Fix OP-TEE build on Ubuntu Jammy (older binutils)

[TuAFBogey]

Summary

• Fix OP-TEE build failure on Ubuntu Jammy due to unsupported linker flag
• The --no-warn-rwx-segments flag is only available in binutils 2.39+
• Added conditional check before using the flag

Changes

# Check if linker supports --no-warn-rwx-segments (binutils 2.39+)
# Workaround for ubuntu:jammy older toolchain
local ldflags=""
if ${cross_compile}ld --help 2>&1 | grep -q "no-warn-rwx-segments"; then
    ldflags="--no-warn-rwx-segments"
fi

Testing

• Successfully built u-boot on ubuntu:jammy with DOCKER_ARMBIAN_BASE_IMAGE="ubuntu:jammy"

Summary by CodeRabbit

Release Notes

• Chores
  • Enhanced build compatibility by implementing runtime detection for linker flag support, enabling the OP-TEE build system to work seamlessly with a broader range of cross-compiler toolchains.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

📝 Walkthrough

Walkthrough

A runtime check is introduced to detect cross-compiler linker support for the --no-warn-rwx-segments flag. If supported, the LDFLAGS variable is set to this flag; otherwise, it remains empty. The OP-TEE build invocation is updated to use the conditionally-set LDFLAGS instead of a hardcoded flag value.

Changes

Cohort / File(s)	Summary
OP-TEE Build Configuration config/sources/families/nuvoton-ma35d1.conf	Added runtime detection for linker flag support via conditional check; replaces hardcoded --no-warn-rwx-segments with conditionally-set LDFLAGS variable in OP-TEE build invocation.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• #8583: Detects and selects the correct linker flag variant for suppressing RWX warnings across different toolchains.
• #8757: Ensures the --no-warn-rwx-segments flag is properly forwarded to the linker with -Wl, prefix handling.
• #9162: Implements similar runtime detection and conditional application of the --no-warn-rwx-segment(s) flag to replace hardcoded usage.

Suggested reviewers

• igorpecovnik
• chainsx
• EvilOlaf
• prahal

Poem

🐰 A linker flag once hardcoded in stone,
Now dances with grace when the compiler's known!
Runtime detection—a flexible friend,
No warnings of RWX from beginning to end! 🎉

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically summarizes the main change: adding a conditional check to fix OP-TEE build failures on Ubuntu Jammy systems with older binutils that don't support the --no-warn-rwx-segments flag.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

---

📜 Recent review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 5182e2a and f442f01.

📒 Files selected for processing (1)

• config/sources/families/nuvoton-ma35d1.conf

🧰 Additional context used

🧠 Learnings (4)

📓 Common learnings

Learnt from: glneo
Repo: armbian/build PR: 8913
File: config/sources/families/include/k3_common.inc:57-60
Timestamp: 2025-11-11T20:56:20.303Z
Learning: In config/sources/families/include/k3_common.inc, the OP-TEE build command at line 59 should be updated in a future PR to explicitly set CROSS_COMPILE64=aarch64-linux-gnu- and CROSS_COMPILE32=arm-linux-gnueabihf- instead of relying on OP-TEE's internal defaults, for better clarity and maintainability. User glneo agreed to address this in a separate PR.

Learnt from: tabrisnet
Repo: armbian/build PR: 8925
File: lib/functions/host/docker.sh:141-141
Timestamp: 2025-11-13T14:50:44.662Z
Learning: In the Armbian build system, certain boards have U-Boot that doesn't build correctly on ubuntu:noble but works on ubuntu:jammy. For these boards, DOCKER_ARMBIAN_BASE_IMAGE can be set to "ubuntu:jammy" via an extension file loaded before docker_cli_prepare() runs, allowing legacy toolchains to work while the community works on proper fixes with limited resources.

Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.

Learnt from: tabrisnet
Repo: armbian/build PR: 8661
File: lib/functions/compilation/armbian-kernel.sh:194-199
Timestamp: 2025-09-25T18:37:00.330Z
Learning: In PR armbian/build#8661, line 235 of lib/functions/compilation/armbian-kernel.sh already contains the corrected comment "BPF link support for netfilter hooks" for NETFILTER_BPF_LINK, not the misleading "BPF_SYSCALL" comment that was flagged during review.

Learnt from: rpardini
Repo: armbian/build PR: 9159
File: patch/u-boot/u-boot-genio/0026-dts-configs-add-Grinn-GenioSBC-510.patch:161-161
Timestamp: 2026-01-03T20:46:29.189Z
Learning: For the Armbian genio family (config/sources/families/genio.conf and patch/u-boot/u-boot-genio/), when reviewing PRs that include vendor U-Boot patches from Collabora, avoid flagging potential issues in board configurations that are out of scope for the PR's primary focus (e.g., don't flag Genio 510/700 board issues when the PR is focused on radxa-nio-12l/Genio 1200). The maintainer prioritizes keeping vendor patches close to upstream for easier re-copying and maintenance, even if secondary board configs have potential mismatches.
<!-- </add_learning>

Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub or the PR API to get the complete picture of what files are being added or modified.

Learnt from: rpardini
Repo: armbian/build PR: 8044
File: patch/u-boot/v2025.04/cmd-fileenv-read-string-from-file-into-env.patch:76-86
Timestamp: 2025-03-31T22:20:48.475Z
Learning: For the Armbian build project, maintaining consistency with existing patches across U-Boot versions (such as between 2025.01 and 2025.04) is prioritized over refactoring individual patches for code improvements.

Learnt from: EvilOlaf
Repo: armbian/build PR: 8428
File: config/boards/lckfb-taishanpi.csc:5-9
Timestamp: 2025-07-25T03:51:50.830Z
Learning: When reviewing PRs in the Armbian build system, U-Boot defconfig files and patches may be added as part of the PR changes but might not be visible in the current repository clone state during review. It's important to check the actual PR file changes directly via GitHub API (https://api.github.com/repos/armbian/build/pulls/{pr_number}/files) to get the complete picture of what files are being added or modified, especially for U-Boot patches that will be applied during the build process.

Learnt from: EvilOlaf
Repo: armbian/build PR: 8968
File: patch/u-boot/u-boot-sunxi/arm64-dts-sun50i-h6-orangepi.dtsi-Rollback-r_rsb-to-r_i2c.patch:36-36
Timestamp: 2025-11-20T18:20:11.985Z
Learning: The rewrite-patches tool (REWRITE_PATCHES=yes) in the Armbian build system can inadvertently introduce semantic changes when the u-boot/kernel git base revision differs from expected state. The tool applies patches, commits them, and re-exports them using git format-patch, which can cause the re-exported patch to reflect the base revision's state rather than preserving the original patch intent. This is particularly problematic for device tree changes like interrupt specifications. The tool currently lacks validation mechanisms to detect such semantic drift, and affected patches must be manually corrected after rewriting.

Learnt from: EvilOlaf
Repo: armbian/build PR: 0
File: :0-0
Timestamp: 2025-12-19T13:56:45.124Z
Learning: When reviewing kernel or u-boot version bump PRs in the Armbian build system, check if patches existed in previous kernel version directories (e.g., sunxi-6.12, sunxi-6.13) before describing them as new features. If a patch and the majority of its contents existed previously with no major functionality changes, focus the review on the actual changes: the version bump itself and patch compatibility adjustments. Don't describe existing patches being ported/maintained across versions as new features or drivers—this is misleading. The patches are existing code being re-aligned to work with the new upstream version.

📚 Learning: 2025-11-11T20:56:20.303Z

Learnt from: glneo
Repo: armbian/build PR: 8913
File: config/sources/families/include/k3_common.inc:57-60
Timestamp: 2025-11-11T20:56:20.303Z
Learning: In config/sources/families/include/k3_common.inc, the OP-TEE build command at line 59 should be updated in a future PR to explicitly set CROSS_COMPILE64=aarch64-linux-gnu- and CROSS_COMPILE32=arm-linux-gnueabihf- instead of relying on OP-TEE's internal defaults, for better clarity and maintainability. User glneo agreed to address this in a separate PR.

Applied to files:

• config/sources/families/nuvoton-ma35d1.conf

📚 Learning: 2026-01-03T20:46:29.189Z

Learnt from: rpardini
Repo: armbian/build PR: 9159
File: patch/u-boot/u-boot-genio/0026-dts-configs-add-Grinn-GenioSBC-510.patch:161-161
Timestamp: 2026-01-03T20:46:29.189Z
Learning: For the Armbian genio family (config/sources/families/genio.conf and patch/u-boot/u-boot-genio/), when reviewing PRs that include vendor U-Boot patches from Collabora, avoid flagging potential issues in board configurations that are out of scope for the PR's primary focus (e.g., don't flag Genio 510/700 board issues when the PR is focused on radxa-nio-12l/Genio 1200). The maintainer prioritizes keeping vendor patches close to upstream for easier re-copying and maintenance, even if secondary board configs have potential mismatches.
<!-- </add_learning>

Applied to files:

• config/sources/families/nuvoton-ma35d1.conf

📚 Learning: 2025-12-12T23:09:56.813Z

Learnt from: tabrisnet
Repo: armbian/build PR: 9058
File: config/sources/families/spacemit.conf:39-45
Timestamp: 2025-12-12T23:09:56.813Z
Learning: In Armbian build configs for vendor kernel sources, prefer the following branch naming conventions: use 'vendor' or 'vendor-rt' for stable vendor releases, and 'vendor-edge' for bleeding-edge/pre-release vendor versions. The 'edge' naming without the 'vendor-' prefix is reserved for mainline kernel branches. Apply this pattern to family config files under config/sources/families (e.g., spacemit.conf) to ensure consistent vendor kernel sourcing naming across the repository.

Applied to files:

• config/sources/families/nuvoton-ma35d1.conf

🔇 Additional comments (2)

config/sources/families/nuvoton-ma35d1.conf (2)

119-124: LGTM! Clean implementation of the linker flag detection.

The approach correctly detects --no-warn-rwx-segments support by checking the linker's help output. This gracefully handles older binutils (< 2.39) on Ubuntu Jammy where the flag is unavailable.

Based on learnings, this aligns with the pattern where certain boards need DOCKER_ARMBIAN_BASE_IMAGE="ubuntu:jammy" for legacy toolchain compatibility.

---

129-137: LGTM! The conditional LDFLAGS integrates cleanly.

The LDFLAGS="${ldflags}" correctly passes either the flag or an empty string without affecting other build parameters. When empty, this is effectively a no-op which is the desired behavior for older toolchains.

_{✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

✅ This PR has been reviewed and approved — all set for merge!

[EvilOlaf]

#9162
@rpardini touched that rwx segment stuff recently, just for awareness

[rpardini]

#9162
@rpardini touched that rwx segment stuff recently, just for awareness

Yep, I did in core, but this is family code, which breaks cos armbian/os builds everything on Jammy despite all of us working on Noble.

[igorpecovnik]

OK, we will move to Noble, but this can't hurt.

[TuAFBogey]

OK, we will move to Noble, but this can't hurt.

If there's anything I can do to help, I'd be happy to support you.