From 43b057dfeb6cc7b1a8c7b91f13ef54b32e779e3f Mon Sep 17 00:00:00 2001 From: A1029384756 Date: Sat, 6 Jun 2026 21:23:26 -0400 Subject: [PATCH 1/3] [linux] change default settings to enable pie and full relro --- src/build_settings.cpp | 14 ++++++++++++++ src/linker.cpp | 10 +++++++++- src/llvm_backend.cpp | 10 ---------- 3 files changed, 23 insertions(+), 11 deletions(-) diff --git a/src/build_settings.cpp b/src/build_settings.cpp index df9142c74..4d8a5a495 100644 --- a/src/build_settings.cpp +++ b/src/build_settings.cpp @@ -1898,6 +1898,20 @@ gb_internal void init_build_context(TargetMetrics *cross_target, Subtarget subta } break; } + } else if (metrics->os == TargetOs_linux) { + if (bc->reloc_mode == RelocMode_Default) { + bc->reloc_mode = RelocMode_PIC; + } + } else if (metrics->os == TargetOs_openbsd) { + // Always use PIC for OpenBSD: it defaults to PIE + if (bc->reloc_mode == RelocMode_Default) { + bc->reloc_mode = RelocMode_PIC; + } + } else if (metrics->arch == TargetArch_riscv64) { + // NOTE(laytan): didn't seem to work without this. + if (bc->reloc_mode == RelocMode_Default) { + bc->reloc_mode = RelocMode_PIC; + } } else if (metrics->os == TargetOs_linux && subtarget == Subtarget_Android) { switch (metrics->arch) { case TargetArch_arm64: diff --git a/src/linker.cpp b/src/linker.cpp index 50bb4e524..1af78de15 100644 --- a/src/linker.cpp +++ b/src/linker.cpp @@ -788,7 +788,12 @@ try_cross_linking:; } if (build_context.build_mode == BuildMode_Executable && build_context.reloc_mode == RelocMode_PIC) { - // Do not disable PIE, let the linker choose. (most likely you want it enabled) + if (build_context.metrics.os == TargetOs_linux) { + // Linux does not enable PIE by default but required for ASLR + link_settings = gb_string_appendc(link_settings, "-pie "); + } else { + // Do not disable PIE, let the linker choose. (most likely you want it enabled) + } } else if (build_context.build_mode != BuildMode_DynamicLibrary) { if (build_context.metrics.os != TargetOs_openbsd && build_context.metrics.arch != TargetArch_riscv64 @@ -906,6 +911,9 @@ try_cross_linking:; // need to pass -z nobtcfi in order to allow the resulting program to run under // OpenBSD 7.4 and newer. Once support is added at compile time, this can be dropped. platform_lib_str = gb_string_appendc(platform_lib_str, "-Wl,-z,nobtcfi "); + } else if (build_context.metrics.os == TargetOs_linux) { + // required for RELRO + platform_lib_str = gb_string_appendc(platform_lib_str, "-Wl,-z,now -Wl,-z,relro "); } if (is_android) { diff --git a/src/llvm_backend.cpp b/src/llvm_backend.cpp index 40aceb7fe..e08116736 100644 --- a/src/llvm_backend.cpp +++ b/src/llvm_backend.cpp @@ -3156,16 +3156,6 @@ gb_internal bool lb_generate_code(lbGenerator *gen) { switch (build_context.reloc_mode) { case RelocMode_Default: - if (build_context.metrics.os == TargetOs_openbsd) { - // Always use PIC for OpenBSD: it defaults to PIE - reloc_mode = LLVMRelocPIC; - } - - if (build_context.metrics.arch == TargetArch_riscv64) { - // NOTE(laytan): didn't seem to work without this. - reloc_mode = LLVMRelocPIC; - } - break; case RelocMode_Static: reloc_mode = LLVMRelocStatic; From da742fc526a47dcbd0333ea7d5b3550f38b0d52d Mon Sep 17 00:00:00 2001 From: A1029384756 Date: Mon, 8 Jun 2026 10:58:05 -0400 Subject: [PATCH 2/3] [no-plt] enable no-plt behavior on linux arm64 and amd64 targets --- src/build_settings.cpp | 7 +++++++ src/llvm_backend.cpp | 6 ++++++ src/llvm_backend_general.cpp | 6 ++++++ src/llvm_backend_proc.cpp | 7 +++++++ 4 files changed, 26 insertions(+) diff --git a/src/build_settings.cpp b/src/build_settings.cpp index 4d8a5a495..e3d79e1b9 100644 --- a/src/build_settings.cpp +++ b/src/build_settings.cpp @@ -602,6 +602,7 @@ struct BuildContext { RelocMode reloc_mode; bool disable_red_zone; bool disable_unwind; + bool no_plt; isize max_error_count; @@ -1902,6 +1903,12 @@ gb_internal void init_build_context(TargetMetrics *cross_target, Subtarget subta if (bc->reloc_mode == RelocMode_Default) { bc->reloc_mode = RelocMode_PIC; } + switch (metrics->arch) { + case TargetArch_arm64: + case TargetArch_amd64: + bc->no_plt = true; + break; + } } else if (metrics->os == TargetOs_openbsd) { // Always use PIC for OpenBSD: it defaults to PIE if (bc->reloc_mode == RelocMode_Default) { diff --git a/src/llvm_backend.cpp b/src/llvm_backend.cpp index e08116736..15ff125d4 100644 --- a/src/llvm_backend.cpp +++ b/src/llvm_backend.cpp @@ -2142,6 +2142,9 @@ gb_internal lbProcedure *lb_create_startup_runtime(lbModule *main_module, lbProc lbProcedure *p = lb_create_dummy_procedure(main_module, str_lit(LB_STARTUP_RUNTIME_PROC_NAME), proc_type); p->is_startup = true; + if (build_context.no_plt) { + lb_add_attribute_to_proc(p->module, p->value, "nonlazybind"); + } lb_add_attribute_to_proc(p->module, p->value, "optnone"); lb_add_attribute_to_proc(p->module, p->value, "noinline"); @@ -2162,6 +2165,9 @@ gb_internal lbProcedure *lb_create_cleanup_runtime(lbModule *main_module) { // C lbProcedure *p = lb_create_dummy_procedure(main_module, str_lit(LB_CLEANUP_RUNTIME_PROC_NAME), proc_type); p->is_startup = true; + if (build_context.no_plt) { + lb_add_attribute_to_proc(p->module, p->value, "nonlazybind"); + } lb_add_attribute_to_proc(p->module, p->value, "optnone"); lb_add_attribute_to_proc(p->module, p->value, "noinline"); diff --git a/src/llvm_backend_general.cpp b/src/llvm_backend_general.cpp index 8068670f0..27a8c66e3 100644 --- a/src/llvm_backend_general.cpp +++ b/src/llvm_backend_general.cpp @@ -59,6 +59,12 @@ gb_internal WORKER_TASK_PROC(lb_init_module_worker_proc) { m->ctx = LLVMContextCreate(); m->mod = LLVMModuleCreateWithNameInContext(m->module_name, m->ctx); // m->debug_builder = nullptr; + if (build_context.no_plt) { + LLVMAddModuleFlag(m->mod, + LLVMModuleFlagBehaviorWarning, + "RtLibUseGOT", 11, + LLVMValueAsMetadata(LLVMConstInt(LLVMInt32TypeInContext(m->ctx), 1, true))); + } if (build_context.ODIN_DEBUG) { enum {DEBUG_METADATA_VERSION = 3}; diff --git a/src/llvm_backend_proc.cpp b/src/llvm_backend_proc.cpp index e26bac5c6..8738dbc9c 100644 --- a/src/llvm_backend_proc.cpp +++ b/src/llvm_backend_proc.cpp @@ -2,6 +2,9 @@ gb_internal LLVMValueRef lb_call_intrinsic(lbProcedure *p, const char *name, LLV unsigned id = LLVMLookupIntrinsicID(name, gb_strlen(name)); GB_ASSERT_MSG(id != 0, "Unable to find %s", name); LLVMValueRef ip = LLVMGetIntrinsicDeclaration(p->module->mod, id, types, type_count); + if (build_context.no_plt) { + lb_add_attribute_to_proc(p->module, ip, "nonlazybind"); + } LLVMTypeRef call_type = LLVMIntrinsicGetType(p->module->ctx, id, types, type_count); return LLVMBuildCall2(p->builder, call_type, ip, args, arg_count, ""); } @@ -153,6 +156,10 @@ gb_internal lbProcedure *lb_create_procedure(lbModule *m, Entity *entity, bool i lb_ensure_abi_function_type(m, p); lb_add_function_type_attributes(p->value, p->abi_function_type, p->abi_function_type->calling_convention); + if (build_context.no_plt) { + lb_add_attribute_to_proc(m, p->value, "nonlazybind"); + } + if (build_context.disable_unwind) { lb_add_attribute_to_proc(m, p->value, "nounwind"); } From 286674a8629a1d32d90b6c0106175a80bc6a4534 Mon Sep 17 00:00:00 2001 From: A1029384756 Date: Mon, 8 Jun 2026 10:59:32 -0400 Subject: [PATCH 3/3] [no-plt] restricted to llvm 19+ --- src/build_settings.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/build_settings.cpp b/src/build_settings.cpp index e3d79e1b9..f31830598 100644 --- a/src/build_settings.cpp +++ b/src/build_settings.cpp @@ -1906,7 +1906,7 @@ gb_internal void init_build_context(TargetMetrics *cross_target, Subtarget subta switch (metrics->arch) { case TargetArch_arm64: case TargetArch_amd64: - bc->no_plt = true; + bc->no_plt = LLVM_VERSION_MAJOR >= 19; break; } } else if (metrics->os == TargetOs_openbsd) {