diff --git a/docs/ReleaseNotes.rst b/docs/ReleaseNotes.rst index efbf27a8872a..d817907e2230 100644 --- a/docs/ReleaseNotes.rst +++ b/docs/ReleaseNotes.rst @@ -35,6 +35,12 @@ sections with improvements to Clang's support for those languages. Non-comprehensive list of changes in this release ------------------------------------------------- +- Support for `retpolines `_ + was added to help mitigate "branch target injection" (variant #2) of the + "Spectre" speculative side channels described by `Project Zero + `_ + and the `Spectre paper `_. + - Bitrig OS was merged back into OpenBSD, so Bitrig support has been removed from Clang/LLVM. @@ -109,6 +115,18 @@ Improvements to Clang's diagnostics New Compiler Flags ------------------ +- Clang supports the ``-mretpoline`` flag to enable `retpolines + `_. Code compiled with this + flag will be hardened against variant #2 of the Spectre attack. Indirect + branches from switches or gotos removed from the code, and indirect calls + will be made through a "retpoline" thunk. The necessary thunks will + automatically be inserted into the generated code. Clang also supports + ``-mretpoline-external-thunk`` which works like ``-mretpoline`` but requires + the user to provide their own thunk definitions. The external thunk names + start with ``__x86_indirect_thunk_`` and end in a register name. For 64-bit + platforms, only an ``r11`` thunk is used, but for 32-bit platforms ``eax``, + ``ecx``, ``edx``, and ``edi`` thunks are used. + - Clang now supports configuration files. These are collections of driver options, which can be applied by specifying the configuration file, either using command line option ``--config foo.cfg`` or encoding it into executable