[PATCH master v2] Kbuild: disable ARM64 pointer authentication

[PATCH master v2] Kbuild: disable ARM64 pointer authentication

[Ahmad Fatoum]

The aarch64 cross-compiler built with Yocto's kirkstone release
configures -mbranch-protection=standard as default.

The resulting PACIASP/AUTIASP instructions are interpreted as NOPs by
existing CPUs, but they increase image size and misalign the barebox
header in ENTRY_FUNCTION(). Also on ARMv8.3+, where they serve a
purpose, we wouldn't benefit from them as we don't setup any pointer
authentication keys. Thus disable it.

The misaligned barebox header caused is_barebox_arm_head to fail,
breaking all code that verified barebox' header, like i.MX8MM
imx-usb-loader barebox-side support and barebox_update for
some ARM64 SoCs without a SoC-specific header.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
This is a workaround. ENTRY_FUNCTION() should be rewritten for ARM64,
so we don't expect function prologue to be exactly two bytes long.
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>

v1 -> v2:
  - revised commit message after understanding ramification better.
---
 Makefile | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/Makefile b/Makefile
index 98da09f18523..3737265316e9 100644
--- a/Makefile
+++ b/Makefile
@@ -659,6 +659,11 @@ KBUILD_CFLAGS  += $(call cc-option,-fno-stack-check)
 # Platforms that have their setjmp appropriately implemented may override this
 KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none)
 
+# We don't have the necessary infrastructure to benefit from ARMv8.3+ pointer
+# authentication. On older CPUs, they are interpreted as NOPs and blot the
+# code and break less portable code that expects a very specific code layout
+KBUILD_CFLAGS += $(call cc-option,-mbranch-protection=none)
+
 KBUILD_CFLAGS   += $(call cc-disable-warning, address-of-packed-member)
 
 # Align the bit size of userspace programs with the kernel
-- 
2.30.2

Re: [PATCH master v2] Kbuild: disable ARM64 pointer authentication

[Sascha Hauer]

On Wed, Oct 19, 2022 at 03:53:22PM +0200, Ahmad Fatoum wrote:
> The aarch64 cross-compiler built with Yocto's kirkstone release
> configures -mbranch-protection=standard as default.
> 
> The resulting PACIASP/AUTIASP instructions are interpreted as NOPs by
> existing CPUs, but they increase image size and misalign the barebox
> header in ENTRY_FUNCTION(). Also on ARMv8.3+, where they serve a
> purpose, we wouldn't benefit from them as we don't setup any pointer
> authentication keys. Thus disable it.
> 
> The misaligned barebox header caused is_barebox_arm_head to fail,
> breaking all code that verified barebox' header, like i.MX8MM
> imx-usb-loader barebox-side support and barebox_update for
> some ARM64 SoCs without a SoC-specific header.
> 
> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> ---
> This is a workaround. ENTRY_FUNCTION() should be rewritten for ARM64,
> so we don't expect function prologue to be exactly two bytes long.
> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> 
> v1 -> v2:
>   - revised commit message after understanding ramification better.
> ---
>  Makefile | 5 +++++
>  1 file changed, 5 insertions(+)

Applied, thanks

Sascha

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |