Re: [PATCH] configure: Allow a host makefile fragment to override PIE flag settings.

["H.J. Lu" <hjl.tools@gmail.com>]

On Wed, Aug 25, 2021 at 10:42 AM Iain Sandoe <idsandoe@googlemail.com> wrote:
>
> Hi,
>
> > On 20 Aug 2021, at 11:29, Richard Sandiford <richard.sandiford@arm.com> wrote:
> >
> >>> Maybe it would be easier to have the makefile fragments determine
> >>> something like CODE_MODEL_CFLAGS, which can be "-fPIC", "-mdynamic-no-pic",
> >>> etc., and use:
> >>>
> >>> COMPILER += $(NO_PIE_CFLAGS) $(CODE_MODEL_CFLAGS)
> >>
> >> OK. I have misgivings about this - the problem is that:
> >>
> >> -fPIC -fno-PIE != -fno-PIE -fPIC,  which is not obvious to many folks - who expect that
> >> the “last edition of a flag will be the one in force”.
> >>
> >> So the PIE-ness and the PIC-ness are decoupled in the configury but they need to be
> >> ordered specifically for targets that want PIC code by default (FWIW, I don’t think Darwin
> >> is the only default-PIC case here, from discussions on irc).
> >
> > Yeah, that's what the above was supposed to achieve.  In other words,
> > if you force non-PIE, you also need to follow that by $(CODE_MODEL_CFLAGS),
> > which restates whatever the base code model is.
> >
> > If it's the decoupling you're worried about, then an alternative would
> > be to have:
> >
> >  NO_PIE_CFLAGS="-fno-PIE \$(CODE_MODEL_CFLAGS)”
>
> I’d like to ask a couple of questions (of HJ who introduced the no-PIE logic) before implementing this.
>
> A. We use no-PIE for cc1* because that is needed to handle the PCH implementation (which relies on the executables being loaded at the same addresses each time).
>
> B. It’s certainly not obvious to me why we need to build code to run on $build to be no-PIE - I don’t see any such dependencies in the generators etc.
>
>  - So Question1 - HJ what was the motivation for making the  XXX_BUILD_XXX adopt no-PIE?

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=71934

> ——
>
> Independently of this we seem to be building the objects for $host thus:
>
> $(CXX) (NO_PIE_CFLAGS) -c $(ALL_CXXFLAGS) etc.
>
> but we build for $build thus:
>
> $(CXX) -c $(ALL_CXXFLAGS) $(GENERATOR_CFLAGS) -DGENERATOR_FILE $(BUILD_NO_PIE_CFLAGS) $(BUILD_CPPFLAGS)
>
> which means that code model flags in $ALL_CXXFLAGS are overridden for $build, but active for $host
> ^^ this is actually what causes the Darwin build fail - since on Darwin we cannot build static linked code for user-space processes.
>
> in any event that’s inconsistent (unless there’s a reason that it should be different).
>
> ----
>
> below are extracts from gcc/Makefile *on linux* which demonstrates the different ordering.
>
> AFAICT,
> NO_PIE_CFLAGS_FOR_BUILD, NO_PIE_FLAG_FOR_BUILD are dead variables?
>
> Question 2 : HJ, what was your intention for how a configuration would request PIC code (for example) for things to run on $build?
>
> thanks
> Iain
>
> -------
>
>
> ALL_CXXFLAGS = $(T_CFLAGS) $(CFLAGS-$@) $(CXXFLAGS) $(INTERNAL_CFLAGS) \
>   $(COVERAGE_FLAGS) $(ALIASING_FLAGS) $(NOEXCEPTION_FLAGS) \
>
> --
> # Native compiler for the build machine and its switches.
> CC_FOR_BUILD = $(CC)
> CXX_FOR_BUILD = $(CXX)
> NO_PIE_CFLAGS_FOR_BUILD =
> NO_PIE_FLAG_FOR_BUILD =
> BUILD_CFLAGS= $(ALL_CFLAGS) $(GENERATOR_CFLAGS) -DGENERATOR_FILE
> BUILD_CXXFLAGS = $(ALL_CXXFLAGS) $(GENERATOR_CFLAGS) -DGENERATOR_FILE
> BUILD_NO_PIE_CFLAGS = $(NO_PIE_CFLAGS)
> BUILD_CFLAGS += $(BUILD_NO_PIE_CFLAGS)
> BUILD_CXXFLAGS += $(BUILD_NO_PIE_CFLAGS)
>
> # Native compiler that we use.  This may be C++ some day.
> COMPILER_FOR_BUILD = $(CXX_FOR_BUILD)
> BUILD_COMPILERFLAGS = $(BUILD_CXXFLAGS)
>
> # Native linker that we use.
> LINKER_FOR_BUILD = $(CXX_FOR_BUILD)
> BUILD_LINKERFLAGS = $(BUILD_CXXFLAGS)
>
> # Native linker and preprocessor flags.  For x-fragment overrides.
> BUILD_LDFLAGS=$(LDFLAGS)
> BUILD_NO_PIE_FLAG = $(NO_PIE_FLAG)
> BUILD_LDFLAGS += $(BUILD_NO_PIE_FLAG)
> BUILD_CPPFLAGS= -I. -I$(@D) -I$(srcdir) -I$(srcdir)/$(@D) \
>                 -I$(srcdir)/../include  $(CPPINC) $(CPPFLAGS)
> --
> # This is the variable actually used when we compile. If you change this,
> # you probably want to update BUILD_CFLAGS in configure.ac
> ALL_CFLAGS = $(T_CFLAGS) $(CFLAGS-$@) \
>
> build/%.o :  # dependencies provided by explicit rule later
>         $(COMPILER_FOR_BUILD) -c $(BUILD_COMPILERFLAGS) $(BUILD_CPPFLAGS) \
>                 -o $@ $<
>
> ^^^^ this has
> $(CXX) -c $(ALL_CXXFLAGS) $(GENERATOR_CFLAGS) -DGENERATOR_FILE $(BUILD_NO_PIE_CFLAGS) $(BUILD_CPPFLAGS)
> NO_PIE_CFLAGS_FOR_BUILD is apparently ignored
>
> # Rule for the generator programs:
> $(genprog:%=build/gen%$(build_exeext)): build/gen%$(build_exeext): build/gen%.o $(BUILD_LIBDEPS)
>         +$(LINKER_FOR_BUILD) $(BUILD_LINKERFLAGS) $(BUILD_LDFLAGS) -o $@ \
>             $(filter-out $(BUILD_LIBDEPS), $^) $(BUILD_LIBS)
>
> --
> build/genversion$(build_exeext): build/genversion.o
>         +$(LINKER_FOR_BUILD) $(BUILD_LINKERFLAGS) $(BUILD_LDFLAGS) \
>                 build/genversion.o -o $@
> =========
>
> # The name of the compiler to use.
> COMPILER = $(CXX)
> COMPILER_FLAGS = $(CXXFLAGS)
> # If HOST_LIBS is set, then the user is controlling the libraries to
> --
> CET_HOST_FLAGS = -fcf-protection
> COMPILER += $(CET_HOST_FLAGS)
>
> --
> # We don't want to compile the compilers with -fPIE, it make PCH fail.
> COMPILER += $(NO_PIE_CFLAGS)
>
> --
> # A list of all the language-specific executables.
> COMPILERS =  gnat1$(exeext) cc1$(exeext) cc1plus$(exeext) d21$(exeext) f951$(exeext) go1$(exeext)  lto1$(exeext) cc1obj$(exeext) cc1objplus$(exeext)
>
> --
> # Native compiler that we use.  This may be C++ some day.
> COMPILER_FOR_BUILD = $(CXX_FOR_BUILD)
> BUILD_COMPILERFLAGS = $(BUILD_CXXFLAGS)
>
> --
>
> # This is the variable to use when using $(COMPILER).
> ALL_COMPILERFLAGS = $(ALL_CXXFLAGS)
>
> --
>
> COMPILE.base = $(COMPILER) -c $(ALL_COMPILERFLAGS) $(ALL_CPPFLAGS) -o $@
>
> This is :
> $(CXX) (NO_PIE_CFLAGS) -c $(ALL_CXXFLAGS) etc.
>
> COMPILE = $(COMPILE.base) -MT $@ -MMD -MP -MF $(@D)/$(DEPDIR)/$(*F).TPo
> POSTCOMPILE = @mv $(@D)/$(DEPDIR)/$(*F).TPo $(@D)/$(DEPDIR)/$(*F).Po
>
> .cc.o .c.o:
>         $(COMPILE) $<
>         $(POSTCOMPILE)
>


-- 
H.J.