From patchwork Wed Jul 18 16:41:55 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "H.J. Lu" X-Patchwork-Id: 945833 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (mailfrom) smtp.mailfrom=sourceware.org (client-ip=209.132.180.131; helo=sourceware.org; envelope-from=libc-alpha-return-94435-incoming=patchwork.ozlabs.org@sourceware.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; secure) header.d=sourceware.org header.i=@sourceware.org header.b="mdR4hDou"; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="TgChzDXB"; dkim-atps=neutral Received: from sourceware.org (server1.sourceware.org [209.132.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 41W2xK3BRpz9s3Z for ; Thu, 19 Jul 2018 02:42:13 +1000 (AEST) DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:mime-version:from:date:message-id:subject:to :cc:content-type; q=dns; s=default; b=pmRlPsj74C9ZkzBdgEl5G/vtwC h/IwXnsZ3RXg8yHQQPwlT/MOTLEzSoSqbZAJvAWu02wnJzfWlZo5MPLq1mFOk0t+ Eev/+NY0b+GEXE7f5pbbOuqkGii9F4wN+YHvJUbGsJ4fODNf+7NAoxgdGM0nnwL5 FZHHpjkoUauAELCjg= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:mime-version:from:date:message-id:subject:to :cc:content-type; s=default; bh=9ZP7U+NLpieyloFtHnt1S81ILtQ=; b= mdR4hDoue59gb3u1e8T09eW9YX0qLzZLXpjPBc9fms9IuDkGQcks6o+sonPWytpg v0W1x7aLLuVNLPzaNEDddY6ng6PAys33PwgfGE+InK2DQgzJ65lvelv78uooXtXk YBmegs5jhIajSkD+Sdhap2XEuB6YOKYTPjjiH5+Sp+A= Received: (qmail 45715 invoked by alias); 18 Jul 2018 16:42:01 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 45573 invoked by uid 89); 18 Jul 2018 16:42:00 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-25.3 required=5.0 tests=AWL, BAYES_00, FREEMAIL_FROM, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, RCVD_IN_DNSWL_NONE, SPF_PASS autolearn=ham version=3.3.2 spammy= X-HELO: mail-oi0-f68.google.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:from:date:message-id:subject:to:cc; bh=nsiy/Qu/4LFZ1ibvdC9zB3b7SAI7Dm0GcU+rcfpuA6c=; b=TgChzDXBGahRANnp2AFk6rqw7H2dVh5KNp/++l7blA4boWF8kCVRcEDBQzbV9LqWAO IhlbmkJze/xI8h1RA4UpAB8dqAs2HrRSKi5LWux9qJuXvbrU+3evsSHNba+cBpSCgi+9 6xj6Ltn3SpNnCHlbBbOUAMPBiIdLEC1DoLPuSEQBjXxX1tDWy6V0too28WXZQj/zjDrx j3XjHiEef3M3cpfXpdj3EkKb/xwCpygNIrozIFA4+9NIRf6nVFaPSXXy1sDVRSZBxQ78 58H/O5NelLLfzM1gpmBjejDoxdrpdARI23P042iLmAo5u9y19vTmhEHYvtLyRrMMzwfJ i7LQ== MIME-Version: 1.0 From: "H.J. Lu" Date: Wed, 18 Jul 2018 09:41:55 -0700 Message-ID: Subject: V2 [PATCH 24/24] Intel CET: Document --enable-cet To: Rical Jasan Cc: GNU C Library , "Carlos O'Donell" , "Joseph S. Myers" On Tue, Jul 17, 2018 at 10:46 PM, Rical Jasan wrote: > On 07/17/2018 08:19 PM, H.J. Lu wrote: >> On Wed, Jun 13, 2018 at 8:32 AM, H.J. Lu wrote: > ... >>> diff --git a/NEWS b/NEWS >>> index d51fa09544..e914336557 100644 >>> --- a/NEWS >>> +++ b/NEWS >>> @@ -9,6 +9,16 @@ Version 2.28 >>> >>> Major new features: >>> >>> +* The GNU C Library can now be compiled with support for Intel CET, AKA >>> + Intel Control-flow Enforcement Technology. When the library is built >>> + with --enable-cet, the resulting glibc is protected with indirect >>> + branch tracking (IBT) and shadow stack (SHSTK). CET-enabled glibc is >>> + compatible with all existing executables and shared libraries. This >>> + feature is currently supported on i386, x86_64 and x32 with GCC 8 and >>> + binutils 2.29 or later. Note that CET-enabled glibc requires CPUs >>> + capable of multi-byte NOPs, like x86-64 processors as well as Intel >>> + Pentium Pro or newer. >>> + >>> * functions that round their results to a narrower type are added >>> from TS 18661-1:2014 and TS 18661-3:2015: >>> >>> diff --git a/manual/install.texi b/manual/install.texi >>> index 4bbbfcffa5..62aec719d7 100644 >>> --- a/manual/install.texi >>> +++ b/manual/install.texi >>> @@ -137,6 +137,16 @@ with no-pie. The resulting glibc can be used with the GCC option, >>> PIE. This option also implies that glibc programs and tests are created >>> as dynamic position independent executables (PIE) by default. >>> >>> +@item --enable-cet >>> +Enable Intel Control-flow Enforcement Technology (CET) support. When >>> +the library is built with --enable-cet, the resulting glibc is protected > > @option{--enable-cet} (else both dashes aren't preserved) Fixed. > @glibcadj{} wouldn't be right here because it's not an adjective, so it > would be better to reword the sentence: "When @theglibc{} is built with > @option{--enable-cet}, the resulting library ..." Fixed. >>> +with indirect branch tracking (IBT) and shadow stack (SHSTK)@. CET-enabled >>> +glibc is compatible with all existing executables and shared libraries. > > Similarly here; perhaps: "When CET is enabled, @theglibc{} ..." Fixed. >>> +This feature is currently supported on i386, x86_64 and x32 with GCC 8 and >>> +binutils 2.29 or later. Note that CET-enabled glibc requires CPUs capable > > Could reuse the same approach as above: "When CET is enabled, > @theglibc{} ..." Fixed. >>> +of multi-byte NOPs, like x86-64 processors as well as Intel Pentium Pro or >>> +newer. >>> + >>> @item --disable-profile >>> Don't build libraries with profiling information. You may want to use >>> this option if you don't plan to do profiling. >>> -- >>> 2.17.1 >>> >> >> PING. > > Note that I don't have the same objection to using "glibc" in the NEWS > entry as I do to using it in the manual. > Here is the updated patch. OK for trunk? Thanks. Reviewed-by: Carlos O'Donell From 36bc8d9755edfee0b28d4dd400431d08600b399c Mon Sep 17 00:00:00 2001 From: "H.J. Lu" Date: Wed, 9 May 2018 08:28:29 -0700 Subject: [PATCH] Intel CET: Document --enable-cet * NEWS: Mention --enable-cet. * manual/install.texi: Document --enable-cet. * INSTALL: Regenerated. --- INSTALL | 11 +++++++++++ NEWS | 10 ++++++++++ manual/install.texi | 11 +++++++++++ 3 files changed, 32 insertions(+) diff --git a/INSTALL b/INSTALL index 3c656fb7a6..844aa0f34c 100644 --- a/INSTALL +++ b/INSTALL @@ -106,6 +106,17 @@ if 'CFLAGS' is specified it must enable optimization. For example: programs and tests are created as dynamic position independent executables (PIE) by default. +'--enable-cet' + Enable Intel Control-flow Enforcement Technology (CET) support. + When the GNU C Library is built with '--enable-cet', the resulting + library is protected with indirect branch tracking (IBT) and shadow + stack (SHSTK). When CET is enabled, the GNU C Library is + compatible with all existing executables and shared libraries. + This feature is currently supported on i386, x86_64 and x32 with + GCC 8 and binutils 2.29 or later. Note that when CET is enabled, + the GNU C Library requires CPUs capable of multi-byte NOPs, like + x86-64 processors as well as Intel Pentium Pro or newer. + '--disable-profile' Don't build libraries with profiling information. You may want to use this option if you don't plan to do profiling. diff --git a/NEWS b/NEWS index c2896a7d93..daef815ae7 100644 --- a/NEWS +++ b/NEWS @@ -9,6 +9,16 @@ Version 2.28 Major new features: +* The GNU C Library can now be compiled with support for Intel CET, AKA + Intel Control-flow Enforcement Technology. When the library is built + with --enable-cet, the resulting glibc is protected with indirect + branch tracking (IBT) and shadow stack (SHSTK). CET-enabled glibc is + compatible with all existing executables and shared libraries. This + feature is currently supported on i386, x86_64 and x32 with GCC 8 and + binutils 2.29 or later. Note that CET-enabled glibc requires CPUs + capable of multi-byte NOPs, like x86-64 processors as well as Intel + Pentium Pro or newer. + * The GNU C Library now has correct support for ABSOLUTE symbols (SHN_ABS-relative symbols). Previously such ABSOLUTE symbols were relocated incorrectly or in some cases discarded. The GNU linker can diff --git a/manual/install.texi b/manual/install.texi index 42e9954199..3a87ac8bb5 100644 --- a/manual/install.texi +++ b/manual/install.texi @@ -137,6 +137,17 @@ with no-pie. The resulting glibc can be used with the GCC option, PIE. This option also implies that glibc programs and tests are created as dynamic position independent executables (PIE) by default. +@item --enable-cet +Enable Intel Control-flow Enforcement Technology (CET) support. When +@theglibc{} is built with @option{--enable-cet}, the resulting library +is protected with indirect branch tracking (IBT) and shadow stack +(SHSTK)@. When CET is enabled, @theglibc{} is compatible with all +existing executables and shared libraries. This feature is currently +supported on i386, x86_64 and x32 with GCC 8 and binutils 2.29 or later. +Note that when CET is enabled, @theglibc{} requires CPUs capable of +multi-byte NOPs, like x86-64 processors as well as Intel Pentium Pro or +newer. + @item --disable-profile Don't build libraries with profiling information. You may want to use this option if you don't plan to do profiling. -- 2.17.1