package/glibc: optional MTE support in glibc
PATCH 1/1 package/glibc: optional MTE support in glibc
Adding option BR2_PACKAGE_GLIBC_MTE to configure glibc with MTE support. When enabled, glibcs configuration process runs with --enable-memory-tagging [1].
MTE (Memory Tagging Extension) is an ISA extension which aims to improve security on ARMv8.5-A [2]. The linux kernel supports this feature via CONFIG_ARM64_MTE.
In order for glibc's MTE support to work properly, the running kernel has to support that.
dependencies:
- supported on aarch64 only (BR2_aarch64)
- requires binutils version 2.33.1 or newer (!B2_BINUTILS_VERSION_2_32_X)
- requires at least linux 5.4 headers (BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_4)
[1] https://sourceware.org/git/?p=glibc.git;a=blob;f=INSTALL;h=02dcf6b1ca3a4c43a17fdcae5e7dae8189c1c50b;hb=HEAD#l145
[2] https://community.arm.com/developer/ip-products/processors/b/processors-ip-blog/posts/enhancing-memory-safety
--- package/glibc/Config.in | 12 ++++++++++++ package/glibc/glibc.mk | 1 + 2 files changed, 13 insertions(+)
package/glibc/Config.in +12 -0
@@ -16,4 +16,16 @@ config BR2_PACKAGE_GLIBC_UTILS Enabling this option will compile and install the getconf, ldconfig, ldd and locale glibc utilities for the target. +config BR2_PACKAGE_GLIBC_MTE + bool "Install glibc support for MTE" + depends on BR2_aarch64 + depends on !BR2_BINUTILS_VERSION_2_32_X + depends on BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_4 + help + Enabling this option will configure, compile + and install glibc support for MTE (Memory Tagging Extension). + Please be aware, in order for that to work properly, + kernel support for MTE (CONFIG_ARM64_MTE), and a + supported CPU are needed. + endif # BR2_TOOLCHAIN_BUILDROOT_GLIBC
package/glibc/glibc.mk +1 -0
@@ -124,6 +124,7 @@ define GLIBC_CONFIGURE_CMDS --disable-werror \ --without-gd \ --enable-kernel=$(call qstrip,$(BR2_TOOLCHAIN_HEADERS_AT_LEAST)) \ + $(if $(BR2_PACKAGE_GLIBC_MTE),--enable-memory-tagging) \ --with-headers=$(STAGING_DIR)/usr/include) $(GLIBC_ADD_MISSING_STUB_H) endef
Signature · 6 lines
2.25.1 _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Hello,
Thanks a lot for your contribution! See below some comments.
Quoted 6 lines · On Sat, 30 Oct 2021 11:37:50 +0300 "[email protected]" <[email protected]> wrote:
Adding option
BR2_PACKAGE_GLIBC_MTEto configure glibc with MTE support. When enabled, glibcs configuration process runs with--enable-memory-tagging[1].MTE (Memory Tagging Extension) is an ISA extension which aims to improve security on ARMv8.5-A [2]. The linux kernel supports this feature via
CONFIG_ARM64_MTE.
In order for glibc's MTE support to work properly, the running kernel has to support that.
Could you wrap the lines of your commit log to 72 columns?
Quoted 9 lines
dependencies:
- supported on aarch64 only (BR2_aarch64)
- requires binutils version 2.33.1 or newer (!B2_BINUTILS_VERSION_2_32_X)
- requires at least linux 5.4 headers (BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_4)[1] https://sourceware.org/git/?p=glibc.git;a=blob;f=INSTALL;h=02dcf6b1ca3a4c43a17fdcae5e7dae8189c1c50b;hb=HEAD#l145
[2] https://community.arm.com/developer/ip-products/processors/b/processors-ip-blog/posts/enhancing-memory-safetySigned-off-by [email protected] <[email protected]>
Could you resend with a real name ? We cannot accept anonymous contributions.
package/glibc/Config.in config BR2_PACKAGE_GLIBC_UTILS · line 20
Quoted 2 lines
package/glibc/Config.in +2
-0+config BR2_PACKAGE_GLIBC_MTE + bool "Install glibc support for MTE"
Repeating that it's glibc related is not necessary, and making "MTE" explicit seems useful. So perhaps:
bool "enable Memory Tagging Extension (MTE) support"
package/glibc/Config.in config BR2_PACKAGE_GLIBC_UTILS · line 29
Quoted 9 lines
package/glibc/Config.in +9
-0+ depends on BR2_aarch64 + depends on !BR2_BINUTILS_VERSION_2_32_X + depends on BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_4 + help + Enabling this option will configure, compile + and install glibc support for MTE (Memory Tagging Extension). + Please be aware, in order for that to work properly, + kernel support for MTE (CONFIG_ARM64_MTE), and a + supported CPU are needed.
Instead of just saying so, you could do this in glibc.mk:
ifeq ($(BR2_PACKAGE_GLIBC_MTE),y)GLIBC_CONF_OPTS += --enable-memory-tagging
define GLIBC_LINUX_CONFIG_FIXUPS
$(call KCONFIG_ENABLE_OPT,CONFIG_ARM64_MTE)
endef
endif
Of course, you need to add $(GLIBC_CONF_OPTS) inside GLIBC_CONFIGURE_CMDS.
Other than that, it looks good to me.
Do we need special compiler options to make use of MTE ?
Best regards,
Thomas
Signature · 7 lines
Thomas Petazzoni, co-owner and CEO, Bootlin Embedded Linux and Kernel engineering and training https://bootlin.com _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot
Hi,
It has been a while... and I'm really sorry for that. But I do think this can be useful - I took a look at the code a-bit and haven't seen it supports compiling glibc with MTE. May I continue to resolve your comments?
should it be in this thread or a new one is preferred?
Thanks :)
Quoted 70 lines · Thomas Petazzoni
Hello,
Thanks a lot for your contribution! See below some comments.
Quoted 2 lines · On Sat, 30 Oct 2021 11:37:50 +0300 "[email protected]" <[email protected]> wrote:
Adding option
BR2_PACKAGE_GLIBC_MTEto configure glibc with MTE support. When enabled, glibcs configuration process runs with
--enable-memory-tagging[1].Quoted 2 lines
MTE (Memory Tagging Extension) is an ISA extension which aims to improve
security on ARMv8.5-A [2].
Quoted 2 lines
The linux kernel supports this feature via
CONFIG_ARM64_MTE. In order for glibc's MTE support to work properly, the running kernelhas to support that.
Could you wrap the lines of your commit log to 72 columns?
Quoted 3 lines
dependencies:
- supported on aarch64 only (BR2_aarch64)
- requires binutils version 2.33.1 or newer(!B2_BINUTILS_VERSION_2_32_X)
Quoted 1 line
- requires at least linux 5.4 headers
(
BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_4)Quoted 2 lines
[1]
Quoted 1 line
[2]
Quoted 2 lines
Signed-off-by [email protected] <[email protected]>Could you resend with a real name ? We cannot accept anonymous contributions.
package/glibc/Config.in config BR2_PACKAGE_GLIBC_UTILS · line 20
Quoted 2 lines
package/glibc/Config.in +2
-0+config BR2_PACKAGE_GLIBC_MTE + bool "Install glibc support for MTE"Repeating that it's glibc related is not necessary, and making "MTE" explicit seems useful. So perhaps:
bool "enable Memory Tagging Extension (MTE) support"
package/glibc/Config.in config BR2_PACKAGE_GLIBC_UTILS · line 29
Quoted 9 lines
package/glibc/Config.in +9
-0+ depends on BR2_aarch64 + depends on !BR2_BINUTILS_VERSION_2_32_X + depends on BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_4 + help + Enabling this option will configure, compile + and install glibc support for MTE (Memory Tagging Extension). + Please be aware, in order for that to work properly, + kernel support for MTE (CONFIG_ARM64_MTE), and a + supported CPU are needed.Instead of just saying so, you could do this in glibc.mk:
ifeq ($(BR2_PACKAGE_GLIBC_MTE),y)
GLIBC_CONF_OPTS+= --enable-memory-tagging
defineGLIBC_LINUX_CONFIG_FIXUPS$(call KCONFIG_ENABLE_OPT,CONFIG_ARM64_MTE)endef
endifOf course, you need to add $(GLIBC_CONF_OPTS) inside
GLIBC_CONFIGURE_CMDS.Other than that, it looks good to me.
Do we need special compiler options to make use of MTE ?
Quoted 8 lines
Best regards,
Thomas
--
Thomas Petazzoni, co-owner and CEO, Bootlin Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
R, All,
[please do not top-post, but do reply in-line, like I do below]
On 2023-11-26 22:28 +0200, R spake thusly:
Quoted 1 line
It has been a while... and I'm really sorry for that.
No worries, we all have a life outside open source projects! ;-)
Quoted 3 lines
But I do think this can be useful - I took a look at the code a-bit and haven't seen it supports compiling glibc with MTE. May I continue to resolve your comments?
Having MTE support looks interesting, so yes, you are welcome to continue working on that!
Quoted 1 line
should it be in this thread or a new one is preferred?
If you want to reply to the comments, then just do so as a reply to Thomas' email, and reply to individual comments there (like I'm doing for your own mail).
If you want to resend a new patch which addresses Thomas' comments, then send it as a new thread. Don;t forget to add a changelog, see the manual for further details:
https://buildroot.org/downloads/manual/manual.html#submitting-patches
Regards,
Yann E. MORIN.
Quoted 90 lines
Thanks :)
On Sun, Oct 31, 2021 at 7:52 PM Thomas Petazzoni < [1][email protected]> wrote:Hello,
Thanks a lot for your contribution! See below some comments.
Quoted 6 lines · On Sat, 30 Oct 2021 11:37:50 +0300 " [2][email protected]" <…
Adding option
BR2_PACKAGE_GLIBC_MTEto configure glibc with MTE support. When enabled, glibcs configuration process runs with--enable-memory-tagging[1].MTE (Memory Tagging Extension) is an ISA extension which aims to improve security on ARMv8.5-A [2]. The linux kernel supports this feature via
CONFIG_ARM64_MTE.
In order for glibc's MTE support to work properly, the running kernel has to support that.Could you wrap the lines of your commit log to 72 columns?
Quoted 6 lines
dependencies:
- supported on aarch64 only (BR2_aarch64)
- requires binutils version 2.33.1 or newer (!B2_BINUTILS_VERSION_2_32_X)
- requires at least linux 5.4 headers (BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_4)[1]
Quoted 3 lines
Signed-off-by [6][email protected] < [7][email protected]>Could you resend with a real name ? We cannot accept anonymous contributions.
Quoted 2 lines
+config
BR2_PACKAGE_GLIBC_MTE
+ bool "Install glibc support for MTE"Repeating that it's glibc related is not necessary, and making "MTE" explicit seems useful. So perhaps:
bool "enable Memory Tagging Extension (MTE) support"
Quoted 9 lines
+ depends on
BR2_aarch64
+ depends on !BR2_BINUTILS_VERSION_2_32_X
+ depends onBR2_TOOLCHAIN_HEADERS_AT_LEAST_5_4
+ help
+ Enabling this option will configure, compile
+ and install glibc support for MTE (Memory Tagging Extension). + Please be aware, in order for that to work properly, + kernel support for MTE (CONFIG_ARM64_MTE), and a
+ supported CPU are needed.Instead of just saying so, you could do this in [8]glibc.mk:
ifeq ($(BR2_PACKAGE_GLIBC_MTE),y) GLIBC_CONF_OPTS += --enable-memory-tagging define GLIBC_LINUX_CONFIG_FIXUPS $(call KCONFIG_ENABLE_OPT,CONFIG_ARM64_MTE) endef endif Of course, you need to add $(GLIBC_CONF_OPTS) inside GLIBC_CONFIGURE_CMDS.Other than that, it looks good to me.
Do we need special compiler options to make use of MTE ?
Best regards,
Thomas
--
Thomas Petazzoni, co-owner and CEO, Bootlin Embedded Linux and Kernel engineering and training [9]https://bootlin.comLinks:
1. mailto:[email protected]
2. mailto:[email protected]
3. mailto:[email protected]
4. https://sourceware.org/git/?p=glibc.git;a=blob;f=INSTALL;h=02dcf6b1ca3a4c43a17fdcae5e7dae8189c1c50b;hb=HEAD#l145
5. https://community.arm.com/developer/ip-products/processors/b/processors-ip-blog/posts/enhancing-memory-safety
6. mailto:[email protected]
7. mailto:[email protected]
8. http://glibc.mk
9. https://bootlin.com_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
Signature · 10 lines
.-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | +33 561 099 427 `------------.-------: X AGAINST | \e/ There is no | | http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. | '------------------------------^-------^------------------^--------------------' _______________________________________________ buildroot mailing list [email protected] https://lists.buildroot.org/mailman/listinfo/buildroot