Re: [OE-core] systemd build failure with gcc 15 / tpm2 / aarch64: gcs required

[Mikko Rapeli <mikko.rapeli@linaro.org>]

Hi,

On Tue, May 06, 2025 at 06:32:02AM -0700, Khem Raj via lists.openembedded.org wrote:
> On Tue, May 6, 2025 at 6:28 AM Sathishkumar Duraisamy <
> sathishkumar.d.cbe@gmail.com> wrote:
> 
> > Hi
> >
> > On Tue, May 6, 2025 at 6:43 PM Khem Raj <raj.khem@gmail.com> wrote:
> >
> >> On Tue, May 6, 2025 at 4:38 AM Sathishkumar D via
> >> lists.openembedded.org
> >> <sathishkumar.d.cbe=gmail.com@lists.openembedded.org> wrote:
> >> >
> >> > Hi all,
> >> >
> >> > I am also facing the same build issue. I tried to understand the issue.
> >> From build system for both openssl and systemd,
> >> -mbranch-protection=standard   enabled. In fact the support this flag added
> >> long back,
> >> https://github.com/openembedded/openembedded-core/commit/8905639d1cdc5ce809cc5ecd9672f5e86bf8a579
> >> and tpm2 introduces additional dependencies for systemd as in commit
> >> https://git.yoctoproject.org/meta-security/commit/meta-tpm/recipes-core/systemd/systemd_%25.bbappend?id=6eb3098e57881895e62fc811f714c2aa4ecfcf8f
> >> .
> >> >
> >>
> >> is this flag passed to linker as well ?
> >>
> >> Openssl:
> > =======
> >
> > export CC="aarch64-tdx-linux-gcc  -march=armv8-a+crypto
> > -mbranch-protection=standard -fstack-protector-strong  -O2
> > -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security
> > --sysroot=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/openssl/3.5.0/recipe-sysroot"
> >
> > export CFLAGS=" -O2 -g
> >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/openssl/3.5.0/openssl-3.5.0=/usr/src/debug/openssl/3.5.0
> >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/openssl/3.5.0/build=/usr/src/debug/openssl/3.5.0
> >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/openssl/3.5.0/recipe-sysroot=
> >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/openssl/3.5.0/recipe-sysroot-native=
> >  -pipe -Wl,-z,gcs-compliant=all "
> >
> > export LDFLAGS="-Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed
> >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/openssl/3.5.0/openssl-3.5.0=/usr/src/debug/openssl/3.5.0
> >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/openssl/3.5.0/build=/usr/src/debug/openssl/3.5.0
> >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/openssl/3.5.0/recipe-sysroot=
> >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/openssl/3.5.0/recipe-sysroot-native=
> >  -Wl,-z,relro,-z,now"
> >
> > systemd
> > ======
> >
> > export CC="aarch64-tdx-linux-gcc  -march=armv8-a+crypto
> > -mbranch-protection=standard -fstack-protector-strong  -O2
> > -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security
> > --sysroot=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/recipe-sysroot"
> >
> > export CFLAGS=" -O2 -g
> >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/git=/usr/src/debug/systemd/257.5
> >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/build=/usr/src/debug/systemd/257.5
> >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/recipe-sysroot=
> >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/recipe-sysroot-native=
> >  -pipe
> > --sysroot=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/recipe-sysroot"
> >
> > export LDFLAGS="-Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed
> >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/git=/usr/src/debug/systemd/257.5
> >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/build=/usr/src/debug/systemd/257.5
> >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/recipe-sysroot=
> >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/recipe-sysroot-native=
> >  -Wl,-z,relro,-z,now"
> >
> 
> Please post exact linker command line to build libcrypto.so as well

FWIW, this reproduces on genericarm64 machine, poky-altcfg distro, tpm2 added to
MACHINE_FEATURES and meta-security/meta-tpm layer added to build. It is triggered by
"openssl" in systemd PACKAGECONFIG.

Cheers,

-Mikko