Created attachment 205535 [details]
Patch unconditionally enabling secure-PLT for FreeBSD/powerpc*
The attached patch, probably incomplete, enables secure PLT for powerpc* (powerpc, powerpcspe, powerpc64). The "correct" way would probably be to enable it only for 12 and later (12 will be getting secure-PLT in base after a 1 month burn-in period in head).
Andreas, what is your take?
IMO this should go upstream (GCC 10, ideally also GCC 9) first.
Hm, the linker option --secure-plt is not known to 64-bit ld, do I miss something?
Andreas, I see the same thing. secure-plt really should be configured, in the specs config, as only enabled if -m32 is specified, since it's *only* for 32-bit powerpc. So maybe that can be done by changing secureplt.h? I have no idea.
Well, I need some time. Currently native buildworld doesn't complete due to this --secure-plt in bsd.cpu.mk. The gen* helpers die during building system gcc.
(In reply to Justin Hibbits from comment #3)
For system-clang-b-ased cross build contexts,
possibly including powerpc64 building its lib32,
what I've observed follows (in hopes that it
will help track things down).
For lld based ld . . .
From what I've seen via trying cc/c++ commands
that target linking for 32-bit powerpc, with with
-### added, the linker command has the likes of:
and I do not see anything else that it is given
on the command line that directly indicates a
32-bit powerpc context.
So my guess is that the linker needs to enable
allowing the --secure-plt option based on the
likes of that -m elf32ppc_fbsd .
lld does not do this yet and rejects the
As for modern gnu ld . . .
Modern gnu ld does allow the --secure-plt (as
does the historical FreeBSD system binutils).
But, unlike the old FreeBSD binutils, modern
gnu ld returns an error code when --secure-plt
was specified but the linker reports the likes
/usr/local/powerpc64-unknown-freebsd13.0/bin/ld: bss-plt forced due to ...
(and it does report such during builds when
system-clang is used).
The non-zero return status from ld stops the
build when such a modern gnu ld is used.
The easiest way to see many of using bss-plt
messages is to search building with system clang
and the historical freebsd binutils:
Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/crt1.o
Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/crtbeginS.o
Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(fixdfdi.o)
Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(fixsfdi.o)
Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(floatdidf.o)
Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(floatdisf.o)
Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(floatundidf.o)
Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(floatundisf.o)
Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(moddi3.o)
Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(umoddi3.o)
Using bss-plt due to accf_http.kld
Using bss-plt due to acl_nfs4.kld
Using bss-plt due to acl_posix1e.kld
Using bss-plt due to if_ae.kld
Using bss-plt due to if_age.kld
Using bss-plt due to reloc.o
Note: This stopped where it did because of:
--- agp.ko.full ---
ld: agp.kld(.text+0x37a4): R_PPC_PLTREL24 reloc against local symbol
agp.kld: could not read symbols: Bad value
*** [agp.ko.full] Error code 1
so there might be more places.
(I'll not here get into why gnu ld decides that
bss-plt is to be used for the clang output.)
Between the two types of modern ld's, I've not managed
a system-clang based 32-bit powerpc cross build since
the secure-plt switch was made.
(In reply to Mark Millard from comment #5)
I finally got around to trying to buildworld
buildkernel targeting powerpc64 via system-clang
(amd64 -> powerpc64 cross build).
Using lld complained about ELFv1 not being
supported, as expected if I understand the
It got the following trying to build lib32
materials when using devel/powerpc64-binutils
and its gnu ld instead:
--- libc.so.7.full ---
building shared library libc.so.7
/usr/local/powerpc64-unknown-freebsd13.0/bin/ld: bss-plt forced due to /usr/obj/powerpc64vtsc_clang_altbinutils-oldunwind/powerpc.powerpc64/usr/src/powerpc.powerpc64/obj-lib32/tmp/usr/lib32/crtbeginS.o
cc: error: linker command failed with exit code 1 (use -v to see invocation)
*** [libc.so.7.full] Error code 1
(The same type of problem as when directly
targeting 32-bit powerpc.)
It also got the following shortly before the above
--- Version.map ---
cpp: warning: argument unused during compilation: '-L/usr/obj/powerpc64vtsc_clang_altbinutils-oldunwind/powerpc.powerpc64/usr/src/powerpc.powerpc64/obj-lib32/tmp/usr/lib32' [-Wunused-command-line-argument]
As for the what stopped it: WITHOUT_LIB32= seems
to avoid the issue.
Created attachment 207810 [details]
This is the patch I most probably will commit upstream. Feedback welcome.
FYI, I am getting the bss-plt errors trying to build powerpc with powerpc-gcc9 from the devel/freebsd-gcc9 port. I didn't see any patch files for the lang/gcc9* or gcc10 ports, so not sure if this has been resolved in an upstream patch yet for GCC on powerpc?
The upstream patch was applied to gcc10. I am not able to merge to gcc9 since I have no working powerpc anymore. You can take the upstream patch to the ports files section and try it. I expect it to work.
If it works, can you give me a feedback and I can try to merge it to gcc9 upstream. Then I can spin port patches which can be used until the upstream gcc9 gets updated.
Thanks and sorry for the delay.
I did try back porting the patch to devel/freebsd-gcc9 which did work, but so did adding -msecure-plt to CFLAGS.gcc in share/mk/bsd.cpu.mk. I think I will go with the latter patch as it is simpler. Thanks!