| Message ID | 20220908215504.3686827-1-samitolvanen@google.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | KCFI support | expand |
On Thu, Sep 08, 2022 at 02:54:42PM -0700, Sami Tolvanen wrote: > KCFI is a forward-edge control-flow integrity scheme in the upcoming > Clang 16 release, which is more suitable for kernel use than the > existing CFI scheme used by CONFIG_CFI_CLANG. KCFI doesn't require > LTO, doesn't alter function references to point to a jump table, and > won't break function address equality. > > This series replaces the current arm64 CFI implementation with KCFI > and adds support for x86_64. > > KCFI requires assembly functions that are indirectly called from C > code to be annotated with type identifiers. As type information is > only available in C, the compiler emits expected type identifiers > into the symbol table, so they can be referenced from assembly > without having to hardcode type hashes. Patch 6 adds helper macros > for annotating functions, and patches 9 and 20 add annotations. > > In case of a type mismatch, KCFI always traps. To support error > handling, the compiler generates a .kcfi_traps section for x86_64, > which contains the locations of each trap, and for arm64, encodes > the necessary register information to the ESR. Patches 10 and 22 add > arch-specific error handlers. > > To test this series, you'll need a ToT Clang toolchain. The series > is also available pn GitHub: > > https://github.com/samitolvanen/linux/commits/kcfi-v5 As mentioned at plumbers, my only concern is somewhat excessive use of CFI_CLANG as oposed to something more compiler neutral. But I suppose that's something we can cleanup/fix when GCC grows support for this. Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Tested-by: Peter Zijlstra (Intel) <peterz@infradead.org> (as in I ran kCFI + call-depth-tracking + FineIBT on a bunch of hardware) HJL, can you look at adding kCFI support to GCC ?
On Thu, 8 Sep 2022 14:54:42 -0700, Sami Tolvanen wrote: > KCFI is a forward-edge control-flow integrity scheme in the upcoming > Clang 16 release, which is more suitable for kernel use than the > existing CFI scheme used by CONFIG_CFI_CLANG. KCFI doesn't require > LTO, doesn't alter function references to point to a jump table, and > won't break function address equality. > > This series replaces the current arm64 CFI implementation with KCFI > and adds support for x86_64. > > [...] I assume that Peter's Ack means I should carry the tree, so, to that end: Applied to for-next/kcfi, thanks! [01/22] treewide: Filter out CC_FLAGS_CFI https://git.kernel.org/kees/c/f143ff397a3f [02/22] scripts/kallsyms: Ignore __kcfi_typeid_ https://git.kernel.org/kees/c/d0f9562ee43a [03/22] cfi: Remove CONFIG_CFI_CLANG_SHADOW https://git.kernel.org/kees/c/9fca7115827b [04/22] cfi: Drop __CFI_ADDRESSABLE https://git.kernel.org/kees/c/92efda8eb152 [05/22] cfi: Switch to -fsanitize=kcfi https://git.kernel.org/kees/c/89245600941e [06/22] cfi: Add type helper macros https://git.kernel.org/kees/c/e84e008e7b02 [07/22] lkdtm: Emit an indirect call for CFI tests https://git.kernel.org/kees/c/cf90d0383560 [08/22] psci: Fix the function type for psci_initcall_t https://git.kernel.org/kees/c/44f665b69c67 [09/22] arm64: Add types to indirect called assembly functions https://git.kernel.org/kees/c/c50d32859e70 [10/22] arm64: Add CFI error handling https://git.kernel.org/kees/c/b26e484b8bb3 [11/22] arm64: Drop unneeded __nocfi attributes https://git.kernel.org/kees/c/5f20997c194e [12/22] init: Drop __nocfi from __init https://git.kernel.org/kees/c/5dbbb3eaa2a7 [13/22] treewide: Drop function_nocfi https://git.kernel.org/kees/c/607289a7cd7a [14/22] treewide: Drop WARN_ON_FUNCTION_MISMATCH https://git.kernel.org/kees/c/4b24356312fb [15/22] treewide: Drop __cficanonical https://git.kernel.org/kees/c/5659b598b4dc [16/22] objtool: Preserve special st_shndx indexes in elf_update_symbol https://git.kernel.org/kees/c/5141d3a06b2d [17/22] objtool: Disable CFI warnings https://git.kernel.org/kees/c/3c68a92d17ad [18/22] kallsyms: Drop CONFIG_CFI_CLANG workarounds https://git.kernel.org/kees/c/dfb352ab1162 [19/22] x86/tools/relocs: Ignore __kcfi_typeid_ relocations https://git.kernel.org/kees/c/ca7e10bff196 [20/22] x86: Add types to indirectly called assembly functions https://git.kernel.org/kees/c/ccace936eec7 [21/22] x86/purgatory: Disable CFI https://git.kernel.org/kees/c/a4b7a12c5594 [22/22] x86: Add support for CONFIG_CFI_CLANG https://git.kernel.org/kees/c/3c516f89e17e
On Mon, Sep 26, 2022 at 5:39 AM Peter Zijlstra <peterz@infradead.org> wrote: > > On Thu, Sep 08, 2022 at 02:54:42PM -0700, Sami Tolvanen wrote: > > KCFI is a forward-edge control-flow integrity scheme in the upcoming > > Clang 16 release, which is more suitable for kernel use than the > > existing CFI scheme used by CONFIG_CFI_CLANG. KCFI doesn't require > > LTO, doesn't alter function references to point to a jump table, and > > won't break function address equality. > > > > This series replaces the current arm64 CFI implementation with KCFI > > and adds support for x86_64. > > > > KCFI requires assembly functions that are indirectly called from C > > code to be annotated with type identifiers. As type information is > > only available in C, the compiler emits expected type identifiers > > into the symbol table, so they can be referenced from assembly > > without having to hardcode type hashes. Patch 6 adds helper macros > > for annotating functions, and patches 9 and 20 add annotations. > > > > In case of a type mismatch, KCFI always traps. To support error > > handling, the compiler generates a .kcfi_traps section for x86_64, > > which contains the locations of each trap, and for arm64, encodes > > the necessary register information to the ESR. Patches 10 and 22 add > > arch-specific error handlers. > > > > To test this series, you'll need a ToT Clang toolchain. The series > > is also available pn GitHub: > > > > https://github.com/samitolvanen/linux/commits/kcfi-v5 > > As mentioned at plumbers, my only concern is somewhat excessive use of > CFI_CLANG as oposed to something more compiler neutral. But I suppose > that's something we can cleanup/fix when GCC grows support for this. > > Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> > Tested-by: Peter Zijlstra (Intel) <peterz@infradead.org> > > (as in I ran kCFI + call-depth-tracking + FineIBT on a bunch of > hardware) > > HJL, can you look at adding kCFI support to GCC ? Adding -fsanitize=kcfi to GCC is a big effort. Please open a GCC bug: https://gcc.gnu.org/bugzilla/enter_bug.cgi?product=gcc
On Mon, Sep 26, 2022 at 01:16:04PM -0700, H.J. Lu wrote: > On Mon, Sep 26, 2022 at 5:39 AM Peter Zijlstra <peterz@infradead.org> wrote: > > > > On Thu, Sep 08, 2022 at 02:54:42PM -0700, Sami Tolvanen wrote: > > > KCFI is a forward-edge control-flow integrity scheme in the upcoming > > > Clang 16 release, which is more suitable for kernel use than the > > > existing CFI scheme used by CONFIG_CFI_CLANG. KCFI doesn't require > > > LTO, doesn't alter function references to point to a jump table, and > > > won't break function address equality. > > > > > > This series replaces the current arm64 CFI implementation with KCFI > > > and adds support for x86_64. > > > > > > KCFI requires assembly functions that are indirectly called from C > > > code to be annotated with type identifiers. As type information is > > > only available in C, the compiler emits expected type identifiers > > > into the symbol table, so they can be referenced from assembly > > > without having to hardcode type hashes. Patch 6 adds helper macros > > > for annotating functions, and patches 9 and 20 add annotations. > > > > > > In case of a type mismatch, KCFI always traps. To support error > > > handling, the compiler generates a .kcfi_traps section for x86_64, > > > which contains the locations of each trap, and for arm64, encodes > > > the necessary register information to the ESR. Patches 10 and 22 add > > > arch-specific error handlers. > > > > > > To test this series, you'll need a ToT Clang toolchain. The series > > > is also available pn GitHub: > > > > > > https://github.com/samitolvanen/linux/commits/kcfi-v5 > > > > As mentioned at plumbers, my only concern is somewhat excessive use of > > CFI_CLANG as oposed to something more compiler neutral. But I suppose > > that's something we can cleanup/fix when GCC grows support for this. > > > > Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> > > Tested-by: Peter Zijlstra (Intel) <peterz@infradead.org> > > > > (as in I ran kCFI + call-depth-tracking + FineIBT on a bunch of > > hardware) > > > > HJL, can you look at adding kCFI support to GCC ? > > Adding -fsanitize=kcfi to GCC is a big effort. Please open a > GCC bug: > > https://gcc.gnu.org/bugzilla/enter_bug.cgi?product=gcc Here goes: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107048
On Mon, Sep 26, 2022 at 7:21 PM Kees Cook <keescook@chromium.org> wrote: > > On Thu, 8 Sep 2022 14:54:42 -0700, Sami Tolvanen wrote: > > KCFI is a forward-edge control-flow integrity scheme in the upcoming > > Clang 16 release, which is more suitable for kernel use than the > > existing CFI scheme used by CONFIG_CFI_CLANG. KCFI doesn't require > > LTO, doesn't alter function references to point to a jump table, and > > won't break function address equality. > > > > This series replaces the current arm64 CFI implementation with KCFI > > and adds support for x86_64. > > > > [...] > > I assume that Peter's Ack means I should carry the tree, so, to that end: > > Applied to for-next/kcfi, thanks! > Hi, I did regularly KCFI testing. 1. Used Sami's samitolvanen.github#linux/kcfi Git on the Linux side. 2. Used *not* LLVM-16 (including KCFI) but with LLVM-15 from samitolvanen.github#llvm-project/15.x/kcfi Git on the toolchain side. My last testing was with [1] (Linux v6.0-rc7 + KCFI) and [2] (LLVM v15.0.1 + KCFI) plus drm-i915-gt/KCFI for Linux v6.0-rc7 patch from Nathan (see [3]). Thanks Sami for updating 15.x/kcfi on LLVM side on my request. So, feel free to add my: Tested-by: Sedat Dilek <sedat.dilek@gmail.com> # LLVM-15 (with KCFI support) on x86-64 Thanks to all involved people! Best regards, -Sedat- [1] https://github.com/samitolvanen/linux/commits/kcfi [2] https://github.com/samitolvanen/llvm-project/commits/15.x/kcfi [3] https://github.com/ClangBuiltLinux/linux/issues/1716#issuecomment-1257311327 > [01/22] treewide: Filter out CC_FLAGS_CFI > https://git.kernel.org/kees/c/f143ff397a3f > [02/22] scripts/kallsyms: Ignore __kcfi_typeid_ > https://git.kernel.org/kees/c/d0f9562ee43a > [03/22] cfi: Remove CONFIG_CFI_CLANG_SHADOW > https://git.kernel.org/kees/c/9fca7115827b > [04/22] cfi: Drop __CFI_ADDRESSABLE > https://git.kernel.org/kees/c/92efda8eb152 > [05/22] cfi: Switch to -fsanitize=kcfi > https://git.kernel.org/kees/c/89245600941e > [06/22] cfi: Add type helper macros > https://git.kernel.org/kees/c/e84e008e7b02 > [07/22] lkdtm: Emit an indirect call for CFI tests > https://git.kernel.org/kees/c/cf90d0383560 > [08/22] psci: Fix the function type for psci_initcall_t > https://git.kernel.org/kees/c/44f665b69c67 > [09/22] arm64: Add types to indirect called assembly functions > https://git.kernel.org/kees/c/c50d32859e70 > [10/22] arm64: Add CFI error handling > https://git.kernel.org/kees/c/b26e484b8bb3 > [11/22] arm64: Drop unneeded __nocfi attributes > https://git.kernel.org/kees/c/5f20997c194e > [12/22] init: Drop __nocfi from __init > https://git.kernel.org/kees/c/5dbbb3eaa2a7 > [13/22] treewide: Drop function_nocfi > https://git.kernel.org/kees/c/607289a7cd7a > [14/22] treewide: Drop WARN_ON_FUNCTION_MISMATCH > https://git.kernel.org/kees/c/4b24356312fb > [15/22] treewide: Drop __cficanonical > https://git.kernel.org/kees/c/5659b598b4dc > [16/22] objtool: Preserve special st_shndx indexes in elf_update_symbol > https://git.kernel.org/kees/c/5141d3a06b2d > [17/22] objtool: Disable CFI warnings > https://git.kernel.org/kees/c/3c68a92d17ad > [18/22] kallsyms: Drop CONFIG_CFI_CLANG workarounds > https://git.kernel.org/kees/c/dfb352ab1162 > [19/22] x86/tools/relocs: Ignore __kcfi_typeid_ relocations > https://git.kernel.org/kees/c/ca7e10bff196 > [20/22] x86: Add types to indirectly called assembly functions > https://git.kernel.org/kees/c/ccace936eec7 > [21/22] x86/purgatory: Disable CFI > https://git.kernel.org/kees/c/a4b7a12c5594 > [22/22] x86: Add support for CONFIG_CFI_CLANG > https://git.kernel.org/kees/c/3c516f89e17e > > -- > Kees Cook >