release: build riscv64 binary, build static PIE if supported #3446

kolyshkin · 2022-04-01T21:38:54Z

This can be split into a few groups:

Dockerfile fixes.
Makefile fixes.
Enabling static PIE for arm64 and amd64.
Enabling riscv64.

See individual commits for details.

kolyshkin · 2022-04-14T01:03:42Z

@cyphar @thaJeztah PTAL 🙏🏻

AkihiroSuda · 2022-04-28T12:09:15Z

Enabling riscv64.

seccomp stuffs has to be updated too.
Opened PR #3463

thaJeztah · 2022-04-28T12:11:21Z

Opened PR #3463

Slightly confused now; can these be merged independently, or should they be merged in a specific order? 😅

AkihiroSuda · 2022-04-28T12:24:26Z

Opened PR #3463

Slightly confused now; can these be merged independently, or should they be merged in a specific order? 😅

In arbitrary order, but merging one will need rebasing another one.

kolyshkin · 2022-04-29T01:03:22Z

Let me try to pick your changes @AkihiroSuda

kolyshkin · 2022-04-29T01:07:30Z

Picked the libseccomp-golang bump commit from #3463

PTAL @AkihiroSuda @thaJeztah

AkihiroSuda · 2022-05-05T15:57:03Z

Needs rebase

kolyshkin · 2022-05-06T01:13:41Z

Rebased; PTAL @AkihiroSuda @thaJeztah @mrunalp

AkihiroSuda

This seems needed as well

diff --git a/libcontainer/seccomp/patchbpf/enosys_linux.go b/libcontainer/seccomp/patchbpf/enosys_linux.go
index dfb8a0a8..d1ee0c2b 100644
--- a/libcontainer/seccomp/patchbpf/enosys_linux.go
+++ b/libcontainer/seccomp/patchbpf/enosys_linux.go
@@ -67,6 +67,7 @@ const uint32_t C_AUDIT_ARCH_PPC64        = AUDIT_ARCH_PPC64;
 const uint32_t C_AUDIT_ARCH_PPC64LE      = AUDIT_ARCH_PPC64LE;
 const uint32_t C_AUDIT_ARCH_S390         = AUDIT_ARCH_S390;
 const uint32_t C_AUDIT_ARCH_S390X        = AUDIT_ARCH_S390X;
+const uint32_t C_AUDIT_ARCH_RISCV64      = AUDIT_ARCH_RISCV64;
 */
 import "C"
 
@@ -197,6 +198,8 @@ func archToNative(arch libseccomp.ScmpArch) (nativeArch, error) {
                return nativeArch(C.C_AUDIT_ARCH_S390), nil
        case libseccomp.ArchS390X:
                return nativeArch(C.C_AUDIT_ARCH_S390X), nil
+       case libseccomp.ArchRISCV64:
+               return nativeArch(C.C_AUDIT_ARCH_RISCV64), nil
        default:
                return invalidArch, fmt.Errorf("unknown architecture: %v", arch)
        }

AkihiroSuda · 2022-05-11T02:41:33Z

@kolyshkin Could you update the PR? ↑

kolyshkin · 2022-05-11T21:49:48Z

+const uint32_t C_AUDIT_ARCH_RISCV64      = AUDIT_ARCH_RISCV64;

Alas this breaks the compilation on centos 7; I have added a workaround.

We do not use all the files from scripts, only seccomp.sh and lib.sh. This prevents unneeded rebuild of the image if e.g. scripts/release_build.sh has changed. Signed-off-by: Kir Kolyshkin <[email protected]>

Dockerfile used to install libseccomp-dev packages for different architectures. This is no longer true since commit f30244e, which changed to cross-compiling libseccomp (so we can get a static library to link against). Thus, adding extra architectures is no longer needed. Signed-off-by: Kir Kolyshkin <[email protected]>

All we need is gcc, libc-dev, and binutils. In addition to that, crossbuild-essential installs g++, libstdc++-dev, and a bunch of perl packages and libraries which we do not need. This should speed up image building, as well as make it smaller. Signed-off-by: Kir Kolyshkin <[email protected]>

LDFLAGS_COMMON are used from two places, so it makes sense to dedup. LDFLAGS_STATIC is a preparation for the next commit. Signed-off-by: Kir Kolyshkin <[email protected]>

1. Set to empty value by default. 2. Assume Linux (remove GOOS check, since we do not support other OSes). 3. Instead of using a "not-supported" list, use a "supported" list (as Go release notes usually say which platforms are supported). As of today, -buildmode=pie is supported for: * linux/386, linux/amd64, linux/arm, linux/arm64, and linux/ppc64le (since Go 1.6, see https://tip.golang.org/doc/go1.6#compiler) * linux/s390x (since Go 1.7, which adds the initial port) * linux/riscv64 (since Go 1.16, see https://tip.golang.org/doc/go1.16#riscv) NOTE this does not mean we support these architectures; it is merely a way to see if -buildmode=pie can be used. Signed-off-by: Kir Kolyshkin <[email protected]>

Signed-off-by: Kir Kolyshkin <[email protected]>

It doesn't matter whether static or dynamic linking is used, runc always needs libcontainer/nsenter, which is written in C and thus requires cgo. Same is true for libcontainer/integration. In addition, contrib/pkg/seccompagent also needs cgo (if seccomp build tag is set), as it need to be linked against libseccomp C library. By default, cgo is disabled when cross-compiling, meaning that CGO_ENABLED=1 has to be set explicitly in such cases. In all other cases (e.g. other contrib binaries) we do not need cgo. Remove CGO_ENABLED=1 from GO_BUILD_STATIC (as it does not have anything to do with static linking), and add it to all targets that require it. Signed-off-by: Kir Kolyshkin <[email protected]>

Co-authored-by: Kir Kolyshkin <[email protected]> Signed-off-by: Akihiro Suda <[email protected]> Signed-off-by: Kir Kolyshkin <[email protected]>

Signed-off-by: Kir Kolyshkin <[email protected]>

thaJeztah

LGTM

thaJeztah · 2022-05-12T09:52:37Z

Do we need another check from @crazy-max on this PR? (#3463 (comment))

crazy-max · 2022-05-12T10:56:55Z

Makefile

-		endif
+GO_BUILDMODE :=
+# Enable dynamic PIE executables on supported platforms.
+ifneq (,$(filter $(GOARCH),386 amd64 arm arm64 ppc64le riscv64 s390x))


afaik -buildmode=pie is not supported only on windows arm64 and linux mips*, ppc64be. should work on riscv64. see https://github.com/golang/go/blob/4aa1efed4853ea067d665a952eee77c52faac774/src/cmd/internal/sys/supported.go#L125-L131

So, this is a list of supported platforms. Meaning, we do enable -buildmode=pie for riscv64.

See commit description at ab5c60d

@crazy-max PTAL ^^^

brandond · 2023-04-13T00:34:09Z

Is there any particular reason that this hasn't been made available in a 1.x release yet? Trying to get k3s running on riscv64 and this looks like one of the last blockers.

AkihiroSuda · 2023-04-13T00:53:00Z

release

This will be in v1.2.
I think we can have a RC soon.

kolyshkin · 2023-04-13T01:08:25Z

Is there any particular reason that this hasn't been made available in a 1.x release yet? Trying to get k3s running on riscv64 and this looks like one of the last blockers.

This is a new feature, and we don't want to backport new features into an old release unless it's absolutely necessary.

If you need a binary, you can get one from any recent PR "Actions" tab. In there, click on "validate" in the left column, scroll all the way down to see "Artifacts", and in the zip will you will find a binary.

kolyshkin force-pushed the risc branch from 28f79d5 to d4b67e9 Compare April 1, 2022 22:18

kolyshkin requested review from cyphar, thaJeztah and AkihiroSuda and removed request for thaJeztah April 1, 2022 23:17

kolyshkin added this to the 1.2.0 milestone Apr 1, 2022

AkihiroSuda previously approved these changes Apr 2, 2022

View reviewed changes

kolyshkin dismissed AkihiroSuda’s stale review via ae4f3a7 April 29, 2022 01:06

kolyshkin force-pushed the risc branch from d4b67e9 to ae4f3a7 Compare April 29, 2022 01:06

kolyshkin mentioned this pull request Apr 29, 2022

Build runc.riscv64 #3463

Closed

kolyshkin requested a review from AkihiroSuda April 29, 2022 01:13

AkihiroSuda previously approved these changes Apr 30, 2022

View reviewed changes

This was referenced Apr 30, 2022

Support RISC-V 64 containerd/containerd#6882

Merged

seccomp: support riscv64 moby/moby#43553

Merged

kolyshkin dismissed AkihiroSuda’s stale review via 742b0db May 6, 2022 01:13

kolyshkin force-pushed the risc branch from ae4f3a7 to 742b0db Compare May 6, 2022 01:13

kolyshkin requested a review from AkihiroSuda May 6, 2022 01:13

AkihiroSuda approved these changes May 6, 2022

View reviewed changes

AkihiroSuda requested changes May 6, 2022

View reviewed changes

AkihiroSuda mentioned this pull request May 6, 2022

Support riscv64 containerd/nerdctl#1037

Merged

kolyshkin dismissed AkihiroSuda’s stale review via b669235 May 11, 2022 21:49

kolyshkin force-pushed the risc branch from 2c3629a to b669235 Compare May 11, 2022 21:49

AkihiroSuda previously approved these changes May 12, 2022

View reviewed changes

kolyshkin and others added 9 commits May 11, 2022 17:23

Dockerfile: nit

d542ad6

We do not use all the files from scripts, only seccomp.sh and lib.sh. This prevents unneeded rebuild of the image if e.g. scripts/release_build.sh has changed. Signed-off-by: Kir Kolyshkin <[email protected]>

Makefile: add LDFLAGS_COMMON and LDFLAGS_STATIC

f2f6e59

LDFLAGS_COMMON are used from two places, so it makes sense to dedup. LDFLAGS_STATIC is a preparation for the next commit. Signed-off-by: Kir Kolyshkin <[email protected]>

Makefile: add support for static PIE

21e32d4

Signed-off-by: Kir Kolyshkin <[email protected]>

libct/seccomp: add riscv64

1d7b297

Co-authored-by: Kir Kolyshkin <[email protected]> Signed-off-by: Akihiro Suda <[email protected]> Signed-off-by: Kir Kolyshkin <[email protected]>

release: add riscv64 binary

a14cc40

Signed-off-by: Kir Kolyshkin <[email protected]>

kolyshkin force-pushed the risc branch from b669235 to a14cc40 Compare May 12, 2022 00:23

thaJeztah approved these changes May 12, 2022

View reviewed changes

crazy-max reviewed May 12, 2022

View reviewed changes

cyphar dismissed AkihiroSuda’s stale review via a14cc40 May 13, 2022 04:29

AkihiroSuda approved these changes May 19, 2022

View reviewed changes

AkihiroSuda merged commit 8093c54 into opencontainers:main May 19, 2022

AkihiroSuda mentioned this pull request Jul 16, 2022

[release/1.6] Support RISC-V 64 containerd/containerd#7170

Merged

AkihiroSuda mentioned this pull request Oct 19, 2022

Adding support for RISC-V moby/moby#44319

Open

AkihiroSuda mentioned this pull request Jan 2, 2023

Enable riscv64 cross build moby/moby#44735

Draft

thaJeztah mentioned this pull request Feb 14, 2023

Makefile: fix typo in LDFLAGS_STATIC #3746

Merged

chazapis mentioned this pull request Jun 16, 2023

Backport riscv64 support into 1.1.x #3905

Merged

lifubang added the backport/1.1-done A PR in main branch which has been backported to release-1.1 label Jul 22, 2023

brandond mentioned this pull request Aug 2, 2023

Add support for position-independent executables (static-pie) rancher/image-build-base#51

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

release: build riscv64 binary, build static PIE if supported #3446

release: build riscv64 binary, build static PIE if supported #3446

kolyshkin commented Apr 1, 2022

kolyshkin commented Apr 14, 2022

AkihiroSuda commented Apr 28, 2022

thaJeztah commented Apr 28, 2022

AkihiroSuda commented Apr 28, 2022

kolyshkin commented Apr 29, 2022

kolyshkin commented Apr 29, 2022

AkihiroSuda commented May 5, 2022

kolyshkin commented May 6, 2022

AkihiroSuda left a comment

AkihiroSuda commented May 11, 2022

kolyshkin commented May 11, 2022

thaJeztah left a comment

thaJeztah commented May 12, 2022

crazy-max May 12, 2022

kolyshkin May 19, 2022 •

edited

Loading

kolyshkin May 19, 2022

kolyshkin May 19, 2022

brandond commented Apr 13, 2023

AkihiroSuda commented Apr 13, 2023

kolyshkin commented Apr 13, 2023

release: build riscv64 binary, build static PIE if supported #3446

release: build riscv64 binary, build static PIE if supported #3446

Conversation

kolyshkin commented Apr 1, 2022

kolyshkin commented Apr 14, 2022

AkihiroSuda commented Apr 28, 2022

thaJeztah commented Apr 28, 2022

AkihiroSuda commented Apr 28, 2022

kolyshkin commented Apr 29, 2022

kolyshkin commented Apr 29, 2022

AkihiroSuda commented May 5, 2022

kolyshkin commented May 6, 2022

AkihiroSuda left a comment

Choose a reason for hiding this comment

AkihiroSuda commented May 11, 2022

kolyshkin commented May 11, 2022

thaJeztah left a comment

Choose a reason for hiding this comment

thaJeztah commented May 12, 2022

crazy-max May 12, 2022

Choose a reason for hiding this comment

kolyshkin May 19, 2022 • edited Loading

Choose a reason for hiding this comment

kolyshkin May 19, 2022

Choose a reason for hiding this comment

kolyshkin May 19, 2022

Choose a reason for hiding this comment

brandond commented Apr 13, 2023

AkihiroSuda commented Apr 13, 2023

kolyshkin commented Apr 13, 2023

kolyshkin May 19, 2022 •

edited

Loading