Re: llvm15: Make -mbranch-protection=bti the default

[Theo de Raadt]

Christian Weisgerber <na...@mips.inka.de> wrote:

> Mark Kettenis:
> 
> > CVSROOT:    /cvs
> > Module name:        src
> > Changes by: kette...@cvs.openbsd.org        2023/04/17 12:10:26
> > 
> > Modified files:
> >     gnu/llvm/clang/lib/Driver/ToolChains: Clang.cpp 
> > 
> > Log message:
> > Make -mbranch-protection=bti the default on OpenBSD.
> 
> LLVM 15 reshuffled some code, so the change above no longer applies
> there.  Here's my attempt to add it:

I suspect there will be a different arm64 variation of that diff coming
which tries to change the default at a lower level.

Here is the corresponding amd64 diff (an earlier version had a bug) for
in-tree clang.  It changes it so BTI is enabled by default, and then adds
missing code to allow it to be turned off.

Index: gnu/llvm/clang/include/clang/Basic/CodeGenOptions.def
===================================================================
RCS file: /cvs/src/gnu/llvm/clang/include/clang/Basic/CodeGenOptions.def,v
retrieving revision 1.4
diff -u -p -u -r1.4 CodeGenOptions.def
--- gnu/llvm/clang/include/clang/Basic/CodeGenOptions.def       17 Dec 2021 
14:46:43 -0000      1.4
+++ gnu/llvm/clang/include/clang/Basic/CodeGenOptions.def       17 Apr 2023 
18:36:15 -0000
@@ -102,7 +102,7 @@ CODEGENOPT(InstrumentFunctionEntryBare ,
                                ///< -finstrument-function-entry-bare is 
enabled.
 CODEGENOPT(CFProtectionReturn , 1, 0) ///< if -fcf-protection is
                                       ///< set to full or return.
-CODEGENOPT(CFProtectionBranch , 1, 0) ///< if -fcf-protection is
+CODEGENOPT(CFProtectionBranch , 1, 1) ///< if -fcf-protection is
                                       ///< set to full or branch.
 CODEGENOPT(XRayInstrumentFunctions , 1, 0) ///< Set when -fxray-instrument is
                                            ///< enabled.
Index: gnu/llvm/clang/lib/Frontend/CompilerInvocation.cpp
===================================================================
RCS file: /cvs/src/gnu/llvm/clang/lib/Frontend/CompilerInvocation.cpp,v
retrieving revision 1.5
diff -u -p -u -r1.5 CompilerInvocation.cpp
--- gnu/llvm/clang/lib/Frontend/CompilerInvocation.cpp  17 Dec 2021 14:46:44 
-0000      1.5
+++ gnu/llvm/clang/lib/Frontend/CompilerInvocation.cpp  18 Apr 2023 10:48:28 
-0000
@@ -1792,7 +1792,10 @@ bool CompilerInvocation::ParseCodeGenArg
       Opts.CFProtectionReturn = 1;
     else if (Name == "branch")
       Opts.CFProtectionBranch = 1;
-    else if (Name != "none")
+    else if (Name == "none") {
+      Opts.CFProtectionBranch = 0;
+      Opts.CFProtectionReturn = 0;
+    } else
       Diags.Report(diag::err_drv_invalid_value) << A->getAsString(Args) << 
Name;
   }
 
@@ -3653,7 +3656,8 @@ bool CompilerInvocation::ParseLangArgs(L
     StringRef Name = A->getValue();
     if (Name == "full" || Name == "branch") {
       Opts.CFProtectionBranch = 1;
-    }
+    } else if (Name == "none")
+      Opts.CFProtectionBranch = 1;
   }
 
   if ((Args.hasArg(OPT_fsycl_is_device) || Args.hasArg(OPT_fsycl_is_host)) &&