mk +++ b/boot/arm-trusted-firmware/arm-trusted-firmware.mk @@ -100,6 +100,14 @@ ARM_TRUSTED_FIRMWARE_MAKE_OPTS += MV_DDR_PATH=$(MV_DDR_MARVELL_DIR) ARM_TRUSTED_FIRMWARE_DEPENDENCIES += mv-ddr-marvell endif +ifeq ($(BR2_SSP_REGULAR),y) +ARM_TRUSTED_FIRMWARE_MAKE_OPTS += ENABLE_STACK_PROTECTOR=default +else ifeq ($(BR2_SSP_STRONG),y) +ARM_TRUSTED_FIRMWARE_MAKE_OPTS += ENABLE_STACK_PROTECTOR=strong +else ifeq ($(BR2_SSP_ALL),y) +ARM_TRUSTED_FIRMWARE_MAKE_OPTS += ENABLE_STACK_PROTECTOR=all +endif + ARM_TRUSTED_FIRMWARE_MAKE_TARGETS = all ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_FIP),y)