From 6f000b3263e617dfce6e516a406dc816bc1876be Mon Sep 17 00:00:00 2001 From: "riseproject-dev[bot]" <330740410+riseproject-dev[bot]@users.noreply.github.com> Date: Thu, 22 Oct 2026 12:13:57 +0000 Subject: [PATCH 1/4] tcmlib: Add version 1.6.0 Signed-off-by: riseproject-dev[bot] <330740410+riseproject-dev[bot]@users.noreply.github.com> --- docs/packages/tcmlib.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/packages/tcmlib.yaml b/docs/packages/tcmlib.yaml index e3c28c140cdf..52f64e895b70 100644 --- a/docs/packages/tcmlib.yaml +++ b/docs/packages/tcmlib.yaml @@ -8,3 +8,4 @@ versions: files: - filename: tcmlib-1.5.0-py2.py3-none-manylinux_2_39_riscv64.whl sha256: d484bfd62627723c68bb3ef9e2be01932b00452b6455a05b40de4c45e8649c64 +- version: 1.6.0 From ed340094dab923bafb97824d2dfc66054cdf2da7 Mon Sep 17 00:00:00 2001 From: Ludovic Henry Date: Tue, 27 Oct 2026 04:37:53 +0100 Subject: [PATCH 2/4] tcmlib: Carry the fcf-protection patch over to version 1.6.0 --- ...rotection-full-to-x86-in-TCM-s-GNU.c.patch | 45 +++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 patches/tcmlib/1.6.0/0001-build-gate-fcf-protection-full-to-x86-in-TCM-s-GNU.c.patch diff --git a/patches/tcmlib/1.6.0/0001-build-gate-fcf-protection-full-to-x86-in-TCM-s-GNU.c.patch b/patches/tcmlib/1.6.0/0001-build-gate-fcf-protection-full-to-x86-in-TCM-s-GNU.c.patch new file mode 100644 index 000000000000..2e0086b448fd --- /dev/null +++ b/patches/tcmlib/1.6.0/0001-build-gate-fcf-protection-full-to-x86-in-TCM-s-GNU.c.patch @@ -0,0 +1,45 @@ +From 384ee8a7590516884d8a8290921864efa2644d55 Mon Sep 17 00:00:00 2001 +From: Ludovic Henry +Date: Thu, 10 Sep 2026 22:32:07 +0200 +Subject: [PATCH] build: gate -fcf-protection=full to x86 in TCM's GNU.cmake + +Upstream-Status: To upstream [python-wheels does not open issues/PRs on third-party repos, so this can't be submitted to uxlfoundation/oneTBB from here; flagging for a human to upstream] + +thread_composability_manager/cmake/compilers/GNU.cmake adds +-fcf-protection=full unconditionally for GCC >= 8, unlike oneTBB's own +cmake/compilers/GNU.cmake, which gates the same flag behind +CMAKE_SYSTEM_PROCESSOR MATCHES "(AMD64|amd64|i.86|x86)". -fcf-protection is +Intel CET control-flow hardening; on riscv64 GCC 13 rejects it outright: + + cc1plus: error: '-fcf-protection=full' is not supported for this target + compilation terminated due to -Wfatal-errors. + +Restore the same x86 guard TBB's copy already has. Reproduces on riscv64 +only; x86_64 and aarch64 builds are unaffected. + +Signed-off-by: Ludovic Henry +--- + thread_composability_manager/cmake/compilers/GNU.cmake | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/thread_composability_manager/cmake/compilers/GNU.cmake b/thread_composability_manager/cmake/compilers/GNU.cmake +index d7c1a46..abfbbce 100644 +--- a/thread_composability_manager/cmake/compilers/GNU.cmake ++++ b/thread_composability_manager/cmake/compilers/GNU.cmake +@@ -26,7 +26,12 @@ endif() + set(TCM_COMMON_COMPILE_FLAGS ${TCM_COMMON_COMPILE_FLAGS} -fno-strict-overflow -fno-delete-null-pointer-checks -fwrapv + -Wformat -Wformat-security -Werror=format-security -fstack-protector-strong $<$>:-D_FORTIFY_SOURCE=2>) + +-set(TCM_LIB_COMPILE_FLAGS $<$>:-flto> $<$>:-fcf-protection=full>) ++set(TCM_LIB_COMPILE_FLAGS $<$>:-flto>) ++# -fcf-protection is x86 CET hardening; GCC rejects it outright ("is not supported for ++# this target") on other architectures, unlike -fstack-clash-protection above. ++if (CMAKE_SYSTEM_PROCESSOR MATCHES "(AMD64|amd64|i.86|x86)") ++ set(TCM_LIB_COMPILE_FLAGS ${TCM_LIB_COMPILE_FLAGS} $<$>:-fcf-protection=full>) ++endif() + + set(TCM_LIB_LINK_FLAGS ${TCM_LIB_LINK_FLAGS} $<$>:-flto> -Wl,-z,relro,-z,now,-z,noexecstack) + set(TCM_COMPILE_DEFINITIONS "") +-- +2.50.1 (Apple Git-155) + From e07ba1d89c140a4c6b49fffd5c5c20aa241062d6 Mon Sep 17 00:00:00 2001 From: Ludovic Henry Date: Tue, 27 Oct 2026 19:32:14 +0100 Subject: [PATCH 3/4] tcmlib: Build 1.6.0 from the oneTBB commit that carries TCM 1.6.0 --- .github/workflows/build-tcmlib.yml | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/.github/workflows/build-tcmlib.yml b/.github/workflows/build-tcmlib.yml index d962bfaea843..345de4ad4297 100644 --- a/.github/workflows/build-tcmlib.yml +++ b/.github/workflows/build-tcmlib.yml @@ -38,9 +38,14 @@ permissions: contents: read # to fetch code (actions/checkout) env: - # oneTBB commit that introduced TCM at version 1.5.0 (git-subtree merge of TCM's own - # history, one day before the matching PyPI upload). Update alongside TCM_VERSION. - TCM_REF: 7bc8577403df32b69b25157caad45677a8552861 + # oneTBB commit to build, which must report the TCM version being built (the smoke test + # below checks tcmGetVersion()). 1.5.0 was the commit that introduced TCM (git-subtree + # merge of TCM's own history, one day before the matching PyPI upload): + # 7bc8577403df32b69b25157caad45677a8552861. 1.6.0 (PyPI upload 2026-10-16) is the last + # commit touching thread_composability_manager before that upload; it sets + # TCM_VERSION 1.6.0 ("[TCM] Update version to 1.6.0", 171e5ead, is its ancestor) and + # carries the x86 guard around -fcf-protection itself. Update alongside TCM_VERSION. + TCM_REF: f1e7e5cbf0b77a94d27700141b9188580bd9c778 HWLOC_VERSION: 2.14.0 MANYLINUX_RISCV64_IMAGE: quay.io/pypa/manylinux_2_39_riscv64 @@ -79,11 +84,16 @@ jobs: path: python-wheels persist-credentials: false - # TCM's own cmake/compilers/GNU.cmake applies -fcf-protection=full (x86 CET - # hardening) unconditionally, unlike oneTBB's own copy of the same file, which - # gates it to x86 - GCC rejects the flag outright on other architectures. + # TCM 1.5.0's own cmake/compilers/GNU.cmake applied -fcf-protection=full (x86 CET + # hardening) unconditionally, unlike oneTBB's own copy of the same file, which gated + # it to x86 - GCC rejects the flag outright on other architectures. 1.6.0 carries + # that guard upstream, so only versions that still need a patch have a patches dir. - name: Patch TCM source - run: git apply python-wheels/patches/tcmlib/${{ env.TCM_VERSION }}/*.patch + run: | + patches="python-wheels/patches/tcmlib/${TCM_VERSION}" + if [ -d "$patches" ]; then + git apply "$patches"/*.patch + fi - name: Pull manylinux_riscv64 image run: docker pull "${MANYLINUX_RISCV64_IMAGE}" From 02667da47cddd36b27bacfbebdc6a43c26a1a80c Mon Sep 17 00:00:00 2001 From: Ludovic Henry Date: Tue, 27 Oct 2026 19:32:17 +0100 Subject: [PATCH 4/4] tcmlib: Drop the -fcf-protection patch for 1.6.0, upstream gates it to x86 --- ...rotection-full-to-x86-in-TCM-s-GNU.c.patch | 45 ------------------- 1 file changed, 45 deletions(-) delete mode 100644 patches/tcmlib/1.6.0/0001-build-gate-fcf-protection-full-to-x86-in-TCM-s-GNU.c.patch diff --git a/patches/tcmlib/1.6.0/0001-build-gate-fcf-protection-full-to-x86-in-TCM-s-GNU.c.patch b/patches/tcmlib/1.6.0/0001-build-gate-fcf-protection-full-to-x86-in-TCM-s-GNU.c.patch deleted file mode 100644 index 2e0086b448fd..000000000000 --- a/patches/tcmlib/1.6.0/0001-build-gate-fcf-protection-full-to-x86-in-TCM-s-GNU.c.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 384ee8a7590516884d8a8290921864efa2644d55 Mon Sep 17 00:00:00 2001 -From: Ludovic Henry -Date: Thu, 10 Sep 2026 22:32:07 +0200 -Subject: [PATCH] build: gate -fcf-protection=full to x86 in TCM's GNU.cmake - -Upstream-Status: To upstream [python-wheels does not open issues/PRs on third-party repos, so this can't be submitted to uxlfoundation/oneTBB from here; flagging for a human to upstream] - -thread_composability_manager/cmake/compilers/GNU.cmake adds --fcf-protection=full unconditionally for GCC >= 8, unlike oneTBB's own -cmake/compilers/GNU.cmake, which gates the same flag behind -CMAKE_SYSTEM_PROCESSOR MATCHES "(AMD64|amd64|i.86|x86)". -fcf-protection is -Intel CET control-flow hardening; on riscv64 GCC 13 rejects it outright: - - cc1plus: error: '-fcf-protection=full' is not supported for this target - compilation terminated due to -Wfatal-errors. - -Restore the same x86 guard TBB's copy already has. Reproduces on riscv64 -only; x86_64 and aarch64 builds are unaffected. - -Signed-off-by: Ludovic Henry ---- - thread_composability_manager/cmake/compilers/GNU.cmake | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/thread_composability_manager/cmake/compilers/GNU.cmake b/thread_composability_manager/cmake/compilers/GNU.cmake -index d7c1a46..abfbbce 100644 ---- a/thread_composability_manager/cmake/compilers/GNU.cmake -+++ b/thread_composability_manager/cmake/compilers/GNU.cmake -@@ -26,7 +26,12 @@ endif() - set(TCM_COMMON_COMPILE_FLAGS ${TCM_COMMON_COMPILE_FLAGS} -fno-strict-overflow -fno-delete-null-pointer-checks -fwrapv - -Wformat -Wformat-security -Werror=format-security -fstack-protector-strong $<$>:-D_FORTIFY_SOURCE=2>) - --set(TCM_LIB_COMPILE_FLAGS $<$>:-flto> $<$>:-fcf-protection=full>) -+set(TCM_LIB_COMPILE_FLAGS $<$>:-flto>) -+# -fcf-protection is x86 CET hardening; GCC rejects it outright ("is not supported for -+# this target") on other architectures, unlike -fstack-clash-protection above. -+if (CMAKE_SYSTEM_PROCESSOR MATCHES "(AMD64|amd64|i.86|x86)") -+ set(TCM_LIB_COMPILE_FLAGS ${TCM_LIB_COMPILE_FLAGS} $<$>:-fcf-protection=full>) -+endif() - - set(TCM_LIB_LINK_FLAGS ${TCM_LIB_LINK_FLAGS} $<$>:-flto> -Wl,-z,relro,-z,now,-z,noexecstack) - set(TCM_COMPILE_DEFINITIONS "") --- -2.50.1 (Apple Git-155) -