[PATCH] gcc: enable branch protection by standard

[PATCH] gcc: enable branch protection by standard

[Ross Burton]

Pass --enable-standard-branch-protection.  This is an aarch64-specific
option (currently) which does nothing on other targets.  On aarch64 this
generates code uses BTI/PAC instructions to mitigate Return Orientated
Programming attacks.  This approach is backwards compatible and the code
size/performance impact is typically negliable.

More details can be found at
https://events.static.linuxfound.org/sites/events/files/slides/slides_23.pdf

Signed-off-by: Ross Burton <ross.burton@arm.com>
---
 meta/recipes-devtools/gcc/gcc-configure-common.inc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-devtools/gcc/gcc-configure-common.inc b/meta/recipes-devtools/gcc/gcc-configure-common.inc
index a64c4caf00..dc7f458b25 100644
--- a/meta/recipes-devtools/gcc/gcc-configure-common.inc
+++ b/meta/recipes-devtools/gcc/gcc-configure-common.inc
@@ -40,6 +40,7 @@ EXTRA_OECONF = "\
     ${@get_gcc_mips_plt_setting(bb, d)} \
     ${@get_gcc_ppc_plt_settings(bb, d)} \
     ${@get_gcc_multiarch_setting(bb, d)} \
+	--enable-standard-branch-protection \
 "
 
 # glibc version is a minimum controlling whether features are enabled. 
-- 
2.25.1

Re: [OE-core] [PATCH] gcc: enable branch protection by standard

[Khem Raj]

On 5/20/21 10:15 AM, Ross Burton wrote:
> Pass --enable-standard-branch-protection.  This is an aarch64-specific
> option (currently) which does nothing on other targets.  On aarch64 this
> generates code uses BTI/PAC instructions to mitigate Return Orientated
> Programming attacks.  This approach is backwards compatible and the code
> size/performance impact is typically negliable.
> 
> More details can be found at
> https://events.static.linuxfound.org/sites/events/files/slides/slides_23.pdf
> 
> Signed-off-by: Ross Burton <ross.burton@arm.com>
> ---
>   meta/recipes-devtools/gcc/gcc-configure-common.inc | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/meta/recipes-devtools/gcc/gcc-configure-common.inc b/meta/recipes-devtools/gcc/gcc-configure-common.inc
> index a64c4caf00..dc7f458b25 100644
> --- a/meta/recipes-devtools/gcc/gcc-configure-common.inc
> +++ b/meta/recipes-devtools/gcc/gcc-configure-common.inc
> @@ -40,6 +40,7 @@ EXTRA_OECONF = "\
>       ${@get_gcc_mips_plt_setting(bb, d)} \
>       ${@get_gcc_ppc_plt_settings(bb, d)} \
>       ${@get_gcc_multiarch_setting(bb, d)} \
> +	--enable-standard-branch-protection \
>   "
>  

lgtm


>   # glibc version is a minimum controlling whether features are enabled.
> 
> 
> 
> 
> 

Re: [OE-core] [PATCH] gcc: enable branch protection by standard

[Mikko Rapeli]

Hi,

On Thu, May 20, 2021 at 06:15:11PM +0100, Ross Burton wrote:
> Pass --enable-standard-branch-protection.  This is an aarch64-specific
> option (currently) which does nothing on other targets.  On aarch64 this
> generates code uses BTI/PAC instructions to mitigate Return Orientated
> Programming attacks.  This approach is backwards compatible and the code
> size/performance impact is typically negliable.
> 
> More details can be found at
> https://events.static.linuxfound.org/sites/events/files/slides/slides_23.pdf

Do you recommend this for dunfell and other stable releases? Any requirements
to gcc version? What about clang?

Cheers,

-Mikko

> Signed-off-by: Ross Burton <ross.burton@arm.com>
> ---
>  meta/recipes-devtools/gcc/gcc-configure-common.inc | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/meta/recipes-devtools/gcc/gcc-configure-common.inc b/meta/recipes-devtools/gcc/gcc-configure-common.inc
> index a64c4caf00..dc7f458b25 100644
> --- a/meta/recipes-devtools/gcc/gcc-configure-common.inc
> +++ b/meta/recipes-devtools/gcc/gcc-configure-common.inc
> @@ -40,6 +40,7 @@ EXTRA_OECONF = "\
>      ${@get_gcc_mips_plt_setting(bb, d)} \
>      ${@get_gcc_ppc_plt_settings(bb, d)} \
>      ${@get_gcc_multiarch_setting(bb, d)} \
> +	--enable-standard-branch-protection \
>  "
>
>  # glibc version is a minimum controlling whether features are enabled. 
> -- 
> 2.25.1
> 

> 
> 
> 

Re: [OE-core] [PATCH] gcc: enable branch protection by standard

[Khem Raj]

On 5/20/21 11:12 PM, Mikko Rapeli wrote:
> Hi,
> 
> On Thu, May 20, 2021 at 06:15:11PM +0100, Ross Burton wrote:
>> Pass --enable-standard-branch-protection.  This is an aarch64-specific
>> option (currently) which does nothing on other targets.  On aarch64 this
>> generates code uses BTI/PAC instructions to mitigate Return Orientated
>> Programming attacks.  This approach is backwards compatible and the code
>> size/performance impact is typically negliable.
>>
>> More details can be found at
>> https://events.static.linuxfound.org/sites/events/files/slides/slides_23.pdf
> 
> Do you recommend this for dunfell and other stable releases? Any requirements
> to gcc version? What about clang?

it can be backported to dunfell, but I would not recommend it unless we 
run whole set of testing.

clang does not have convenient configure switch like gcc, so you bring 
up a good point, if we added this via cmdline options instead via 
SECURITY_CFLAGS
then it will work homogeneously across clang and gcc, perhaps that might 
be a better approach as it will also extend to other prebuilt toolchains 
which may support this option but arent configured to default to them.

Ross, some thought might be needed.


> 
> Cheers,
> 
> -Mikko
> 
>> Signed-off-by: Ross Burton <ross.burton@arm.com>
>> ---
>>   meta/recipes-devtools/gcc/gcc-configure-common.inc | 1 +
>>   1 file changed, 1 insertion(+)
>>
>> diff --git a/meta/recipes-devtools/gcc/gcc-configure-common.inc b/meta/recipes-devtools/gcc/gcc-configure-common.inc
>> index a64c4caf00..dc7f458b25 100644
>> --- a/meta/recipes-devtools/gcc/gcc-configure-common.inc
>> +++ b/meta/recipes-devtools/gcc/gcc-configure-common.inc
>> @@ -40,6 +40,7 @@ EXTRA_OECONF = "\
>>       ${@get_gcc_mips_plt_setting(bb, d)} \
>>       ${@get_gcc_ppc_plt_settings(bb, d)} \
>>       ${@get_gcc_multiarch_setting(bb, d)} \
>> +	--enable-standard-branch-protection \
>>   "
>>   
>>   # glibc version is a minimum controlling whether features are enabled.
>> -- 
>> 2.25.1
>>
> 
>>
>>
>>
>>
>>
>> 
>>