linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [RFC PATCH v3 00/20] KCFI support
@ 2022-06-10 23:34 Sami Tolvanen
  2022-06-10 23:34 ` [RFC PATCH v3 01/20] treewide: Filter out CC_FLAGS_CFI Sami Tolvanen
                   ` (20 more replies)
  0 siblings, 21 replies; 31+ messages in thread
From: Sami Tolvanen @ 2022-06-10 23:34 UTC (permalink / raw)
  To: linux-kernel
  Cc: Kees Cook, Josh Poimboeuf, Peter Zijlstra, x86, Catalin Marinas,
	Will Deacon, Mark Rutland, Nathan Chancellor, Nick Desaulniers,
	Joao Moreira, Sedat Dilek, Steven Rostedt, linux-hardening,
	linux-arm-kernel, llvm, Sami Tolvanen

KCFI is a proposed forward-edge control-flow integrity scheme for
Clang, which is more suitable for kernel use than the existing CFI
scheme used by CONFIG_CFI_CLANG. KCFI doesn't require LTO, doesn't
alter function references to point to a jump table, and won't break
function address equality. The latest LLVM patch is here:

  https://reviews.llvm.org/D119296

This RFC series replaces the current arm64 CFI implementation with
KCFI and adds support for x86_64.

KCFI requires assembly functions that are indirectly called from C
code to be annotated with type identifiers. As type information is
only available in C, the compiler emits expected type identifiers into
the symbol table, so they can be referenced from assembly without
having to hardcode type hashes. Patch 6 adds helper macros for
annotating functions, and patches 8 and 18 add annotations.

In case of a type mismatch, KCFI always traps. To support error
handling, the compiler generates a .kcfi_traps section for x86_64,
which contains the locations of each trap, and for arm64, encodes
the necessary register information to the ESR. Patches 9 and 20 add
arch-specific error handlers.

To test this series, you'll need to compile your own Clang toolchain
with the patches linked above. You can also find the complete source
tree here:

  https://github.com/samitolvanen/llvm-project/commits/kcfi-rfc-v3

This series is also available in GitHub:

  https://github.com/samitolvanen/linux/commits/kcfi-rfc-v3

---
Changes in v3:
- Merged the patches that split CC_FLAGS_CFI from CC_FLAGS_LTO.

- Dropped the psci_initcall_t patch as Mark volunteered to send a
  patch for this. Note that this patch is still needed to boot a
  CFI kernel on certain arm64 systems:
  https://lore.kernel.org/lkml/YoNhKaTT3EDukxXY@FVFF77S0Q05N/

- Added a patch to remove the now unnecessary workarounds with
  CFI+ThinLTO in kallsyms.

- Added an lkdtm patch to ensure the test actually generates an
  indirect call.

- Changed report_cfi_failure to clearly indicate if we failed to
  decode target address.

- Switched to relative offsets for .kcfi_traps.

- On x86_64, moved CFI error handling from traps.c to cfi.c, and
  as we only call memcpy indirectly w/ CONFIG_MODULES, ensured that
  the compiler emits __kcfi_typeid_memcpy also without modules.

- On x86_64, added a check for the cmpl REX prefix to handle the
  case where the compiler might not use r8-r15 registers for the
  call target.

- On the compiler side, ensured that on x86_64 calls are emitted
  immediately after the CFI check, fixed the __cfi_ preamble
  linkage, and changed the compiler to emit relative offsets in
  .kcfi_traps.

Changes in v2:
- Changed the compiler patch to encode arm64 target and type details
  in the ESR, and updated the kernel error handling patch accordingly.

- Changed the compiler patch to embed the x86_64 type hash in a valid
  instruction to avoid special casing objtool instruction decoding, and
  added a __cfi_ symbol for the preamble. Changed the kernel error
  handling and manual type annotations to match.

- Dropped the .kcfi_types section as that’s no longer needed by
  objtool, and changed the objtool patch to simply ignore the __cfi_
  preambles falling through.

- Dropped the .kcfi_traps section on arm64 as it’s no longer needed,
  and moved the trap look-up code behind CONFIG_ARCH_USES_CFI_TRAPS,
  which is selected only for x86_64.

- Dropped __nocfi attributes from arm64 code where CFI was disabled
  due to address space confusion issues, and added type annotations to
  relevant assembly functions.

- Dropped __nocfi from __init.

Sami Tolvanen (20):
  treewide: Filter out CC_FLAGS_CFI
  scripts/kallsyms: Ignore __kcfi_typeid_
  cfi: Remove CONFIG_CFI_CLANG_SHADOW
  cfi: Drop __CFI_ADDRESSABLE
  cfi: Switch to -fsanitize=kcfi
  cfi: Add type helper macros
  lkdtm: Emit an indirect call for CFI tests
  arm64: Add types to indirect called assembly functions
  arm64: Add CFI error handling
  arm64: Drop unneeded __nocfi attributes
  init: Drop __nocfi from __init
  treewide: Drop function_nocfi
  treewide: Drop WARN_ON_FUNCTION_MISMATCH
  treewide: Drop __cficanonical
  objtool: Disable CFI warnings
  kallsyms: Drop CONFIG_CFI_CLANG workarounds
  x86/tools/relocs: Ignore __kcfi_typeid_ relocations
  x86: Add types to indirectly called assembly functions
  x86/purgatory: Disable CFI
  x86: Add support for CONFIG_CFI_CLANG

 Makefile                                  |  13 +-
 arch/Kconfig                              |  18 +-
 arch/arm64/crypto/ghash-ce-core.S         |   5 +-
 arch/arm64/crypto/sm3-ce-core.S           |   3 +-
 arch/arm64/include/asm/brk-imm.h          |   6 +
 arch/arm64/include/asm/ftrace.h           |   2 +-
 arch/arm64/include/asm/mmu_context.h      |   4 +-
 arch/arm64/kernel/acpi_parking_protocol.c |   2 +-
 arch/arm64/kernel/alternative.c           |   2 +-
 arch/arm64/kernel/cpu-reset.S             |   5 +-
 arch/arm64/kernel/cpufeature.c            |   4 +-
 arch/arm64/kernel/ftrace.c                |   2 +-
 arch/arm64/kernel/machine_kexec.c         |   2 +-
 arch/arm64/kernel/psci.c                  |   2 +-
 arch/arm64/kernel/smp_spin_table.c        |   2 +-
 arch/arm64/kernel/traps.c                 |  47 ++-
 arch/arm64/kernel/vdso/Makefile           |   3 +-
 arch/arm64/mm/proc.S                      |   5 +-
 arch/x86/Kconfig                          |   2 +
 arch/x86/crypto/blowfish-x86_64-asm_64.S  |   5 +-
 arch/x86/entry/vdso/Makefile              |   3 +-
 arch/x86/include/asm/cfi.h                |  22 ++
 arch/x86/include/asm/linkage.h            |  12 +
 arch/x86/kernel/Makefile                  |   2 +
 arch/x86/kernel/cfi.c                     |  83 ++++++
 arch/x86/kernel/traps.c                   |   4 +-
 arch/x86/lib/memcpy_64.S                  |   3 +-
 arch/x86/purgatory/Makefile               |   4 +
 arch/x86/tools/relocs.c                   |   1 +
 drivers/firmware/efi/libstub/Makefile     |   2 +
 drivers/firmware/psci/psci.c              |   4 +-
 drivers/misc/lkdtm/cfi.c                  |  15 +-
 drivers/misc/lkdtm/usercopy.c             |   2 +-
 include/asm-generic/bug.h                 |  16 -
 include/asm-generic/vmlinux.lds.h         |  37 +--
 include/linux/cfi.h                       |  59 ++--
 include/linux/cfi_types.h                 |  57 ++++
 include/linux/compiler-clang.h            |  14 +-
 include/linux/compiler.h                  |  16 +-
 include/linux/compiler_types.h            |   4 -
 include/linux/init.h                      |   6 +-
 include/linux/module.h                    |  10 +-
 include/linux/pci.h                       |   4 +-
 kernel/cfi.c                              | 342 ++++------------------
 kernel/kallsyms.c                         |  17 --
 kernel/kthread.c                          |   3 +-
 kernel/module/main.c                      |  49 +---
 kernel/workqueue.c                        |   2 +-
 scripts/kallsyms.c                        |   1 +
 scripts/module.lds.S                      |  23 +-
 tools/objtool/check.c                     |   7 +-
 51 files changed, 420 insertions(+), 538 deletions(-)
 create mode 100644 arch/x86/include/asm/cfi.h
 create mode 100644 arch/x86/kernel/cfi.c
 create mode 100644 include/linux/cfi_types.h

-- 
2.36.1.476.g0c4daa206d-goog


^ permalink raw reply	[flat|nested] 31+ messages in thread

end of thread, other threads:[~2022-07-26  0:10 UTC | newest]

Thread overview: 31+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-06-10 23:34 [RFC PATCH v3 00/20] KCFI support Sami Tolvanen
2022-06-10 23:34 ` [RFC PATCH v3 01/20] treewide: Filter out CC_FLAGS_CFI Sami Tolvanen
2022-06-10 23:34 ` [RFC PATCH v3 02/20] scripts/kallsyms: Ignore __kcfi_typeid_ Sami Tolvanen
2022-06-10 23:34 ` [RFC PATCH v3 03/20] cfi: Remove CONFIG_CFI_CLANG_SHADOW Sami Tolvanen
2022-06-10 23:34 ` [RFC PATCH v3 04/20] cfi: Drop __CFI_ADDRESSABLE Sami Tolvanen
2022-06-10 23:34 ` [RFC PATCH v3 05/20] cfi: Switch to -fsanitize=kcfi Sami Tolvanen
2022-06-10 23:34 ` [RFC PATCH v3 06/20] cfi: Add type helper macros Sami Tolvanen
2022-06-10 23:35 ` [RFC PATCH v3 07/20] lkdtm: Emit an indirect call for CFI tests Sami Tolvanen
2022-06-10 23:43   ` Nick Desaulniers
2022-06-11  6:01   ` Kees Cook
2022-06-10 23:35 ` [RFC PATCH v3 08/20] arm64: Add types to indirect called assembly functions Sami Tolvanen
2022-06-10 23:35 ` [RFC PATCH v3 09/20] arm64: Add CFI error handling Sami Tolvanen
2022-06-10 23:35 ` [RFC PATCH v3 10/20] arm64: Drop unneeded __nocfi attributes Sami Tolvanen
2022-06-10 23:35 ` [RFC PATCH v3 11/20] init: Drop __nocfi from __init Sami Tolvanen
2022-06-10 23:35 ` [RFC PATCH v3 12/20] treewide: Drop function_nocfi Sami Tolvanen
2022-06-10 23:35 ` [RFC PATCH v3 13/20] treewide: Drop WARN_ON_FUNCTION_MISMATCH Sami Tolvanen
2022-06-10 23:35 ` [RFC PATCH v3 14/20] treewide: Drop __cficanonical Sami Tolvanen
2022-06-10 23:35 ` [RFC PATCH v3 15/20] objtool: Disable CFI warnings Sami Tolvanen
2022-06-13 16:10   ` Josh Poimboeuf
2022-06-10 23:35 ` [RFC PATCH v3 16/20] kallsyms: Drop CONFIG_CFI_CLANG workarounds Sami Tolvanen
2022-06-10 23:40   ` Nick Desaulniers
2022-06-13 19:19     ` Bill Wendling
2022-06-10 23:35 ` [RFC PATCH v3 17/20] x86/tools/relocs: Ignore __kcfi_typeid_ relocations Sami Tolvanen
2022-06-10 23:35 ` [RFC PATCH v3 18/20] x86: Add types to indirectly called assembly functions Sami Tolvanen
2022-06-10 23:35 ` [RFC PATCH v3 19/20] x86/purgatory: Disable CFI Sami Tolvanen
2022-06-10 23:35 ` [RFC PATCH v3 20/20] x86: Add support for CONFIG_CFI_CLANG Sami Tolvanen
2022-07-23 11:21   ` Peter Zijlstra
2022-07-26  0:09     ` Sami Tolvanen
2022-06-13 17:04 ` [RFC PATCH v3 00/20] KCFI support Kees Cook
2022-07-18 21:46   ` Peter Zijlstra
2022-07-19 13:36   ` Will Deacon

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).