| Message ID | 20220401201916.1487500-2-samitolvanen@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | cfi: Use __builtin_function_start | expand |
On Sat, Apr 2, 2022 at 5:19 AM Sami Tolvanen <samitolvanen@google.com> wrote: > > Clang 14 added support for the __builtin_function_start() > built-in function, which allows us to implement function_nocfi() > without architecture-specific inline assembly. This patch changes > CONFIG_CFI_CLANG to depend on the built-in and effectively upgrades > the minimum supported compiler version for CFI to Clang 14. From this description, I think the straight-forward change would be: depends on CLANG_VERSION >= 120000 --> depends on CLANG_VERSION >= 140000 Any reason to avoid this? > > Signed-off-by: Sami Tolvanen <samitolvanen@google.com> > --- > arch/Kconfig | 5 +---- > init/Kconfig | 3 +++ > 2 files changed, 4 insertions(+), 4 deletions(-) > > diff --git a/arch/Kconfig b/arch/Kconfig > index 29b0167c088b..eecfc2809781 100644 > --- a/arch/Kconfig > +++ b/arch/Kconfig > @@ -723,10 +723,7 @@ config ARCH_SUPPORTS_CFI_CLANG > config CFI_CLANG > bool "Use Clang's Control Flow Integrity (CFI)" > depends on LTO_CLANG && ARCH_SUPPORTS_CFI_CLANG > - # Clang >= 12: > - # - https://bugs.llvm.org/show_bug.cgi?id=46258 > - # - https://bugs.llvm.org/show_bug.cgi?id=47479 > - depends on CLANG_VERSION >= 120000 > + depends on CC_HAS_BUILTIN_FUNCTION_START > select KALLSYMS > help > This option enables Clang’s forward-edge Control Flow Integrity > diff --git a/init/Kconfig b/init/Kconfig > index ddcbefe535e9..f024fd353373 100644 > --- a/init/Kconfig > +++ b/init/Kconfig > @@ -86,6 +86,9 @@ config CC_HAS_ASM_INLINE > config CC_HAS_NO_PROFILE_FN_ATTR > def_bool $(success,echo '__attribute__((no_profile_instrument_function)) int x();' | $(CC) -x c - -c -o /dev/null -Werror) > > +config CC_HAS_BUILTIN_FUNCTION_START > + def_bool $(success,echo 'void f(void) {}; void *p = __builtin_function_start(f);' | $(CC) -x c - -c -o /dev/null) > + > config PAHOLE_VERSION > int > default $(shell,$(srctree)/scripts/pahole-version.sh $(PAHOLE)) > -- > 2.35.0 > -- Best Regards Masahiro Yamada
On Sat, Apr 2, 2022 at 6:32 AM Masahiro Yamada <masahiroy@kernel.org> wrote: > > On Sat, Apr 2, 2022 at 5:19 AM Sami Tolvanen <samitolvanen@google.com> wrote: > > > > Clang 14 added support for the __builtin_function_start() > > built-in function, which allows us to implement function_nocfi() > > without architecture-specific inline assembly. This patch changes > > CONFIG_CFI_CLANG to depend on the built-in and effectively upgrades > > the minimum supported compiler version for CFI to Clang 14. > > From this description, I think the straight-forward change would be: > > depends on CLANG_VERSION >= 120000 > --> > depends on CLANG_VERSION >= 140000 > > Any reason to avoid this? I thought testing for the compiler feature was preferred, but I can certainly just increase the minimum version number here too. Sami
On Mon, Apr 04, 2022 at 12:40:46PM -0700, Sami Tolvanen wrote: > On Sat, Apr 2, 2022 at 6:32 AM Masahiro Yamada <masahiroy@kernel.org> wrote: > > > > On Sat, Apr 2, 2022 at 5:19 AM Sami Tolvanen <samitolvanen@google.com> wrote: > > > > > > Clang 14 added support for the __builtin_function_start() > > > built-in function, which allows us to implement function_nocfi() > > > without architecture-specific inline assembly. This patch changes > > > CONFIG_CFI_CLANG to depend on the built-in and effectively upgrades > > > the minimum supported compiler version for CFI to Clang 14. > > > > From this description, I think the straight-forward change would be: > > > > depends on CLANG_VERSION >= 120000 > > --> > > depends on CLANG_VERSION >= 140000 > > > > Any reason to avoid this? > > I thought testing for the compiler feature was preferred, but I can > certainly just increase the minimum version number here too. I think we have been somewhat inconsistent with feature versus version checking. It might be nice to hash out when a feature check should be done instead of a version one. Generally, I think we tend to prefer version checks, as they are "cheaper" since we do not have to call the compiler again because we already cached the version code. When adding version checks, our policy has always been use the upstream version of LLVM that the feature in question shipped in, even if it is a top of tree version, as people who are using prereleased versions of LLVM should be frequently updating them. Unfortunately, that does not always match reality. For example, Android's LLVM tracks the main branch but they are almost always behind by a few months. For example, the latest release is 14.0.4, based on a version of LLVM from January 28th: https://android.googlesource.com/platform/prebuilts/clang/host/linux-x86/+/ab73cd180863dbd17fdb8f20e39b33ab38030cf9/clang-r450784b/clang_source_info.md https://github.com/llvm/llvm-project/commits/282c83c32384cb2f37030c28650fef4150a8b67c Normally, I would say "who cares?" but Android's LLVM is used by the Android kernel team both downstream and upstream, so I would argue it is important to take that into account when deciding to do a feature check versus a version check. In other words, by moving to a version check, will we knowingly break a version of clang that is relatively widely used? In this case, 14.0.4 has __builtin_function_start(), so I think it is okay to use a version check instead of a feature one. There are times where feature or problem checking is not always possible: https://lore.kernel.org/r/20220318230747.3900772-1-nathan@kernel.org/ In cases like these, we can work to upgrade the compiler before changing the feature check ot a version one, which helps minimize the window for breakage. Another aspect of feature versus version checks is that it is easier to clean up stale versions checks when we bump the minimum supported version of the compiler (as we can just look for "CLANG_VERSION" across the tree) compared to stale feature checks. We could fix this by adding some sort of common keyword, like Compiler check: <compiler> <comparison> <version> like Compiler check: clang <= 14.0.0 Cheers, Nathan
On Mon, Apr 04, 2022 at 03:52:11PM -0700, Nathan Chancellor wrote: > On Mon, Apr 04, 2022 at 12:40:46PM -0700, Sami Tolvanen wrote: > > On Sat, Apr 2, 2022 at 6:32 AM Masahiro Yamada <masahiroy@kernel.org> wrote: > > > > > > On Sat, Apr 2, 2022 at 5:19 AM Sami Tolvanen <samitolvanen@google.com> wrote: > > > > > > > > Clang 14 added support for the __builtin_function_start() > > > > built-in function, which allows us to implement function_nocfi() > > > > without architecture-specific inline assembly. This patch changes > > > > CONFIG_CFI_CLANG to depend on the built-in and effectively upgrades > > > > the minimum supported compiler version for CFI to Clang 14. > > > > > > From this description, I think the straight-forward change would be: > > > > > > depends on CLANG_VERSION >= 120000 > > > --> > > > depends on CLANG_VERSION >= 140000 > > > > > > Any reason to avoid this? > > > > I thought testing for the compiler feature was preferred, but I can > > certainly just increase the minimum version number here too. > > I think we have been somewhat inconsistent with feature versus version > checking. It might be nice to hash out when a feature check should be > done instead of a version one. > > Generally, I think we tend to prefer version checks, as they are > "cheaper" since we do not have to call the compiler again because we > already cached the version code. When adding version checks, our policy > has always been use the upstream version of LLVM that the feature in > question shipped in, even if it is a top of tree version, as people who > are using prereleased versions of LLVM should be frequently updating > them. > > Unfortunately, that does not always match reality. For example, > Android's LLVM tracks the main branch but they are almost always behind > by a few months. For example, the latest release is 14.0.4, based on a > version of LLVM from January 28th: > > https://android.googlesource.com/platform/prebuilts/clang/host/linux-x86/+/ab73cd180863dbd17fdb8f20e39b33ab38030cf9/clang-r450784b/clang_source_info.md > https://github.com/llvm/llvm-project/commits/282c83c32384cb2f37030c28650fef4150a8b67c > > Normally, I would say "who cares?" but Android's LLVM is used by the > Android kernel team both downstream and upstream, so I would argue it is > important to take that into account when deciding to do a feature check > versus a version check. In other words, by moving to a version check, > will we knowingly break a version of clang that is relatively widely > used? > > In this case, 14.0.4 has __builtin_function_start(), so I think it is > okay to use a version check instead of a feature one. Thanks for checking the details on that. Yeah, I think it's fine to go with a version check here. Sami, can you send a v2, and I can take it via the hardening for -next? (Unless the ARM folks _really_ want it for -rc2 -- this is kind of a fix, but it's also kind of not.)
diff --git a/arch/Kconfig b/arch/Kconfig index 29b0167c088b..eecfc2809781 100644 --- a/arch/Kconfig +++ b/arch/Kconfig @@ -723,10 +723,7 @@ config ARCH_SUPPORTS_CFI_CLANG config CFI_CLANG bool "Use Clang's Control Flow Integrity (CFI)" depends on LTO_CLANG && ARCH_SUPPORTS_CFI_CLANG - # Clang >= 12: - # - https://bugs.llvm.org/show_bug.cgi?id=46258 - # - https://bugs.llvm.org/show_bug.cgi?id=47479 - depends on CLANG_VERSION >= 120000 + depends on CC_HAS_BUILTIN_FUNCTION_START select KALLSYMS help This option enables Clang’s forward-edge Control Flow Integrity diff --git a/init/Kconfig b/init/Kconfig index ddcbefe535e9..f024fd353373 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -86,6 +86,9 @@ config CC_HAS_ASM_INLINE config CC_HAS_NO_PROFILE_FN_ATTR def_bool $(success,echo '__attribute__((no_profile_instrument_function)) int x();' | $(CC) -x c - -c -o /dev/null -Werror) +config CC_HAS_BUILTIN_FUNCTION_START + def_bool $(success,echo 'void f(void) {}; void *p = __builtin_function_start(f);' | $(CC) -x c - -c -o /dev/null) + config PAHOLE_VERSION int default $(shell,$(srctree)/scripts/pahole-version.sh $(PAHOLE))
Clang 14 added support for the __builtin_function_start() built-in function, which allows us to implement function_nocfi() without architecture-specific inline assembly. This patch changes CONFIG_CFI_CLANG to depend on the built-in and effectively upgrades the minimum supported compiler version for CFI to Clang 14. Signed-off-by: Sami Tolvanen <samitolvanen@google.com> --- arch/Kconfig | 5 +---- init/Kconfig | 3 +++ 2 files changed, 4 insertions(+), 4 deletions(-)