Fix branch protection also on Aarch64
Related: RHEL-58736
This commit is contained in:
Jakub Jelen
parent
617e4c5f4c
commit
60990da0cc
229
libgcrypt-1.11.0-pac-bti-protection.patch
Normal file
229
libgcrypt-1.11.0-pac-bti-protection.patch
Normal file
@ -0,0 +1,229 @@
|
||||
From afdd68b162103820edb72ad170f8ee26f206b396 Mon Sep 17 00:00:00 2001
|
||||
From: Jussi Kivilinna <jussi.kivilinna@iki.fi>
|
||||
Date: Sun, 4 Aug 2024 18:51:34 +0300
|
||||
Subject: [PATCH] Add PAC/BTI support for AArch64 assembly
|
||||
|
||||
* cipher/asm-common-aarch64.h (AARCH64_BTI_PROPERTY_FLAG)
|
||||
(AARCH64_HINT_BTI_C, AARCH64_PAC_PROPERTY_FLAG)
|
||||
(note.gnu.property): New.
|
||||
(CFI_STARTPROC): Add AARCH64_HINT_BTI_C.
|
||||
--
|
||||
|
||||
GnuPG-bug-id: 7220
|
||||
Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
|
||||
---
|
||||
cipher/asm-common-aarch64.h | 50 +++++++++++++++++++++++++++++++++++--
|
||||
1 file changed, 48 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/cipher/asm-common-aarch64.h b/cipher/asm-common-aarch64.h
|
||||
index 3a72d7c4..ff65ea6a 100644
|
||||
--- a/cipher/asm-common-aarch64.h
|
||||
+++ b/cipher/asm-common-aarch64.h
|
||||
@@ -45,9 +45,25 @@
|
||||
add reg, reg, #:lo12:name ;
|
||||
#endif
|
||||
|
||||
+#if defined(__ARM_FEATURE_BTI_DEFAULT) && __ARM_FEATURE_BTI_DEFAULT == 1
|
||||
+# define AARCH64_BTI_PROPERTY_FLAG (1 << 0)
|
||||
+# define AARCH64_HINT_BTI_C \
|
||||
+ hint #34
|
||||
+#else
|
||||
+# define AARCH64_BTI_PROPERTY_FLAG 0 /* No BTI */
|
||||
+# define AARCH64_HINT_BTI_C /*_*/
|
||||
+#endif
|
||||
+
|
||||
+#if defined(__ARM_FEATURE_PAC_DEFAULT) && (__ARM_FEATURE_PAC_DEFAULT & 3) != 0
|
||||
+/* PAC enabled, signed with either A or B key. */
|
||||
+# define AARCH64_PAC_PROPERTY_FLAG (1 << 1)
|
||||
+#else
|
||||
+# define AARCH64_PAC_PROPERTY_FLAG 0 /* No PAC */
|
||||
+#endif
|
||||
+
|
||||
#ifdef HAVE_GCC_ASM_CFI_DIRECTIVES
|
||||
/* CFI directives to emit DWARF stack unwinding information. */
|
||||
-# define CFI_STARTPROC() .cfi_startproc
|
||||
+# define CFI_STARTPROC() .cfi_startproc; AARCH64_HINT_BTI_C
|
||||
# define CFI_ENDPROC() .cfi_endproc
|
||||
# define CFI_REMEMBER_STATE() .cfi_remember_state
|
||||
# define CFI_RESTORE_STATE() .cfi_restore_state
|
||||
@@ -89,7 +105,7 @@
|
||||
DW_SLEB128_28BIT(rsp_offs)
|
||||
|
||||
#else
|
||||
-# define CFI_STARTPROC()
|
||||
+# define CFI_STARTPROC() AARCH64_HINT_BTI_C
|
||||
# define CFI_ENDPROC()
|
||||
# define CFI_REMEMBER_STATE()
|
||||
# define CFI_RESTORE_STATE()
|
||||
@@ -129,4 +145,34 @@
|
||||
ldp d8, d9, [sp], #16; \
|
||||
CFI_ADJUST_CFA_OFFSET(-16);
|
||||
|
||||
+#if (AARCH64_BTI_PROPERTY_FLAG | AARCH64_PAC_PROPERTY_FLAG)
|
||||
+/* Generate PAC/BTI property for all assembly files including this header.
|
||||
+ *
|
||||
+ * libgcrypt support these extensions:
|
||||
+ * - Armv8.3-A Pointer Authentication (PAC):
|
||||
+ * As currently all AArch64 assembly functions are leaf functions and do
|
||||
+ * not store/load link register LR, we just mark PAC as supported.
|
||||
+ *
|
||||
+ * - Armv8.5-A Branch Target Identification (BTI):
|
||||
+ * All AArch64 assembly functions get branch target instruction through
|
||||
+ * CFI_STARTPROC macro.
|
||||
+ */
|
||||
+ELF(.section .note.gnu.property,"a")
|
||||
+ELF(.balign 8)
|
||||
+ELF(.long 1f - 0f)
|
||||
+ELF(.long 4f - 1f)
|
||||
+ELF(.long 5)
|
||||
+ELF(0:)
|
||||
+ELF(.byte 0x47, 0x4e, 0x55, 0) /* string "GNU" */
|
||||
+ELF(1:)
|
||||
+ELF(.balign 8)
|
||||
+ELF(.long 0xc0000000)
|
||||
+ELF(.long 3f - 2f)
|
||||
+ELF(2:)
|
||||
+ELF(.long (AARCH64_BTI_PROPERTY_FLAG | AARCH64_PAC_PROPERTY_FLAG))
|
||||
+ELF(3:)
|
||||
+ELF(.balign 8)
|
||||
+ELF(4:)
|
||||
+#endif
|
||||
+
|
||||
#endif /* GCRY_ASM_COMMON_AARCH64_H */
|
||||
--
|
||||
2.43.0
|
||||
|
||||
From 07706d69f238f6a3bfc3f74145686a02decbee9c Mon Sep 17 00:00:00 2001
|
||||
From: Jussi Kivilinna <jussi.kivilinna@iki.fi>
|
||||
Date: Mon, 5 Aug 2024 20:18:05 +0300
|
||||
Subject: [PATCH] Do not build 32-bit ARM assembly on Aarch64
|
||||
|
||||
* configure.ac: Build "serpent-armv7-neon", "salsa20-armv7-neon",
|
||||
"chacha20-armv7-neon", "sha512-armv7-neon" and "keccak-armv7-neon"
|
||||
only on 32-bit ARM.
|
||||
--
|
||||
|
||||
GnuPG-bug-id: 7220
|
||||
Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>
|
||||
---
|
||||
configure.ac | 54 ++++++++++++++++++++++++++++------------------------
|
||||
1 file changed, 29 insertions(+), 25 deletions(-)
|
||||
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index 191aa38d..2b6ddb7b 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -3139,17 +3139,18 @@ if test "$found" = "1" ; then
|
||||
GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-avx2-amd64.lo"
|
||||
fi
|
||||
;;
|
||||
+ arm*-*-*)
|
||||
+ if test x"$neonsupport" = xyes ; then
|
||||
+ # Build with the NEON implementation
|
||||
+ GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-armv7-neon.lo"
|
||||
+ fi
|
||||
+ ;;
|
||||
esac
|
||||
|
||||
if test x"$avx512support" = xyes ; then
|
||||
# Build with the AVX512 implementation
|
||||
GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-avx512-x86.lo"
|
||||
fi
|
||||
-
|
||||
- if test x"$neonsupport" = xyes ; then
|
||||
- # Build with the NEON implementation
|
||||
- GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS serpent-armv7-neon.lo"
|
||||
- fi
|
||||
fi
|
||||
|
||||
LIST_MEMBER(rfc2268, $enabled_ciphers)
|
||||
@@ -3230,12 +3231,13 @@ if test "$found" = "1" ; then
|
||||
# Build with the assembly implementation
|
||||
GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS salsa20-amd64.lo"
|
||||
;;
|
||||
+ arm*-*-*)
|
||||
+ if test x"$neonsupport" = xyes ; then
|
||||
+ # Build with the NEON implementation
|
||||
+ GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS salsa20-armv7-neon.lo"
|
||||
+ fi
|
||||
+ ;;
|
||||
esac
|
||||
-
|
||||
- if test x"$neonsupport" = xyes ; then
|
||||
- # Build with the NEON implementation
|
||||
- GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS salsa20-armv7-neon.lo"
|
||||
- fi
|
||||
fi
|
||||
|
||||
LIST_MEMBER(gost28147, $enabled_ciphers)
|
||||
@@ -3256,6 +3258,12 @@ if test "$found" = "1" ; then
|
||||
GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS chacha20-amd64-avx2.lo"
|
||||
GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS chacha20-amd64-avx512.lo"
|
||||
;;
|
||||
+ arm*-*-*)
|
||||
+ if test x"$neonsupport" = xyes ; then
|
||||
+ # Build with the NEON implementation
|
||||
+ GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS chacha20-armv7-neon.lo"
|
||||
+ fi
|
||||
+ ;;
|
||||
aarch64-*-*)
|
||||
# Build with the assembly implementation
|
||||
GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS chacha20-aarch64.lo"
|
||||
@@ -3282,11 +3290,6 @@ if test "$found" = "1" ; then
|
||||
GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS chacha20-s390x.lo"
|
||||
;;
|
||||
esac
|
||||
-
|
||||
- if test x"$neonsupport" = xyes ; then
|
||||
- # Build with the NEON implementation
|
||||
- GCRYPT_ASM_CIPHERS="$GCRYPT_ASM_CIPHERS chacha20-armv7-neon.lo"
|
||||
- fi
|
||||
fi
|
||||
|
||||
LIST_MEMBER(sm4, $enabled_ciphers)
|
||||
@@ -3491,6 +3494,11 @@ if test "$found" = "1" ; then
|
||||
arm*-*-*)
|
||||
# Build with the assembly implementation
|
||||
GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS sha512-arm.lo"
|
||||
+
|
||||
+ if test x"$neonsupport" = xyes ; then
|
||||
+ # Build with the NEON implementation
|
||||
+ GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS sha512-armv7-neon.lo"
|
||||
+ fi
|
||||
;;
|
||||
aarch64-*-*)
|
||||
# Build with the assembly implementation
|
||||
@@ -3510,11 +3518,6 @@ if test "$found" = "1" ; then
|
||||
# Build with the crypto extension implementation
|
||||
GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS sha512-ppc.lo"
|
||||
esac
|
||||
-
|
||||
- if test x"$neonsupport" = xyes ; then
|
||||
- # Build with the NEON implementation
|
||||
- GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS sha512-armv7-neon.lo"
|
||||
- fi
|
||||
fi
|
||||
|
||||
LIST_MEMBER(sha3, $enabled_digests)
|
||||
@@ -3527,12 +3530,13 @@ if test "$found" = "1" ; then
|
||||
# Build with the assembly implementation
|
||||
GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS keccak-amd64-avx512.lo"
|
||||
;;
|
||||
+ arm*-*-*)
|
||||
+ if test x"$neonsupport" = xyes ; then
|
||||
+ # Build with the NEON implementation
|
||||
+ GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS keccak-armv7-neon.lo"
|
||||
+ fi
|
||||
+ ;;
|
||||
esac
|
||||
-
|
||||
- if test x"$neonsupport" = xyes ; then
|
||||
- # Build with the NEON implementation
|
||||
- GCRYPT_ASM_DIGESTS="$GCRYPT_ASM_DIGESTS keccak-armv7-neon.lo"
|
||||
- fi
|
||||
fi
|
||||
|
||||
LIST_MEMBER(tiger, $enabled_digests)
|
||||
--
|
||||
2.43.0
|
||||
|
||||
@ -28,6 +28,7 @@ Patch2: libgcrypt-1.11.0-Disable-SHA3-s390x-acceleration-for-CSHAKE.patch
|
||||
Patch3: libgcrypt-1.11.0-covscan.patch
|
||||
# https://dev.gnupg.org/T7220
|
||||
Patch4: libgcrypt-1.11.0-cf-protection.patch
|
||||
Patch5: libgcrypt-1.11.0-pac-bti-protection.patch
|
||||
|
||||
%global gcrylibdir %{_libdir}
|
||||
%global gcrysoname libgcrypt.so.20
|
||||
@ -65,6 +66,7 @@ applications using libgcrypt.
|
||||
%patch 2 -p1
|
||||
%patch 3 -p1
|
||||
%patch 4 -p1
|
||||
%patch 5 -p1
|
||||
|
||||
%build
|
||||
# should be all algorithms except SM3 and SM4, aria
|
||||
|
||||
Loading…
Reference in New Issue
Block a user