linux-hardening - Re: [PATCH v4 6/7] arm: Add ARM 32-bit Kernel Control Flow Integrity implementation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202509252105.CCE8EAC20@keescook>
Date: Thu, 25 Sep 2025 21:06:26 -0700
From: Kees Cook <kees@...nel.org>
To: Qing Zhao <qing.zhao@...cle.com>
Cc: Andrew Pinski <pinskia@...il.com>, Jakub Jelinek <jakub@...hat.com>,
	Martin Uecker <uecker@...raz.at>,
	Richard Biener <rguenther@...e.de>,
	Joseph Myers <josmyers@...hat.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Ard Biesheuvel <ardb@...nel.org>, Jeff Law <jeffreyalaw@...il.com>,
	Jan Hubicka <hubicka@....cz>,
	Richard Earnshaw <richard.earnshaw@....com>,
	Richard Sandiford <richard.sandiford@....com>,
	Marcus Shawcroft <marcus.shawcroft@....com>,
	Kyrylo Tkachov <kyrylo.tkachov@....com>,
	Kito Cheng <kito.cheng@...il.com>,
	Palmer Dabbelt <palmer@...belt.com>,
	Andrew Waterman <andrew@...ive.com>,
	Jim Wilson <jim.wilson.gcc@...il.com>,
	Dan Li <ashimida.1990@...il.com>,
	Sami Tolvanen <samitolvanen@...gle.com>,
	Ramon de C Valle <rcvalle@...gle.com>,
	Joao Moreira <joao@...rdrivepizza.com>,
	Nathan Chancellor <nathan@...nel.org>,
	Bill Wendling <morbo@...gle.com>, gcc-patches@....gnu.org,
	linux-hardening@...r.kernel.org
Subject: Re: [PATCH v4 6/7] arm: Add ARM 32-bit Kernel Control Flow Integrity
 implementation

On Thu, Sep 25, 2025 at 08:02:48PM -0700, Kees Cook wrote:
> Assembly Code Pattern for ARM 32-bit:
>   push {r0, r1}                ; Spill r0, r1
>   ldr  r0, [target, #-4]       ; Load actual type ID from preamble
>   movw r1, #type_id_low        ; Load expected type (lower 16 bits)
>   movt r1, #type_id_high       ; Load upper 16 bits with top instruction
>   cmp  r0, r1                  ; Compare type IDs directly
>   pop [r0, r1]                 ; Reload r0, r1
>   beq  .Lkcfi_call             ; Branch if typeids match
>   .Lkcfi_trap: udf #udf_value  ; Undefined instruction trap with encoding
>   .Lkcfi_call: blx/bx target   ; Execute validated indirect transfer

Agh, I missed changing this part of the commit log to reflect the new
eor sequence. I'll get that fixed.

-- 
Kees Cook