[PATCH 0/3] fix uclibc build with security_flags.inc

[PATCH 0/3] fix uclibc build with security_flags.inc

[Andre McCurdy]

Andre McCurdy (3):
  uclibc.inc: remove unused UCLIBC_EXTRA_LDFLAGS
  security_flags.inc: clear SECURITY_CFLAGS for uclibc
  uclibc.inc: avoid immediate expansion for UCLIBC_EXTRA_CFLAGS

 meta/conf/distro/include/security_flags.inc | 2 ++
 meta/recipes-core/uclibc/uclibc.inc         | 5 ++---
 2 files changed, 4 insertions(+), 3 deletions(-)

-- 
1.9.1

[PATCH 1/3] uclibc.inc: remove unused UCLIBC_EXTRA_LDFLAGS

[Andre McCurdy]

Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
---
 meta/recipes-core/uclibc/uclibc.inc | 1 -
 1 file changed, 1 deletion(-)

diff --git a/meta/recipes-core/uclibc/uclibc.inc b/meta/recipes-core/uclibc/uclibc.inc
index 08465c4..c483228 100644
--- a/meta/recipes-core/uclibc/uclibc.inc
+++ b/meta/recipes-core/uclibc/uclibc.inc
@@ -59,7 +59,6 @@ export V="2"
 #
 CFLAGS_arm := "${@oe_filter_out('-fno-omit-frame-pointer', '${CFLAGS}', d)}"
 UCLIBC_EXTRA_CFLAGS  := "${@oe_filter_out('(-I\S+|-i\S+)', '${CFLAGS}', d)}"
-UCLIBC_EXTRA_LDFLAGS := "${@oe_filter_out('(-L\S+|-l\S+)', '${LDFLAGS}', d)}"
 
 do_compile_prepend () {
   unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS
-- 
1.9.1

[PATCH 2/3] security_flags.inc: clear SECURITY_CFLAGS for uclibc

[Andre McCurdy]

uclibc fails to build when security_flags.inc is used.

 | i686-rdk-linux-uclibc-gcc  -m32 -march=core2 -mtune=core2 -msse3 -mfpmath=sse --sysroot=/build-vbox32/tmp/sysroots/vbox32-tcbootstrap  -Wl,-EL -Wl,--sort-common -Wl,--sort-section=alignment -m32 -shared -Wl,--warn-common -Wl,--warn-once -Wl,-z,combreloc -Wl,-z,relro -Wl,-z,now -Wl,--hash-style=gnu -Wl,-z,defs   -Wl,-init,__uClibc_init  -Wl,-soname=libc.so.0 -nostdlib -o lib/libuClibc-0.9.34-git.so  -Wl,--whole-archive libc/libc_so.a -Wl,--no-whole-archive ./lib/interp.os ./lib/ld-uClibc.so.0 ./lib/uclibc_nonshared.a /build-vbox32/tmp/sysroots/vbox32-tcbootstrap/usr/lib/i686-rdk-linux-uclibc/4.9.3/libgcc.a
 | libc/libc_so.a(sigaction.os): In function `__libc_sigaction':
 | /build-vbox32/tmp/work/core2-32-rdk-linux-uclibc/uclibc/0.9.33+gitAUTOINC+48a0006012-r9/git/libc/sysdeps/linux/i386/sigaction.c:37: undefined reference to `__stack_chk_guard'
 | /build-vbox32/tmp/work/core2-32-rdk-linux-uclibc/uclibc/0.9.33+gitAUTOINC+48a0006012-r9/git/libc/sysdeps/linux/i386/sigaction.c:49: undefined reference to `__stack_chk_fail_local'
 | collect2: error: ld returned 1 exit status
 | make: *** [lib/libc.so] Error 1

Clearing SECURITY_CFLAGS completely may not be the best approach, but
it's the approach taken for glibc, so try it for uclibc too.

Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
---
 meta/conf/distro/include/security_flags.inc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/conf/distro/include/security_flags.inc b/meta/conf/distro/include/security_flags.inc
index 3724972..a107657 100644
--- a/meta/conf/distro/include/security_flags.inc
+++ b/meta/conf/distro/include/security_flags.inc
@@ -84,6 +84,8 @@ SECURITY_CFLAGS_pn-python-smartpm = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-python-numpy = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-tcl = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-tiff = "${SECURITY_NO_PIE_CFLAGS}"
+SECURITY_CFLAGS_pn-uclibc = ""
+SECURITY_CFLAGS_pn-uclibc-initial = ""
 SECURITY_CFLAGS_pn-valgrind = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-webkit-gtk = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-zlib = "${SECURITY_NO_PIE_CFLAGS}"
-- 
1.9.1

Re: [PATCH 2/3] security_flags.inc: clear SECURITY_CFLAGS for uclibc

[Khem Raj]

On Thu, Aug 6, 2015 at 12:41 PM, Andre McCurdy <armccurdy@gmail.com> wrote:
> uclibc fails to build when security_flags.inc is used.
>
>  | i686-rdk-linux-uclibc-gcc  -m32 -march=core2 -mtune=core2 -msse3 -mfpmath=sse --sysroot=/build-vbox32/tmp/sysroots/vbox32-tcbootstrap  -Wl,-EL -Wl,--sort-common -Wl,--sort-section=alignment -m32 -shared -Wl,--warn-common -Wl,--warn-once -Wl,-z,combreloc -Wl,-z,relro -Wl,-z,now -Wl,--hash-style=gnu -Wl,-z,defs   -Wl,-init,__uClibc_init  -Wl,-soname=libc.so.0 -nostdlib -o lib/libuClibc-0.9.34-git.so  -Wl,--whole-archive libc/libc_so.a -Wl,--no-whole-archive ./lib/interp.os ./lib/ld-uClibc.so.0 ./lib/uclibc_nonshared.a /build-vbox32/tmp/sysroots/vbox32-tcbootstrap/usr/lib/i686-rdk-linux-uclibc/4.9.3/libgcc.a
>  | libc/libc_so.a(sigaction.os): In function `__libc_sigaction':
>  | /build-vbox32/tmp/work/core2-32-rdk-linux-uclibc/uclibc/0.9.33+gitAUTOINC+48a0006012-r9/git/libc/sysdeps/linux/i386/sigaction.c:37: undefined reference to `__stack_chk_guard'
>  | /build-vbox32/tmp/work/core2-32-rdk-linux-uclibc/uclibc/0.9.33+gitAUTOINC+48a0006012-r9/git/libc/sysdeps/linux/i386/sigaction.c:49: undefined reference to `__stack_chk_fail_local'
>  | collect2: error: ld returned 1 exit status
>  | make: *** [lib/libc.so] Error 1

This fix is papering over real problem. this means gcc is expecting
ssp implementation from libc but is not detecting it rightly can you
try passing gcc_cv_libc_provides_ssp=yes to help it configure

>
> Clearing SECURITY_CFLAGS completely may not be the best approach, but
> it's the approach taken for glibc, so try it for uclibc too.
>
> Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
> ---
>  meta/conf/distro/include/security_flags.inc | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/meta/conf/distro/include/security_flags.inc b/meta/conf/distro/include/security_flags.inc
> index 3724972..a107657 100644
> --- a/meta/conf/distro/include/security_flags.inc
> +++ b/meta/conf/distro/include/security_flags.inc
> @@ -84,6 +84,8 @@ SECURITY_CFLAGS_pn-python-smartpm = "${SECURITY_NO_PIE_CFLAGS}"
>  SECURITY_CFLAGS_pn-python-numpy = "${SECURITY_NO_PIE_CFLAGS}"
>  SECURITY_CFLAGS_pn-tcl = "${SECURITY_NO_PIE_CFLAGS}"
>  SECURITY_CFLAGS_pn-tiff = "${SECURITY_NO_PIE_CFLAGS}"
> +SECURITY_CFLAGS_pn-uclibc = ""
> +SECURITY_CFLAGS_pn-uclibc-initial = ""
>  SECURITY_CFLAGS_pn-valgrind = "${SECURITY_NO_PIE_CFLAGS}"
>  SECURITY_CFLAGS_pn-webkit-gtk = "${SECURITY_NO_PIE_CFLAGS}"
>  SECURITY_CFLAGS_pn-zlib = "${SECURITY_NO_PIE_CFLAGS}"
> --
> 1.9.1
>
> --
> _______________________________________________
> Openembedded-core mailing list
> Openembedded-core@lists.openembedded.org
> http://lists.openembedded.org/mailman/listinfo/openembedded-core

Re: [PATCH 2/3] security_flags.inc: clear SECURITY_CFLAGS for uclibc

[Andre McCurdy]

On Thu, Aug 6, 2015 at 7:02 PM, Khem Raj <raj.khem@gmail.com> wrote:
> On Thu, Aug 6, 2015 at 12:41 PM, Andre McCurdy <armccurdy@gmail.com> wrote:
>> uclibc fails to build when security_flags.inc is used.
>>
>>  | i686-rdk-linux-uclibc-gcc  -m32 -march=core2 -mtune=core2 -msse3 -mfpmath=sse --sysroot=/build-vbox32/tmp/sysroots/vbox32-tcbootstrap  -Wl,-EL -Wl,--sort-common -Wl,--sort-section=alignment -m32 -shared -Wl,--warn-common -Wl,--warn-once -Wl,-z,combreloc -Wl,-z,relro -Wl,-z,now -Wl,--hash-style=gnu -Wl,-z,defs   -Wl,-init,__uClibc_init  -Wl,-soname=libc.so.0 -nostdlib -o lib/libuClibc-0.9.34-git.so  -Wl,--whole-archive libc/libc_so.a -Wl,--no-whole-archive ./lib/interp.os ./lib/ld-uClibc.so.0 ./lib/uclibc_nonshared.a /build-vbox32/tmp/sysroots/vbox32-tcbootstrap/usr/lib/i686-rdk-linux-uclibc/4.9.3/libgcc.a
>>  | libc/libc_so.a(sigaction.os): In function `__libc_sigaction':
>>  | /build-vbox32/tmp/work/core2-32-rdk-linux-uclibc/uclibc/0.9.33+gitAUTOINC+48a0006012-r9/git/libc/sysdeps/linux/i386/sigaction.c:37: undefined reference to `__stack_chk_guard'
>>  | /build-vbox32/tmp/work/core2-32-rdk-linux-uclibc/uclibc/0.9.33+gitAUTOINC+48a0006012-r9/git/libc/sysdeps/linux/i386/sigaction.c:49: undefined reference to `__stack_chk_fail_local'
>>  | collect2: error: ld returned 1 exit status
>>  | make: *** [lib/libc.so] Error 1
>
> This fix is papering over real problem. this means gcc is expecting
> ssp implementation from libc but is not detecting it rightly can you
> try passing gcc_cv_libc_provides_ssp=yes to help it configure

OK, so I tried adding:

  export gcc_cv_libc_provides_ssp = 'yes'

to gcc-configure-common.inc and uclibc does then seem to build OK
without needing to provide uclibc specific SECURITY_CFLAGS.

The build still fails later (gcc-runtime fails while configuring
libgomp) but getting beyond building uclibc with security_flags.inc
enabled seems like progress.

>>
>> Clearing SECURITY_CFLAGS completely may not be the best approach, but
>> it's the approach taken for glibc, so try it for uclibc too.
>>
>> Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
>> ---
>>  meta/conf/distro/include/security_flags.inc | 2 ++
>>  1 file changed, 2 insertions(+)
>>
>> diff --git a/meta/conf/distro/include/security_flags.inc b/meta/conf/distro/include/security_flags.inc
>> index 3724972..a107657 100644
>> --- a/meta/conf/distro/include/security_flags.inc
>> +++ b/meta/conf/distro/include/security_flags.inc
>> @@ -84,6 +84,8 @@ SECURITY_CFLAGS_pn-python-smartpm = "${SECURITY_NO_PIE_CFLAGS}"
>>  SECURITY_CFLAGS_pn-python-numpy = "${SECURITY_NO_PIE_CFLAGS}"
>>  SECURITY_CFLAGS_pn-tcl = "${SECURITY_NO_PIE_CFLAGS}"
>>  SECURITY_CFLAGS_pn-tiff = "${SECURITY_NO_PIE_CFLAGS}"
>> +SECURITY_CFLAGS_pn-uclibc = ""
>> +SECURITY_CFLAGS_pn-uclibc-initial = ""
>>  SECURITY_CFLAGS_pn-valgrind = "${SECURITY_NO_PIE_CFLAGS}"
>>  SECURITY_CFLAGS_pn-webkit-gtk = "${SECURITY_NO_PIE_CFLAGS}"
>>  SECURITY_CFLAGS_pn-zlib = "${SECURITY_NO_PIE_CFLAGS}"
>> --
>> 1.9.1
>>
>> --
>> _______________________________________________
>> Openembedded-core mailing list
>> Openembedded-core@lists.openembedded.org
>> http://lists.openembedded.org/mailman/listinfo/openembedded-core

[PATCH 3/3] uclibc.inc: avoid immediate expansion for UCLIBC_EXTRA_CFLAGS

[Andre McCurdy]

If immediate variable expansion is used, then UCLIBC_EXTRA_CFLAGS can
sometimes be derived from a partially expanded value of CFLAGS.

One specific problem case occurs when security_flags.inc is used: CFLAGS
is evaluated before the SECURITY_CFLAGS_pn-uclibc over-ride has been
applied and therefore UCLIBC_EXTRA_CFLAGS ends up being based on the
default SECURITY_CFLAGS instead of the uclibc specific value.

Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
---
 meta/recipes-core/uclibc/uclibc.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/meta/recipes-core/uclibc/uclibc.inc b/meta/recipes-core/uclibc/uclibc.inc
index c483228..3ed8b60 100644
--- a/meta/recipes-core/uclibc/uclibc.inc
+++ b/meta/recipes-core/uclibc/uclibc.inc
@@ -57,8 +57,8 @@ export V="2"
 # -O<n> -fno-omit-frame-pointer ends up with GCC ICE on thumb as reported
 # http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44860
 #
-CFLAGS_arm := "${@oe_filter_out('-fno-omit-frame-pointer', '${CFLAGS}', d)}"
-UCLIBC_EXTRA_CFLAGS  := "${@oe_filter_out('(-I\S+|-i\S+)', '${CFLAGS}', d)}"
+CFLAGS_arm = "${@oe_filter_out('-fno-omit-frame-pointer', '${CFLAGS}', d)}"
+UCLIBC_EXTRA_CFLAGS = "${@oe_filter_out('(-I\S+|-i\S+)', '${CFLAGS}', d)}"
 
 do_compile_prepend () {
   unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS
-- 
1.9.1

Re: [PATCH 3/3] uclibc.inc: avoid immediate expansion for UCLIBC_EXTRA_CFLAGS

[Richard Purdie]

On Thu, 2015-08-06 at 12:41 -0700, Andre McCurdy wrote:
> If immediate variable expansion is used, then UCLIBC_EXTRA_CFLAGS can
> sometimes be derived from a partially expanded value of CFLAGS.
> 
> One specific problem case occurs when security_flags.inc is used: CFLAGS
> is evaluated before the SECURITY_CFLAGS_pn-uclibc over-ride has been
> applied and therefore UCLIBC_EXTRA_CFLAGS ends up being based on the
> default SECURITY_CFLAGS instead of the uclibc specific value.
> 
> Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
> ---
>  meta/recipes-core/uclibc/uclibc.inc | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/meta/recipes-core/uclibc/uclibc.inc b/meta/recipes-core/uclibc/uclibc.inc
> index c483228..3ed8b60 100644
> --- a/meta/recipes-core/uclibc/uclibc.inc
> +++ b/meta/recipes-core/uclibc/uclibc.inc
> @@ -57,8 +57,8 @@ export V="2"
>  # -O<n> -fno-omit-frame-pointer ends up with GCC ICE on thumb as reported
>  # http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44860
>  #
> -CFLAGS_arm := "${@oe_filter_out('-fno-omit-frame-pointer', '${CFLAGS}', d)}"
> -UCLIBC_EXTRA_CFLAGS  := "${@oe_filter_out('(-I\S+|-i\S+)', '${CFLAGS}', d)}"
> +CFLAGS_arm = "${@oe_filter_out('-fno-omit-frame-pointer', '${CFLAGS}', d)}"

I'm rather surprised we don't get circular references without the :=
operator with this. I suspect we can see build failures if you change
the code like this. That said, I've been meaning to go through and
replace all the uses of oe_filter_out with the remove operator. Can we
do that here please instead?

E.g:
CFLAGS_remove_arm = "-fno-omit-frame-pointer"

> +UCLIBC_EXTRA_CFLAGS = "${@oe_filter_out('(-I\S+|-i\S+)', '${CFLAGS}', d)}"

Cheers,

Richard

Re: [PATCH 3/3] uclibc.inc: avoid immediate expansion for UCLIBC_EXTRA_CFLAGS

[Andre McCurdy]

On Thu, Aug 6, 2015 at 4:02 PM, Richard Purdie
<richard.purdie@linuxfoundation.org> wrote:
> On Thu, 2015-08-06 at 12:41 -0700, Andre McCurdy wrote:
>> If immediate variable expansion is used, then UCLIBC_EXTRA_CFLAGS can
>> sometimes be derived from a partially expanded value of CFLAGS.
>>
>> One specific problem case occurs when security_flags.inc is used: CFLAGS
>> is evaluated before the SECURITY_CFLAGS_pn-uclibc over-ride has been
>> applied and therefore UCLIBC_EXTRA_CFLAGS ends up being based on the
>> default SECURITY_CFLAGS instead of the uclibc specific value.
>>
>> Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
>> ---
>>  meta/recipes-core/uclibc/uclibc.inc | 4 ++--
>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/meta/recipes-core/uclibc/uclibc.inc b/meta/recipes-core/uclibc/uclibc.inc
>> index c483228..3ed8b60 100644
>> --- a/meta/recipes-core/uclibc/uclibc.inc
>> +++ b/meta/recipes-core/uclibc/uclibc.inc
>> @@ -57,8 +57,8 @@ export V="2"
>>  # -O<n> -fno-omit-frame-pointer ends up with GCC ICE on thumb as reported
>>  # http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44860
>>  #
>> -CFLAGS_arm := "${@oe_filter_out('-fno-omit-frame-pointer', '${CFLAGS}', d)}"
>> -UCLIBC_EXTRA_CFLAGS  := "${@oe_filter_out('(-I\S+|-i\S+)', '${CFLAGS}', d)}"
>> +CFLAGS_arm = "${@oe_filter_out('-fno-omit-frame-pointer', '${CFLAGS}', d)}"
>
> I'm rather surprised we don't get circular references without the :=
> operator with this. I suspect we can see build failures if you change
> the code like this. That said, I've been meaning to go through and
> replace all the uses of oe_filter_out with the remove operator. Can we
> do that here please instead?
>
> E.g:
> CFLAGS_remove_arm = "-fno-omit-frame-pointer"

OK, new patch on the way.

>> +UCLIBC_EXTRA_CFLAGS = "${@oe_filter_out('(-I\S+|-i\S+)', '${CFLAGS}', d)}"

Is it OK to keep using oe_filter_out() here to support the regex?

> Cheers,
>
> Richard
>
>

Re: [PATCH 3/3] uclibc.inc: avoid immediate expansion for UCLIBC_EXTRA_CFLAGS

[Richard Purdie]

On Thu, 2015-08-06 at 18:14 -0700, Andre McCurdy wrote:
> On Thu, Aug 6, 2015 at 4:02 PM, Richard Purdie
> <richard.purdie@linuxfoundation.org> wrote:
> > On Thu, 2015-08-06 at 12:41 -0700, Andre McCurdy wrote:
> >> If immediate variable expansion is used, then UCLIBC_EXTRA_CFLAGS can
> >> sometimes be derived from a partially expanded value of CFLAGS.
> >>
> >> One specific problem case occurs when security_flags.inc is used: CFLAGS
> >> is evaluated before the SECURITY_CFLAGS_pn-uclibc over-ride has been
> >> applied and therefore UCLIBC_EXTRA_CFLAGS ends up being based on the
> >> default SECURITY_CFLAGS instead of the uclibc specific value.
> >>
> >> Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
> >> ---
> >>  meta/recipes-core/uclibc/uclibc.inc | 4 ++--
> >>  1 file changed, 2 insertions(+), 2 deletions(-)
> >>
> >> diff --git a/meta/recipes-core/uclibc/uclibc.inc b/meta/recipes-core/uclibc/uclibc.inc
> >> index c483228..3ed8b60 100644
> >> --- a/meta/recipes-core/uclibc/uclibc.inc
> >> +++ b/meta/recipes-core/uclibc/uclibc.inc
> >> @@ -57,8 +57,8 @@ export V="2"
> >>  # -O<n> -fno-omit-frame-pointer ends up with GCC ICE on thumb as reported
> >>  # http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44860
> >>  #
> >> -CFLAGS_arm := "${@oe_filter_out('-fno-omit-frame-pointer', '${CFLAGS}', d)}"
> >> -UCLIBC_EXTRA_CFLAGS  := "${@oe_filter_out('(-I\S+|-i\S+)', '${CFLAGS}', d)}"
> >> +CFLAGS_arm = "${@oe_filter_out('-fno-omit-frame-pointer', '${CFLAGS}', d)}"
> >
> > I'm rather surprised we don't get circular references without the :=
> > operator with this. I suspect we can see build failures if you change
> > the code like this. That said, I've been meaning to go through and
> > replace all the uses of oe_filter_out with the remove operator. Can we
> > do that here please instead?
> >
> > E.g:
> > CFLAGS_remove_arm = "-fno-omit-frame-pointer"
> 
> OK, new patch on the way.
> 
> >> +UCLIBC_EXTRA_CFLAGS = "${@oe_filter_out('(-I\S+|-i\S+)', '${CFLAGS}', d)}"
> 
> Is it OK to keep using oe_filter_out() here to support the regex?

Yes, the regex is obviously trickier with _remove so I think that one is
a fair use of oe_filter_out(). Thanks for the updated patches, just need
to answer Khem's question, it sounds like LDFLAGS may be used somehow
but I've not looked at the code as yet.

Cheers,

Richard