Re: [PATCH v5 00/22] KCFI support

On Thu, Sep 08, 2022 at 02:54:42PM -0700, Sami Tolvanen wrote:

KCFI is a forward-edge control-flow integrity scheme in the upcoming
Clang 16 release, which is more suitable for kernel use than the
existing CFI scheme used by CONFIG_CFI_CLANG. KCFI doesn't require
LTO, doesn't alter function references to point to a jump table, and
won't break function address equality.

This series replaces the current arm64 CFI implementation with KCFI
and adds support for x86_64.

KCFI requires assembly functions that are indirectly called from C
code to be annotated with type identifiers. As type information is
only available in C, the compiler emits expected type identifiers
into the symbol table, so they can be referenced from assembly
without having to hardcode type hashes. Patch 6 adds helper macros
for annotating functions, and patches 9 and 20 add annotations.

In case of a type mismatch, KCFI always traps. To support error
handling, the compiler generates a .kcfi_traps section for x86_64,
which contains the locations of each trap, and for arm64, encodes
the necessary register information to the ESR. Patches 10 and 22 add
arch-specific error handlers.

To test this series, you'll need a ToT Clang toolchain. The series
is also available pn GitHub:

  https://github.com/samitolvanen/linux/commits/kcfi-v5

As mentioned at plumbers, my only concern is somewhat excessive use of
CFI_CLANG as oposed to something more compiler neutral. But I suppose
that's something we can cleanup/fix when GCC grows support for this.

Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-by: Peter Zijlstra (Intel) <peterz@infradead.org>

(as in I ran kCFI + call-depth-tracking + FineIBT on a bunch of
hardware)

HJL, can you look at adding kCFI support to GCC ?

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel