[24/24] Intel CET: Document --enable-cet
Commit Message
On Mon, May 14, 2018 at 12:48 PM, Florian Weimer <fweimer@redhat.com> wrote:
> On 05/14/2018 09:45 PM, H.J. Lu wrote:
>>
>> Like this?
>
>
> Looks good, with one nit:
>
>> + (SHSTK). CET-enabled glibc is compatible with all existing
>
>
> Missing space after period.
>
>> +with indirect branch tracking (IBT) and shadow stack (SHSTK).
>> CET-enabled
>
>
> You need to write “(SHSTK)@.” to add the missing space.
>
Thanks for the tip. Here is the updated patch.
From 9b15e68f8d6b2217c56fcd66ed454ff78c5c1114 Mon Sep 17 00:00:00 2001
From: "H.J. Lu" <hjl.tools@gmail.com>
Date: Wed, 9 May 2018 08:28:29 -0700
Subject: [PATCH] Intel CET: Document --enable-cet
* NEWS: Mention --enable-cet.
* manual/install.texi: Document --enable-cet.
* INSTALL: Regenerated.
---
INSTALL | 11 +++++++++++
NEWS | 10 ++++++++++
manual/install.texi | 10 ++++++++++
3 files changed, 31 insertions(+)
@@ -106,6 +106,17 @@ if 'CFLAGS' is specified it must enable optimization. For example:
programs and tests are created as dynamic position independent
executables (PIE) by default.
+'--enable-cet'
+ Enable Intel Control-flow Enforcement Technology (CET) support.
+ When the library is built with -enable-cet, the resulting glibc is
+ protected with indirect branch tracking (IBT) and shadow stack
+ (SHSTK). CET-enabled glibc is compatible with all existing
+ executables and shared libraries. This feature is currently
+ supported on i386, x86_64 and x32 with GCC 8 and binutils 2.29 or
+ later. Note that CET-enabled glibc requires CPUs capable of
+ multi-byte NOPs, like x86-64 processors as well as Intel Pentium
+ Pro or newer.
+
'--disable-profile'
Don't build libraries with profiling information. You may want to
use this option if you don't plan to do profiling.
@@ -9,6 +9,16 @@ Version 2.28
Major new features:
+* The GNU C Library can now be compiled with support for Intel CET, AKA
+ Intel Control-flow Enforcement Technology. When the library is built
+ with --enable-cet, the resulting glibc is protected with indirect
+ branch tracking (IBT) and shadow stack (SHSTK). CET-enabled glibc is
+ compatible with all existing executables and shared libraries. This
+ feature is currently supported on i386, x86_64 and x32 with GCC 8 and
+ binutils 2.29 or later. Note that CET-enabled glibc requires CPUs
+ capable of multi-byte NOPs, like x86-64 processors as well as Intel
+ Pentium Pro or newer.
+
* <math.h> functions that round their results to a narrower type are added
from TS 18661-1:2014 and TS 18661-3:2015:
@@ -137,6 +137,16 @@ with no-pie. The resulting glibc can be used with the GCC option,
PIE. This option also implies that glibc programs and tests are created
as dynamic position independent executables (PIE) by default.
+@item --enable-cet
+Enable Intel Control-flow Enforcement Technology (CET) support. When
+the library is built with --enable-cet, the resulting glibc is protected
+with indirect branch tracking (IBT) and shadow stack (SHSTK)@. CET-enabled
+glibc is compatible with all existing executables and shared libraries.
+This feature is currently supported on i386, x86_64 and x32 with GCC 8 and
+binutils 2.29 or later. Note that CET-enabled glibc requires CPUs capable
+of multi-byte NOPs, like x86-64 processors as well as Intel Pentium Pro or
+newer.
+
@item --disable-profile
Don't build libraries with profiling information. You may want to use
this option if you don't plan to do profiling.
--
2.17.0