Support branch protection

[blhc/blhc.git] / bin / blhc

diff --git a/bin/blhc b/bin/blhc
index c4443832eff00b2552fcf4c1f94468775b6a9c35..9b785b1722a034af38ab27e14dd1cf143ccbb9d8 100755 (executable)
--- a/bin/blhc
+++ b/bin/blhc
@@ -243,6 +243,12 @@ my @def_cflags_stack_clash = (
 my @def_cflags_pie = (
     '-fPIE',
 );
+my @def_cflags_branch_amd64 = (
+    '-fcf-protection',
+);
+my @def_cflags_branch_arm64 = (
+    '-mbranch-protection=standard',
+);
 my @def_cxxflags = (
     @def_cflags,
 );
@@ -285,6 +291,8 @@ my @flag_refs = (
     \@def_cflags_stack_bad,
     \@def_cflags_stack_clash,
     \@def_cflags_pie,
+    \@def_cflags_branch_amd64,
+    \@def_cflags_branch_arm64,
     \@def_cxxflags,
     \@def_cppflags,
     \@def_cppflags_fortify,
@@ -807,6 +815,7 @@ foreach my $file (@ARGV) {
     my $harden_stack   = 1;
     my $harden_stack_strong = 1;
     my $harden_stack_clash = 1;
+    my $harden_branch  = 1;
     my $harden_relro   = 1;
     my $harden_bindnow = $option_bindnow; # defaults to 0
     my $harden_pie     = $option_pie;     # defaults to 0
@@ -862,6 +871,7 @@ foreach my $file (@ARGV) {
             my $disable = 1;
             my $disable_strong = 1;
             my $disable_clash = 1;
+            my $disable_branch = 1;
 
             if ($line =~ /\bdpkg-dev_(\S+)/) {
                 if (Dpkg::Version::version_compare($1, '1.16.1') >= 0) {
@@ -875,6 +885,7 @@ foreach my $file (@ARGV) {
                 }
                 if (Dpkg::Version::version_compare($1, '1.22.0') >= 0) {
                     $disable_clash = 0;
+                    $disable_branch = 0;
                 }
             }
 
@@ -892,6 +903,9 @@ foreach my $file (@ARGV) {
             if ($disable_clash) {
                 $harden_stack_clash = 0;
             }
+            if ($disable_branch) {
+                $harden_branch = 0;
+            }
         }
 
         # The following two versions of CMake in Debian obeyed CPPFLAGS, but
@@ -1179,6 +1193,7 @@ foreach my $file (@ARGV) {
     }
 
     # Option or auto detected.
+    my @harden_branch_flags;
     if ($arch) {
         # The following was partially copied from dpkg-dev 1.22.0
         # (/usr/share/perl5/Dpkg/Vendor/Debian.pm, set_build_features and
@@ -1248,6 +1263,11 @@ foreach my $file (@ARGV) {
             $harden_relro   = 0;
             $harden_bindnow = 0;
         }
+        if ($cpu eq 'amd64') {
+            @harden_branch_flags = @def_cflags_branch_amd64;
+        } elsif ($cpu eq 'arm64') {
+            @harden_branch_flags = @def_cflags_branch_arm64;
+        }
     }
 
     # Default values.
@@ -1281,6 +1301,10 @@ foreach my $file (@ARGV) {
         @cflags   = (@cflags,   @def_cflags_format);
         @cxxflags = (@cxxflags, @def_cflags_format);
     }
+    if ($harden_branch and @harden_branch_flags) {
+        @cflags   = (@cflags,   @harden_branch_flags);
+        @cxxflags = (@cxxflags, @harden_branch_flags);
+    }
     if ($harden_relro) {
         @ldflags = (@ldflags, @def_ldflags_relro);
     }