linux-kernel - Re: [PATCH v15 01/26] Documentation/x86: Add CET description

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4fad528b-e467-f96d-b7fb-9484fd975886@intel.com>
Date:   Mon, 30 Nov 2020 10:34:38 -0800
From:   "Yu, Yu-cheng" <yu-cheng.yu@...el.com>
To:     Nick Desaulniers <ndesaulniers@...gle.com>
Cc:     Dave.Martin@....com, arnd@...db.de, bp@...en8.de,
        bsingharora@...il.com, corbet@....net, dave.hansen@...ux.intel.com,
        esyr@...hat.com, fweimer@...hat.com, gorcunov@...il.com,
        hjl.tools@...il.com, hpa@...or.com, jannh@...gle.com,
        keescook@...omium.org, linux-api@...r.kernel.org,
        linux-arch@...r.kernel.org, linux-doc@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-mm@...ck.org, luto@...nel.org,
        mike.kravetz@...cle.com, mingo@...hat.com, nadav.amit@...il.com,
        oleg@...hat.com, pavel@....cz, pengfei.xu@...el.com,
        peterz@...radead.org, ravi.v.shankar@...el.com,
        rdunlap@...radead.org, tglx@...utronix.de,
        vedvyas.shanbhogue@...el.com, weijiang.yang@...el.com,
        x86@...nel.org, maskray@...gle.com, llozano@...gle.com,
        clang-built-linux@...glegroups.com, erich.keane@...el.com
Subject: Re: [PATCH v15 01/26] Documentation/x86: Add CET description

On 11/30/2020 10:26 AM, Nick Desaulniers wrote:
> (In response to https://lore.kernel.org/lkml/20201110162211.9207-2-yu-cheng.yu@intel.com/)
> 
>> These need to be enabled to build a CET-enabled kernel, and Binutils v2.31
>> and GCC v8.1 or later are required to build a CET kernel.
> 
> What about LLVM? Surely CrOS might be of interest to ship this on (we ship the
> equivalent for aarch64 on Android).
> 

I have not built with LLVM, but think it probably will work as well.  I 
will test it.

>> An application's CET capability is marked in its ELF header and can be
>> verified from the following command output, in the NT_GNU_PROPERTY_TYPE_0
>> field:
>>
>>      readelf -n <application> | grep SHSTK
>>          properties: x86 feature: IBT, SHSTK
> 
> Same for llvm-readelf.
> 

I will add that to the document.

Thanks,
Yu-cheng