Bug 239007

Summary: lang/gcc8 enable secure-plt by default for powerpc*
Product: Ports & Packages Reporter: Justin Hibbits <jhibbits>
Component: Individual Port(s)Assignee: Andreas Tobler <andreast>
Status: New ---    
Severity: Affects Some People CC: jhb, marklmi26-fbsd, powerpc
Priority: ---    
Version: Latest   
Hardware: powerpc   
OS: Any   
Description Flags
Patch unconditionally enabling secure-PLT for FreeBSD/powerpc*
upstream patch none

Description Justin Hibbits freebsd_committer 2019-07-05 19:40:35 UTC
Created attachment 205535 [details]
Patch unconditionally enabling secure-PLT for FreeBSD/powerpc*

The attached patch, probably incomplete, enables secure PLT for powerpc* (powerpc, powerpcspe, powerpc64).  The "correct" way would probably be to enable it only for 12 and later (12 will be getting secure-PLT in base after a 1 month burn-in period in head).
Comment 1 Gerald Pfeifer freebsd_committer 2019-07-05 19:48:56 UTC
Andreas, what is your take?

IMO this should go upstream (GCC 10, ideally also GCC 9) first.
Comment 2 Andreas Tobler freebsd_committer 2019-07-06 18:06:44 UTC
Hm, the linker option --secure-plt is not known to 64-bit ld, do I miss something?
Comment 3 Justin Hibbits freebsd_committer 2019-07-07 00:06:40 UTC
Andreas, I see the same thing.  secure-plt really should be configured, in the specs config, as only enabled if -m32 is specified, since it's *only* for 32-bit powerpc.  So maybe that can be done by changing secureplt.h?  I have no idea.
Comment 4 Andreas Tobler freebsd_committer 2019-07-08 19:50:21 UTC
Well, I need some time. Currently native buildworld doesn't complete due to this --secure-plt in bsd.cpu.mk. The gen* helpers die during building system gcc.
Comment 5 Mark Millard 2019-07-28 20:07:30 UTC
(In reply to Justin Hibbits from comment #3)

For system-clang-b-ased cross build contexts,
possibly including powerpc64 building its lib32,
what I've observed follows (in hopes that it
will help track things down).

For lld based ld . . .

From what I've seen via trying cc/c++ commands
that target linking for 32-bit powerpc, with with
-### added, the linker command has the likes of:

"-m" "elf32ppc_fbsd"

and I do not see anything else that it is given
on the command line that directly indicates a
32-bit powerpc context.

So my guess is that the linker needs to enable
allowing the --secure-plt option based on the
likes of that -m elf32ppc_fbsd .

lld does not do this yet and rejects the

As for modern gnu ld . . .

Modern gnu ld does allow the --secure-plt (as
does the historical FreeBSD system binutils).

But, unlike the old FreeBSD binutils, modern
gnu ld returns an error code when --secure-plt
was specified but the linker reports the likes

/usr/local/powerpc64-unknown-freebsd13.0/bin/ld: bss-plt forced due to ...

(and it does report such during builds when
system-clang is used).

The non-zero return status from ld stops the
build when such a modern gnu ld is used.

The easiest way to see many of using bss-plt
messages is to search building with system clang
and the historical freebsd binutils:

Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/crt1.o
Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/crtbeginS.o
Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(fixdfdi.o)
Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(fixsfdi.o)
Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(floatdidf.o)
Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(floatdisf.o)
Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(floatundidf.o)
Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(floatundisf.o)
Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(moddi3.o)
Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(umoddi3.o)
Using bss-plt due to accf_http.kld
Using bss-plt due to acl_nfs4.kld
Using bss-plt due to acl_posix1e.kld
Using bss-plt due to if_ae.kld
Using bss-plt due to if_age.kld
Using bss-plt due to reloc.o

Note: This stopped where it did because of:

--- agp.ko.full ---
ld: agp.kld(.text+0x37a4): R_PPC_PLTREL24 reloc against local symbol
agp.kld: could not read symbols: Bad value
*** [agp.ko.full] Error code 1

so there might be more places.

(I'll not here get into why gnu ld decides that
bss-plt is to be used for the clang output.)

Between the two types of modern ld's, I've not managed
a system-clang based 32-bit powerpc cross build since
the secure-plt switch was made.
Comment 6 Mark Millard 2019-07-31 23:50:09 UTC
(In reply to Mark Millard from comment #5)

I finally got around to trying to buildworld
buildkernel targeting powerpc64 via system-clang
(amd64 -> powerpc64 cross build).

Using lld complained about ELFv1 not being
supported, as expected if I understand the
status correctly.

It got the following trying to build lib32
materials when using devel/powerpc64-binutils
and its gnu ld instead:

--- libc.so.7.full ---
building shared library libc.so.7
/usr/local/powerpc64-unknown-freebsd13.0/bin/ld: bss-plt forced due to /usr/obj/powerpc64vtsc_clang_altbinutils-oldunwind/powerpc.powerpc64/usr/src/powerpc.powerpc64/obj-lib32/tmp/usr/lib32/crtbeginS.o
cc: error: linker command failed with exit code 1 (use -v to see invocation)
*** [libc.so.7.full] Error code 1

(The same type of problem as when directly
targeting 32-bit powerpc.)

It also got the following shortly before the above

--- Version.map ---
cpp: warning: argument unused during compilation: '-L/usr/obj/powerpc64vtsc_clang_altbinutils-oldunwind/powerpc.powerpc64/usr/src/powerpc.powerpc64/obj-lib32/tmp/usr/lib32' [-Wunused-command-line-argument]

As for the what stopped it: WITHOUT_LIB32= seems
to avoid the issue.
Comment 7 Andreas Tobler freebsd_committer 2019-09-25 20:50:45 UTC
Created attachment 207810 [details]
upstream patch

This is the patch I most probably will commit upstream. Feedback welcome.
Comment 8 John Baldwin freebsd_committer freebsd_triage 2020-07-26 14:34:50 UTC
FYI, I am getting the bss-plt errors trying to build powerpc with powerpc-gcc9 from the devel/freebsd-gcc9 port.  I didn't see any patch files for the lang/gcc9* or gcc10 ports, so not sure if this has been resolved in an upstream patch yet for GCC on powerpc?
Comment 9 Andreas Tobler freebsd_committer 2020-07-26 19:25:53 UTC
The upstream patch was applied to gcc10. I am not able to merge to gcc9 since I have no working powerpc anymore. You can take the upstream patch to the ports files section and try it. I expect it to work.
If it works, can you give me a feedback and I can try to merge it to gcc9 upstream. Then I can spin port patches which can be used until the upstream gcc9 gets updated.
Thanks and sorry for the delay.
Comment 10 John Baldwin freebsd_committer freebsd_triage 2020-08-23 23:33:43 UTC
I did try back porting the patch to devel/freebsd-gcc9 which did work, but so did adding -msecure-plt to CFLAGS.gcc in share/mk/bsd.cpu.mk.  I think I will go with the latter patch as it is simpler.  Thanks!