diff mbox series

[v6,14/14] aarch64: add NEWS entry about branch protection support

Message ID 62a4294111ba2d06fdc1772fee65960e1cc02e5d.1593612309.git.szabolcs.nagy@arm.com
State Committed
Headers
Series aarch64: branch protection support |

Commit Message

Szabolcs Nagy July 1, 2020, 2:41 p.m. UTC 
  This is a new security feature that relies on architecture
extensions and needs glibc to be built with a gcc configured
with branch protection.
---
 NEWS | 12 ++++++++++++
 1 file changed, 12 insertions(+)

Comments

Adhemerval Zanella July 6, 2020, 6:41 p.m. UTC | #1 
On 01/07/2020 11:41, Szabolcs Nagy wrote:
> This is a new security feature that relies on architecture
> extensions and needs glibc to be built with a gcc configured
> with branch protection.
> ---
>  NEWS | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
> diff --git a/NEWS b/NEWS
> index a660fc59a8..7d0ca3f520 100644
> --- a/NEWS
> +++ b/NEWS
> @@ -31,6 +31,18 @@ Major new features:
>    pthread_attr_getsigmask_np have been added.  They allow applications
>    to specify the signal mask of a thread created with pthread_create.
>  
> +* AArch64 now supports standard branch protection security hardening
> +  in glibc when it is built with a GCC that is configured with
> +  --enable-standard-branch-protection. This includes branch target

Should we state that user can also set the required flags on compiler
specification as well (CC='gcc -mbranch-protection=pac-ret+bti -O2)?

> +  identification (BTI) and pointer authentication for return addresses
> +  (PAC-RET). They require armv8.5-a and armv8.3-a architecture

Two space after period.

> +  extensions respectively for the protection to be effective,
> +  otherwise the used instructions are nops. User code can use PAC-RET
> +  without libc support, but BTI requires a libc that is built with BTI
> +  support, otherwise runtime objects linked into user code will not be
> +  BTI compatible. It is recommended to use GCC 10 or newer when
> +  building glibc with branch protection.

Should we extend why gcc 10 is required here? This statement without much
explanation might raise some questioning. 

> +
>  Deprecated and removed features, and other changes affecting compatibility:
>  
>  * The deprecated <sys/sysctl.h> header and the sysctl function have been
>
Szabolcs Nagy July 8, 2020, 10:04 a.m. UTC | #2 
The 07/06/2020 15:41, Adhemerval Zanella wrote:
> On 01/07/2020 11:41, Szabolcs Nagy wrote:
> >  
> > +* AArch64 now supports standard branch protection security hardening
> > +  in glibc when it is built with a GCC that is configured with
> > +  --enable-standard-branch-protection. This includes branch target
> 
> Should we state that user can also set the required flags on compiler
> specification as well (CC='gcc -mbranch-protection=pac-ret+bti -O2)?

the gcc config option is the preferred way, explicit CC
setting may or may not work if the compiler internally
has to do something differently (such as building its
own runtime libs with bti support).

> > +  identification (BTI) and pointer authentication for return addresses
> > +  (PAC-RET). They require armv8.5-a and armv8.3-a architecture
> 
> Two space after period.

fixed throughout.

> > +  extensions respectively for the protection to be effective,
> > +  otherwise the used instructions are nops. User code can use PAC-RET
> > +  without libc support, but BTI requires a libc that is built with BTI
> > +  support, otherwise runtime objects linked into user code will not be
> > +  BTI compatible. It is recommended to use GCC 10 or newer when
> > +  building glibc with branch protection.
> 
> Should we extend why gcc 10 is required here? This statement without much
> explanation might raise some questioning. 

i removed the last sentence. (there were nasty bugs in gcc
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94697
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94514
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94515
which were fixed and backported, but instead of checking
if gcc-9 have them i thought it would be easier to just
recommend gcc 10 which always have the fixes. but i dont
think we need to go into details in the news entry.)
diff mbox series

Patch

diff --git a/NEWS b/NEWS
index a660fc59a8..7d0ca3f520 100644
--- a/NEWS
+++ b/NEWS
@@ -31,6 +31,18 @@  Major new features:
   pthread_attr_getsigmask_np have been added.  They allow applications
   to specify the signal mask of a thread created with pthread_create.
 
+* AArch64 now supports standard branch protection security hardening
+  in glibc when it is built with a GCC that is configured with
+  --enable-standard-branch-protection. This includes branch target
+  identification (BTI) and pointer authentication for return addresses
+  (PAC-RET). They require armv8.5-a and armv8.3-a architecture
+  extensions respectively for the protection to be effective,
+  otherwise the used instructions are nops. User code can use PAC-RET
+  without libc support, but BTI requires a libc that is built with BTI
+  support, otherwise runtime objects linked into user code will not be
+  BTI compatible. It is recommended to use GCC 10 or newer when
+  building glibc with branch protection.
+
 Deprecated and removed features, and other changes affecting compatibility:
 
 * The deprecated <sys/sysctl.h> header and the sysctl function have been