[Buildroot] [PATCH 1/1] boot/arm-trusted-firmware: add -no-pie to LDFLAGS

* [Buildroot] [PATCH 1/1] boot/arm-trusted-firmware: add -no-pie to LDFLAGS
@ 2024-09-03 18:05 Julien Olivain
  2024-09-03 21:59 ` Yann E. MORIN
  0 siblings, 1 reply; 2+ messages in thread
From: Julien Olivain @ 2024-09-03 18:05 UTC (permalink / raw)
  To: buildroot; +Cc: Julien Olivain, Vincent Stehlé, Sergey Matyukevich

Arm Trusted Firmware (TF-A) v2.11 fails to build in some situations
with the error message:

    ld: build/qemu/release/bl1/bl1.elf: error: PHDR segment not covered by LOAD segment

This error can be reproduced with the commands:

    make qemu_aarch64_ebbr_defconfig
    utils/config --set-str BR2_TARGET_ARM_TRUSTED_FIRMWARE_CUSTOM_VERSION_VALUE v2.11
    make olddefconfig
    make

This issue was reported in [1].

This error is coming from a check that was made more strict since
binutils ld 2.34. This error message is normally related to dynamic
linker, so it should normally not apply to a package like TF-A.

When BR2_SHARED_LIBS=y (shared libraries only) and BR2_PIC_PIE=y
(Build code with PIC/PIE), the Buildroot toolchain-wrapper will try
to enable position-independent code/executables. See [2]. This
configuration is a common default.

Arm Trusted Firmware (TF-A) build system, on its side, tries to detect
if the toolchain enables PIE automatically. It does so by checking if
--enable-default-pie is in the output of "$(CC) -v". If found, the TF-A
build system tries to disable PIE globally (it can be explicitly
enabled again with the ENABLE_PIE=1 build variable, in some specific
configurations). This detection mechanism is not working with the
Buildroot toolchain wrapper which is enabling PIE silently. See [3].

Commit 1061ed6c "boot/arm-trusted-firmware: add -fno-PIE to CFLAGS"
added the option -fno-PIE in CFLAGS for that reason. See [4].
TF-A >= v2.11 now needs the same treatment for LDFLAGS. This is
because TF-A switched the default linker from "ld" to "gcc", in
upstream commit [5]. This change makes the Buildroot toolchain wrapper
to enable PIE at link, without passing the "--no-dynamic-linker" option
that would normally avoids this ld error.

Also, even if there is no defconfigs using the
BR2_TARGET_ARM_TRUSTED_FIRMWARE_LATEST_VERSION config directive, it is
worth mentioning that the Buildroot TF-A "latest version" was updated
to v2.11 in commit 9c50759cd "boot/arm-trusted-firmware: bump to
v2.11". See [6]. This latest version is the default choice. So
Buildroot is subject to generate this build failure. This can be
reproduced with the commands:

    cat <<EOF >.config
    BR2_aarch64=y
    BR2_TARGET_ARM_TRUSTED_FIRMWARE=y
    BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM="qemu"
    BR2_TOOLCHAIN_EXTERNAL=y
    EOF
    make olddefconfig
    make arm-trusted-firmware

This commit fixes the issue by adding the option "-no-pie" in LDFLAGS.
This will prevent the Buildroot toolchain wrapper to enable PIE, for
versions using "gcc" as a linker. This change should also remain
compatible with older TF-A < 2.11 using "ld" as a linker, since
"-no-pie" is also a valid ld option.

Fixes:

    ld: build/qemu/release/bl1/bl1.elf: error: PHDR segment not covered by LOAD segment

[1] https://github.com/TrustedFirmware-A/trusted-firmware-a/issues/26
[2] https://gitlab.com/buildroot.org/buildroot/-/blob/2024.08-rc3/toolchain/toolchain-wrapper.c?ref_type=tags#L403
[3] https://git.trustedfirmware.org/plugins/gitiles/TF-A/trusted-firmware-a.git/+/refs/tags/v2.11.0/Makefile#711
[4] https://gitlab.com/buildroot.org/buildroot/-/commit/1061ed6c6273e90618b05ddc0cb66be17364da33
[5] https://git.trustedfirmware.org/plugins/gitiles/TF-A/trusted-firmware-a.git/+/2f1c5e7eb1775b252fa4998e10093b8ac34ca699%5E%21/
[6] https://gitlab.com/buildroot.org/buildroot/-/commit/9c50759cd1677e1739078239a1e86fb1d62e33e8

Reported-by: Vincent Stehlé <vincent.stehle@arm.com>
Tested-by: Vincent Stehlé <vincent.stehle@arm.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
---
Buildroot defconfigs (as of commit e40c6f2) are ranging from TF-A
version v2.0 (for orangepi_lite2 and orangepi_one_plus) to v2.10. I
checked this patch is not introducing new build failures in all
defconfigs enabling arm-trusted-firmware.

See the defconfigs with the commands:

    git grep -l '^BR2_TARGET_ARM_TRUSTED_FIRMWARE=y' configs/

Out of the 61 defconfigs, 6 are failing in arm-trusted-firmware for
reasons unrelated to this patch.

imx8mqevk_defconfig, see:
https://gitlab.com/buildroot.org/buildroot/-/jobs/7691701411
Fix proposed in:
https://patchwork.ozlabs.org/project/buildroot/patch/20240901194422.383895-1-ju.o@free.fr/

kontron_pitx_imx8m_defconfig, see:
https://gitlab.com/buildroot.org/buildroot/-/jobs/7691701416

octavo_osd32mp1_brk_defconfig, see:
https://gitlab.com/buildroot.org/buildroot/-/jobs/7691701458

octavo_osd32mp1_red_defconfig, see:
https://gitlab.com/buildroot.org/buildroot/-/jobs/7691701459

orangepi_lite2_defconfig, see:
https://gitlab.com/buildroot.org/buildroot/-/jobs/7691701483

orangepi_one_plus_defconfig, see:
https://gitlab.com/buildroot.org/buildroot/-/jobs/7691701487

This patch has also been successfully tested with the commands
described in the commit log.

I also runtime tested qemu_aarch64_ebbr_defconfig with both TF-A
at v2.10 and v2.11.
---
 boot/arm-trusted-firmware/arm-trusted-firmware.mk | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/boot/arm-trusted-firmware/arm-trusted-firmware.mk b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
index a3a44feea9..172a930b5c 100644
--- a/boot/arm-trusted-firmware/arm-trusted-firmware.mk
+++ b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
@@ -77,11 +77,13 @@ endif
 
 ifeq ($(BR2_PIC_PIE),y)
 ARM_TRUSTED_FIRMWARE_CFLAGS += -fno-PIE
+ARM_TRUSTED_FIRMWARE_LDFLAGS += -no-pie
 endif
 
 ARM_TRUSTED_FIRMWARE_MAKE_ENV += \
 	$(TARGET_MAKE_ENV) \
-	CFLAGS="$(ARM_TRUSTED_FIRMWARE_CFLAGS)"
+	CFLAGS="$(ARM_TRUSTED_FIRMWARE_CFLAGS)" \
+	LDFLAGS="$(ARM_TRUSTED_FIRMWARE_LDFLAGS)"
 
 ifeq ($(BR2_ARM_CPU_ARMV7A),y)
 ARM_TRUSTED_FIRMWARE_MAKE_OPTS += ARM_ARCH_MAJOR=7
-- 
2.46.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

^ permalink raw reply related	[flat|nested] 2+ messages in thread