Created attachment 205535 [details] Patch unconditionally enabling secure-PLT for FreeBSD/powerpc* The attached patch, probably incomplete, enables secure PLT for powerpc* (powerpc, powerpcspe, powerpc64). The "correct" way would probably be to enable it only for 12 and later (12 will be getting secure-PLT in base after a 1 month burn-in period in head).
Andreas, what is your take? IMO this should go upstream (GCC 10, ideally also GCC 9) first.
Hm, the linker option --secure-plt is not known to 64-bit ld, do I miss something?
Andreas, I see the same thing. secure-plt really should be configured, in the specs config, as only enabled if -m32 is specified, since it's *only* for 32-bit powerpc. So maybe that can be done by changing secureplt.h? I have no idea.
Well, I need some time. Currently native buildworld doesn't complete due to this --secure-plt in bsd.cpu.mk. The gen* helpers die during building system gcc.
(In reply to Justin Hibbits from comment #3) For system-clang-b-ased cross build contexts, possibly including powerpc64 building its lib32, what I've observed follows (in hopes that it will help track things down). For lld based ld . . . From what I've seen via trying cc/c++ commands that target linking for 32-bit powerpc, with with -### added, the linker command has the likes of: "-m" "elf32ppc_fbsd" and I do not see anything else that it is given on the command line that directly indicates a 32-bit powerpc context. So my guess is that the linker needs to enable allowing the --secure-plt option based on the likes of that -m elf32ppc_fbsd . lld does not do this yet and rejects the option. As for modern gnu ld . . . Modern gnu ld does allow the --secure-plt (as does the historical FreeBSD system binutils). But, unlike the old FreeBSD binutils, modern gnu ld returns an error code when --secure-plt was specified but the linker reports the likes of: /usr/local/powerpc64-unknown-freebsd13.0/bin/ld: bss-plt forced due to ... (and it does report such during builds when system-clang is used). The non-zero return status from ld stops the build when such a modern gnu ld is used. The easiest way to see many of using bss-plt messages is to search building with system clang and the historical freebsd binutils: Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/crt1.o Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/crtbeginS.o Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(fixdfdi.o) Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(fixsfdi.o) Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(floatdidf.o) Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(floatdisf.o) Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(floatundidf.o) Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(floatundisf.o) Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(moddi3.o) Using bss-plt due to /usr/obj/powerpcvtsc_clang/powerpc.powerpc/usr/src/powerpc.powerpc/tmp/usr/lib/libgcc.a(umoddi3.o) Using bss-plt due to accf_http.kld Using bss-plt due to acl_nfs4.kld Using bss-plt due to acl_posix1e.kld Using bss-plt due to if_ae.kld Using bss-plt due to if_age.kld Using bss-plt due to reloc.o Note: This stopped where it did because of: --- agp.ko.full --- ld: agp.kld(.text+0x37a4): R_PPC_PLTREL24 reloc against local symbol agp.kld: could not read symbols: Bad value *** [agp.ko.full] Error code 1 so there might be more places. (I'll not here get into why gnu ld decides that bss-plt is to be used for the clang output.) Between the two types of modern ld's, I've not managed a system-clang based 32-bit powerpc cross build since the secure-plt switch was made.
(In reply to Mark Millard from comment #5) I finally got around to trying to buildworld buildkernel targeting powerpc64 via system-clang (amd64 -> powerpc64 cross build). Using lld complained about ELFv1 not being supported, as expected if I understand the status correctly. It got the following trying to build lib32 materials when using devel/powerpc64-binutils and its gnu ld instead: --- libc.so.7.full --- building shared library libc.so.7 /usr/local/powerpc64-unknown-freebsd13.0/bin/ld: bss-plt forced due to /usr/obj/powerpc64vtsc_clang_altbinutils-oldunwind/powerpc.powerpc64/usr/src/powerpc.powerpc64/obj-lib32/tmp/usr/lib32/crtbeginS.o cc: error: linker command failed with exit code 1 (use -v to see invocation) *** [libc.so.7.full] Error code 1 (The same type of problem as when directly targeting 32-bit powerpc.) It also got the following shortly before the above error: --- Version.map --- cpp: warning: argument unused during compilation: '-L/usr/obj/powerpc64vtsc_clang_altbinutils-oldunwind/powerpc.powerpc64/usr/src/powerpc.powerpc64/obj-lib32/tmp/usr/lib32' [-Wunused-command-line-argument] As for the what stopped it: WITHOUT_LIB32= seems to avoid the issue.
Created attachment 207810 [details] upstream patch This is the patch I most probably will commit upstream. Feedback welcome.
FYI, I am getting the bss-plt errors trying to build powerpc with powerpc-gcc9 from the devel/freebsd-gcc9 port. I didn't see any patch files for the lang/gcc9* or gcc10 ports, so not sure if this has been resolved in an upstream patch yet for GCC on powerpc?
The upstream patch was applied to gcc10. I am not able to merge to gcc9 since I have no working powerpc anymore. You can take the upstream patch to the ports files section and try it. I expect it to work. If it works, can you give me a feedback and I can try to merge it to gcc9 upstream. Then I can spin port patches which can be used until the upstream gcc9 gets updated. Thanks and sorry for the delay.
I did try back porting the patch to devel/freebsd-gcc9 which did work, but so did adding -msecure-plt to CFLAGS.gcc in share/mk/bsd.cpu.mk. I think I will go with the latter patch as it is simpler. Thanks!
Andreas pushed this upstream into GCC 10 (and later), and GCC 8 is end of life with GCC 10 being the default in the Ports Collection, so let's close this report (which has not seen any activity for 14 months).