[Bug lto/95604] New: LTO doesn't pick up -fcf-protection flag for the link step

[Bug lto/95604] New: LTO doesn't pick up -fcf-protection flag for the link step

[doko at debian dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95604

            Bug ID: 95604
           Summary: LTO doesn't pick up -fcf-protection flag for the link
                    step
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: lto
          Assignee: unassigned at gcc dot gnu.org
          Reporter: doko at debian dot org
                CC: marxin at gcc dot gnu.org
  Target Milestone: ---

Building the example from PR93966 with the -fcf-protection flag in the compile
step, but not in the link step, I get the error triggered by the -z option.

$ cat x.c 
#include <stdio.h>

int
main ()
{
  printf ("hello\n");
  return 0;
}

$ gcc-10 -flto -fcf-protection -c x.c
$ gcc-10 -flto x.o -Wl,-z,cet-report=error
/usr/bin/ld: /tmp/ccM08n28.ltrans0.ltrans.o: error: missing IBT and SHSTK
properties
collect2: error: ld returned 1 exit status

Isn't the lto link step supposed to pick up the compilation options from the
compile step?

An objdump -w -s --section=.gnu.lto_.opts x.o
shows that this option is recorded, however I don't see it printed out in the
link step, even when calling gcc with -v.

An unrelated question: why is the compile step from PR93966 not called with
-fcf-protection?

[Bug lto/95604] LTO doesn't pick up -fcf-protection flag for the link step

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95604

--- Comment #1 from H.J. Lu <hjl.tools at gmail dot com> ---
(In reply to Matthias Klose from comment #0)
> Building the example from PR93966 with the -fcf-protection flag in the
> compile step, but not in the link step, I get the error triggered by the -z
> option.
> 
> $ cat x.c 
> #include <stdio.h>
> 
> int
> main ()
> {
>   printf ("hello\n");
>   return 0;
> }
> 
> $ gcc-10 -flto -fcf-protection -c x.c
> $ gcc-10 -flto x.o -Wl,-z,cet-report=error
> /usr/bin/ld: /tmp/ccM08n28.ltrans0.ltrans.o: error: missing IBT and SHSTK
> properties
> collect2: error: ld returned 1 exit status
> 
> Isn't the lto link step supposed to pick up the compilation options from the
> compile step?
> 
> An objdump -w -s --section=.gnu.lto_.opts x.o
> shows that this option is recorded, however I don't see it printed out in
> the link step, even when calling gcc with -v.
> 
> An unrelated question: why is the compile step from PR93966 not called with
> -fcf-protection?

-fcf-protection is a codegen option. I think -flto -fcf-protection at
the final link is sufficient to enable CET.

[Bug lto/95604] LTO doesn't pick up -fcf-protection flag for the link step

[doko at debian dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95604

--- Comment #2 from Matthias Klose <doko at debian dot org> ---
Really? The documentation states:

  The macro "__CET__" is defined when -fcf-protection is used.

so it's a preprocessor option as well?

[Bug lto/95604] LTO doesn't pick up -fcf-protection flag for the link step

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95604

--- Comment #3 from H.J. Lu <hjl.tools at gmail dot com> ---
(In reply to Matthias Klose from comment #2)
> Really? The documentation states:
> 
>   The macro "__CET__" is defined when -fcf-protection is used.
> 
> so it's a preprocessor option as well?

__CET__ check isn't needed to enable CET in C/C++.  __CET__ is needed to
add CET support to assembly codes.  If there are mixed source codes,
-fcf-protection should be used for compilation.

[Bug lto/95604] LTO doesn't pick up -fcf-protection flag for the link step

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95604

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Matthias Klose <doko@gcc.gnu.org>:

https://gcc.gnu.org/g:6a48d12475cdb7375b98277f8bc089715feeeafe

commit r11-2076-g6a48d12475cdb7375b98277f8bc089715feeeafe
Author: Matthias Klose <doko@ubuntu.com>
Date:   Tue Jul 14 10:12:08 2020 +0200

    LTO: pick up -fcf-protection flag for the link step

    2020-07-14  Matthias Klose  <doko@ubuntu.com>

            PR lto/95604
            * lto-wrapper.c (merge_and_complain): Add decoded options as
parameter,
            error on different values for -fcf-protection.
            (append_compiler_options): Pass -fcf-protection option.
            (find_and_merge_options): Add decoded options as parameter,
            pass decoded_options to merge_and_complain.
            (run_gcc): Pass decoded options to find_and_merge_options.
            * lto-opts.c (lto_write_options): Pass -fcf-protection option.

[Bug lto/95604] LTO doesn't pick up -fcf-protection flag for the link step

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95604

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Matthias Klose
<doko@gcc.gnu.org>:

https://gcc.gnu.org/g:8147c741df97ee02aa64c099c6b360e6a93384e1

commit r10-8492-g8147c741df97ee02aa64c099c6b360e6a93384e1
Author: Matthias Klose <doko@ubuntu.com>
Date:   Tue Jul 14 10:23:47 2020 +0200

    LTO: pick up -fcf-protection flag for the link step

    2020-07-14  Matthias Klose  <doko@ubuntu.com>

            PR lto/95604
            * lto-wrapper.c (merge_and_complain): Add decoded options as
parameter,
            error on different values for -fcf-protection.
            (append_compiler_options): Pass -fcf-protection option.
            (find_and_merge_options): Add decoded options as parameter,
            pass decoded_options to merge_and_complain.
            (run_gcc): Pass decoded options to find_and_merge_options.
            * lto-opts.c (lto_write_options): Pass -fcf-protection option.

    (cherry picked from commit 6a48d12475cdb7375b98277f8bc089715feeeafe)

[Bug lto/95604] LTO doesn't pick up -fcf-protection flag for the link step

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95604

--- Comment #6 from H.J. Lu <hjl.tools at gmail dot com> ---
LTO should follow GNU property spec by merging GNU_PROPERTY_X86_FEATURE_1_IBT
and GNU_PROPERTY_X86_FEATURE_1_SHSTK from all IR files, just like ld.  The
current behavior can be retained by a new option, -fcf-protection=error.

[Bug lto/95604] LTO doesn't pick up -fcf-protection flag for the link step

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95604

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rguenth at gcc dot gnu.org

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
What's the state of this bug?  IIRC we reverted on the branch and fixed things
up on trunk.

[Bug lto/95604] LTO doesn't pick up -fcf-protection flag for the link step

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95604

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Matthias Klose
<doko@gcc.gnu.org>:

https://gcc.gnu.org/g:5c7cf559e6a51ebb41631bfc8396d6ab9f992499

commit r10-8742-g5c7cf559e6a51ebb41631bfc8396d6ab9f992499
Author: Matthias Klose <doko@ubuntu.com>
Date:   Fri Sep 11 12:21:06 2020 +0200

    LTO: pick up -fcf-protection flag for the link step

    2020-07-14  Matthias Klose  <doko@ubuntu.com>

            PR lto/95604
            * lto-wrapper.c (merge_and_complain): Add decoded options as
parameter,
            error on different values for -fcf-protection.
            (append_compiler_options): Pass -fcf-protection option.
            (find_and_merge_options): Add decoded options as parameter,
            pass decoded_options to merge_and_complain.
            (run_gcc): Pass decoded options to find_and_merge_options.
            * lto-opts.c (lto_write_options): Pass -fcf-protection option.

    (cherry picked from commit 6a48d12475cdb7375b98277f8bc089715feeeafe)

[Bug lto/95604] LTO doesn't pick up -fcf-protection flag for the link step

[doko at debian dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95604

Matthias Klose <doko at debian dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #9 from Matthias Klose <doko at debian dot org> ---
now commit to the gcc-10-branch, together with PR96203.