aboutsummaryrefslogtreecommitdiff
path: root/INSTALL
diff options
context:
space:
mode:
authorH.J. Lu <hjl.tools@gmail.com>2020-04-27 15:44:07 -0700
committerH.J. Lu <hjl.tools@gmail.com>2020-05-18 08:38:53 -0700
commit9e38f455a6c602be86b7b5a8d6523cbdcd7ec051 (patch)
tree3fa62a570dd9ae651db62b21231a63358bd66edf /INSTALL
parentce12fc711387375d0248ab3ff9084fb958c43bc6 (diff)
downloadglibc-9e38f455a6c602be86b7b5a8d6523cbdcd7ec051.zip
glibc-9e38f455a6c602be86b7b5a8d6523cbdcd7ec051.tar.gz
glibc-9e38f455a6c602be86b7b5a8d6523cbdcd7ec051.tar.bz2
x86: Add --enable-cet=permissive
When CET is enabled, it is an error to dlopen a non CET enabled shared library in CET enabled application. It may be desirable to make CET permissive, that is disable CET when dlopening a non CET enabled shared library. With the new --enable-cet=permissive configure option, CET is disabled when dlopening a non CET enabled shared library. Add DEFAULT_DL_X86_CET_CONTROL to config.h.in: /* The default value of x86 CET control. */ #define DEFAULT_DL_X86_CET_CONTROL cet_elf_property which enables CET features based on ELF property note. --enable-cet=permissive it to /* The default value of x86 CET control. */ #define DEFAULT_DL_X86_CET_CONTROL cet_permissive which enables CET features permissively. Update tst-cet-legacy-5a, tst-cet-legacy-5b, tst-cet-legacy-6a and tst-cet-legacy-6b to check --enable-cet and --enable-cet=permissive.
Diffstat (limited to 'INSTALL')
-rw-r--r--INSTALL26
1 files changed, 15 insertions, 11 deletions
diff --git a/INSTALL b/INSTALL
index b7676d1..62e7872 100644
--- a/INSTALL
+++ b/INSTALL
@@ -123,20 +123,24 @@ if 'CFLAGS' is specified it must enable optimization. For example:
executables (PIE) by default.
'--enable-cet'
+'--enable-cet=permissive'
Enable Intel Control-flow Enforcement Technology (CET) support.
- When the GNU C Library is built with '--enable-cet', the resulting
- library is protected with indirect branch tracking (IBT) and shadow
- stack (SHSTK). When CET is enabled, the GNU C Library is
- compatible with all existing executables and shared libraries.
- This feature is currently supported on i386, x86_64 and x32 with
- GCC 8 and binutils 2.29 or later. Note that when CET is enabled,
- the GNU C Library requires CPUs capable of multi-byte NOPs, like
- x86-64 processors as well as Intel Pentium Pro or newer.
+ When the GNU C Library is built with '--enable-cet' or
+ '--enable-cet=permissive', the resulting library is protected with
+ indirect branch tracking (IBT) and shadow stack (SHSTK). When CET
+ is enabled, the GNU C Library is compatible with all existing
+ executables and shared libraries. This feature is currently
+ supported on i386, x86_64 and x32 with GCC 8 and binutils 2.29 or
+ later. Note that when CET is enabled, the GNU C Library requires
+ CPUs capable of multi-byte NOPs, like x86-64 processors as well as
+ Intel Pentium Pro or newer. With '--enable-cet', it is an error to
+ dlopen a non CET enabled shared library in CET enabled application.
+ With '--enable-cet=permissive', CET is disabled when dlopening a
+ non CET enabled shared library in CET enabled application.
NOTE: '--enable-cet' has been tested for i686, x86_64 and x32 on
- non-CET processors. '--enable-cet' has been tested for x86_64 and
- x32 on CET SDVs, but Intel CET support hasn't been validated for
- i686.
+ non-CET processors. '--enable-cet' has been tested for i686,
+ x86_64 and x32 on CET processors.
'--disable-profile'
Don't build libraries with profiling information. You may want to