[ELF][AArch64] Rename --force-bti to -z force-bti and --pac-plt to -z pac-plt

[MaskRay]

Summary

The original design used --foo but the upstream complained that ELF only
options should be -z foo. See https://sourceware.org/ml/binutils/2019-04/msg00151.html
https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=8bf6d176b0a442a8091d338d4af971591d19922c
made the rename.

Our --force-bti and --pac-plt implement the same functionality, so it
seems wise to be consistent with GNU ld.

[grimar]

I'd add to the link to the description https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=8bf6d176b0a442a8091d338d4af971591d19922c

It looks like they also just removed the option and added a new -z option, like this patch does. To this LG to me, but lets wait for other opinions too.

[peter.smith]

Looks good to me.

To my knowledge there is only a small amount of people using this option doing early software work in preparation for the hardware. I think that as long as I warn them this is coming then this should be fine.

[MaskRay]

Add more information about the rename and our rationale to switch

lld/ELF/Driver.cpp

if (config->singleRoRx && !script->hasSectionsCommand)
       error("-execute-only and -no-rosegment cannot be used together");
   }
 
   if (config->zRetpolineplt && config->requireCET)
     error("--require-cet may not be used with -z retpolineplt");
 
   if (config->emachine != EM_AARCH64) {
     if (config->pacPlt)
-      error("--pac-plt only supported on AArch64");
+      error("-z pac-plt only supported on AArch64");
     if (config->forceBTI)
-      error("--force-bti only supported on AArch64");
+      error("-z force-bti only supported on AArch64");
   }
 }
 
 static const char *getReproduceOption(opt::InputArgList &args) {
   if (auto *arg = args.getLastArg(OPT_reproduce))
     return arg->getValue();
   return getenv("LLD_REPRODUCE");
 }
if (StringRef("nognustack") == arg->getValue())
       return GnuStackKind::None;
   }
 
   return GnuStackKind::NoExec;
 }
 
 static bool isKnownZFlag(StringRef s) {
   return s == "combreloc" || s == "copyreloc" || s == "defs" ||
-         s == "execstack" || s == "global" || s == "hazardplt" ||
-         s == "ifunc-noplt" || s == "initfirst" || s == "interpose" ||
-         s == "keep-text-section-prefix" || s == "lazy" || s == "muldefs" ||
-         s == "separate-code" || s == "separate-loadable-segments" ||
-         s == "nocombreloc" || s == "nocopyreloc" || s == "nodefaultlib" ||
-         s == "nodelete" || s == "nodlopen" || s == "noexecstack" ||
-         s == "nognustack" ||
+         s == "execstack" || s == "force-bti" || s == "global" ||
+         s == "hazardplt" || s == "ifunc-noplt" || s == "initfirst" ||
+         s == "interpose" || s == "keep-text-section-prefix" || s == "lazy" ||
+         s == "muldefs" || s == "separate-code" ||
+         s == "separate-loadable-segments" || s == "nocombreloc" ||
+         s == "nocopyreloc" || s == "nodefaultlib" || s == "nodelete" ||
+         s == "nodlopen" || s == "noexecstack" || s == "nognustack" ||
          s == "nokeep-text-section-prefix" || s == "norelro" ||
          s == "noseparate-code" || s == "notext" || s == "now" ||
-         s == "origin" || s == "relro" || s == "retpolineplt" ||
-         s == "rodynamic" || s == "text" || s == "undefs" || s == "wxneeded" ||
+         s == "origin" || s == "pac-plt" || s == "relro" ||
+         s == "retpolineplt" || s == "rodynamic" || s == "text" ||
+         s == "undefs" || s == "wxneeded" ||
          s.startswith("common-page-size=") || s.startswith("max-page-size=") ||
          s.startswith("stack-size=");
 }
 
 // Report an error for an unknown -z option.
 static void checkZOptions(opt::InputArgList &args) {
   for (auto *arg : args.filtered(OPT_z))
     if (!isKnownZFlag(arg->getValue()))
static void readConfigs(opt::InputArgList &args) {
   config->executeOnly =
       args.hasFlag(OPT_execute_only, OPT_no_execute_only, false);
   config->exportDynamic =
       args.hasFlag(OPT_export_dynamic, OPT_no_export_dynamic, false);
   config->filterList = args::getStrings(args, OPT_filter);
   config->fini = args.getLastArgValue(OPT_fini, "_fini");
   config->fixCortexA53Errata843419 = args.hasArg(OPT_fix_cortex_a53_843419);
   config->fixCortexA8 = args.hasArg(OPT_fix_cortex_a8);
-  config->forceBTI = args.hasArg(OPT_force_bti);
+  config->forceBTI = hasZOption(args, "force-bti");
   config->requireCET = args.hasArg(OPT_require_cet);
   config->gcSections = args.hasFlag(OPT_gc_sections, OPT_no_gc_sections, false);
   config->gnuUnique = args.hasFlag(OPT_gnu_unique, OPT_no_gnu_unique, true);
   config->gdbIndex = args.hasFlag(OPT_gdb_index, OPT_no_gdb_index, false);
   config->icf = getICF(args);
   config->ignoreDataAddressEquality =
       args.hasArg(OPT_ignore_data_address_equality);
   config->ignoreFunctionAddressEquality =
static void readConfigs(opt::InputArgList &args) {
   config->omagic = args.hasFlag(OPT_omagic, OPT_no_omagic, false);
   config->optRemarksFilename = args.getLastArgValue(OPT_opt_remarks_filename);
   config->optRemarksPasses = args.getLastArgValue(OPT_opt_remarks_passes);
   config->optRemarksWithHotness = args.hasArg(OPT_opt_remarks_with_hotness);
   config->optRemarksFormat = args.getLastArgValue(OPT_opt_remarks_format);
   config->optimize = args::getInteger(args, OPT_O, 1);
   config->orphanHandling = getOrphanHandling(args);
   config->outputFile = args.getLastArgValue(OPT_o);
-  config->pacPlt = args.hasArg(OPT_pac_plt);
+  config->pacPlt = hasZOption(args, "pac-plt");
   config->pie = args.hasFlag(OPT_pie, OPT_no_pie, false);
   config->printIcfSections =
       args.hasFlag(OPT_print_icf_sections, OPT_no_print_icf_sections, false);
   config->printGcSections =
       args.hasFlag(OPT_print_gc_sections, OPT_no_print_gc_sections, false);
   config->printSymbolOrder =
       args.getLastArgValue(OPT_print_symbol_order);
   config->rpath = getRpath(args);
template <class ELFT> static uint32_t getAndFeatures() {
   if (config->emachine != EM_386 && config->emachine != EM_X86_64 &&
       config->emachine != EM_AARCH64)
     return 0;
 
   uint32_t ret = -1;
   for (InputFile *f : objectFiles) {
     uint32_t features = cast<ObjFile<ELFT>>(f)->andFeatures;
     if (config->forceBTI && !(features & GNU_PROPERTY_AARCH64_FEATURE_1_BTI)) {
-      warn(toString(f) + ": --force-bti: file does not have BTI property");
+      warn(toString(f) + ": -z force-bti: file does not have BTI property");
       features |= GNU_PROPERTY_AARCH64_FEATURE_1_BTI;
     } else if (!features && config->requireCET)
       error(toString(f) + ": --require-cet: file is not compatible with CET");
     ret &= features;
   }
 
   // Force enable pointer authentication Plt, we don't warn in this case as
   // this does not require support in the object for correctness.

lld/ELF/Options.td

 
 def fix_cortex_a8: F<"fix-cortex-a8">,
   HelpText<"Apply fixes for ARM Cortex-A8 erratum 657417">;
 
 // This option is intentionally hidden from the user as the implementation
 // is not complete.
 def require_cet: F<"require-cet">;
 
-def force_bti: F<"force-bti">,
-  HelpText<"Force enable AArch64 BTI in PLT, warn if Input ELF file does not have GNU_PROPERTY_AARCH64_FEATURE_1_BTI property">;
-
 defm format: Eq<"format", "Change the input format of the inputs following this option">,
   MetaVarName<"[default,elf,binary]">;
 
 defm gc_sections: B<"gc-sections",
     "Enable garbage collection of unused sections",
     "Disable garbage collection of unused sections (default)">;
 
 defm gdb_index: B<"gdb-index",

 
 defm orphan_handling:
   Eq<"orphan-handling", "Control how orphan sections are handled when linker script used">;
 
 defm pack_dyn_relocs:
   Eq<"pack-dyn-relocs", "Pack dynamic relocations in the given format">,
   MetaVarName<"[none,android,relr,android+relr]">;
 
-def pac_plt: F<"pac-plt">,
-  HelpText<"AArch64 only, use pointer authentication in PLT">;
-
 defm use_android_relr_tags: B<"use-android-relr-tags",
     "Use SHT_ANDROID_RELR / DT_ANDROID_RELR* tags instead of SHT_RELR / DT_RELR*",
     "Use SHT_RELR / DT_RELR* tags (default)">;
 
 def pic_veneer: F<"pic-veneer">,
   HelpText<"Always generate position independent thunks (veneers)">;
 
 defm pie: B<"pie",

lld/docs/ld.lld.1

 .It Fl -fatal-warnings
 Treat warnings as errors.
 .It Fl -filter Ns = Ns Ar value , Fl F Ar value
 Set the
 .Dv DT_FILTER
 field to the specified value.
 .It Fl -fini Ns = Ns Ar symbol
 Specify a finalizer function.
-.It Fl -force-bti
-Force enable AArch64 BTI instruction in PLT, warn if Input ELF file does not have GNU_PROPERTY_AARCH64_FEATURE_1_BTI property.
 .It Fl -format Ns = Ns Ar input-format , Fl b Ar input-format
 Specify the format of the inputs following this option.
 .Ar input-format
 may be one of
 .Cm binary ,
 .Cm elf ,
 and
 .Cm default .

 .El
 .Pp
 .Cm none
 is the default.
 If
 .Fl -use-android-relr-tags
 is specified, use SHT_ANDROID_RELR instead of SHT_RELR.
 .Pp
-.It Fl -pac-plt
-AArch64 only, use pointer authentication in PLT.
 .It Fl -pic-veneer
 Always generate position independent thunks.
 .It Fl -pie , Fl -pic-executable
 Create a position independent executable.
 .It Fl -print-gc-sections
 List removed unused sections.
 .It Fl -print-icf-sections
 List identical folded sections.

 .Bl -tag -width indent -compact
 .Pp
 .It Cm execstack
 Make the main stack executable.
 Stack permissions are recorded in the
 .Dv PT_GNU_STACK
 segment.
 .Pp
+.It Cm force-bti
+Force enable AArch64 BTI instruction in PLT, warn if Input ELF file does not have GNU_PROPERTY_AARCH64_FEATURE_1_BTI property.
+.Pp
 .It Cm global
 Sets the
 .Dv DF_1_GLOBAL flag in the
 .Dv DYNAMIC
 section.
 Different loaders can decide how to handle this flag on their own.
 .Pp
 .It Cm ifunc-noplt

 .Pp
 .It Cm origin
 Set the
 .Dv DF_ORIGIN
 flag to indicate that the object requires
 $ORIGIN
 processing.
 .Pp
+.It Cm pac-plt
+AArch64 only, use pointer authentication in PLT.
+.Pp
 .It Cm retpolineplt
 Emit retpoline format PLT entries as a mitigation for CVE-2017-5715.
 .Pp
 .It Cm rodynamic
 Make the
 .Li .dynamic
 section read-only.
 The

lld/test/ELF/aarch64-bti-pac-cli-error.s

 # REQUIRES: x86
 # RUN: llvm-mc --triple=x86_64-pc-linux --filetype=obj -o %t.o %s
-# RUN: not ld.lld --pac-plt --force-bti %t.o -o %t 2>&1 | FileCheck %s
+# RUN: not ld.lld -z pac-plt -z force-bti %t.o -o %t 2>&1 | FileCheck %s
 #
-## Check that we error if --pac-plt and --force-bti are used when target is not
+## Check that we error if -z pac-plt and -z force-bti are used when target is not
 ## aarch64
 
-# CHECK: error: --pac-plt only supported on AArch64
-# CHECK-NEXT: error: --force-bti only supported on AArch64
+# CHECK: error: -z pac-plt only supported on AArch64
+# CHECK-NEXT: error: -z force-bti only supported on AArch64
 
         .globl start
 start:  ret

lld/test/ELF/aarch64-feature-bti.s

 # NOEX-NEXT:           nop
 # NOEX-NEXT:           nop
 # NOEX: 0000000000210310 func2@plt:
 # NOEX-NEXT:   210310: adrp    x16, #131072
 # NOEX-NEXT:           ldr     x17, [x16, #1032]
 # NOEX-NEXT:           add     x16, x16, #1032
 # NOEX-NEXT:           br      x17
 
-## Force BTI entries with the --force-bti command line option. Expect a warning
+## Force BTI entries with the -z force-bti command line option. Expect a warning
 ## from the file without the .note.gnu.property.
 
-# RUN: ld.lld %t.o %t2.o --force-bti %t.so -o %tforcebti.exe 2>&1 | FileCheck --check-prefix=FORCE-WARN %s
+# RUN: ld.lld %t.o %t2.o -z force-bti %t.so -o %tforcebti.exe 2>&1 | FileCheck --check-prefix=FORCE-WARN %s
 
-# FORCE-WARN: aarch64-feature-bti.s.tmp2.o: --force-bti: file does not have BTI property
+# FORCE-WARN: aarch64-feature-bti.s.tmp2.o: -z force-bti: file does not have BTI property
 
 
 # RUN: llvm-readelf -n %tforcebti.exe | FileCheck --check-prefix=BTIPROP %s
 # RUN: llvm-readelf --dynamic-table %tforcebti.exe | FileCheck --check-prefix BTIDYN %s
 # RUN: llvm-objdump -d -mattr=+bti --no-show-raw-insn %tforcebti.exe | FileCheck --check-prefix=FORCE %s
 
 # FORCE: Disassembly of section .text:
 # FORCE: 0000000000210370 func1:

lld/test/ELF/aarch64-feature-btipac.s

 # EX:        210310: adrp    x16, #131072
 # EX-NEXT:           ldr     x17, [x16, #1032]
 # EX-NEXT:           add     x16, x16, #1032
 # EX-NEXT:           br      x17
 
 # NODYN-NOT:   0x0000000070000001 (AARCH64_BTI_PLT)
 # NODYN-NOT:   0x0000000070000003 (AARCH64_PAC_PLT)
 
-## Check that combination of --pac-plt and --force-bti warns for the file that
+## Check that combination of -z pac-plt and -z force-bti warns for the file that
 ## doesn't contain the BTI property, but generates PAC and BTI PLT sequences.
-## The --pac-plt doesn't warn as it is not required for correctness.
+## The -z pac-plt doesn't warn as it is not required for correctness.
 
-# RUN: ld.lld %t.o %t3.o %t.so --pac-plt --force-bti -o %t.exe 2>&1 | FileCheck --check-prefix=FORCE-WARN %s
+# RUN: ld.lld %t.o %t3.o %t.so -z pac-plt -z force-bti -o %t.exe 2>&1 | FileCheck --check-prefix=FORCE-WARN %s
 
-# FORCE-WARN: aarch64-feature-btipac.s.tmp3.o: --force-bti: file does not have BTI property
+# FORCE-WARN: aarch64-feature-btipac.s.tmp3.o: -z force-bti: file does not have BTI property
 
 # RUN: llvm-readelf -n %t.exe | FileCheck --check-prefix=BTIPACPROP %s
 # RUN: llvm-objdump -d -mattr=+v8.5a --no-show-raw-insn %t.exe | FileCheck --check-prefix BTIPACEX %s
 # RUN: llvm-readelf --dynamic-table %t.exe | FileCheck --check-prefix BTIPACDYN %s
 .section ".note.gnu.property", "a"
 .long 4
 .long 0x10
 .long 0x5

lld/test/ELF/aarch64-feature-pac.s

 # SOGOTPLT2-NEXT: 0x00030468 00000000 00000000 00000000 00000000
 # SOGOTPLT2-NEXT: 0x00030478 00000000 00000000 60030100 00000000
 
 # PACPROP: Properties:    aarch64 feature: PAC
 
 # PACDYN-NOT:      0x0000000070000001 (AARCH64_BTI_PLT)
 # PACDYN:          0x0000000070000003 (AARCH64_PAC_PLT)
 
-## Turn on PAC entries with the --pac-plt command line option. There are no
+## Turn on PAC entries with the -z pac-plt command line option. There are no
 ## warnings in this case as the choice to use PAC in PLT entries is orthogonal
 ## to the choice of using PAC in relocatable objects. The presence of the PAC
 ## .note.gnu.property is an indication of preference by the relocatable object.
 
-# RUN: ld.lld %t.o %t2.o --pac-plt %t.so -o %tpacplt.exe
+# RUN: ld.lld %t.o %t2.o -z pac-plt %t.so -o %tpacplt.exe
 # RUN: llvm-readelf -n %tpacplt.exe | FileCheck --check-prefix=PACPROP %s
 # RUN: llvm-readelf --dynamic-table %tpacplt.exe | FileCheck --check-prefix PACDYN %s
 # RUN: llvm-objdump -d -mattr=+v8.3a --no-show-raw-insn %tpacplt.exe | FileCheck --check-prefix PACPLT %s
 
 # PACPLT: Disassembly of section .text:
 # PACPLT: 0000000000210370 func1:
 # PACPLT-NEXT:   210370:        bl      #48 <func2@plt>
 # PACPLT-NEXT:                  ret