C9S/boringssl-antelopeio
2
0
Fork 0
mirror of https://github.com/AntelopeIO/boringssl.git synced 2026-07-21 14:43:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add a comment about the Chromium sandbox for macOS sysctls

Browse Source 
https://crrev.com/c/4415225 had to react to us querying these. Add a
comment so we can fix this proactively in the future.

Bug: chromium:1432323
Change-Id: I2ffe4d90e32215b521815a25f3448502da2156bf
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/59925
Reviewed-by: Adam Langley <agl@google.com>
This commit is contained in:
David Benjamin
2023-05-18 19:20:27 -04:00
parent 47b2fefb03
commit 74a75b3959
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SANDBOXING.md
+4 -2
View File
@@ -90,8 +90,10 @@ addition to the operations above.
On Linux ARM platforms, BoringSSL depends on OS APIs to query CPU capabilities. On Linux ARM platforms, BoringSSL depends on OS APIs to query CPU capabilities.
32-bit and 64-bit ARM both depend on the `getauxval` function. 32-bit ARM, to 32-bit and 64-bit ARM both depend on the `getauxval` function. 32-bit ARM, to
work around bugs in older Android devices, may additionally read `/proc/cpuinfo` work around bugs in older Android devices, may additionally read
and `/proc/self/auxv`. `/proc/cpuinfo`.
On 64-bit Apple ARM platforms, BoringSSL needs to query `hw.optional.*` sysctls.
If querying CPU capabilities fails, BoringSSL will still function, but may not If querying CPU capabilities fails, BoringSSL will still function, but may not
perform as well. perform as well.
crypto/cpu_aarch64_apple.c
+3
View File
@@ -65,6 +65,9 @@ void OPENSSL_cpuid_setup(void) {
// available in macOS 12. For compatibility with macOS 11, we also support // available in macOS 12. For compatibility with macOS 11, we also support
// the old names. The old names don't have values for features like FEAT_AES, // the old names. The old names don't have values for features like FEAT_AES,
// so instead we detect them statically above. // so instead we detect them statically above.
//
// If querying new sysctls, update the Chromium sandbox definition. See
// https://crrev.com/c/4415225.
if (has_hw_feature("hw.optional.arm.FEAT_SHA512") || if (has_hw_feature("hw.optional.arm.FEAT_SHA512") ||
has_hw_feature("hw.optional.armv8_2_sha512")) { has_hw_feature("hw.optional.armv8_2_sha512")) {
OPENSSL_armcap_P |= ARMV8_SHA512; OPENSSL_armcap_P |= ARMV8_SHA512;