2068010 - NSS 3.128 Duplicate symbol error for make builds on non-linux hosts

Status: NEW

(NSS :: Build, defect, P1)

Description

[Dennis Jackson]

Reported by [e-mail] to the dev-tech-crypto mailing list.

Since NSS 3.128, the legacy coreconf/make build of libfreebl3 fails to link on macOS/arm64 with five duplicate symbols, each defined in both gcm.o and ghash-aarch64.o:

  duplicate symbol '_gcm_HashInit_hw'
  duplicate symbol '_platform_ghash_support'
  duplicate symbol '_gcm_HashZeroX_hw'
  duplicate symbol '_gcm_HashWrite_hw'
  duplicate symbol '_gcm_HashMult_hw'
  ld: 5 duplicate symbols

Two guards decide whether those five functions are compiled, and on a non-Linux
host they disagree.

1. lib/freebl/gcm.c:37-38 compiles fallback stubs:

   /* Stub definitions if we aren't linking a platform-specific ghash */
   #if !defined(HAVE_PLATFORM_GHASH)

2. lib/freebl/ghash-aarch64.c:12 compiles the real PMULL implementation:

   #if defined(aarch64) && defined(IS_LITTLE_ENDIAN) &&
   (defined(clang) || defined(GNUC) && GNUC > 6)

   IS_LITTLE_ENDIAN comes from NSPR's pr/include/md/_darwin.cfg, which sets it
   from clang's LITTLE_ENDIAN — not from the makefile.

lib/freebl/Makefile:139-146 is what keeps the two in sync. It adds
ghash-aarch64.c to the link unconditionally, but gates -DHAVE_PLATFORM_GHASH on
the make variable LITTLE_ENDIAN:

ifeq ($(CPU_ARCH),aarch64)
    ifdef CC_IS_CLANG
        DEFINES += -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2
        ifeq ($(LITTLE_ENDIAN),1)
            DEFINES += -DHAVE_PLATFORM_GHASH
        endif
        EXTRA_SRCS += aes-armv8.c ghash-aarch64.c sha1-armv8.c sha256-armv8.c

LITTLE_ENDIAN is set in exactly one place, coreconf/Linux.mk:191-197, and
coreconf/arch.mk:57-64 includes Linux.mk only when the host OS_ARCH is Linux.
On macOS it is never included, so LITTLE_ENDIAN is undefined, the ifeq fails,
HAVE_PLATFORM_GHASH is dropped, gcm.c emits the five stubs — and
ghash-aarch64.c emits the same five real functions.

Only the legacy coreconf/make build is affected. gyp defines HAVE_PLATFORM_GHASH unconditionally for arm64/aarch64.

Comment 1

[Thomas Klausner]

I have gotten a report that this also affects the NetBSD arm64 port.

Comment 3

[Landry Breuil (:gaston)]

fwiw it also affects OpenBSD/arm64, for now i've copypasted https://hg-edge.mozilla.org/projects/nss/diff/dd07a5b89f6ee00465c947c987563cdfde636bf3/coreconf/Linux.mk to coreconf/OpenBSD.mk locally. Maybe that should go in a common makefile ?