add -fret-clean option (amd64 and i386 only at first), defaulting to off.
This causes the caller to cleans the return address off the stack after
a callq completes. The option is best used in low-level libraries (such as
libc), because libc contains low-level system call stubs. The option
reduces hints (found on the stale parts of the stack) about libc.so's mapping
location, and together with random-relinking, relro got/pic, and xonly
makes some exploit methods more difficult.
ok mortimer, mlarkin, much discussion with kettenis, in snaps for 2 weeks.

update build infrastructure for llvm-16.0.6

Update build infrastructure for LLVM 13.0.0.

Update clang build infrastructure for LLVM 11.1.0.

Heavy lifting by mortimer@, thank you so much!

Update build infrastructure for LLVM 10.0.1.

Update build infrastructure for LLVM 10.0.0.

ok hackroom@
tested by plenty

Update clang build infrastructure for LLVM 8.0.0.

Build and install a shared libLLVM, llvm-config and llvm includes.
This is required to build the radeonsi Mesa driver.

ok patrick@

Update clang build infrastructure for LLVM 7.0.1.

Refactor retguard to make adding additional arches easier.

Add a clang pass that identifies potential ROP gadgets and replaces ROP
friendly instructions with safe alternatives. This initial commit fixes
3 instruction forms that will lower to include a c3 (return) byte.
Additional problematic instructions can be fixed incrementally using
this framework.
ok deraadt@

revert to 2018/04/20 10:00:00, before oops

sync

Update clang build infrastructure for LLVM 6.0.0.

Update clang build infrastructure for LLVM 5.0.0.

zap empty depends/silence empty installs.
okay millert@

Update clang build infrastructure for LLVM 4.0.0

Discussed with kettenis@

Update clang build infrastructure for LLVM 3.9.1

"go ahead" kettenis@
"just go ahead" deraadt@
"sounds good to me" stefan@

LLVM/Clang build system. This only builds the bare minimum of what is needed
to get a working "clang" binary.

Note that you need GCC from ports to bootstrap clang.

looks good to patrick@, ok jsg@ kettenis@

update build infrastructure for llvm-16.0.6

Update build infrastructure for LLVM 13.0.0.

Update clang build infrastructure for LLVM 11.1.0.

Heavy lifting by mortimer@, thank you so much!

Update build infrastructure for LLVM 10.0.1.

Update build infrastructure for LLVM 10.0.0.

ok hackroom@
tested by plenty

Update clang build infrastructure for LLVM 8.0.0.

Build and install a shared libLLVM, llvm-config and llvm includes.
This is required to build the radeonsi Mesa driver.

ok patrick@

Update clang build infrastructure for LLVM 7.0.1.

Refactor retguard to make adding additional arches easier.

Add a clang pass that identifies potential ROP gadgets and replaces ROP
friendly instructions with safe alternatives. This initial commit fixes
3 instruction forms that will lower to include a c3 (return) byte.
Additional problematic instructions can be fixed incrementally using
this framework.
ok deraadt@

revert to 2018/04/20 10:00:00, before oops

sync

Update clang build infrastructure for LLVM 6.0.0.

Update clang build infrastructure for LLVM 5.0.0.

zap empty depends/silence empty installs.
okay millert@

Update clang build infrastructure for LLVM 4.0.0

Discussed with kettenis@

Update clang build infrastructure for LLVM 3.9.1

"go ahead" kettenis@
"just go ahead" deraadt@
"sounds good to me" stefan@

LLVM/Clang build system. This only builds the bare minimum of what is needed
to get a working "clang" binary.

Note that you need GCC from ports to bootstrap clang.

looks good to patrick@, ok jsg@ kettenis@

Update build infrastructure for LLVM 13.0.0.

Update clang build infrastructure for LLVM 11.1.0.

Heavy lifting by mortimer@, thank you so much!

Update build infrastructure for LLVM 10.0.1.

Update build infrastructure for LLVM 10.0.0.

ok hackroom@
tested by plenty

Update clang build infrastructure for LLVM 8.0.0.

Build and install a shared libLLVM, llvm-config and llvm includes.
This is required to build the radeonsi Mesa driver.

ok patrick@

Update clang build infrastructure for LLVM 7.0.1.

Refactor retguard to make adding additional arches easier.

Add a clang pass that identifies potential ROP gadgets and replaces ROP
friendly instructions with safe alternatives. This initial commit fixes
3 instruction forms that will lower to include a c3 (return) byte.
Additional problematic instructions can be fixed incrementally using
this framework.
ok deraadt@

revert to 2018/04/20 10:00:00, before oops

sync

Update clang build infrastructure for LLVM 6.0.0.

Update clang build infrastructure for LLVM 5.0.0.

zap empty depends/silence empty installs.
okay millert@

Update clang build infrastructure for LLVM 4.0.0

Discussed with kettenis@

Update clang build infrastructure for LLVM 3.9.1

"go ahead" kettenis@
"just go ahead" deraadt@
"sounds good to me" stefan@

LLVM/Clang build system. This only builds the bare minimum of what is needed
to get a working "clang" binary.

Note that you need GCC from ports to bootstrap clang.

looks good to patrick@, ok jsg@ kettenis@

Update clang build infrastructure for LLVM 11.1.0.

Heavy lifting by mortimer@, thank you so much!

Update build infrastructure for LLVM 10.0.1.

Update build infrastructure for LLVM 10.0.0.

ok hackroom@
tested by plenty

Update clang build infrastructure for LLVM 8.0.0.

Build and install a shared libLLVM, llvm-config and llvm includes.
This is required to build the radeonsi Mesa driver.

ok patrick@

Update clang build infrastructure for LLVM 7.0.1.

Refactor retguard to make adding additional arches easier.

Add a clang pass that identifies potential ROP gadgets and replaces ROP
friendly instructions with safe alternatives. This initial commit fixes
3 instruction forms that will lower to include a c3 (return) byte.
Additional problematic instructions can be fixed incrementally using
this framework.
ok deraadt@

revert to 2018/04/20 10:00:00, before oops

sync

Update clang build infrastructure for LLVM 6.0.0.

Update clang build infrastructure for LLVM 5.0.0.

zap empty depends/silence empty installs.
okay millert@

Update clang build infrastructure for LLVM 4.0.0

Discussed with kettenis@

Update clang build infrastructure for LLVM 3.9.1

"go ahead" kettenis@
"just go ahead" deraadt@
"sounds good to me" stefan@

LLVM/Clang build system. This only builds the bare minimum of what is needed
to get a working "clang" binary.

Note that you need GCC from ports to bootstrap clang.

looks good to patrick@, ok jsg@ kettenis@

Update build infrastructure for LLVM 10.0.1.

Update build infrastructure for LLVM 10.0.0.

ok hackroom@
tested by plenty

Update clang build infrastructure for LLVM 8.0.0.

Build and install a shared libLLVM, llvm-config and llvm includes.
This is required to build the radeonsi Mesa driver.

ok patrick@

Update clang build infrastructure for LLVM 7.0.1.

Refactor retguard to make adding additional arches easier.

Add a clang pass that identifies potential ROP gadgets and replaces ROP
friendly instructions with safe alternatives. This initial commit fixes
3 instruction forms that will lower to include a c3 (return) byte.
Additional problematic instructions can be fixed incrementally using
this framework.
ok deraadt@

revert to 2018/04/20 10:00:00, before oops

sync

Update clang build infrastructure for LLVM 6.0.0.

Update clang build infrastructure for LLVM 5.0.0.

zap empty depends/silence empty installs.
okay millert@

Update clang build infrastructure for LLVM 4.0.0

Discussed with kettenis@

Update clang build infrastructure for LLVM 3.9.1

"go ahead" kettenis@
"just go ahead" deraadt@
"sounds good to me" stefan@

LLVM/Clang build system. This only builds the bare minimum of what is needed
to get a working "clang" binary.

Note that you need GCC from ports to bootstrap clang.

looks good to patrick@, ok jsg@ kettenis@

Update build infrastructure for LLVM 10.0.0.

ok hackroom@
tested by plenty

Update clang build infrastructure for LLVM 8.0.0.

Build and install a shared libLLVM, llvm-config and llvm includes.
This is required to build the radeonsi Mesa driver.

ok patrick@

Update clang build infrastructure for LLVM 7.0.1.

Refactor retguard to make adding additional arches easier.

Add a clang pass that identifies potential ROP gadgets and replaces ROP
friendly instructions with safe alternatives. This initial commit fixes
3 instruction forms that will lower to include a c3 (return) byte.
Additional problematic instructions can be fixed incrementally using
this framework.
ok deraadt@

revert to 2018/04/20 10:00:00, before oops

sync

Update clang build infrastructure for LLVM 6.0.0.

Update clang build infrastructure for LLVM 5.0.0.

zap empty depends/silence empty installs.
okay millert@

Update clang build infrastructure for LLVM 4.0.0

Discussed with kettenis@

Update clang build infrastructure for LLVM 3.9.1

"go ahead" kettenis@
"just go ahead" deraadt@
"sounds good to me" stefan@

LLVM/Clang build system. This only builds the bare minimum of what is needed
to get a working "clang" binary.

Note that you need GCC from ports to bootstrap clang.

looks good to patrick@, ok jsg@ kettenis@

Update clang build infrastructure for LLVM 8.0.0.

Build and install a shared libLLVM, llvm-config and llvm includes.
This is required to build the radeonsi Mesa driver.

ok patrick@

Update clang build infrastructure for LLVM 7.0.1.

Refactor retguard to make adding additional arches easier.

Add a clang pass that identifies potential ROP gadgets and replaces ROP
friendly instructions with safe alternatives. This initial commit fixes
3 instruction forms that will lower to include a c3 (return) byte.
Additional problematic instructions can be fixed incrementally using
this framework.
ok deraadt@

revert to 2018/04/20 10:00:00, before oops

sync

Update clang build infrastructure for LLVM 6.0.0.

Update clang build infrastructure for LLVM 5.0.0.

zap empty depends/silence empty installs.
okay millert@

Update clang build infrastructure for LLVM 4.0.0

Discussed with kettenis@

Update clang build infrastructure for LLVM 3.9.1

"go ahead" kettenis@
"just go ahead" deraadt@
"sounds good to me" stefan@

LLVM/Clang build system. This only builds the bare minimum of what is needed
to get a working "clang" binary.

Note that you need GCC from ports to bootstrap clang.

looks good to patrick@, ok jsg@ kettenis@

Build and install a shared libLLVM, llvm-config and llvm includes.
This is required to build the radeonsi Mesa driver.

ok patrick@

Update clang build infrastructure for LLVM 7.0.1.

Refactor retguard to make adding additional arches easier.

Add a clang pass that identifies potential ROP gadgets and replaces ROP
friendly instructions with safe alternatives. This initial commit fixes
3 instruction forms that will lower to include a c3 (return) byte.
Additional problematic instructions can be fixed incrementally using
this framework.
ok deraadt@

revert to 2018/04/20 10:00:00, before oops

sync

Update clang build infrastructure for LLVM 6.0.0.

Update clang build infrastructure for LLVM 5.0.0.

zap empty depends/silence empty installs.
okay millert@

Update clang build infrastructure for LLVM 4.0.0

Discussed with kettenis@

Update clang build infrastructure for LLVM 3.9.1

"go ahead" kettenis@
"just go ahead" deraadt@
"sounds good to me" stefan@

LLVM/Clang build system. This only builds the bare minimum of what is needed
to get a working "clang" binary.

Note that you need GCC from ports to bootstrap clang.

looks good to patrick@, ok jsg@ kettenis@

Update clang build infrastructure for LLVM 7.0.1.

Refactor retguard to make adding additional arches easier.

Add a clang pass that identifies potential ROP gadgets and replaces ROP
friendly instructions with safe alternatives. This initial commit fixes
3 instruction forms that will lower to include a c3 (return) byte.
Additional problematic instructions can be fixed incrementally using
this framework.
ok deraadt@

revert to 2018/04/20 10:00:00, before oops

sync

Update clang build infrastructure for LLVM 6.0.0.

Update clang build infrastructure for LLVM 5.0.0.

zap empty depends/silence empty installs.
okay millert@

Update clang build infrastructure for LLVM 4.0.0

Discussed with kettenis@

Update clang build infrastructure for LLVM 3.9.1

"go ahead" kettenis@
"just go ahead" deraadt@
"sounds good to me" stefan@

LLVM/Clang build system. This only builds the bare minimum of what is needed
to get a working "clang" binary.

Note that you need GCC from ports to bootstrap clang.

looks good to patrick@, ok jsg@ kettenis@

Refactor retguard to make adding additional arches easier.

Add a clang pass that identifies potential ROP gadgets and replaces ROP
friendly instructions with safe alternatives. This initial commit fixes
3 instruction forms that will lower to include a c3 (return) byte.
Additional problematic instructions can be fixed incrementally using
this framework.
ok deraadt@

revert to 2018/04/20 10:00:00, before oops

sync

Update clang build infrastructure for LLVM 6.0.0.

Update clang build infrastructure for LLVM 5.0.0.

zap empty depends/silence empty installs.
okay millert@

Update clang build infrastructure for LLVM 4.0.0

Discussed with kettenis@

Update clang build infrastructure for LLVM 3.9.1

"go ahead" kettenis@
"just go ahead" deraadt@
"sounds good to me" stefan@

LLVM/Clang build system. This only builds the bare minimum of what is needed
to get a working "clang" binary.

Note that you need GCC from ports to bootstrap clang.

looks good to patrick@, ok jsg@ kettenis@

Add a clang pass that identifies potential ROP gadgets and replaces ROP
friendly instructions with safe alternatives. This initial commit fixes
3 instruction forms that will lower to include a c3 (return) byte.
Additional problematic instructions can be fixed incrementally using
this framework.
ok deraadt@

revert to 2018/04/20 10:00:00, before oops

sync

Update clang build infrastructure for LLVM 6.0.0.

Update clang build infrastructure for LLVM 5.0.0.

zap empty depends/silence empty installs.
okay millert@

Update clang build infrastructure for LLVM 4.0.0

Discussed with kettenis@

Update clang build infrastructure for LLVM 3.9.1

"go ahead" kettenis@
"just go ahead" deraadt@
"sounds good to me" stefan@

LLVM/Clang build system. This only builds the bare minimum of what is needed
to get a working "clang" binary.

Note that you need GCC from ports to bootstrap clang.

looks good to patrick@, ok jsg@ kettenis@

Update clang build infrastructure for LLVM 5.0.0.

zap empty depends/silence empty installs.
okay millert@

Update clang build infrastructure for LLVM 4.0.0

Discussed with kettenis@

Update clang build infrastructure for LLVM 3.9.1

"go ahead" kettenis@
"just go ahead" deraadt@
"sounds good to me" stefan@

LLVM/Clang build system. This only builds the bare minimum of what is needed
to get a working "clang" binary.

Note that you need GCC from ports to bootstrap clang.

looks good to patrick@, ok jsg@ kettenis@