From 04274fb29de388756e4b86a067574894da2946ed Mon Sep 17 00:00:00 2001 From: Joseph Melber Date: Mon, 13 Jul 2026 15:20:29 -0600 Subject: [PATCH 1/3] Force PIE on bootgen with explicit compiler/linker flags, not just the CMake property PR #3327 set POSITION_INDEPENDENT_CODE ON on the bootgen/bootgen-lib targets to keep bootgen's ELF layout PIE regardless of what the linked MLIR/LLVM package sets globally (needed because auditwheel repair's patchelf-based RPATH rewrite corrupts a non-PIE bootgen -- SIGSEGV SEGV_ACCERR jumping into the non-executable DYNAMIC segment before main() runs, breaking PDI/xclbin generation on real hardware). That fix didn't actually take effect: this project never calls check_pie_supported()/wires up CMP0083, so the POSITION_INDEPENDENT_CODE property has no effect on GCC's linking of the bootgen executable. The wheel built from #3327's own commit still ships a non-PIE `bootgen` (confirmed via `readelf -h` and reproduced the SIGSEGV via `strace` on the exact artifact CI produced), because manylinux_2_28's gcc-toolset doesn't default to PIE the way a distro's system gcc does. Pass -fPIC/-fPIE/-pie explicitly instead, placed last so they win over any inherited -fno-pie/-fno-PIC (compilers apply last-flag-wins for these). Verified locally under a forced -fno-pie -fno-PIC -no-pie global configuration (reproducing the manylinux/ROCm build environment) that the previous property-only approach still yields a non-PIE `EXEC` binary, while this change reliably produces a true PIE (`ET_DYN`) bootgen that runs correctly. Co-Authored-By: Claude Sonnet 5 --- tools/bootgen/CMakeLists.txt | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/tools/bootgen/CMakeLists.txt b/tools/bootgen/CMakeLists.txt index 7e8040dbc3a..ec55d332cad 100644 --- a/tools/bootgen/CMakeLists.txt +++ b/tools/bootgen/CMakeLists.txt @@ -144,6 +144,18 @@ if (CMAKE_CXX_COMPILER_ID MATCHES "MSVC") target_compile_options(bootgen-lib PRIVATE /wd4996 /wd4840 /wd4005 /wd5033) endif() target_compile_options(bootgen-lib PRIVATE ${bootgen_warning_ignores}) +if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU") + # Explicit -fPIC, not just the POSITION_INDEPENDENT_CODE property above: + # that property relies on CMake's CMP0083 + the CheckPIESupported module + # to inject the right compiler/linker flags, and this project never calls + # check_pie_supported(), so the property silently does nothing on some + # toolchains (observed on the manylinux_2_28 gcc-toolset used to build + # release wheels, which -- unlike a distro's system gcc -- does not + # default to PIE/PIC either). Passed last so it wins (compilers apply + # "last flag wins" for -fPIC/-fno-PIC) over anything inherited from the + # linked MLIR/LLVM package's own build configuration. + target_compile_options(bootgen-lib PRIVATE -fPIC) +endif() target_include_directories(bootgen-lib PRIVATE ${BOOTGEN_SOURCE} ${OPENSSL_INCLUDE_DIR}) # Make C API header available publicly target_include_directories(bootgen-lib PUBLIC @@ -166,6 +178,15 @@ if (CMAKE_CXX_COMPILER_ID MATCHES "MSVC") target_compile_options(bootgen PRIVATE /EHsc) target_compile_options(bootgen PRIVATE /wd4996 /wd4840 /wd4005 /wd5033) endif() +if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU") + # Explicit -fPIE/-pie (see bootgen-lib above for why the + # POSITION_INDEPENDENT_CODE property alone can't be trusted). Passed last + # so it wins -- compilers apply "last flag wins" for -fPIE/-fno-PIE and + # -pie/-no-pie -- over anything inherited from the linked MLIR/LLVM + # package's own build configuration. + target_compile_options(bootgen PRIVATE -fPIE) + target_link_options(bootgen PRIVATE -fPIE -pie) +endif() target_compile_definitions(bootgen PRIVATE OPENSSL_USE_APPLINK) target_link_libraries(bootgen PRIVATE bootgen-lib OpenSSL::SSL OpenSSL::applink) install(TARGETS bootgen) From e5a2c3da1792fdef0f2987941b4afa812e475f26 Mon Sep 17 00:00:00 2001 From: Joseph Melber Date: Mon, 13 Jul 2026 15:29:16 -0600 Subject: [PATCH 2/3] Address Copilot review comments - Guard the new -fPIC/-fPIE blocks with NOT MSVC too: clang-cl reports CMAKE_CXX_COMPILER_ID "Clang" but uses the MSVC-style driver, which doesn't accept these GNU-style flags. - Drop -fPIE from target_link_options(bootgen ...); it's a compile-only flag, and passing it at link time can break toolchains where linking doesn't go through the compiler driver. Only -pie belongs there. Re-verified locally under the same forced -fno-pie -fno-PIC -no-pie global configuration as before: bootgen still links as a true PIE (ET_DYN) binary and runs correctly. Co-Authored-By: Claude Sonnet 5 --- tools/bootgen/CMakeLists.txt | 27 ++++++++++----------------- 1 file changed, 10 insertions(+), 17 deletions(-) diff --git a/tools/bootgen/CMakeLists.txt b/tools/bootgen/CMakeLists.txt index ec55d332cad..b65b69617ba 100644 --- a/tools/bootgen/CMakeLists.txt +++ b/tools/bootgen/CMakeLists.txt @@ -144,16 +144,12 @@ if (CMAKE_CXX_COMPILER_ID MATCHES "MSVC") target_compile_options(bootgen-lib PRIVATE /wd4996 /wd4840 /wd4005 /wd5033) endif() target_compile_options(bootgen-lib PRIVATE ${bootgen_warning_ignores}) -if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU") - # Explicit -fPIC, not just the POSITION_INDEPENDENT_CODE property above: - # that property relies on CMake's CMP0083 + the CheckPIESupported module - # to inject the right compiler/linker flags, and this project never calls - # check_pie_supported(), so the property silently does nothing on some - # toolchains (observed on the manylinux_2_28 gcc-toolset used to build - # release wheels, which -- unlike a distro's system gcc -- does not - # default to PIE/PIC either). Passed last so it wins (compilers apply - # "last flag wins" for -fPIC/-fno-PIC) over anything inherited from the - # linked MLIR/LLVM package's own build configuration. +if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU" AND NOT MSVC) + # The POSITION_INDEPENDENT_CODE property above doesn't reliably force PIC + # here (this project never calls check_pie_supported(), which CMP0083 + # needs), so pass -fPIC explicitly, last, so it wins over any inherited + # -fno-PIC. NOT MSVC excludes clang-cl, which also matches "Clang" but + # can't parse this flag. target_compile_options(bootgen-lib PRIVATE -fPIC) endif() target_include_directories(bootgen-lib PRIVATE ${BOOTGEN_SOURCE} ${OPENSSL_INCLUDE_DIR}) @@ -178,14 +174,11 @@ if (CMAKE_CXX_COMPILER_ID MATCHES "MSVC") target_compile_options(bootgen PRIVATE /EHsc) target_compile_options(bootgen PRIVATE /wd4996 /wd4840 /wd4005 /wd5033) endif() -if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU") - # Explicit -fPIE/-pie (see bootgen-lib above for why the - # POSITION_INDEPENDENT_CODE property alone can't be trusted). Passed last - # so it wins -- compilers apply "last flag wins" for -fPIE/-fno-PIE and - # -pie/-no-pie -- over anything inherited from the linked MLIR/LLVM - # package's own build configuration. +if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU" AND NOT MSVC) + # See bootgen-lib above. -fPIE is compile-only; -pie is the link-mode + # switch (kept separate since some toolchains don't accept -fPIE at link). target_compile_options(bootgen PRIVATE -fPIE) - target_link_options(bootgen PRIVATE -fPIE -pie) + target_link_options(bootgen PRIVATE -pie) endif() target_compile_definitions(bootgen PRIVATE OPENSSL_USE_APPLINK) target_link_libraries(bootgen PRIVATE bootgen-lib OpenSSL::SSL OpenSSL::applink) From 5ce8ff1c3e6936fbd4711d6d6a791e5def6ebd07 Mon Sep 17 00:00:00 2001 From: Joseph Melber Date: Mon, 13 Jul 2026 16:33:31 -0600 Subject: [PATCH 3/3] Fix comments --- tools/bootgen/CMakeLists.txt | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/tools/bootgen/CMakeLists.txt b/tools/bootgen/CMakeLists.txt index b65b69617ba..c6b9f829253 100644 --- a/tools/bootgen/CMakeLists.txt +++ b/tools/bootgen/CMakeLists.txt @@ -146,10 +146,7 @@ endif() target_compile_options(bootgen-lib PRIVATE ${bootgen_warning_ignores}) if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU" AND NOT MSVC) # The POSITION_INDEPENDENT_CODE property above doesn't reliably force PIC - # here (this project never calls check_pie_supported(), which CMP0083 - # needs), so pass -fPIC explicitly, last, so it wins over any inherited - # -fno-PIC. NOT MSVC excludes clang-cl, which also matches "Clang" but - # can't parse this flag. + # so pass -fPIC explicitly, last, so it wins over any inherited -fno-PIC. target_compile_options(bootgen-lib PRIVATE -fPIC) endif() target_include_directories(bootgen-lib PRIVATE ${BOOTGEN_SOURCE} ${OPENSSL_INCLUDE_DIR})