Re: [OE-core] systemd build failure with gcc 15 / tpm2 / aarch64: gcs required

[Max Krummenacher <max.oss.09@gmail.com>]

On Tue, May 06, 2025 at 04:45:46PM +0300, Mikko Rapeli wrote:
> Hi,
> 
> On Tue, May 06, 2025 at 06:32:02AM -0700, Khem Raj via lists.openembedded.org wrote:
> > On Tue, May 6, 2025 at 6:28 AM Sathishkumar Duraisamy <
> > sathishkumar.d.cbe@gmail.com> wrote:
> > 
> > > Hi
> > >
> > > On Tue, May 6, 2025 at 6:43 PM Khem Raj <raj.khem@gmail.com> wrote:
> > >
> > >> On Tue, May 6, 2025 at 4:38 AM Sathishkumar D via
> > >> lists.openembedded.org
> > >> <sathishkumar.d.cbe=gmail.com@lists.openembedded.org> wrote:
> > >> >
> > >> > Hi all,
> > >> >
> > >> > I am also facing the same build issue. I tried to understand the issue.
> > >> From build system for both openssl and systemd,
> > >> -mbranch-protection=standard   enabled. In fact the support this flag added
> > >> long back,
> > >> https://github.com/openembedded/openembedded-core/commit/8905639d1cdc5ce809cc5ecd9672f5e86bf8a579
> > >> and tpm2 introduces additional dependencies for systemd as in commit
> > >> https://git.yoctoproject.org/meta-security/commit/meta-tpm/recipes-core/systemd/systemd_%25.bbappend?id=6eb3098e57881895e62fc811f714c2aa4ecfcf8f
> > >> .
> > >> >
> > >>
> > >> is this flag passed to linker as well ?
> > >>
> > >> Openssl:
> > > =======
> > >
> > > export CC="aarch64-tdx-linux-gcc  -march=armv8-a+crypto
> > > -mbranch-protection=standard -fstack-protector-strong  -O2
> > > -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security
> > > --sysroot=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/openssl/3.5.0/recipe-sysroot"
> > >
> > > export CFLAGS=" -O2 -g
> > >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/openssl/3.5.0/openssl-3.5.0=/usr/src/debug/openssl/3.5.0
> > >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/openssl/3.5.0/build=/usr/src/debug/openssl/3.5.0
> > >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/openssl/3.5.0/recipe-sysroot=
> > >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/openssl/3.5.0/recipe-sysroot-native=
> > >  -pipe -Wl,-z,gcs-compliant=all "
> > >
> > > export LDFLAGS="-Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed
> > >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/openssl/3.5.0/openssl-3.5.0=/usr/src/debug/openssl/3.5.0
> > >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/openssl/3.5.0/build=/usr/src/debug/openssl/3.5.0
> > >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/openssl/3.5.0/recipe-sysroot=
> > >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/openssl/3.5.0/recipe-sysroot-native=
> > >  -Wl,-z,relro,-z,now"
> > >
> > > systemd
> > > ======
> > >
> > > export CC="aarch64-tdx-linux-gcc  -march=armv8-a+crypto
> > > -mbranch-protection=standard -fstack-protector-strong  -O2
> > > -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security
> > > --sysroot=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/recipe-sysroot"
> > >
> > > export CFLAGS=" -O2 -g
> > >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/git=/usr/src/debug/systemd/257.5
> > >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/build=/usr/src/debug/systemd/257.5
> > >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/recipe-sysroot=
> > >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/recipe-sysroot-native=
> > >  -pipe
> > > --sysroot=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/recipe-sysroot"
> > >
> > > export LDFLAGS="-Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed
> > >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/git=/usr/src/debug/systemd/257.5
> > >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/build=/usr/src/debug/systemd/257.5
> > >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/recipe-sysroot=
> > >  -ffile-prefix-map=/home/sathishkumar/yoctospace/verdin-next/build/tmp/work/armv8a-tdx-linux/systemd/257.5/recipe-sysroot-native=
> > >  -Wl,-z,relro,-z,now"
> > >
> > 
> > Please post exact linker command line to build libcrypto.so as well

I checked all the object files (*.o) built.
About 40 have the GCS flag not set. All of which are produced from assembler
sources using 'gcc' as the 'as' frontend with all the same flags as used for
C source files. Changing marm from 'cortex-a57+crc' to 'cortex-a57+crc+gcs'
doesn't change that.

Configuring openssl with no-arm no longer uses the optimized assembler code
and thus the resulting .so is marked with the GCS feature.

I sent a patch to the ML.
https://lore.kernel.org/all/20250506141013.2600055-1-max.oss.09@gmail.com/

Thanks Khem for the valuable feedback.

Regards
Max

> 
> FWIW, this reproduces on genericarm64 machine, poky-altcfg distro, tpm2 added to
> MACHINE_FEATURES and meta-security/meta-tpm layer added to build. It is triggered by
> "openssl" in systemd PACKAGECONFIG.
> 
> Cheers,
> 
> -Mikko
>