Re: [Buildroot] [PATCH 1/1] boot/arm-trusted-firmware: add -no-pie to LDFLAGS

["Yann E. MORIN" <yann.morin.1998@free.fr>]

Julien, All,

On 2024-09-03 20:05 +0200, Julien Olivain spake thusly:
> Arm Trusted Firmware (TF-A) v2.11 fails to build in some situations
> with the error message:
> 
>     ld: build/qemu/release/bl1/bl1.elf: error: PHDR segment not covered by LOAD segment
> 
> This error can be reproduced with the commands:
> 
>     make qemu_aarch64_ebbr_defconfig
>     utils/config --set-str BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION_VALUE v2.11
>     make olddefconfig
>     make
> 
> This issue was reported in [1].
> 
> This error is coming from a check that was made more strict since
> binutils ld 2.34. This error message is normally related to dynamic
> linker, so it should normally not apply to a package like TF-A.
> 
> When BR2_SHARED_LIBS=y (shared libraries only) and BR2_PIC_PIE=y
> (Build code with PIC/PIE), the Buildroot toolchain-wrapper will try
> to enable position-independent code/executables. See [2]. This
> configuration is a common default.
> 
> Arm Trusted Firmware (TF-A) build system, on its side, tries to detect
> if the toolchain enables PIE automatically. It does so by checking if
> --enable-default-pie is in the output of "$(CC) -v". If found, the TF-A
> build system tries to disable PIE globally (it can be explicitly
> enabled again with the ENABLE_PIE=1 build variable, in some specific
> configurations). This detection mechanism is not working with the
> Buildroot toolchain wrapper which is enabling PIE silently. See [3].
> 
> Commit 1061ed6c "boot/arm-trusted-firmware: add -fno-PIE to CFLAGS"
> added the option -fno-PIE in CFLAGS for that reason. See [4].
> TF-A >= v2.11 now needs the same treatment for LDFLAGS. This is
> because TF-A switched the default linker from "ld" to "gcc", in
> upstream commit [5]. This change makes the Buildroot toolchain wrapper
> to enable PIE at link, without passing the "--no-dynamic-linker" option
> that would normally avoids this ld error.
> 
> Also, even if there is no defconfigs using the
> BR2_TARGET_ARM_TRUSTED_FIRMWARE_LATEST_VERSION config directive, it is
> worth mentioning that the Buildroot TF-A "latest version" was updated
> to v2.11 in commit 9c50759cd "boot/arm-trusted-firmware: bump to
> v2.11". See [6]. This latest version is the default choice. So
> Buildroot is subject to generate this build failure. This can be
> reproduced with the commands:
> 
>     cat <<EOF >.config
>     BR2_aarch64=y
>     BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
>     BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="qemu"
>     BR2_TOOLCHAIN_EXTERNAL=y
>     EOF
>     make olddefconfig
>     make arm-trusted-firmware
> 
> This commit fixes the issue by adding the option "-no-pie" in LDFLAGS.
> This will prevent the Buildroot toolchain wrapper to enable PIE, for
> versions using "gcc" as a linker. This change should also remain
> compatible with older TF-A < 2.11 using "ld" as a linker, since
> "-no-pie" is also a valid ld option.
> 
> Fixes:
> 
>     ld: build/qemu/release/bl1/bl1.elf: error: PHDR segment not covered by LOAD segment
> 
> [1] https://github.com/TrustedFirmware-A/trusted-firmware-a/issues/26
> [2] https://gitlab.com/buildroot.org/buildroot/-/blob/2024.08-rc3/toolchain/toolchain-wrapper.c?ref_type=tags#L403
> [3] https://git.trustedfirmware.org/plugins/gitiles/TF-A/trusted-firmware-a.git/+/refs/tags/v2.11.0/Makefile#711
> [4] https://gitlab.com/buildroot.org/buildroot/-/commit/1061ed6c6273e90618b05ddc0cb66be17364da33
> [5] https://git.trustedfirmware.org/plugins/gitiles/TF-A/trusted-firmware-a.git/+/2f1c5e7eb1775b252fa4998e10093b8ac34ca699%5E%21/
> [6] https://gitlab.com/buildroot.org/buildroot/-/commit/9c50759cd1677e1739078239a1e86fb1d62e33e8
> 
> Reported-by: Vincent Stehlé <vincent.stehle@arm.com>
> Tested-by: Vincent Stehlé <vincent.stehle@arm.com>
> Signed-off-by: Julien Olivain <ju.o@free.fr>

Thanks a lot for this extended information! 👍

Applied to master, thanks.

Regards,
Yann E. MORIN.

> ---
> Buildroot defconfigs (as of commit e40c6f2) are ranging from TF-A
> version v2.0 (for orangepi_lite2 and orangepi_one_plus) to v2.10. I
> checked this patch is not introducing new build failures in all
> defconfigs enabling arm-trusted-firmware.
> 
> See the defconfigs with the commands:
> 
>     git grep -l '^BR2_TARGET_ARM_TRUSTED_FIRMWARE=y' configs/
> 
> Out of the 61 defconfigs, 6 are failing in arm-trusted-firmware for
> reasons unrelated to this patch.
> 
> imx8mqevk_defconfig, see:
> https://gitlab.com/buildroot.org/buildroot/-/jobs/7691701411
> Fix proposed in:
> https://patchwork.ozlabs.org/project/buildroot/patch/20240901194422.383895-1-ju.o@free.fr/
> 
> kontron_pitx_imx8m_defconfig, see:
> https://gitlab.com/buildroot.org/buildroot/-/jobs/7691701416
> 
> octavo_osd32mp1_brk_defconfig, see:
> https://gitlab.com/buildroot.org/buildroot/-/jobs/7691701458
> 
> octavo_osd32mp1_red_defconfig, see:
> https://gitlab.com/buildroot.org/buildroot/-/jobs/7691701459
> 
> orangepi_lite2_defconfig, see:
> https://gitlab.com/buildroot.org/buildroot/-/jobs/7691701483
> 
> orangepi_one_plus_defconfig, see:
> https://gitlab.com/buildroot.org/buildroot/-/jobs/7691701487
> 
> This patch has also been successfully tested with the commands
> described in the commit log.
> 
> I also runtime tested qemu_aarch64_ebbr_defconfig with both TF-A
> at v2.10 and v2.11.
> ---
>  boot/arm-trusted-firmware/arm-trusted-firmware.mk | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/boot/arm-trusted-firmware/arm-trusted-firmware.mk b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
> index a3a44feea9..172a930b5c 100644
> --- a/boot/arm-trusted-firmware/arm-trusted-firmware.mk
> +++ b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
> @@ -77,11 +77,13 @@ endif
>  
>  ifeq ($(BR2_PIC_PIE),y)
>  ARM_TRUSTED_FIRMWARE_CFLAGS += -fno-PIE
> +ARM_TRUSTED_FIRMWARE_LDFLAGS += -no-pie
>  endif
>  
>  ARM_TRUSTED_FIRMWARE_MAKE_ENV += \
>  	$(TARGET_MAKE_ENV) \
> -	CFLAGS="$(ARM_TRUSTED_FIRMWARE_CFLAGS)"
> +	CFLAGS="$(ARM_TRUSTED_FIRMWARE_CFLAGS)" \
> +	LDFLAGS="$(ARM_TRUSTED_FIRMWARE_LDFLAGS)"
>  
>  ifeq ($(BR2_ARM_CPU_ARMV7A),y)
>  ARM_TRUSTED_FIRMWARE_MAKE_OPTS += ARM_ARCH_MAJOR=7
> -- 
> 2.46.0
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 561 099 427 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot