https://github.com/Alearner12 updated https://github.com/llvm/llvm-project/pull/209279
>From e43497de52d389a6ffd62a8b930e799d91c0146a Mon Sep 17 00:00:00 2001 From: Alearner12 <[email protected]> Date: Tue, 14 Jul 2026 00:50:11 +0530 Subject: [PATCH 1/2] [clang] Enable -fstack-clash-protection by default for Android Enable -fstack-clash-protection by default for Android targets where Clang already supports stack clash protection. The existing target support gate remains in place, so unsupported 32-bit ARM does not receive the option. Explicit -fno-stack-clash-protection continues to disable the default, with normal last-option-wins behavior. This addresses the Android stack clash hardening gap discussed in llvm/llvm-project#184428. RFC: https://discourse.llvm.org/t/rfc-enable-fstack-clash-protection-by-default-for-android-targets/91223 --- clang/include/clang/Driver/ToolChain.h | 3 +++ clang/lib/Driver/ToolChains/Clang.cpp | 6 ++++-- clang/lib/Driver/ToolChains/Linux.cpp | 4 ++++ clang/lib/Driver/ToolChains/Linux.h | 1 + clang/test/Driver/stack-clash-protection.c | 15 +++++++++++++++ 5 files changed, 27 insertions(+), 2 deletions(-) diff --git a/clang/include/clang/Driver/ToolChain.h b/clang/include/clang/Driver/ToolChain.h index 863ba1084cb1a..afa390592f87a 100644 --- a/clang/include/clang/Driver/ToolChain.h +++ b/clang/include/clang/Driver/ToolChain.h @@ -537,6 +537,9 @@ class ToolChain { return LangOptions::SSPOff; } + /// Does this tool chain enable -fstack-clash-protection by default. + virtual bool IsStackClashProtectionDefault() const { return false; } + /// Get the default trivial automatic variable initialization. virtual LangOptions::TrivialAutoVarInitKind GetDefaultTrivialAutoVarInit() const { diff --git a/clang/lib/Driver/ToolChains/Clang.cpp b/clang/lib/Driver/ToolChains/Clang.cpp index fe01e6ffd59ef..ff4864872706b 100644 --- a/clang/lib/Driver/ToolChains/Clang.cpp +++ b/clang/lib/Driver/ToolChains/Clang.cpp @@ -3820,8 +3820,10 @@ static void RenderSCPOptions(const ToolChain &TC, const ArgList &Args, !EffectiveTriple.isRISCV() && !EffectiveTriple.isLoongArch()) return; - Args.addOptInFlag(CmdArgs, options::OPT_fstack_clash_protection, - options::OPT_fno_stack_clash_protection); + if (Args.hasFlag(options::OPT_fstack_clash_protection, + options::OPT_fno_stack_clash_protection, + TC.IsStackClashProtectionDefault())) + CmdArgs.push_back("-fstack-clash-protection"); } static void RenderTrivialAutoVarInitOptions(const Driver &D, diff --git a/clang/lib/Driver/ToolChains/Linux.cpp b/clang/lib/Driver/ToolChains/Linux.cpp index 8d30a5ead3bbb..61de337e35604 100644 --- a/clang/lib/Driver/ToolChains/Linux.cpp +++ b/clang/lib/Driver/ToolChains/Linux.cpp @@ -946,6 +946,10 @@ bool Linux::isPIEDefault(const llvm::opt::ArgList &Args) const { getTriple().isMusl() || getSanitizerArgs(Args).requiresPIE(); } +bool Linux::IsStackClashProtectionDefault() const { + return getTriple().isAndroid(); +} + bool Linux::IsAArch64OutlineAtomicsDefault(const ArgList &Args) const { // Outline atomics for AArch64 are supported by compiler-rt // and libgcc since 9.3.1 diff --git a/clang/lib/Driver/ToolChains/Linux.h b/clang/lib/Driver/ToolChains/Linux.h index 6c81bbc71f7c2..12d8ae466fa76 100644 --- a/clang/lib/Driver/ToolChains/Linux.h +++ b/clang/lib/Driver/ToolChains/Linux.h @@ -51,6 +51,7 @@ class LLVM_LIBRARY_VISIBILITY Linux : public Generic_ELF { IsAArch64OutlineAtomicsDefault(const llvm::opt::ArgList &Args) const override; bool isPIEDefault(const llvm::opt::ArgList &Args) const override; bool IsMathErrnoDefault() const override; + bool IsStackClashProtectionDefault() const override; SanitizerMask getSupportedSanitizers(BoundArch BA, Action::OffloadKind DeviceOffloadKind) const override; diff --git a/clang/test/Driver/stack-clash-protection.c b/clang/test/Driver/stack-clash-protection.c index 3b0476db9d3cb..9c337b2216ed3 100644 --- a/clang/test/Driver/stack-clash-protection.c +++ b/clang/test/Driver/stack-clash-protection.c @@ -8,6 +8,21 @@ // RUN: %clang -target x86_64-unknown-freebsd -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-x86 // SCP-x86: "-fstack-clash-protection" +// RUN: %clang -target x86_64-unknown-linux -### %s 2>&1 | FileCheck %s -check-prefix=SCP-LINUX-NO +// SCP-LINUX-NO-NOT: "-fstack-clash-protection" + +// RUN: %clang -target x86_64-linux-android -### %s 2>&1 | FileCheck %s -check-prefix=SCP-ANDROID +// RUN: %clang -target i686-linux-android -### %s 2>&1 | FileCheck %s -check-prefix=SCP-ANDROID +// RUN: %clang -target aarch64-linux-android -### %s 2>&1 | FileCheck %s -check-prefix=SCP-ANDROID +// RUN: %clang -target riscv64-linux-android -### %s 2>&1 | FileCheck %s -check-prefix=SCP-ANDROID +// RUN: %clang -target aarch64-linux-android -fno-stack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-ANDROID-NO +// RUN: %clang -target aarch64-linux-android -fno-stack-clash-protection -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-ANDROID +// RUN: %clang -target aarch64-linux-android -fstack-clash-protection -fno-stack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-ANDROID-NO +// RUN: %clang -target armv7-linux-androideabi -### %s 2>&1 | FileCheck %s -check-prefix=SCP-ANDROID-ARMV7 +// SCP-ANDROID: "-fstack-clash-protection" +// SCP-ANDROID-NO-NOT: "-fstack-clash-protection" +// SCP-ANDROID-ARMV7-NOT: "-fstack-clash-protection" + // RUN: %clang -target armv7k-apple-linux -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-armv7 // SCP-armv7-NOT: "-fstack-clash-protection" // SCP-armv7: argument unused during compilation: '-fstack-clash-protection' >From cf13b0244734b75c596da44f826e33245306a892 Mon Sep 17 00:00:00 2001 From: Alearner12 <[email protected]> Date: Tue, 14 Jul 2026 02:41:59 +0530 Subject: [PATCH 2/2] [clang][test] Simplify stack clash driver checks Use a shared ENABLED prefix for tests that expect the driver option and implicit negative checks for disabled cases. --- clang/test/Driver/stack-clash-protection.c | 56 ++++++++++------------ 1 file changed, 25 insertions(+), 31 deletions(-) diff --git a/clang/test/Driver/stack-clash-protection.c b/clang/test/Driver/stack-clash-protection.c index 9c337b2216ed3..5369c6986f1a9 100644 --- a/clang/test/Driver/stack-clash-protection.c +++ b/clang/test/Driver/stack-clash-protection.c @@ -1,30 +1,25 @@ -// RUN: %clang -target i386-unknown-linux -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-i386 -// RUN: %clang -target i386-unknown-linux -fno-stack-clash-protection -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-i386 -// RUN: %clang -target i386-unknown-linux -fstack-clash-protection -fno-stack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-i386-NO -// SCP-i386: "-fstack-clash-protection" -// SCP-i386-NO-NOT: "-fstack-clash-protection" - -// RUN: %clang -target x86_64-scei-linux -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-x86 -// RUN: %clang -target x86_64-unknown-freebsd -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-x86 -// SCP-x86: "-fstack-clash-protection" - -// RUN: %clang -target x86_64-unknown-linux -### %s 2>&1 | FileCheck %s -check-prefix=SCP-LINUX-NO -// SCP-LINUX-NO-NOT: "-fstack-clash-protection" - -// RUN: %clang -target x86_64-linux-android -### %s 2>&1 | FileCheck %s -check-prefix=SCP-ANDROID -// RUN: %clang -target i686-linux-android -### %s 2>&1 | FileCheck %s -check-prefix=SCP-ANDROID -// RUN: %clang -target aarch64-linux-android -### %s 2>&1 | FileCheck %s -check-prefix=SCP-ANDROID -// RUN: %clang -target riscv64-linux-android -### %s 2>&1 | FileCheck %s -check-prefix=SCP-ANDROID -// RUN: %clang -target aarch64-linux-android -fno-stack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-ANDROID-NO -// RUN: %clang -target aarch64-linux-android -fno-stack-clash-protection -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-ANDROID -// RUN: %clang -target aarch64-linux-android -fstack-clash-protection -fno-stack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-ANDROID-NO -// RUN: %clang -target armv7-linux-androideabi -### %s 2>&1 | FileCheck %s -check-prefix=SCP-ANDROID-ARMV7 -// SCP-ANDROID: "-fstack-clash-protection" -// SCP-ANDROID-NO-NOT: "-fstack-clash-protection" -// SCP-ANDROID-ARMV7-NOT: "-fstack-clash-protection" - -// RUN: %clang -target armv7k-apple-linux -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-armv7 -// SCP-armv7-NOT: "-fstack-clash-protection" +// RUN: %clang -target i386-unknown-linux -fstack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED +// RUN: %clang -target i386-unknown-linux -fno-stack-clash-protection -fstack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED +// RUN: %clang -target i386-unknown-linux -fstack-clash-protection -fno-stack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=DISABLED --implicit-check-not='"-fstack-clash-protection"' + +// RUN: %clang -target x86_64-scei-linux -fstack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED +// RUN: %clang -target x86_64-unknown-freebsd -fstack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED + +// RUN: %clang -target x86_64-unknown-linux -### %s 2>&1 | FileCheck %s --check-prefix=DISABLED --implicit-check-not='"-fstack-clash-protection"' + +// RUN: %clang -target x86_64-linux-android -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED +// RUN: %clang -target i686-linux-android -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED +// RUN: %clang -target aarch64-linux-android -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED +// RUN: %clang -target riscv64-linux-android -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED +// RUN: %clang -target aarch64-linux-android -fno-stack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=DISABLED --implicit-check-not='"-fstack-clash-protection"' +// RUN: %clang -target aarch64-linux-android -fno-stack-clash-protection -fstack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED +// RUN: %clang -target aarch64-linux-android -fstack-clash-protection -fno-stack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=DISABLED --implicit-check-not='"-fstack-clash-protection"' +// RUN: %clang -target armv7-linux-androideabi -### %s 2>&1 | FileCheck %s --check-prefix=DISABLED --implicit-check-not='"-fstack-clash-protection"' + +// ENABLED: "-fstack-clash-protection" +// DISABLED: "-cc1" + +// RUN: %clang -target armv7k-apple-linux -fstack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=SCP-armv7 --implicit-check-not='"-fstack-clash-protection"' // SCP-armv7: argument unused during compilation: '-fstack-clash-protection' // RUN: %clang -target x86_64-unknown-linux -fstack-clash-protection -S -emit-llvm -o %t.ll %s 2>&1 | FileCheck %s -check-prefix=SCP-warn @@ -37,10 +32,9 @@ // SCP-ll-win64-NOT: attributes {{.*}} "probe-stack"="inline-asm" // SCP-ll-win64: argument unused during compilation: '-fstack-clash-protection' -// RUN: %clang -target x86_64-unknown-fuchsia -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-FUCHSIA -// RUN: %clang -target aarch64-unknown-fuchsia -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-FUCHSIA -// RUN: %clang -target riscv64-unknown-fuchsia -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-FUCHSIA -// SCP-FUCHSIA: "-fstack-clash-protection" +// RUN: %clang -target x86_64-unknown-fuchsia -fstack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED +// RUN: %clang -target aarch64-unknown-fuchsia -fstack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED +// RUN: %clang -target riscv64-unknown-fuchsia -fstack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED int foo(int c) { int r; _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
