@@ -154,6 +154,19 @@ passed to 'configure'. For example:
NOTE: '--enable-cet' is only supported on x86_64 and x32.
+'--enable-cfi'
+ Enable RISC-V Control Flow Integrity Extensions (Zicfilp/Zicfiss)
+ support. When the GNU C Library is built with '--enable-cfi', the
+ resulting library is protected with landing pad and shadow stack.
+ This feature is currently supported on RV64 with GCC 15 and
+ binutils 2.45 or later. With '--enable-cfi', it is an error to
+ dlopen a non CFI enabled shared library in CFI enabled application.
+ The restriction can be loosened by setting to permissive mode with
+ the use of the glibc tunables, see glibc tunables section for more
+ information.
+
+ NOTE: '--enable-cfi' is only supported on RV64.
+
'--disable-profile'
Don't build libraries with profiling information. You may want to
use this option if you don't plan to do profiling.
@@ -9,6 +9,9 @@ Version 2.44
Major new features:
+* Added --enable-cfi option to enable the RISC-V CFI extensions
+ (Zicfilp/Zicfiss) support on RV64 Linux.
+
* A new tunable, glibc.elf.thp, is added to map read-only segments with
Transparent Huge Pages (THP) if THP isn't disable in kernel. When
glibc.elf.thp is set to 1, malloc uses the actual kernel THP mode
@@ -814,6 +814,7 @@ enable_nscd
enable_pt_chown
enable_mathvec
enable_cet
+enable_cfi
enable_scv
enable_fortify_source
enable_sframe
@@ -1493,6 +1494,7 @@ Optional Features:
depends on architecture]
--enable-cet enable Intel Control-flow Enforcement Technology
(CET), x86 only
+ --enable-cfi enable Control Flow Integrity (CFI), RISC-V only
--disable-scv syscalls will not use scv instruction, even if the
kernel supports it, powerpc only
--enable-fortify-source[=1|2|3]
@@ -4813,6 +4815,16 @@ esac
fi
+# Check whether --enable-cfi was given.
+if test ${enable_cfi+y}
+then :
+ enableval=$enable_cfi; enable_cfi=$enableval
+else case e in #(
+ e) enable_cfi=no ;;
+esac
+fi
+
+
# Check whether --enable-scv was given.
if test ${enable_scv+y}
then :
@@ -393,6 +393,12 @@ AC_ARG_ENABLE([cet],
[enable_cet=$enableval],
[enable_cet=$libc_cv_compiler_default_cet])
+AC_ARG_ENABLE([cfi],
+ AS_HELP_STRING([--enable-cfi],
+ [enable Control Flow Integrity (CFI), RISC-V only]),
+ [enable_cfi=$enableval],
+ [enable_cfi=no])
+
AC_ARG_ENABLE([scv],
AS_HELP_STRING([--disable-scv],
[syscalls will not use scv instruction, even if the kernel supports it, powerpc only]),
@@ -185,6 +185,18 @@ non CET enabled shared library in CET enabled application.
NOTE: @option{--enable-cet} is only supported on x86_64 and x32.
+@item --enable-cfi
+Enable RISC-V Control Flow Integrity Extensions (Zicfilp/Zicfiss) support.
+When @theglibc{} is built with @option{--enable-cfi}, the resulting
+library is protected with landing pad and shadow stack@.
+This feature is currently supported on RV64 with GCC 15 and binutils 2.45
+or later. With @option{--enable-cfi}, it is an error to dlopen a non CFI
+enabled shared library in CFI enabled application. The restriction can be
+loosened by setting to permissive mode with the use of the glibc tunables,
+see glibc tunables section for more information.
+
+NOTE: @option{--enable-cfi} is only supported on RV64.
+
@item --disable-profile
Don't build libraries with profiling information. You may want to use
this option if you don't plan to do profiling.