Only use -fstack-protector-strong with supported compilers

[ngie]

Summary

Only use -fstack-protector-strong with supported compilers

This includes clang 3.5.0+, gcc 4.2.1, gcc 4.8.0+

This allows me to do subdirectory makes again on 10.2-RELEASE as it
comes with clang 3.4.1.

[pfg]

This should also fix some issues some ports are having with USE_GCC.

[emaste]

Thanks!

[ngie]

share/mk/bsd.sys.mk

153

40800 is wrong; it needs to be 40804: https://svnweb.freebsd.org/ports/head/lang/gcc48/

[ngie]

share/mk/bsd.sys.mk

153

LGTM:

[ngie@escher ~/svn/freebsd/src/tests/sys/pjdfstest/pjdfstest]$ env CC=clang35 make -VCFLAGS:M-fstack-protector-strong
-fstack-protector-strong
[ngie@escher ~/svn/freebsd/src/tests/sys/pjdfstest/pjdfstest]$ env CC=clang make -VCFLAGS:M-fstack-protector-strong                                                                                         

[ngie@escher ~/svn/freebsd/src/tests/sys/pjdfstest/pjdfstest]$ env CC=gcc47 make -VCFLAGS:M-fstack-protector-strong                                                                                         

[ngie@escher ~/svn/freebsd/src/tests/sys/pjdfstest/pjdfstest]$ env CC=gcc48 make -VCFLAGS:M-fstack-protector-strong                                                                                         
-fstack-protector-strong
[ngie@escher ~/svn/freebsd/src/tests/sys/pjdfstest/pjdfstest]$ env CC=gcc49 make -VCFLAGS:M-fstack-protector-strong                                                                                         
-fstack-protector-strong
[ngie@escher ~/svn/freebsd/src/tests/sys/pjdfstest/pjdfstest]$ env CC=gcc make -VCFLAGS:M-fstack-protector-strong
-fstack-protector-strong
[ngie@escher ~/svn/freebsd/src/tests/sys/pjdfstest/pjdfstest]$ env CC=clang36 make -VCFLAGS:M-fstack-protector-strong                                                                                       
-fstack-protector-strong
[ngie@escher ~/svn/freebsd/src/tests/sys/pjdfstest/pjdfstest]$ env CC=clang37 make -VCFLAGS:M-fstack-protector-strong                                                                                       
-fstack-protector-strong

[antoine]

The check looks wrong, people usually get gcc from the lang/gcc port, not lang/gcc48:

% gcc48 --version
gcc48 (FreeBSD Ports Collection) 4.8.5
Copyright (C) 2015 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

% gcc48 -fstack-protector-strong
gcc48: error: unrecognized command line option '-fstack-protector-strong'
gcc48: fatal error: no input files
compilation terminated.

Also, if this ever gets MFCed, people using clang 3.4.1 will lose all stack protection.

[pfg]

In D3924#81534, @antoine wrote:

The check looks wrong, people usually get gcc from the lang/gcc port, not lang/gcc48:

...

Also, if this ever gets MFCed, people using clang 3.4.1 will lose all stack protection.

There are no plans to MFC any of this, but you are right: we should have an .else
with the regular -fstack-protector

[ngie]

In D3924#81534, @antoine wrote:

The check looks wrong, people usually get gcc from the lang/gcc port, not lang/gcc48:

% gcc48 --version
gcc48 (FreeBSD Ports Collection) 4.8.5
Copyright (C) 2015 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

% gcc48 -fstack-protector-strong
gcc48: error: unrecognized command line option '-fstack-protector-strong'
gcc48: fatal error: no input files
compilation terminated.

Why doesn't lang/gcc have all of the patches from lang/gcc48???

https://svnweb.freebsd.org/ports?view=revision&revision=357238

Also, if this ever gets MFCed, people using clang 3.4.1 will lose all stack protection.

clang 3.4.1 doesn't have this option:

[ngie@fbsd10 /usr/src]$ grep -r protector-strong contrib/llvm/ || echo not found
not found
[ngie@fbsd10 /usr/src]$ clang --version
FreeBSD clang version 3.4.1 (tags/RELEASE_34/dot1-final 208032) 20140512
Target: x86_64-unknown-freebsd10.2
Thread model: posix
[ngie@fbsd10 /usr/src]$ svnversion 
289467

[ngie]

In D3924#81535, @pfg wrote:

In D3924#81534, @antoine wrote:

The check looks wrong, people usually get gcc from the lang/gcc port, not lang/gcc48:

...

Also, if this ever gets MFCed, people using clang 3.4.1 will lose all stack protection.

There are no plans to MFC any of this, but you are right: we should have an .else
with the regular -fstack-protector

Yeah... that have been added in the earlier commit.

[antoine]

In D3924#81536, @ngie wrote:

Why doesn't lang/gcc have all of the patches from lang/gcc48???

https://svnweb.freebsd.org/ports?view=revision&revision=357238

There's a PR: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=203751

Also, if this ever gets MFCed, people using clang 3.4.1 will lose all stack protection.

clang 3.4.1 doesn't have this option:

[ngie@fbsd10 /usr/src]$ grep -r protector-strong contrib/llvm/ || echo not found
not found
[ngie@fbsd10 /usr/src]$ clang --version
FreeBSD clang version 3.4.1 (tags/RELEASE_34/dot1-final 208032) 20140512
Target: x86_64-unknown-freebsd10.2
Thread model: posix
[ngie@fbsd10 /usr/src]$ svnversion 
289467

bug clang 3.4.1 has -fstack-protector

[ngie]

Reopening the revision based on input from antoine@

[ngie]

I'm changing the conditional to only enable itself with gcc versions 4.9+ to unbreak ports.

[ngie@escher ~/svn/freebsd/src/tests/sys/pjdfstest/pjdfstest]$ env CC=clang37 make -V'CFLAGS:M-fstack-protector*'
-fstack-protector-strong
[ngie@escher ~/svn/freebsd/src/tests/sys/pjdfstest/pjdfstest]$ env CC=clang34 make -V'CFLAGS:M-fstack-protector*'
-fstack-protector
[ngie@escher ~/svn/freebsd/src/tests/sys/pjdfstest/pjdfstest]$ env CC=gcc49 make -V'CFLAGS:M-fstack-protector*'
-fstack-protector-strong
[ngie@escher ~/svn/freebsd/src/tests/sys/pjdfstest/pjdfstest]$ env CC=gcc48 make -V'CFLAGS:M-fstack-protector*'
-fstack-protector

[ngie]

Only use -fstack-protector-strong on gcc 4.9+, because of lang/gcc doesn't have
all of the patches from lang/gcc48

[ngie]

In D3924#81568, @ngie wrote:

Only use -fstack-protector-strong on gcc 4.9+, because of lang/gcc doesn't have
all of the patches from lang/gcc48

Also, use -fstack-protector if MK_SSP != no on compatible architectures.