diff mbox

[for-2.0] configure: add option to disable -fstack-protector flags

Message ID CAFEAcA-H_CF277a=+6brx+2=aofdajkPxcNRLoTVmaxiwf+HqQ@mail.gmail.com
State Superseded
Headers show

Commit Message

Peter Maydell April 8, 2014, 8:37 p.m. UTC 
On 28 March 2014 16:19, Paolo Bonzini <pbonzini@redhat.com> wrote:
> This patch introduces a configure option to disable the stack protector
> entirely, and conditional stack protector flag selection (in order,
> based on availability): -fstack-protector-strong, -fstack-protector-all,
> no stack protector.

I've just noticed that this test doesn't correctly handle MacOSX clang.
For some reason that has this behaviour:

manooth$ clang -o /tmp/zz9 -Werror -fstack-protector /tmp/zz9.c
# OK, plain -fstack-protector works
manooth$ clang -o /tmp/zz9 -Werror -fstack-protector-strong  /tmp/zz9.c
clang: error: argument unused during compilation: '-fstack-protector-strong'
# The strong variant isn't implemented
manooth$ clang -o /tmp/zz9 -Werror -fstack-protector-strong
/tmp/zz9.c -framework CoreFoundation
# ...but for some reason adding the -framework CoreFoundation argument
# suppresses the error!

This is bad because we have that framework argument as part of our
linker flags. Effectively this means that clang won't warn about the
argument at link time but will warn for every .c->.o compile (as well
as ending up with no stack protection).

Changing the test from doing a compile-and-link to just
compiling a single object seems to fix this:

manooth$ git diff

However perhaps the correct fix is to make MacOSX put
the -framework options in CFLAGS, not LDFLAGS -- they
seem (from what I can gather from google, which is not much)
to be a sort of combination of include files and libraries so should
probably be consistently specified everywhere.

thanks
-- PMM

Comments

Peter Maydell April 9, 2014, 7:40 a.m. UTC | #1 
On 8 April 2014 21:47, Noonan, Steven <snoonan@amazon.com> wrote:
> On Tue, Apr 08, 2014 at 09:37:27PM +0100, Peter Maydell wrote:
>> This is bad because we have that framework argument as part of our
>> linker flags. Effectively this means that clang won't warn about the
>> argument at link time but will warn for every .c->.o compile (as well
>> as ending up with no stack protection).
>
> So -framework is designed to transparently add the appropriate -I and
> -L/-l flags, pointing to the insides of a .framework bundle.
>
> To me, the -framework arguments belong in CFLAGS and LIBS, but not
> LDFLAGS. In the context of QEMU's configure script, I think it'd be
> QEMU_INCLUDES and LIBS.

Unfortunately, putting "-framework CoreFoundation" in CFLAGS
produces a different warning:

manooth$ clang -o /tmp/zz9.o -Werror -fstack-protector -c /tmp/zz9.c
-framework CoreFoundation
clang: error: -framework CoreFoundation: 'linker' input unused

which would seem to imply that you shouldn't be passing it on
the .c->.o compile command line.

thanks
-- PMM
Peter Maydell April 9, 2014, 9:34 a.m. UTC | #2 
On 9 April 2014 10:29, Noonan, Steven <snoonan@amazon.com> wrote:
> So in your case all you probably need is to drop the -framework
> arguments from CFLAGS and plop them into LIBS, and you're probably good
> to go.

This is where they are already. The problem is that putting
-framework on the linker command line causes clang to
fail to reject -fsome-random-unknown-thing, which means
we can't do configure detection of -fsomething arguments
using compile_prog  :-(

I think the only thing we can do about this is to make sure
that our configure code to check for -fsomething does a
compile-only check and not a link.

thanks
-- PMM
diff mbox

Patch

diff --git a/configure b/configure
index eb0e7bb..c85475f 100755
--- a/configure
+++ b/configure
@@ -1448,7 +1448,7 @@  done
 if test "$stack_protector" != "no" ; then
   gcc_flags="-fstack-protector-strong -fstack-protector-all"
   for flag in $gcc_flags; do
-    if compile_prog "-Werror $flag" "" ; then
+    if do_cc $QEMU_CFLAGS -Werror $flag -c -o $TMPO $TMPC ; then
       QEMU_CFLAGS="$QEMU_CFLAGS $flag"
       LIBTOOLFLAGS="$LIBTOOLFLAGS -Wc,$flag"
       break