[PATCH] D59780: Support Intel Control-flow Enforcement Technology

Mon Mar 25 19:04:27 PDT 2019

xiangzhangllvm added a comment.

  Is --force-cet the best option name? H. J. Lu pointed out that gold has -z ibtplt and other options, but I couldn't find these options in the binutils' repository. Is the option really implemneted to gold?
  What is the compiler flag to enable CET? I'd like to write it in a comment for reference.

Hi, Ruiu, You may need update ld to 2.31+ version:
xiangzh1 at xiangzh1:~$ ld -v
GNU ld (GNU Binutils) 2.32
xiangzh1 at xiangzh1:~$ ld --help
elf_x86_64:

   ...
  -z ibtplt                   Generate IBT-enabled PLT entries
  -z ibt                      Generate GNU_PROPERTY_X86_FEATURE_1_IBT
  -z shstk                    Generate GNU_PROPERTY_X86_FEATURE_1_SHSTK

All these options in gold is just for test.

For C/C++ sources, Compiler flag of CET  is -fcf-protection,  -fcf-protection=branch/full

For LLD the key of the tests is check the feature flags in the output file.
You can also run the test in an non-cet machine, the endbr* instruction will be seen as nop.

Repository:
  rG LLVM Github Monorepo

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D59780/new/

https://reviews.llvm.org/D59780