From e9401c8bfe4000baeefbdaaba22d6a5787198405 Mon Sep 17 00:00:00 2001 From: Alvin Wong Date: Thu, 29 Sep 2022 01:29:51 +0800 Subject: [PATCH] Add CFGuard options to build scripts (disabled by default) --- Dockerfile | 14 ++++++++------ Dockerfile.dev | 14 ++++++++------ build-all.sh | 21 ++++++++++++++------- build-compiler-rt.sh | 15 ++++++++++++++- build-libcxx.sh | 9 ++++++++- build-libssp.sh | 23 +++++++++++++++++++---- build-mingw-w64-libraries.sh | 25 +++++++++++++++++++++---- build-mingw-w64.sh | 12 ++++++++++-- build-openmp.sh | 21 +++++++++++++++++++-- libssp-Makefile | 2 +- 10 files changed, 122 insertions(+), 34 deletions(-) diff --git a/Dockerfile b/Dockerfile index 8a7d482..9ae005f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -44,6 +44,8 @@ ARG TOOLCHAIN_ARCHS="i686 x86_64 armv7 aarch64" ARG DEFAULT_CRT=ucrt +ARG CFGUARD_ARGS=--disable-cfguard + # Build everything that uses the llvm monorepo. We need to build the mingw runtime before the compiler-rt/libunwind/libcxxabi/libcxx runtimes. COPY build-llvm.sh build-lldb-mi.sh strip-llvm.sh install-wrappers.sh build-mingw-w64.sh build-mingw-w64-tools.sh build-compiler-rt.sh build-libcxx.sh build-mingw-w64-libraries.sh build-openmp.sh ./ COPY wrappers/*.sh wrappers/*.c wrappers/*.h ./wrappers/ @@ -51,18 +53,18 @@ RUN ./build-llvm.sh $TOOLCHAIN_PREFIX && \ ./build-lldb-mi.sh $TOOLCHAIN_PREFIX && \ ./strip-llvm.sh $TOOLCHAIN_PREFIX && \ ./install-wrappers.sh $TOOLCHAIN_PREFIX && \ - ./build-mingw-w64.sh $TOOLCHAIN_PREFIX --with-default-msvcrt=$DEFAULT_CRT && \ + ./build-mingw-w64.sh $TOOLCHAIN_PREFIX --with-default-msvcrt=$DEFAULT_CRT $CFGUARD_ARGS && \ ./build-mingw-w64-tools.sh $TOOLCHAIN_PREFIX && \ - ./build-compiler-rt.sh $TOOLCHAIN_PREFIX && \ - ./build-libcxx.sh $TOOLCHAIN_PREFIX && \ - ./build-mingw-w64-libraries.sh $TOOLCHAIN_PREFIX && \ + ./build-compiler-rt.sh $TOOLCHAIN_PREFIX $CFGUARD_ARGS && \ + ./build-libcxx.sh $TOOLCHAIN_PREFIX $CFGUARD_ARGS && \ + ./build-mingw-w64-libraries.sh $TOOLCHAIN_PREFIX $CFGUARD_ARGS && \ ./build-compiler-rt.sh $TOOLCHAIN_PREFIX --build-sanitizers && \ - ./build-openmp.sh $TOOLCHAIN_PREFIX && \ + ./build-openmp.sh $TOOLCHAIN_PREFIX $CFGUARD_ARGS && \ rm -rf /build/* # Build libssp COPY build-libssp.sh libssp-Makefile ./ -RUN ./build-libssp.sh $TOOLCHAIN_PREFIX && \ +RUN ./build-libssp.sh $TOOLCHAIN_PREFIX $CFGUARD_ARGS && \ rm -rf /build/* ENV PATH=$TOOLCHAIN_PREFIX/bin:$PATH diff --git a/Dockerfile.dev b/Dockerfile.dev index c22a408..161b06b 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -67,24 +67,26 @@ RUN ./install-wrappers.sh $TOOLCHAIN_PREFIX ARG DEFAULT_CRT=ucrt +ARG CFGUARD_ARGS=--disable-cfguard + # Build MinGW-w64 COPY build-mingw-w64.sh ./ -RUN ./build-mingw-w64.sh $TOOLCHAIN_PREFIX --with-default-msvcrt=$DEFAULT_CRT +RUN ./build-mingw-w64.sh $TOOLCHAIN_PREFIX --with-default-msvcrt=$DEFAULT_CRT $CFGUARD_ARGS COPY build-mingw-w64-tools.sh ./ RUN ./build-mingw-w64-tools.sh $TOOLCHAIN_PREFIX # Build compiler-rt COPY build-compiler-rt.sh ./ -RUN ./build-compiler-rt.sh $TOOLCHAIN_PREFIX +RUN ./build-compiler-rt.sh $TOOLCHAIN_PREFIX $CFGUARD_ARGS # Build libunwind/libcxxabi/libcxx COPY build-libcxx.sh ./ -RUN ./build-libcxx.sh $TOOLCHAIN_PREFIX +RUN ./build-libcxx.sh $TOOLCHAIN_PREFIX $CFGUARD_ARGS # Build mingw-w64's extra libraries COPY build-mingw-w64-libraries.sh ./ -RUN ./build-mingw-w64-libraries.sh $TOOLCHAIN_PREFIX +RUN ./build-mingw-w64-libraries.sh $TOOLCHAIN_PREFIX $CFGUARD_ARGS # Build C test applications ENV PATH=$TOOLCHAIN_PREFIX/bin:$PATH @@ -152,7 +154,7 @@ RUN cd test && \ # Build libssp COPY build-libssp.sh libssp-Makefile ./ -RUN ./build-libssp.sh $TOOLCHAIN_PREFIX +RUN ./build-libssp.sh $TOOLCHAIN_PREFIX $CFGUARD_ARGS RUN cd test && \ for arch in $TOOLCHAIN_ARCHS; do \ @@ -167,7 +169,7 @@ RUN cd test && \ # Build OpenMP COPY build-openmp.sh ./ -RUN ./build-openmp.sh $TOOLCHAIN_PREFIX +RUN ./build-openmp.sh $TOOLCHAIN_PREFIX $CFGUARD_ARGS # OpenMP on windows only supports x86. RUN cd test && \ diff --git a/build-all.sh b/build-all.sh index 5135197..74cec64 100755 --- a/build-all.sh +++ b/build-all.sh @@ -18,6 +18,7 @@ set -e LLVM_ARGS="" MINGW_ARGS="" +CFGUARD_ARGS="--disable-cfguard" while [ $# -gt 0 ]; do case "$1" in @@ -47,6 +48,12 @@ while [ $# -gt 0 ]; do --with-default-win32-winnt=*) MINGW_ARGS="$MINGW_ARGS $1" ;; + --enable-cfguard) + CFGUARD_ARGS="--enable-cfguard" + ;; + --disable-cfguard) + CFGUARD_ARGS="--disable-cfguard" + ;; *) if [ -n "$PREFIX" ]; then echo Unrecognized parameter $1 @@ -58,7 +65,7 @@ while [ $# -gt 0 ]; do shift done if [ -z "$PREFIX" ]; then - echo $0 [--enable-asserts] [--disable-dylib] [--full-llvm] [--with-python] [--symlink-projects] [--disable-lldb] [--disable-lldb-mi] [--disable-clang-tools-extra] [--host=triple] [--with-default-win32-winnt=0x601] [--with-default-msvcrt=ucrt] dest + echo "$0 [--enable-asserts] [--disable-dylib] [--full-llvm] [--with-python] [--symlink-projects] [--disable-lldb] [--disable-lldb-mi] [--disable-clang-tools-extra] [--host=triple] [--with-default-win32-winnt=0x601] [--with-default-msvcrt=ucrt] [--enable-cfguard|--disable-cfguard] dest" exit 1 fi @@ -77,11 +84,11 @@ if [ -z "$FULL_LLVM" ]; then ./strip-llvm.sh $PREFIX fi ./install-wrappers.sh $PREFIX -./build-mingw-w64.sh $PREFIX $MINGW_ARGS +./build-mingw-w64.sh $PREFIX $MINGW_ARGS $CFGUARD_ARGS ./build-mingw-w64-tools.sh $PREFIX -./build-compiler-rt.sh $PREFIX -./build-libcxx.sh $PREFIX -./build-mingw-w64-libraries.sh $PREFIX +./build-compiler-rt.sh $PREFIX $CFGUARD_ARGS +./build-libcxx.sh $PREFIX $CFGUARD_ARGS +./build-mingw-w64-libraries.sh $PREFIX $CFGUARD_ARGS ./build-compiler-rt.sh $PREFIX --build-sanitizers -./build-libssp.sh $PREFIX -./build-openmp.sh $PREFIX +./build-libssp.sh $PREFIX $CFGUARD_ARGS +./build-openmp.sh $PREFIX $CFGUARD_ARGS diff --git a/build-compiler-rt.sh b/build-compiler-rt.sh index 4228919..fc589c5 100755 --- a/build-compiler-rt.sh +++ b/build-compiler-rt.sh @@ -19,6 +19,8 @@ set -e SRC_DIR=../lib/builtins BUILD_SUFFIX= BUILD_BUILTINS=TRUE +ENABLE_CFGUARD= +CFGUARD_CFLAGS= while [ $# -gt 0 ]; do if [ "$1" = "--build-sanitizers" ]; then @@ -26,15 +28,24 @@ while [ $# -gt 0 ]; do BUILD_SUFFIX=-sanitizers SANITIZERS=1 BUILD_BUILTINS=FALSE + elif [ "$1" = "--enable-cfguard" ]; then + CFGUARD_CFLAGS="-mguard=cf" + ENABLE_CFGUARD=1 + elif [ "$1" = "--disable-cfguard" ]; then + CFGUARD_CFLAGS= + ENABLE_CFGUARD= else PREFIX="$1" fi shift done if [ -z "$PREFIX" ]; then - echo $0 [--build-sanitizers] dest + echo "$0 [--build-sanitizers] [--enable-cfguard|--disable-cfguard] dest" exit 1 fi +if [ -n "$SANITIZERS" ] && [ -n "$ENABLE_CFGUARD" ]; then + echo "warning: Sanitizers may not work correctly with Control Flow Guard enabled." 1>&2 +fi mkdir -p "$PREFIX" PREFIX="$(cd "$PREFIX" && pwd)" @@ -100,6 +111,8 @@ for arch in $ARCHS; do -DCOMPILER_RT_BUILD_BUILTINS=$BUILD_BUILTINS \ -DLLVM_CONFIG_PATH="" \ -DSANITIZER_CXX_ABI=libc++ \ + -DCMAKE_C_FLAGS_INIT="$CFGUARD_CFLAGS" \ + -DCMAKE_CXX_FLAGS_INIT="$CFGUARD_CFLAGS" \ $SRC_DIR $BUILDCMD ${CORES+-j$CORES} $BUILDCMD install diff --git a/build-libcxx.sh b/build-libcxx.sh index 8bbdd73..6b18d97 100755 --- a/build-libcxx.sh +++ b/build-libcxx.sh @@ -18,6 +18,7 @@ set -e BUILD_STATIC=ON BUILD_SHARED=ON +CFGUARD_CFLAGS= while [ $# -gt 0 ]; do if [ "$1" = "--disable-shared" ]; then @@ -28,13 +29,17 @@ while [ $# -gt 0 ]; do BUILD_STATIC=OFF elif [ "$1" = "--enable-static" ]; then BUILD_STATIC=ON + elif [ "$1" = "--enable-cfguard" ]; then + CFGUARD_CFLAGS="-mguard=cf" + elif [ "$1" = "--disable-cfguard" ]; then + CFGUARD_CFLAGS= else PREFIX="$1" fi shift done if [ -z "$PREFIX" ]; then - echo $0 [--disable-shared] [--disable-static] dest + echo "$0 [--disable-shared] [--disable-static] [--enable-cfguard|--disable-cfguard] dest" exit 1 fi @@ -107,6 +112,8 @@ for arch in $ARCHS; do -DLIBCXXABI_USE_LLVM_UNWINDER=ON \ -DLIBCXXABI_ENABLE_SHARED=OFF \ -DLIBCXXABI_LIBDIR_SUFFIX="" \ + -DCMAKE_C_FLAGS_INIT="$CFGUARD_CFLAGS" \ + -DCMAKE_CXX_FLAGS_INIT="$CFGUARD_CFLAGS" \ .. $BUILDCMD ${CORES+-j$CORES} diff --git a/build-libssp.sh b/build-libssp.sh index 9af811c..6b4b064 100755 --- a/build-libssp.sh +++ b/build-libssp.sh @@ -16,8 +16,24 @@ set -e -if [ $# -lt 1 ]; then - echo $0 dest +CFGUARD_CFLAGS= + +while [ $# -gt 0 ]; do + case "$1" in + --enable-cfguard) + CFGUARD_CFLAGS="-mguard=cf" + ;; + --disable-cfguard) + CFGUARD_CFLAGS= + ;; + *) + PREFIX="$1" + ;; + esac + shift +done +if [ -z "$PREFIX" ]; then + echo "$0 [--enable-cfguard|--disable-cfguard] dest" exit 1 fi @@ -26,7 +42,6 @@ if command -v gmake >/dev/null; then MAKE=gmake fi -PREFIX="$1" mkdir -p "$PREFIX" PREFIX="$(cd "$PREFIX" && pwd)" export PATH="$PREFIX/bin:$PATH" @@ -80,7 +95,7 @@ for arch in $ARCHS; do [ -z "$CLEAN" ] || rm -rf build-$arch mkdir -p build-$arch cd build-$arch - $MAKE -f ../Makefile -j$CORES CROSS=$arch-w64-mingw32- + $MAKE -f ../Makefile -j$CORES CROSS=$arch-w64-mingw32- CFGUARD_CFLAGS="$CFGUARD_CFLAGS" mkdir -p "$PREFIX/$arch-w64-mingw32/bin" cp libssp.a "$PREFIX/$arch-w64-mingw32/lib" cp libssp_nonshared.a "$PREFIX/$arch-w64-mingw32/lib" diff --git a/build-mingw-w64-libraries.sh b/build-mingw-w64-libraries.sh index a676acd..3836ad1 100755 --- a/build-mingw-w64-libraries.sh +++ b/build-mingw-w64-libraries.sh @@ -16,11 +16,26 @@ set -e -if [ $# -lt 1 ]; then - echo $0 dest +USE_CFLAGS="-g -O2" + +while [ $# -gt 0 ]; do + case "$1" in + --enable-cfguard) + USE_CFLAGS="-g -O2 -mguard=cf" + ;; + --disable-cfguard) + USE_CFLAGS="-g -O2" + ;; + *) + PREFIX="$1" + ;; + esac + shift +done +if [ -z "$PREFIX" ]; then + echo "$0 [--enable-cfguard|--disable-cfguard] dest" exit 1 fi -PREFIX="$1" mkdir -p "$PREFIX" PREFIX="$(cd "$PREFIX" && pwd)" export PATH="$PREFIX/bin:$PATH" @@ -43,7 +58,9 @@ for lib in winpthreads winstorecompat; do mkdir -p build-$arch cd build-$arch arch_prefix="$PREFIX/$arch-w64-mingw32" - ../configure --host=$arch-w64-mingw32 --prefix="$arch_prefix" --libdir="$arch_prefix/lib" + ../configure --host=$arch-w64-mingw32 --prefix="$arch_prefix" --libdir="$arch_prefix/lib" \ + CFLAGS="$USE_CFLAGS" \ + CXXFLAGS="$USE_CFLAGS" make -j$CORES make install cd .. diff --git a/build-mingw-w64.sh b/build-mingw-w64.sh index 0d9bec2..3c3383f 100755 --- a/build-mingw-w64.sh +++ b/build-mingw-w64.sh @@ -20,6 +20,8 @@ set -e : ${DEFAULT_MSVCRT:=ucrt} : ${MINGW_W64_VERSION:=d4a0c84d908243a45255a06dc293d3d7c06db98c} +CFGUARD_FLAGS= + while [ $# -gt 0 ]; do case "$1" in --skip-include-triplet-prefix) @@ -31,6 +33,12 @@ while [ $# -gt 0 ]; do --with-default-msvcrt=*) DEFAULT_MSVCRT="${1#*=}" ;; + --enable-cfguard) + CFGUARD_FLAGS="--enable-cfguard" + ;; + --disable-cfguard) + CFGUARD_FLAGS= + ;; *) PREFIX="$1" ;; @@ -39,7 +47,7 @@ while [ $# -gt 0 ]; do done if [ -z "$CHECKOUT_ONLY" ]; then if [ -z "$PREFIX" ]; then - echo $0 [--skip-include-triplet-prefix] [--with-default-win32-winnt=0x601] [--with-default-msvcrt=ucrt] dest + echo "$0 [--skip-include-triplet-prefix] [--with-default-win32-winnt=0x601] [--with-default-msvcrt=ucrt] [--enable-cfguard|--disable-cfguard] dest" exit 1 fi @@ -118,7 +126,7 @@ for arch in $ARCHS; do ;; esac FLAGS="$FLAGS --with-default-msvcrt=$DEFAULT_MSVCRT" - ../configure --host=$arch-w64-mingw32 --prefix="$PREFIX/$arch-w64-mingw32" $FLAGS + ../configure --host=$arch-w64-mingw32 --prefix="$PREFIX/$arch-w64-mingw32" $FLAGS $CFGUARD_FLAGS $MAKE -j$CORES $MAKE install cd .. diff --git a/build-openmp.sh b/build-openmp.sh index 104e1e5..4ba41b0 100755 --- a/build-openmp.sh +++ b/build-openmp.sh @@ -16,9 +16,24 @@ set -e -PREFIX="$1" +CFGUARD_CFLAGS= + +while [ $# -gt 0 ]; do + case "$1" in + --enable-cfguard) + CFGUARD_CFLAGS="-mguard=cf" + ;; + --disable-cfguard) + CFGUARD_CFLAGS= + ;; + *) + PREFIX="$1" + ;; + esac + shift +done if [ -z "$PREFIX" ]; then - echo $0 dest + echo "$0 [--enable-cfguard|--disable-cfguard] dest" exit 1 fi @@ -84,6 +99,8 @@ for arch in $ARCHS; do -DCMAKE_AR="$PREFIX/bin/llvm-ar" \ -DCMAKE_RANLIB="$PREFIX/bin/llvm-ranlib" \ -DLIBOMP_ENABLE_SHARED=TRUE \ + -DCMAKE_C_FLAGS_INIT="$CFGUARD_CFLAGS" \ + -DCMAKE_CXX_FLAGS_INIT="$CFGUARD_CFLAGS" \ $CMAKEFLAGS \ .. $BUILDCMD ${CORES+-j$CORES} diff --git a/libssp-Makefile b/libssp-Makefile index 97c1914..07f5356 100644 --- a/libssp-Makefile +++ b/libssp-Makefile @@ -4,7 +4,7 @@ vpath %.c $(SRC_PATH) CC = $(CROSS)gcc AR = $(CROSS)ar -CFLAGS = -O2 -Wall -Wundef -I$(SRC_PATH) -D_FORTIFY_SOURCE=0 -D__SSP_FORTIFY_LEVEL=0 +CFLAGS = $(CFGUARD_CFLAGS) -O2 -Wall -Wundef -I$(SRC_PATH) -D_FORTIFY_SOURCE=0 -D__SSP_FORTIFY_LEVEL=0 SOURCES = $(filter-out ssp-local.c, $(patsubst $(SRC_PATH)%,%,$(wildcard $(SRC_PATH)*.c))) OBJS = $(SOURCES:%.c=%.o)