linux-kernel - Re: [PATCH v2] cfi: Use __builtin_function

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 5 Apr 2022 15:20:39 -0700
From:   Nathan Chancellor <nathan@...nel.org>
To:     Sami Tolvanen <samitolvanen@...gle.com>
Cc:     Kees Cook <keescook@...omium.org>,
        Catalin Marinas <catalin.marinas@....com>,
        Mark Rutland <mark.rutland@....com>,
        Masahiro Yamada <masahiroy@...nel.org>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Will Deacon <will@...nel.org>,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        llvm@...ts.linux.dev
Subject: Re: [PATCH v2] cfi: Use __builtin_function_start

On Tue, Apr 05, 2022 at 03:16:18PM -0700, Sami Tolvanen wrote:
> Clang 14 added support for the __builtin_function_start function,
> which allows us to implement the function_nocfi macro without
> architecture-specific inline assembly and in a way that also works
> with static initializers.
> 
> Change CONFIG_CFI_CLANG to depend on Clang >= 14, define
> function_nocfi using __builtin_function_start, and remove the arm64
> inline assembly implementation.
> 
> Link: https://github.com/llvm/llvm-project/commit/ec2e26eaf63558934f5b73a6e530edc453cf9508
> Link: https://github.com/ClangBuiltLinux/linux/issues/1353
> Signed-off-by: Sami Tolvanen <samitolvanen@...gle.com>
> Reviewed-by: Nick Desaulniers <ndesaulniers@...gle.com>
> Reviewed-by: Mark Rutland <mark.rutland@....com>
> Tested-by: Mark Rutland <mark.rutland@....com>
> Acked-by: Will Deacon <will@...nel.org> # arm64

Reviewed-by: Nathan Chancellor <nathan@...nel.org>

> ---
> v2:
> - Changed CFI_CLANG to depend on Clang 14 instead of
>   __builtin_function_start.
> - Squashed all three patches into one.
> 
> ---
>  arch/Kconfig                      |  5 +----
>  arch/arm64/include/asm/compiler.h | 16 ----------------
>  include/linux/compiler-clang.h    | 10 ++++++++++
>  3 files changed, 11 insertions(+), 20 deletions(-)
> 
> diff --git a/arch/Kconfig b/arch/Kconfig
> index 29b0167c088b..c1627bce4a3a 100644
> --- a/arch/Kconfig
> +++ b/arch/Kconfig
> @@ -723,10 +723,7 @@ config ARCH_SUPPORTS_CFI_CLANG
>  config CFI_CLANG
>  	bool "Use Clang's Control Flow Integrity (CFI)"
>  	depends on LTO_CLANG && ARCH_SUPPORTS_CFI_CLANG
> -	# Clang >= 12:
> -	# - https://bugs.llvm.org/show_bug.cgi?id=46258
> -	# - https://bugs.llvm.org/show_bug.cgi?id=47479
> -	depends on CLANG_VERSION >= 120000
> +	depends on CLANG_VERSION >= 140000
>  	select KALLSYMS
>  	help
>  	  This option enables Clang’s forward-edge Control Flow Integrity
> diff --git a/arch/arm64/include/asm/compiler.h b/arch/arm64/include/asm/compiler.h
> index dc3ea4080e2e..6fb2e6bcc392 100644
> --- a/arch/arm64/include/asm/compiler.h
> +++ b/arch/arm64/include/asm/compiler.h
> @@ -23,20 +23,4 @@
>  #define __builtin_return_address(val)					\
>  	(void *)(ptrauth_clear_pac((unsigned long)__builtin_return_address(val)))
>  
> -#ifdef CONFIG_CFI_CLANG
> -/*
> - * With CONFIG_CFI_CLANG, the compiler replaces function address
> - * references with the address of the function's CFI jump table
> - * entry. The function_nocfi macro always returns the address of the
> - * actual function instead.
> - */
> -#define function_nocfi(x) ({						\
> -	void *addr;							\
> -	asm("adrp %0, " __stringify(x) "\n\t"				\
> -	    "add  %0, %0, :lo12:" __stringify(x)			\
> -	    : "=r" (addr));						\
> -	addr;								\
> -})
> -#endif
> -
>  #endif /* __ASM_COMPILER_H */
> diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
> index babb1347148c..c84fec767445 100644
> --- a/include/linux/compiler-clang.h
> +++ b/include/linux/compiler-clang.h
> @@ -69,6 +69,16 @@
>  #define __nocfi		__attribute__((__no_sanitize__("cfi")))
>  #define __cficanonical	__attribute__((__cfi_canonical_jump_table__))
>  
> +#if defined(CONFIG_CFI_CLANG)
> +/*
> + * With CONFIG_CFI_CLANG, the compiler replaces function address
> + * references with the address of the function's CFI jump table
> + * entry. The function_nocfi macro always returns the address of the
> + * actual function instead.
> + */
> +#define function_nocfi(x)	__builtin_function_start(x)
> +#endif
> +
>  /*
>   * Turn individual warnings and errors on and off locally, depending
>   * on version.
> -- 
> 2.35.1.1094.g7c7d902a7c-goog
>