Skip to content

Commit ce3e2dd

Browse files
committed
Add options for enable code gen with CFI -fcf-protection=[full|branch|return|none] and -mcf-label-scheme=[simple|func-sig]
Resue the options defined by X86 CET, `-fcf-protection=[full|branch|return|none]` `-fcf-protection=branch` for landing pad (`Zicfilp`), `-fcf-protection=return` for landing pad (`Zicfiss`) and `-fcf-protection=full` for enable both if possible, landing pad just require instrcution defined by base extension, so compiler will emit landing pad even without `Zicfilp` extension, but `-fcf-protection=return` will require at least `Zimop` since the instrcution isn't included in base extension. Also we defined another option for specify the labeling scheme: `simple` and `func-sig`. The `simple` scheme is always use `lpad 0`, and `func-sig` is based on the function signature, the rule is defined in psABI.
1 parent e207d2e commit ce3e2dd

File tree

1 file changed

+22
-0
lines changed

1 file changed

+22
-0
lines changed

README.mkd

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -445,6 +445,28 @@ NOTE: This option does not affect inline assembly.
445445
The precedence among `-m[no]-scalar-strict-align`, `-m[no-]vector-strict-align`,
446446
and `-m[no-]strict-align` is determined by the last one specified.
447447

448+
### `-fcf-protection=[full|branch|return|none]`/`-fcf-protection`
449+
450+
Enable control flow protection. The compiler will insert control flow integrity
451+
instructions to protect the program against control flow hijacking attacks.
452+
453+
`-fcf-protection` is alias to `-fcf-protection=full`.
454+
455+
- `none`: Disable control flow protection.
456+
- `full`: Protect all control flow instructions, will enable branch protection
457+
and return protection if the `Zimop` extension is available.
458+
- `branch`: Protect branch instructions only by insert landing pad.
459+
- `return`: Protect branch instructions only, this require `Zimop` extension.
460+
461+
### `-mcf-label-scheme=[simple|func-sig]`
462+
463+
Specify the label scheme for the `-fcf-protectio=branch`. The default is value
464+
is platform defined.
465+
466+
- `simple`: Use simple label scheme, the label is always `0`.
467+
- `func-sig`: Use function signature as the label, the label is generated by the
468+
compiler, the rule is defined in psABI spec.
469+
448470
## TODO
449471

450472
* `-mdiv`, `-mno-div`, `-mfdiv`, `-mno-fdiv`, `-msave-restore`,

0 commit comments

Comments
 (0)