All of lore.kernel.org
 help / color / mirror / Atom feed
From: Kees Cook <keescook@chromium.org>
To: Sami Tolvanen <samitolvanen@google.com>
Cc: linux-kernel@vger.kernel.org,
	Josh Poimboeuf <jpoimboe@redhat.com>,
	Peter Zijlstra <peterz@infradead.org>,
	x86@kernel.org, Catalin Marinas <catalin.marinas@arm.com>,
	Will Deacon <will@kernel.org>,
	Mark Rutland <mark.rutland@arm.com>,
	Nathan Chancellor <nathan@kernel.org>,
	Nick Desaulniers <ndesaulniers@google.com>,
	Joao Moreira <joao@overdrivepizza.com>,
	Sedat Dilek <sedat.dilek@gmail.com>,
	Steven Rostedt <rostedt@goodmis.org>,
	linux-hardening@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org, llvm@lists.linux.dev
Subject: Re: [PATCH v4 00/21] KCFI support
Date: Wed, 31 Aug 2022 15:04:20 -0700	[thread overview]
Message-ID: <202208311503.62B2C1BC@keescook> (raw)
In-Reply-To: <20220830233129.30610-1-samitolvanen@google.com>

On Tue, Aug 30, 2022 at 04:31:08PM -0700, Sami Tolvanen wrote:
> KCFI is a forward-edge control-flow integrity scheme in the upcoming
> Clang 16 release, which is more suitable for kernel use than the
> existing CFI scheme used by CONFIG_CFI_CLANG. KCFI doesn't require
> LTO, doesn't alter function references to point to a jump table, and
> won't break function address equality.
> 
> This series replaces the current arm64 CFI implementation with KCFI
> and adds support for x86_64.
> 
> KCFI requires assembly functions that are indirectly called from C
> code to be annotated with type identifiers. As type information is
> only available in C, the compiler emits expected type identifiers
> into the symbol table, so they can be referenced from assembly
> without having to hardcode type hashes. Patch 6 adds helper macros
> for annotating functions, and patches 9 and 19 add annotations.
> 
> In case of a type mismatch, KCFI always traps. To support error
> handling, the compiler generates a .kcfi_traps section for x86_64,
> which contains the locations of each trap, and for arm64, encodes
> the necessary register information to the ESR. Patches 10 and 21 add
> arch-specific error handlers.
> 
> To test this series, you'll a ToT Clang toolchain. The series is
> also available in GitHub:
> 
>   https://github.com/samitolvanen/linux/commits/kcfi-v4

This happily runs through all my initial testing hoops. :)

Tested-by: Kees Cook <keescook@chromium.org>

-- 
Kees Cook

WARNING: multiple messages have this Message-ID (diff)
From: Kees Cook <keescook@chromium.org>
To: Sami Tolvanen <samitolvanen@google.com>
Cc: linux-kernel@vger.kernel.org,
	Josh Poimboeuf <jpoimboe@redhat.com>,
	Peter Zijlstra <peterz@infradead.org>,
	x86@kernel.org, Catalin Marinas <catalin.marinas@arm.com>,
	Will Deacon <will@kernel.org>,
	Mark Rutland <mark.rutland@arm.com>,
	Nathan Chancellor <nathan@kernel.org>,
	Nick Desaulniers <ndesaulniers@google.com>,
	Joao Moreira <joao@overdrivepizza.com>,
	Sedat Dilek <sedat.dilek@gmail.com>,
	Steven Rostedt <rostedt@goodmis.org>,
	linux-hardening@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org, llvm@lists.linux.dev
Subject: Re: [PATCH v4 00/21] KCFI support
Date: Wed, 31 Aug 2022 15:04:20 -0700	[thread overview]
Message-ID: <202208311503.62B2C1BC@keescook> (raw)
In-Reply-To: <20220830233129.30610-1-samitolvanen@google.com>

On Tue, Aug 30, 2022 at 04:31:08PM -0700, Sami Tolvanen wrote:
> KCFI is a forward-edge control-flow integrity scheme in the upcoming
> Clang 16 release, which is more suitable for kernel use than the
> existing CFI scheme used by CONFIG_CFI_CLANG. KCFI doesn't require
> LTO, doesn't alter function references to point to a jump table, and
> won't break function address equality.
> 
> This series replaces the current arm64 CFI implementation with KCFI
> and adds support for x86_64.
> 
> KCFI requires assembly functions that are indirectly called from C
> code to be annotated with type identifiers. As type information is
> only available in C, the compiler emits expected type identifiers
> into the symbol table, so they can be referenced from assembly
> without having to hardcode type hashes. Patch 6 adds helper macros
> for annotating functions, and patches 9 and 19 add annotations.
> 
> In case of a type mismatch, KCFI always traps. To support error
> handling, the compiler generates a .kcfi_traps section for x86_64,
> which contains the locations of each trap, and for arm64, encodes
> the necessary register information to the ESR. Patches 10 and 21 add
> arch-specific error handlers.
> 
> To test this series, you'll a ToT Clang toolchain. The series is
> also available in GitHub:
> 
>   https://github.com/samitolvanen/linux/commits/kcfi-v4

This happily runs through all my initial testing hoops. :)

Tested-by: Kees Cook <keescook@chromium.org>

-- 
Kees Cook

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

  parent reply	other threads:[~2022-08-31 22:04 UTC|newest]

Thread overview: 62+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-08-30 23:31 [PATCH v4 00/21] KCFI support Sami Tolvanen
2022-08-30 23:31 ` Sami Tolvanen
2022-08-30 23:31 ` [PATCH v4 01/21] treewide: Filter out CC_FLAGS_CFI Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-30 23:31 ` [PATCH v4 02/21] scripts/kallsyms: Ignore __kcfi_typeid_ Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-30 23:31 ` [PATCH v4 03/21] cfi: Remove CONFIG_CFI_CLANG_SHADOW Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-30 23:31 ` [PATCH v4 04/21] cfi: Drop __CFI_ADDRESSABLE Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-30 23:31 ` [PATCH v4 05/21] cfi: Switch to -fsanitize=kcfi Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-30 23:31 ` [PATCH v4 06/21] cfi: Add type helper macros Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-30 23:31 ` [PATCH v4 07/21] lkdtm: Emit an indirect call for CFI tests Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-30 23:31 ` [PATCH v4 08/21] psci: Fix the function type for psci_initcall_t Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-31 18:22   ` Kees Cook
2022-08-31 18:22     ` Kees Cook
2022-08-30 23:31 ` [PATCH v4 09/21] arm64: Add types to indirect called assembly functions Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-30 23:31 ` [PATCH v4 10/21] arm64: Add CFI error handling Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-30 23:31 ` [PATCH v4 11/21] arm64: Drop unneeded __nocfi attributes Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-30 23:31 ` [PATCH v4 12/21] init: Drop __nocfi from __init Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-30 23:31 ` [PATCH v4 13/21] treewide: Drop function_nocfi Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-30 23:31 ` [PATCH v4 14/21] treewide: Drop WARN_ON_FUNCTION_MISMATCH Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-30 23:31 ` [PATCH v4 15/21] treewide: Drop __cficanonical Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-30 23:31 ` [PATCH v4 16/21] objtool: Disable CFI warnings Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-31 18:23   ` Kees Cook
2022-08-31 18:23     ` Kees Cook
2022-08-30 23:31 ` [PATCH v4 17/21] kallsyms: Drop CONFIG_CFI_CLANG workarounds Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-31 18:23   ` Kees Cook
2022-08-31 18:23     ` Kees Cook
2022-08-30 23:31 ` [PATCH v4 18/21] x86/tools/relocs: Ignore __kcfi_typeid_ relocations Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-30 23:31 ` [PATCH v4 19/21] x86: Add types to indirectly called assembly functions Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-30 23:31 ` [PATCH v4 20/21] x86/purgatory: Disable CFI Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-30 23:31 ` [PATCH v4 21/21] x86: Add support for CONFIG_CFI_CLANG Sami Tolvanen
2022-08-30 23:31   ` Sami Tolvanen
2022-08-31 18:28   ` Kees Cook
2022-08-31 18:28     ` Kees Cook
2022-08-31 22:04 ` Kees Cook [this message]
2022-08-31 22:04   ` [PATCH v4 00/21] KCFI support Kees Cook
2022-09-01 21:19 ` Nathan Chancellor
2022-09-01 21:19   ` Nathan Chancellor
2022-09-02  0:33   ` Sami Tolvanen
2022-09-02  0:33     ` Sami Tolvanen
2022-09-02  7:51     ` Peter Zijlstra
2022-09-02  7:51       ` Peter Zijlstra
2022-09-02 15:39       ` Sami Tolvanen
2022-09-02 15:39         ` Sami Tolvanen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=202208311503.62B2C1BC@keescook \
    --to=keescook@chromium.org \
    --cc=catalin.marinas@arm.com \
    --cc=joao@overdrivepizza.com \
    --cc=jpoimboe@redhat.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-hardening@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=llvm@lists.linux.dev \
    --cc=mark.rutland@arm.com \
    --cc=nathan@kernel.org \
    --cc=ndesaulniers@google.com \
    --cc=peterz@infradead.org \
    --cc=rostedt@goodmis.org \
    --cc=samitolvanen@google.com \
    --cc=sedat.dilek@gmail.com \
    --cc=will@kernel.org \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.