guix: re-revert risc-v execstack workaround #25313

Now that we use GCC 10 for release builds, we no-longer need to pass -Wl,-z,noexecstack to get a non-executable stack in RISC-V binaries.

This was originally removed in #21036, but then re-added in #21799, when we reverted to using GCC 8.

Guix Build (arm64):

0655a94f88e8e89b1e048ae96e99c7dd45aed32011fe4ed9d03d0d1dfa073650  guix-build-2dcf3e153fbc/output/arm-linux-gnueabihf/SHA256SUMS.part
7c803347073839e2c7d8c1260e691964ab00b149da506edda4dc693df8e7f345  guix-build-2dcf3e153fbc/output/arm-linux-gnueabihf/bitcoin-2dcf3e153fbc-arm-linux-gnueabihf-debug.tar.gz
3b9ce2f349b9a4a463f66c9a2838e8490d4990c5b8dea9ad458b0bafeba8d1ac  guix-build-2dcf3e153fbc/output/arm-linux-gnueabihf/bitcoin-2dcf3e153fbc-arm-linux-gnueabihf.tar.gz
557c01453e3cedf6ef171715a02fe63abd7223f779a8c9b94ddc9ec17a4a45e4  guix-build-2dcf3e153fbc/output/arm64-apple-darwin/SHA256SUMS.part
26fcdbd10ad372ef541f519cc4990bdb5d513b51b05252ce9bde6e84258157b9  guix-build-2dcf3e153fbc/output/arm64-apple-darwin/bitcoin-2dcf3e153fbc-arm64-apple-darwin-unsigned.dmg
b145a9f6716f8e7f8c23d247fa82a02e4e7b76bebb17d55a1190448d0db5ab23  guix-build-2dcf3e153fbc/output/arm64-apple-darwin/bitcoin-2dcf3e153fbc-arm64-apple-darwin-unsigned.tar.gz
f172cd4c799a7ab065a36829fb8d546e83ce6791d9cb326d7cef14ad74d63d7a  guix-build-2dcf3e153fbc/output/arm64-apple-darwin/bitcoin-2dcf3e153fbc-arm64-apple-darwin.tar.gz
9a6c886a0bc81e729e3bb50dd972e10c8d4563bcbd917a9ba9c418a6fbe2de71  guix-build-2dcf3e153fbc/output/dist-archive/bitcoin-2dcf3e153fbc.tar.gz
254a11143d61aeb98749cd405ed307cca77e80198d58b7bb669ef9490cc8eaf6  guix-build-2dcf3e153fbc/output/powerpc64-linux-gnu/SHA256SUMS.part
83d7dc51404e328f6965f4d2da0b76fbe0a712d48465d6713348e0c4eb314a0a  guix-build-2dcf3e153fbc/output/powerpc64-linux-gnu/bitcoin-2dcf3e153fbc-powerpc64-linux-gnu-debug.tar.gz
522b98c63ab76dac6083a17f6b8f8173e9683f7d79e6f46b0a2e56c48e841a02  guix-build-2dcf3e153fbc/output/powerpc64-linux-gnu/bitcoin-2dcf3e153fbc-powerpc64-linux-gnu.tar.gz
96053b629ba60446f499d19400a25913932a02920bad963aaa12f1b6337b9f6e  guix-build-2dcf3e153fbc/output/powerpc64le-linux-gnu/SHA256SUMS.part
147f0b1d07b986879a859e6d6186c339085bcfcac4c5fe30586f94e0ab09ce77  guix-build-2dcf3e153fbc/output/powerpc64le-linux-gnu/bitcoin-2dcf3e153fbc-powerpc64le-linux-gnu-debug.tar.gz
c916680e75fb265e4099244cb876c2535c45981fbba9cfef9ad47c3aa58bc60b  guix-build-2dcf3e153fbc/output/powerpc64le-linux-gnu/bitcoin-2dcf3e153fbc-powerpc64le-linux-gnu.tar.gz
b90329d8531afb450678ec3d0981d3b1542f7b17d2feb0f2630216d0479630ad  guix-build-2dcf3e153fbc/output/riscv64-linux-gnu/SHA256SUMS.part
c77f02947d57ad2b841d594dca55271c9aecc1ef03f55371e0109ccaa5782aba  guix-build-2dcf3e153fbc/output/riscv64-linux-gnu/bitcoin-2dcf3e153fbc-riscv64-linux-gnu-debug.tar.gz
234f54da9df09ef2f330be016d58ab11e81e49644db01b6093050b5fcd5c5c82  guix-build-2dcf3e153fbc/output/riscv64-linux-gnu/bitcoin-2dcf3e153fbc-riscv64-linux-gnu.tar.gz
637f4a77d17493b319fb404e91c949373e0105caff61200f2a62729ca515f6de  guix-build-2dcf3e153fbc/output/x86_64-apple-darwin/SHA256SUMS.part
6cbe6c91e0a35df9f92af461f68f823c7d12c37237c33e0169825ba56eb9a7c3  guix-build-2dcf3e153fbc/output/x86_64-apple-darwin/bitcoin-2dcf3e153fbc-x86_64-apple-darwin-unsigned.dmg
b9b8cc7317e62a34f2286e07f743d4274b7ad00e93653e281257fc3bc068f30c  guix-build-2dcf3e153fbc/output/x86_64-apple-darwin/bitcoin-2dcf3e153fbc-x86_64-apple-darwin-unsigned.tar.gz
b846df40c5a956ca02a017fbd2b97bc39caba876f7b6ad080ba1962b9092cb0d  guix-build-2dcf3e153fbc/output/x86_64-apple-darwin/bitcoin-2dcf3e153fbc-x86_64-apple-darwin.tar.gz
5260fe7678567af5e73d296bfb115e09cc352e039fa6ae41007a6a93a5d1d6fd  guix-build-2dcf3e153fbc/output/x86_64-linux-gnu/SHA256SUMS.part
2ddbf9afe86ff3bcde44a6beb8e1fa2a8b9a35ceae33aa1633878d8c7f611939  guix-build-2dcf3e153fbc/output/x86_64-linux-gnu/bitcoin-2dcf3e153fbc-x86_64-linux-gnu-debug.tar.gz
a21eb3ad0671d3f09ce3b1e5263ba6cd9ea56f2c51d849bc39010b9c2b273ebf  guix-build-2dcf3e153fbc/output/x86_64-linux-gnu/bitcoin-2dcf3e153fbc-x86_64-linux-gnu.tar.gz
0043277076a16b2baf5dc1957c2e176d5c5d95abe693b3d6bd6dec7ccb9f5481  guix-build-2dcf3e153fbc/output/x86_64-w64-mingw32/SHA256SUMS.part
c7271c7ee7361c2f3349a00fd444fcfd42b07dbe77905a5570366312ba413fbc  guix-build-2dcf3e153fbc/output/x86_64-w64-mingw32/bitcoin-2dcf3e153fbc-win64-debug.zip
19197d3abd2f422ad860a888578369da453509be3f8cab04cbf80055263b83c9  guix-build-2dcf3e153fbc/output/x86_64-w64-mingw32/bitcoin-2dcf3e153fbc-win64-setup-unsigned.exe
21bfae266d684e95ebe8bcf40102c3ee8468e3d7364f6d6c5c6dd9dfc06b376a  guix-build-2dcf3e153fbc/output/x86_64-w64-mingw32/bitcoin-2dcf3e153fbc-win64-unsigned.tar.gz
2feb16aab1fb0007670f816b1e25bff031acca01f68e3b5a8b20d13b60542b48  guix-build-2dcf3e153fbc/output/x86_64-w64-mingw32/bitcoin-2dcf3e153fbc-win64.zip

Oh, nice! Is it still needed for powerpc64?

Is it still needed for powerpc64?

Yes, still required for that build.

Yes, still required for that build.

OK, interesting, i wonder what object file is the root cause there.

-Wl,-z,noexecstack can be a fairly dangerous work-around because it overrides the 'preference' flag of the code itself, so if some code actually requires an executable stack and we force it to be non-executable it could crash.

For RISC-V I traced it back to a compiler bug at the time but don't remember for ppc64.

ACK 2dcf3e153fbc3f39290e66c1f20c1e613e28a66d (it wouldn't pass the security check and finish the guix build if it didn't work)

Guix builds on x86_64:

$ find guix-build-$(git rev-parse --short=12 HEAD)/output/ -type f -print0 | env LC_ALL=C sort -z | xargs -r0 sha256sum
165d622a05819369564a3d79f8bc511f398cc32f0c507ab5ea11798ce9a9dbbe  guix-build-2dcf3e153fbc/output/aarch64-linux-gnu/SHA256SUMS.part
3284353ba45386af62c63c65bcf13a480b80da00cf6bc8cbc44ad2739e16565b  guix-build-2dcf3e153fbc/output/aarch64-linux-gnu/bitcoin-2dcf3e153fbc-aarch64-linux-gnu-debug.tar.gz
df42fb36c40ccdf3aa16ab97598e6dcbb3c475ebe19592f4c7039681c6fda817  guix-build-2dcf3e153fbc/output/aarch64-linux-gnu/bitcoin-2dcf3e153fbc-aarch64-linux-gnu.tar.gz
5d34e6e6aa15b997b5df86970f79f35153278ef05ddc2382edbc64d8c435f860  guix-build-2dcf3e153fbc/output/arm-linux-gnueabihf/SHA256SUMS.part
4e4f94d7aaa6524683e11bcf7c4a926eda7ff45fa306e3a75f8eb9cd35d3bc41  guix-build-2dcf3e153fbc/output/arm-linux-gnueabihf/bitcoin-2dcf3e153fbc-arm-linux-gnueabihf-debug.tar.gz
b5dba3edbaa456fa66ee90adcf842ba724e9e5a263d239ec389e06a1be7bb1cf  guix-build-2dcf3e153fbc/output/arm-linux-gnueabihf/bitcoin-2dcf3e153fbc-arm-linux-gnueabihf.tar.gz
9fcff3368a674b5bd059dfc9f062970a22109039cf32ec9f6d3ebe3804db8343  guix-build-2dcf3e153fbc/output/arm64-apple-darwin/SHA256SUMS.part
f4253bfc14a73fd513d649bc624439af312e6affe39143f734007de00ca7b588  guix-build-2dcf3e153fbc/output/arm64-apple-darwin/bitcoin-2dcf3e153fbc-arm64-apple-darwin-unsigned.dmg
efaca496af57b16e9e0cee3815906b2edba33bfb45a6bab7439b956daddf5abc  guix-build-2dcf3e153fbc/output/arm64-apple-darwin/bitcoin-2dcf3e153fbc-arm64-apple-darwin-unsigned.tar.gz
5436f872831823f48f380ab10177988d2f73797bee694a4f99c008967122e225  guix-build-2dcf3e153fbc/output/arm64-apple-darwin/bitcoin-2dcf3e153fbc-arm64-apple-darwin.tar.gz
9a6c886a0bc81e729e3bb50dd972e10c8d4563bcbd917a9ba9c418a6fbe2de71  guix-build-2dcf3e153fbc/output/dist-archive/bitcoin-2dcf3e153fbc.tar.gz
e25a9fce9003211342e5d4090140bae4d194ac7579f51f0dac51f5b79435cb48  guix-build-2dcf3e153fbc/output/powerpc64-linux-gnu/SHA256SUMS.part
435139e6cd3ede5ff9e2f8099f66f21bc4ef3289aaf23a3b67f5e9e11b2617fe  guix-build-2dcf3e153fbc/output/powerpc64-linux-gnu/bitcoin-2dcf3e153fbc-powerpc64-linux-gnu-debug.tar.gz
f79e9ea8a442eaca97d298c202e6c86eeafaf2429bd7b179f1d18355161ba374  guix-build-2dcf3e153fbc/output/powerpc64-linux-gnu/bitcoin-2dcf3e153fbc-powerpc64-linux-gnu.tar.gz
6f0619adeb20799cc3d598fcf8c4808125e8f5c8a4240436bbadac0361ef2457  guix-build-2dcf3e153fbc/output/powerpc64le-linux-gnu/SHA256SUMS.part
df0b1e6823edc1dd25a25a3071201f72a107fab270a52c1a3896197635aeab19  guix-build-2dcf3e153fbc/output/powerpc64le-linux-gnu/bitcoin-2dcf3e153fbc-powerpc64le-linux-gnu-debug.tar.gz
c426d1a7ff0475ad094f2fdd04979506f8e6e4a2d02798b0496bda9c655b6fa2  guix-build-2dcf3e153fbc/output/powerpc64le-linux-gnu/bitcoin-2dcf3e153fbc-powerpc64le-linux-gnu.tar.gz
29850dad7269f095c3594e17ddb495dd807d310850bb05805f1757a23e6daafc  guix-build-2dcf3e153fbc/output/riscv64-linux-gnu/SHA256SUMS.part
117ef143f7021baa15478b7a81454eb3625d057e75a2f9f9b2d57b78321d3c0d  guix-build-2dcf3e153fbc/output/riscv64-linux-gnu/bitcoin-2dcf3e153fbc-riscv64-linux-gnu-debug.tar.gz
428bbf7ed77b5e32f53ea29e86384315de2cf57fb8ff281a4e1c49ae41382c70  guix-build-2dcf3e153fbc/output/riscv64-linux-gnu/bitcoin-2dcf3e153fbc-riscv64-linux-gnu.tar.gz
637f4a77d17493b319fb404e91c949373e0105caff61200f2a62729ca515f6de  guix-build-2dcf3e153fbc/output/x86_64-apple-darwin/SHA256SUMS.part
6cbe6c91e0a35df9f92af461f68f823c7d12c37237c33e0169825ba56eb9a7c3  guix-build-2dcf3e153fbc/output/x86_64-apple-darwin/bitcoin-2dcf3e153fbc-x86_64-apple-darwin-unsigned.dmg
b9b8cc7317e62a34f2286e07f743d4274b7ad00e93653e281257fc3bc068f30c  guix-build-2dcf3e153fbc/output/x86_64-apple-darwin/bitcoin-2dcf3e153fbc-x86_64-apple-darwin-unsigned.tar.gz
b846df40c5a956ca02a017fbd2b97bc39caba876f7b6ad080ba1962b9092cb0d  guix-build-2dcf3e153fbc/output/x86_64-apple-darwin/bitcoin-2dcf3e153fbc-x86_64-apple-darwin.tar.gz
722b0b99a7ba27ad2ea75c4aa14e4f25a81425fbf42d7b5e6fcab1dcf47c7476  guix-build-2dcf3e153fbc/output/x86_64-linux-gnu/SHA256SUMS.part
f7702a0f21e703b3588b9dcecaf58ae2af462deb2f252a1e200bc4674a48ed04  guix-build-2dcf3e153fbc/output/x86_64-linux-gnu/bitcoin-2dcf3e153fbc-x86_64-linux-gnu-debug.tar.gz
502f958ab94b506a04ac615042c652d13048bd899c4f569a9fd20188bb9e8490  guix-build-2dcf3e153fbc/output/x86_64-linux-gnu/bitcoin-2dcf3e153fbc-x86_64-linux-gnu.tar.gz
8cdb106494e82ad8c4ba70426438113212c1545a35f80004867e34876e934630  guix-build-2dcf3e153fbc/output/x86_64-w64-mingw32/SHA256SUMS.part
9c08d66e38e9b6899f7e54ea89de1a88d8b757549c18bf16c68394d0acc8d3a1  guix-build-2dcf3e153fbc/output/x86_64-w64-mingw32/bitcoin-2dcf3e153fbc-win64-debug.zip
19197d3abd2f422ad860a888578369da453509be3f8cab04cbf80055263b83c9  guix-build-2dcf3e153fbc/output/x86_64-w64-mingw32/bitcoin-2dcf3e153fbc-win64-setup-unsigned.exe
21bfae266d684e95ebe8bcf40102c3ee8468e3d7364f6d6c5c6dd9dfc06b376a  guix-build-2dcf3e153fbc/output/x86_64-w64-mingw32/bitcoin-2dcf3e153fbc-win64-unsigned.tar.gz
b48f93c7a72274c07f8c118bea975e655e0d228b53b75a74fa2263cb61ce9d6e  guix-build-2dcf3e153fbc/output/x86_64-w64-mingw32/bitcoin-2dcf3e153fbc-win64.zip

For RISC-V I traced it back to a compiler bug at the time but don't remember for ppc64.

I've done some research for ppc64. From what I understand from old discussions e.g.:

• https://binutils.sourceware.narkive.com/6eriy5ZX/ppc64-exec-stack
• https://gcc.gnu.org/bugzilla/show_bug.cgi?id=21098
• https://groups.google.com/g/fa.linux.kernel/c/vUM60JrpSf8

ppc64 never needs an executable stack, not even for cases where it'd be needed normally (such as stack trampolines for nested C functions). For this reason the .note.GNU-stack ELF note is never emitted. This also holds for the GNU_STACK program header.

Some architectures (especially newer ones) default to non-exec stack. The absense of a GNU_STACK header represents the default. - Andreas Schwab, linux kernel list

So it may well be that it's our check that is wrong, not gcc, in this case! (it would be good if someone with ppc64 could check this; execute a binary without GNU_STACK program header, which should be any, then see if the [stack] in /proc/<pid>/mappings does not have x)

<!--9cd9c72976c961c55c7acef8f6ba82cd-->

Guix builds

ACK 2dcf3e153fbc3f39290e66c1f20c1e613e28a66d