From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170])
	(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 32666623
	for <llvm@lists.linux.dev>; Sun, 15 May 2022 03:19:52 +0000 (UTC)
Received: by mail-pg1-f170.google.com with SMTP id a191so11081479pge.2
        for <llvm@lists.linux.dev>; Sat, 14 May 2022 20:19:52 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=chromium.org; s=google;
        h=date:from:to:cc:subject:message-id:references:mime-version
         :content-disposition:content-transfer-encoding:in-reply-to;
        bh=MEi80uS+Hv7whcnPDmWumoTBr+8suRXlPOFaSGMgA4w=;
        b=k2E2gWVeuIcJmXctth50gI+JpHO8Jdri7XEy81BsIY5b7LBB+U+mfEZEpjht24f6UP
         dpH1IzclL/xXavJ7dhUZAwraqMh5bh6+PNchYFKigMWuFKoAjMlY5pRxsSmlGENEVH77
         eDbavVNzNaxKdVIVDHOBiq7SWRKR8gbONOzLo=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20210112;
        h=x-gm-message-state:date:from:to:cc:subject:message-id:references
         :mime-version:content-disposition:content-transfer-encoding
         :in-reply-to;
        bh=MEi80uS+Hv7whcnPDmWumoTBr+8suRXlPOFaSGMgA4w=;
        b=QfMSJEMm5qElBvHLJvZYIPjJngeP4/oyZc3Q8R/oj4dKwOJzBZBDIXbE1KKLPLtU8X
         9NIEXMHT/OhBDIkY/hflfoZBcrkx3evsO+hxrlsK+vRIE7UsHXq47mrVwBHUOEgPLbYQ
         Ron5C++WWxQGpDLJe/ccPYNU8T5HnZGkoqtIjCl6MrEmLuIzg0KpCqcO+JbkBmMwsWM7
         UFzKbPfOZJkjdEThep3ClNZmKNjVdaLZdiMhjHBFkUnm67BMoqUpi/xIgR7wX8avfgYy
         SnQA10vW8PiuvNcwHw8r3i5a/JdHlLCJjZzJgmImBfY9ZS2oD4jgNeHFcP7AQ3QUfHtV
         1hJw==
X-Gm-Message-State: AOAM531gfQKUkfxRdcuZWzt1WB2Nqzyf2MrNnL/92UmjnYGiFVKn8OzY
	J0aASIFfvpBusG0tIA4DVrL8vg==
X-Google-Smtp-Source: ABdhPJwR7XZOxJrS4oIzgQbamR8MN0/jGNaXZitp2YdTHflXf1xkjcnFI+uVSj0ggVkl4+1JzhTJtw==
X-Received: by 2002:a63:8843:0:b0:3da:fe5c:9374 with SMTP id l64-20020a638843000000b003dafe5c9374mr10329905pgd.342.1652584791498;
        Sat, 14 May 2022 20:19:51 -0700 (PDT)
Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163])
        by smtp.gmail.com with ESMTPSA id o15-20020a170902d4cf00b0015e8d4eb27csm4411356plg.198.2022.05.14.20.19.50
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Sat, 14 May 2022 20:19:51 -0700 (PDT)
Date: Sat, 14 May 2022 20:19:47 -0700
From: Kees Cook <keescook@chromium.org>
To: Sami Tolvanen <samitolvanen@google.com>
Cc: linux-kernel@vger.kernel.org, Josh Poimboeuf <jpoimboe@redhat.com>,
	Peter Zijlstra <peterz@infradead.org>, x86@kernel.org,
	Catalin Marinas <catalin.marinas@arm.com>,
	Will Deacon <will@kernel.org>, Mark Rutland <mark.rutland@arm.com>,
	Nathan Chancellor <nathan@kernel.org>,
	Nick Desaulniers <ndesaulniers@google.com>,
	Joao Moreira <joao@overdrivepizza.com>,
	Sedat Dilek <sedat.dilek@gmail.com>,
	Steven Rostedt <rostedt@goodmis.org>,
	linux-hardening@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org, llvm@lists.linux.dev
Subject: Re: [RFC PATCH v2 20/21] x86: Add support for CONFIG_CFI_CLANG
Message-ID: <202205142016.DB5DB8638A@keescook>
References: <20220513202159.1550547-1-samitolvanen@google.com>
 <20220513202159.1550547-21-samitolvanen@google.com>
Precedence: bulk
X-Mailing-List: llvm@lists.linux.dev
List-Id: <llvm.lists.linux.dev>
List-Subscribe: <mailto:llvm+subscribe@lists.linux.dev>
List-Unsubscribe: <mailto:llvm+unsubscribe@lists.linux.dev>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20220513202159.1550547-21-samitolvanen@google.com>

On Fri, May 13, 2022 at 01:21:58PM -0700, Sami Tolvanen wrote:
> With CONFIG_CFI_CLANG, the compiler injects a type preamble
> immediately before each function and a check to validate the target
> function type before indirect calls:
> 
>   ; type preamble
>   __cfi_function:
>     int3
>     int3
>     mov <id>, %eax
>     int3
>     int3
>   function:
>     ...
>   ; indirect call check
>     cmpl    <id>, -6(%r11)
>     je      .Ltmp1
>     ud2
>   .Ltmp1:
>     call    __x86_indirect_thunk_r11
> 
> Define the __CFI_TYPE helper macro for manual type annotations in
> assembly code, add error handling for the CFI ud2 traps, and allow
> CONFIG_CFI_CLANG to be selected on x86_64.
> 
> Signed-off-by: Sami Tolvanen <samitolvanen@google.com>

Looks good testing with LKDTM...

$ echo CFI_FORWARD_PROTO | cat >/sys/kernel/debug/provoke-crash/DIRECT
[  144.084017] lkdtm: Performing direct entry CFI_FORWARD_PROTO
[  144.086138] lkdtm: Calling matched prototype ...
[  144.087833] lkdtm: Calling mismatched prototype ...
[  144.089777] CFI failure at lkdtm_CFI_FORWARD_PROTO+0x34/0x67 [lkdtm] (target: lkdtm_increment_int+0x0/0x7 [lkdtm]; expected type: 0x7e0c52a5)


Tested-by: Kees Cook <keescook@chromium.org>

-- 
Kees Cook

From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.lore.kernel.org (Postfix) with ESMTPS id 38D73C433F5
	for <linux-arm-kernel@archiver.kernel.org>; Sun, 15 May 2022 03:21:42 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
	d=lists.infradead.org; s=bombadil.20210309; h=Sender:
	Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post:
	List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References:
	Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description:
	Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:
	List-Owner; bh=6EVTQByuPrk8/mgkFwPvLVzjgitqCAW7qTaTY1itbcw=; b=SpQ8pMufliCpFq
	HkPBc1wfbE/DEW7HOeNknb9+patI7NNS6o9/UmIsihrqJmZU68si+VSG1CBwx78e+Wnk9sxnBvJ9R
	5ftjD7uqLM/2w/uUwjXHY3K6oJfOQvDTkRjML0pQtFkibwAsqd2uYC0XCjVy+mb4Gg1QVVlfmPD0z
	b5rH6WljdsVTVDNb1oWilwO5mmw5CutE52sl3RMNi6A3wFCZRTGH8kMHnBHNviUbseyup2gngKfCn
	EMAxh4C3415M75fCaVMnK6FC/gcN7a1ONnZO3sKmTypR4M4Fr9Xcs/L5bvWTppKJcOJiaFvbak6kn
	+ePiLBzeDK4ta9jz5wWw==;
Received: from localhost ([::1] helo=bombadil.infradead.org)
	by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux))
	id 1nq4nT-0032uC-Op; Sun, 15 May 2022 03:19:55 +0000
Received: from mail-pg1-x52a.google.com ([2607:f8b0:4864:20::52a])
 by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux))
 id 1nq4nQ-0032tW-Pa
 for linux-arm-kernel@lists.infradead.org; Sun, 15 May 2022 03:19:54 +0000
Received: by mail-pg1-x52a.google.com with SMTP id 31so11056764pgp.8
 for <linux-arm-kernel@lists.infradead.org>;
 Sat, 14 May 2022 20:19:52 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google;
 h=date:from:to:cc:subject:message-id:references:mime-version
 :content-disposition:content-transfer-encoding:in-reply-to;
 bh=MEi80uS+Hv7whcnPDmWumoTBr+8suRXlPOFaSGMgA4w=;
 b=k2E2gWVeuIcJmXctth50gI+JpHO8Jdri7XEy81BsIY5b7LBB+U+mfEZEpjht24f6UP
 dpH1IzclL/xXavJ7dhUZAwraqMh5bh6+PNchYFKigMWuFKoAjMlY5pRxsSmlGENEVH77
 eDbavVNzNaxKdVIVDHOBiq7SWRKR8gbONOzLo=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20210112;
 h=x-gm-message-state:date:from:to:cc:subject:message-id:references
 :mime-version:content-disposition:content-transfer-encoding
 :in-reply-to;
 bh=MEi80uS+Hv7whcnPDmWumoTBr+8suRXlPOFaSGMgA4w=;
 b=ZhJS6u5WL5LkoqKE395jvq+uArDtQKAmkUvqprvyY68/52Szq7nPS0iJ6MYAWWwHES
 7G5KMO6/9MM5UoARD6jBYFwqkccIpmzev6Kuw0mwR4uOCkOzE6p4SL8F0/4oTE7BKPxI
 O5a08Q1n5IKD54whutchPEWA6O7DeAvVdqCYEvOwboHmazaVKhodAdJHiO4c+7mD8Iy4
 QVSuOPDHJCALZcuwvnrEMsF9dQ/uUUKFLp/j4/7POV6hVzsyDyjUoaodqwKexpdk2ZKJ
 gHZcPyCuzcMs21mt8Magw54HD4BQoYmNnADc0RfdKptsBdu+GfuPWHdxeE2XmsNuCMRy
 Dpug==
X-Gm-Message-State: AOAM532kcnZEqBrmcfIy7TvHr0k8R/pPp3746RsCnQNp2o/dMhzY/M1c
 AjX2KdW5PeGGjo5m7IMGe3KeEg==
X-Google-Smtp-Source: ABdhPJwR7XZOxJrS4oIzgQbamR8MN0/jGNaXZitp2YdTHflXf1xkjcnFI+uVSj0ggVkl4+1JzhTJtw==
X-Received: by 2002:a63:8843:0:b0:3da:fe5c:9374 with SMTP id
 l64-20020a638843000000b003dafe5c9374mr10329905pgd.342.1652584791498; 
 Sat, 14 May 2022 20:19:51 -0700 (PDT)
Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163])
 by smtp.gmail.com with ESMTPSA id
 o15-20020a170902d4cf00b0015e8d4eb27csm4411356plg.198.2022.05.14.20.19.50
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Sat, 14 May 2022 20:19:51 -0700 (PDT)
Date: Sat, 14 May 2022 20:19:47 -0700
From: Kees Cook <keescook@chromium.org>
To: Sami Tolvanen <samitolvanen@google.com>
Cc: linux-kernel@vger.kernel.org, Josh Poimboeuf <jpoimboe@redhat.com>,
 Peter Zijlstra <peterz@infradead.org>, x86@kernel.org,
 Catalin Marinas <catalin.marinas@arm.com>,
 Will Deacon <will@kernel.org>, Mark Rutland <mark.rutland@arm.com>,
 Nathan Chancellor <nathan@kernel.org>,
 Nick Desaulniers <ndesaulniers@google.com>,
 Joao Moreira <joao@overdrivepizza.com>,
 Sedat Dilek <sedat.dilek@gmail.com>, Steven Rostedt <rostedt@goodmis.org>,
 linux-hardening@vger.kernel.org,
 linux-arm-kernel@lists.infradead.org, llvm@lists.linux.dev
Subject: Re: [RFC PATCH v2 20/21] x86: Add support for CONFIG_CFI_CLANG
Message-ID: <202205142016.DB5DB8638A@keescook>
References: <20220513202159.1550547-1-samitolvanen@google.com>
 <20220513202159.1550547-21-samitolvanen@google.com>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <20220513202159.1550547-21-samitolvanen@google.com>
X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 
X-CRM114-CacheID: sfid-20220514_201952_890459_2CA09558 
X-CRM114-Status: GOOD (  12.80  )
X-BeenThere: linux-arm-kernel@lists.infradead.org
X-Mailman-Version: 2.1.34
Precedence: list
List-Id: <linux-arm-kernel.lists.infradead.org>
List-Unsubscribe: <http://lists.infradead.org/mailman/options/linux-arm-kernel>, 
 <mailto:linux-arm-kernel-request@lists.infradead.org?subject=unsubscribe>
List-Archive: <http://lists.infradead.org/pipermail/linux-arm-kernel/>
List-Post: <mailto:linux-arm-kernel@lists.infradead.org>
List-Help: <mailto:linux-arm-kernel-request@lists.infradead.org?subject=help>
List-Subscribe: <http://lists.infradead.org/mailman/listinfo/linux-arm-kernel>, 
 <mailto:linux-arm-kernel-request@lists.infradead.org?subject=subscribe>
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Sender: "linux-arm-kernel" <linux-arm-kernel-bounces@lists.infradead.org>
Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org

On Fri, May 13, 2022 at 01:21:58PM -0700, Sami Tolvanen wrote:
> With CONFIG_CFI_CLANG, the compiler injects a type preamble
> immediately before each function and a check to validate the target
> function type before indirect calls:
> =

>   ; type preamble
>   __cfi_function:
>     int3
>     int3
>     mov <id>, %eax
>     int3
>     int3
>   function:
>     ...
>   ; indirect call check
>     cmpl=A0 =A0 <id>, -6(%r11)
>     je      .Ltmp1
>     ud2
>   .Ltmp1:
>     call    __x86_indirect_thunk_r11
> =

> Define the __CFI_TYPE helper macro for manual type annotations in
> assembly code, add error handling for the CFI ud2 traps, and allow
> CONFIG_CFI_CLANG to be selected on x86_64.
> =

> Signed-off-by: Sami Tolvanen <samitolvanen@google.com>

Looks good testing with LKDTM...

$ echo CFI_FORWARD_PROTO | cat >/sys/kernel/debug/provoke-crash/DIRECT
[  144.084017] lkdtm: Performing direct entry CFI_FORWARD_PROTO
[  144.086138] lkdtm: Calling matched prototype ...
[  144.087833] lkdtm: Calling mismatched prototype ...
[  144.089777] CFI failure at lkdtm_CFI_FORWARD_PROTO+0x34/0x67 [lkdtm] (ta=
rget: lkdtm_increment_int+0x0/0x7 [lkdtm]; expected type: 0x7e0c52a5)


Tested-by: Kees Cook <keescook@chromium.org>

-- =

Kees Cook

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel