Read .note.gnu.property sections and emit a merged .note.gnu.property section.

[ruiu]

Summary

This patch also adds --requires-cet option for the sake of testing.
The actual feature for IBT-aware PLT is not included in this patch.

This is a part of https://reviews.llvm.org/D59780. Submitting this
first should make it easy to work with a related change
(https://reviews.llvm.org/D62609).

[peter.smith]

Thanks very much for extracting the .note.gnu.property parsing code. There was one modification I'd made in D62609 that permitted multiple GNU_PROPERTY_X86_FEATURE_1_AND properties in the same .note.gnu.property section as this was observed in the ld.bfd testsuite. I'll submit a patch with just these modifications in.

One thing to mention here is that we may want to give a warning that IBT support is not implemented yet as this could result in a output that would fault (claims support via GNU_PROPERTY_X86_FEATURE_1_IBT) should anyone try to use it.

[peter.smith]

In D62853#1529359, @peter.smith wrote:

Thanks very much for extracting the .note.gnu.property parsing code. There was one modification I'd made in D62609 that permitted multiple GNU_PROPERTY_X86_FEATURE_1_AND properties in the same .note.gnu.property section as this was observed in the ld.bfd testsuite. I'll submit a patch with just these modifications in.

I've created D62862 which is independent of X86/AArch64.

[emaste]

I've created D62862 which is independent of X86/AArch64.

D62862 is x86-specific right now?

[peter.smith]

In D62853#1529462, @emaste wrote:

I've created D62862 which is independent of X86/AArch64.

D62862 is x86-specific right now?

Apologies I should have been clearer. The change in D62862 just permits more than one GNU_PROPERTY_X86_FEATURE_1_AND to be read which is actually X86 specific. I'm rebasing D62609 on top of this and D62862 which will add AArch64 support.

[MaskRay]

This patch also adds --requires-cet option for the sake of testing.

Typo, --require-cet?

lld/ELF/Config.h

 };
 
 // This struct contains the global configuration for the linker.
 // Most fields are direct mapping from the command line options
 // and such fields have the same name as the corresponding options.
 // Most fields are initialized by the driver.
 struct Configuration {
   uint8_t OSABI = 0;
+  uint32_t AndFeatures = 0;
   llvm::CachePruningPolicy ThinLTOCachePolicy;
   llvm::StringMap<uint64_t> SectionStartMap;
   llvm::StringRef Chroot;
   llvm::StringRef DynamicLinker;
   llvm::StringRef DwoDir;
   llvm::StringRef Entry;
   llvm::StringRef Emulation;
   llvm::StringRef Fini;
struct Configuration {
   bool EhFrameHdr;
   bool EmitLLVM;
   bool EmitRelocs;
   bool EnableNewDtags;
   bool ExecuteOnly;
   bool ExportDynamic;
   bool FixCortexA53Errata843419;
   bool FormatBinary = false;
+  bool RequireCET;
   bool GcSections;
   bool GdbIndex;
   bool GnuHash = false;
   bool GnuUnique;
   bool HasDynamicList = false;
   bool HasDynSymTab;
   bool IgnoreDataAddressEquality;
   bool IgnoreFunctionAddressEquality;

lld/ELF/Driver.cpp

static void checkOptions() {
 
   if (Config->ExecuteOnly) {
     if (Config->EMachine != EM_AARCH64)
       error("-execute-only is only supported on AArch64 targets");
 
     if (Config->SingleRoRx && !Script->HasSectionsCommand)
       error("-execute-only and -no-rosegment cannot be used together");
   }
+
+  if (Config->ZRetpolineplt && Config->RequireCET)
+    error("--require-cet may not be used with -z retpolineplt");
 }
 
 static const char *getReproduceOption(opt::InputArgList &Args) {
   if (auto *Arg = Args.getLastArg(OPT_reproduce))
     return Arg->getValue();
   return getenv("LLD_REPRODUCE");
 }
 
static void readConfigs(opt::InputArgList &Args) {
   Config->Entry = Args.getLastArgValue(OPT_entry);
   Config->ExecuteOnly =
       Args.hasFlag(OPT_execute_only, OPT_no_execute_only, false);
   Config->ExportDynamic =
       Args.hasFlag(OPT_export_dynamic, OPT_no_export_dynamic, false);
   Config->FilterList = args::getStrings(Args, OPT_filter);
   Config->Fini = Args.getLastArgValue(OPT_fini, "_fini");
   Config->FixCortexA53Errata843419 = Args.hasArg(OPT_fix_cortex_a53_843419);
+  Config->RequireCET = Args.hasArg(OPT_require_cet);
   Config->GcSections = Args.hasFlag(OPT_gc_sections, OPT_no_gc_sections, false);
   Config->GnuUnique = Args.hasFlag(OPT_gnu_unique, OPT_no_gnu_unique, true);
   Config->GdbIndex = Args.hasFlag(OPT_gdb_index, OPT_no_gdb_index, false);
   Config->ICF = getICF(Args);
   Config->IgnoreDataAddressEquality =
       Args.hasArg(OPT_ignore_data_address_equality);
   Config->IgnoreFunctionAddressEquality =
       Args.hasArg(OPT_ignore_function_address_equality);
for (size_t I = 0, E = Syms.size(); I != E; ++I)
         Syms[I] = S;
   });
 
   // Update pointers in the symbol table.
   for (const WrappedSymbol &W : Wrapped)
     Symtab->wrap(W.Sym, W.Real, W.Wrap);
 }
 
+// To enable CET (x86's hardware-assited control flow enforcement), each
+// source file must be compiled with -fcf-protection. Object files compiled
+// with the flag contain feature flags indicating that they are compatible
+// with CET. We enable the feature only when all object files are compatible
+// with CET.
+//
+// This function returns the merged feature flags. If 0, we cannot enable CET.
+//
+// Note that the CET-aware PLT is not implemented yet. We do error
+// check only.
+template <class ELFT> static uint32_t getAndFeatures() {
+  if (Config->EMachine != EM_386 && Config->EMachine != EM_X86_64)
+    return 0;
+
+  uint32_t Ret = -1;
+  for (InputFile *F : ObjectFiles) {
+    uint32_t Features = cast<ObjFile<ELFT>>(F)->AndFeatures;
+    if (!Features && Config->RequireCET)
+      error(toString(F) + ": --require-cet: file is not compatible with CET");
+    Ret &= Features;
+  }
+  return Ret;
+}
+
 static const char *LibcallRoutineNames[] = {
 #define HANDLE_LIBCALL(code, name) name,
 #include "llvm/IR/RuntimeLibcalls.def"
 #undef HANDLE_LIBCALL
 };
 
 // Do actual linking. Note that when this function is called,
 // all linker scripts have already been parsed.
llvm::erase_if(InputSections, [](InputSectionBase *S) {
     }
 
     // We do not want to emit debug sections if --strip-all
     // or -strip-debug are given.
     return Config->Strip != StripPolicy::None &&
            (S->Name.startswith(".debug") || S->Name.startswith(".zdebug"));
   });
 
+  // Read .note.gnu.property sections from input object files which
+  // contain a hint to tweak linker's and loader's behaviors.
+  Config->AndFeatures = getAndFeatures<ELFT>();
+
   Config->EFlags = Target->calcEFlags();
   // MaxPageSize (sometimes called abi page size) is the maximum page size that
   // the output can be run on. For example if the OS can use 4k or 64k page
   // sizes then MaxPageSize must be 64 for the output to be useable on both.
   // All important alignment decisions must use this value.
   Config->MaxPageSize = getMaxPageSize(Args);
   // CommonPageSize is the most common page size that the output will be run on.
   // For example if an OS can use 4k or 64k page sizes and 4k is more common

lld/ELF/InputFiles.h

public:
   llvm::Optional<llvm::DILineInfo> getDILineInfo(InputSectionBase *, uint64_t);
   llvm::Optional<std::pair<std::string, unsigned>> getVariableLoc(StringRef Name);
 
   // MIPS GP0 value defined by this file. This value represents the gp value
   // used to create the relocatable object and required to support
   // R_MIPS_GPREL16 / R_MIPS_GPREL32 relocations.
   uint32_t MipsGp0 = 0;
 
+  uint32_t AndFeatures = 0;
+
   // Name of source file obtained from STT_FILE symbol value,
   // or empty string if there is no such symbol in object file
   // symbol table.
   StringRef SourceFile;
 
   // True if the file defines functions compiled with
   // -fsplit-stack. Usually false.
   bool SplitStack = false;

lld/ELF/InputFiles.cpp

 #include "llvm/DebugInfo/DWARF/DWARFContext.h"
 #include "llvm/IR/LLVMContext.h"
 #include "llvm/IR/Module.h"
 #include "llvm/LTO/LTO.h"
 #include "llvm/MC/StringTableBuilder.h"
 #include "llvm/Object/ELFObjectFile.h"
 #include "llvm/Support/ARMAttributeParser.h"
 #include "llvm/Support/ARMBuildAttributes.h"
+#include "llvm/Support/Endian.h"
 #include "llvm/Support/Path.h"
 #include "llvm/Support/TarWriter.h"
 #include "llvm/Support/raw_ostream.h"
 
 using namespace llvm;
 using namespace llvm::ELF;
 using namespace llvm::object;
 using namespace llvm::sys;
 using namespace llvm::sys::fs;
+using namespace llvm::support::endian;
 
 using namespace lld;
 using namespace lld::elf;
 
 bool InputFile::IsInGroup;
 uint32_t InputFile::NextGroupId;
 std::vector<BinaryFile *> elf::BinaryFiles;
 std::vector<BitcodeFile *> elf::BitcodeFiles;
default:
     if (Arch != ARMBuildAttrs::v6_M && Arch != ARMBuildAttrs::v6S_M)
       // All Architectures used in Cortex processors with the exception
       // of v6-M and v6S-M have the MOVT and MOVW instructions.
       Config->ARMHasMovtMovw = true;
     break;
   }
 }
 
+// If a source file is compiled with x86 hardware-assisted call flow control
+// enabled, the generated object file contains feature flags indicating that
+// fact. This function reads the feature flags and returns it.
+//
+// Essentially we want to read a single 32-bit value in this function, but this
+// function is rather complicated because the value is buried deep inside a
+// .note.gnu.property section.
+//
+// The section consists of one or more NOTE records. Each NOTE record consists
+// of zero or more type-length-value fields. We want to find a field of a
+// certain type. It seems a bit too much to just store a 32-bit value, perhaps
+// the ABI is unnecessarily complicated.
+template <class ELFT>
+static uint32_t readAndFeatures(ObjFile<ELFT> *Obj, ArrayRef<uint8_t> Data) {
+  using Elf_Nhdr = typename ELFT::Nhdr;
+  using Elf_Note = typename ELFT::Note;
+
+  while (!Data.empty()) {
+    // Read one NOTE record.
+    if (Data.size() < sizeof(Elf_Nhdr))
+      fatal(toString(Obj) + ": .note.gnu.property: section too short");
+
+    auto *Nhdr = reinterpret_cast<const Elf_Nhdr *>(Data.data());
+    if (Data.size() < Nhdr->getSize())
+      fatal(toString(Obj) + ": .note.gnu.property: section too short");
+
+    Elf_Note Note(*Nhdr);
+    if (Nhdr->n_type != NT_GNU_PROPERTY_TYPE_0 || Note.getName() != "GNU") {
+      Data = Data.slice(Nhdr->getSize());
+      continue;
+    }
+
+    // Read a body of a NOTE record, which consists of type-length-value fields.
+    ArrayRef<uint8_t> Desc = Note.getDesc();
+    while (!Desc.empty()) {
+      if (Desc.size() < 8)
+        fatal(toString(Obj) + ": .note.gnu.property: section too short");
+
+      uint32_t Type = read32le(Desc.data());
+      uint32_t Size = read32le(Desc.data() + 4);
+
+      if (Type == GNU_PROPERTY_X86_FEATURE_1_AND) {
+        // We found the field.
+        return read32le(Desc.data() + 8);
+      }
+
+      // On 64-bit, a payload may be followed by a 4-byte padding to make its
+      // size a multiple of 8.
+      if (ELFT::Is64Bits)
+        Size = alignTo(Size, 8);
+
+      Desc = Desc.slice(Size + 8); // +8 for Type and Size
+    }
+
+    // Go to next NOTE record if a note section didn't contain
+    // X86_FEATURES_1_AND description.
+    Data = Data.slice(Nhdr->getSize());
+  }
+
+  return 0;
+}
+
 template <class ELFT>
 InputSectionBase *ObjFile<ELFT>::getRelocTarget(const Elf_Shdr &Sec) {
   uint32_t Idx = Sec.sh_info;
   if (Idx >= this->Sections.size())
     fatal(toString(this) + ": invalid relocated section index: " + Twine(Idx));
   InputSectionBase *Target = this->Sections[Idx];
 
   // Strictly speaking, a relocation section must be included in the
InputSectionBase *ObjFile<ELFT>::createInputSection(const Elf_Shdr &Sec) {
   // reasons. Failure to do so may result in a serious security issue.
   // Therefore, we make LLD always add PT_GNU_STACK unless it is
   // explicitly told to do otherwise (by -z execstack). Because the stack
   // executable-ness is controlled solely by command line options,
   // .note.GNU-stack sections are simply ignored.
   if (Name == ".note.GNU-stack")
     return &InputSection::Discarded;
 
+  // If an object file is compatible with Intel Control-Flow Enforcement
+  // Technology (CET), it has a .note.gnu.property section containing the
+  // GNU_PROPERTY_X86_FEATURE_1_IBT flag. Read a bitmap containing the flag.
+  //
+  // Since we merge bitmaps from multiple object files to create a new
+  // .note.gnu.property containing a single AND'ed bitmap, we discard an input
+  // file's .note.gnu.property section.
+  if (Name == ".note.gnu.property") {
+    ArrayRef<uint8_t> Contents = check(this->getObj().getSectionContents(&Sec));
+    this->AndFeatures = readAndFeatures(this, Contents);
+    return &InputSection::Discarded;
+  }
+
   // Split stacks is a feature to support a discontiguous stack,
   // commonly used in the programming language Go. For the details,
   // see https://gcc.gnu.org/wiki/SplitStacks. An object file compiled
   // for split stack will include a .note.GNU-split-stack section.
   if (Name == ".note.GNU-split-stack") {
     if (Config->Relocatable) {
       error("cannot mix split-stack and non-split-stack in a relocatable link");
       return &InputSection::Discarded;

lld/ELF/Options.td

 
 defm filter: Eq<"filter", "Set DT_FILTER field to the specified name">;
 
 defm fini: Eq<"fini", "Specify a finalizer function">, MetaVarName<"<symbol>">;
 
 def fix_cortex_a53_843419: F<"fix-cortex-a53-843419">,
   HelpText<"Apply fixes for AArch64 Cortex-A53 erratum 843419">;
 
+// This option is intentionally hidden from the user as the implementation
+// is not complete.
+def require_cet: F<"require-cet">;
+
 defm format: Eq<"format", "Change the input format of the inputs following this option">,
   MetaVarName<"[default,elf,binary]">;
 
 defm gc_sections: B<"gc-sections",
     "Enable garbage collection of unused sections",
     "Disable garbage collection of unused sections (default)">;
 
 defm gdb_index: B<"gdb-index",

lld/ELF/SyntheticSections.h

 class GnuStackSection : public SyntheticSection {
 public:
   GnuStackSection()
       : SyntheticSection(0, llvm::ELF::SHT_PROGBITS, 1, ".note.GNU-stack") {}
   void writeTo(uint8_t *Buf) override {}
   size_t getSize() const override { return 0; }
 };
 
+class GnuPropertySection : public SyntheticSection {
+public:
+  GnuPropertySection();
+  void writeTo(uint8_t *Buf) override;
+  size_t getSize() const override;
+};
+
 // .note.gnu.build-id section.
 class BuildIdSection : public SyntheticSection {
   // First 16 bytes are a header.
   static const unsigned HeaderSize = 16;
 
 public:
   const size_t HashSize;
   BuildIdSection();

lld/ELF/SyntheticSections.cpp

case BuildIdKind::Sha1:
     return 20;
   case BuildIdKind::Hexstring:
     return Config->BuildIdVector.size();
   default:
     llvm_unreachable("unknown BuildIdKind");
   }
 }
 
+// This class represents a linker-synthesized .note.gnu.property section.
+//
+// In x86, object files may contain feature flags indicating the features that
+// they are using. The flags are stored in a .note.gnu.property section.
+//
+// lld reads the sections from input files and merges them by computing AND of
+// the flags. The result is written as a new .note.gnu.property section.
+//
+// If the flag is zero (which indicates that the intersection of the feature
+// sets is empty, or some input files didn't have .note.gnu.property sections),
+// we don't create this section.
+GnuPropertySection::GnuPropertySection()
+    : SyntheticSection(llvm::ELF::SHF_ALLOC, llvm::ELF::SHT_NOTE, 4,
+                       ".note.gnu.property") {}
+
+void GnuPropertySection::writeTo(uint8_t *Buf) {
+  write32(Buf, 4);                                   // Name size
+  write32(Buf + 4, Config->Is64 ? 16 : 12);          // Content size
+  write32(Buf + 8, NT_GNU_PROPERTY_TYPE_0);          // Type
+  memcpy(Buf + 12, "GNU", 4);                        // Name string
+  write32(Buf + 16, GNU_PROPERTY_X86_FEATURE_1_AND); // Feature type
+  write32(Buf + 20, 4);                              // Feature size
+  write32(Buf + 24, Config->AndFeatures);            // Feature flags
+  if (Config->Is64)
+    write32(Buf + 28, 0); // Padding
+}
+
+size_t GnuPropertySection::getSize() const { return Config->Is64 ? 32 : 28; }
+
 BuildIdSection::BuildIdSection()
     : SyntheticSection(SHF_ALLOC, SHT_NOTE, 4, ".note.gnu.build-id"),
       HashSize(getHashSize()) {}
 
 void BuildIdSection::writeTo(uint8_t *Buf) {
   write32(Buf, 4);                      // Name size
   write32(Buf + 4, HashSize);           // Content size
   write32(Buf + 8, NT_GNU_BUILD_ID);    // Type

lld/ELF/Writer.cpp

In.RelaIplt = make<RelocationSection<ELFT>>(
       false /*Sort*/);
   Add(In.RelaIplt);
 
   In.Plt = make<PltSection>(false);
   Add(In.Plt);
   In.Iplt = make<PltSection>(true);
   Add(In.Iplt);
 
+  if (Config->AndFeatures)
+    Add(make<GnuPropertySection>());
+
   // .note.GNU-stack is always added when we are creating a re-linkable
   // object file. Other linkers are using the presence of this marker
   // section to control the executable-ness of the stack area, but that
   // is irrelevant these days. Stack area should always be non-executable
   // by default. So we emit this section unconditionally.
   if (Config->Relocatable)
     Add(make<GnuStackSection>());
 

lld/test/ELF/Inputs/i386-cet1.s

+.section ".note.gnu.property", "a"
+.align 4
+.long 4
+.long 12
+.long 5
+.asciz "GNU"
+
+.long 0xc0000002
+.long 4
+.long 3
+
+.text
+.globl func2
+.type func2,@function
+func2:
+  ret

lld/test/ELF/Inputs/i386-cet2.s

+.section ".note.gnu.property", "a"
+.align 4
+.long 4
+.long 24
+.long 5
+.asciz "GNU"
+
+.long 0xc0000000
+.long 4
+.long 0
+
+.long 0xc0000002
+.long 4
+.long 3
+
+.text
+.globl func2
+.type func2,@function
+func2:
+  ret

lld/test/ELF/Inputs/i386-cet3.s

+.text
+.globl func2
+.type func2,@function
+func2:
+  ret

lld/test/ELF/Inputs/i386-cet4.s

+.section ".note.gnu.property", "a"
+.align 4
+.long 4
+.long 12
+.long 5
+.asciz "GNU"
+
+.long 0xc0000002
+.long 4
+.long 0xfffffffd
+
+.text
+.globl func2
+.type func2,@function
+func2:
+  ret

lld/test/ELF/Inputs/x86-64-cet1.s

+.section ".note.gnu.property", "a"
+.align 4
+.long 4
+.long 16
+.long 5
+.asciz "GNU"
+
+.long 0xc0000002
+.long 4
+.long 3
+.long 0
+
+.text
+.globl func2
+.type func2,@function
+func2:
+  ret

lld/test/ELF/Inputs/x86-64-cet2.s

+.section ".note.gnu.property", "a"
+.align 4
+.long 4
+.long 32
+.long 5
+.asciz "GNU"
+
+.long 0xc0000000
+.long 4
+.long 0
+.long 0
+
+.long 0xc0000002
+.long 4
+.long 3
+.long 0
+
+.text
+.globl func2
+.type func2,@function
+func2:
+  ret

lld/test/ELF/Inputs/x86-64-cet3.s

+.text
+.globl func2
+.type func2,@function
+func2:
+  ret

lld/test/ELF/Inputs/x86-64-cet4.s

+.section ".note.gnu.property", "a"
+.align 4
+.long 4
+.long 16
+.long 5
+.asciz "GNU"
+
+.long 0xc0000002
+.long 4
+.long 0xfffffffd
+.long 0
+
+.text
+.globl func2
+.type func2,@function
+func2:
+  ret

lld/test/ELF/i386-cet.s

+# REQUIRES: x86
+# RUN: llvm-mc -filetype=obj -triple=i386-unknown-linux %s -o %t.o
+# RUN: llvm-mc -filetype=obj -triple=i386-unknown-linux %p/Inputs/i386-cet1.s -o %t1.o
+# RUN: llvm-mc -filetype=obj -triple=i386-unknown-linux %p/Inputs/i386-cet2.s -o %t2.o
+# RUN: llvm-mc -filetype=obj -triple=i386-unknown-linux %p/Inputs/i386-cet3.s -o %t3.o
+# RUN: llvm-mc -filetype=obj -triple=i386-unknown-linux %p/Inputs/i386-cet4.s -o %t4.o
+
+# RUN: ld.lld -e func1 %t.o %t1.o -o %t
+# RUN: llvm-readelf -n %t | FileCheck -check-prefix=CET -match-full-lines %s
+
+# RUN: ld.lld -e func1 %t.o %t2.o -o %t
+# RUN: llvm-readelf -n %t | FileCheck -check-prefix=CET -match-full-lines %s
+
+# CET: Properties: x86 feature: IBT, SHSTK
+
+# RUN: ld.lld -e func1 %t.o %t3.o -o %t
+# RUN: llvm-readelf -S %t | FileCheck -check-prefix=NOCET %s
+
+# NOCET:     Section Headers
+# NOCET-NOT: .note.gnu.property
+
+# RUN: not ld.lld -e func1 %t.o %t3.o -o %t --require-cet 2>&1 \
+# RUN:   | FileCheck -check-prefix=ERROR %s
+# ERROR: i386-cet.s.tmp3.o: --require-cet: file is not compatible with CET
+
+# RUN: ld.lld -e func1 %t.o %t4.o -o %t
+# RUN: llvm-readelf -n %t | FileCheck -check-prefix=NOSHSTK -match-full-lines %s
+
+# Check .note.gnu.protery without property SHSTK.
+# NOSHSTK: Properties: x86 feature: IBT
+
+.section ".note.gnu.property", "a"
+.long 4
+.long 0x10
+.long 0x5
+.asciz "GNU"
+
+.long 0xc0000002
+.long 4
+.long 3
+.long 0
+
+.text
+.globl func1
+.type func1,@function
+func1:
+  call func2
+  ret

lld/test/ELF/x86-64-cet.s

+# REQUIRES: x86
+# RUN: llvm-mc -filetype=obj -triple=x86_64-unknown-linux %s -o %t.o
+# RUN: llvm-mc -filetype=obj -triple=x86_64-unknown-linux %p/Inputs/x86-64-cet1.s -o %t1.o
+# RUN: llvm-mc -filetype=obj -triple=x86_64-unknown-linux %p/Inputs/x86-64-cet2.s -o %t2.o
+# RUN: llvm-mc -filetype=obj -triple=x86_64-unknown-linux %p/Inputs/x86-64-cet3.s -o %t3.o
+# RUN: llvm-mc -filetype=obj -triple=x86_64-unknown-linux %p/Inputs/x86-64-cet4.s -o %t4.o
+
+# RUN: ld.lld -e func1 %t.o %t1.o -o %t
+# RUN: llvm-readelf -n %t | FileCheck -check-prefix=CET -match-full-lines %s
+
+# RUN: ld.lld -e func1 %t.o %t2.o -o %t
+# RUN: llvm-readelf -n %t | FileCheck -check-prefix=CET -match-full-lines %s
+
+# CET: Properties: x86 feature: IBT, SHSTK
+
+# RUN: ld.lld -e func1 %t.o %t3.o -o %t
+# RUN: llvm-readelf -S %t | FileCheck -check-prefix=NOCET %s
+
+# NOCET:     Section Headers
+# NOCET-NOT: .note.gnu.property
+
+# RUN: not ld.lld -e func1 %t.o %t3.o -o %t --require-cet 2>&1 \
+# RUN:   | FileCheck -check-prefix=ERROR %s
+# ERROR: x86-64-cet.s.tmp3.o: --require-cet: file is not compatible with CET
+
+# RUN: ld.lld -e func1 %t.o %t4.o -o %t
+# RUN: llvm-readelf -n %t | FileCheck -check-prefix=NOSHSTK -match-full-lines %s
+
+# Check .note.gnu.protery without property SHSTK.
+# NOSHSTK: Properties: x86 feature: IBT
+
+.section ".note.gnu.property", "a"
+.long 4
+.long 0x10
+.long 0x5
+.asciz "GNU"
+
+.long 0xc0000002
+.long 4
+.long 3
+.long 0
+
+.text
+.globl func1
+.type func1,@function
+func1:
+  call func2
+  ret

llvm/include/llvm/Object/ELFTypes.h

 template <class ELFT>
 class Elf_Note_Impl {
   LLVM_ELF_IMPORT_TYPES_ELFT(ELFT)
 
   const Elf_Nhdr_Impl<ELFT> &Nhdr;
 
   template <class NoteIteratorELFT> friend class Elf_Note_Iterator_Impl;
 
+public:
   Elf_Note_Impl(const Elf_Nhdr_Impl<ELFT> &Nhdr) : Nhdr(Nhdr) {}
 
-public:
   /// Get the note's name, excluding the terminating null byte.
   StringRef getName() const {
     if (!Nhdr.n_namesz)
       return StringRef();
     return StringRef(reinterpret_cast<const char *>(&Nhdr) + sizeof(Nhdr),
                      Nhdr.n_namesz - 1);
   }