diff --git a/board/freescale/common/patches/arm-trusted-firmware/0001-feat-build-add-support-for-new-binutils-versions.patch b/board/freescale/common/patches/arm-trusted-firmware/0001-feat-build-add-support-for-new-binutils-versions.patch new file mode 100644 index 0000000000..335c18553a --- /dev/null +++ b/board/freescale/common/patches/arm-trusted-firmware/0001-feat-build-add-support-for-new-binutils-versions.patch @@ -0,0 +1,61 @@ +From 0f75b03c008eacb9818af3a56dc088e72a623d17 Mon Sep 17 00:00:00 2001 +From: Marco Felsch +Date: Wed, 9 Nov 2022 12:59:09 +0100 +Subject: [PATCH] feat(build): add support for new binutils versions + +Users of GNU ld (BPF) from binutils 2.39+ will observe multiple instaces +of a new warning when linking the bl*.elf in the form: + + ld.bfd: warning: stm32mp1_helper.o: missing .note.GNU-stack section implies executable stack + ld.bfd: NOTE: This behaviour is deprecated and will be removed in a future version of the linker + ld.bfd: warning: bl2.elf has a LOAD segment with RWX permissions + ld.bfd: warning: bl32.elf has a LOAD segment with RWX permissions + +These new warnings are enbaled by default to secure elf binaries: + - https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ba951afb99912da01a6e8434126b8fac7aa75107 + - https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=0d38576a34ec64a1b4500c9277a8e9d0f07e6774 + +Fix it in a similar way to what the Linux kernel does, see: +https://lore.kernel.org/all/20220810222442.2296651-1-ndesaulniers@google.com/ + +Following the reasoning there, we set "-z noexecstack" for all linkers +(although LLVM's LLD defaults to it) and optional add +--no-warn-rwx-segments since this a ld.bfd related. + +Signed-off-by: Marco Felsch +Signed-off-by: Robert Schwebel +Change-Id: I9430f5fa5036ca88da46cd3b945754d62616b617 +Signed-off-by: Heiko Thiery +Upstream: https://github.com/ARM-software/arm-trusted-firmware/commit/1f49db5f25cdd4e43825c9bcc0575070b80f628c +--- + Makefile | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/Makefile b/Makefile +index 1ddb7b844..470956b19 100644 +--- a/Makefile ++++ b/Makefile +@@ -416,6 +416,8 @@ endif + + GCC_V_OUTPUT := $(shell $(CC) -v 2>&1) + ++TF_LDFLAGS += -z noexecstack ++ + # LD = armlink + ifneq ($(findstring armlink,$(notdir $(LD))),) + TF_LDFLAGS += --diag_error=warning --lto_level=O1 +@@ -442,7 +444,10 @@ TF_LDFLAGS += $(subst --,-Xlinker --,$(TF_LDFLAGS_$(ARCH))) + + # LD = gcc-ld (ld) or llvm-ld (ld.lld) or other + else +-TF_LDFLAGS += --fatal-warnings -O1 ++# With ld.bfd version 2.39 and newer new warnings are added. Skip those since we ++# are not loaded by a elf loader. ++TF_LDFLAGS += $(call ld_option, --no-warn-rwx-segments) ++TF_LDFLAGS += -O1 + TF_LDFLAGS += --gc-sections + # ld.lld doesn't recognize the errata flags, + # therefore don't add those in that case +-- +2.30.2 + diff --git a/configs/freescale_imx8mmevk_defconfig b/configs/freescale_imx8mmevk_defconfig index dcb4b42540..ca5c308da6 100644 --- a/configs/freescale_imx8mmevk_defconfig +++ b/configs/freescale_imx8mmevk_defconfig @@ -1,6 +1,7 @@ BR2_aarch64=y BR2_ARM_FPU_VFPV3=y BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_10=y +BR2_GLOBAL_PATCH_DIR="board/freescale/common/patches" BR2_TARGET_GENERIC_GETTY_PORT="ttymxc1" BR2_ROOTFS_POST_IMAGE_SCRIPT="board/freescale/common/imx/imx8-bootloader-prepare.sh board/freescale/common/imx/post-image.sh" BR2_ROOTFS_POST_SCRIPT_ARGS="${UBOOT_DIR}/arch/arm/dts/imx8mm-evk.dtb" diff --git a/configs/freescale_imx8mnevk_defconfig b/configs/freescale_imx8mnevk_defconfig index 0653978d91..ac73bea769 100644 --- a/configs/freescale_imx8mnevk_defconfig +++ b/configs/freescale_imx8mnevk_defconfig @@ -1,6 +1,7 @@ BR2_aarch64=y BR2_ARM_FPU_VFPV3=y BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_10=y +BR2_GLOBAL_PATCH_DIR="board/freescale/common/patches" BR2_TARGET_GENERIC_GETTY_PORT="ttymxc1" BR2_ROOTFS_POST_IMAGE_SCRIPT="board/freescale/common/imx/imx8-bootloader-prepare.sh board/freescale/common/imx/post-image.sh" BR2_ROOTFS_POST_SCRIPT_ARGS="${UBOOT_DIR}/arch/arm/dts/imx8mn-ddr4-evk.dtb" diff --git a/configs/freescale_imx8mpevk_defconfig b/configs/freescale_imx8mpevk_defconfig index 5a72406b67..913c190d87 100644 --- a/configs/freescale_imx8mpevk_defconfig +++ b/configs/freescale_imx8mpevk_defconfig @@ -1,6 +1,7 @@ BR2_aarch64=y BR2_ARM_FPU_VFPV3=y BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_10=y +BR2_GLOBAL_PATCH_DIR="board/freescale/common/patches" BR2_TARGET_GENERIC_GETTY_PORT="ttymxc1" BR2_ROOTFS_POST_IMAGE_SCRIPT="board/freescale/common/imx/imx8-bootloader-prepare.sh board/freescale/common/imx/post-image.sh" BR2_ROOTFS_POST_SCRIPT_ARGS="${UBOOT_DIR}/arch/arm/dts/imx8mp-evk.dtb" diff --git a/configs/freescale_imx8mqevk_defconfig b/configs/freescale_imx8mqevk_defconfig index e3f88dc44c..79375d7f88 100644 --- a/configs/freescale_imx8mqevk_defconfig +++ b/configs/freescale_imx8mqevk_defconfig @@ -1,6 +1,7 @@ BR2_aarch64=y BR2_ARM_FPU_VFPV3=y BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_10=y +BR2_GLOBAL_PATCH_DIR="board/freescale/common/patches" BR2_TARGET_GENERIC_GETTY_PORT="ttymxc0" BR2_ROOTFS_POST_IMAGE_SCRIPT="board/freescale/common/imx/imx8-bootloader-prepare.sh board/freescale/common/imx/post-image.sh" BR2_ROOTFS_POST_SCRIPT_ARGS="${UBOOT_DIR}/arch/arm/dts/imx8mq-evk.dtb" diff --git a/configs/freescale_imx8qmmek_defconfig b/configs/freescale_imx8qmmek_defconfig index 75777646df..0fc3fe7b07 100644 --- a/configs/freescale_imx8qmmek_defconfig +++ b/configs/freescale_imx8qmmek_defconfig @@ -1,6 +1,7 @@ BR2_aarch64=y BR2_ARM_FPU_VFPV4=y BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_10=y +BR2_GLOBAL_PATCH_DIR="board/freescale/common/patches" BR2_ROOTFS_POST_IMAGE_SCRIPT="board/freescale/common/imx/imx8-bootloader-prepare.sh board/freescale/common/imx/post-image.sh" BR2_ROOTFS_POST_SCRIPT_ARGS="${UBOOT_DIR}/arch/arm/dts/fsl-imx8qm-mek.dtb" BR2_LINUX_KERNEL=y diff --git a/configs/freescale_imx8qxpmek_defconfig b/configs/freescale_imx8qxpmek_defconfig index ce8f6b7c84..47a2104d5b 100644 --- a/configs/freescale_imx8qxpmek_defconfig +++ b/configs/freescale_imx8qxpmek_defconfig @@ -2,6 +2,7 @@ BR2_aarch64=y BR2_cortex_a35=y BR2_ARM_FPU_VFPV3=y BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_10=y +BR2_GLOBAL_PATCH_DIR="board/freescale/common/patches" BR2_TARGET_GENERIC_GETTY_PORT="ttyLP0" BR2_ROOTFS_POST_IMAGE_SCRIPT="board/freescale/common/imx/imx8-bootloader-prepare.sh board/freescale/common/imx/post-image.sh" BR2_ROOTFS_POST_SCRIPT_ARGS="${UBOOT_DIR}/arch/arm/dts/fsl-imx8qxp-mek.dtb" diff --git a/configs/ls1028ardb_defconfig b/configs/ls1028ardb_defconfig index a46b94511a..d92c543b44 100644 --- a/configs/ls1028ardb_defconfig +++ b/configs/ls1028ardb_defconfig @@ -2,6 +2,9 @@ BR2_aarch64=y BR2_cortex_a72=y +# patches +BR2_GLOBAL_PATCH_DIR="board/freescale/common/patches" + # Toolchain # Linux headers same as kernel, a 5.10 series BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_10=y