[Bug bootstrap/94739] New: GCC won't build on CET enabled Linux OS

[Bug bootstrap/94739] New: GCC won't build on CET enabled Linux OS

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94739

            Bug ID: 94739
           Summary: GCC won't build on CET enabled Linux OS
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: bootstrap
          Assignee: unassigned at gcc dot gnu.org
          Reporter: hjl.tools at gmail dot com
  Target Milestone: ---

[hjl@gnu-tgl-1 build-x86_64-linux]$ readelf -n /bin/ld 2>&1|more

Displaying notes found in: .note.gnu.property
  Owner                Data size        Description
  GNU                  0x00000030       NT_GNU_PROPERTY_TYPE_0
      Properties: x86 feature: IBT, SHSTK
        x86 ISA used: CMOV, SSE, SSE2
        x86 feature used: x86, XMM

and I got

build-x86_64-linux/./gcc/liblto_plugin.so: indirect branch tracking isn't
enabled: Invalid argument
collect2: error: ld returned 1 exit status
make[7]: *** [Makefile:994: libgcc_s.so] Error 1

Since ld is CET enabled, dlopen failed on liblto_plugin.so since it isn't CET
enabled.  On CET enabled Linux OS, we need to always enable CET on
liblto_plugin.so.

[Bug bootstrap/94739] GCC won't build on CET enabled Linux OS

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94739

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2020-04-24
           Keywords|                            |patch
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
                URL|                            |https://gcc.gnu.org/piperma
                   |                            |il/gcc-patches/2020-April/5
                   |                            |44535.html

--- Comment #1 from H.J. Lu <hjl.tools at gmail dot com> ---
A patch is posted at

https://gcc.gnu.org/pipermail/gcc-patches/2020-April/544535.html

[Bug bootstrap/94739] GCC won't build on CET enabled Linux OS

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94739

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by H.J. Lu <hjl@gcc.gnu.org>:

https://gcc.gnu.org/g:8fc8bf801e46d0d478c50bddecf5d8edf9511849

commit r10-7961-g8fc8bf801e46d0d478c50bddecf5d8edf9511849
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Sat Apr 25 10:06:59 2020 -0700

    Enable Intel CET in liblto_plugin.so on Intel CET enabled host

    Since ld is Intel CET enabled on Intel CET enabled host, dlopen fails on
    liblto_plugin.so if it isn't Intel CET enabled.  Add GCC_CET_HOST_FLAGS
    to cet.m4, use it in libiberty and lto-plugin to always enable Intel
    CET in liblto_plugin.so on Intel CET enabled host.

    On Linux/x86 host, enable Intel CET by default if assembler and compiler
    support Intel CET so that the generated liblto_plugin.so can be used on
    both CET and non-CET machines.  It is an error to disable Intel CET in
    liblto_plugin.so on Intel CET enabled host.

    config/

            PR bootstrap/94739
            * cet.m4 (GCC_CET_HOST_FLAGS): New.

    libiberty/

            PR bootstrap/94739
            * Makefile.in (COMPILE.c): Add @CET_HOST_FLAGS@.
            (configure_deps): Add $(srcdir)/../config/cet.m4 and
            $(srcdir)/../config/enable.m4.
            * aclocal.m4: Include ../config/cet.m4 and ../config/enable.m4.
            * configure.ac: Add GCC_CET_HOST_FLAGS(CET_HOST_FLAGS) and
            AC_SUBST(CET_HOST_FLAGS).
            * configure: Regenerated.

    lto-plugin/

            PR bootstrap/94739
            * Makefile.am (AM_CFLAGS): Add $(CET_HOST_FLAGS).
            * configure.ac: Add GCC_CET_HOST_FLAGS(CET_HOST_FLAGS) and
            AC_SUBST(CET_HOST_FLAGS).
            * Makefile.in: Regenerated.
            * aclocal.m4: Likewise.
            * configure: Likewise.

[Bug bootstrap/94739] GCC won't build on CET enabled Linux OS

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94739

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |10.0
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #3 from H.J. Lu <hjl.tools at gmail dot com> ---
Fixed for GCC 10.

[Bug bootstrap/94739] GCC won't build on CET enabled Linux OS

[manfred99 at gmx dot ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94739

Manfred Schwarb <manfred99 at gmx dot ch> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |manfred99 at gmx dot ch

--- Comment #4 from Manfred Schwarb <manfred99 at gmx dot ch> ---
This broke my i686 build (only, x86_64 build with same settings is OK), I get

configure: error: Intel CET must be enabled on Intel CET enabled host
make[2]: *** [configure-stage2-lto-plugin] Error 1
make[2]: *** Waiting for unfinished jobs....
configure: error: Intel CET must be enabled on Intel CET enabled host
make[2]: *** [configure-stage2-libiberty] Error 1


both in prev-libiberty/config.log and prev-lto-plugin/config.log there is

configure:5283: checking for CET support
configure:5312: gcc -march=i686 -m32 -Wa,--32 -c -g -fcf-protection  conftest.c
>&5
gcc: error: unrecognized command line option '-fcf-protection'
configure:5312: $? = 1
configure: failed program was:
| /* confdefs.h */
| #define PACKAGE_NAME ""
| #define PACKAGE_TARNAME ""
| #define PACKAGE_VERSION ""
| #define PACKAGE_STRING ""
| #define PACKAGE_BUGREPORT ""
| #define PACKAGE_URL ""
| #define STDC_HEADERS 1
| #define HAVE_SYS_TYPES_H 1
| #define HAVE_SYS_STAT_H 1
| #define HAVE_STDLIB_H 1
| #define HAVE_STRING_H 1
| #define HAVE_MEMORY_H 1
| #define HAVE_STRINGS_H 1
| #define HAVE_INTTYPES_H 1
| #define HAVE_STDINT_H 1
| #define HAVE_UNISTD_H 1
| #define __EXTENSIONS__ 1
| #define _ALL_SOURCE 1
| #define _GNU_SOURCE 1
| #define _POSIX_PTHREAD_SEMANTICS 1
| #define _TANDEM_SOURCE 1
| #define _FILE_OFFSET_BITS 64
| /* end confdefs.h.  */
|
| int
| main ()
| {
|
| #if !defined(__SSE2__)
| #error target does not support multi-byte NOPs
| #else
| asm ("setssbsy");
| #endif
|
|   ;
|   return 0;
| }


My configure command is
#> ../gcc-trunk-source/gcc/configure --enable-languages=c,c++,fortran
--enable-checking=yes,extra --disable-libstdcxx-pch --enable-libgomp
--enable-lto --enable-gold --with-plugin-ld=gold
--prefix=/usr/local/gcc-trunk-32bit i686-linux

and then I issue the make command with
#> make -j4 BOOT_CFLAGS="-g -O2" bootstrap2-lean


As mentioned above, the very same commands (without the "i686-linux" configure
argument) work fine to build x86_64 binaries.

[Bug bootstrap/94739] GCC won't build on CET enabled Linux OS

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94739

--- Comment #5 from H.J. Lu <hjl.tools at gmail dot com> ---
(In reply to Manfred Schwarb from comment #4)
> This broke my i686 build (only, x86_64 build with same settings is OK), I get
> 
> configure: error: Intel CET must be enabled on Intel CET enabled host
> make[2]: *** [configure-stage2-lto-plugin] Error 1
> make[2]: *** Waiting for unfinished jobs....
> configure: error: Intel CET must be enabled on Intel CET enabled host
> make[2]: *** [configure-stage2-libiberty] Error 1

Please show me libiberty/config.log which leads to

configure: error: Intel CET must be enabled on Intel CET enabled host

> 
> both in prev-libiberty/config.log and prev-lto-plugin/config.log there is
> 
> configure:5283: checking for CET support
> configure:5312: gcc -march=i686 -m32 -Wa,--32 -c -g -fcf-protection 
> conftest.c >&5
> gcc: error: unrecognized command line option '-fcf-protection'

[Bug bootstrap/94739] GCC won't build on CET enabled Linux OS

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94739

--- Comment #6 from H.J. Lu <hjl.tools at gmail dot com> ---
Created attachment 48383
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48383&action=edit
A patch.

Please try this.

[Bug bootstrap/94739] GCC won't build on CET enabled Linux OS

[tschwinge at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94739

Thomas Schwinge <tschwinge at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
                 CC|                            |tschwinge at gcc dot gnu.org
         Resolution|FIXED                       |---
           Assignee|unassigned at gcc dot gnu.org      |hjl at gcc dot gnu.org

--- Comment #7 from Thomas Schwinge <tschwinge at gcc dot gnu.org> ---
(In reply to CVS Commits from comment #2)
> commit r10-7961-g8fc8bf801e46d0d478c50bddecf5d8edf9511849
> Author: H.J. Lu <hjl.tools@gmail.com>
> Date:   Sat Apr 25 10:06:59 2020 -0700
> 
>     Enable Intel CET in liblto_plugin.so on Intel CET enabled host

In a GCC configuration on x86_64-pc-linux-gnu (so, x86_64 build/host) but with:

    --enable-linker-plugin-flags='CC=gcc\ -m32' \
    --enable-linker-plugin-configure-flags=--host=i686-pc-linux-gnu

... so that linker plugins are compiled for use with a x86 32-bit linker
executable, we get:

    checking for a BSD-compatible install... /usr/bin/install -c
    checking for CET support... configure: error: in
`[...]/build-gcc-offload-nvptx-none/libiberty-linker-plugin':
    configure: error: cannot run test program while cross compiling
    See `config.log' for more details
    Makefile:8440: recipe for target 'configure-libiberty-linker-plugin' failed

I can't speak for Manfred's (different) problem report, but:

(In reply to H.J. Lu from comment #6)
> Created attachment 48383 [details]
> A patch.
> 
> Please try this.

This does seem to resolve the particular problem I'm seeing.

[Bug bootstrap/94739] GCC won't build on CET enabled Linux OS

[manfred99 at gmx dot ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94739

--- Comment #8 from Manfred Schwarb <manfred99 at gmx dot ch> ---
Created attachment 48384
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48384&action=edit
libiberty/config.log

The full logfile of libiberty. I will apply the patch now and will report back.

[Bug bootstrap/94739] GCC won't build on CET enabled Linux OS

[manfred99 at gmx dot ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94739

--- Comment #9 from Manfred Schwarb <manfred99 at gmx dot ch> ---
Patch seems to work so far. Do you need any logfiles?

[Bug bootstrap/94739] GCC won't build on CET enabled Linux OS

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94739

--- Comment #10 from H.J. Lu <hjl.tools at gmail dot com> ---
(In reply to Manfred Schwarb from comment #9)
> Patch seems to work so far. Do you need any logfiles?

No need for it.

[Bug bootstrap/94739] GCC won't build on CET enabled Linux OS

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94739

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by H.J. Lu <hjl@gcc.gnu.org>:

https://gcc.gnu.org/g:eedc73a224df61694fe4802ddec8eb9ad1822f32

commit r10-8010-geedc73a224df61694fe4802ddec8eb9ad1822f32
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Tue Apr 28 05:42:34 2020 -0700

    Check whether -fcf-protection=none -Wl,-z,ibt,-z,shstk work first

    GCC_CET_HOST_FLAGS uses -Wl,-z,ibt,-z,shstk to check if Linux/x86 host
    has Intel CET enabled by introducing an Intel CET violation on purpose.
    To avoid false positive, check whether -Wl,-z,ibt,-z,shstk works first.
    -fcf-protection=none is added to avoid false negative when -fcf-protection
    is enabled by default.

    config/

            PR bootstrap/94739
            * cet.m4 (GCC_CET_HOST_FLAGS): Add -fcf-protection=none to
            -Wl,-z,ibt,-z,shstk.  Check whether -fcf-protection=none
            -Wl,-z,ibt,-z,shstk works first.

    libiberty/

            PR bootstrap/94739
            * configure: Regenerated.

    lto-plugin/

            PR bootstrap/94739
            * configure: Regenerated.

[Bug bootstrap/94739] GCC won't build on CET enabled Linux OS

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94739

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|REOPENED                    |RESOLVED

--- Comment #12 from H.J. Lu <hjl.tools at gmail dot com> ---
Fixed.