Re: [OE-core] systemd build failure with gcc 15 / tpm2 / aarch64: gcs required

[Mikko Rapeli <mikko.rapeli@linaro.org>]

Hi,

On Wed, May 07, 2025 at 03:10:29PM -0400, Trevor Woerner wrote:
> On Wed 2025-05-07 @ 03:04:49 PM, Trevor Woerner wrote:
> > On Wed 2025-05-07 @ 11:38:12 AM, Khem Raj wrote:
> > > On Wed, May 7, 2025 at 11:34 AM Ross Burton <Ross.Burton@arm.com> wrote:
> > > >
> > > > On 7 May 2025, at 19:29, Trevor Woerner via lists.openembedded.org <twoerner=gmail.com@lists.openembedded.org> wrote:
> > > > >
> > > > > I stumbled across this build issue via a completely different route than most
> > > > > others, it seems, and certainly different than what you have described. I'm
> > > > > not using meta-security and I'm not using tpm2. Therefore your patch will do
> > > > > little to solve my build, and others will likely stumble across this issue by
> > > > > other routes as well.
> > > >
> > > > For what it’s worth, we’re seeing this without meta-security too.  This needs to be worked around in core (personally, I’d remove —fatal-warnings from systemd until openssl includes the GCS hints).
> > > >
> > > 
> > > thats a bigger hammer, I would suggest to apply
> > > LDFLAGS:append:aarch64 = " -Wl,-z,gcs-report-dynamic=none"
> > > in systemd recipe in core
> > 
> > If we want to make the hammer smaller, it's only triggered when:
> > 
> > 	PACKAGECONFIG:append:pn-systemd = " openssl"
> > 
> 
> diff --git a/meta/recipes-core/systemd/systemd_257.5.bb b/meta/recipes-core/systemd/systemd_257.5.bb
> index acf97517a94a..995b55580e4a 100644
> --- a/meta/recipes-core/systemd/systemd_257.5.bb
> +++ b/meta/recipes-core/systemd/systemd_257.5.bb
> @@ -240,6 +240,7 @@ RESOLV_CONF ??= ""
>  # bpf-framework: pass the recipe-sysroot to the compiler used to build
>  # the eBPFs, so that it can find needed system includes in there.
>  CFLAGS:append = " --sysroot=${STAGING_DIR_TARGET}"
> +LDFLAGS:append:aarch64 = " ${@bb.utils.contains('PACKAGECONFIG', 'openssl', '-Wl,-z,gcs-report-dynamic=none', '', d)}"
> 
>  EXTRA_OEMESON += "-Dnobody-user=nobody \
>                    -Dnobody-group=nogroup \

I would prefer this but in the past I had trouble getting non-default
config fixes to oe-core and thus I proposed the patch to meta-security/meta-tpm
only. I do understand that "openssl" in systemd PACKAGECONFIG can be enabled
in a number of builds and setups, but it's not the default. Maybe
it should be the default, together with "repart"? Another thread, hopefully
shorter than "efi".

There are a lot of corner cases and non-default configs which need fixes
to oe-core. I would like to understand what the policy for fixes is.

I think it would make sense to enable more features by default, but allow them
to be disabled. TPM support being one of them.

Cheers,

-Mikko