[libcxx-commits] [PATCH] D107560: [libc++][libc++abi][CET] Support building libc++ and libc++abi with CET enabled.

[xiongji90 via Phabricator via libcxx-commits]

xiongji90 added a comment.

Hi, @Mordante , @ldionne , @manojgupta , @MaskRay 
Since "-fcf-protection=full" is a compiling flag for C and CXX sources, I think users can add this flag via CMAKE_CXX_FLAGS. However, adding "-fcf-protection=full" to CMAKE_CXX_FLAGS will enable CET for all components we build.
As @manojgupta mentioned, in order to build application with CET enabled, we need to:

1. compile the application's source code with "-fcf-protection=full"
2. link the .o files generated form 1 with libraries which are CET enabled

We don't require the compiler used to build the application to be CET enabled. If we build libc++, libc++abi with other components such as clang++, lld, ldb...and add "-fcf-protection=full" to CMAKE_CXX_FLAGS, this flag will be used for all components which is not necessary.
Although we can use "-fcf-protection=full" to build all components whose sources don't include any assembly code, it may be not enough to enable CET for those components. For example, I once built clang, lld, lldb with "-fcf-protection=full", most tests passed in CET enable platform but we also had a few runtime errors most of which are related to JIT code. So, before resolving all issues, I think it is not safe to add "-fcf-protection=full" to CMAKE_CXX_FLAGS.
Currently, CET has been fully enabled in GNU toolchain (all tools such as compiler, linker, debugger, all libraries such libgcc, libstdc++...)while llvm toolchain has not. A practical approach is enabling the components one by one, the first step is enabling libc++, libc++abi, libunwind.
If we have a way to pass "-fcf-protection=full" to libc++ CXX flag, I think we can avoid the option LIBCXX_ENABLE_CET here.
Thanks very much.


Repository:
  rG LLVM Github Monorepo

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D107560/new/

https://reviews.llvm.org/D107560