[PATCH v3 01/16] riscv: Add --enable-cfi option for controlling cfi features

[Jesse Huang]

---
 INSTALL             | 13 +++++++++++++
 NEWS                |  3 +++
 configure           | 12 ++++++++++++
 configure.ac        |  6 ++++++
 manual/install.texi | 12 ++++++++++++
 5 files changed, 46 insertions(+)

diff --git a/INSTALL b/INSTALL
index d3200f271f..476861b521 100644
--- a/INSTALL
+++ b/INSTALL
@@ -155,6 +155,19 @@ passed to 'configure'.  For example:
 
      NOTE: '--enable-cet' is only supported on x86_64 and x32.
 
+'--enable-cfi'
+     Enable RISC-V Control Flow Integrity Extensions (Zicfilp/Zicfiss)
+     support.  When the GNU C Library is built with '--enable-cfi', the
+     resulting library is protected with landing pad and shadow stack.
+     This feature is currently supported on RV64 with GCC 15 and
+     binutils 2.45 or later.  With '--enable-cfi', it is an error to
+     dlopen a non CFI enabled shared library in CFI enabled application.
+     The restriction can be loosen by setting to permissive mode with
+     the use of the glibc tunables, see glibc tunables section for more
+     information.
+
+     NOTE: '--enable-cfi' is only supported on RV64.
+
 '--enable-memory-tagging'
      Enable memory tagging support if the architecture supports it.
      When the GNU C Library is built with this option then the resulting
diff --git a/NEWS b/NEWS
index 521fbd5e07..02a39b05e4 100644
--- a/NEWS
+++ b/NEWS
@@ -21,6 +21,9 @@ Major new features:
 * The ISO C2Y family of unsigned abs functions, i.e.
   uabs, ulabs, ullabs and uimaxabs, are now supported.
 
+* Added --enable-cfi option to enable the RISC-V CFI extensions
+  (Zicfilp/Zicfiss) support on RV64 Linux.
+
 Deprecated and removed features, and other changes affecting compatibility:
 
 * The glibc.rtld.execstack now supports a compatibility mode to allow
diff --git a/configure b/configure
index 7cda641fce..5a996c8f25 100755
--- a/configure
+++ b/configure
@@ -818,6 +818,7 @@ enable_nscd
 enable_pt_chown
 enable_mathvec
 enable_cet
+enable_cfi
 enable_scv
 enable_fortify_source
 with_cpu
@@ -1499,6 +1500,7 @@ Optional Features:
                           depends on architecture]
   --enable-cet            enable Intel Control-flow Enforcement Technology
                           (CET), x86 only
+  --enable-cfi            enable Control Flow Integrity (CFI), RISC-V only
   --disable-scv           syscalls will not use scv instruction, even if the
                           kernel supports it, powerpc only
   --enable-fortify-source[=1|2|3]
@@ -4853,6 +4855,16 @@ esac
 fi
 
 
+# Check whether --enable-cfi was given.
+if test ${enable_cfi+y}
+then :
+  enableval=$enable_cfi; enable_cfi=$enableval
+else case e in #(
+  e) enable_cfi=no ;;
+esac
+fi
+
+
 # Check whether --enable-scv was given.
 if test ${enable_scv+y}
 then :
diff --git a/configure.ac b/configure.ac
index 0b0d8875cc..9bda3d1520 100644
--- a/configure.ac
+++ b/configure.ac
@@ -421,6 +421,12 @@ AC_ARG_ENABLE([cet],
 	      [enable_cet=$enableval],
 	      [enable_cet=$libc_cv_compiler_default_cet])
 
+AC_ARG_ENABLE([cfi],
+	      AS_HELP_STRING([--enable-cfi],
+			     [enable Control Flow Integrity (CFI), RISC-V only]),
+	      [enable_cfi=$enableval],
+	      [enable_cfi=no])
+
 AC_ARG_ENABLE([scv],
 	      AS_HELP_STRING([--disable-scv],
 			     [syscalls will not use scv instruction, even if the kernel supports it, powerpc only]),
diff --git a/manual/install.texi b/manual/install.texi
index 7fcdda9146..d3e7153365 100644
--- a/manual/install.texi
+++ b/manual/install.texi
@@ -185,6 +185,18 @@ non CET enabled shared library in CET enabled application.
 
 NOTE: @option{--enable-cet} is only supported on x86_64 and x32.
 
+@item --enable-cfi
+Enable RISC-V Control Flow Integrity Extensions (Zicfilp/Zicfiss) support.
+When @theglibc{} is built with @option{--enable-cfi}, the resulting
+library is protected with landing pad and shadow stack@. 
+This feature is currently supported on RV64 with GCC 15 and binutils 2.45
+or later. With @option{--enable-cfi}, it is an error to dlopen a non CFI
+enabled shared library in CFI enabled application.  The restriction can be
+loosen by setting to permissive mode with the use of the glibc tunables,
+see glibc tunables section for more information.
+
+NOTE: @option{--enable-cfi} is only supported on RV64.
+
 @item --enable-memory-tagging
 Enable memory tagging support if the architecture supports it.  When
 @theglibc{} is built with this option then the resulting library will
-- 
2.39.3