From patchwork Sat Sep 8 14:41:39 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Romain Naour X-Patchwork-Id: 967635 Return-Path: X-Original-To: incoming-buildroot@patchwork.ozlabs.org Delivered-To: patchwork-incoming-buildroot@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=busybox.net (client-ip=140.211.166.138; helo=whitealder.osuosl.org; envelope-from=buildroot-bounces@busybox.net; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="TNeilM8F"; dkim-atps=neutral Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 426xpX52GPz9s3C for ; Sun, 9 Sep 2018 00:41:55 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id 54808861A3; Sat, 8 Sep 2018 14:41:50 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 91ZH-bZitk1D; Sat, 8 Sep 2018 14:41:47 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by whitealder.osuosl.org (Postfix) with ESMTP id 3354086092; Sat, 8 Sep 2018 14:41:47 +0000 (UTC) X-Original-To: buildroot@lists.busybox.net Delivered-To: buildroot@osuosl.org Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by ash.osuosl.org (Postfix) with ESMTP id 971CF1BFCC3 for ; Sat, 8 Sep 2018 14:41:46 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 9454185626 for ; Sat, 8 Sep 2018 14:41:46 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xKGDXwL4GqKR for ; Sat, 8 Sep 2018 14:41:45 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail-wm0-f65.google.com (mail-wm0-f65.google.com [74.125.82.65]) by fraxinus.osuosl.org (Postfix) with ESMTPS id 362CB84EF6 for ; Sat, 8 Sep 2018 14:41:45 +0000 (UTC) Received: by mail-wm0-f65.google.com with SMTP id j25-v6so1767519wmc.1 for ; Sat, 08 Sep 2018 07:41:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=K0t7fVLZ2n8kSo58iHvwq0jc/awYets+JxBliWZu9v0=; b=TNeilM8Fdy6T0qldQZO5WF7jVFHFytUkMOphWu5nfDYwo+KN1RrO2Z4RCzrdi7RHpo bNN2J/O95cTmCBRqiQDaMV8evv1sg2GFHkgcS1d1WqkThV7bdkt61bl4gB8QnqeggECP 0bTjAeOE4Cl1HDw0+/USeW7YaRldmNJEtOJjEMNIHMTxTHVk5x8DG8zdlriUKmw91oQy uVTCeMYA0ZCCYb79rLtzWvlc5xBa6TF3CzbRU5/wPTWRPovlKlWA1ysdCM/m8f6ZzmkZ CyYRN0sMI9VFV65ReRaZGXVpFVeHayDquKxVUw5IQi7E0B4HdgXdSsudHeU8rSsUtJPH OVFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=K0t7fVLZ2n8kSo58iHvwq0jc/awYets+JxBliWZu9v0=; b=XvvsCtgtjiFCObY2oARzS3HqxX9HEUNbkFWgfAg7tiOU+FznP0cSlbBsARrPTcfDxq W5ATXqLngpsZHpoiI61ksGE/mtUXvHyrD+eCPxj0jIMuNqOWfbNHGdZ2eNqo3WxjFUk1 zdRMGJX6bLYA+4En3IH0ODnC9rkZC/E/lB5+75fQOiABEtCuvwy2kK0RBKa66J7kY8K1 nS2S14TeRa4F1g0dc/5q/ZI/HoV62jXQaIqbxLc9B6Rjn6CuSN5xpUDxfsI1FE/icO37 zKsmTXTpp4noPaBMcmg9D7yqD6g6fxaNfH235TAXXwbckgwdDMlIAmLJI9CQ6oTibKJt SY3A== X-Gm-Message-State: APzg51C4LXbMSM0HWHmxsYdXALMjVyvix7NbiEYkgTPhsGZYY3sM/XnS g0FTEOKTi7s8l+44T28cNySUH2SK X-Google-Smtp-Source: ANB0VdboWkIPuqwX02qoHxSOScZ55jsZ6GdM4ol1f4xjxe4tbTM7mWr4UN+8LYvtrBzTjkbliQ0PWg== X-Received: by 2002:a1c:e581:: with SMTP id c123-v6mr8222314wmh.85.1536417703047; Sat, 08 Sep 2018 07:41:43 -0700 (PDT) Received: from adeos.home (2a01cb000577e4007362e7db4e8430b1.ipv6.abo.wanadoo.fr. [2a01:cb00:577:e400:7362:e7db:4e84:30b1]) by smtp.gmail.com with ESMTPSA id w17-v6sm7691905wmc.43.2018.09.08.07.41.41 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Sat, 08 Sep 2018 07:41:42 -0700 (PDT) From: Romain Naour To: buildroot@buildroot.org Date: Sat, 8 Sep 2018 16:41:39 +0200 Message-Id: <20180908144139.20353-1-romain.naour@gmail.com> X-Mailer: git-send-email 2.14.4 Subject: [Buildroot] [PATCH v2] SSP: disable ssp support if CFI support in Binutils is missing X-BeenThere: buildroot@busybox.net X-Mailman-Version: 2.1.24 Precedence: list List-Id: Discussion and development of buildroot List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Romain Naour , Thomas Petazzoni MIME-Version: 1.0 Errors-To: buildroot-bounces@busybox.net Sender: "buildroot" As reported by [1], SSP support is missing in the Buildroot toolchain for microblaze even if it's requested by selecting BR2_TOOLCHAIN_HAS_SSP config option. In Buildroot, we are using libssp provided by the C library (Glibc, musl, uClibc-ng) when available. We are not using libssp from gcc. So for a microblaze glibc based toolchain, the SSP support is enabled unconditionally by a select BR2_TOOLCHAIN_HAS_SSP. BR2_microblazeel=y BR2_TOOLCHAIN_BUILDROOT_GLIBC=y BR2_KERNEL_HEADERS_4_14=y BR2_BINUTILS_VERSION_2_30_X=y BR2_GCC_VERSION_8_X=y BR2_TOOLCHAIN_BUILDROOT_CXX=y While building the toolchain, we are building host-binutils which provide "as" (assembler) and host-gcc-initial wich provide a minimal cross gcc (C only cross-compiler without any C library). When SSP support is requested, gcc_cv_libc_provides_ssp=yes is added to the make command line (see [2] for full details) With this setting, the SSP support is requested but it's not available in the end and the toochain build succeed. When the microblaze toolchain is imported to Biuldroot (2018.05) as external toolchain with BR2_TOOLCHAIN_EXTERNAL_HAS_SSP set, the build stop with : "SSP support not available in this toolchain, please disable BR2_TOOLCHAIN_EXTERNAL_HAS_SSP" The test is doing the following command line: echo 'void main(){}' | [...]/host/bin/microblazeel-linux-gcc.br_real -Werror -fstack-protector -x c - -o [...]/build/.br-toolchain-test.tmp cc1: error: -fstack-protector not supported for this target [-Werror] When we look at the gcc-final log file (config.log) we can see this error several time when using the minimal gcc (from host-gcc-initial). So Why the minimal gcc doesn't support SSP? When we look at the gcc-initial log file (config.log) we can see an error with 'as': configure:23194: checking assembler for cfi directives configure:23209: [...]microblazeel-buildroot-linux-gnu/bin/as -o conftest.o conftest.s >&5 conftest.s: Assembler messages: conftest.s:2: Error: CFI is not supported for this target conftest.s:3: Error: CFI is not supported for this target conftest.s:4: Error: CFI is not supported for this target conftest.s:5: Error: CFI is not supported for this target conftest.s:6: Error: CFI is not supported for this target conftest.s:7: Error: CFI is not supported for this target configure:23212: $? = 1 configure: failed program was .text .cfi_startproc .cfi_offset 0, 0 .cfi_same_value 1 .cfi_def_cfa 1, 2 .cfi_escape 1, 2, 3, 4, 5 .cfi_endproc This is the only relevant difference compared to a nios2 toolchain where libssp is enabled and available (nios2 is an example). "CFI" stand for "Control Flow Integrity" and it seems that SSP support requires CFI target support (see [3] for some explanation). The SSP support seems to depends on CFI support, but the toolchain infrastructure is not detailed enough to handle the CFI dependency. The NiosII toolchains built with binutils < 2.30 are also affected by this issue. This patch improve the toolchain infrastructure by adding a new BR2_PACKAGE_HOST_BINUTILS_SUPPORTS_CFI blind option Disable SSP support for microblaze entirely. Disable SSP support for nios2 only with Binutils < 2.30. Fixes: https://gitlab.com/free-electrons/toolchains-builder/-/jobs/72006389 [1] https://gitlab.com/free-electrons/toolchains-builder/issues/1 [2] https://git.buildroot.net/buildroot/tree/package/gcc/gcc.mk?h=2018.05#n275 [3] https://grsecurity.net/rap_faq.php Signed-off-by: Romain Naour Cc: Thomas Petazzoni --- v2: Add BR2_PACKAGE_HOST_BINUTILS_SUPPORTS_CFI option (Thomas) Handle case with niosII and binutils < 2.30. --- package/binutils/Config.in.host | 6 ++++++ package/glibc/Config.in | 2 +- package/musl/Config.in | 3 ++- package/uclibc/Config.in | 1 + 4 files changed, 10 insertions(+), 2 deletions(-) diff --git a/package/binutils/Config.in.host b/package/binutils/Config.in.host index 21dc84e498..102937c5f6 100644 --- a/package/binutils/Config.in.host +++ b/package/binutils/Config.in.host @@ -1,5 +1,11 @@ comment "Binutils Options" +config BR2_PACKAGE_HOST_BINUTILS_SUPPORTS_CFI + bool + default y + depends on !BR2_microblaze \ + && (!BR2_nios2 || !BR2_BINUTILS_VERSION_2_28_X && !BR2_BINUTILS_VERSION_2_29_X) + choice prompt "Binutils Version" default BR2_BINUTILS_VERSION_2_28_X if BR2_ARM_INSTRUCTIONS_THUMB diff --git a/package/glibc/Config.in b/package/glibc/Config.in index 57a2e833d2..1dca96b3b7 100644 --- a/package/glibc/Config.in +++ b/package/glibc/Config.in @@ -4,6 +4,6 @@ config BR2_PACKAGE_GLIBC bool default y select BR2_PACKAGE_LINUX_HEADERS - select BR2_TOOLCHAIN_HAS_SSP + select BR2_TOOLCHAIN_HAS_SSP if BR2_PACKAGE_HOST_BINUTILS_SUPPORTS_CFI endif diff --git a/package/musl/Config.in b/package/musl/Config.in index bedc50cd45..67e9e78a14 100644 --- a/package/musl/Config.in +++ b/package/musl/Config.in @@ -4,6 +4,7 @@ config BR2_PACKAGE_MUSL depends on BR2_TOOLCHAIN_USES_MUSL select BR2_PACKAGE_LINUX_HEADERS # SSP broken on i386/ppc: http://www.openwall.com/lists/musl/2016/12/04/2 - select BR2_TOOLCHAIN_HAS_SSP if !(BR2_i386 || BR2_powerpc) + select BR2_TOOLCHAIN_HAS_SSP if BR2_PACKAGE_HOST_BINUTILS_SUPPORTS_CFI \ + && !(BR2_i386 || BR2_powerpc) # Compatibility headers: cdefs.h, queue.h select BR2_PACKAGE_MUSL_COMPAT_HEADERS diff --git a/package/uclibc/Config.in b/package/uclibc/Config.in index a566881852..de2885bc92 100644 --- a/package/uclibc/Config.in +++ b/package/uclibc/Config.in @@ -70,6 +70,7 @@ config BR2_PTHREAD_DEBUG config BR2_TOOLCHAIN_BUILDROOT_USE_SSP bool "Enable stack protection support" + depends on BR2_PACKAGE_HOST_BINUTILS_SUPPORTS_CFI select BR2_TOOLCHAIN_HAS_SSP help Enable stack smashing protection support using GCCs