1- # Copyright (C) 2023 Intel Corporation
1+ # Copyright (C) 2023-2024 Intel Corporation
22# Part of the Unified-Runtime Project, under the Apache License v2.0 with LLVM Exceptions.
33# See LICENSE.TXT
44# SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
@@ -28,13 +28,14 @@ function(add_cppformat name)
2828 if (${ARGC} EQUAL 0)
2929 return ()
3030 else ()
31+ # Split args into 2 parts (in Windows the list is probably too long)
32+ list (SUBLIST ARGN 0 250 selected_files_1)
33+ list (SUBLIST ARGN 251 -1 selected_files_2)
3134 add_custom_target (cppformat-${name}
32- COMMAND ${CLANG_FORMAT}
33- --style=file
34- --i
35- ${ARGN}
35+ COMMAND ${CLANG_FORMAT} --style=file --i ${selected_files_1}
36+ COMMAND ${CLANG_FORMAT} --style=file --i ${selected_files_2}
3637 COMMENT "Format CXX source files"
37- )
38+ )
3839 endif ()
3940
4041 add_dependencies (cppformat cppformat-${name} )
@@ -57,28 +58,43 @@ macro(add_sanitizer_flag flag)
5758 set (CMAKE_REQUIRED_LIBRARIES ${SAVED_CMAKE_REQUIRED_LIBRARIES} )
5859endmacro ()
5960
61+ check_cxx_compiler_flag("-fcf-protection=full" CXX_HAS_FCF_PROTECTION_FULL)
62+
6063function (add_ur_target_compile_options name )
6164 if (NOT MSVC )
65+ target_compile_definitions (${name} PRIVATE -D_FORTIFY_SOURCE=2)
6266 target_compile_options (${name} PRIVATE
63- -fPIC
67+ # Warning options
6468 -Wall
6569 -Wpedantic
6670 -Wempty-body
71+ -Wformat
72+ -Wformat-security
6773 -Wunused-parameter
74+
75+ # Hardening options
76+ -fPIC
77+ -fstack-protector-strong
78+ -fvisibility=hidden # Required for -fsanitize=cfi
79+ # -fsanitize=cfi requires -flto, which breaks a lot of things
80+ # See: https://github.com/oneapi-src/unified-runtime/issues/2120
81+ # -flto
82+ # $<$<CXX_COMPILER_ID:Clang,AppleClang>:-fsanitize=cfi>
83+ $<$<BOOL :${CXX_HAS_FCF_PROTECTION_FULL} >:-fcf-protection=full>
84+ # -fstack-clash-protection is not supported in apple clang or GCC < 8
85+ $<$<AND :$<CXX_COMPILER_ID:GNU>,$<VERSION_GREATER_EQUAL :$<CXX_COMPILER_VERSION>,8>>:-fstack-clash-protection>
86+ $<$<CXX_COMPILER_ID:Clang>:-fstack-clash-protection>
87+
88+ # Colored output
6889 $<$<CXX_COMPILER_ID:GNU>:-fdiagnostics-color=always>
6990 $<$<CXX_COMPILER_ID:Clang,AppleClang>:-fcolor-diagnostics>
7091 )
92+ if (UR_DEVELOPER_MODE)
93+ target_compile_options (${name} PRIVATE -Werror -Wextra)
94+ endif ()
7195 if (CMAKE_BUILD_TYPE STREQUAL "Release" )
72- target_compile_definitions (${name} PRIVATE -D_FORTIFY_SOURCE=2)
7396 target_compile_options (${name} PRIVATE -fvisibility=hidden)
7497 endif ()
75- if (UR_DEVELOPER_MODE)
76- target_compile_options (${name} PRIVATE
77- -Werror
78- -fno-omit-frame-pointer
79- -fstack-protector-strong
80- )
81- endif ()
8298 elseif (MSVC )
8399 target_compile_options (${name} PRIVATE
84100 $<$<CXX_COMPILER_ID:MSVC >:/MP> # clang-cl.exe does not support /MP
@@ -102,7 +118,15 @@ endfunction()
102118function (add_ur_target_link_options name )
103119 if (NOT MSVC )
104120 if (NOT APPLE )
105- target_link_options (${name} PRIVATE "LINKER:-z,relro,-z,now" )
121+ target_link_options (${name} PRIVATE "LINKER:-z,relro,-z,now,-z,noexecstack" )
122+ if (UR_DEVELOPER_MODE)
123+ target_link_options (${name} PRIVATE -Werror -Wextra)
124+ endif ()
125+ if (CMAKE_BUILD_TYPE STREQUAL "Release" )
126+ target_link_options (${name} PRIVATE
127+ $<$<CXX_COMPILER_ID:GNU>:-pie>
128+ )
129+ endif ()
106130 endif ()
107131 elseif (MSVC )
108132 target_link_options (${name} PRIVATE
0 commit comments