diff mbox series

[v4,01/17] riscv: Add --enable-cfi option for controlling cfi features

Message ID 20260526061703.2188042-2-jesse.huang@sifive.com (mailing list archive)
State New
Headers
Series Support RISC-V Control Flow Integrifty (CFI) |

Checks

Context Check Description
redhat-pt-bot/TryBot-apply_patch success Patch applied to master at the time it was sent
linaro-tcwg-bot/tcwg_glibc_build--master-arm success Build passed
linaro-tcwg-bot/tcwg_glibc_build--master-aarch64 success Build passed
linaro-tcwg-bot/tcwg_glibc_check--master-aarch64 success Test passed

Commit Message

Jesse Huang May 26, 2026, 6:16 a.m. UTC 
  ---
 INSTALL             | 13 +++++++++++++
 NEWS                |  3 +++
 configure           | 12 ++++++++++++
 configure.ac        |  6 ++++++
 manual/install.texi | 12 ++++++++++++
 5 files changed, 46 insertions(+)

Comments

Andreas Schwab May 26, 2026, 7:58 a.m. UTC | #1 
On Mai 25 2026, Jesse Huang wrote:

> diff --git a/manual/install.texi b/manual/install.texi
> index 073cda0530..a9dc56f937 100644
> --- a/manual/install.texi
> +++ b/manual/install.texi
> @@ -185,6 +185,18 @@ non CET enabled shared library in CET enabled application.
>  
>  NOTE: @option{--enable-cet} is only supported on x86_64 and x32.
>  
> +@item --enable-cfi
> +Enable RISC-V Control Flow Integrity Extensions (Zicfilp/Zicfiss) support.
> +When @theglibc{} is built with @option{--enable-cfi}, the resulting
> +library is protected with landing pad and shadow stack@. 
> +This feature is currently supported on RV64 with GCC 15 and binutils 2.45
> +or later. With @option{--enable-cfi}, it is an error to dlopen a non CFI
> +enabled shared library in CFI enabled application.  The restriction can be
> +loosen by setting to permissive mode with the use of the glibc tunables,

   loosened
diff mbox series

Patch

diff --git a/INSTALL b/INSTALL
index 4174c9661f..04bdea3647 100644
--- a/INSTALL
+++ b/INSTALL
@@ -154,6 +154,19 @@  passed to 'configure'.  For example:
 
      NOTE: '--enable-cet' is only supported on x86_64 and x32.
 
+'--enable-cfi'
+     Enable RISC-V Control Flow Integrity Extensions (Zicfilp/Zicfiss)
+     support.  When the GNU C Library is built with '--enable-cfi', the
+     resulting library is protected with landing pad and shadow stack.
+     This feature is currently supported on RV64 with GCC 15 and
+     binutils 2.45 or later.  With '--enable-cfi', it is an error to
+     dlopen a non CFI enabled shared library in CFI enabled application.
+     The restriction can be loosen by setting to permissive mode with
+     the use of the glibc tunables, see glibc tunables section for more
+     information.
+
+     NOTE: '--enable-cfi' is only supported on RV64.
+
 '--enable-memory-tagging'
      Enable memory tagging support if the architecture supports it.
      When the GNU C Library is built with this option then the resulting
diff --git a/NEWS b/NEWS
index e2173fa1aa..c19d881868 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,9 @@  Version 2.44
 
 Major new features:
 
+* Added --enable-cfi option to enable the RISC-V CFI extensions
+  (Zicfilp/Zicfiss) support on RV64 Linux.
+
 * Additional optimized and correctly rounded mathematical functions have
   been imported from the CORE-MATH project, in particular cosh, sinh, and
   tanh.
diff --git a/configure b/configure
index 336a93fbef..80d8c839e5 100755
--- a/configure
+++ b/configure
@@ -818,6 +818,7 @@  enable_nscd
 enable_pt_chown
 enable_mathvec
 enable_cet
+enable_cfi
 enable_scv
 enable_fortify_source
 enable_sframe
@@ -1500,6 +1501,7 @@  Optional Features:
                           depends on architecture]
   --enable-cet            enable Intel Control-flow Enforcement Technology
                           (CET), x86 only
+  --enable-cfi            enable Control Flow Integrity (CFI), RISC-V only
   --disable-scv           syscalls will not use scv instruction, even if the
                           kernel supports it, powerpc only
   --enable-fortify-source[=1|2|3]
@@ -4855,6 +4857,16 @@  esac
 fi
 
 
+# Check whether --enable-cfi was given.
+if test ${enable_cfi+y}
+then :
+  enableval=$enable_cfi; enable_cfi=$enableval
+else case e in #(
+  e) enable_cfi=no ;;
+esac
+fi
+
+
 # Check whether --enable-scv was given.
 if test ${enable_scv+y}
 then :
diff --git a/configure.ac b/configure.ac
index e9138a38b7..9739ce399d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -421,6 +421,12 @@  AC_ARG_ENABLE([cet],
 	      [enable_cet=$enableval],
 	      [enable_cet=$libc_cv_compiler_default_cet])
 
+AC_ARG_ENABLE([cfi],
+	      AS_HELP_STRING([--enable-cfi],
+			     [enable Control Flow Integrity (CFI), RISC-V only]),
+	      [enable_cfi=$enableval],
+	      [enable_cfi=no])
+
 AC_ARG_ENABLE([scv],
 	      AS_HELP_STRING([--disable-scv],
 			     [syscalls will not use scv instruction, even if the kernel supports it, powerpc only]),
diff --git a/manual/install.texi b/manual/install.texi
index 073cda0530..a9dc56f937 100644
--- a/manual/install.texi
+++ b/manual/install.texi
@@ -185,6 +185,18 @@  non CET enabled shared library in CET enabled application.
 
 NOTE: @option{--enable-cet} is only supported on x86_64 and x32.
 
+@item --enable-cfi
+Enable RISC-V Control Flow Integrity Extensions (Zicfilp/Zicfiss) support.
+When @theglibc{} is built with @option{--enable-cfi}, the resulting
+library is protected with landing pad and shadow stack@. 
+This feature is currently supported on RV64 with GCC 15 and binutils 2.45
+or later. With @option{--enable-cfi}, it is an error to dlopen a non CFI
+enabled shared library in CFI enabled application.  The restriction can be
+loosen by setting to permissive mode with the use of the glibc tunables,
+see glibc tunables section for more information.
+
+NOTE: @option{--enable-cfi} is only supported on RV64.
+
 @item --enable-memory-tagging
 Enable memory tagging support if the architecture supports it.  When
 @theglibc{} is built with this option then the resulting library will