From 9cd89e7d13a529ad439a9d8abae615943c08e78e Mon Sep 17 00:00:00 2001 From: Sam James Date: Thu, 17 Aug 2023 04:07:35 +0100 Subject: [PATCH 1/5] toolchain.eclass: downgrade znver4 to znver3 for <12.3 Closes: https://bugs.gentoo.org/912292 Signed-off-by: Sam James --- eclass/toolchain.eclass | 1 + 1 file changed, 1 insertion(+) diff --git a/eclass/toolchain.eclass b/eclass/toolchain.eclass index 9f626c5bfc77e..6a88676b750db 100644 --- a/eclass/toolchain.eclass +++ b/eclass/toolchain.eclass @@ -1395,6 +1395,7 @@ downgrade_arch_flags() { # "added" "arch" "replacement" local archlist=( + 12.3 znver4 znver3 10 znver3 znver2 9 znver2 znver1 4.9 bdver4 bdver3 From 1dd3378347f15c27b82237443f3a4825b4e70b3d Mon Sep 17 00:00:00 2001 From: Sam James Date: Thu, 17 Aug 2023 04:17:05 +0100 Subject: [PATCH 2/5] toolchain-funcs.eclass: tc-enables-fortify-source: update for newer libcxx Newer libcxx uses _LIBCPP_ENABLE_HARDENED_MODE instead of _LIBCPP_ENABLE_ASSERTIONS which is now deprecated. Bug: https://bugs.gentoo.org/912223 Signed-off-by: Sam James --- eclass/toolchain-funcs.eclass | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/eclass/toolchain-funcs.eclass b/eclass/toolchain-funcs.eclass index e28f6148ddc10..556bbac353074 100644 --- a/eclass/toolchain-funcs.eclass +++ b/eclass/toolchain-funcs.eclass @@ -963,9 +963,9 @@ gcc-specs-stack-check() { # @DESCRIPTION: # Return truth if the current compiler enables assertions in the C++ standard # library. For libstdc++, this is -D_GLIBCXX_ASSERTIONS, and for libcxx/libc++, -# this is -D_LIBCPP_ENABLE_ASSERTIONS. +# this is -D_LIBCPP_ENABLE_ASSERTIONS (deprecated) or -D_LIBCPP_ENABLE_HARDENED_MODE. tc-enables-cxx-assertions() { - tc-cpp-is-true "defined(_GLIBCXX_ASSERTIONS) || defined(_LIBCPP_ENABLE_ASSERTIONS)" ${CPPFLAGS} ${CXXFLAGS} + tc-cpp-is-true "defined(_GLIBCXX_ASSERTIONS) || defined(_LIBCPP_ENABLE_ASSERTIONS) || defined(_LIBCPP_ENABLE_HARDENED_MODE)" ${CPPFLAGS} ${CXXFLAGS} } # @FUNCTION: tc-enables-pie From b540f017cacb9d8c293648dcb1ab209d43d1ca79 Mon Sep 17 00:00:00 2001 From: Sam James Date: Thu, 17 Aug 2023 04:18:19 +0100 Subject: [PATCH 3/5] flag-o-matic.eclass: update _filter-hardened _filter-hardened is used by filter-flags to negate defaults, e.g. it makes filter-flags -fstack-protector correctly then disable -fstack-protector as well if the toolchain enables SSP by default. Modernise the tests it uses with the tc-enables-* functions rather than just gcc-specs-*. We haven't done hardening via specs for ages. Signed-off-by: Sam James --- eclass/flag-o-matic.eclass | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/eclass/flag-o-matic.eclass b/eclass/flag-o-matic.eclass index 0558e639b981a..7ea29334bba8f 100644 --- a/eclass/flag-o-matic.eclass +++ b/eclass/flag-o-matic.eclass @@ -147,7 +147,10 @@ _filter-hardened() { # not -fPIC or -fpic, but too many places filter -fPIC without # thinking about -fPIE. -fPIC|-fpic|-fPIE|-fpie|-Wl,pie|-pie) - gcc-specs-pie || continue + if ! gcc-specs-pie && ! tc-enables-pie ; then + continue + fi + if ! is-flagq -nopie && ! is-flagq -no-pie ; then # Support older Gentoo form first (-nopie) before falling # back to the official gcc-6+ form (-no-pie). @@ -158,15 +161,26 @@ _filter-hardened() { fi fi ;; + -fstack-protector) - gcc-specs-ssp || continue - is-flagq -fno-stack-protector || append-flags $(test-flags -fno-stack-protector);; + if ! gcc-specs-ssp && ! tc-enables-ssp ; then + continue + fi + + is-flagq -fno-stack-protector || append-flags $(test-flags -fno-stack-protector) + ;; -fstack-protector-all) - gcc-specs-ssp-to-all || continue - is-flagq -fno-stack-protector-all || append-flags $(test-flags -fno-stack-protector-all);; + if ! gcc-specs-ssp-to-all && ! tc-enables-ssp-all ; then + continue + fi + + is-flagq -fno-stack-protector-all || append-flags $(test-flags -fno-stack-protector-all) + ;; -fno-strict-overflow) gcc-specs-nostrict || continue - is-flagq -fstrict-overflow || append-flags $(test-flags -fstrict-overflow);; + + is-flagq -fstrict-overflow || append-flags $(test-flags -fstrict-overflow) + ;; esac done } From d5568f773d763bcfcaa50577553a3721c7b9eb83 Mon Sep 17 00:00:00 2001 From: Sam James Date: Thu, 17 Aug 2023 04:20:57 +0100 Subject: [PATCH 4/5] flag-o-matic.eclass: recognize -fstack-protector-strong in _filter-hardened Signed-off-by: Sam James --- eclass/flag-o-matic.eclass | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/eclass/flag-o-matic.eclass b/eclass/flag-o-matic.eclass index 7ea29334bba8f..70d39d034388c 100644 --- a/eclass/flag-o-matic.eclass +++ b/eclass/flag-o-matic.eclass @@ -162,8 +162,8 @@ _filter-hardened() { fi ;; - -fstack-protector) - if ! gcc-specs-ssp && ! tc-enables-ssp ; then + -fstack-protector|-fstack-protector-strong) + if ! gcc-specs-ssp && ! tc-enables-ssp && ! tc-enables-ssp-strong ; then continue fi From bc7f9e5b77e202ba568eaaf0f6a5638e5c0f6f23 Mon Sep 17 00:00:00 2001 From: Sam James Date: Thu, 17 Aug 2023 04:21:13 +0100 Subject: [PATCH 5/5] flag-o-matic.eclass: handle C++ assertions and FORTIFY_SOURCE in _filter-hardened Signed-off-by: Sam James --- eclass/flag-o-matic.eclass | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/eclass/flag-o-matic.eclass b/eclass/flag-o-matic.eclass index 70d39d034388c..b4c27bf89d926 100644 --- a/eclass/flag-o-matic.eclass +++ b/eclass/flag-o-matic.eclass @@ -181,6 +181,16 @@ _filter-hardened() { is-flagq -fstrict-overflow || append-flags $(test-flags -fstrict-overflow) ;; + -D_GLIBCXX_ASSERTIONS|-D_LIBCPP_ENABLE_ASSERTIONS|-D_LIBCPP_ENABLE_HARDENED_MODE) + tc-enables-cxx-assertions || continue + + append-cppflags -U_GLIBCXX_ASSERTIONS -U_LIBCPP_ENABLE_ASSERTIONS -U_LIBCPP_ENABLE_HARDENED_MODE + ;; + -D_FORTIFY_SOURCE=*) + tc-enables-fortify-source || continue + + append-cppflags -U_FORTIFY_SOURCE + ;; esac done }