[libc++][libc++abi][CET] Support building libc++ and libc++abi with CET enabled.

[xiongji90]

Summary

Control-flow Enforcement Technology (CET), published by Intel, introduces indirect branch tracking (IBT) to guard all indirect 'jmp' and 'call'. The target of indirect 'jmp' or 'call' begin with 'endbr' instruction. Currently, CET has been implemented in x86 GNU Linux platforms.
In order to enable CET when building applications, we need to ensure:

1. building source code with '-fcf-protection=full'
2. all libraries linked must be CET enabled

This patch is used to build libc++ and libc++abi with CET enabled. If developers want to build applications with CET enabled and use libc++ and libc++abi, they must link CET enabled libc++ and libc++abi libraries. We introduce 2 options: LIBCXX_ENABLE_CET and LIBCXXABI_ENABLE_CET to enable CET building. This patch also enables running all libcxx and libcxxabi tests with CET enabled.

[xiongji90]

We have built libc++ tests with CET enabled and ran those tests in a Fedora34 system with CET enabled. No fails found. However, for exception handling tests, we can't run them with llvm unwinder in CET enabled environment, after https://reviews.llvm.org/D105968/new/ is accepted, we can run libc++/libc++abi tests with llvm unwinder in CET enabled environment.

[MaskRay]

Reasonable, but you need a libc++/libc++abi approver.

[MaskRay]

Wait. Can't the user just specify -fcf-protection=full in CMAKE_CXX_FLAGS?

[Mordante]

This patch is used to build libc++ and libc++abi with CET enabled. If developers want to build applications with CET enabled and use libc++ and libc++abi, they must link CET enabled libc++ and libc++abi libraries. We introduce 2 options: LIBCXX_ENABLE_CET and LIBCXXABI_ENABLE_CET to enable CET building. This patch also enables running all libcxx and libcxxabi tests with CET enabled.

I wonder what happens if only one of the two libraries is build with the flag enabled. Will these libraries still be compatible but with CET disabled? Or will they be incompatible?

Is there a risk that this option breaks working code? If so I think it would be good to add a CI job to validate this build. This can be done by modifying run-buildbot and buildkite-pipeline.yml, both in the directory libcxx/utils/ci/.

Note I'm not familiar with libc++abi, so didn't review that part of the changes.

libcxx/CMakeLists.txt

87

This needs more documentation. CET isn't a well known feature. Please also update libcxx/docs/BuildingLibcxx.rst regarding this feature. The comment for this patch already contains a lot of useful information, that I would like to see here.

158

Can you also validate the build is on the x86 platform?
Question regarding x86, do you mean the 32-bit platform or both the 32-bit and 64-bit platform.
To me x86 means only the 32-bit platform.

[ldionne]

In D107560#2932805, @MaskRay wrote:

Wait. Can't the user just specify -fcf-protection=full in CMAKE_CXX_FLAGS?

This.

CET seems like a fairly narrow-use option, and I would rather you use a general option to enable it than add yet another configuration option to libc++. WDYT?

[manojgupta]

In D107560#2932805, @MaskRay wrote:

Wait. Can't the user just specify -fcf-protection=full in CMAKE_CXX_FLAGS?

Is there a way to specify flags for libc++ when building libc++ with llvm/clang.

CET requires all libraries to be built with CET flags. So the use case is to build libraries with CET enabled but not clang itself as the build host may not have CET support. However, this clang binary can still link the instrumented libraries for running on a device with CET support.
Use case example: -DLLVM_ENABLE_PROJECTS="clang;libcxx;libcxxabi;libunwind;compiler-rt". Runtimes build could use it as well to produce runtimes that are CET instrumented.

[xiongji90]

Hi, @Mordante , @ldionne , @manojgupta , @MaskRay
Since "-fcf-protection=full" is a compiling flag for C and CXX sources, I think users can add this flag via CMAKE_CXX_FLAGS. However, adding "-fcf-protection=full" to CMAKE_CXX_FLAGS will enable CET for all components we build.
As @manojgupta mentioned, in order to build application with CET enabled, we need to:

1. compile the application's source code with "-fcf-protection=full"
2. link the .o files generated form 1 with libraries which are CET enabled

We don't require the compiler used to build the application to be CET enabled. If we build libc++, libc++abi with other components such as clang++, lld, ldb...and add "-fcf-protection=full" to CMAKE_CXX_FLAGS, this flag will be used for all components which is not necessary.
Although we can use "-fcf-protection=full" to build all components whose sources don't include any assembly code, it may be not enough to enable CET for those components. For example, I once built clang, lld, lldb with "-fcf-protection=full", most tests passed in CET enable platform but we also had a few runtime errors most of which are related to JIT code. So, before resolving all issues, I think it is not safe to add "-fcf-protection=full" to CMAKE_CXX_FLAGS.
Currently, CET has been fully enabled in GNU toolchain (all tools such as compiler, linker, debugger, all libraries such libgcc, libstdc++...)while llvm toolchain has not. A practical approach is enabling the components one by one, the first step is enabling libc++, libc++abi, libunwind.
If we have a way to pass "-fcf-protection=full" to libc++ CXX flag, I think we can avoid the option LIBCXX_ENABLE_CET here.
Thanks very much.

[xiongji90]

In D107560#2933130, @Mordante wrote:

This patch is used to build libc++ and libc++abi with CET enabled. If developers want to build applications with CET enabled and use libc++ and libc++abi, they must link CET enabled libc++ and libc++abi libraries. We introduce 2 options: LIBCXX_ENABLE_CET and LIBCXXABI_ENABLE_CET to enable CET building. This patch also enables running all libcxx and libcxxabi tests with CET enabled.

I wonder what happens if only one of the two libraries is build with the flag enabled. Will these libraries still be compatible but with CET disabled? Or will they be incompatible?

Hi, @Mordante
Do you mean if we build libc+, libc++abi with CET enabled and use them in a non-CET environment? If so, they can still work. After applying "-fcf-protection=full", "endbr32/64" instruction will be added to the beginning of all functions, the "endbr32/64" instruction will be regarded as "nop" instruction in non-CET environment.
Thanks very much.

libcxx/CMakeLists.txt

87

Hi, @Mordante
Since we have not decided whether we need to add LIBCXX_ENABLE_CET option, it seems better for us to discuss and make final decision about the option firstly, if we finally decide to add this option, I will add some documentation as you required.
Thanks very much.

158

Hi, @Mordante
"Can you also validate the build is on the x86 platform?"

Do you mean we need to check whether we are building the library on a x86 platform?

"Question regarding x86, do you mean the 32-bit platform or both the 32-bit and 64-bit platform."

Sorry for the confusion, I mean both 32-bit and 64-bit platform and I have tested both 32-bit and 64-bit.
Thanks very much.

[Mordante]

In D107560#2938901, @xiongji90 wrote:

In D107560#2933130, @Mordante wrote:

This patch is used to build libc++ and libc++abi with CET enabled. If developers want to build applications with CET enabled and use libc++ and libc++abi, they must link CET enabled libc++ and libc++abi libraries. We introduce 2 options: LIBCXX_ENABLE_CET and LIBCXXABI_ENABLE_CET to enable CET building. This patch also enables running all libcxx and libcxxabi tests with CET enabled.

I wonder what happens if only one of the two libraries is build with the flag enabled. Will these libraries still be compatible but with CET disabled? Or will they be incompatible?

Hi, @Mordante
Do you mean if we build libc+, libc++abi with CET enabled and use them in a non-CET environment? If so, they can still work. After applying "-fcf-protection=full", "endbr32/64" instruction will be added to the beginning of all functions, the "endbr32/64" instruction will be regarded as "nop" instruction in non-CET environment.
Thanks very much.

You've added two flags LIBCXX_ENABLE_CET and LIBCXXABI_ENABLE_CET. I'm more wondering about when the user enables only LIBCXXABI_ENABLE_CET will this work?

So I'm concerned that there are two flags, but it might be required that both have the same value.

libc++ and libc++abi already have their own internal LIBCXX(ABI|)_COMPILE_FLAGS in CMake. So maybe adding a way to set their initial value from CMake would be a more generic approach. This would make it easier for Intel and other vendors to use their own special flags without needing changes to libc++ and libc++abi.

libcxx/CMakeLists.txt

158

libc++ is available on more platforms than x86 and X86-64. So I think we should either warn for all invalid combinations or none. The test target_add_compile_flags_if_supported already validates whether the flag is supported.

[xiongji90]

In D107560#2945032, @Mordante wrote:

In D107560#2938901, @xiongji90 wrote:

In D107560#2933130, @Mordante wrote:

This patch is used to build libc++ and libc++abi with CET enabled. If developers want to build applications with CET enabled and use libc++ and libc++abi, they must link CET enabled libc++ and libc++abi libraries. We introduce 2 options: LIBCXX_ENABLE_CET and LIBCXXABI_ENABLE_CET to enable CET building. This patch also enables running all libcxx and libcxxabi tests with CET enabled.

I wonder what happens if only one of the two libraries is build with the flag enabled. Will these libraries still be compatible but with CET disabled? Or will they be incompatible?

Hi, @Mordante
Do you mean if we build libc+, libc++abi with CET enabled and use them in a non-CET environment? If so, they can still work. After applying "-fcf-protection=full", "endbr32/64" instruction will be added to the beginning of all functions, the "endbr32/64" instruction will be regarded as "nop" instruction in non-CET environment.
Thanks very much.

You've added two flags LIBCXX_ENABLE_CET and LIBCXXABI_ENABLE_CET. I'm more wondering about when the user enables only LIBCXXABI_ENABLE_CET will this work?

So I'm concerned that there are two flags, but it might be required that both have the same value.

Hi, @Mordante
Do you have some scenario that libcxxabi is used alone withouth libcxx? If there is no such scenario, I also agree that LIBCXXABI_ENABLE_CET is unnecessary. Maybe we can do following:

1. Just use LIBCXX_ENABLE_CET in libcxxabi and remove LIBCXXABI_ENABLE_CET
2. We can use such code in libcxxabi CMakeFile "option(LIBCXXABI_ENABLE_CET "Build libc++abi with CET enabled." ${LIBCXX_ENABLE_CET})"

libc++ and libc++abi already have their own internal LIBCXX(ABI|)_COMPILE_FLAGS in CMake. So maybe adding a way to set their initial value from CMake would be a more generic approach. This would make it easier for Intel and other vendors to use their own special flags without needing changes to libc++ and libc++abi.

Do you mean we should add a way to set LIBCXX(ABI)_COMPILE_FLAGS in CMakeFile instead of adding the compiling flag to common CXX flag?

Thanks very much.

libcxx/CMakeLists.txt

158

Hi, @Mordante
Since CET is only implemented in Intel platform, I can check whether the compiler supports "-fcf-protection=full" and report error if it doesn't support.
Thanks very much.

libcxx/CMakeLists.txt

 #===============================================================================
 # Setup CMake Options
 #===============================================================================
 include(CMakeDependentOption)
 include(HandleCompilerRT)
 
 # Basic options ---------------------------------------------------------------
 option(LIBCXX_ENABLE_ASSERTIONS "Enable assertions independent of build mode." OFF)
+option(LIBCXX_ENABLE_CET "Build libc++ with CET enabled." OFF)
 option(LIBCXX_ENABLE_SHARED "Build libc++ as a shared library." ON)
 option(LIBCXX_ENABLE_STATIC "Build libc++ as a static library." ON)
 option(LIBCXX_ENABLE_EXPERIMENTAL_LIBRARY "Build libc++experimental.a" ON)
 set(ENABLE_FILESYSTEM_DEFAULT ON)
 if (WIN32 AND NOT MINGW)
   # Filesystem is buildable for windows, but it requires __int128 helper
   # functions, that currently are provided by libgcc or compiler_rt builtins.
   # These are available in MinGW environments, but not currently in MSVC

 if (LIBCXX_BENCHMARK_NATIVE_STDLIB)
   if (NOT (LIBCXX_BENCHMARK_NATIVE_STDLIB STREQUAL "libc++"
         OR LIBCXX_BENCHMARK_NATIVE_STDLIB STREQUAL "libstdc++"))
     message(FATAL_ERROR "Invalid value for LIBCXX_BENCHMARK_NATIVE_STDLIB: "
             "'${LIBCXX_BENCHMARK_NATIVE_STDLIB}'")
   endif()
 endif()
 
+if (LIBCXX_ENABLE_CET AND MSVC)
+  message(FATAL_ERROR "libc++ CET support is not available for MSVC!")
+endif()
+
 option(LIBCXX_INCLUDE_DOCS "Build the libc++ documentation." ${LLVM_INCLUDE_DOCS})
 set(LIBCXX_LIBDIR_SUFFIX "${LLVM_LIBDIR_SUFFIX}" CACHE STRING
     "Define suffix of library directory name (32/64)")
 option(LIBCXX_INSTALL_HEADERS "Install the libc++ headers." ON)
 option(LIBCXX_INSTALL_LIBRARY "Install the libc++ library." ON)
 cmake_dependent_option(LIBCXX_INSTALL_STATIC_LIBRARY
   "Install the static libc++ library." ON
   "LIBCXX_ENABLE_STATIC;LIBCXX_INSTALL_LIBRARY" OFF)

 # RTTI flags ==================================================================
 function(cxx_add_rtti_flags target)
   if (NOT LIBCXX_ENABLE_RTTI)
     target_add_compile_flags_if_supported(${target} PUBLIC -GR-)
     target_add_compile_flags_if_supported(${target} PUBLIC -fno-rtti)
   endif()
 endfunction()
 
+# CET flags ===================================================================
+function(cxx_add_cet_flags target)
+  if (LIBCXX_ENABLE_CET)
+    target_add_compile_flags_if_supported(${target} PUBLIC -fcf-protection=full)
+  endif()
+endfunction()
+
 # Threading flags =============================================================
 if (LIBCXX_BUILD_EXTERNAL_THREAD_LIBRARY AND LIBCXX_ENABLE_SHARED)
   # Need to allow unresolved symbols if this is to work with shared library builds
   if (APPLE)
     add_link_flags("-undefined dynamic_lookup")
   else()
     # Relax this restriction from HandleLLVMOptions
     string(REPLACE "-Wl,-z,defs" "" CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS}")

 # Setup all common build flags =================================================
 function(cxx_add_common_build_flags target)
   cxx_add_basic_build_flags(${target})
   cxx_add_warning_flags(${target})
   cxx_add_windows_flags(${target})
   cxx_add_exception_flags(${target})
   cxx_add_rtti_flags(${target})
   cxx_add_module_flags(${target})
+  cxx_add_cet_flags(${target})
   cxx_link_system_libraries(${target})
 endfunction()
 
 #===============================================================================
 # Setup Source Code And Tests
 #===============================================================================
 add_subdirectory(include)
 add_subdirectory(src)

libcxx/test/CMakeLists.txt

if(LIBCXX_INCLUDE_TESTS AND LIBCXX_LINK_TESTS_WITH_SHARED_LIBCXX AND NOT LIBCXX_ENABLE_SHARED)
   message(FATAL_ERROR "LIBCXX_LINK_TESTS_WITH_SHARED_LIBCXX being ON requires LIBCXX_ENABLE_SHARED to be ON")
 endif()
 
 if(LIBCXX_INCLUDE_TESTS AND NOT LIBCXX_LINK_TESTS_WITH_SHARED_LIBCXX AND NOT LIBCXX_ENABLE_STATIC)
   message(FATAL_ERROR "LIBCXX_LINK_TESTS_WITH_SHARED_LIBCXX being OFF requires LIBCXX_ENABLE_STATIC to be ON")
 endif()
 
 pythonize_bool(LIBCXX_ENABLE_SHARED)
+pythonize_bool(LIBCXX_ENABLE_CET)
 pythonize_bool(LIBCXX_LINK_TESTS_WITH_SHARED_LIBCXX)
 pythonize_bool(LIBCXX_LINK_TESTS_WITH_SHARED_LIBCXXABI)
 pythonize_bool(LIBCXX_ENABLE_FILESYSTEM)
 pythonize_bool(LIBCXX_BUILD_32_BITS)
 pythonize_bool(LIBCXX_GENERATE_COVERAGE)
 pythonize_bool(LIBCXXABI_ENABLE_SHARED)
 pythonize_bool(LIBCXXABI_USE_LLVM_UNWINDER)
 pythonize_bool(LIBCXX_USE_COMPILER_RT)

libcxx/test/configs/legacy.cfg.in

 config.configuration_variant    = "@LIBCXX_LIT_VARIANT@"
 config.host_triple              = "@LLVM_HOST_TRIPLE@"
 config.sysroot                  = "@LIBCXX_SYSROOT@"
 config.gcc_toolchain            = "@LIBCXX_GCC_TOOLCHAIN@"
 config.generate_coverage        = @LIBCXX_GENERATE_COVERAGE@
 config.target_info              = "@LIBCXX_TARGET_INFO@"
 config.test_linker_flags        = "@LIBCXX_TEST_LINKER_FLAGS@"
 config.test_compiler_flags      = "@LIBCXX_TEST_COMPILER_FLAGS@"
+config.cet_on                   = @LIBCXX_ENABLE_CET@
 
 config.executor                 = "@LIBCXX_EXECUTOR@"
 config.llvm_unwinder            = @LIBCXXABI_USE_LLVM_UNWINDER@
 config.builtins_library         = "@LIBCXX_BUILTINS_LIBRARY@"
 config.has_libatomic            = @LIBCXX_HAS_ATOMIC_LIB@
 config.debug_build              = @LIBCXX_DEBUG_BUILD@
 config.libcxxabi_shared         = @LIBCXX_LINK_TESTS_WITH_SHARED_LIBCXXABI@
 config.cxx_ext_threads          = @LIBCXX_BUILD_EXTERNAL_THREAD_LIBRARY@

libcxx/utils/libcxx/test/config.py

def configure_compile_flags(self):
             self.cxx.compile_flags += ['-D_CRT_STDIO_ISO_WIDE_SPECIFIERS']
             # Required so that tests using min/max don't fail on Windows,
             # and so that those tests don't have to be changed to tolerate
             # this insanity.
             self.cxx.compile_flags += ['-DNOMINMAX']
         additional_flags = self.get_lit_conf('test_compiler_flags')
         if additional_flags:
             self.cxx.compile_flags += shlex.split(additional_flags)
+        if self.get_lit_bool('cet_on'):
+            self.cxx.compile_flags += ['-fcf-protection=full']
 
     def configure_default_compile_flags(self):
         # Configure include paths
         self.configure_compile_flags_header_includes()
         self.target_info.add_cxx_compile_flags(self.cxx.compile_flags)
         self.target_info.add_cxx_flags(self.cxx.flags)
         # Use verbose output for better errors
         self.cxx.flags += ['-v']

libcxxabi/CMakeLists.txt

 include(HandleCompilerRT)
 
 # Define options.
 option(LIBCXXABI_ENABLE_EXCEPTIONS
   "Provide support for exceptions in the runtime.
   When disabled, libc++abi does not support stack unwinding and other exceptions-related features." ON)
 option(LIBCXXABI_ENABLE_ASSERTIONS "Enable assertions independent of build mode." ON)
 option(LIBCXXABI_ENABLE_PEDANTIC "Compile with pedantic enabled." ON)
+option(LIBCXXABI_ENABLE_CET "Build libc++abi with CET enabled." OFF)
 option(LIBCXXABI_ENABLE_WERROR "Fail and stop if a warning is triggered." OFF)
 option(LIBCXXABI_USE_LLVM_UNWINDER "Build and use the LLVM unwinder." OFF)
 option(LIBCXXABI_ENABLE_STATIC_UNWINDER "Statically link the LLVM unwinder." OFF)
 option(LIBCXXABI_USE_COMPILER_RT "Use compiler-rt instead of libgcc" OFF)
 option(LIBCXXABI_ENABLE_THREADS "Build with threads enabled" ON)
 option(LIBCXXABI_HAS_PTHREAD_API "Ignore auto-detection and force use of pthread API" OFF)
 option(LIBCXXABI_HAS_WIN32_THREAD_API "Ignore auto-detection and force use of win32 thread API" OFF)
 option(LIBCXXABI_HAS_EXTERNAL_THREAD_API

 option(LIBCXXABI_SILENT_TERMINATE "Set this to make the terminate handler default to a silent alternative" OFF)
 option(LIBCXXABI_NON_DEMANGLING_TERMINATE "Set this to make the terminate handler
 avoid demangling" OFF)
 
 if (NOT LIBCXXABI_ENABLE_SHARED AND NOT LIBCXXABI_ENABLE_STATIC)
   message(FATAL_ERROR "libc++abi must be built as either a shared or static library.")
 endif()
 
+if (LIBCXXABI_ENABLE_CET AND MSVC)
+   message(FATAL_ERROR "libc++abi CET support is not available for MSVC!")
+endif()
+
 # TODO: This is a workaround for the fact that Standalone builds can't use
 # targets from the other runtimes (so the cxx-headers target doesn't exist).
 set(LIBCXXABI_LIBCXX_INCLUDES "" CACHE PATH
     "Specify path to libc++ includes.")
 if (LIBCXXABI_STANDALONE_BUILD)
   if (NOT IS_DIRECTORY ${LIBCXXABI_LIBCXX_INCLUDES})
     message(FATAL_ERROR
       "LIBCXXABI_LIBCXX_INCLUDES=${LIBCXXABI_LIBCXX_INCLUDES} is not a valid directory. "
if (WIN32 AND LIBCXXABI_ENABLE_STATIC AND NOT LIBCXXABI_ENABLE_SHARED)
   else()
     # Regular static build; disable dllexports.
     add_definitions(-D_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS)
   endif()
 endif()
 
 add_compile_flags_if_supported(-Werror=return-type)
 
+if (LIBCXXABI_ENABLE_CET)
+  add_compile_flags_if_supported(-fcf-protection=full)
+endif()
+
 # Get warning flags
 add_compile_flags_if_supported(-W)
 add_compile_flags_if_supported(-Wall)
 add_compile_flags_if_supported(-Wchar-subscripts)
 add_compile_flags_if_supported(-Wconversion)
 add_compile_flags_if_supported(-Wmismatched-tags)
 add_compile_flags_if_supported(-Wmissing-braces)
 add_compile_flags_if_supported(-Wnewline-eof)

libcxxabi/test/CMakeLists.txt

 if(DEFINED LIBCXX_ENABLE_STATIC
    AND NOT LIBCXXABI_LINK_TESTS_WITH_SHARED_LIBCXX
    AND NOT LIBCXX_ENABLE_STATIC)
   message(FATAL_ERROR "LIBCXXABI_LINK_TESTS_WITH_SHARED_LIBCXX being OFF requires LIBCXX_ENABLE_STATIC to be ON")
 endif()
 
 pythonize_bool(LIBCXXABI_BUILD_32_BITS)
 pythonize_bool(LIBCXX_ENABLE_SHARED)
+pythonize_bool(LIBCXXABI_ENABLE_CET)
 pythonize_bool(LIBCXXABI_ENABLE_SHARED)
 pythonize_bool(LIBCXXABI_ENABLE_THREADS)
 pythonize_bool(LIBCXXABI_USE_LLVM_UNWINDER)
 pythonize_bool(LIBCXXABI_USE_COMPILER_RT)
 pythonize_bool(LIBCXXABI_BUILD_EXTERNAL_THREAD_LIBRARY)
 pythonize_bool(LIBCXX_ENABLE_PARALLEL_ALGORITHMS)
 pythonize_bool(LIBCXXABI_LINK_TESTS_WITH_SHARED_LIBCXX)
 pythonize_bool(LIBCXXABI_LINK_TESTS_WITH_SHARED_LIBCXXABI)

libcxxabi/test/libcxxabi/test/config.py

def configure_compile_flags(self):
             '-DLIBCXXABI_NO_TIMER',
             '-D_LIBCPP_ENABLE_CXX17_REMOVED_UNEXPECTED_FUNCTIONS',
         ]
         if self.get_lit_bool('enable_exceptions', True):
             self.cxx.compile_flags += ['-funwind-tables']
         if not self.get_lit_bool('enable_threads', True):
             self.cxx.compile_flags += ['-D_LIBCXXABI_HAS_NO_THREADS']
             self.config.available_features.add('libcxxabi-no-threads')
+        if self.get_lit_bool('cet_on', False):
+            self.cxx.compile_flags += ['-fcf-protection=full']
         super(Configuration, self).configure_compile_flags()
 
     def configure_compile_flags_header_includes(self):
         cxx_headers = self.get_lit_conf('cxx_headers', None) or \
             os.path.join(self.libcxxabi_hdr_root, 'include', 'c++', 'v1')
         if cxx_headers == '':
             self.lit_config.note('using the systems c++ headers')
         else:

libcxxabi/test/lit.site.cfg.in

 config.target_info              = "@LIBCXXABI_TARGET_INFO@"
 config.executor                 = "@LIBCXXABI_EXECUTOR@"
 config.libcxxabi_shared         = @LIBCXXABI_LINK_TESTS_WITH_SHARED_LIBCXXABI@
 config.enable_shared            = @LIBCXXABI_LINK_TESTS_WITH_SHARED_LIBCXX@
 config.host_triple              = "@LLVM_HOST_TRIPLE@"
 config.sysroot                  = "@LIBCXXABI_SYSROOT@"
 config.gcc_toolchain            = "@LIBCXXABI_GCC_TOOLCHAIN@"
 config.cxx_ext_threads          = @LIBCXXABI_BUILD_EXTERNAL_THREAD_LIBRARY@
+config.cet_on                   = @LIBCXXABI_ENABLE_CET@
 
 config.pstl_src_root            = "@ParallelSTL_SOURCE_DIR@" if @LIBCXX_ENABLE_PARALLEL_ALGORITHMS@ else None
 config.pstl_obj_root            = "@ParallelSTL_BINARY_DIR@" if @LIBCXX_ENABLE_PARALLEL_ALGORITHMS@ else None
 
 # Code signing
 config.llvm_codesign_identity   = "@LLVM_CODESIGNING_IDENTITY@"
 
 site.addsitedir(os.path.join(config.libcxxabi_src_root, 'test'))