[PATCH 0/3] fix uclibc build with security_flags.inc

[PATCH 0/3] fix uclibc build with security_flags.inc

[Andre McCurdy]

Andre McCurdy (3):
  uclibc.inc: remove unused UCLIBC_EXTRA_LDFLAGS
  security_flags.inc: clear SECURITY_CFLAGS for uclibc
  uclibc.inc: avoid immediate expansion for UCLIBC_EXTRA_CFLAGS

 meta/conf/distro/include/security_flags.inc | 2 ++
 meta/recipes-core/uclibc/uclibc.inc         | 5 ++---
 2 files changed, 4 insertions(+), 3 deletions(-)

-- 
1.9.1

[PATCH 1/3] uclibc.inc: remove unused UCLIBC_EXTRA_LDFLAGS

[Andre McCurdy]

Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
---
 meta/recipes-core/uclibc/uclibc.inc | 1 -
 1 file changed, 1 deletion(-)

diff --git a/meta/recipes-core/uclibc/uclibc.inc b/meta/recipes-core/uclibc/uclibc.inc
index 08465c4..c483228 100644
--- a/meta/recipes-core/uclibc/uclibc.inc
+++ b/meta/recipes-core/uclibc/uclibc.inc
@@ -59,7 +59,6 @@ export V="2"
 #
 CFLAGS_arm := "${@oe_filter_out('-fno-omit-frame-pointer', '${CFLAGS}', d)}"
 UCLIBC_EXTRA_CFLAGS  := "${@oe_filter_out('(-I\S+|-i\S+)', '${CFLAGS}', d)}"
-UCLIBC_EXTRA_LDFLAGS := "${@oe_filter_out('(-L\S+|-l\S+)', '${LDFLAGS}', d)}"
 
 do_compile_prepend () {
   unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS
-- 
1.9.1

[PATCH 2/3] security_flags.inc: clear SECURITY_CFLAGS for uclibc

[Andre McCurdy]

uclibc fails to build when security_flags.inc is used.

 | i686-rdk-linux-uclibc-gcc  -m32 -march=core2 -mtune=core2 -msse3 -mfpmath=sse --sysroot=/build-vbox32/tmp/sysroots/vbox32-tcbootstrap  -Wl,-EL -Wl,--sort-common -Wl,--sort-section=alignment -m32 -shared -Wl,--warn-common -Wl,--warn-once -Wl,-z,combreloc -Wl,-z,relro -Wl,-z,now -Wl,--hash-style=gnu -Wl,-z,defs   -Wl,-init,__uClibc_init  -Wl,-soname=libc.so.0 -nostdlib -o lib/libuClibc-0.9.34-git.so  -Wl,--whole-archive libc/libc_so.a -Wl,--no-whole-archive ./lib/interp.os ./lib/ld-uClibc.so.0 ./lib/uclibc_nonshared.a /build-vbox32/tmp/sysroots/vbox32-tcbootstrap/usr/lib/i686-rdk-linux-uclibc/4.9.3/libgcc.a
 | libc/libc_so.a(sigaction.os): In function `__libc_sigaction':
 | /build-vbox32/tmp/work/core2-32-rdk-linux-uclibc/uclibc/0.9.33+gitAUTOINC+48a0006012-r9/git/libc/sysdeps/linux/i386/sigaction.c:37: undefined reference to `__stack_chk_guard'
 | /build-vbox32/tmp/work/core2-32-rdk-linux-uclibc/uclibc/0.9.33+gitAUTOINC+48a0006012-r9/git/libc/sysdeps/linux/i386/sigaction.c:49: undefined reference to `__stack_chk_fail_local'
 | collect2: error: ld returned 1 exit status
 | make: *** [lib/libc.so] Error 1

Clearing SECURITY_CFLAGS completely may not be the best approach, but
it's the approach taken for glibc, so try it for uclibc too.

Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
---
 meta/conf/distro/include/security_flags.inc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta/conf/distro/include/security_flags.inc b/meta/conf/distro/include/security_flags.inc
index 3724972..a107657 100644
--- a/meta/conf/distro/include/security_flags.inc
+++ b/meta/conf/distro/include/security_flags.inc
@@ -84,6 +84,8 @@ SECURITY_CFLAGS_pn-python-smartpm = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-python-numpy = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-tcl = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-tiff = "${SECURITY_NO_PIE_CFLAGS}"
+SECURITY_CFLAGS_pn-uclibc = ""
+SECURITY_CFLAGS_pn-uclibc-initial = ""
 SECURITY_CFLAGS_pn-valgrind = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-webkit-gtk = "${SECURITY_NO_PIE_CFLAGS}"
 SECURITY_CFLAGS_pn-zlib = "${SECURITY_NO_PIE_CFLAGS}"
-- 
1.9.1

[PATCH 3/3] uclibc.inc: avoid immediate expansion for UCLIBC_EXTRA_CFLAGS

[Andre McCurdy]

If immediate variable expansion is used, then UCLIBC_EXTRA_CFLAGS can
sometimes be derived from a partially expanded value of CFLAGS.

One specific problem case occurs when security_flags.inc is used: CFLAGS
is evaluated before the SECURITY_CFLAGS_pn-uclibc over-ride has been
applied and therefore UCLIBC_EXTRA_CFLAGS ends up being based on the
default SECURITY_CFLAGS instead of the uclibc specific value.

Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
---
 meta/recipes-core/uclibc/uclibc.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/meta/recipes-core/uclibc/uclibc.inc b/meta/recipes-core/uclibc/uclibc.inc
index c483228..3ed8b60 100644
--- a/meta/recipes-core/uclibc/uclibc.inc
+++ b/meta/recipes-core/uclibc/uclibc.inc
@@ -57,8 +57,8 @@ export V="2"
 # -O<n> -fno-omit-frame-pointer ends up with GCC ICE on thumb as reported
 # http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44860
 #
-CFLAGS_arm := "${@oe_filter_out('-fno-omit-frame-pointer', '${CFLAGS}', d)}"
-UCLIBC_EXTRA_CFLAGS  := "${@oe_filter_out('(-I\S+|-i\S+)', '${CFLAGS}', d)}"
+CFLAGS_arm = "${@oe_filter_out('-fno-omit-frame-pointer', '${CFLAGS}', d)}"
+UCLIBC_EXTRA_CFLAGS = "${@oe_filter_out('(-I\S+|-i\S+)', '${CFLAGS}', d)}"
 
 do_compile_prepend () {
   unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS
-- 
1.9.1

Re: [PATCH 3/3] uclibc.inc: avoid immediate expansion for UCLIBC_EXTRA_CFLAGS

[Richard Purdie]

On Thu, 2015-08-06 at 12:41 -0700, Andre McCurdy wrote:
> If immediate variable expansion is used, then UCLIBC_EXTRA_CFLAGS can
> sometimes be derived from a partially expanded value of CFLAGS.
> 
> One specific problem case occurs when security_flags.inc is used: CFLAGS
> is evaluated before the SECURITY_CFLAGS_pn-uclibc over-ride has been
> applied and therefore UCLIBC_EXTRA_CFLAGS ends up being based on the
> default SECURITY_CFLAGS instead of the uclibc specific value.
> 
> Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
> ---
>  meta/recipes-core/uclibc/uclibc.inc | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/meta/recipes-core/uclibc/uclibc.inc b/meta/recipes-core/uclibc/uclibc.inc
> index c483228..3ed8b60 100644
> --- a/meta/recipes-core/uclibc/uclibc.inc
> +++ b/meta/recipes-core/uclibc/uclibc.inc
> @@ -57,8 +57,8 @@ export V="2"
>  # -O<n> -fno-omit-frame-pointer ends up with GCC ICE on thumb as reported
>  # http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44860
>  #
> -CFLAGS_arm := "${@oe_filter_out('-fno-omit-frame-pointer', '${CFLAGS}', d)}"
> -UCLIBC_EXTRA_CFLAGS  := "${@oe_filter_out('(-I\S+|-i\S+)', '${CFLAGS}', d)}"
> +CFLAGS_arm = "${@oe_filter_out('-fno-omit-frame-pointer', '${CFLAGS}', d)}"

I'm rather surprised we don't get circular references without the :=
operator with this. I suspect we can see build failures if you change
the code like this. That said, I've been meaning to go through and
replace all the uses of oe_filter_out with the remove operator. Can we
do that here please instead?

E.g:
CFLAGS_remove_arm = "-fno-omit-frame-pointer"

> +UCLIBC_EXTRA_CFLAGS = "${@oe_filter_out('(-I\S+|-i\S+)', '${CFLAGS}', d)}"

Cheers,

Richard

Re: [PATCH 3/3] uclibc.inc: avoid immediate expansion for UCLIBC_EXTRA_CFLAGS

[Andre McCurdy]

On Thu, Aug 6, 2015 at 4:02 PM, Richard Purdie
<richard.purdie@linuxfoundation.org> wrote:
> On Thu, 2015-08-06 at 12:41 -0700, Andre McCurdy wrote:
>> If immediate variable expansion is used, then UCLIBC_EXTRA_CFLAGS can
>> sometimes be derived from a partially expanded value of CFLAGS.
>>
>> One specific problem case occurs when security_flags.inc is used: CFLAGS
>> is evaluated before the SECURITY_CFLAGS_pn-uclibc over-ride has been
>> applied and therefore UCLIBC_EXTRA_CFLAGS ends up being based on the
>> default SECURITY_CFLAGS instead of the uclibc specific value.
>>
>> Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
>> ---
>>  meta/recipes-core/uclibc/uclibc.inc | 4 ++--
>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/meta/recipes-core/uclibc/uclibc.inc b/meta/recipes-core/uclibc/uclibc.inc
>> index c483228..3ed8b60 100644
>> --- a/meta/recipes-core/uclibc/uclibc.inc
>> +++ b/meta/recipes-core/uclibc/uclibc.inc
>> @@ -57,8 +57,8 @@ export V="2"
>>  # -O<n> -fno-omit-frame-pointer ends up with GCC ICE on thumb as reported
>>  # http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44860
>>  #
>> -CFLAGS_arm := "${@oe_filter_out('-fno-omit-frame-pointer', '${CFLAGS}', d)}"
>> -UCLIBC_EXTRA_CFLAGS  := "${@oe_filter_out('(-I\S+|-i\S+)', '${CFLAGS}', d)}"
>> +CFLAGS_arm = "${@oe_filter_out('-fno-omit-frame-pointer', '${CFLAGS}', d)}"
>
> I'm rather surprised we don't get circular references without the :=
> operator with this. I suspect we can see build failures if you change
> the code like this. That said, I've been meaning to go through and
> replace all the uses of oe_filter_out with the remove operator. Can we
> do that here please instead?
>
> E.g:
> CFLAGS_remove_arm = "-fno-omit-frame-pointer"

OK, new patch on the way.

>> +UCLIBC_EXTRA_CFLAGS = "${@oe_filter_out('(-I\S+|-i\S+)', '${CFLAGS}', d)}"

Is it OK to keep using oe_filter_out() here to support the regex?

> Cheers,
>
> Richard
>
>

Re: [PATCH 2/3] security_flags.inc: clear SECURITY_CFLAGS for uclibc

[Khem Raj]

On Thu, Aug 6, 2015 at 12:41 PM, Andre McCurdy <armccurdy@gmail.com> wrote:
> uclibc fails to build when security_flags.inc is used.
>
>  | i686-rdk-linux-uclibc-gcc  -m32 -march=core2 -mtune=core2 -msse3 -mfpmath=sse --sysroot=/build-vbox32/tmp/sysroots/vbox32-tcbootstrap  -Wl,-EL -Wl,--sort-common -Wl,--sort-section=alignment -m32 -shared -Wl,--warn-common -Wl,--warn-once -Wl,-z,combreloc -Wl,-z,relro -Wl,-z,now -Wl,--hash-style=gnu -Wl,-z,defs   -Wl,-init,__uClibc_init  -Wl,-soname=libc.so.0 -nostdlib -o lib/libuClibc-0.9.34-git.so  -Wl,--whole-archive libc/libc_so.a -Wl,--no-whole-archive ./lib/interp.os ./lib/ld-uClibc.so.0 ./lib/uclibc_nonshared.a /build-vbox32/tmp/sysroots/vbox32-tcbootstrap/usr/lib/i686-rdk-linux-uclibc/4.9.3/libgcc.a
>  | libc/libc_so.a(sigaction.os): In function `__libc_sigaction':
>  | /build-vbox32/tmp/work/core2-32-rdk-linux-uclibc/uclibc/0.9.33+gitAUTOINC+48a0006012-r9/git/libc/sysdeps/linux/i386/sigaction.c:37: undefined reference to `__stack_chk_guard'
>  | /build-vbox32/tmp/work/core2-32-rdk-linux-uclibc/uclibc/0.9.33+gitAUTOINC+48a0006012-r9/git/libc/sysdeps/linux/i386/sigaction.c:49: undefined reference to `__stack_chk_fail_local'
>  | collect2: error: ld returned 1 exit status
>  | make: *** [lib/libc.so] Error 1

This fix is papering over real problem. this means gcc is expecting
ssp implementation from libc but is not detecting it rightly can you
try passing gcc_cv_libc_provides_ssp=yes to help it configure

>
> Clearing SECURITY_CFLAGS completely may not be the best approach, but
> it's the approach taken for glibc, so try it for uclibc too.
>
> Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
> ---
>  meta/conf/distro/include/security_flags.inc | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/meta/conf/distro/include/security_flags.inc b/meta/conf/distro/include/security_flags.inc
> index 3724972..a107657 100644
> --- a/meta/conf/distro/include/security_flags.inc
> +++ b/meta/conf/distro/include/security_flags.inc
> @@ -84,6 +84,8 @@ SECURITY_CFLAGS_pn-python-smartpm = "${SECURITY_NO_PIE_CFLAGS}"
>  SECURITY_CFLAGS_pn-python-numpy = "${SECURITY_NO_PIE_CFLAGS}"
>  SECURITY_CFLAGS_pn-tcl = "${SECURITY_NO_PIE_CFLAGS}"
>  SECURITY_CFLAGS_pn-tiff = "${SECURITY_NO_PIE_CFLAGS}"
> +SECURITY_CFLAGS_pn-uclibc = ""
> +SECURITY_CFLAGS_pn-uclibc-initial = ""
>  SECURITY_CFLAGS_pn-valgrind = "${SECURITY_NO_PIE_CFLAGS}"
>  SECURITY_CFLAGS_pn-webkit-gtk = "${SECURITY_NO_PIE_CFLAGS}"
>  SECURITY_CFLAGS_pn-zlib = "${SECURITY_NO_PIE_CFLAGS}"
> --
> 1.9.1
>
> --
> _______________________________________________
> Openembedded-core mailing list
> Openembedded-core@lists.openembedded.org
> http://lists.openembedded.org/mailman/listinfo/openembedded-core

Re: [PATCH 3/3] uclibc.inc: avoid immediate expansion for UCLIBC_EXTRA_CFLAGS

[Richard Purdie]

On Thu, 2015-08-06 at 18:14 -0700, Andre McCurdy wrote:
> On Thu, Aug 6, 2015 at 4:02 PM, Richard Purdie
> <richard.purdie@linuxfoundation.org> wrote:
> > On Thu, 2015-08-06 at 12:41 -0700, Andre McCurdy wrote:
> >> If immediate variable expansion is used, then UCLIBC_EXTRA_CFLAGS can
> >> sometimes be derived from a partially expanded value of CFLAGS.
> >>
> >> One specific problem case occurs when security_flags.inc is used: CFLAGS
> >> is evaluated before the SECURITY_CFLAGS_pn-uclibc over-ride has been
> >> applied and therefore UCLIBC_EXTRA_CFLAGS ends up being based on the
> >> default SECURITY_CFLAGS instead of the uclibc specific value.
> >>
> >> Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
> >> ---
> >>  meta/recipes-core/uclibc/uclibc.inc | 4 ++--
> >>  1 file changed, 2 insertions(+), 2 deletions(-)
> >>
> >> diff --git a/meta/recipes-core/uclibc/uclibc.inc b/meta/recipes-core/uclibc/uclibc.inc
> >> index c483228..3ed8b60 100644
> >> --- a/meta/recipes-core/uclibc/uclibc.inc
> >> +++ b/meta/recipes-core/uclibc/uclibc.inc
> >> @@ -57,8 +57,8 @@ export V="2"
> >>  # -O<n> -fno-omit-frame-pointer ends up with GCC ICE on thumb as reported
> >>  # http://gcc.gnu.org/bugzilla/show_bug.cgi?id=44860
> >>  #
> >> -CFLAGS_arm := "${@oe_filter_out('-fno-omit-frame-pointer', '${CFLAGS}', d)}"
> >> -UCLIBC_EXTRA_CFLAGS  := "${@oe_filter_out('(-I\S+|-i\S+)', '${CFLAGS}', d)}"
> >> +CFLAGS_arm = "${@oe_filter_out('-fno-omit-frame-pointer', '${CFLAGS}', d)}"
> >
> > I'm rather surprised we don't get circular references without the :=
> > operator with this. I suspect we can see build failures if you change
> > the code like this. That said, I've been meaning to go through and
> > replace all the uses of oe_filter_out with the remove operator. Can we
> > do that here please instead?
> >
> > E.g:
> > CFLAGS_remove_arm = "-fno-omit-frame-pointer"
> 
> OK, new patch on the way.
> 
> >> +UCLIBC_EXTRA_CFLAGS = "${@oe_filter_out('(-I\S+|-i\S+)', '${CFLAGS}', d)}"
> 
> Is it OK to keep using oe_filter_out() here to support the regex?

Yes, the regex is obviously trickier with _remove so I think that one is
a fair use of oe_filter_out(). Thanks for the updated patches, just need
to answer Khem's question, it sounds like LDFLAGS may be used somehow
but I've not looked at the code as yet.

Cheers,

Richard

Re: [PATCH 2/3] security_flags.inc: clear SECURITY_CFLAGS for uclibc

[Andre McCurdy]

On Thu, Aug 6, 2015 at 7:02 PM, Khem Raj <raj.khem@gmail.com> wrote:
> On Thu, Aug 6, 2015 at 12:41 PM, Andre McCurdy <armccurdy@gmail.com> wrote:
>> uclibc fails to build when security_flags.inc is used.
>>
>>  | i686-rdk-linux-uclibc-gcc  -m32 -march=core2 -mtune=core2 -msse3 -mfpmath=sse --sysroot=/build-vbox32/tmp/sysroots/vbox32-tcbootstrap  -Wl,-EL -Wl,--sort-common -Wl,--sort-section=alignment -m32 -shared -Wl,--warn-common -Wl,--warn-once -Wl,-z,combreloc -Wl,-z,relro -Wl,-z,now -Wl,--hash-style=gnu -Wl,-z,defs   -Wl,-init,__uClibc_init  -Wl,-soname=libc.so.0 -nostdlib -o lib/libuClibc-0.9.34-git.so  -Wl,--whole-archive libc/libc_so.a -Wl,--no-whole-archive ./lib/interp.os ./lib/ld-uClibc.so.0 ./lib/uclibc_nonshared.a /build-vbox32/tmp/sysroots/vbox32-tcbootstrap/usr/lib/i686-rdk-linux-uclibc/4.9.3/libgcc.a
>>  | libc/libc_so.a(sigaction.os): In function `__libc_sigaction':
>>  | /build-vbox32/tmp/work/core2-32-rdk-linux-uclibc/uclibc/0.9.33+gitAUTOINC+48a0006012-r9/git/libc/sysdeps/linux/i386/sigaction.c:37: undefined reference to `__stack_chk_guard'
>>  | /build-vbox32/tmp/work/core2-32-rdk-linux-uclibc/uclibc/0.9.33+gitAUTOINC+48a0006012-r9/git/libc/sysdeps/linux/i386/sigaction.c:49: undefined reference to `__stack_chk_fail_local'
>>  | collect2: error: ld returned 1 exit status
>>  | make: *** [lib/libc.so] Error 1
>
> This fix is papering over real problem. this means gcc is expecting
> ssp implementation from libc but is not detecting it rightly can you
> try passing gcc_cv_libc_provides_ssp=yes to help it configure

OK, so I tried adding:

  export gcc_cv_libc_provides_ssp = 'yes'

to gcc-configure-common.inc and uclibc does then seem to build OK
without needing to provide uclibc specific SECURITY_CFLAGS.

The build still fails later (gcc-runtime fails while configuring
libgomp) but getting beyond building uclibc with security_flags.inc
enabled seems like progress.

>>
>> Clearing SECURITY_CFLAGS completely may not be the best approach, but
>> it's the approach taken for glibc, so try it for uclibc too.
>>
>> Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
>> ---
>>  meta/conf/distro/include/security_flags.inc | 2 ++
>>  1 file changed, 2 insertions(+)
>>
>> diff --git a/meta/conf/distro/include/security_flags.inc b/meta/conf/distro/include/security_flags.inc
>> index 3724972..a107657 100644
>> --- a/meta/conf/distro/include/security_flags.inc
>> +++ b/meta/conf/distro/include/security_flags.inc
>> @@ -84,6 +84,8 @@ SECURITY_CFLAGS_pn-python-smartpm = "${SECURITY_NO_PIE_CFLAGS}"
>>  SECURITY_CFLAGS_pn-python-numpy = "${SECURITY_NO_PIE_CFLAGS}"
>>  SECURITY_CFLAGS_pn-tcl = "${SECURITY_NO_PIE_CFLAGS}"
>>  SECURITY_CFLAGS_pn-tiff = "${SECURITY_NO_PIE_CFLAGS}"
>> +SECURITY_CFLAGS_pn-uclibc = ""
>> +SECURITY_CFLAGS_pn-uclibc-initial = ""
>>  SECURITY_CFLAGS_pn-valgrind = "${SECURITY_NO_PIE_CFLAGS}"
>>  SECURITY_CFLAGS_pn-webkit-gtk = "${SECURITY_NO_PIE_CFLAGS}"
>>  SECURITY_CFLAGS_pn-zlib = "${SECURITY_NO_PIE_CFLAGS}"
>> --
>> 1.9.1
>>
>> --
>> _______________________________________________
>> Openembedded-core mailing list
>> Openembedded-core@lists.openembedded.org
>> http://lists.openembedded.org/mailman/listinfo/openembedded-core