[PATCH] D105603: [X86][CET] Support to build LLVM toolchain with CET enabled.

[xiongji90 via Phabricator via llvm-commits]

xiongji90 created this revision.
xiongji90 added a reviewer: LuoYuanke.
Herald added subscribers: pengfei, mgorny.
xiongji90 requested review of this revision.
Herald added a project: LLVM.
Herald added a subscriber: llvm-commits.

This patch is the first one of a series of patches aiming to support to build llvm toolchain(compiler, tools, libraries) with CET enabled. Currently, CET has been implemented in x86 Linux target and in order to compile source code with CET enabled, "-fcf-protection=full" should be added. CET introduces 'IBT' which restricts the target of indirect jumps and 'SHSTK' is also introduced which aims to check the return address when a function is going to return to caller. This patch introduces the option "LLVM_BUILD_CET_ENABLE", if you want to build compiler and libraries with CET enabled, you can define it to true:
cmake -G "Unix Makefiles" -DLLVM_BUILD_CET_ENABLE=True ...
The default value is false. When LLVM_BUILD_CET_ENABLE is true, "-fcf-protection=full" will be added to C and CXX flag when the compiler used to build LLVM supports.
The source code in llvm project can be split into:

1. pure C or C++ code which doesn't include any inline assembly code
2. C or C++ code include some inline assembly code
3. Assembly code

To 1, adding "-fcf-proection=full" should be enough but to 2 and 3, we need to go through the assembly code and and "endbr" to all target of indirect jumps. Currently, we didn't consider JIT libraries.
With this patch, we can build compiler and most tools such as llvm-link, clang-format, FileCheck with CET enabled and some libraries such as libc++, libc++abi can be CET enabled too. Next, we need to support building libunwind, compiler-rt with CET enabled.


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D105603

Files:
  llvm/CMakeLists.txt
  llvm/cmake/modules/HandleLLVMOptions.cmake
  llvm/cmake/modules/LLVMConfig.cmake.in
  llvm/docs/CMake.rst


Index: llvm/docs/CMake.rst
===================================================================
--- llvm/docs/CMake.rst
+++ llvm/docs/CMake.rst
@@ -250,6 +250,10 @@
   Build 32-bit executables and libraries on 64-bit systems. This option is
   available only on some 64-bit Unix systems. Defaults to OFF.
 
+**LLVM_BUILD_CET_ENABLE**:BOOL
+  Build executables and libraries with CET enabled. CET is currently implemented
+  in x86 GNU/Linux target. Defaults to OFF.
+
 **LLVM_BUILD_BENCHMARKS**:BOOL
   Adds benchmarks to the list of default targets. Defaults to OFF.
 
Index: llvm/cmake/modules/LLVMConfig.cmake.in
===================================================================
--- llvm/cmake/modules/LLVMConfig.cmake.in
+++ llvm/cmake/modules/LLVMConfig.cmake.in
@@ -74,6 +74,8 @@
 
 set(LLVM_BUILD_32_BITS @LLVM_BUILD_32_BITS@)
 
+set(LLVM_BUILD_CET_ENABLE @LLVM_BUILD_CET_ENABLE@)
+
 if (NOT "@LLVM_PTHREAD_LIB@" STREQUAL "")
   set(LLVM_PTHREAD_LIB "@LLVM_PTHREAD_LIB@")
 endif()
Index: llvm/cmake/modules/HandleLLVMOptions.cmake
===================================================================
--- llvm/cmake/modules/HandleLLVMOptions.cmake
+++ llvm/cmake/modules/HandleLLVMOptions.cmake
@@ -366,6 +366,17 @@
   endif( LLVM_BUILD_32_BITS )
 endif( CMAKE_SIZEOF_VOID_P EQUAL 8 AND NOT WIN32 )
 
+# To enable CET in compilation, "-fcf-protection=full" should
+# be added. Currently, CET has been implemented in x86 GNU/Linux target.
+if(NOT WIN32)
+  if( LLVM_BUILD_CET_ENABLE)
+    add_flag_if_supported("-fcf-protection=full" CET)
+    if((NOT C_SUPPORTS_CET) OR (NOT CXX_SUPPORTS_CET))
+      message(FATAL_ERROR "The compiler used for building doesn't support CET!")
+    endif()
+  endif( LLVM_BUILD_CET_ENABLE)
+endif()
+
 # If building on a GNU specific 32-bit system, make sure off_t is 64 bits
 # so that off_t can stored offset > 2GB.
 # Android until version N (API 24) doesn't support it.
Index: llvm/CMakeLists.txt
===================================================================
--- llvm/CMakeLists.txt
+++ llvm/CMakeLists.txt
@@ -513,6 +513,10 @@
   option(LLVM_BUILD_32_BITS "Build 32 bits executables and libraries." OFF)
 endif()
 
+if(NOT WIN32)
+  option(LLVM_BUILD_CET_ENABLE "Build executables and libraries with CET enabled." OFF)
+endif()
+
 # Define the default arguments to use with 'lit', and an option for the user to
 # override.
 set(LIT_ARGS_DEFAULT "-sv")


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D105603.357113.patch
Type: text/x-patch
Size: 2402 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20210708/241f1f29/attachment.bin>