asm_trampoline.S misses GCS flag for aarch64
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 77.2k
- Forks
- 35.9k
- PR merge metrics
- PR metrics pending
Description
Bug report
Bug description:
When building with GCC15+, binutils 2.44+, glibc 2.41+ and -mbranch-protection=standard on aarch64, this enables PAC and BTI as stated in https://github.com/python/cpython/issues/139808 but also GCS (Guarded Control Stack).
PAC/BTI is already covered with https://github.com/python/cpython/pull/130864
For GCS, we would need to add some additional gnu properties on top of this patch, similarly to https://github.com/smuellerDD/leancrypto/commit/fe9751f2b13581e938f25b82f3e725372223af81
Maybe https://github.com/python/cpython/pull/130864 could be updated to also cover GCS?
More details on GCS:
- https://community.arm.com/arm-community-blogs/b/tools-software-ides-blog/posts/gcc-15-continuously-improving#guarded
- https://docs.kernel.org/next/arch/arm64/gcs.html
CPython versions tested on:
CPython main branch
Operating systems tested on:
Linux
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with asm_trampoline.S and the existing PAC/BTI handling from pull request 130864. Compare the GNU properties in the referenced leancrypto commit, then build CPython main on Linux with GCC 15+, binutils 2.44+, glibc 2.41+ and -mbranch-protection=standard; done means the aarch64 trampoline declares GCS support as well.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, python
- Domain
- build-system, operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100