[PATCH v5 00/16] Support RISC-V Control Flow Integrifty (CFI)
Andreas K. Huettel
dilfridge@gentoo.org
Tue Jun 30 13:15:19 GMT 2026
Am Sonntag, 28. Juni 2026, 16:02:25 Japanische Normalzeit schrieb Jesse Huang:
> This patch series adds support for the new RISC-V Control Flow Integrity (CFI)
> extensions, i.e. Zicfilp and Zicfiss, as described in the following sections
> of the RISC-V Instruction Set Manual:
>
> - Volume I, Chapter 33
> - Volume II, Chapter 22
>
Let's figure this out after the release please.
>
> Our implementation largely refers to the existing x86 CET code, and we would
> like to thank the developers for their work.
>
> Summary of Changes
> ------------------
>
> 1) New Option for the Build System
>
> A new '--enable-cfi' configure option is introduced to control whether
> CFI-related features are enabled. It appends the '-fcf-protection=full'
> compiler flag to all source files.
>
> 2) Adjustment to Assembly Code
>
> While compiler automatically do the job for C source files, assembly files
> and routines are requiring manual modifications
> - Insert GNU property notes and landing pad, label setting instructions
> into assembly files and routines
> - Replace indirect branches with software-guarded branches where applicable
> - Extend setjmp/longjmp to support for the shadow stack by storing the
> shadow stack pointer (SSP) to a new union __ssp_sigset_arch_t, that wraps
> the original sigset_t and a new __ssp_sigset_t that shrinks the mask size
> to make spaces for storing SSP and SSP base, and handling the
> save/restore/unwinding logic
>
> 3) Parse GNU Property Notes and Setup the Environment
>
> The loader scans the GNU_PROPERTY_RISCV_FEATURE_1_AND note and parses the
> bits specified by the binary to determine the required CFI features, it
> then performs checks on all dependencies, and uses new prctl operations
> to call to the kernel to do the setup work.
>
> 4) Add Tunables for Overriding Runtime Behavior
>
> Two new tunables are introduced:
> - glibc.cpu.riscv_cfi_lp
> - glibc.cpu.riscv_cfi_ss
>
> These control landing pad and shadow stack behavior at runtime,
> respectively. Each accepts 'on|permissive|off' for its value, which is
> same as x86.
>
> 5. Store shadow stack information in TLS to support ucontext
>
> We make the following structure changes to support the ucontext library
> - A new helper function `__allocate_shadow_stack` to map a new shadow stack
> Shadow stack size for the new context is based on an estimation from the
> runtime stack size, which is same to the implementation of x86.
> - Store ssp and shadow stack base marker in TLS
> - Change the type of uc_sigmask in ucontext_t to __ssp_sigset_arch_t, in that
> we can make use of the space for storing ssp and shadow stack base
> that is also used by jmp_buf
>
> Changes from V1
> --------------------
> - The new option '--enable-cfi' gets a descrition in install.texi and
> an entry in NEWS
> - Update prctl numbers of landing pad
> - Re-implement ucontext using shadow stack restore token techniques
> - Change makecontext to use the `map_shadow_stack` syscall
>
> Changes from V2
> --------------------
> - Use indirect jump instead of return in __longjmp if CFI is enabled
> - Add __INDIRECT_RETURN attribute to swapcontext, which instructs the
> compiler to insert a LPAD after the function callsite, so that we can
> use CFI-guarded indirect jump for context swtiching. Compiler would
> need to be updated to support this attribute for it to work
> - Remove SSP from jmp_buf, stored it into a new union __ssp_sigset_arch_t
> that holds a original sigset_t and the shrinked sigset_t with ssp and
> ssp_base, so that we won't affect the size of jmp_buf or sigset_t
> - SSP field in ucontext_t is also moved into the uc_sigmask that is of
> type __ssp_sigset_arch_t
>
> Changes from V3
> --------------------
> - Fixed the offset used for accessing ssp in TLS that was incorrect
> - Make setjmp/longjmp capable of handling inter-ucontext jumps
> - Switch to the new prctl option numbers that was introduced in Linux
> 7.0
>
> Changes from V4
> --------------------
> - Fixed several typos and commit messages that does not reflect the
> newest version of the patch
> - The patch for updating prctl option numbers is squashed
> - ENTRY() and LEAF() macros now inserts LPAD so no longer need to
> manually modify the assembly functions defined with these macros and
> their derivatives
>
> Jesse Huang (16):
> riscv: Add --enable-cfi option for controlling CFI features
> riscv/cfi: Set up necessary options for --enable-cfi
> riscv: Add GNU property definitions for RISC-V CFI
> riscv: Adjust assembly routines to support landing pad
> riscv: Introduce feature variables for RISC-V GNU properties
> riscv/cfi: Add prctl definitions for RISC-V CFI
> riscv/cfi: Enable CFI on static binaries
> riscv/cfi: Enable CFI on dynamic binaries
> riscv/cfi: Introduce tunables for CFI features
> riscv/cfi: Adjust setjmp/longjmp for shadow stack to work
> riscv/cfi: Support locking/disabling CFI and move OS dependent code
> riscv/cfi: Store shadow stack information in TLS
> riscv/cfi: Add internal sigset_t union and use it for both
> ucontext/jmpbuf
> riscv/cfi: Add __allocate_shadow_stack for mapping new shadow stack
> riscv/cfi: Support ucontext under CFI
> riscv/cfi: Add __INDIRECT_RETURN attribute to swapcontext
>
> INSTALL | 13 +
> NEWS | 3 +
> configure | 12 +
> configure.ac | 6 +
> elf/elf.h | 5 +
> manual/install.texi | 12 +
> manual/tunables.texi | 22 ++
> sysdeps/riscv/Makefile | 17 +-
> sysdeps/riscv/__longjmp.S | 54 +++
> sysdeps/riscv/bits/indirect-return.h | 36 ++
> sysdeps/riscv/cpu-features.c | 46 +++
> sysdeps/riscv/cpu-tunables.c | 50 +++
> sysdeps/riscv/crti.S | 4 +
> sysdeps/riscv/crtn.S | 4 +
> sysdeps/riscv/dl-cfi.c | 317 ++++++++++++++++++
> sysdeps/riscv/dl-get-cpu-features.c | 27 ++
> sysdeps/riscv/dl-machine.h | 35 ++
> sysdeps/riscv/dl-procruntime.c | 77 +++++
> sysdeps/riscv/dl-prop.h | 74 ++++
> sysdeps/riscv/dl-trampoline.S | 41 +--
> sysdeps/riscv/dl-tunables.list | 27 ++
> sysdeps/riscv/feature-control.h | 42 +++
> sysdeps/riscv/features-offsets.sym | 5 +
> sysdeps/riscv/ldsodefs.h | 1 +
> sysdeps/riscv/libc-start.c | 31 ++
> sysdeps/riscv/libc-start.h | 95 ++++++
> sysdeps/riscv/link_map.h | 22 ++
> sysdeps/riscv/nptl/Makefile | 1 +
> sysdeps/riscv/nptl/tcb-offsets.sym | 5 +
> sysdeps/riscv/nptl/tls.h | 2 +
> sysdeps/riscv/preconfigure | 2 +
> sysdeps/riscv/preconfigure.ac | 1 +
> sysdeps/riscv/setjmp.S | 22 ++
> sysdeps/riscv/start.S | 9 +
> sysdeps/riscv/sys/asm.h | 12 +-
> sysdeps/unix/sysv/linux/riscv/Makefile | 1 +
> .../sysv/linux/riscv/allocate-shadow-stack.c | 59 ++++
> .../sysv/linux/riscv/allocate-shadow-stack.h | 31 ++
> sysdeps/unix/sysv/linux/riscv/bits/mman.h | 30 ++
> .../sysv/linux/riscv/bits/types/__sigset_t.h | 43 +++
> sysdeps/unix/sysv/linux/riscv/clone.S | 1 +
> sysdeps/unix/sysv/linux/riscv/dl-cfi.h | 116 +++++++
> sysdeps/unix/sysv/linux/riscv/getcontext.S | 20 ++
> .../unix/sysv/linux/riscv/include/asm/prctl.h | 43 +++
> sysdeps/unix/sysv/linux/riscv/jmp_buf-ssp.sym | 7 +
> sysdeps/unix/sysv/linux/riscv/makecontext.c | 19 ++
> sysdeps/unix/sysv/linux/riscv/setcontext.S | 67 ++++
> sysdeps/unix/sysv/linux/riscv/setjmpP.h | 49 +++
> sysdeps/unix/sysv/linux/riscv/swapcontext.S | 81 ++++-
> sysdeps/unix/sysv/linux/riscv/sys/ucontext.h | 14 +-
> sysdeps/unix/sysv/linux/riscv/sysdep.h | 71 ++++
> sysdeps/unix/sysv/linux/riscv/ucontext_i.sym | 4 +-
> 52 files changed, 1763 insertions(+), 25 deletions(-)
> create mode 100644 sysdeps/riscv/bits/indirect-return.h
> create mode 100644 sysdeps/riscv/cpu-features.c
> create mode 100644 sysdeps/riscv/cpu-tunables.c
> create mode 100644 sysdeps/riscv/crti.S
> create mode 100644 sysdeps/riscv/crtn.S
> create mode 100644 sysdeps/riscv/dl-cfi.c
> create mode 100644 sysdeps/riscv/dl-get-cpu-features.c
> create mode 100644 sysdeps/riscv/dl-procruntime.c
> create mode 100644 sysdeps/riscv/dl-prop.h
> create mode 100644 sysdeps/riscv/dl-tunables.list
> create mode 100644 sysdeps/riscv/feature-control.h
> create mode 100644 sysdeps/riscv/features-offsets.sym
> create mode 100644 sysdeps/riscv/libc-start.c
> create mode 100644 sysdeps/riscv/libc-start.h
> create mode 100644 sysdeps/riscv/link_map.h
> create mode 100644 sysdeps/riscv/nptl/Makefile
> create mode 100644 sysdeps/riscv/nptl/tcb-offsets.sym
> create mode 100644 sysdeps/unix/sysv/linux/riscv/allocate-shadow-stack.c
> create mode 100644 sysdeps/unix/sysv/linux/riscv/allocate-shadow-stack.h
> create mode 100644 sysdeps/unix/sysv/linux/riscv/bits/mman.h
> create mode 100644 sysdeps/unix/sysv/linux/riscv/bits/types/__sigset_t.h
> create mode 100644 sysdeps/unix/sysv/linux/riscv/dl-cfi.h
> create mode 100644 sysdeps/unix/sysv/linux/riscv/include/asm/prctl.h
> create mode 100644 sysdeps/unix/sysv/linux/riscv/jmp_buf-ssp.sym
> create mode 100644 sysdeps/unix/sysv/linux/riscv/setjmpP.h
>
>
--
PD Dr. Andreas K. Hüttel
dilfridge@gentoo.org
Gentoo Linux developer
(council, comrel, toolchain, base-system, perl, libreoffice)
https://wiki.gentoo.org/wiki/User:Dilfridge
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 870 bytes
Desc: This is a digitally signed message part.
URL: <https://sourceware.org/pipermail/libc-alpha/attachments/20260630/79743bfd/attachment.sig>
More information about the Libc-alpha
mailing list