diff options
| author | Daniel Micay <daniel.micay@grapheneos.org> | 2024-03-12 10:56:37 -0400 |
|---|---|---|
| committer | Daniel Micay <daniel.micay@grapheneos.org> | 2024-03-12 11:06:06 -0400 |
| commit | bd1b44724d3a1c2d40d1ed6d5c1dc06bdaa7ad61 (patch) | |
| tree | 1ffb4d38928672bbacc5d2bd84ef7aa4e06b6b6c /static | |
| parent | 9e1c1a731f43d9810b520a5e0e58cf861c791ca0 (diff) | |
document recent ARMv9 hardening improvements
Diffstat (limited to 'static')
| -rw-r--r-- | static/features.html | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/static/features.html b/static/features.html index 6709ba8c..5547b082 100644 --- a/static/features.html +++ b/static/features.html @@ -343,6 +343,12 @@ there's a deep userspace compromise.</li> <li>Additional consistency / integrity checks are enabled for frequently targeted kernel data structures.</li> + <li>On ARMv9, Branch Target Identification (BTI) is enabled in + addition to Clang type-based Control Flow Integrity (CFI) to + cover functions excluded from type-based CFI</li> + <li>On ARMv9, ShadowCallStack (SCS) is enabled in addition to + Pointer Authentication Code (PAC) return address protection + instead of only enabling SCS when PAC is unavailable</li> </ul> </li> <li>Android Runtime Just-In-Time (JIT) compilation/profiling is fully |