Re: [OE-core] systemd build failure with gcc 15 / tpm2 / aarch64: gcs required

[Max Krummenacher <max.oss.09@gmail.com>]

On Mon, May 05, 2025 at 02:33:22PM +0200, Vyacheslav Yurkov wrote:
> Did you ask this in the systemd issue tracker as well?

No, I didn't. I hoped to get some insight from OE first.

To me it looks more like an issue with the way the toolchain or
systemd or openssl gets configured rather than with the upstream
systemd codebase. I might be wrong though.

Regards
Max

> 
> Slava
> 
> On Mon, May 5, 2025, 13:46 Max Krummenacher via lists.openembedded.org
> <max.oss.09=gmail.com@lists.openembedded.org> wrote:
> 
> > Hello
> >
> > I'm seeing a strange warning resulting in a failed build when building
> > systemd with tpm2 in DISTRO_FEATURES.
> >
> > GCS seems to be a new feature supported with GCC 15 and friends
> > targeting the AARCH64 architecture. Whatever it does ;-).
> >
> > Ways to reproduce:
> >
> > Add the needed layers for tpm2, add tpm2 to distro features and build
> > systemd.
> > E.g.
> > bblayers.conf additions:
> >
> >   ${TOPDIR}/../meta-security/meta-tpm \
> >   ${TOPDIR}/../meta-openembedded/meta-oe \
> >   ${TOPDIR}/../meta-openembedded/meta-python \
> >
> > local.conf additions:
> >
> > DISTRO_FEATURES:append = " tpm2"
> > INIT_MANAGER = "systemd"
> >
> > MACHINE=qemuarm64 bitbake systemd
> >
> > Results in:
> >
> > | FAILED: src/shared/libsystemd-shared-257.so
> > | aarch64-poky-linux-gcc -mcpu=cortex-a57+crc -mbranch-protection=standard
> > -fstack-protector-strong
> >   -O2 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security
> > -Werror=format-security --sysroot=...systemd/257.5/recipe-sysroot
> >   -o src/shared/libsystemd-shared-257.so -Wl,--as-needed
> > -Wl,--no-undefined -shared -fPIC
> >   -Wl,-soname,libsystemd-shared-257.so -Wl,--whole-archive
> > -Wl,--start-group src/shared/libsystemd-shared-257.a
> >   src/basic/libbasic.a src/libsystemd/libsystemd_static.a
> > -Wl,--no-whole-archive -fstack-protector
> >   -Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed
> > -ffile-prefix-map=...systemd/257.5/git=/usr/src/debug/systemd/257.5
> >   -ffile-prefix-map...systemd/257.5/build=/usr/src/debug/systemd/257.5
> > -ffile-prefix-map=...systemd/257.5/recipe-sysroot=
> >   -ffile-prefix-map=...systemd/257.5/recipe-sysroot-native=
> > -Wl,-z,relro,-z,now -shared
> >   -Wl,--version-script=...systemd/257.5/git/src/shared/libshared.sym
> > -pthread ...systemd/257.5/recipe-sysroot/usr/lib/libacl.so
> >   ...systemd/257.5/recipe-sysroot/usr/lib/libblkid.so
> > ...systemd/257.5/recipe-sysroot/usr/lib/libcap.so
> >   ...systemd/257.5/recipe-sysroot/usr/lib/libcrypt.so -ldl
> > ...systemd/257.5/recipe-sysroot/usr/lib/libmount.so
> >   ...systemd/257.5/recipe-sysroot/usr/lib/libssl.so
> > ...systemd/257.5/recipe-sysroot/usr/lib/libcrypto.so -lrt
> >   ...systemd/257.5/recipe-sysroot/usr/lib/libseccomp.so
> > -Wl,--fatal-warnings -Wl,-z,now -Wl,-z,relro -Wl,--warn-common
> >   -Wl,--gc-sections -Wl,--fatal-warnings -Wl,-z,now -Wl,-z,relro
> > -Wl,--warn-common -Wl,--gc-sections -lm
> >   -Wl,--end-group -Wl,--fatal-warnings -Wl,-z,now -Wl,-z,relro
> > -Wl,--warn-common -Wl,--gc-sections
> >   -Wl,--fatal-warnings -Wl,-z,now -Wl,-z,relro -Wl,--warn-common
> > -Wl,--gc-sections
> > | ...systemd/257.5/recipe-sysroot/usr/lib/libcrypto.so: warning: GCS is
> > required by -z gcs,
> >   but this shared library lacks the necessary property note. The dynamic
> > loader might not enable GCS
> >   or refuse to load the program unless all the shared library dependencies
> > have the GCS marking.
> > | collect2: error: ld returned 1 exit status
> >
> >
> > I already found that adding to the systemd recipe
> >
> > 'CFLAGS:append = " -Wl,-z,gcs-report-dynamic=none"'
> >
> > prevents the build error. However I'm not sure if that would be a good
> > way forward and if there are other recipes / configurations which would
> > result in similar build errors.
> >
> > Any comments? Thanks.
> >
> > Regards
> > Max
> >
> > -=-=-=-=-=-=-=-=-=-=-=-
> > Links: You receive all messages sent to this group.
> > View/Reply Online (#216006):
> > https://lists.openembedded.org/g/openembedded-core/message/216006
> > Mute This Topic: https://lists.openembedded.org/mt/112627480/4455192
> > Group Owner: openembedded-core+owner@lists.openembedded.org
> > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> > uvv.mail@gmail.com]
> > -=-=-=-=-=-=-=-=-=-=-=-
> >
> >