[PATCH] Check whether -fcf-protection=none -Wl, -z, ibt, -z, shstk work first
H.J. Lu
hjl.tools@gmail.com
Mon Apr 27 17:05:26 GMT 2020
GCC_CET_HOST_FLAGS uses -Wl,-z,ibt,-z,shstk to check if Linux/x86 host
has Intel CET enabled by introducing an Intel CET violation on purpose.
To avoid false positive, check whether -Wl,-z,ibt,-z,shstk works first.
-fcf-protection=none is added to avoid false negative when -fcf-protection
is enabled by default.
OK for master?
H.J.
---
config/
PR bootstrap/94739
* cet.m4 (GCC_CET_HOST_FLAGS): Add -fcf-protection=none to
-Wl,-z,ibt,-z,shstk. Check whether -fcf-protection=none
-Wl,-z,ibt,-z,shstk works first.
libiberty/
PR bootstrap/94739
* configure: Regenerated.
lto-plugin/
PR bootstrap/94739
* configure: Regenerated.
---
config/cet.m4 | 17 ++++--
libiberty/configure | 126 ++++++++++++++++++++++++++-----------------
lto-plugin/configure | 35 ++++++++++--
3 files changed, 121 insertions(+), 57 deletions(-)
diff --git a/config/cet.m4 b/config/cet.m4
index 8b9e01fd492..ea616b728a9 100644
--- a/config/cet.m4
+++ b/config/cet.m4
@@ -98,9 +98,19 @@ asm ("setssbsy");
;;
esac
+save_CFLAGS="$CFLAGS"
+CFLAGS="$CFLAGS -fcf-protection=none"
+save_LDFLAGS="$LDFLAGS"
+LDFLAGS="$LDFLAGS -Wl,-z,ibt,-z,shstk"
+if test x$may_have_cet = xyes; then
+ # Check whether -fcf-protection=none -Wl,-z,ibt,-z,shstk work.
+ AC_TRY_LINK(
+ [],[return 0;],
+ [may_have_cet=yes],
+ [may_have_cet=no])
+fi
+
if test x$may_have_cet = xyes; then
- save_LDFLAGS="$LDFLAGS"
- LDFLAGS="$LDFLAGS -Wl,-z,ibt,-z,shstk"
AC_TRY_RUN([
static void
foo (void)
@@ -130,7 +140,6 @@ main ()
],
[have_cet=no],
[have_cet=yes])
- LDFLAGS="$save_LDFLAGS"
if test x$enable_cet = xno -a x$have_cet = xyes; then
AC_MSG_ERROR([Intel CET must be enabled on Intel CET enabled host])
fi
@@ -141,4 +150,6 @@ if test x$enable_cet = xyes; then
else
AC_MSG_RESULT([no])
fi
+CFLAGS="$save_CFLAGS"
+LDFLAGS="$save_LDFLAGS"
])
diff --git a/libiberty/configure b/libiberty/configure
index 2b52ce86c89..bb76cf1b823 100755
--- a/libiberty/configure
+++ b/libiberty/configure
@@ -1674,6 +1674,52 @@ $as_echo "$ac_res" >&6; }
} # ac_fn_c_check_header_compile
+# ac_fn_c_try_link LINENO
+# -----------------------
+# Try to link conftest.$ac_ext, and return whether this succeeded.
+ac_fn_c_try_link ()
+{
+ as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
+ rm -f conftest.$ac_objext conftest$ac_exeext
+ if { { ac_try="$ac_link"
+case "(($ac_try" in
+ *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+ *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
+$as_echo "$ac_try_echo"; } >&5
+ (eval "$ac_link") 2>conftest.err
+ ac_status=$?
+ if test -s conftest.err; then
+ grep -v '^ *+' conftest.err >conftest.er1
+ cat conftest.er1 >&5
+ mv -f conftest.er1 conftest.err
+ fi
+ $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ test $ac_status = 0; } && {
+ test -z "$ac_c_werror_flag" ||
+ test ! -s conftest.err
+ } && test -s conftest$ac_exeext && {
+ test "$cross_compiling" = yes ||
+ test -x conftest$ac_exeext
+ }; then :
+ ac_retval=0
+else
+ $as_echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+ ac_retval=1
+fi
+ # Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information
+ # created by the PGI compiler (conftest_ipa8_conftest.oo), as it would
+ # interfere with the next link command; also delete a directory that is
+ # left behind by Apple's compiler. We do this before executing the actions.
+ rm -rf conftest.dSYM conftest_ipa8_conftest.oo
+ eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
+ as_fn_set_status $ac_retval
+
+} # ac_fn_c_try_link
+
# ac_fn_c_check_header_preproc LINENO HEADER VAR
# ----------------------------------------------
# Tests whether HEADER is present, setting the cache variable VAR accordingly.
@@ -1940,52 +1986,6 @@ $as_echo "$ac_res" >&6; }
} # ac_fn_c_check_type
-# ac_fn_c_try_link LINENO
-# -----------------------
-# Try to link conftest.$ac_ext, and return whether this succeeded.
-ac_fn_c_try_link ()
-{
- as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack
- rm -f conftest.$ac_objext conftest$ac_exeext
- if { { ac_try="$ac_link"
-case "(($ac_try" in
- *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
- *) ac_try_echo=$ac_try;;
-esac
-eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\""
-$as_echo "$ac_try_echo"; } >&5
- (eval "$ac_link") 2>conftest.err
- ac_status=$?
- if test -s conftest.err; then
- grep -v '^ *+' conftest.err >conftest.er1
- cat conftest.er1 >&5
- mv -f conftest.er1 conftest.err
- fi
- $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; } && {
- test -z "$ac_c_werror_flag" ||
- test ! -s conftest.err
- } && test -s conftest$ac_exeext && {
- test "$cross_compiling" = yes ||
- test -x conftest$ac_exeext
- }; then :
- ac_retval=0
-else
- $as_echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
- ac_retval=1
-fi
- # Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information
- # created by the PGI compiler (conftest_ipa8_conftest.oo), as it would
- # interfere with the next link command; also delete a directory that is
- # left behind by Apple's compiler. We do this before executing the actions.
- rm -rf conftest.dSYM conftest_ipa8_conftest.oo
- eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno
- as_fn_set_status $ac_retval
-
-} # ac_fn_c_try_link
-
# ac_fn_c_check_func LINENO FUNC VAR
# ----------------------------------
# Tests whether FUNC exists, setting the cache variable VAR accordingly
@@ -5345,9 +5345,36 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
;;
esac
+save_CFLAGS="$CFLAGS"
+CFLAGS="$CFLAGS -fcf-protection=none"
+save_LDFLAGS="$LDFLAGS"
+LDFLAGS="$LDFLAGS -Wl,-z,ibt,-z,shstk"
+if test x$may_have_cet = xyes; then
+ # Check whether -fcf-protection=none -Wl,-z,ibt,-z,shstk work.
+ if test x$gcc_no_link = xyes; then
+ as_fn_error $? "Link tests are not allowed after GCC_NO_EXECUTABLES." "$LINENO" 5
+fi
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h. */
+
+int
+main ()
+{
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+ may_have_cet=yes
+else
+ may_have_cet=no
+fi
+rm -f core conftest.err conftest.$ac_objext \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+
if test x$may_have_cet = xyes; then
- save_LDFLAGS="$LDFLAGS"
- LDFLAGS="$LDFLAGS -Wl,-z,ibt,-z,shstk"
if test "$cross_compiling" = yes; then :
{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
@@ -5393,7 +5420,6 @@ rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
conftest.$ac_objext conftest.beam conftest.$ac_ext
fi
- LDFLAGS="$save_LDFLAGS"
if test x$enable_cet = xno -a x$have_cet = xyes; then
as_fn_error $? "Intel CET must be enabled on Intel CET enabled host" "$LINENO" 5
fi
@@ -5406,6 +5432,8 @@ else
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
$as_echo "no" >&6; }
fi
+CFLAGS="$save_CFLAGS"
+LDFLAGS="$save_LDFLAGS"
diff --git a/lto-plugin/configure b/lto-plugin/configure
index e55b35ecf38..1baf6cc70b8 100755
--- a/lto-plugin/configure
+++ b/lto-plugin/configure
@@ -5741,9 +5741,33 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
;;
esac
+save_CFLAGS="$CFLAGS"
+CFLAGS="$CFLAGS -fcf-protection=none"
+save_LDFLAGS="$LDFLAGS"
+LDFLAGS="$LDFLAGS -Wl,-z,ibt,-z,shstk"
+if test x$may_have_cet = xyes; then
+ # Check whether -fcf-protection=none -Wl,-z,ibt,-z,shstk work.
+ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h. */
+
+int
+main ()
+{
+return 0;
+ ;
+ return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+ may_have_cet=yes
+else
+ may_have_cet=no
+fi
+rm -f core conftest.err conftest.$ac_objext \
+ conftest$ac_exeext conftest.$ac_ext
+fi
+
if test x$may_have_cet = xyes; then
- save_LDFLAGS="$LDFLAGS"
- LDFLAGS="$LDFLAGS -Wl,-z,ibt,-z,shstk"
if test "$cross_compiling" = yes; then :
{ { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
@@ -5789,7 +5813,6 @@ rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
conftest.$ac_objext conftest.beam conftest.$ac_ext
fi
- LDFLAGS="$save_LDFLAGS"
if test x$enable_cet = xno -a x$have_cet = xyes; then
as_fn_error $? "Intel CET must be enabled on Intel CET enabled host" "$LINENO" 5
fi
@@ -5802,6 +5825,8 @@ else
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
$as_echo "no" >&6; }
fi
+CFLAGS="$save_CFLAGS"
+LDFLAGS="$save_LDFLAGS"
@@ -11916,7 +11941,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
-#line 11919 "configure"
+#line 11944 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
@@ -12022,7 +12047,7 @@ else
lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
lt_status=$lt_dlunknown
cat > conftest.$ac_ext <<_LT_EOF
-#line 12025 "configure"
+#line 12050 "configure"
#include "confdefs.h"
#if HAVE_DLFCN_H
--
2.25.4
More information about the Gcc-patches
mailing list