Re: [OE-core] [PATCH] gcc: enable branch protection by standard

["Mikko Rapeli" <mikko.rapeli@bmw.de>]

Hi,

On Thu, May 20, 2021 at 06:15:11PM +0100, Ross Burton wrote:
> Pass --enable-standard-branch-protection.  This is an aarch64-specific
> option (currently) which does nothing on other targets.  On aarch64 this
> generates code uses BTI/PAC instructions to mitigate Return Orientated
> Programming attacks.  This approach is backwards compatible and the code
> size/performance impact is typically negliable.
> 
> More details can be found at
> https://events.static.linuxfound.org/sites/events/files/slides/slides_23.pdf

Do you recommend this for dunfell and other stable releases? Any requirements
to gcc version? What about clang?

Cheers,

-Mikko

> Signed-off-by: Ross Burton <ross.burton@arm.com>
> ---
>  meta/recipes-devtools/gcc/gcc-configure-common.inc | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/meta/recipes-devtools/gcc/gcc-configure-common.inc b/meta/recipes-devtools/gcc/gcc-configure-common.inc
> index a64c4caf00..dc7f458b25 100644
> --- a/meta/recipes-devtools/gcc/gcc-configure-common.inc
> +++ b/meta/recipes-devtools/gcc/gcc-configure-common.inc
> @@ -40,6 +40,7 @@ EXTRA_OECONF = "\
>      ${@get_gcc_mips_plt_setting(bb, d)} \
>      ${@get_gcc_ppc_plt_settings(bb, d)} \
>      ${@get_gcc_multiarch_setting(bb, d)} \
> +	--enable-standard-branch-protection \
>  "
>
>  # glibc version is a minimum controlling whether features are enabled. 
> -- 
> 2.25.1
> 

> 
> 
>