indirect branch tracking (IBT) and shadow stack (SHSTK). When CET
is enabled, the GNU C Library is compatible with all existing
executables and shared libraries. This feature is currently
- supported on i386, x86_64 and x32 with GCC 8 and binutils 2.29 or
- later. Note that when CET is enabled, the GNU C Library requires
- CPUs capable of multi-byte NOPs, like x86-64 processors as well as
- Intel Pentium Pro or newer. With ‘--enable-cet’, it is an error to
- dlopen a non CET enabled shared library in CET enabled application.
- With ‘--enable-cet=permissive’, CET is disabled when dlopening a
- non CET enabled shared library in CET enabled application.
-
- NOTE: ‘--enable-cet’ has been tested for i686, x86_64 and x32 on
- non-CET processors. ‘--enable-cet’ has been tested for i686,
- x86_64 and x32 on CET processors.
+ supported on x86_64 and x32 with GCC 8 and binutils 2.29 or later.
+ With ‘--enable-cet’, it is an error to dlopen a non CET enabled
+ shared library in CET enabled application. With
+ ‘--enable-cet=permissive’, CET is disabled when dlopening a non CET
+ enabled shared library in CET enabled application.
+
+ NOTE: ‘--enable-cet’ has been tested for x86_64 and x32 on non-CET
+ and CET processors.
‘--enable-memory-tagging’
Enable memory tagging support if the architecture supports it.
Major new features:
+* Sync with Linux kernel 6.6 shadow stack interface. Since only x86-64
+ is supported, --enable-cet is ignored for i386.
+
* struct statvfs now has an f_type member, equal to the f_type statfs member;
on the Hurd this was always available under a reserved name,
and under Linux a spare has been allocated: it was always zero
is protected with indirect branch tracking (IBT) and shadow stack
(SHSTK)@. When CET is enabled, @theglibc{} is compatible with all
existing executables and shared libraries. This feature is currently
-supported on i386, x86_64 and x32 with GCC 8 and binutils 2.29 or later.
-Note that when CET is enabled, @theglibc{} requires CPUs capable of
-multi-byte NOPs, like x86-64 processors as well as Intel Pentium Pro or
-newer. With @option{--enable-cet}, it is an error to dlopen a non CET
+supported on x86_64 and x32 with GCC 8 and binutils 2.29 or later.
+With @option{--enable-cet}, it is an error to dlopen a non CET
enabled shared library in CET enabled application. With
@option{--enable-cet=permissive}, CET is disabled when dlopening a
non CET enabled shared library in CET enabled application.
-NOTE: @option{--enable-cet} has been tested for i686, x86_64 and x32
-on non-CET processors. @option{--enable-cet} has been tested for
-i686, x86_64 and x32 on CET processors.
+NOTE: @option{--enable-cet} has been tested for x86_64 and x32
+on non-CET and CET processors.
@item --enable-memory-tagging
Enable memory tagging support if the architecture supports it. When
# This file is generated from configure.ac by Autoconf. DO NOT EDIT!
# Local configure fragment for sysdeps/i386.
+# CET is only supported for x86-64. Set enable-cet to "no" to allow
+# "ifneq ($(enable-cet),no)" in x86 Makefiles.
+config_vars="$config_vars
+enable-cet = "no""
+
# We no longer support i386 since it lacks the atomic instructions
# required to implement NPTL threading.
if test "$config_machine" = i386; then
GLIBC_PROVIDES dnl See aclocal.m4 in the top level source directory.
# Local configure fragment for sysdeps/i386.
+# CET is only supported for x86-64. Set enable-cet to "no" to allow
+# "ifneq ($(enable-cet),no)" in x86 Makefiles.
+LIBC_CONFIG_VAR([enable-cet], ["no"])
+
# We no longer support i386 since it lacks the atomic instructions
# required to implement NPTL threading.
if test "$config_machine" = i386; then
# This file is generated from configure.ac by Autoconf. DO NOT EDIT!
# Local configure fragment for sysdeps/x86.
-if test $enable_cet != no; then
- # Check if CET can be enabled.
- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether CET can be enabled" >&5
-printf %s "checking whether CET can be enabled... " >&6; }
-if test ${libc_cv_x86_cet_available+y}
-then :
- printf %s "(cached) " >&6
-else $as_nop
- cat > conftest.c <<EOF
-#if !defined __CET__ || __CET__ != 3
-# error CET isn't available.
-#endif
-EOF
- if { ac_try='${CC-cc} -c $CFLAGS -fcf-protection -include cet.h conftest.c 1>&5'
- { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_try\""; } >&5
- (eval $ac_try) 2>&5
- ac_status=$?
- printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; }; }; then
- libc_cv_x86_cet_available=yes
- else
- libc_cv_x86_cet_available=no
- fi
- rm -rf conftest*
-fi
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $libc_cv_x86_cet_available" >&5
-printf "%s\n" "$libc_cv_x86_cet_available" >&6; }
- if test $libc_cv_x86_cet_available != yes; then
- as_fn_error $? "$CC doesn't support CET" "$LINENO" 5
- fi
-fi
-if test $enable_cet != no; then
- # Check if assembler supports CET.
- { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether assembler supports CET" >&5
-printf %s "checking whether assembler supports CET... " >&6; }
-if test ${libc_cv_x86_cet_as+y}
-then :
- printf %s "(cached) " >&6
-else $as_nop
- cat > conftest.s <<EOF
- incsspd %ecx
-EOF
- if { ac_try='${CC-cc} -c $CFLAGS conftest.s -o conftest.o 1>&5'
- { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_try\""; } >&5
- (eval $ac_try) 2>&5
- ac_status=$?
- printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
- test $ac_status = 0; }; }; then
- libc_cv_x86_cet_as=yes
- else
- libc_cv_x86_cet_as=no
- fi
- rm -rf conftest*
-fi
-{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $libc_cv_x86_cet_as" >&5
-printf "%s\n" "$libc_cv_x86_cet_as" >&6; }
- if test $libc_cv_x86_cet_as = no; then
- as_fn_error $? "$AS doesn't support CET" "$LINENO" 5
- fi
-fi
-if test $enable_cet = yes; then
- printf "%s\n" "#define DEFAULT_DL_X86_CET_CONTROL cet_elf_property" >>confdefs.h
-
-elif test $enable_cet = permissive; then
- printf "%s\n" "#define DEFAULT_DL_X86_CET_CONTROL cet_permissive" >>confdefs.h
-
-fi
-config_vars="$config_vars
-enable-cet = $enable_cet"
-
# Check if linker supports x86 ISA level.
{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for linker x86 ISA level support" >&5
printf %s "checking for linker x86 ISA level support... " >&6; }
GLIBC_PROVIDES dnl See aclocal.m4 in the top level source directory.
# Local configure fragment for sysdeps/x86.
-if test $enable_cet != no; then
- # Check if CET can be enabled.
- AC_CACHE_CHECK(whether CET can be enabled,
- libc_cv_x86_cet_available, [dnl
-cat > conftest.c <<EOF
-#if !defined __CET__ || __CET__ != 3
-# error CET isn't available.
-#endif
-EOF
- if AC_TRY_COMMAND(${CC-cc} -c $CFLAGS -fcf-protection -include cet.h conftest.c 1>&AS_MESSAGE_LOG_FD); then
- libc_cv_x86_cet_available=yes
- else
- libc_cv_x86_cet_available=no
- fi
- rm -rf conftest*])
- if test $libc_cv_x86_cet_available != yes; then
- AC_MSG_ERROR([$CC doesn't support CET])
- fi
-fi
-if test $enable_cet != no; then
- # Check if assembler supports CET.
- AC_CACHE_CHECK(whether assembler supports CET,
- libc_cv_x86_cet_as, [dnl
-cat > conftest.s <<EOF
- incsspd %ecx
-EOF
- if AC_TRY_COMMAND(${CC-cc} -c $CFLAGS conftest.s -o conftest.o 1>&AS_MESSAGE_LOG_FD); then
- libc_cv_x86_cet_as=yes
- else
- libc_cv_x86_cet_as=no
- fi
- rm -rf conftest*])
- if test $libc_cv_x86_cet_as = no; then
- AC_MSG_ERROR([$AS doesn't support CET])
- fi
-fi
-if test $enable_cet = yes; then
- AC_DEFINE(DEFAULT_DL_X86_CET_CONTROL, cet_elf_property)
-elif test $enable_cet = permissive; then
- AC_DEFINE(DEFAULT_DL_X86_CET_CONTROL, cet_permissive)
-fi
-LIBC_CONFIG_VAR([enable-cet], [$enable_cet])
-
# Check if linker supports x86 ISA level.
AC_CACHE_CHECK([for linker x86 ISA level support],
libc_cv_include_x86_isa_level, [dnl
build_mathvec=yes
fi
+if test $enable_cet != no; then
+ # Check if CET can be enabled.
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether CET can be enabled" >&5
+printf %s "checking whether CET can be enabled... " >&6; }
+if test ${libc_cv_x86_cet_available+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
+ cat > conftest.c <<EOF
+#if !defined __CET__ || __CET__ != 3
+# error CET isn't available.
+#endif
+EOF
+ if { ac_try='${CC-cc} -c $CFLAGS -fcf-protection -include cet.h conftest.c 1>&5'
+ { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_try\""; } >&5
+ (eval $ac_try) 2>&5
+ ac_status=$?
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ test $ac_status = 0; }; }; then
+ libc_cv_x86_cet_available=yes
+ else
+ libc_cv_x86_cet_available=no
+ fi
+ rm -rf conftest*
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $libc_cv_x86_cet_available" >&5
+printf "%s\n" "$libc_cv_x86_cet_available" >&6; }
+ if test $libc_cv_x86_cet_available != yes; then
+ as_fn_error $? "$CC doesn't support CET" "$LINENO" 5
+ fi
+fi
+if test $enable_cet != no; then
+ # Check if assembler supports CET.
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether assembler supports CET" >&5
+printf %s "checking whether assembler supports CET... " >&6; }
+if test ${libc_cv_x86_cet_as+y}
+then :
+ printf %s "(cached) " >&6
+else $as_nop
+ cat > conftest.s <<EOF
+ incsspd %ecx
+EOF
+ if { ac_try='${CC-cc} -c $CFLAGS conftest.s -o conftest.o 1>&5'
+ { { eval echo "\"\$as_me\":${as_lineno-$LINENO}: \"$ac_try\""; } >&5
+ (eval $ac_try) 2>&5
+ ac_status=$?
+ printf "%s\n" "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5
+ test $ac_status = 0; }; }; then
+ libc_cv_x86_cet_as=yes
+ else
+ libc_cv_x86_cet_as=no
+ fi
+ rm -rf conftest*
+fi
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $libc_cv_x86_cet_as" >&5
+printf "%s\n" "$libc_cv_x86_cet_as" >&6; }
+ if test $libc_cv_x86_cet_as = no; then
+ as_fn_error $? "$AS doesn't support CET" "$LINENO" 5
+ fi
+fi
+if test $enable_cet = yes; then
+ printf "%s\n" "#define DEFAULT_DL_X86_CET_CONTROL cet_elf_property" >>confdefs.h
+
+elif test $enable_cet = permissive; then
+ printf "%s\n" "#define DEFAULT_DL_X86_CET_CONTROL cet_permissive" >>confdefs.h
+
+fi
+config_vars="$config_vars
+enable-cet = $enable_cet"
+
test -n "$critic_missing" && as_fn_error $? "
*** $critic_missing" "$LINENO" 5
build_mathvec=yes
fi
+if test $enable_cet != no; then
+ # Check if CET can be enabled.
+ AC_CACHE_CHECK(whether CET can be enabled,
+ libc_cv_x86_cet_available, [dnl
+cat > conftest.c <<EOF
+#if !defined __CET__ || __CET__ != 3
+# error CET isn't available.
+#endif
+EOF
+ if AC_TRY_COMMAND(${CC-cc} -c $CFLAGS -fcf-protection -include cet.h conftest.c 1>&AS_MESSAGE_LOG_FD); then
+ libc_cv_x86_cet_available=yes
+ else
+ libc_cv_x86_cet_available=no
+ fi
+ rm -rf conftest*])
+ if test $libc_cv_x86_cet_available != yes; then
+ AC_MSG_ERROR([$CC doesn't support CET])
+ fi
+fi
+if test $enable_cet != no; then
+ # Check if assembler supports CET.
+ AC_CACHE_CHECK(whether assembler supports CET,
+ libc_cv_x86_cet_as, [dnl
+cat > conftest.s <<EOF
+ incsspd %ecx
+EOF
+ if AC_TRY_COMMAND(${CC-cc} -c $CFLAGS conftest.s -o conftest.o 1>&AS_MESSAGE_LOG_FD); then
+ libc_cv_x86_cet_as=yes
+ else
+ libc_cv_x86_cet_as=no
+ fi
+ rm -rf conftest*])
+ if test $libc_cv_x86_cet_as = no; then
+ AC_MSG_ERROR([$AS doesn't support CET])
+ fi
+fi
+if test $enable_cet = yes; then
+ AC_DEFINE(DEFAULT_DL_X86_CET_CONTROL, cet_elf_property)
+elif test $enable_cet = permissive; then
+ AC_DEFINE(DEFAULT_DL_X86_CET_CONTROL, cet_permissive)
+fi
+LIBC_CONFIG_VAR([enable-cet], [$enable_cet])
+
test -n "$critic_missing" && AC_MSG_ERROR([
*** $critic_missing])
git://sourceware.org / glibc.git / commitdiff