pkg/60561: libffcall unusable on NetBSD/macppc 11.0

["he%NetBSD.org@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60561
>Category:       pkg
>Synopsis:       libffcall unusable on NetBSD/macppc 11.0
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Aug 08 17:55:00 +0000 2026
>Originator:     Havard Eidnes
>Release:        NetBSD 11.0
>Organization:
	I try...
>Environment:
System: NetBSD bramley.urc.uninett.no 11.0 NetBSD 11.0 (BRAMLEY) #4: Sat Aug  8 14:36:14 CEST 2026  he%bramley.urc.uninett.no@localhost:/usr/obj/sys/arch/macppc/compile/BRAMLEY macppc
Architecture: powerpc
Machine: macppc
>Description:
	While trying to follow up packages which fail to bulk-build
	on NetBSD/macppc 11.0, the turn has come to lang/clisp.

	As part of that, I found that once the initial build issues
	are sorted out in lang/clisp, the linked lisp interpreter
	fails to start with

./lisp.run -B . -N locale -E UTF-8 -Epathname 1:1 -Emisc 1:1 -norc -m 2MW -lp  -x '(and (load "init.lisp") (sys::%saveinitmem) (ext::exit)) (ext::exit t)'
/usr/pkgsrc/lang/clisp/work/clisp-2.49/src/./lisp.run: Shared object "libcallback.so.1" not found

	However, that package *is* installed, but ktrace'ing a simple
	./lisp.run reveals

  7579   7579 lisp.run CALL  open(0xfff0473c,0,0xfff04758)
  7579   7579 lisp.run NAMI  "/usr/pkg/lib/libcallback.so.1"
  7579   7579 lisp.run RET   open 3
  7579   7579 lisp.run CALL  __fstat50(3,0xfff04658)
  7579   7579 lisp.run RET   __fstat50 0
  7579   7579 lisp.run CALL  mmap(0,0x1000,PROT_READ,0x1<SHARED,FILE,ALIGN=NONE>,3,0,0,0)
  7579   7579 lisp.run RET   mmap -302870528/0xedf29000
  7579   7579 lisp.run CALL  mmap(0,0x21000,PROT_NONE,0x10001002<PRIVATE,ANONYMOUS,ALIGN=64KB>,0xffffffff,0,0,0)
  7579   7579 lisp.run RET   mmap -304152576/0xeddf0000
  7579   7579 lisp.run CALL  mmap(0xeddf0000,0x3000,PROT_READ|PROT_EXEC,0x12<PRIVATE,FIXED,FILE,ALIGN=NONE>,3,0,0,0)
  7579   7579 lisp.run RET   mmap -304152576/0xeddf0000
  7579   7579 lisp.run CALL  mmap(0xede0f000,0x2000,PROT_READ|PROT_WRITE|PROT_EXEC,0x12<PRIVATE,FIXED,FILE,ALIGN=NONE>,3,0,0,0xf000)
  7579   7579 lisp.run RET   mmap -1 errno 13 Permission denied

	and an inspection of the shared library reveals that .got and .plt
	sections are both writeable and executable:

bramley: {132} readelf -a /usr/pkg/lib/libcallback.so | grep WAX
  [20] .got              PROGBITS        00020000 010000 000010 04 WAX  0   0  4
  [22] .plt              NOBITS          00020014 010014 00018c 00 WAX  0   0  4
bramley: {133} 

	and this host runs basically a GENERIC kernel, hence, PAX_MPROTECT
	is turned on.

	Manually turning off MPROTECT checking makes the lisp interpreter
	start:

bramley: {136} paxctl lisp.run
No PaX flags.
bramley: {137} paxctl +m lisp.run
bramley: {138} paxctl lisp.run
PaX flags:
  m: mprotect(2) restrictions, explicit disable
bramley: {139} ./lisp.run
WARNING: locale: no encoding 646, using ISO-8859-1
WARNING: locale: no encoding 646, using ISO-8859-1
  i i i i i i i       ooooo    o        ooooooo   ooooo   ooooo
  I I I I I I I      8     8   8           8     8     o  8    8
  I  \ `+' /  I      8         8           8     8        8    8
   \  `-+-'  /       8         8           8      ooooo   8oooo
    `-__|__-'        8         8           8           8  8
        |            8     o   8           8     o     8  8
  ------+------       ooooo    8oooooo  ooo8ooo   ooooo   8

Welcome to GNU CLISP 2.49 (2010-07-07) <http://clisp.cons.org/>

Copyright (c) Bruno Haible, Michael Stoll 1992, 1993
Copyright (c) Bruno Haible, Marcus Daniels 1994-1997
Copyright (c) Bruno Haible, Pierpaolo Bernardi, Sam Steingold 1998
Copyright (c) Bruno Haible, Sam Steingold 1999-2000
Copyright (c) Sam Steingold, Bruno Haible 2001-2010

Type :h and hit Enter for context help.


WARNING: No initialization file specified.
Please try: ./lisp.run -M lispinit.mem

WARNING: No installation directory specified.
Please try: ./lisp.run -B /usr/local/lib/clisp
: 

	But what is causing the libcallback.so shared library to
	have the "wrong" protections for the .plt and .got sections
	I have not managed to find out.

	I have (unsuccessfully) tried adding the flags:

bramley: {56} cvs diff Makefile
Index: Makefile
===================================================================
RCS file: /cvsroot/pkgsrc/devel/libffcall/Makefile,v
retrieving revision 1.6
diff -u -p -r1.6 Makefile
--- Makefile    15 Sep 2024 13:09:51 -0000      1.6
+++ Makefile    8 Aug 2026 17:50:07 -0000
@@ -18,6 +18,9 @@ GNU_CONFIGURE=                yes
 
 CONFIGURE_ARGS+=       --enable-shared
 
+CFLAGS+=               -msecure-plt
+LDFLAGS+=              -msecure-plt
+
 MAKE_FLAGS+=           htmldir=${PREFIX}/share/doc/ffcall
 
 TEST_TARGET=           check
bramley: {57} 

	so it is more involved than that.

	This host has the 11.0_RC6 user-land, but I don't think
	anything significant related to this changed since that.

>How-To-Repeat:
	See above.

>Fix:
	That would be nice...
	Either that, or hints for what more to look at.