arch: add BR2_READELF_ARCH_NAME hidden config option

As shown recently by the firejail example, it is easy to miss that a package builds and installs binaries without actually cross-compiling
them: they are built for the host architecture instead of the target architecture.

This commit adds a small helper script, check-bin-arch, called from the main Makefile as a TARGET_FINALIZE_HOOKS, to verify that all ELF binaries have been built for the correct CPU architecture.

Example output with the firejail package enabled, when building for an ARM target:

support/scripts/check-bin-arch .../buildroot/output/target .../buildroot/output/host/usr/bin/arm-linux-gnueabihf- "ARM"
ERROR: .../buildroot/output/target/usr/bin/firemon architecture is 'Advanced Micro Devices X86-64', should be 'ARM'
ERROR: .../buildroot/output/target/usr/bin/firejail architecture is 'Advanced Micro Devices X86-64', should be 'ARM'
ERROR: .../buildroot/output/target/usr/bin/firecfg architecture is 'Advanced Micro Devices X86-64', should be 'ARM'
ERROR: .../buildroot/output/target/usr/lib/firejail/libconnect.so architecture is 'Advanced Micro Devices X86-64', should be 'ARM'
ERROR: .../buildroot/output/target/usr/lib/firejail/faudit architecture is 'Advanced Micro Devices X86-64', should be 'ARM'
ERROR: .../buildroot/output/target/usr/lib/firejail/ftee architecture is 'Advanced Micro Devices X86-64', should be 'ARM'
ERROR: .../buildroot/output/target/usr/lib/firejail/libtrace.so architecture is 'Advanced Micro Devices X86-64', should be 'ARM'
ERROR: .../buildroot/output/target/usr/lib/firejail/libtracelog.so architecture is 'Advanced Micro Devices X86-64', should be 'ARM' Makefile:665: recipe for target 'target-finalize' failed
make[1]: *** [target-finalize] Error 1

Signed-off-by Thomas Petazzoni <[email protected]>

---
 Makefile                       | 10 ++++++++++
 support/scripts/check-bin-arch | 30 ++++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+)
 create mode 100755 support/scripts/check-bin-arch

Makefile +10 -0

index fb2c235..3cb1f7a 100644
@@ -649,6 +649,16 @@ endef
 TARGET_FINALIZE_HOOKS += PURGE_LOCALES
 endif
 
+READELF_ARCH_NAME = $(call qstrip,$(BR2_READELF_ARCH_NAME))
+
+ifneq ($(READELF_ARCH_NAME),)
+define CHECK_BIN_ARCH
+	support/scripts/check-bin-arch $(TARGET_DIR) \
+		$(TARGET_CROSS) "$(READELF_ARCH_NAME)"
+endef
+TARGET_FINALIZE_HOOKS += CHECK_BIN_ARCH
+endif
+
 $(TARGETS_ROOTFS): target-finalize
 
 target-finalize: $(PACKAGES)

support/scripts/check-bin-arch new file +30 -0

new file mode 100755
index 0000000..de11a71
@@ -0,0 +1,30 @@
+#!/bin/sh
+
+# This script looks at all files in the target filesystem, and for
+# those that are ELF files, verifies that they have been built for the
+# correct architecture.
+
+TARGET_DIR=$1
+TARGET_CROSS=$2
+READELF_ARCH_NAME=$3
+
+exitcode=0
+
+for f in $(find ${TARGET_DIR} -type f) ; do
+    # Skip non-ELF files
+    if ! file -b ${f} | grep -q "ELF " ; then
+	continue
+    fi
+
+    # Get architecture using readelf
+    farchname=$(${TARGET_CROSS}readelf -h ${f} | \
+		       grep '^  Machine:' | \
+		       sed 's/^  Machine: *\(.*\)/\1/')
+
+    if test "${farchname}" != "${READELF_ARCH_NAME}" ; then
+	echo "ERROR: ${f} architecture is '${farchname}', should be '${READELF_ARCH_NAME}'"
+	exitcode=1
+    fi
+done
+
+exit ${exitcode}

Signature · 1 line

2.7.4

That is not possible in all situations.

For example, I have a board here with a kind of co-processor of a different architecture; the firmware for that co-processor is loaded at runtime. It is an ELF file, and it is in target/.

So I don't think it is possible to check that all ELF files are for the Buildroot-known target.

We already discussed this a while ago and came to the same conclusiong back then.

Quoted 10 lines

That is not possible in all situations.

For example, I have a board here with a kind of co-processor of a different architecture; the firmware for that co-processor is loaded at runtime. It is an ELF file, and it is in target/.

So I don't think it is possible to check that all ELF files are for the Buildroot-known target.

Quoted 2 lines

We already discussed this a while ago and came to the same conclusiong back then.

I don't think I want to give up that easily on this, especially considering how many times we get submission for packages that are not actually cross-compiled.

Could you be more specific about these firmware files? Where are they located?

Perhaps with a test restricted to {usr,}/{bin,sbin,lib}, we can avoid testing those firmware files.

On 2017-03-12 16:06 +0100, Thomas Petazzoni spake thusly:

Quoted 8 lines

As shown recently by the firejail example, it is easy to miss that a package builds and installs binaries without actually cross-compiling
them: they are built for the host architecture instead of the target architecture.

This commit adds a small helper script, check-bin-arch, called from the main Makefile as a TARGET_FINALIZE_HOOKS, to verify that all ELF binaries have been built for the correct CPU architecture.

That is not possible in all situations.

For example, I have a board here with a kind of co-processor of a different architecture; the firmware for that co-processor is loaded at runtime. It is an ELF file, and it is in target/.

So I don't think it is possible to check that all ELF files are for the Buildroot-known target.

We already discussed this a while ago and came to the same conclusiong back then.

Hi Yann,

Quoted 19 lines · Yann E. MORIN

On 2017-03-12 16:06 +0100, Thomas Petazzoni spake thusly:

Quoted 8 lines

As shown recently by the firejail example, it is easy to miss that a package builds and installs binaries without actually cross-compiling
them: they are built for the host architecture instead of the target architecture.

This commit adds a small helper script, check-bin-arch, called from the main Makefile as a TARGET_FINALIZE_HOOKS, to verify that all ELF binaries have been built for the correct CPU architecture.

That is not possible in all situations.

For example, I have a board here with a kind of co-processor of a different architecture; the firmware for that co-processor is loaded at runtime. It is an ELF file, and it is in target/.

So I don't think it is possible to check that all ELF files are for the Buildroot-known target.

Quoted 2 lines

We already discussed this a while ago and came to the same conclusiong back then.

Maybe limiting the check to well knows target binary directories like target/{bin,sbin,usr/bin,usr/sbin,...} would help. This check won't catch all possible locations of target ELF binaries, but it's still a significant improvement over the current situation.

baruch

Hello *,

Quoted 25 lines · Baruch Siach

Hi Yann,

Quoted 21 lines · Yann E. MORIN

On 2017-03-12 16:06 +0100, Thomas Petazzoni spake thusly:

Quoted 8 lines

As shown recently by the firejail example, it is easy to miss that a package builds and installs binaries without actually cross-compiling
them: they are built for the host architecture instead of the target architecture.

This commit adds a small helper script, check-bin-arch, called from the main Makefile as a TARGET_FINALIZE_HOOKS, to verify that all ELF binaries have been built for the correct CPU architecture.

That is not possible in all situations.

For example, I have a board here with a kind of co-processor of a different architecture; the firmware for that co-processor is loaded at runtime. It is an ELF file, and it is in target/.

So I don't think it is possible to check that all ELF files are for the Buildroot-known target.

We already discussed this a while ago and came to the same conclusiong back then.

Quoted 4 lines

Maybe limiting the check to well knows target binary directories like target/{bin,sbin,usr/bin,usr/sbin,...} would help. This check won't catch all possible locations of target ELF binaries, but it's still a significant improvement over the current situation.

...or limit to executable binary files (for firmware files read rights should be enough)?

Hi Yann,

Quoted 19 lines · Yann E. MORIN

On 2017-03-12 16:06 +0100, Thomas Petazzoni spake thusly:

Quoted 8 lines

As shown recently by the firejail example, it is easy to miss that a package builds and installs binaries without actually cross-compiling
them: they are built for the host architecture instead of the target architecture.

This commit adds a small helper script, check-bin-arch, called from the main Makefile as a TARGET_FINALIZE_HOOKS, to verify that all ELF binaries have been built for the correct CPU architecture.

That is not possible in all situations.

For example, I have a board here with a kind of co-processor of a different architecture; the firmware for that co-processor is loaded at runtime. It is an ELF file, and it is in target/.

So I don't think it is possible to check that all ELF files are for the Buildroot-known target.

Quoted 2 lines

We already discussed this a while ago and came to the same conclusiong back then.

Maybe limiting the check to well knows target binary directories like target/{bin,sbin,usr/bin,usr/sbin,...} would help. This check won't catch all possible locations of target ELF binaries, but it's still a significant improvement over the current situation.