[1-2/12] New configure option --enable-espf=(all|ssp|pie|no)

Message ID	3585035.qAqG0yHGSY@laptop1.gw.ume.nu
State	New
Headers	show Return-Path: <gcc-patches-return-328502-incoming=patchwork.ozlabs.org@gcc.gnu.org> Comment: DKIM? See http://www.dkim.org Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=gcc.gnu.org; h=Received:Received:X-SWARE-Spam-Status:X-Spam-Check-By:Received:Received:From:To:Subject:Date:Message-ID:User-Agent:In-Reply-To:References:MIME-Version:Content-Type:Content-Transfer-Encoding:X-IsSubscribed:Mailing-List:Precedence:List-Id:List-Unsubscribe:List-Archive:List-Post:List-Help:Sender:Delivered-To; b=WIbZAGYlA2zoSIvl2/ycWHR0YGqROUecLkbUytpqI1WT1OLTw7hsEUO+66S+xX CjfM67ZxoiFz42gW13zeILV0cTqKTMyBIF7W4J56r5w061QqICM8T73MKu0JE9pD GMETAy2RjJ0qEWEuGZXLC8eskTT+qgu1WnyvYNToBQmvo=; sender: zorry) by smtp.gentoo.org (Postfix) with ESMTPSA id C483333BF3F for <gcc-patches@gcc.gnu.org>; Mon, 8 Oct 2012 23:20:15 +0000 (UTC) From: Magnus Granberg <zorry@gentoo.org> To: gcc-patches@gcc.gnu.org Subject: Re: [PATCH 1-2/12 ] New configure option --enable-espf=(all\|ssp\|pie\|no) Date: Tue, 09 Oct 2012 01:20:05 +0200 Message-ID: <3585035.qAqG0yHGSY@laptop1.gw.ume.nu> User-Agent: KMail/4.9.1 (Linux/3.5.3-hardened-r1; KDE/4.9.1; x86_64; ; ) In-Reply-To: <4182464.feoll6zmCU@laptop1.gw.ume.nu> References: <1847698.P25PdQuT3z@laptop1.gw.ume.nu> <6329889.v8vU0eIiWP@laptop1.gw.ume.nu> <4182464.feoll6zmCU@laptop1.gw.ume.nu> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="nextPart1392020.QKYiph1kdW" Content-Transfer-Encoding: 7Bit Mailing-List: contact gcc-patches-help@gcc.gnu.org; run by ezmlm Precedence: bulk Sender: gcc-patches-owner@gcc.gnu.org

--- a/configure.ac 2012-02-02 11:20:32.000000000 +0100 +++ b/configure.ac 2012-07-01 00:44:27.845218414 +0200 @@ -424,6 +424,36 @@ AC_ARG_ENABLE(libssp, ENABLE_LIBSSP=$enableval, ENABLE_LIBSSP=yes) +# Check whether --enable-espf was given and target have the support. +AC_ARG_ENABLE([espf], +[AS_HELP_STRING([--enable-espf[=ARG]], + [Enable Stack protector, Position independent executable and + Fortify_source as default. If we have suppot for it when compiling. + Linux targets supported i?86 and x86_64. + @<:@ARG={all,pie,ssp,no}@:>@ ])], +set_enable_espf=$enableval, +set_enable_espf=no) +case "${set_enable_espf}" in + all|pie|ssp) + case $target in + i?86*-*-linux* | x86_64*-*-linux*) + enable_espf=yes + ;; + *) + enable_espf=no + AC_MSG_WARN([*** --enable-espf is not supported on this $target target.]) + ;; + esac + ;; + no) + enable_espf=no + ;; + *) + AC_MSG_ERROR([invalid --enable-espf argument]) + ;; +esac +AC_SUBST([enable_espf]) + # Save it here so that, even in case of --enable-libgcj, if the Java # front-end isn't enabled, we still get libgcj disabled. libgcj_saved=$libgcj @@ -3213,6 +3242,11 @@ if test "$GCC" = yes -a "$ENABLE_BUILD_W CFLAGS="$saved_CFLAGS" fi +# Disable -fstack-protector on stage1 +if test x$enable_espf = xyes; then + stage1_cflags="$stage1_cflags -fno-stack-protector" +fi + AC_SUBST(stage1_cflags) # Enable --enable-checking in stage1 of the compiler. --- a/gcc/configure.ac 2012-02-22 12:27:45.000000000 +0100 +++ b/gcc/configure.ac 2012-07-01 00:43:14.054216215 +0200 @@ -342,7 +342,8 @@ GCC_STDINT_TYPES # So, we only use -pedantic if we can disable those warnings. ACX_PROG_CC_WARNING_OPTS( - m4_quote(m4_do([-W -Wall -Wno-narrowing -Wwrite-strings -Wcast-qual])), [loose_warn]) + m4_quote(m4_do([-W -Wall -Wno-narrowing -Wwrite-strings -Wcast-qual \ + -Wno-format-security])), [loose_warn]) ACX_PROG_CC_WARNING_OPTS( m4_quote(m4_do([-Wstrict-prototypes -Wmissing-prototypes])), [c_loose_warn]) @@ -5193,6 +5194,167 @@ if test x"${LINKER_HASH_STYLE}" != x; th [The linker hash style]) fi +# -------------- +# Espf checks +# -------------- + +# Check whether --enable-espf was given and target have the support. +AC_ARG_ENABLE([espf], +[AS_HELP_STRING([--enable-espf[=ARG]], + [Enable Stack protector, Position independent executable and + Fortify_sources as default. If we have suppot for it when compiling. + Linux targets supported x86_64. @<:@ARG={all,pie,ssp,no}@:>@ ])], +set_enable_espf=$enableval, +set_enable_espf=no) +case "${set_enable_espf}" in + all|pie|ssp) + AC_MSG_CHECKING(if $target support espf) + case $target in + i?86*-*-linux* | x86_64-*-linux*) + enable_espf=yes + AC_DEFINE(ENABLE_ESPF, 1, + [Define if your target support espf and you have enable it.]) + ;; + *) + enable_espf=no + AC_MSG_WARN([*** --enable-espf is not supported on this $target target.]) + ;; + esac + AC_MSG_RESULT($enable_espf) + ;; + no) + enable_espf=no + ;; + *) + AC_MSG_ERROR([invalid --enable-espf argument]) + ;; +esac +AC_SUBST([enable_espf]) +if test $enable_espf = yes ; then + +# Check for FORTIFY_SOURCES support in target C library. + AC_CACHE_CHECK(for _FORTIFY_SOURCES support in target C library, + gcc_cv_libc_provides_fortify, + [gcc_cv_libc_provides_fortify=no + case "$target" in + *-*-linux*) + [# glibc 2.8 and later provides _FORTIFY_SOURCES. + # uClibc 0.9.32 and later provides _FORTIFY_SOURCES. + if test -f $target_header_dir/features.h; then + if $EGREP '^[ ]*#[ ]*define[ ]+__GLIBC__[ ]+2' \ + $target_header_dir/features.h > /dev/null \ + && $EGREP '^[ ]*#[ ]*define[ ]+__GLIBC_MINOR__[ ]+([1-9][0-9]|[8-9])' \ + $target_header_dir/features.h > /dev/null; then + gcc_cv_libc_provides_fortify=yes + elif $EGREP '^[ ]*#[ ]*define[ ]+__UCLIBC__[ ]+1' \ + $target_header_dir/features.h > /dev/null; then + if test -f $target_header_dir/bits/uClibc_config.h && \ + $EGREP '^[ ]*#[ ]*define[ ]+__UCLIBC_SUBLEVEL__[ ]+([3-9][2-9]|[4-9][0-9])' \ + $target_header_dir/bits/uClibc_config.h > /dev/null; then + gcc_cv_libc_provides_fortify=yes + else + gcc_cv_libc_provides_fortify=no + fi + fi + fi] + ;; + *) gcc_cv_libc_provides_fortify=no ;; + esac]) + + AC_MSG_CHECKING(if we can default to use -fPIE and link with -pie) + enable_espf_pie=no + if test x$gcc_cv_ld_pie = xyes ;then + if test x$set_enable_espf = xall || test x$set_enable_espf = pie; then + if test x$cross_compiling = xno ; then + saved_LDFLAGS="$LDFLAGS" + saved_CFLAGS="$CFLAGS" + CFLAGS="$CFLAGS -fPIE -Werror" + LDFLAGS="$LDFLAGS -fPIE -pie" + AC_TRY_LINK(,, + [AC_MSG_RESULT([yes]); enable_espf_pie=yes],) + LDFLAGS="$saved_LDFLAGS" + CFLAGS="$saved_CFLAGS" + else + AC_MSG_RESULT([yes]) + fi + fi + fi + if test $enable_espf_pie = yes ; then + AC_DEFINE(ENABLE_ESPF_PIE, 1, + [Define if your compiler will default to use -fPIE and link with -pie.]) + else + AC_MSG_RESULT([no]) + fi + + AC_MSG_CHECKING(if we can default to use -fstack-protector) + ssp_link_test=no + enable_espf_ssp=no + if test x$gcc_cv_libc_provides_ssp = xyes && test x$set_have_as_tls = xyes; then + if $EGREP '^[ ]*#[ ]*define[ ]+__UCLIBC__[ ]+1' \ + $target_header_dir/features.h > /dev/null; then + if test -f $target_header_dir/bits/uClibc_config.h && \ + $EGREP '^[ ]*#[ ]*define[ ]+__UCLIBC_SUBLEVEL__[ ]+([3-9][2-9]|[4-9][0-9])' \ + $target_header_dir/bits/uClibc_config.h > /dev/null && \ + $EGREP '^[ ]*#[ ]*define[ ]+__UCLIBC_HAS_TLS__[ ]+1' \ + $target_header_dir/bits/uClibc_config.h > /dev/null; then + ssp_link_test=yes + fi + else + ssp_link_test=yes + fi + fi + if test x$ssp_link_test=xyes;then + if test x$set_enable_espf = xall || test x$set_enable_espf = xssp; then + if test x$cross_compiling = xno ; then + saved_CFLAGS="$CFLAGS" + CFLAGS="$CFLAGS -O2 -fstack-protector -Werror" + AC_TRY_LINK(,, + [AC_MSG_RESULT([yes]); enable_espf_ssp=yes],) + CFLAGS="$saved_CFLAGS" + else + enable_espf_ssp=yes + AC_MSG_RESULT($enable_espf_ssp) + fi + fi + fi + if test $enable_espf_ssp = yes ; then + AC_DEFINE(ENABLE_ESPF_SSP, 1, + [Define if your compiler will default to use -fstack-protector.]) + else + AC_MSG_RESULT([no]) + fi + + AC_MSG_CHECKING(if the compiler default to use -D_FORTIFY_SOURCES=2) + if test x$gcc_cv_libc_provides_fortify = xyes && test x$cross_compiling = xno ; then + saved_CFLAGS="$CFLAGS" + saved_CPPFLAGS="$CPPFLAGS" + CFLAGS="$CFLAGS -O2 -Werror" + CPPFLAGS="$CPPFLAGS -D_FORTIFY_SOURCES=2" + AC_TRY_LINK([ + #include <sys/types.h> + #include <sys/stat.h> + #include <fcntl.h> + ],[ + open ("/tmp/foo", O_WRONLY | O_CREAT); + ], + [AC_MSG_RESULT([no]); enable_espf_fortify=no], + [AC_MSG_RESULT([yes]); enable_espf_fortify=yes]) + CFLAGS="$saved_CFLAGS" + CPPFLAGS="$saved_CPPFLAGS" + elif test x$gcc_cv_libc_provides_fortify = xyes && test x$cross_compiling = xyes ; then + AC_MSG_RESULT([yes]) + enable_espf_fortify=yes + else + AC_MSG_RESULT([no]) + enable_espf_fortify=no + fi + if test $enable_espf_fortify = yes ; then + AC_DEFINE(ENABLE_ESPF_FORTIFY, 1, + [Define if your compiler will default to use -D_FORTIFY_SOURCES=2.]) + fi + +fi + # Configure the subdirectories # AC_CONFIG_SUBDIRS($subdirs) --- a/libcpp/configure.ac 2012-02-14 11:02:21.000000000 +0100 +++ b/libcpp/configure.ac 2012-09-10 01:27:54.618064325 +0200 @@ -34,7 +34,7 @@ AC_CHECK_PROGS([AUTOHEADER], [autoheader # See config/warnings.m4 for details. ACX_PROG_CC_WARNING_OPTS([-W -Wall -Wno-narrowing -Wwrite-strings \ - -Wmissing-format-attribute], [warn]) + -Wmissing-format-attribute -Wno-format-security], [warn]) ACX_PROG_CC_WARNING_OPTS([-Wstrict-prototypes -Wmissing-prototypes \ -Wold-style-definition -Wc++-compat], [c_warn]) ACX_PROG_CC_WARNING_ALMOST_PEDANTIC([-Wno-long-long])

[1-2/12] New configure option --enable-espf=(all|ssp|pie|no)

Commit Message

Patch