#59 Always enable PIE
Merged 5 months ago by berrange. Opened 5 months ago by teuf.
rpms/ teuf/qemu pie  into  rawhide

file modified
+1
@@ -1920,6 +1920,7 @@ 

  run_configure \

    --enable-attr \

    --enable-linux-user \

+   --enable-pie \

    --enable-tcg \

    --disable-install-blobs \

    --static

PIE is currently enabled for qemu-kvm builds, and disabled for
qemu-user-static builds.

--disable-pie is causing https://bugzilla.redhat.com/show_bug.cgi?id=2256916

This commit ensures --enable-pie is used for both qemu-kvm and
qemu-user-static.

This fixes https://bugzilla.redhat.com/show_bug.cgi?id=2256916

Signed-off-by: Christophe Fergeau cfergeau@redhat.com

rebased onto 6ab74db

5 months ago

We still need this line, as this is the 'run_configure' invocation for shared lib build.

rebased onto c319527

5 months ago

rebased onto d67c7ee

5 months ago

We still need this line, as this is the 'run_configure' invocation for shared lib build.

I removed the change, but disable_everything is only used in run_configure, which in turn is used twice, once for the qemu-user-static build, and once for the qemu-kvm build.
The qemu-user-static build did not have --enable-pie, this PR adds it.
The qemu-kvm build unconditionally adds --enable-pie.
I don't think after this PR there is a configure invocation with only --disable-pie

Pull-Request has been merged by berrange

5 months ago

disable_everything can be defined simply to --without-default-features --without-default-devices --disable-download.

And while at it, I would add --enable-pie flags and other that do not affect dependencies (and therefore do not affect static vs. shared linking) directly in run_configure, either directly or through a macro. These can and should be applied to both builds.

All in all, this means changing the huge definition of disable_everything to something like

%if "%{_lto_cflags}" != "%{nil}"
%define qemu_lto_flag --enable-lto
%else
%define  qemu_lto_flag
%endif

# Only enable by default those options that do not introduce
# dependencies on external libraries
%define common_features           \\\ 
   --audio-drv-list=              \\\ 
   --without-default-features     \\\ 
   --without-default-devices      \\\
   --disable-download             \\\  
   --enable-avx2                  \\\  
   --enable-avx512f               \\\
   --enable-avx512bw              \\\
   --enable-coroutine-pool        \\\
   --enable-debug-info            \\\
   --enable-kvm                   \\\
   --enable-l2tpv3                \\\
   --enable-malloc-trim           \\\
   --enable-pie                   \\\
   --enable-relocatable           \\\
   --enable-tcg                   \\\   
   --enable-vhost-kernel          \\\
   --enable-vhost-net             \\\
   --enable-vhost-user            \\\
   --enable-vhost-user-blk-server \\\
   --enable-vhost-vdpa            \\\
   --enable-bochs                 \\\
   --enable-cloop                 \\\
   --enable-dmg                   \\\
   --enable-qcow1                 \\\
   --enable-qed                   \\\
   --enable-vdi                   \\\
   --enable-vhdx                  \\\
   --enable-vmdk                  \\\
   --enable-vpc                   \\\
   --enable-vvfat                 \\\
   --enable-parallels             \\\
   --enable-replication           \\\
   %{qemu_lto_flag}

and the corresponding "enable" flags can be removed from both invocation of run_configure. While most of these only apply to system emulation and static builds are only done for user mode emulators, it is cleaner to keep them in the common code.

Also,

%if %{defined block_drivers_rw_list}
  --block-drv-rw-whitelist=%{block_drivers_rw_list} \
%endif
%if %{defined block_drivers_ro_list}
  --block-drv-ro-whitelist=%{block_drivers_ro_list} \
%endif

applies to all builds and could be moved to run_configure. It is in the same group as --firmwarepath or --tls-priority IMO.

Build failed. More information on how to proceed and troubleshoot errors available at https://fedoraproject.org/wiki/Zuul-based-ci
https://fedora.softwarefactory-project.io/zuul/buildset/67b6023b77904be99f55039415590d92

The ppc64le build fails with

ERROR: -static-pie not available due to missing toolchain support

:-/

I've created https://src.fedoraproject.org/rpms/qemu/pull-request/60 to fix the build failure. I'll look next at making your suggested changes Paolo.

disable_everything can be defined simply to --without-default-features --without-default-devices --disable-download.

would be good to propose that to centos package too. a lot of this spec layout was designed to be similar to centos spec to make it easier to at least visually share rebase work

Metadata