Enable Intel CET in liblto_plugin.so on Intel CET enabled host

Since ld is Intel CET enabled on Intel CET enabled host, dlopen fails on
liblto_plugin.so if it isn't Intel CET enabled.  Add GCC_CET_HOST_FLAGS
to cet.m4, use it in libiberty and lto-plugin to always enable Intel
CET in liblto_plugin.so on Intel CET enabled host.

On Linux/x86 host, enable Intel CET by default if assembler and compiler
support Intel CET so that the generated liblto_plugin.so can be used on
both CET and non-CET machines.  It is an error to disable Intel CET in
liblto_plugin.so on Intel CET enabled host.

config/

	PR bootstrap/94739
	* cet.m4 (GCC_CET_HOST_FLAGS): New.

libiberty/

	PR bootstrap/94739
	* Makefile.in (COMPILE.c): Add @CET_HOST_FLAGS@.
	(configure_deps): Add $(srcdir)/../config/cet.m4 and
	$(srcdir)/../config/enable.m4.
	* aclocal.m4: Include ../config/cet.m4 and ../config/enable.m4.
	* configure.ac: Add GCC_CET_HOST_FLAGS(CET_HOST_FLAGS) and
	AC_SUBST(CET_HOST_FLAGS).
	* configure: Regenerated.

lto-plugin/

	PR bootstrap/94739
	* Makefile.am (AM_CFLAGS): Add $(CET_HOST_FLAGS).
	* configure.ac: Add GCC_CET_HOST_FLAGS(CET_HOST_FLAGS) and
	AC_SUBST(CET_HOST_FLAGS).
	* Makefile.in: Regenerated.
	* aclocal.m4: Likewise.
	* configure: Likewise.

config/ChangeLog

+2020-04-25  H.J. Lu  <hongjiu.lu@intel.com>
+
+	PR bootstrap/94739
+	* cet.m4 (GCC_CET_HOST_FLAGS): New.
+
 2020-04-22  Jakub Jelinek  <jakub@redhat.com>
 
 	PR libfortran/94694

config/cet.m4

@@ -48,3 +48,97 @@ else
   AC_MSG_RESULT([no])
 fi
 ])
+
+dnl
+dnl GCC_CET_HOST_FLAGS
+dnl    (SHELL-CODE_HANDLER)
+dnl
+AC_DEFUN([GCC_CET_HOST_FLAGS],[dnl
+GCC_ENABLE(cet, auto, ,[enable Intel CET in host libraries],
+	   permit yes|no|auto)
+AC_MSG_CHECKING([for CET support])
+
+case "$host" in
+  i[[34567]]86-*-linux* | x86_64-*-linux*)
+    may_have_cet=yes
+    save_CFLAGS="$CFLAGS"
+    CFLAGS="$CFLAGS -fcf-protection"
+    case "$enable_cet" in
+      auto)
+	# Check if target supports multi-byte NOPs
+	# and if assembler supports CET insn.
+	AC_COMPILE_IFELSE(
+	 [AC_LANG_PROGRAM(
+	  [],
+	  [
+#if !defined(__SSE2__)
+#error target does not support multi-byte NOPs
+#else
+asm ("setssbsy");
+#endif
+	  ])],
+	 [enable_cet=yes],
+	 [enable_cet=no])
+	;;
+      yes)
+	# Check if assembler supports CET.
+	AC_COMPILE_IFELSE(
+	 [AC_LANG_PROGRAM(
+	  [],
+	  [asm ("setssbsy");])],
+	 [],
+	 [AC_MSG_ERROR([assembler with CET support is required for --enable-cet])])
+	;;
+    esac
+    CFLAGS="$save_CFLAGS"
+    ;;
+  *)
+    may_have_cet=no
+    enable_cet=no
+    ;;
+esac
+
+if test x$may_have_cet = xyes; then
+  save_LDFLAGS="$LDFLAGS"
+  LDFLAGS="$LDFLAGS -Wl,-z,ibt,-z,shstk"
+  AC_TRY_RUN([
+static void
+foo (void)
+{
+}
+
+static void
+__attribute__ ((noinline, noclone))
+xxx (void (*f) (void))
+{
+  f ();
+}
+
+static void
+__attribute__ ((noinline, noclone))
+bar (void)
+{
+  xxx (foo);
+}
+
+int
+main ()
+{
+  bar ();
+  return 0;
+}
+  ],
+  [have_cet=no],
+  [have_cet=yes])
+  LDFLAGS="$save_LDFLAGS"
+  if test x$enable_cet = xno -a x$have_cet = xyes; then
+    AC_MSG_ERROR([Intel CET must be enabled on Intel CET enabled host])
+  fi
+fi
+if test x$enable_cet = xyes; then
+  $1="-fcf-protection"
+  AC_MSG_RESULT([yes])
+else
+  AC_MSG_RESULT([no])
+fi
+])

libiberty/ChangeLog

+2020-04-25  H.J. Lu  <hongjiu.lu@intel.com>
+
+	PR bootstrap/94739
+	* Makefile.in (COMPILE.c): Add @CET_HOST_FLAGS@.
+	(configure_deps): Add $(srcdir)/../config/cet.m4 and
+	$(srcdir)/../config/enable.m4.
+	* aclocal.m4: Include ../config/cet.m4 and ../config/enable.m4.
+	* configure.ac: Add GCC_CET_HOST_FLAGS(CET_HOST_FLAGS) and
+	AC_SUBST(CET_HOST_FLAGS).
+	* configure: Regenerated.
+
 2020-03-05  Egeyar Bagcioglu  <egeyar.bagcioglu@oracle.com>
 
 	* simple-object.c (handle_lto_debug_sections): Name

libiberty/Makefile.in

@@ -112,7 +112,8 @@ installcheck: installcheck-subdir
 INCDIR=$(srcdir)/$(MULTISRCTOP)../include
 
 COMPILE.c = $(CC) -c @DEFS@ $(CFLAGS) $(CPPFLAGS) -I. -I$(INCDIR) \
-               $(HDEFINES) @ac_libiberty_warn_cflags@ -D_GNU_SOURCE
+               $(HDEFINES) @ac_libiberty_warn_cflags@ -D_GNU_SOURCE \
+               @CET_HOST_FLAGS@
 
 # Just to make sure we don't use a built-in rule with VPATH
 .c.$(objext):
@@ -481,6 +482,8 @@ config.status: $(srcdir)/configure
 AUTOCONF = autoconf
 configure_deps = $(srcdir)/aclocal.m4 \
 	$(srcdir)/../config/acx.m4 \
+	$(srcdir)/../config/cet.m4 \
+	$(srcdir)/../config/enable.m4 \
 	$(srcdir)/../config/no-executables.m4 \
 	$(srcdir)/../config/override.m4 \
 	$(srcdir)/../config/picflag.m4 \

libiberty/aclocal.m4

 sinclude(../config/acx.m4)
+sinclude(../config/cet.m4)
+sinclude(../config/enable.m4)
 sinclude(../config/no-executables.m4)
 sinclude(../config/override.m4)
 sinclude(../config/picflag.m4)

libiberty/configure

@@ -626,6 +626,7 @@ pexecute
 target_header_dir
 CHECK
 LIBOBJS
+CET_HOST_FLAGS
 NOASANFLAG
 PICFLAG
 INSTALL_DATA
@@ -710,6 +711,7 @@ enable_maintainer_mode
 enable_multilib
 enable_install_libiberty
 enable_largefile
+enable_cet
 '
       ac_precious_vars='build_alias
 host_alias
@@ -1337,6 +1339,7 @@ Optional Features:
   --enable-multilib       build many library versions (default)
   --enable-install-libiberty       Install headers and library for end users
   --disable-largefile     omit support for large files
+  --enable-cet            enable Intel CET in host libraries [default=auto]
 
 Optional Packages:
   --with-PACKAGE[=ARG]    use PACKAGE [ARG=yes]
@@ -5264,6 +5267,148 @@ case " ${CFLAGS} " in
 esac
 
 
+ # Check whether --enable-cet was given.
+if test "${enable_cet+set}" = set; then :
+  enableval=$enable_cet;
+      case "$enableval" in
+       yes|no|auto) ;;
+       *) as_fn_error $? "Unknown argument to enable/disable cet" "$LINENO" 5 ;;
+                          esac
+
+else
+  enable_cet=auto
+fi
+
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for CET support" >&5
+$as_echo_n "checking for CET support... " >&6; }
+
+case "$host" in
+  i[34567]86-*-linux* | x86_64-*-linux*)
+    may_have_cet=yes
+    save_CFLAGS="$CFLAGS"
+    CFLAGS="$CFLAGS -fcf-protection"
+    case "$enable_cet" in
+      auto)
+	# Check if target supports multi-byte NOPs
+	# and if assembler supports CET insn.
+	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main ()
+{
+
+#if !defined(__SSE2__)
+#error target does not support multi-byte NOPs
+#else
+asm ("setssbsy");
+#endif
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+  enable_cet=yes
+else
+  enable_cet=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+	;;
+      yes)
+	# Check if assembler supports CET.
+	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main ()
+{
+asm ("setssbsy");
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+
+else
+  as_fn_error $? "assembler with CET support is required for --enable-cet" "$LINENO" 5
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+	;;
+    esac
+    CFLAGS="$save_CFLAGS"
+    ;;
+  *)
+    may_have_cet=no
+    enable_cet=no
+    ;;
+esac
+
+if test x$may_have_cet = xyes; then
+  save_LDFLAGS="$LDFLAGS"
+  LDFLAGS="$LDFLAGS -Wl,-z,ibt,-z,shstk"
+  if test "$cross_compiling" = yes; then :
+  { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "cannot run test program while cross compiling
+See \`config.log' for more details" "$LINENO" 5; }
+else
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+static void
+foo (void)
+{
+}
+
+static void
+__attribute__ ((noinline, noclone))
+xxx (void (*f) (void))
+{
+  f ();
+}
+
+static void
+__attribute__ ((noinline, noclone))
+bar (void)
+{
+  xxx (foo);
+}
+
+int
+main ()
+{
+  bar ();
+  return 0;
+}
+
+_ACEOF
+if ac_fn_c_try_run "$LINENO"; then :
+  have_cet=no
+else
+  have_cet=yes
+fi
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
+  conftest.$ac_objext conftest.beam conftest.$ac_ext
+fi
+
+  LDFLAGS="$save_LDFLAGS"
+  if test x$enable_cet = xno -a x$have_cet = xyes; then
+    as_fn_error $? "Intel CET must be enabled on Intel CET enabled host" "$LINENO" 5
+  fi
+fi
+if test x$enable_cet = xyes; then
+  CET_HOST_FLAGS="-fcf-protection"
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi
+
+
+
 echo "# Warning: this fragment is automatically generated" > temp-frag
 
 if [ -n "${frag}" ] && [ -f "${frag}" ]; then

libiberty/configure.ac

@@ -243,6 +243,9 @@ case " ${CFLAGS} " in
 esac
 AC_SUBST(NOASANFLAG)
 
+GCC_CET_HOST_FLAGS(CET_HOST_FLAGS)
+AC_SUBST(CET_HOST_FLAGS)
+
 echo "# Warning: this fragment is automatically generated" > temp-frag
 
 if [[ -n "${frag}" ]] && [[ -f "${frag}" ]]; then

lto-plugin/ChangeLog

+2020-04-25  H.J. Lu  <hongjiu.lu@intel.com>
+
+	PR bootstrap/94739
+	* Makefile.am (AM_CFLAGS): Add $(CET_HOST_FLAGS).
+	* configure.ac: Add GCC_CET_HOST_FLAGS(CET_HOST_FLAGS) and
+	AC_SUBST(CET_HOST_FLAGS).
+	* Makefile.in: Regenerated.
+	* aclocal.m4: Likewise.
+	* configure: Likewise.
+
 2020-03-19  Martin Liska  <mliska@suse.cz>
 
 	* lto-plugin.c (LTO_SECTION_PREFIX): Rename to ...

lto-plugin/Makefile.am

@@ -8,7 +8,7 @@ target_noncanonical := @target_noncanonical@
 libexecsubdir := $(libexecdir)/gcc/$(real_target_noncanonical)/$(gcc_version)$(accel_dir_suffix)
 
 AM_CPPFLAGS = -I$(top_srcdir)/../include $(DEFS)
-AM_CFLAGS = @ac_lto_plugin_warn_cflags@
+AM_CFLAGS = @ac_lto_plugin_warn_cflags@ $(CET_HOST_FLAGS)
 AM_LDFLAGS = @ac_lto_plugin_ldflags@
 AM_LIBTOOLFLAGS = --tag=disable-static
 override CFLAGS := $(filter-out -fsanitize=address,$(CFLAGS))

lto-plugin/Makefile.in

@@ -92,7 +92,9 @@ target_triplet = @target@
 subdir = .
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/../config/acx.m4 \
+	$(top_srcdir)/../config/cet.m4 \
 	$(top_srcdir)/../config/depstand.m4 \
+	$(top_srcdir)/../config/enable.m4 \
 	$(top_srcdir)/../config/lead-dot.m4 \
 	$(top_srcdir)/../config/lthostflags.m4 \
 	$(top_srcdir)/../config/override.m4 \
@@ -216,6 +218,7 @@ AUTOMAKE = @AUTOMAKE@
 AWK = @AWK@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
+CET_HOST_FLAGS = @CET_HOST_FLAGS@
 CFLAGS = @CFLAGS@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
@@ -340,7 +343,7 @@ AUTOMAKE_OPTIONS = no-dependencies
 gcc_version := $(shell @get_gcc_base_ver@ $(top_srcdir)/../gcc/BASE-VER)
 libexecsubdir := $(libexecdir)/gcc/$(real_target_noncanonical)/$(gcc_version)$(accel_dir_suffix)
 AM_CPPFLAGS = -I$(top_srcdir)/../include $(DEFS)
-AM_CFLAGS = @ac_lto_plugin_warn_cflags@
+AM_CFLAGS = @ac_lto_plugin_warn_cflags@ $(CET_HOST_FLAGS)
 AM_LDFLAGS = @ac_lto_plugin_ldflags@
 AM_LIBTOOLFLAGS = --tag=disable-static
 libexecsub_LTLIBRARIES = liblto_plugin.la

lto-plugin/aclocal.m4

@@ -1168,7 +1168,9 @@ AC_SUBST([am__untar])
 ]) # _AM_PROG_TAR
 
 m4_include([../config/acx.m4])
+m4_include([../config/cet.m4])
 m4_include([../config/depstand.m4])
+m4_include([../config/enable.m4])
 m4_include([../config/lead-dot.m4])
 m4_include([../config/lthostflags.m4])
 m4_include([../config/override.m4])

lto-plugin/configure

@@ -654,6 +654,7 @@ get_gcc_base_ver
 real_target_noncanonical
 accel_dir_suffix
 gcc_build_dir
+CET_HOST_FLAGS
 ac_lto_plugin_ldflags
 ac_lto_plugin_warn_cflags
 EGREP
@@ -770,6 +771,7 @@ enable_maintainer_mode
 with_libiberty
 enable_dependency_tracking
 enable_largefile
+enable_cet
 with_gcc_major_version_only
 enable_shared
 enable_static
@@ -1416,6 +1418,7 @@ Optional Features:
   --disable-dependency-tracking
                           speeds up one-time build
   --disable-largefile     omit support for large files
+  --enable-cet            enable Intel CET in host libraries [default=auto]
   --enable-shared[=PKGS]  build shared libraries [default=yes]
   --enable-static[=PKGS]  build static libraries [default=yes]
   --enable-fast-install[=PKGS]
@@ -5660,6 +5663,148 @@ if test "x$have_static_libgcc" = xyes; then
 fi
 
 
+ # Check whether --enable-cet was given.
+if test "${enable_cet+set}" = set; then :
+  enableval=$enable_cet;
+      case "$enableval" in
+       yes|no|auto) ;;
+       *) as_fn_error $? "Unknown argument to enable/disable cet" "$LINENO" 5 ;;
+                          esac
+
+else
+  enable_cet=auto
+fi
+
+
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for CET support" >&5
+$as_echo_n "checking for CET support... " >&6; }
+
+case "$host" in
+  i[34567]86-*-linux* | x86_64-*-linux*)
+    may_have_cet=yes
+    save_CFLAGS="$CFLAGS"
+    CFLAGS="$CFLAGS -fcf-protection"
+    case "$enable_cet" in
+      auto)
+	# Check if target supports multi-byte NOPs
+	# and if assembler supports CET insn.
+	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main ()
+{
+
+#if !defined(__SSE2__)
+#error target does not support multi-byte NOPs
+#else
+asm ("setssbsy");
+#endif
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+  enable_cet=yes
+else
+  enable_cet=no
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+	;;
+      yes)
+	# Check if assembler supports CET.
+	cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main ()
+{
+asm ("setssbsy");
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"; then :
+
+else
+  as_fn_error $? "assembler with CET support is required for --enable-cet" "$LINENO" 5
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+	;;
+    esac
+    CFLAGS="$save_CFLAGS"
+    ;;
+  *)
+    may_have_cet=no
+    enable_cet=no
+    ;;
+esac
+
+if test x$may_have_cet = xyes; then
+  save_LDFLAGS="$LDFLAGS"
+  LDFLAGS="$LDFLAGS -Wl,-z,ibt,-z,shstk"
+  if test "$cross_compiling" = yes; then :
+  { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+$as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "cannot run test program while cross compiling
+See \`config.log' for more details" "$LINENO" 5; }
+else
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+static void
+foo (void)
+{
+}
+
+static void
+__attribute__ ((noinline, noclone))
+xxx (void (*f) (void))
+{
+  f ();
+}
+
+static void
+__attribute__ ((noinline, noclone))
+bar (void)
+{
+  xxx (foo);
+}
+
+int
+main ()
+{
+  bar ();
+  return 0;
+}
+
+_ACEOF
+if ac_fn_c_try_run "$LINENO"; then :
+  have_cet=no
+else
+  have_cet=yes
+fi
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
+  conftest.$ac_objext conftest.beam conftest.$ac_ext
+fi
+
+  LDFLAGS="$save_LDFLAGS"
+  if test x$enable_cet = xno -a x$have_cet = xyes; then
+    as_fn_error $? "Intel CET must be enabled on Intel CET enabled host" "$LINENO" 5
+  fi
+fi
+if test x$enable_cet = xyes; then
+  CET_HOST_FLAGS="-fcf-protection"
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi
+
+
+
 if test x"$host_subdir" = x.; then
    gcc_build_dir=../gcc
 else
@@ -11771,7 +11916,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 11774 "configure"
+#line 11919 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -11877,7 +12022,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 11880 "configure"
+#line 12025 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H

lto-plugin/configure.ac

@@ -27,6 +27,9 @@ if test "x$have_static_libgcc" = xyes; then
 fi
 AC_SUBST(ac_lto_plugin_ldflags)
 
+GCC_CET_HOST_FLAGS(CET_HOST_FLAGS)
+AC_SUBST(CET_HOST_FLAGS)
+
 if test x"$host_subdir" = x.; then
    gcc_build_dir=../gcc
 else