All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sami Tolvanen <samitolvanen@google.com>
To: linux-kernel@vger.kernel.org
Cc: Kees Cook <keescook@chromium.org>,
	Josh Poimboeuf <jpoimboe@redhat.com>,
	 Peter Zijlstra <peterz@infradead.org>,
	x86@kernel.org,  Catalin Marinas <catalin.marinas@arm.com>,
	Will Deacon <will@kernel.org>,
	 Mark Rutland <mark.rutland@arm.com>,
	Nathan Chancellor <nathan@kernel.org>,
	 Nick Desaulniers <ndesaulniers@google.com>,
	Joao Moreira <joao@overdrivepizza.com>,
	 Sedat Dilek <sedat.dilek@gmail.com>,
	Steven Rostedt <rostedt@goodmis.org>,
	 linux-hardening@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org,  llvm@lists.linux.dev,
	Sami Tolvanen <samitolvanen@google.com>
Subject: [PATCH v5 06/22] cfi: Add type helper macros
Date: Thu,  8 Sep 2022 14:54:48 -0700	[thread overview]
Message-ID: <20220908215504.3686827-7-samitolvanen@google.com> (raw)
In-Reply-To: <20220908215504.3686827-1-samitolvanen@google.com>

With CONFIG_CFI_CLANG, assembly functions called indirectly
from C code must be annotated with type identifiers to pass CFI
checking.  In order to make this easier, the compiler emits a
__kcfi_typeid_<function> symbol for each address-taken function
declaration in C, which contains the expected type identifier that
we can refer to in assembly code.

Add a typed version of SYM_FUNC_START, which emits the type
identifier before the function. Architectures that support KCFI can
define their own __CFI_TYPE macro to override the default preamble
format.

As an example, for the x86_64 blowfish_dec_blk function, the
compiler emits the following type symbol:

$ readelf -sW vmlinux | grep __kcfi_typeid_blowfish_dec_blk
120204: 00000000ef478db5     0 NOTYPE  WEAK   DEFAULT  ABS
	__kcfi_typeid_blowfish_dec_blk

And SYM_TYPED_FUNC_START will generate the following preamble based
on the __CFI_TYPE definition for the architecture:

$ objdump -dr arch/x86/crypto/blowfish-x86_64-asm_64.o
     ...
0000000000000400 <__cfi_blowfish_dec_blk>:
     ...
     40b:       b8 00 00 00 00          mov    $0x0,%eax
                   40c: R_X86_64_32 __kcfi_typeid_blowfish_dec_blk

0000000000000410 <blowfish_dec_blk>:
     ...

Note that the address of all assembly functions annotated with
SYM_TYPED_FUNC_START must be taken in C code that's linked into the
binary or the missing __kcfi_typeid_ symbol will result in a linker
error with CONFIG_CFI_CLANG. If the code that contains the indirect
call is not always compiled in, __ADDRESSABLE(functionname) can be
used to ensure that the __kcfi_typeid_ symbol is emitted.

Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Tested-by: Kees Cook <keescook@chromium.org>
Tested-by: Nathan Chancellor <nathan@kernel.org>
---
 include/linux/cfi_types.h | 45 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 include/linux/cfi_types.h

diff --git a/include/linux/cfi_types.h b/include/linux/cfi_types.h
new file mode 100644
index 000000000000..6b8713675765
--- /dev/null
+++ b/include/linux/cfi_types.h
@@ -0,0 +1,45 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Clang Control Flow Integrity (CFI) type definitions.
+ */
+#ifndef _LINUX_CFI_TYPES_H
+#define _LINUX_CFI_TYPES_H
+
+#ifdef __ASSEMBLY__
+#include <linux/linkage.h>
+
+#ifdef CONFIG_CFI_CLANG
+/*
+ * Use the __kcfi_typeid_<function> type identifier symbol to
+ * annotate indirectly called assembly functions. The compiler emits
+ * these symbols for all address-taken function declarations in C
+ * code.
+ */
+#ifndef __CFI_TYPE
+#define __CFI_TYPE(name)				\
+	.4byte __kcfi_typeid_##name
+#endif
+
+#define SYM_TYPED_ENTRY(name, linkage, align...)	\
+	linkage(name) ASM_NL				\
+	align ASM_NL					\
+	__CFI_TYPE(name) ASM_NL				\
+	name:
+
+#define SYM_TYPED_START(name, linkage, align...)	\
+	SYM_TYPED_ENTRY(name, linkage, align)
+
+#else /* CONFIG_CFI_CLANG */
+
+#define SYM_TYPED_START(name, linkage, align...)	\
+	SYM_START(name, linkage, align)
+
+#endif /* CONFIG_CFI_CLANG */
+
+#ifndef SYM_TYPED_FUNC_START
+#define SYM_TYPED_FUNC_START(name) 			\
+	SYM_TYPED_START(name, SYM_L_GLOBAL, SYM_A_ALIGN)
+#endif
+
+#endif /* __ASSEMBLY__ */
+#endif /* _LINUX_CFI_TYPES_H */
-- 
2.37.2.789.g6183377224-goog


WARNING: multiple messages have this Message-ID (diff)
From: Sami Tolvanen <samitolvanen@google.com>
To: linux-kernel@vger.kernel.org
Cc: Kees Cook <keescook@chromium.org>,
	Josh Poimboeuf <jpoimboe@redhat.com>,
	 Peter Zijlstra <peterz@infradead.org>,
	x86@kernel.org,  Catalin Marinas <catalin.marinas@arm.com>,
	Will Deacon <will@kernel.org>,
	 Mark Rutland <mark.rutland@arm.com>,
	Nathan Chancellor <nathan@kernel.org>,
	 Nick Desaulniers <ndesaulniers@google.com>,
	Joao Moreira <joao@overdrivepizza.com>,
	 Sedat Dilek <sedat.dilek@gmail.com>,
	Steven Rostedt <rostedt@goodmis.org>,
	 linux-hardening@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org,  llvm@lists.linux.dev,
	Sami Tolvanen <samitolvanen@google.com>
Subject: [PATCH v5 06/22] cfi: Add type helper macros
Date: Thu,  8 Sep 2022 14:54:48 -0700	[thread overview]
Message-ID: <20220908215504.3686827-7-samitolvanen@google.com> (raw)
In-Reply-To: <20220908215504.3686827-1-samitolvanen@google.com>

With CONFIG_CFI_CLANG, assembly functions called indirectly
from C code must be annotated with type identifiers to pass CFI
checking.  In order to make this easier, the compiler emits a
__kcfi_typeid_<function> symbol for each address-taken function
declaration in C, which contains the expected type identifier that
we can refer to in assembly code.

Add a typed version of SYM_FUNC_START, which emits the type
identifier before the function. Architectures that support KCFI can
define their own __CFI_TYPE macro to override the default preamble
format.

As an example, for the x86_64 blowfish_dec_blk function, the
compiler emits the following type symbol:

$ readelf -sW vmlinux | grep __kcfi_typeid_blowfish_dec_blk
120204: 00000000ef478db5     0 NOTYPE  WEAK   DEFAULT  ABS
	__kcfi_typeid_blowfish_dec_blk

And SYM_TYPED_FUNC_START will generate the following preamble based
on the __CFI_TYPE definition for the architecture:

$ objdump -dr arch/x86/crypto/blowfish-x86_64-asm_64.o
     ...
0000000000000400 <__cfi_blowfish_dec_blk>:
     ...
     40b:       b8 00 00 00 00          mov    $0x0,%eax
                   40c: R_X86_64_32 __kcfi_typeid_blowfish_dec_blk

0000000000000410 <blowfish_dec_blk>:
     ...

Note that the address of all assembly functions annotated with
SYM_TYPED_FUNC_START must be taken in C code that's linked into the
binary or the missing __kcfi_typeid_ symbol will result in a linker
error with CONFIG_CFI_CLANG. If the code that contains the indirect
call is not always compiled in, __ADDRESSABLE(functionname) can be
used to ensure that the __kcfi_typeid_ symbol is emitted.

Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Tested-by: Kees Cook <keescook@chromium.org>
Tested-by: Nathan Chancellor <nathan@kernel.org>
---
 include/linux/cfi_types.h | 45 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 include/linux/cfi_types.h

diff --git a/include/linux/cfi_types.h b/include/linux/cfi_types.h
new file mode 100644
index 000000000000..6b8713675765
--- /dev/null
+++ b/include/linux/cfi_types.h
@@ -0,0 +1,45 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Clang Control Flow Integrity (CFI) type definitions.
+ */
+#ifndef _LINUX_CFI_TYPES_H
+#define _LINUX_CFI_TYPES_H
+
+#ifdef __ASSEMBLY__
+#include <linux/linkage.h>
+
+#ifdef CONFIG_CFI_CLANG
+/*
+ * Use the __kcfi_typeid_<function> type identifier symbol to
+ * annotate indirectly called assembly functions. The compiler emits
+ * these symbols for all address-taken function declarations in C
+ * code.
+ */
+#ifndef __CFI_TYPE
+#define __CFI_TYPE(name)				\
+	.4byte __kcfi_typeid_##name
+#endif
+
+#define SYM_TYPED_ENTRY(name, linkage, align...)	\
+	linkage(name) ASM_NL				\
+	align ASM_NL					\
+	__CFI_TYPE(name) ASM_NL				\
+	name:
+
+#define SYM_TYPED_START(name, linkage, align...)	\
+	SYM_TYPED_ENTRY(name, linkage, align)
+
+#else /* CONFIG_CFI_CLANG */
+
+#define SYM_TYPED_START(name, linkage, align...)	\
+	SYM_START(name, linkage, align)
+
+#endif /* CONFIG_CFI_CLANG */
+
+#ifndef SYM_TYPED_FUNC_START
+#define SYM_TYPED_FUNC_START(name) 			\
+	SYM_TYPED_START(name, SYM_L_GLOBAL, SYM_A_ALIGN)
+#endif
+
+#endif /* __ASSEMBLY__ */
+#endif /* _LINUX_CFI_TYPES_H */
-- 
2.37.2.789.g6183377224-goog


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

  parent reply	other threads:[~2022-09-08 21:55 UTC|newest]

Thread overview: 56+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-09-08 21:54 [PATCH v5 00/22] KCFI support Sami Tolvanen
2022-09-08 21:54 ` Sami Tolvanen
2022-09-08 21:54 ` [PATCH v5 01/22] treewide: Filter out CC_FLAGS_CFI Sami Tolvanen
2022-09-08 21:54   ` Sami Tolvanen
2022-09-08 21:54 ` [PATCH v5 02/22] scripts/kallsyms: Ignore __kcfi_typeid_ Sami Tolvanen
2022-09-08 21:54   ` Sami Tolvanen
2022-09-08 21:54 ` [PATCH v5 03/22] cfi: Remove CONFIG_CFI_CLANG_SHADOW Sami Tolvanen
2022-09-08 21:54   ` Sami Tolvanen
2022-09-08 21:54 ` [PATCH v5 04/22] cfi: Drop __CFI_ADDRESSABLE Sami Tolvanen
2022-09-08 21:54   ` Sami Tolvanen
2022-09-08 21:54 ` [PATCH v5 05/22] cfi: Switch to -fsanitize=kcfi Sami Tolvanen
2022-09-08 21:54   ` Sami Tolvanen
2022-09-08 21:54 ` Sami Tolvanen [this message]
2022-09-08 21:54   ` [PATCH v5 06/22] cfi: Add type helper macros Sami Tolvanen
2022-09-08 21:54 ` [PATCH v5 07/22] lkdtm: Emit an indirect call for CFI tests Sami Tolvanen
2022-09-08 21:54   ` Sami Tolvanen
2022-09-08 21:54 ` [PATCH v5 08/22] psci: Fix the function type for psci_initcall_t Sami Tolvanen
2022-09-08 21:54   ` Sami Tolvanen
2022-09-08 21:54 ` [PATCH v5 09/22] arm64: Add types to indirect called assembly functions Sami Tolvanen
2022-09-08 21:54   ` Sami Tolvanen
2022-09-08 21:54 ` [PATCH v5 10/22] arm64: Add CFI error handling Sami Tolvanen
2022-09-08 21:54   ` Sami Tolvanen
2022-09-08 21:54 ` [PATCH v5 11/22] arm64: Drop unneeded __nocfi attributes Sami Tolvanen
2022-09-08 21:54   ` Sami Tolvanen
2022-09-08 21:54 ` [PATCH v5 12/22] init: Drop __nocfi from __init Sami Tolvanen
2022-09-08 21:54   ` Sami Tolvanen
2022-09-08 21:54 ` [PATCH v5 13/22] treewide: Drop function_nocfi Sami Tolvanen
2022-09-08 21:54   ` Sami Tolvanen
2022-09-08 21:54 ` [PATCH v5 14/22] treewide: Drop WARN_ON_FUNCTION_MISMATCH Sami Tolvanen
2022-09-08 21:54   ` Sami Tolvanen
2022-09-08 21:54 ` [PATCH v5 15/22] treewide: Drop __cficanonical Sami Tolvanen
2022-09-08 21:54   ` Sami Tolvanen
2022-09-08 21:54 ` [PATCH v5 16/22] objtool: Preserve special st_shndx indexes in elf_update_symbol Sami Tolvanen
2022-09-08 21:54   ` Sami Tolvanen
2022-09-08 21:54 ` [PATCH v5 17/22] objtool: Disable CFI warnings Sami Tolvanen
2022-09-08 21:54   ` Sami Tolvanen
2022-09-08 21:55 ` [PATCH v5 18/22] kallsyms: Drop CONFIG_CFI_CLANG workarounds Sami Tolvanen
2022-09-08 21:55   ` Sami Tolvanen
2022-09-08 21:55 ` [PATCH v5 19/22] x86/tools/relocs: Ignore __kcfi_typeid_ relocations Sami Tolvanen
2022-09-08 21:55   ` Sami Tolvanen
2022-09-08 21:55 ` [PATCH v5 20/22] x86: Add types to indirectly called assembly functions Sami Tolvanen
2022-09-08 21:55   ` Sami Tolvanen
2022-09-08 21:55 ` [PATCH v5 21/22] x86/purgatory: Disable CFI Sami Tolvanen
2022-09-08 21:55   ` Sami Tolvanen
2022-09-08 21:55 ` [PATCH v5 22/22] x86: Add support for CONFIG_CFI_CLANG Sami Tolvanen
2022-09-08 21:55   ` Sami Tolvanen
2022-09-26 12:39 ` [PATCH v5 00/22] KCFI support Peter Zijlstra
2022-09-26 12:39   ` Peter Zijlstra
2022-09-26 20:16   ` H.J. Lu
2022-09-26 20:16     ` H.J. Lu
2022-09-27  7:29     ` Peter Zijlstra
2022-09-27  7:29       ` Peter Zijlstra
2022-09-26 17:20 ` Kees Cook
2022-09-26 17:20   ` Kees Cook
2022-09-28  9:01   ` Sedat Dilek
2022-09-28  9:01     ` Sedat Dilek

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220908215504.3686827-7-samitolvanen@google.com \
    --to=samitolvanen@google.com \
    --cc=catalin.marinas@arm.com \
    --cc=joao@overdrivepizza.com \
    --cc=jpoimboe@redhat.com \
    --cc=keescook@chromium.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-hardening@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=llvm@lists.linux.dev \
    --cc=mark.rutland@arm.com \
    --cc=nathan@kernel.org \
    --cc=ndesaulniers@google.com \
    --cc=peterz@infradead.org \
    --cc=rostedt@goodmis.org \
    --cc=sedat.dilek@gmail.com \
    --cc=will@kernel.org \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.