glibc-2.13 failed to build with gcc-4.6 on x86_64-pc-linux-gnu-gcc -m32 ../sysdeps/unix/sysv/linux/futimesat.c -c -std=gnu99 -fgnu89-inline -O2 -Wall -Winline -Wwrite-strings -fmerge-all-constants -fno-strict-aliasing -mar ch=native -mtune=native -pipe -Wstrict-prototypes -mpreferred-stack-boundary=2 -fPIC -Wa,-mtune=i686 -I../include -I/var/tmp/portage/sys-libs/glibc-2.13-r2/work/build-x86-x86_64-pc-linux-gnu-nptl/misc -I/var/tmp/portage/sys-libs/glibc-2.13-r2/work/build-x86-x86_64-pc-linux-gnu-nptl -I../sysdeps/i386/elf -I../nptl/sysdeps/unix/sysv/linux/i386/i686 -I../sysdeps/unix/sysv/linux/i386/i686 -I../nptl/sysdeps/unix/sysv/linux/i386 -I../sysdeps/unix/sysv/linux/i386 -I../nptl/sysdeps/unix/sysv/linux -I../nptl/sysdeps/pthread -I../sysdeps/pthread -I../ports/sysdeps/unix/sysv/linux -I../sysdeps/unix/sysv/linux -I../sysdeps/gnu -I../sysdeps/unix/common -I../sysdeps/unix/mman -I../sysdeps/unix/inet -I../ports/sysdeps/unix/sysv/i386 -I../sysdeps/unix/sysv/i386 -I../nptl/sysdeps/unix/sysv -I../ports/sysdeps/unix/sysv -I../sysdeps/unix/sysv -I../sysdeps/unix/i386 -I../nptl/sysdeps/unix -I../ports/sysdeps/unix -I../sysdeps/unix -I../sysdeps/posix -I../sysdeps/i386/i686/fpu -I../sysdeps/i386/i686/multiarch -I../nptl/sysdeps/i386/i686 -I../sysdeps/i386/i686 -I../sysdeps/i386/i486 -I../nptl/sysdeps/i386/i486 -I../sysdeps/i386/fpu -I../nptl/sysdeps/i386 -I../sysdeps/i386 -I../sysdeps/wordsize-32 -I../sysdeps/ieee754/ldbl-96 -I../sysdeps/ieee754/dbl-64 -I../sysdeps/ieee754/flt-32 -I../sysdeps/ieee754 -I../sysdeps/generic/elf -I../sysdeps/generic -I../nptl -I../ports -I.. -I../libio -I. -nostdinc -isystem /usr/lib/gcc/x86_64-pc-linux-gnu/4.6.0/include -isystem /usr/lib/gcc/x86_64-pc-linux-gnu/4.6.0/include-fixed -isystem /usr/include -D_LIBC_REENTRANT -include ../include/libc-symbols.h -DPIC -DSHARED -U_FORTIFY_SOURCE -U_FORTIFY_SOURCE -U_FORTIFY_SOURCE -o /var/tmp/portage/sys-libs/glibc-2.13-r2/work/build-x86-x86_64-pc-linux-gnu-nptl/misc/futimesat.os -MD -MP -MF /var/tmp/portage/sys-libs/glibc-2.13-r2/work/build-x86-x86_64-pc-linux-gnu-nptl/misc/futimesat.os.dt -MT /var/tmp/portage/sys-libs/glibc-2.13-r2/work/build-x86-x86_64-pc-linux-gnu-nptl/misc/futimesat.os In file included from ../sysdeps/unix/sysv/linux/syslog.c:10:0: ../misc/syslog.c: In function ‘__vsyslog_chk’: ../misc/syslog.c:144:9: warning: variable ‘prioff’ set but not used [-Wunused-but-set-variable] In file included from ../sysdeps/unix/sysv/linux/syslog.c:10:0: ../misc/syslog.c:123:28: sorry, unimplemented: inlining failed in call to ‘syslog’: function body not available ../misc/syslog.c:155:9: sorry, unimplemented: called from here make[2]: *** [/var/tmp/portage/sys-libs/glibc-2.13-r2/work/build-x86-x86_64-pc-linux-gnu-nptl/misc/syslog.os] Error 1 make[2]: *** Waiting for unfinished jobs.... make[2]: Leaving directory `/var/tmp/portage/sys-libs/glibc-2.13-r2/work/glibc-2.13/misc' make[1]: *** [misc/subdir_lib] Error 2 make[1]: Leaving directory `/var/tmp/portage/sys-libs/glibc-2.13-r2/work/glibc-2.13' $ emerge --info Portage 2.2.0_alpha29 (default/linux/amd64/10.0/desktop/kde, gcc-4.6.0, glibc-2.13-r2, 2.6.39-rc1-gentoo x86_64) ================================================================= System uname: Linux-2.6.39-rc1-gentoo-x86_64-Intel-R-_Core-TM-_i5_CPU_M_520_@_2.40GHz-with-gentoo-2.0.2 Timestamp of tree: Sun, 03 Apr 2011 09:30:01 +0000 ccache version 3.1.4 [enabled] app-shells/bash: 4.2_p8 dev-java/java-config: 2.1.11-r3 dev-lang/python: 2.7.1-r1, 3.1.3-r1 dev-util/ccache: 3.1.4 dev-util/cmake: 2.8.4 sys-apps/baselayout: 2.0.2 sys-apps/openrc: 0.8.0 sys-apps/sandbox: 2.5 sys-devel/autoconf: 2.13, 2.68 sys-devel/automake: 1.9.6-r3, 1.10.3, 1.11.1 sys-devel/binutils: 2.21 sys-devel/gcc: 4.6.0 sys-devel/gcc-config: 1.4.1 sys-devel/libtool: 2.4-r1 sys-devel/make: 3.82 virtual/os-headers: 2.6.38 (sys-kernel/linux-headers) Repositories: gentoo kde x11 science sunrise alexxy gamerlay-stable rion bicatali aidecoe qting-edge gcc-porting Installed sets: ACCEPT_KEYWORDS="amd64 ~amd64" ACCEPT_LICENSE="* -@EULA" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -pipe -march=native -mtune=native -mfpmath=sse -msse4 -maes -floop-interchange -floop-strip-mine -floop-block -floop-parallelize-all" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/config /usr/share/gnupg/qualified.txt /usr/share/openvpn/easy-rsa /usr/share/themes/oxygen-gtk/gtk-2.0" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/splash /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c" CXXFLAGS="-O2 -pipe -march=native -mtune=native -mfpmath=sse -msse4 -maes -floop-interchange -floop-strip-mine -floop-block -floop-parallelize-all" DISTDIR="/usr/portage/distfiles" FEATURES="assume-digests binpkg-logs candy ccache distlocks fixlafiles fixpackages metadata-transfer news parallel-fetch preserve-libs protect-owned sandbox sfperms sign strict unknown-features-warn unmerge-logs unmerge-orphans userfetch webrsync-gpg" FFLAGS="-O2 -pipe -march=native -mtune=native -mfpmath=sse -msse4 -maes -floop-interchange -floop-strip-mine -floop-block -floop-parallelize-all" GENTOO_MIRRORS="http://distfiles.gentoo.org" LANG="ru_RU.UTF-8" LDFLAGS="-Wl,-O1,--hash-style=gnu,--sort-common,--as-needed" LINGUAS="ru en" MAKEOPTS="--jobs --load-average=5" PKGDIR="/usr/portage/packages" PORTAGE_COMPRESS="xz" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/var/lib/layman/kde /var/lib/layman/x11 /var/lib/layman/science /var/lib/layman/sunrise /var/lib/layman/alexxy /var/lib/layman/gamerlay /var/lib/layman/rion /var/lib/layman/bicatali /var/lib/layman/aidecoe /var/lib/layman/qting-edge /var/lib/layman/gcc-porting" SYNC="rsync://rsync.gentoo.org/gentoo-portage" USE="64bit X a52 aac acl acpi addressbook alsa amd64 attrib audit bash-completion bazaar berkdb blas bluetooth branding bzip2 cairo caps chm cli clucene connection-sharing consolekit context cracklib crypt cups cvs cxx cyrillic dbus declarative detex device-mapper dhcp dhcpcd dirac disk-partition djvu dri dts dvd dvdr dvi2tty dvipdfm eap-tls ebook emboss enca encode exif expoblending extensions external-ffmpeg extra extras faac faad fam fbcondecor fbsplash ffmpeg fftw firefox flac fontconfig fortran games gdbm gdu gensplash geolocation gif gimp git gles gmp gnutls gphoto2 gpm gps gpu graphics graphite graphviz gs gstreamer gtk hdaps hdf5 health humanities iconsets iconv icu id3 id3tag imagemagick inotify iproute2 ipv6 jadetex java jingle jpeg kde kerberos kpathsea lapack laptop lastfm latex latex3 lcms ldap lensfun libnotify libv4l2 lm_sensors lto luatex lvm lzma mad matroska mercurial mikmod mktemp mmx mng modules mp3 mp4 mpeg mplayer msms mudflap multilib multimedia music mysql ncurses netlink networkmanager nls nptl nptlonly nsplugin ntp ogg omega openexr opengl openmp oscar otr pam pam_ssh pango pcre pdf perl phonon plasma plotutils plugins pm-utils pnat png policykit povray ppds pppd ps pstricks publishers pulseaudio python qemu qt qt3support qt4 rar rdesktop readline realtime redeyes resolvconf rtsp samba schroedinger science script sdk sdl semantic-desktop session skins skype smp speex spell spice sse sse2 sse3 sse4 ssh ssl ssse3 stars startup-notification stream subversion svg symlink sysfs syslog systemd taglib tcpd tex4ht theora threads thumbnail tiff tk tools truetype twolame udev unicode upnp usb utils v4l v4l2 vaapi vde vhost-net video videos vim vim-syntax vlc vlm vnc vorbis vpx webkit wifi wimax wmf x264 xattr xcb xen xetex xindy xml xmlpatterns xmp xorg xscreensaver xulrunner xv xvid xvmc zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" DRACUT_MODULES="btrfs crypt gensplash lvm syslog plymouth biosdevname caps xen" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="evdev synaptics" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="ru en" PHP_TARGETS="php5-3" QEMU_SOFTMMU_TARGETS="arm i386 mips mips64 mips64el mipsel x86_64" QEMU_USER_TARGETS="arm mips mipsel x86_64" RUBY_TARGETS="ruby18" USERLAND="GNU" VIDEO_CARDS="intel i965" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Created attachment 268321 [details] /var/tmp/portage/sys-libs/glibc-2.13-r2/temp/build.log.gz gzipped build.log
Upstream or is gentoo related?
looks to me like -U_FORTIFY_SOURCE isnt working in disabling fortify source ...
For some reason it seems to split it up now and doesn't match the spec pattern we were using. $ echo "" | gcc -E -v -U_FORTIFY_SOURCE ... /usr/libexec/gcc/x86_64-unknown-linux-gnu/4.6.0-pre9999/cc1 -E -quiet -v -U _FORTIFY_SOURCE - -mtune=generic -march=x86-64 ... Anyways I'm testing a patch.
Fixed in 4.6.0 p1.1. http://sources.gentoo.org/viewcvs.py/gentoo/src/patchsets/gcc/4.6.0/gentoo/10_all_default-fortify-source.patch?r1=1.1&r2=1.2
i dont think we want to go that route. the point of doing it via specs is that people are free to use their own custom specs and bypass the whole thing.
okay. i'm not sure why this stopped working though. it looks like -D and -U options are now getting split into two parts: $ gcc-4.6.0 -E -v -D_FORTIFY_SOURCE=2 -U_FORTIFY_SOURCE - < /dev/null COLLECT_GCC_OPTIONS='-E' '-v' '-D' '_FORTIFY_SOURCE=2' '-U' '_FORTIFY_SOURCE' '-mtune=generic' '-march=x86-64' $ gcc-4.5.2 -E -v -D_FORTIFY_SOURCE=2 -U_FORTIFY_SOURCE - < /dev/null COLLECT_GCC_OPTIONS='-E' '-v' '-D_FORTIFY_SOURCE=2' '-U_FORTIFY_SOURCE' '-mtune=generic' '-march=x86-64' but the specs for -D and -U options are %{D*&U*&A*} in both.
http://gcc.gnu.org/PR47236
so if we use `append-cppflags -U _FORTIFY_SOURCE`, things work ?
Nope. $ cat myspec .test: @test @test: echo Test1: %{D*&U*&A*} echo Test2: %{!U_FORTIFY_SOURCE:-D_FORTIFY_SOURCE=2} echo Test3: %{!D_FORTIFY_SOURCE:%{!D_FORTIFY_SOURCE=*:%{!U_FORTIFY_SOURCE:-D_FORTIFY_SOURCE=2}}} $ touch foo.test $ gcc -E -specs myspec -U_FORTIFY_SOURCE -U _FORTIFY_SOURCE foo.test Test1: -U _FORTIFY_SOURCE Test2: -D_FORTIFY_SOURCE=2 Test3: -D_FORTIFY_SOURCE=2 And you can't use spaces or wildcards in the middle of a switch name. Unless I'm missing something obvious it seems impossible to write a spec rule for a preprocessor definition now. I'll bug upstream about it.
http://gcc.gnu.org/ml/gcc-help/2011-04/msg00063.html
hardened: this probably breaks your kernel builds since this and similar stopped working: %{!D__KERNEL__:%{!nopie:%(esp_options_pie) %(esp_link_pie)}}
(In reply to comment #12) > hardened: this probably breaks your kernel builds since this and similar > stopped working: > > %{!D__KERNEL__:%{!nopie:%(esp_options_pie) %(esp_link_pie)}} It does. hard-sixtyfour linux-2.6.38-hardened # cat .config | grep STACKPROTECTOR CONFIG_CC_STACKPROTECTOR=y hard-sixtyfour linux-2.6.38-hardened # make HOSTLD scripts/kconfig/conf ... kernel/bounds.c:1:0: error: code model kernel does not support PIC mode kernel/bounds.c:1:0: error: code model 'kernel' not supported in the 64 bit mode make[1]: *** [kernel/bounds.s] Error 1 make: *** [prepare0] Error 2
i wonder if there's a piece of core logic we can revert for the time being so we get the old behavior. that way we can focus on the other problems without this tripping us up while upstream resolves the issue.
upstream says specs are for internal use only, so yeah, we're on our own.
If we add the preprocessor flags we need to the opt file we can get the behaviour we want but we'd have to add each flag individually. That sucks but if we only have to handle _FORTIFY_SOURCE and __KERNEL__ it might be manageable. I've been messing with the option handling code but haven't found a way around it yet that doesn't break the separated arg case or mess up other options.
Created attachment 269455 [details, diff] 01_all_joined-cpp-defs.patch Force -D and -U to use joined as their canonical forms. As an added bonus this also fixes stuff like "-U _FORTIFY_SOURCE" which never worked before. It survived a testsuite run with no regressions but I'm going to do a system rebuild to make sure I didn't horribly mess something up.
(In reply to comment #16) > If we add the preprocessor flags we need to the opt file we can get the > behaviour we want but we'd have to add each flag individually. That sucks but > if we only have to handle _FORTIFY_SOURCE and __KERNEL__ it might be > manageable. I've been messing with the option handling code but haven't found > a way around it yet that doesn't break the separated arg case or mess up other > options. Zorry and I were thinking of an adhoc solution along these lines, and it does suck handling each manually. A gcc -dumpspecs of hardened gcc gives the following -D and -U options: -D_POSIX_SOURCE -D_REENTRANT -D_MUDFLAP -D_MUDFLAPTH in additon to the -D_FORTIFY_SOURCES -D__KERNEL__. I think we would have to deal with those too.
http://sources.gentoo.org/viewcvs.py/gentoo/src/patchsets/gcc/4.6.0/gentoo/01_all_joined-cpp-defs.patch?rev=1.1&view=markup http://sources.gentoo.org/viewcvs.py/gentoo/src/patchsets/gcc/4.6.0/gentoo/10_all_default-fortify-source.patch?r1=1.2&r2=1.3
Fixed in 4.6.0 p1.2.
*** Bug 365239 has been marked as a duplicate of this bug. ***
Ryan: did you get a chance to mention this cpp patch upstream ?
I didn't, but I don't think it would be accepted. They changed it pretty deliberately to pave the way for further cleanups. So I don't even know if this patch will keep working in 4.7. I didn't use the Ubuntu fortify patch at the time because hardened would still be broken, but maybe it's the way to go.
I'm releasing 4.6.2 with this patch + the fix for gcj in bug #364319. I don't want to carry this patch forward to 4.7. We have an alternative for FORTIFY_SOURCE. Can hardened migrate away from spec rules or do we have to have some kind of whitelist?
(In reply to comment #24) > I'm releasing 4.6.2 with this patch + the fix for gcj in bug #364319. I don't > want to carry this patch forward to 4.7. We have an alternative for > FORTIFY_SOURCE. Can hardened migrate away from spec rules or do we have to > have some kind of whitelist? Can check for __KERNEL__ insted of D__KERNEL__ and it should work so will change that in the patch for hardened gcc 4.7
the ubuntu patch i mentioned (somewhere) doesn't use specs. it uses builtin default defines. shouldn't that work for us ?
I looked through all the hardened spec stuff and it's only -D__KERNEL__ we have to worry about. The rest aren't used as patterns to match, just replacement text. Matching on __KERNEL__ doesn't work either in the tests I just did. Since it's one flag let's just special case it and use the ubuntu patch for fortify. I'll try to roll a new patchset this weekend.
(In reply to comment #27) i think we should send a patch to lkml to add -no-pie/etc... if the compiler supports it ...
(In reply to comment #28) > (In reply to comment #27) > > i think we should send a patch to lkml to add -no-pie/etc... if the compiler > supports it ... The kernel is one thing but then we have all the kernels modules packages.
(In reply to comment #29) kernel modules use the kernel source tree to build modules
Created attachment 293865 [details, diff] support switches with separated form like -D/-U Fist apptempt to support switches with separated form like -D/-U
Created attachment 293867 [details, diff] support switches with separated form like -D/-U Did have some error in the last patch
How does that differ from the patch we're using now?
4.6.2 p1.1 switches back to the builtin define method for fortification. Let's table the rest til 4.7.
Fixed in gcc 4.7 http://gcc.gnu.org/viewcvs?view=revision&revision=184022
Nice. :)
