[TEST]: Add CT-LLVM

.github/actions/ct-test/action.yml

@@ -10,6 +10,9 @@ inputs:
   valgrind_flags:
     description: Extra flags to pass to valgrind
     default: ""
+  ctllvm:
+    description: whether to run CT-LLVM or not (requires LLVM)
+    default: "false"
 
 runs:
   using: composite
@@ -40,3 +43,12 @@ runs:
         run: |
           make clean
           tests func --exec-wrapper="valgrind --error-exitcode=1 --track-origins=yes ${{ inputs.valgrind_flags }}" --cflags="-DMLK_CT_TESTING_ENABLED -DNTESTS=50 ${{ inputs.cflags }}"
+      - shell: ${{ env.SHELL }}
+        if: ${{ inputs.ctllvm == 'true' }}
+        run: |
+          make -C test/ctllvm
+      - shell: ${{ env.SHELL }}
+        if: ${{ inputs.ctllvm == 'true' }}
+        run: | 
+          make clean
+          tests func --cflags="-fpass-plugin=test/ctllvm/ctllvm.so"-g ${{ inputs.cflags }}"

.github/workflows/ct-tests.yml

@@ -12,35 +12,49 @@ jobs:
     # Using the patched Valgrind from the KyberSlash paper to detect divisions
     # In case the patch no longer applies after an update, we may want to switch back
     # to stock valgrind added in https://github.com/pq-code-package/mlkem-native/pull/687
-    name: CT test ${{ matrix.nix-shell }} ${{ matrix.system }}
+    name: CT test ${{ matrix.nix-shell.shell }} ${{ matrix.system }}
     strategy:
       fail-fast: false
       max-parallel: 10
       matrix:
         system: [ubuntu-latest, pqcp-arm64]
         nix-shell:
-          - ci_valgrind-varlat_clang14
-          - ci_valgrind-varlat_clang15
-          - ci_valgrind-varlat_clang16
-          - ci_valgrind-varlat_clang17
-          - ci_valgrind-varlat_clang18
-          - ci_valgrind-varlat_clang19
-          - ci_valgrind-varlat_clang20
-          - ci_valgrind-varlat_gcc48
-          - ci_valgrind-varlat_gcc49
-          - ci_valgrind-varlat_gcc7
-          - ci_valgrind-varlat_gcc11
-          - ci_valgrind-varlat_gcc12
-          - ci_valgrind-varlat_gcc13
-          - ci_valgrind-varlat_gcc14
+          - shell: ci_valgrind-varlat_clang14
+            ctllvm: true
+          - shell: ci_valgrind-varlat_clang15
+            ctllvm: true
+          - shell: ci_valgrind-varlat_clang16
+            ctllvm: true
+          - shell: ci_valgrind-varlat_clang17
+            ctllvm: true
+          - shell: ci_valgrind-varlat_clang18
+            ctllvm: true
+          - shell: ci_valgrind-varlat_clang19
+            ctllvm: true
+          - shell: ci_valgrind-varlat_clang20
+            ctllvm: true
+          - shell: ci_valgrind-varlat_gcc48
+            ctllvm: false
+          - shell: ci_valgrind-varlat_gcc49
+            ctllvm: false
+          - shell: ci_valgrind-varlat_gcc7
+            ctllvm: false
+          - shell: ci_valgrind-varlat_gcc11
+            ctllvm: false
+          - shell: ci_valgrind-varlat_gcc12
+            ctllvm: false
+          - shell: ci_valgrind-varlat_gcc13
+            ctllvm: false
+          - shell: ci_valgrind-varlat_gcc14
+            ctllvm: false
     runs-on: ${{ matrix.system }}
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Setup nix
         uses: ./.github/actions/setup-shell
         with:
           gh_token: ${{ secrets.GITHUB_TOKEN }}
-          nix-shell: ${{ matrix.nix-shell }}
+          nix-shell: ${{ matrix.nix-shell.name }}
           nix-cache: true
       - name:  Build and run test (-Oz)
         # -Oz got introduced in gcc12
@@ -49,40 +63,48 @@ jobs:
         with:
           cflags: -Oz -DMLK_KEYGEN_PCT
           valgrind_flags: --variable-latency-errors=yes
+          ctllvm: ${{ matrix.nix-shell.ctllvm }}
       - name:  Build and run test (-Os)
         uses: ./.github/actions/ct-test
         with:
           cflags: -Os -DMLK_KEYGEN_PCT
           valgrind_flags: --variable-latency-errors=yes
+          ctllvm: ${{ matrix.nix-shell.ctllvm }}
       - name:  Build and run test (-O3)
         uses: ./.github/actions/ct-test
         with:
           cflags: -O3 -DMLK_KEYGEN_PCT
           valgrind_flags: --variable-latency-errors=yes
+          ctllvm: ${{ matrix.nix-shell.ctllvm }}
       - name:  Build and run test (-Ofast)
         # -Ofast got deprecated in clang19; -O3 -ffast-math should be used instead
         if: ${{ matrix.nix-shell != 'ci_valgrind-varlat_clang19' &&  matrix.nix-shell !=  'ci_valgrind-varlat_clang20' }}
         uses: ./.github/actions/ct-test
         with:
           cflags: -Ofast -DMLK_KEYGEN_PCT
           valgrind_flags: --variable-latency-errors=yes
+          ctllvm: ${{ matrix.nix-shell.ctllvm }}
       - name:  Build and run test (-O3 -ffast-math)
         uses: ./.github/actions/ct-test
         with:
           cflags: -O3 -ffast-math -DMLK_KEYGEN_PCT
           valgrind_flags: --variable-latency-errors=yes
+          ctllvm: ${{ matrix.nix-shell.ctllvm }}
       - name:  Build and run test (-O2)
         uses: ./.github/actions/ct-test
         with:
           cflags: -O2 -DMLK_KEYGEN_PCT
           valgrind_flags: --variable-latency-errors=yes
+          ctllvm: ${{ matrix.nix-shell.ctllvm }}
       - name:  Build and run test (-O1)
         uses: ./.github/actions/ct-test
         with:
           cflags: -O1 -DMLK_KEYGEN_PCT
           valgrind_flags: --variable-latency-errors=yes
+          ctllvm: ${{ matrix.nix-shell.ctllvm }}
       - name:  Build and run test (-O0)
         uses: ./.github/actions/ct-test
         with:
           cflags: -O0 -DMLK_KEYGEN_PCT
           valgrind_flags: --variable-latency-errors=yes
+          ctllvm: ${{ matrix.nix-shell.ctllvm }}

nix/util.nix

@@ -65,7 +65,7 @@ rec {
     };
   mkShellWithCC_valgrind' = cc:
     mkShellWithCC cc {
-      packages = [ pkgs.python3 ] ++ pkgs.lib.optionals (!pkgs.stdenv.isDarwin) [ valgrind_varlat ];
+      packages = [ pkgs.python3 pkgs.llvmPackages.libllvm ] ++ pkgs.lib.optionals (!pkgs.stdenv.isDarwin) [ valgrind_varlat ];
       hardeningDisable = [ "fortify" ];
     };
 

test/ctllvm/Makefile

@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: Apache-2.0
+
+.PHONY: all clean
+
+CC = clang
+CPPFLAGS += -Wno-c++17-extensions -fPIC -shared 
+LDFLAGS += `llvm-config --cxxflags --ldflags --system-libs --libs core passes`
+
+all: ctllvm.so
+
+%.so: %.cpp
+	$(CC) $(CPPFLAGS) $< -o $@ $(LDFLAGS)
+
+clean:
+	-$(RM) -rf *.so