From nobody Fri Oct 3 06:33:25 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D3EF019F127; Thu, 4 Sep 2025 03:46:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756957617; cv=none; b=liu3NMQGHqrhShXCxvszE2/Exgw5H6pN/1d5OOsrENw+AuHoI7xD+ejA/CeiebykcfmZkolfE4dO/0t1Z8tgHsfu068DJK04CGgMp1SKn7CSSTtJ+IzGtm7ouNF1TlAYap7EssuC3kDjJOqkIlXYypgR78lJCjG6kVQV+vXZe4A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756957617; c=relaxed/simple; bh=d3lOLi68KOsHVuJ/f3j08zMj0QWctUjZ54+wY+NXD08=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=L5PcTkGEAbwovUOcrhx7wGDvuyFGnWd0WJXTUEf+P2iBmB9GLxATfRAolgo720NIJn1MALawdE4Ps9iF5KR0ETxs2UVpLwm2gDXtupm+XgYFTZ9gUbEl8kzzf4RWkA/MYMgIhDJoC+V3g0tzRZwS4vIJbg9eZvaSnRSXNllYrTA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=WgQf/Pim; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="WgQf/Pim" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 625BAC4CEF6; Thu, 4 Sep 2025 03:46:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1756957616; bh=d3lOLi68KOsHVuJ/f3j08zMj0QWctUjZ54+wY+NXD08=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WgQf/PimBcqXFchHFFEXbGkt8CPsVDbpv3hGvURMfReygav6u5xf86AMUd5DROUP6 fNC3wlARQSAoXfliV/h+AXt/o27Ivu9RfomLqUxm0+VdkuU5Nzk11H6HAohoCpzy6+ rbIMn0HY71k68cSQtrjQFhE2gFUFMtMOqoB+wbFR4PEGbhPCzXNb7Z70z/EY6zc5Ax /lamD6uEhHQoHb3eW9UsQ4Tfw8JaEvOKTNv+0rhHdZhj0LEt1u8h9DgOrUth8TLAEN /g+wNzxYIDGe18HCyIQNPgM4YFUvb06pMfW7n/JpltZ4z4x7wDWtoBIKF/UcW/DEPt 1iJYogmhAdLDQ== From: Kees Cook To: Peter Zijlstra Cc: Kees Cook , Nathan Chancellor , Nick Desaulniers , Bill Wendling , Justin Stitt , Miguel Ojeda , Marco Elver , Przemek Kitszel , Ramon de C Valle , llvm@lists.linux.dev, Vegard Nossum , Linus Walleij , Jeff Johnson , Randy Dunlap , David Woodhouse , "Russell King (Oracle)" , Jonathan Corbet , "Paul E. McKenney" , Nicolas Schier , Masahiro Yamada , Arnd Bergmann , Krzysztof Kozlowski , Sami Tolvanen , Mark Rutland , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-kbuild@vger.kernel.org, linux-arm-kernel@lists.infradead.org, x86@kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 1/9] compiler_types.h: Move __nocfi out of compiler-specific header Date: Wed, 3 Sep 2025 20:46:40 -0700 Message-Id: <20250904034656.3670313-1-kees@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250904033217.it.414-kees@kernel.org> References: <20250904033217.it.414-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1743; i=kees@kernel.org; h=from:subject; bh=d3lOLi68KOsHVuJ/f3j08zMj0QWctUjZ54+wY+NXD08=; b=owGbwMvMwCVmps19z/KJym7G02pJDBk7OYtuJi1qLixhqb860yLcbsEPyaa/uQe18+7JeZj9F RMXrm7sKGVhEONikBVTZAmyc49z8XjbHu4+VxFmDisTyBAGLk4BmMiSCIb/MfMWcC1u7nPcvDS9 tlDJtsX0xvJV3CKsf/eJimm8OfoxjZHhZYDFc4NVL3fzS9216vF/erDP5f6VnveKx15OPcOeoMn ADgA= X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Prepare for GCC KCFI support and move the __nocfi attribute from compiler-clang.h to compiler_types.h. This was already gated by CONFIG_CFI_CLANG, so this remains safe for non-KCFI GCC builds. Signed-off-by: Kees Cook Reviewed-by: Nathan Chancellor --- Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Bill Wendling Cc: Justin Stitt Cc: Miguel Ojeda Cc: Marco Elver Cc: Przemek Kitszel Cc: Ramon de C Valle Cc: --- include/linux/compiler-clang.h | 5 ----- include/linux/compiler_types.h | 4 +++- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h index fa4ffe037bc7..7a4568e421dc 100644 --- a/include/linux/compiler-clang.h +++ b/include/linux/compiler-clang.h @@ -96,11 +96,6 @@ # define __noscs __attribute__((__no_sanitize__("shadow-call-stack"))) #endif =20 -#if __has_feature(kcfi) -/* Disable CFI checking inside a function. */ -#define __nocfi __attribute__((__no_sanitize__("kcfi"))) -#endif - /* * Turn individual warnings and errors on and off locally, depending * on version. diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h index 16755431fc11..a910f9fa5341 100644 --- a/include/linux/compiler_types.h +++ b/include/linux/compiler_types.h @@ -432,7 +432,9 @@ struct ftrace_likely_data { # define __noscs #endif =20 -#ifndef __nocfi +#if defined(CONFIG_CFI_CLANG) +# define __nocfi __attribute__((__no_sanitize__("kcfi"))) +#else # define __nocfi #endif =20 --=20 2.34.1 From nobody Fri Oct 3 06:33:25 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C146723814D; Thu, 4 Sep 2025 03:46:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756957617; cv=none; b=J9L2KCEmCaTTj7RKDvIm9AUEeH74bGGhGdd3poRXkUTJWdlHzoyvhMxTbXXbfTavL/OUXvKXXTxjxQ/4/qD1xvSsEPmiR3JJMWGJgq4ZHuQ7StZja+cJnw+3CksSnO3xULWKvwbcT2kdVqRpXGvUgMQtCvC/C/yqCj59GG7mFmM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756957617; c=relaxed/simple; bh=xAOGr0wz5pVGa6TAyVuH2Ski5/R27AIRietPZivlbmo=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version:Content-Type; b=OYeCwwCBjJncf6jubfjug6EzLSByutUWZ2PMwaragsUaT+Hiinm7BQDXzDIdYLVKMZi9B5FMwMIA+Mf6LnkSEpiC8uVysfpQzKQtjf8ufrij4yknvwxC6TJB6Kh+w2/pD64VpPKO3V25NJBe6IqXvneQfUZo/seh9JcluIBZufE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=WxUuM0l0; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="WxUuM0l0" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5D26DC4AF09; Thu, 4 Sep 2025 03:46:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1756957617; bh=xAOGr0wz5pVGa6TAyVuH2Ski5/R27AIRietPZivlbmo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WxUuM0l0f6VAAADe9tpJw8aZR/FHuaXXhhclaetWnKatzrmKi6ULANZV52XYZUpPf NTdQcABHTS9HYn4nNWXtYCJ8UXxgdsWbJXIULuaS76nQ+RlFVkwRYUHbeWeBiHtS+3 e/Vbnr8NFwQKJ6toL2gZulhjRTAN+kSSM6quA6WGwUkezR9ngqGJQbqj/DmklpOi2r zbKYtjBexzhoDD5Pz2s2ODzYX19xf9/mvJ9Vub/CqhC7ccjcoRAU3qI45jULzhIvsC FCXWrTyXe7XRCdGkWL9Wlr9m0uP7NTslglMW1chFs2+WHSJWnGeMHobGsBxsAG/ZXA 4GYXUb7113nFg== From: Kees Cook To: Peter Zijlstra Cc: Kees Cook , Nathan Chancellor , Vegard Nossum , Miguel Ojeda , Linus Walleij , Jeff Johnson , Randy Dunlap , David Woodhouse , "Russell King (Oracle)" , Nick Desaulniers , Bill Wendling , Justin Stitt , Marco Elver , Przemek Kitszel , Ramon de C Valle , Jonathan Corbet , "Paul E. McKenney" , Nicolas Schier , Masahiro Yamada , Arnd Bergmann , Krzysztof Kozlowski , Sami Tolvanen , Mark Rutland , linux-kernel@vger.kernel.org, llvm@lists.linux.dev, linux-doc@vger.kernel.org, linux-kbuild@vger.kernel.org, linux-arm-kernel@lists.infradead.org, x86@kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 2/9] x86/traps: Clarify KCFI instruction layout Date: Wed, 3 Sep 2025 20:46:41 -0700 Message-Id: <20250904034656.3670313-2-kees@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250904033217.it.414-kees@kernel.org> References: <20250904033217.it.414-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=902; i=kees@kernel.org; h=from:subject; bh=xAOGr0wz5pVGa6TAyVuH2Ski5/R27AIRietPZivlbmo=; b=owGbwMvMwCVmps19z/KJym7G02pJDBk7OYv+GWdP3f0jz/ecudlNqZ2MUk+XdjndX6TGcmXJX Mmiovv+HaUsDGJcDLJiiixBdu5xLh5v28Pd5yrCzGFlAhnCwMUpABN53cTIMCG2z3jpxYd+zROt DkRvZTHaI+nde21V1OEvD7fNWH+27jgjQ1fBrcSXK3ubLVRPpx3TPudw2mN654+p71OLJ+cdrFv VzQEA X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Just a nit-picky change to the KCFI indirect call check instruction documentation. The addl offset isn't always -4 (it depends on patchable function entry configuration). Signed-off-by: Kees Cook --- Cc: Peter Zijlstra --- arch/x86/kernel/cfi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kernel/cfi.c b/arch/x86/kernel/cfi.c index 77086cf565ec..638eb5c933e0 100644 --- a/arch/x86/kernel/cfi.c +++ b/arch/x86/kernel/cfi.c @@ -27,7 +27,7 @@ static bool decode_cfi_insn(struct pt_regs *regs, unsigne= d long *target, * for indirect call checks: * * =C2=A0 movl -, %r10d ; 6 bytes - * addl -4(%reg), %r10d ; 4 bytes + * addl -(%reg), %r10d; 4 bytes * je .Ltmp1 ; 2 bytes * ud2 ; <- regs->ip * .Ltmp1: --=20 2.34.1 From nobody Fri Oct 3 06:33:25 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F2C352253E1; Thu, 4 Sep 2025 03:46:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756957617; cv=none; b=j8P6CAlR8v6NTVVeFivscKRgv/QDT92R7yl2NIJD0zllGDNcWbIV8HDUptkCOIL/BseSLS85ujbkAxIyqpsX/lzItc9867UbPgzw6ESXqQzQq9TXsQhuM6sA8OUmLU7KFF8vOsgvLo9v86pMS08gW92te4pSWnHh6M2SaxByQ2U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756957617; c=relaxed/simple; bh=/OwwI41G7+Tx15l2gGzfUnj2QKLIC0KZTQah1RCXchQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=LQsO7uECYGyFXWPlBQI+zc3icyEe/noXqAJuBMfYsC2Wpljh7d4CE2Lk+z/RqAbeFpsLjYJnZLIg2WAiDowe8+MnJfv2UJzHwjFtx0FKzreYl4GqpYAuZppdQzXmEcVqG2bf3wGab5F2amgB8kB361XFRHzwAAjs+FoiTHOdMEE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=MylokCOL; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="MylokCOL" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 793B1C4CEF1; Thu, 4 Sep 2025 03:46:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1756957616; bh=/OwwI41G7+Tx15l2gGzfUnj2QKLIC0KZTQah1RCXchQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MylokCOLrkzILw21dOISnvzdCnC5ic0BWGjbhj8ixodadygjQteMcRPhO8kWoA6oM 6GGtXCwET8NKOjZBkeQkGxSP6IXjq1MixvApdHAq/v86BP1hkZUR0qeSbyCvE/ddJl nx+Fz20MrH6eKgXxDA9x1tjRS2xT7WVy2EwOeLedKKzRsKXAYtXbuC/jxFE1u9qpvj t+BktwnoIU7pmPMUzvEyGkybllUiJoG+Zmx/52PVWdBYgjjJZ+ZCXE/AeZwsmBRq9p GkGB5PYo+MShdaIc3qEtNQ8SgapozpZ2b0dMj9QaWmUCcQ6kOEbIQKgteHkRbDJXVx uMZB0k8YpJ8EA== From: Kees Cook To: Peter Zijlstra Cc: Kees Cook , Jonathan Corbet , "Paul E. McKenney" , Randy Dunlap , linux-doc@vger.kernel.org, Nathan Chancellor , Vegard Nossum , Miguel Ojeda , Linus Walleij , Jeff Johnson , David Woodhouse , "Russell King (Oracle)" , Nick Desaulniers , Bill Wendling , Justin Stitt , Marco Elver , Przemek Kitszel , Ramon de C Valle , Nicolas Schier , Masahiro Yamada , Arnd Bergmann , Krzysztof Kozlowski , Sami Tolvanen , Mark Rutland , linux-kernel@vger.kernel.org, llvm@lists.linux.dev, linux-kbuild@vger.kernel.org, linux-arm-kernel@lists.infradead.org, x86@kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 3/9] x86/cfi: Document the "cfi=" bootparam options Date: Wed, 3 Sep 2025 20:46:42 -0700 Message-Id: <20250904034656.3670313-3-kees@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250904033217.it.414-kees@kernel.org> References: <20250904033217.it.414-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1713; i=kees@kernel.org; h=from:subject; bh=/OwwI41G7+Tx15l2gGzfUnj2QKLIC0KZTQah1RCXchQ=; b=owGbwMvMwCVmps19z/KJym7G02pJDBk7OYslK7sPyK8r/yYYUab2O3f2jr2JoYvqn009+jJ05 /mHQR/4OkpZGMS4GGTFFFmC7NzjXDzetoe7z1WEmcPKBDKEgYtTACbyXpnhf5wCS2RwSuTUzIet 4T/Zd6uV+UjqykrE3eZIe6IgUGClyshwNDmyTXFnvZOH35caoe/G/HMao/tC9mbahsZZqp28lcQ NAA== X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The kernel-parameters.txt didn't have a section for the cfi=3D options. Add it. Signed-off-by: Kees Cook Reviewed-by: Nathan Chancellor --- Cc: Jonathan Corbet Cc: "Paul E. McKenney" Cc: Randy Dunlap Cc: Peter Zijlstra Cc: --- Documentation/admin-guide/kernel-parameters.txt | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentatio= n/admin-guide/kernel-parameters.txt index 747a55abf494..8bbffbb334ab 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -608,6 +608,23 @@ ccw_timeout_log [S390] See Documentation/arch/s390/common_io.rst for details. =20 + cfi=3D [X86-64] Set Control Flow Integrity checking features + when CONFIG_FINEIBT is enabled. + Format: feature[,feature...] + Default: auto + + auto: Use FineIBT if IBT available, otherwise kCFI. + Under FineIBT, enable "paranoid" mode when + FRED is not available. + off: Turn off CFI checking. + kcfi: Use kCFI (disable FineIBT). + fineibt: Use FineIBT (even if IBT not available). + norand: Do not re-randomize CFI hashes. + paranoid: Add caller hash checking under FineIBT. + bhi: Enable register poisoning to stop speculation + across FineIBT. (Disabled by default.) + warn: Do not enforce CFI checking: warn only. + cgroup_disable=3D [KNL] Disable a particular controller or optional featu= re Format: {name of the controller(s) or feature(s) to disable} The effects of cgroup_disable=3Dfoo are: --=20 2.34.1 From nobody Fri Oct 3 06:33:25 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 47886227EB9; Thu, 4 Sep 2025 03:46:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756957617; cv=none; b=PD1ire6OUkQezpSYIc/ag91j4MsEuy7hiGHmyOLm6LOVmhKh5Q4whjJlrNT1OrCNCl9tBkhLWMGkjhL6qrDuJhCU3I5ABi0PW3VUjmX+uGshdFQKThQzTdAI4JsWBm4vPOj0A/EZ+Bd0toBM4xcZ6Wq6osNPiKhecOSW1YGb1E4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756957617; c=relaxed/simple; bh=fZM4pUskzgVzzDbqpdGr74pYeEbdYleorCSgkPRkjPo=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=RXk6v+GNNZyzjceynnS2zqJNfCGRhKZSWRWZYW1SfCCEv3CgULRbt8CtwvaUdpfLPzIw4VFlEfqIxqRDda9vtGx2HPW+PzyshQM1zC2XysY82BFn0G8dSIJc6N+A0h0uBvY6J1UW8mNKl2Q+7twrdPUO8Cnd3qczvtL21cwNFFs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=MlnAoabs; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="MlnAoabs" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7F35AC4CEF8; Thu, 4 Sep 2025 03:46:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1756957616; bh=fZM4pUskzgVzzDbqpdGr74pYeEbdYleorCSgkPRkjPo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MlnAoabsXDFgD+6GMVKhYGy490ebRIpVqlFFJafvlL4ISa9St9CrbCfmn4ifzaKP8 bX9ZGnDeiMZ9WVD74hcOBdalYxSesR/Y9E9Xp3fZUVaPSxEkYly/tS8sPOMzpqyamg 7ZHv5Lp3GL2zmaMDwclI3/cNq7KoLXqTKIynvUJeGCKg90SxQUiTnmFB39Hin5/IT3 zQnghkY80irwD/oWDUCf5PD59IuxNJmHwRDfk7+Ntr/3jMiSf0Y1EZQyhZ9V+rTbe8 IOFKkMm4JzBrzgo8BT4ZoAPLtu54jkDTYU9ucIiuUIpe+BFusthdcwzaJnimNmfjhR fdeZ2DNVeIaVQ== From: Kees Cook To: Peter Zijlstra Cc: Kees Cook , Nathan Chancellor , Vegard Nossum , Miguel Ojeda , Linus Walleij , Jeff Johnson , Randy Dunlap , David Woodhouse , "Russell King (Oracle)" , Nick Desaulniers , Bill Wendling , Justin Stitt , Marco Elver , Przemek Kitszel , Ramon de C Valle , Jonathan Corbet , "Paul E. McKenney" , Nicolas Schier , Masahiro Yamada , Arnd Bergmann , Krzysztof Kozlowski , Sami Tolvanen , Mark Rutland , linux-kernel@vger.kernel.org, llvm@lists.linux.dev, linux-doc@vger.kernel.org, linux-kbuild@vger.kernel.org, linux-arm-kernel@lists.infradead.org, x86@kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 4/9] x86/cfi: Standardize on common "CFI:" prefix for CFI reports Date: Wed, 3 Sep 2025 20:46:43 -0700 Message-Id: <20250904034656.3670313-4-kees@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250904033217.it.414-kees@kernel.org> References: <20250904033217.it.414-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2513; i=kees@kernel.org; h=from:subject; bh=fZM4pUskzgVzzDbqpdGr74pYeEbdYleorCSgkPRkjPo=; b=owGbwMvMwCVmps19z/KJym7G02pJDBk7OYsz1+h4pN6YrHiFfYKc4nMzjk9TFqvsF3i0eLNp4 e85Dt13O0pZGMS4GGTFFFmC7NzjXDzetoe7z1WEmcPKBDKEgYtTACZi2Mjwm71UTUCCm2ldnMdv n4CjPns8o37m5s18lb9NMcX97cNHfQz/lC+c1Jm4xNF6WfbPZ38mljIdef+n5p3DY2Nr7cz783f e4AUA X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Use a regular "CFI:" prefix for CFI reports during alternatives setup, including reporting when nothing has happened (i.e. CONFIG_FINEIBT=3Dn). Signed-off-by: Kees Cook Reviewed-by: Nathan Chancellor --- Cc: Peter Zijlstra --- arch/x86/kernel/alternative.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c index 7bde68247b5f..d8f4ac95b4df 100644 --- a/arch/x86/kernel/alternative.c +++ b/arch/x86/kernel/alternative.c @@ -1266,26 +1266,26 @@ static __init int cfi_parse_cmdline(char *str) } else if (!strcmp(str, "norand")) { cfi_rand =3D false; } else if (!strcmp(str, "warn")) { - pr_alert("CFI mismatch non-fatal!\n"); + pr_alert("CFI: mismatch non-fatal!\n"); cfi_warn =3D true; } else if (!strcmp(str, "paranoid")) { if (cfi_mode =3D=3D CFI_FINEIBT) { cfi_paranoid =3D true; } else { - pr_err("Ignoring paranoid; depends on fineibt.\n"); + pr_err("CFI: ignoring paranoid; depends on fineibt.\n"); } } else if (!strcmp(str, "bhi")) { #ifdef CONFIG_FINEIBT_BHI if (cfi_mode =3D=3D CFI_FINEIBT) { cfi_bhi =3D true; } else { - pr_err("Ignoring bhi; depends on fineibt.\n"); + pr_err("CFI: ignoring bhi; depends on fineibt.\n"); } #else - pr_err("Ignoring bhi; depends on FINEIBT_BHI=3Dy.\n"); + pr_err("CFI: ignoring bhi; depends on FINEIBT_BHI=3Dy.\n"); #endif } else { - pr_err("Ignoring unknown cfi option (%s).", str); + pr_err("CFI: Ignoring unknown option (%s).", str); } =20 str =3D next; @@ -1757,7 +1757,7 @@ static void __apply_fineibt(s32 *start_retpoline, s32= *end_retpoline, switch (cfi_mode) { case CFI_OFF: if (builtin) - pr_info("Disabling CFI\n"); + pr_info("CFI: disabled\n"); return; =20 case CFI_KCFI: @@ -1766,7 +1766,8 @@ static void __apply_fineibt(s32 *start_retpoline, s32= *end_retpoline, goto err; =20 if (builtin) - pr_info("Using kCFI\n"); + pr_info("CFI: Using %sretpoline kCFI\n", + cfi_rand ? "rehashed " : ""); return; =20 case CFI_FINEIBT: @@ -2005,6 +2006,8 @@ bool decode_fineibt_insn(struct pt_regs *regs, unsign= ed long *target, u32 *type) static void __apply_fineibt(s32 *start_retpoline, s32 *end_retpoline, s32 *start_cfi, s32 *end_cfi, bool builtin) { + if (IS_ENABLED(CONFIG_CFI) && builtin) + pr_info("CFI: Using standard kCFI\n"); } =20 #ifdef CONFIG_X86_KERNEL_IBT --=20 2.34.1 From nobody Fri Oct 3 06:33:25 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 47467227B95; Thu, 4 Sep 2025 03:46:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756957617; cv=none; b=gMdU/neYrJ34f1Y7/XKLr6/z5bi3v4krMLvwRTvqUeeWDQPkNXJyPosx+DO0x++cuqp4zwGo8mFw3d4VOT3uHrAjtdB2yZuw4fEUeADXm7QK5JgmuU5ttyxK7cdNx1xdtpqliWODVcSh65o/Aa11X9k4xlH3x5f1EMfC2VVKEsE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756957617; c=relaxed/simple; bh=fAYAUBGJzo8b71uhoB5b/MGQo+Cci4aVf5GCY6U9+Og=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=rw453e6whmIuS3oQNsnnT4ENy9MSNEoe2TKetTLZst2HthssYaONPlXhD+hIwpNrNQF14hH9nyA8Z9YwTtpCz6Yv9TB2G0QsNhpPUOBYLApoTMdlvQsCeyVOa2BZzTyMS6qZIIRIXJNMMh698M4h2ZWVn6/PoJ2zwe5qkOsfAr8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=MQ1wii6x; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="MQ1wii6x" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BC035C4CEF9; Thu, 4 Sep 2025 03:46:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1756957616; bh=fAYAUBGJzo8b71uhoB5b/MGQo+Cci4aVf5GCY6U9+Og=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MQ1wii6xQtLMVMyBk31+A/kBaQZrsWcYyRslt3wRiqrIgJwSD/vMPaXxjHvlXQ70q woTlgLahuOMaNldVXWLhxv2VMw2yg/a+mZCFThs/9eKCSPvWWRfFrEOFKQtQiGkT8z sktrp+AQAN1Pdu004OOJa/HLhNZSkHtv9w1bXPvGVrCtnMgPiKUnBGz3Xmyr8+3RmF 5LJR8DZfAIL+HlnYDABwGlNeuiP5F6UhvbusAD7TJS/CpsANxCtcciMaUcy11PtthN xsT3PWpg8CJApz2ug6Z9Qhf11n7EK75u9A1C8Y5jXxW5j90q3cig/joCyV0pxelZI3 12GobLSRdOnrg== From: Kees Cook To: Peter Zijlstra Cc: Kees Cook , Nathan Chancellor , Vegard Nossum , Miguel Ojeda , Linus Walleij , Jeff Johnson , Randy Dunlap , David Woodhouse , "Russell King (Oracle)" , Nick Desaulniers , Bill Wendling , Justin Stitt , Marco Elver , Przemek Kitszel , Ramon de C Valle , Jonathan Corbet , "Paul E. McKenney" , Nicolas Schier , Masahiro Yamada , Arnd Bergmann , Krzysztof Kozlowski , Sami Tolvanen , Mark Rutland , linux-kernel@vger.kernel.org, llvm@lists.linux.dev, linux-doc@vger.kernel.org, linux-kbuild@vger.kernel.org, linux-arm-kernel@lists.infradead.org, x86@kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 5/9] x86/cfi: Add "debug" option to "cfi=" bootparam Date: Wed, 3 Sep 2025 20:46:44 -0700 Message-Id: <20250904034656.3670313-5-kees@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250904033217.it.414-kees@kernel.org> References: <20250904033217.it.414-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4249; i=kees@kernel.org; h=from:subject; bh=fAYAUBGJzo8b71uhoB5b/MGQo+Cci4aVf5GCY6U9+Og=; b=owGbwMvMwCVmps19z/KJym7G02pJDBk7OYuNvPgOPD79OO+JnXXRp6Xu8nwx71xY93EVlCf3x 6bxXNvQUcrCIMbFICumyBJk5x7n4vG2Pdx9riLMHFYmkCEMXJwCMJGpYgy/2VR2/91myqOcFp/c 6yV1dvuyNcnb3k/h3Mb8pmgBG98MTYZ/Vv2fVK7qNr275O/OvuS9daCF9u2IlUJSrJ9OcjL0z+V mAwA= X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add "debug" option for "cfi=3D" bootparam to get details on early CFI initialization steps so future Kees can find breakage easier. Signed-off-by: Kees Cook --- Cc: Peter Zijlstra --- .../admin-guide/kernel-parameters.txt | 1 + arch/x86/kernel/alternative.c | 23 +++++++++++++++++++ 2 files changed, 24 insertions(+) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentatio= n/admin-guide/kernel-parameters.txt index 8bbffbb334ab..c8337d0e6ba3 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -624,6 +624,7 @@ bhi: Enable register poisoning to stop speculation across FineIBT. (Disabled by default.) warn: Do not enforce CFI checking: warn only. + debug: Report CFI initialization details. =20 cgroup_disable=3D [KNL] Disable a particular controller or optional featu= re Format: {name of the controller(s) or feature(s) to disable} diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c index d8f4ac95b4df..b311e31a9056 100644 --- a/arch/x86/kernel/alternative.c +++ b/arch/x86/kernel/alternative.c @@ -1177,6 +1177,7 @@ void __init_or_module apply_seal_endbr(s32 *start, s3= 2 *end) { } #endif =20 enum cfi_mode cfi_mode __ro_after_init =3D __CFI_DEFAULT; +static bool cfi_debug __ro_after_init; =20 #ifdef CONFIG_FINEIBT_BHI bool cfi_bhi __ro_after_init =3D false; @@ -1259,6 +1260,8 @@ static __init int cfi_parse_cmdline(char *str) } else if (!strcmp(str, "off")) { cfi_mode =3D CFI_OFF; cfi_rand =3D false; + } else if (!strcmp(str, "debug")) { + cfi_debug =3D true; } else if (!strcmp(str, "kcfi")) { cfi_mode =3D CFI_KCFI; } else if (!strcmp(str, "fineibt")) { @@ -1734,6 +1737,8 @@ static void __apply_fineibt(s32 *start_retpoline, s32= *end_retpoline, * rewrite them. This disables all CFI. If this succeeds but any of the * later stages fails, we're without CFI. */ + if (cfi_debug) + pr_info("CFI: disabling all indirect call checking\n"); ret =3D cfi_disable_callers(start_retpoline, end_retpoline); if (ret) goto err; @@ -1744,14 +1749,23 @@ static void __apply_fineibt(s32 *start_retpoline, s= 32 *end_retpoline, cfi_bpf_hash =3D cfi_rehash(cfi_bpf_hash); cfi_bpf_subprog_hash =3D cfi_rehash(cfi_bpf_subprog_hash); } + if (cfi_debug) + pr_info("CFI: cfi_seed: 0x%08x\n", cfi_seed); =20 + if (cfi_debug) + pr_info("CFI: rehashing all preambles\n"); ret =3D cfi_rand_preamble(start_cfi, end_cfi); if (ret) goto err; =20 + if (cfi_debug) + pr_info("CFI: rehashing all indirect calls\n"); ret =3D cfi_rand_callers(start_retpoline, end_retpoline); if (ret) goto err; + } else { + if (cfi_debug) + pr_info("CFI: rehashing disabled\n"); } =20 switch (cfi_mode) { @@ -1761,6 +1775,8 @@ static void __apply_fineibt(s32 *start_retpoline, s32= *end_retpoline, return; =20 case CFI_KCFI: + if (cfi_debug) + pr_info("CFI: enabling all indirect call checking\n"); ret =3D cfi_enable_callers(start_retpoline, end_retpoline); if (ret) goto err; @@ -1771,17 +1787,23 @@ static void __apply_fineibt(s32 *start_retpoline, s= 32 *end_retpoline, return; =20 case CFI_FINEIBT: + if (cfi_debug) + pr_info("CFI: adding FineIBT to all preambles\n"); /* place the FineIBT preamble at func()-16 */ ret =3D cfi_rewrite_preamble(start_cfi, end_cfi); if (ret) goto err; =20 /* rewrite the callers to target func()-16 */ + if (cfi_debug) + pr_info("CFI: rewriting indirect call sites to use FineIBT\n"); ret =3D cfi_rewrite_callers(start_retpoline, end_retpoline); if (ret) goto err; =20 /* now that nobody targets func()+0, remove ENDBR there */ + if (cfi_debug) + pr_info("CFI: removing old endbr insns\n"); cfi_rewrite_endbr(start_cfi, end_cfi); =20 if (builtin) { @@ -2324,6 +2346,7 @@ void __init alternative_instructions(void) =20 __apply_fineibt(__retpoline_sites, __retpoline_sites_end, __cfi_sites, __cfi_sites_end, true); + cfi_debug =3D false; =20 /* * Rewrite the retpolines, must be done before alternatives since --=20 2.34.1 From nobody Fri Oct 3 06:33:25 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 49B0C229B2E; Thu, 4 Sep 2025 03:46:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756957617; cv=none; b=QI1EqpFjexLQkRsU5gwBVyjCNjPGVsZiOkuwyvh1K9/wAI9E/5nDQO2HXaDcclwJNA+DO0j92iZQFcn5hFsJpoXQ07mwam/iBORsqw25gnyIOoszQOn2lDGYcq8X/U6as7KO87QV8vg8YPlvrbNX9jj9Vit2BfWGtwLZcb8hLFo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756957617; c=relaxed/simple; bh=9qnhoP2qHT9CRFXlDqVxSaXFtL9InbhntKhaSQiQx6M=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=FIKKrnfPKChg/GcxEPo7Sbi2XBZ3XEC0yxadHC7W8bkl6GJictQR7WF5qFXiLq4LrVeQyLp2Zr8cCDDN4vcOLezTVTjJuahmUeQayTERhoxBz9Grug4g30KL5dclk4HMBHKs9sMTWnJcGH/sBQnlVMElbH4PzQ8x1Vozo1N1BBk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=K9kvhgem; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="K9kvhgem" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BB9D7C4CEF7; Thu, 4 Sep 2025 03:46:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1756957616; bh=9qnhoP2qHT9CRFXlDqVxSaXFtL9InbhntKhaSQiQx6M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=K9kvhgemZLc77NjaYChu+kfIy+lKgj4STMzZqVPEwORHSSWEBrXn4s28M0SnG4nxC Wu3xHCZbZ/nUM6ZPODEIyL6cWsjx1VApf6RxkEsXzFjkDC/O/QWKXu4NuAEYF8B+S+ LgS9vE8UZc3doXOMiVJxVW5JgzTcEDFTlQN/Omyb40rAKUxim0AV5p2QywaxzuMJgK +ii+sEYsQJHg74flff0DDp00tpDyiYnODBeLUR/4F02RivsopYizPEw1L5QZq2N6L2 h63pd+G8sOubOQudI/lcfUNufiNWH+cxJ07zDP3VSGFy4QXa0WAtP4Pf1FVDMkTelw CSfXhtx0Foqkw== From: Kees Cook To: Peter Zijlstra Cc: Kees Cook , David Woodhouse , Nathan Chancellor , Vegard Nossum , Miguel Ojeda , Linus Walleij , Jeff Johnson , Randy Dunlap , "Russell King (Oracle)" , Nick Desaulniers , Bill Wendling , Justin Stitt , Marco Elver , Przemek Kitszel , Ramon de C Valle , Jonathan Corbet , "Paul E. McKenney" , Nicolas Schier , Masahiro Yamada , Arnd Bergmann , Krzysztof Kozlowski , Sami Tolvanen , Mark Rutland , linux-kernel@vger.kernel.org, llvm@lists.linux.dev, linux-doc@vger.kernel.org, linux-kbuild@vger.kernel.org, linux-arm-kernel@lists.infradead.org, x86@kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 6/9] x86/cfi: Remove __noinitretpoline and __noretpoline Date: Wed, 3 Sep 2025 20:46:45 -0700 Message-Id: <20250904034656.3670313-6-kees@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250904033217.it.414-kees@kernel.org> References: <20250904033217.it.414-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3285; i=kees@kernel.org; h=from:subject; bh=9qnhoP2qHT9CRFXlDqVxSaXFtL9InbhntKhaSQiQx6M=; b=owGbwMvMwCVmps19z/KJym7G02pJDBk7OUt2nPcJtw664XD+lmLHE+dcGSFbRbaJLz7YMDVtu tyzxmBCRykLgxgXg6yYIkuQnXuci8fb9nD3uYowc1iZQIYwcHEKwET0nzP8L1j/7tX/ua+naOr3 T560tb/6T7/W6pkx4g++H/nKwDxBmIfhf8lKDsddi5Lmigdk8W1S16msOXe4ZuO2SwsSBANvfSp bwQYA X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Commit 66f793099a63 ("x86/retpoline: Avoid retpolines for built-in __init functions") disabled retpolines in __init sections (__noinitretpoline) as a precaution against potential issues with retpolines in early boot, but it has not been a problem in practice (i.e. see Clang below). Commit 87358710c1fb ("x86/retpoline: Support retpoline builds with Clang") narrowed this to only GCC, as Clang doesn't have per-function control over retpoline emission. As such, Clang has been booting with retpolines in __init since retpoline support was introduced. Clang KCFI has been instrumenting __init since CFI was introduced. With the introduction of KCFI for GCC, KCFI instrumentation with retpolines disabled means that objtool does not construct .retpoline_sites section entries for the non-retpoline KCFI calls. At boot, the KCFI rehashing code, via __apply_fineibt(), misses all __init KCFI calls (since they are not retpolines), resulting in immediate hash mismatches: all preambles are rehashed (via .cfi_sites) and none of the __init call sites are rehashed. Remove __noinitretpoline since it provides no meaningful utility and creates problems with CFI. Additionally remove __noretpoline since it is now unused. Alternatively, cfi_rand_callers() could walk the .kcfi_traps section which is exactly the list of KCFI instrumentation sites. But it seems better to have as few differences in common instruction sequences between compilers as possible, so better to remove the special handling of retpolines in __init for GCC. Signed-off-by: Kees Cook --- Cc: Peter Zijlstra Cc: David Woodhouse --- include/linux/compiler-gcc.h | 4 ---- include/linux/init.h | 8 -------- 2 files changed, 12 deletions(-) diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h index 5d07c469b571..5de824a0b3d7 100644 --- a/include/linux/compiler-gcc.h +++ b/include/linux/compiler-gcc.h @@ -35,10 +35,6 @@ (typeof(ptr)) (__ptr + (off)); \ }) =20 -#ifdef CONFIG_MITIGATION_RETPOLINE -#define __noretpoline __attribute__((__indirect_branch__("keep"))) -#endif - #if defined(LATENT_ENTROPY_PLUGIN) && !defined(__CHECKER__) #define __latent_entropy __attribute__((latent_entropy)) #endif diff --git a/include/linux/init.h b/include/linux/init.h index a60d32d227ee..17c1bc712e23 100644 --- a/include/linux/init.h +++ b/include/linux/init.h @@ -7,13 +7,6 @@ #include #include =20 -/* Built-in __init functions needn't be compiled with retpoline */ -#if defined(__noretpoline) && !defined(MODULE) -#define __noinitretpoline __noretpoline -#else -#define __noinitretpoline -#endif - /* These macros are used to mark some functions or=20 * initialized data (doesn't apply to uninitialized data) * as `initialization' functions. The kernel can take this @@ -50,7 +43,6 @@ /* These are for everybody (although not all archs will actually discard it in modules) */ #define __init __section(".init.text") __cold __latent_entropy \ - __noinitretpoline \ __no_kstack_erase #define __initdata __section(".init.data") #define __initconst __section(".init.rodata") --=20 2.34.1 From nobody Fri Oct 3 06:33:25 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1C780225A4F; Thu, 4 Sep 2025 03:46:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756957617; cv=none; b=MSJ8AgrDv5O6gch/PBtPjiW0kEuyUv+M4mpVzuKLnarDe/+7xh864eHYd+q28lfXkosyxe8fct25aXFDxse7nnMvmSvRlABVEhOVf24Ahl3b4/mO2y+JMbjPFaYJbRR5i02zyBto46vaIY5ops6X85a6TEhUHf0Bz4pysdyKne0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756957617; c=relaxed/simple; bh=pr+YoVUXdyYWMn2tMjP3zE+G8H1rGuamvFiupzUQ/S0=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=IPGPAraPaaIH/opVB+Xm8vbfn1WJRg66RhvaNysNGbkeH2Y5/XJycI5EfGtKy/A6UT5X9Qpaj+jFI8Jrp2NNgsfq+WX63KFlATXDaWAYMyv7JbKd6Lx8zPDNDzfPn4nQV5pidrIbd9t/vzOr4ajyOShip+3vZP4HpoShzBJVNpA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=rqsKGPfC; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="rqsKGPfC" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C4007C4CEFA; Thu, 4 Sep 2025 03:46:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1756957616; bh=pr+YoVUXdyYWMn2tMjP3zE+G8H1rGuamvFiupzUQ/S0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rqsKGPfCH1qCEMRQytUXr49gIDeg0KXuGdWIgszBD8TrMXhgvZCEIz3wYmAvdmSPy 8Ld3MnjmENjzDW91LFSFQe6xVoFhZpuNeGHc1OxLSKXGWSoySBoO5SDH8HhH3XVIMs 1DEU2R6qjSgu8H9LswT3nyTNCqpBoVIAXCx+qOrVUL8FXRoqtJewCDDtjHy9NK/ByN VnNORWkFwx+NuT3PYB67/4IH9m74tt14xRTkWd9/86WPnpMBFUwwiDpTX70R3mHTXk qJuQWzzWuvXOdsCMNVVLOcmfQHwu1AOoiuF4aN1FUM2PTO6IVMFvYVMulOK5s2055Y qhRLrrQgMZV7g== From: Kees Cook To: Peter Zijlstra Cc: Kees Cook , Nathan Chancellor , Nicolas Schier , Vegard Nossum , Jonathan Corbet , Masahiro Yamada , Randy Dunlap , Arnd Bergmann , Krzysztof Kozlowski , linux-kbuild@vger.kernel.org, linux-doc@vger.kernel.org, Miguel Ojeda , Linus Walleij , Jeff Johnson , David Woodhouse , "Russell King (Oracle)" , Nick Desaulniers , Bill Wendling , Justin Stitt , Marco Elver , Przemek Kitszel , Ramon de C Valle , "Paul E. McKenney" , Sami Tolvanen , Mark Rutland , linux-kernel@vger.kernel.org, llvm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, x86@kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 7/9] kconfig: Add transitional symbol attribute for migration support Date: Wed, 3 Sep 2025 20:46:46 -0700 Message-Id: <20250904034656.3670313-7-kees@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250904033217.it.414-kees@kernel.org> References: <20250904033217.it.414-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=17987; i=kees@kernel.org; h=from:subject; bh=pr+YoVUXdyYWMn2tMjP3zE+G8H1rGuamvFiupzUQ/S0=; b=owGbwMvMwCVmps19z/KJym7G02pJDBk7OUtSz9wrPvd9j0iTCq/gtB31V4yFUts/P33mHR/TX H1xGd+9jlIWBjEuBlkxRZYgO/c4F4+37eHucxVh5rAygQxh4OIUgIks6mNk+LCd3dI74ZqU8SGt h43HjbQM8zJPWr9Z/vDBVo/bU7av387wk3FywFbHSc/1FysKPos9/jRN4eE1y9C1l1SnKPDoZGs ysgIA X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" During kernel option migrations (e.g. CONFIG_CFI_CLANG to CONFIG_CFI), existing .config files need to maintain backward compatibility while preventing deprecated options from appearing in newly generated configurations. This is challenging with existing Kconfig mechanisms because: 1. Simply removing old options breaks existing .config files. 2. Manually listing an option as "deprecated" leaves it needlessly visible and still writes them to new .config files. 3. Using any method to remove visibility (.e.g no 'prompt', 'if n', etc) prevents the option from being processed at all. Add a "transitional" attribute that creates symbols which are: - Processed during configuration (can influence other symbols' defaults) - Hidden from user menus (no prompts appear) - Omitted from newly written .config files (gets migrated) - Restricted to only having help sections (no defaults, selects, etc) making it truly just a "prior value pass-through" option. The transitional syntax requires a type argument and prevents type redefinition: config NEW_OPTION bool "New option" default OLD_OPTION config OLD_OPTION bool transitional help Transitional config for OLD_OPTION migration. This allows seamless migration: olddefconfig processes existing CONFIG_OLD_OPTION=3Dy settings to enable CONFIG_NEW_OPTION=3Dy, while CONFIG_OLD_OPTION is omitted from newly generated .config files. Implementation details: - Parser validates transitional symbols can only have help sections - Symbol visibility logic updated: usable =3D (visible !=3D no || transitio= nal) - Transitional symbols preserve user values during configuration - Documentation added to show the usage - Added positive and negative testing via "testconfig" target Signed-off-by: Kees Cook --- With help from Claude Code to show me how to navigate the kconfig parser. Cc: Nathan Chancellor Cc: Nicolas Schier Cc: Vegard Nossum Cc: Jonathan Corbet Cc: Masahiro Yamada Cc: Randy Dunlap Cc: Arnd Bergmann Cc: Krzysztof Kozlowski Cc: Cc: --- .../kconfig/tests/err_transitional/Kconfig | 52 +++++++++ scripts/kconfig/tests/transitional/Kconfig | 100 ++++++++++++++++++ scripts/kconfig/expr.h | 1 + scripts/kconfig/lexer.l | 1 + scripts/kconfig/parser.y | 47 ++++++++ scripts/kconfig/symbol.c | 16 ++- .../tests/err_transitional/__init__.py | 14 +++ .../tests/err_transitional/expected_stderr | 7 ++ .../kconfig/tests/transitional/__init__.py | 18 ++++ .../tests/transitional/expected_config | 12 +++ .../kconfig/tests/transitional/initial_config | 16 +++ Documentation/kbuild/kconfig-language.rst | 32 ++++++ 12 files changed, 313 insertions(+), 3 deletions(-) create mode 100644 scripts/kconfig/tests/err_transitional/Kconfig create mode 100644 scripts/kconfig/tests/transitional/Kconfig create mode 100644 scripts/kconfig/tests/err_transitional/__init__.py create mode 100644 scripts/kconfig/tests/err_transitional/expected_stderr create mode 100644 scripts/kconfig/tests/transitional/__init__.py create mode 100644 scripts/kconfig/tests/transitional/expected_config create mode 100644 scripts/kconfig/tests/transitional/initial_config diff --git a/scripts/kconfig/tests/err_transitional/Kconfig b/scripts/kconf= ig/tests/err_transitional/Kconfig new file mode 100644 index 000000000000..a75ed3b2fe5e --- /dev/null +++ b/scripts/kconfig/tests/err_transitional/Kconfig @@ -0,0 +1,52 @@ +# SPDX-License-Identifier: GPL-2.0 +# Test that transitional symbols cannot have properties other than help + +config BAD_DEFAULT + bool + transitional + default y + help + This transitional symbol illegally has a default property. + +config BAD_PROMPT + bool + transitional + prompt "Bad prompt" + help + This transitional symbol illegally has a prompt. + +config BAD_SELECT + bool + transitional + select OTHER_SYMBOL + help + This transitional symbol illegally has a select. + +config BAD_IMPLY + bool + transitional + imply OTHER_SYMBOL + help + This transitional symbol illegally has an imply. + +config BAD_DEPENDS + bool + transitional + depends on OTHER_SYMBOL + help + This transitional symbol illegally has a depends. + +config BAD_RANGE + int + transitional + range 1 10 + help + This transitional symbol illegally has a range. + +config BAD_NO_TYPE + transitional + help + This transitional symbol illegally has no type specified. + +config OTHER_SYMBOL + bool diff --git a/scripts/kconfig/tests/transitional/Kconfig b/scripts/kconfig/t= ests/transitional/Kconfig new file mode 100644 index 000000000000..62c3b24665b9 --- /dev/null +++ b/scripts/kconfig/tests/transitional/Kconfig @@ -0,0 +1,100 @@ +# SPDX-License-Identifier: GPL-2.0 +# Test transitional symbols for config migration with all Kconfig types + +# Enable module support for tristate testing +config MODULES + bool "Enable loadable module support" + modules + default y + +# Basic migration tests for all types +config NEW_BOOL + bool "New bool option" + default OLD_BOOL + +config OLD_BOOL + bool + transitional + +config NEW_TRISTATE + tristate "New tristate option" + default OLD_TRISTATE + +config OLD_TRISTATE + tristate + transitional + +config NEW_STRING + string "New string option" + default OLD_STRING + +config OLD_STRING + string + transitional + +config NEW_HEX + hex "New hex option" + default OLD_HEX + +config OLD_HEX + hex + transitional + +config NEW_INT + int "New int option" + default OLD_INT + +config OLD_INT + int + transitional + +# Precedence tests for all types +config NEW_BOOL_PRECEDENCE + bool "New bool option with precedence" + default OLD_BOOL_PRECEDENCE + +config OLD_BOOL_PRECEDENCE + bool + transitional + +config NEW_STRING_PRECEDENCE + string "New string option with precedence" + default OLD_STRING_PRECEDENCE + +config OLD_STRING_PRECEDENCE + string + transitional + +config NEW_TRISTATE_PRECEDENCE + tristate "New tristate option with precedence" + default OLD_TRISTATE_PRECEDENCE + +config OLD_TRISTATE_PRECEDENCE + tristate + transitional + +config NEW_HEX_PRECEDENCE + hex "New hex option with precedence" + default OLD_HEX_PRECEDENCE + +config OLD_HEX_PRECEDENCE + hex + transitional + +config NEW_INT_PRECEDENCE + int "New int option with precedence" + default OLD_INT_PRECEDENCE + +config OLD_INT_PRECEDENCE + int + transitional + +# Test that help sections are allowed for transitional symbols +config OLD_WITH_HELP + bool + transitional + help + This transitional symbol has a help section to validate that help is al= lowed. + +config REGULAR_OPTION + bool "Regular option" diff --git a/scripts/kconfig/expr.h b/scripts/kconfig/expr.h index fe2231e0e6a4..5e7cdabc029c 100644 --- a/scripts/kconfig/expr.h +++ b/scripts/kconfig/expr.h @@ -145,6 +145,7 @@ struct symbol { #define SYMBOL_CONST 0x0001 /* symbol is const */ #define SYMBOL_CHECK 0x0008 /* used during dependency checking */ #define SYMBOL_VALID 0x0080 /* set when symbol.curr is calculated */ +#define SYMBOL_HIDDEN 0x0100 /* symbol is hidden (usable but invisibl= e) */ #define SYMBOL_WRITE 0x0200 /* write symbol to file (KCONFIG_CONFIG)= */ #define SYMBOL_WRITTEN 0x0800 /* track info to avoid double-write to .= config */ #define SYMBOL_CHECKED 0x2000 /* used during dependency checking */ diff --git a/scripts/kconfig/lexer.l b/scripts/kconfig/lexer.l index 9c2cdfc33c6f..6d2c92c6095d 100644 --- a/scripts/kconfig/lexer.l +++ b/scripts/kconfig/lexer.l @@ -126,6 +126,7 @@ n [A-Za-z0-9_-] "select" return T_SELECT; "source" return T_SOURCE; "string" return T_STRING; +"transitional" return T_TRANSITIONAL; "tristate" return T_TRISTATE; "visible" return T_VISIBLE; "||" return T_OR; diff --git a/scripts/kconfig/parser.y b/scripts/kconfig/parser.y index e9c3c664e925..c95271c22183 100644 --- a/scripts/kconfig/parser.y +++ b/scripts/kconfig/parser.y @@ -75,6 +75,7 @@ struct menu *current_menu, *current_entry, *current_choic= e; %token T_SELECT %token T_SOURCE %token T_STRING +%token T_TRANSITIONAL %token T_TRISTATE %token T_VISIBLE %token T_EOL @@ -205,6 +206,12 @@ config_option: T_PROMPT T_WORD_QUOTE if_expr T_EOL printd(DEBUG_PARSE, "%s:%d:prompt\n", cur_filename, cur_lineno); }; =20 +config_option: T_TRANSITIONAL T_EOL +{ + current_entry->sym->flags |=3D SYMBOL_HIDDEN; + printd(DEBUG_PARSE, "%s:%d:transitional\n", cur_filename, cur_lineno); +}; + config_option: default expr if_expr T_EOL { menu_add_expr(P_DEFAULT, $2, $3); @@ -482,6 +489,43 @@ assign_val: =20 %% =20 +/** + * transitional_check_sanity - check transitional symbols have no other + * properties + * + * @menu: menu of the potentially transitional symbol + * + * Return: -1 if an error is found, 0 otherwise. + */ +static int transitional_check_sanity(const struct menu *menu) +{ + struct property *prop; + + if (!menu->sym || !(menu->sym->flags & SYMBOL_HIDDEN)) + return 0; + + /* Check for depends and visible conditions. */ + if ((menu->dep && !expr_is_yes(menu->dep)) || + (menu->visibility && !expr_is_yes(menu->visibility))) { + fprintf(stderr, "%s:%d: error: %s", + menu->filename, menu->lineno, + "transitional symbols can only have help sections\n"); + return -1; + } + + /* Check for any property other than "help". */ + for (prop =3D menu->sym->prop; prop; prop =3D prop->next) { + if (prop->type !=3D P_COMMENT) { + fprintf(stderr, "%s:%d: error: %s", + prop->filename, prop->lineno, + "transitional symbols can only have help sections\n"); + return -1; + } + } + + return 0; +} + /** * choice_check_sanity - check sanity of a choice member * @@ -558,6 +602,9 @@ void conf_parse(const char *name) if (menu->sym && sym_check_deps(menu->sym)) yynerrs++; =20 + if (transitional_check_sanity(menu)) + yynerrs++; + if (menu->sym && sym_is_choice(menu->sym)) { menu_for_each_sub_entry(child, menu) if (child->sym && choice_check_sanity(child)) diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c index 26ab10c0fd76..b2686dba05ec 100644 --- a/scripts/kconfig/symbol.c +++ b/scripts/kconfig/symbol.c @@ -408,6 +408,7 @@ void sym_calc_value(struct symbol *sym) struct symbol_value newval, oldval; struct property *prop; struct menu *choice_menu; + bool usable; =20 if (!sym) return; @@ -447,6 +448,13 @@ void sym_calc_value(struct symbol *sym) if (sym->visible !=3D no) sym->flags |=3D SYMBOL_WRITE; =20 + /* + * For a symbol to be processed during configuration it needs to + * be either visible or a transitional symbol that is hidden from + * menus and omitted from newly written .config files. + */ + usable =3D (sym->visible !=3D no || (sym->flags & SYMBOL_HIDDEN)); + /* set default if recursively called */ sym->curr =3D newval; =20 @@ -459,13 +467,15 @@ void sym_calc_value(struct symbol *sym) sym_calc_choice(choice_menu); newval.tri =3D sym->curr.tri; } else { - if (sym->visible !=3D no) { + if (usable) { /* if the symbol is visible use the user value * if available, otherwise try the default value */ if (sym_has_value(sym)) { + tristate value =3D (sym->flags & SYMBOL_HIDDEN) ? + sym->def[S_DEF_USER].tri : sym->visible; newval.tri =3D EXPR_AND(sym->def[S_DEF_USER].tri, - sym->visible); + value); goto calc_newval; } } @@ -497,7 +507,7 @@ void sym_calc_value(struct symbol *sym) case S_STRING: case S_HEX: case S_INT: - if (sym->visible !=3D no && sym_has_value(sym)) { + if (usable && sym_has_value(sym)) { newval.val =3D sym->def[S_DEF_USER].val; break; } diff --git a/scripts/kconfig/tests/err_transitional/__init__.py b/scripts/k= config/tests/err_transitional/__init__.py new file mode 100644 index 000000000000..7dffb5b0833f --- /dev/null +++ b/scripts/kconfig/tests/err_transitional/__init__.py @@ -0,0 +1,14 @@ +# SPDX-License-Identifier: GPL-2.0 +""" +Test that transitional symbols with invalid properties are rejected. + +Transitional symbols can only have help sections. Any other properties +(default, select, depends, etc.) should cause a parser error. +""" + +def test(conf): + # This should fail with exit code 1 due to invalid transitional symbol + assert conf.olddefconfig() =3D=3D 1 + + # Check that the error message is about transitional symbols + assert conf.stderr_contains('expected_stderr') diff --git a/scripts/kconfig/tests/err_transitional/expected_stderr b/scrip= ts/kconfig/tests/err_transitional/expected_stderr new file mode 100644 index 000000000000..b52db4f680f4 --- /dev/null +++ b/scripts/kconfig/tests/err_transitional/expected_stderr @@ -0,0 +1,7 @@ +Kconfig:46:warning: config symbol defined without type +Kconfig:7: error: transitional symbols can only have help sections +Kconfig:14: error: transitional symbols can only have help sections +Kconfig:21: error: transitional symbols can only have help sections +Kconfig:28: error: transitional symbols can only have help sections +Kconfig:32: error: transitional symbols can only have help sections +Kconfig:42: error: transitional symbols can only have help sections diff --git a/scripts/kconfig/tests/transitional/__init__.py b/scripts/kconf= ig/tests/transitional/__init__.py new file mode 100644 index 000000000000..61937d10edf1 --- /dev/null +++ b/scripts/kconfig/tests/transitional/__init__.py @@ -0,0 +1,18 @@ +# SPDX-License-Identifier: GPL-2.0 +""" +Test transitional symbol migration functionality for all Kconfig types. + +This tests that: +- OLD_* options in existing .config cause NEW_* options to be set +- OLD_* options are not written to the new .config file +- NEW_* options appear in the new .config file with correct values +- All Kconfig types work correctly: bool, tristate, string, hex, int +- User-set NEW values take precedence over conflicting OLD transitional va= lues +""" + +def test(conf): + # Run olddefconfig to process the migration with the initial config + assert conf.olddefconfig(dot_config=3D'initial_config') =3D=3D 0 + + # Check that the configuration matches expected output + assert conf.config_contains('expected_config') diff --git a/scripts/kconfig/tests/transitional/expected_config b/scripts/k= config/tests/transitional/expected_config new file mode 100644 index 000000000000..846e9ddcab91 --- /dev/null +++ b/scripts/kconfig/tests/transitional/expected_config @@ -0,0 +1,12 @@ +CONFIG_MODULES=3Dy +CONFIG_NEW_BOOL=3Dy +CONFIG_NEW_TRISTATE=3Dm +CONFIG_NEW_STRING=3D"test string" +CONFIG_NEW_HEX=3D0x1234 +CONFIG_NEW_INT=3D42 +# CONFIG_NEW_BOOL_PRECEDENCE is not set +CONFIG_NEW_STRING_PRECEDENCE=3D"user value" +CONFIG_NEW_TRISTATE_PRECEDENCE=3Dy +CONFIG_NEW_HEX_PRECEDENCE=3D0xABCD +CONFIG_NEW_INT_PRECEDENCE=3D100 +# CONFIG_REGULAR_OPTION is not set diff --git a/scripts/kconfig/tests/transitional/initial_config b/scripts/kc= onfig/tests/transitional/initial_config new file mode 100644 index 000000000000..e648a65e504c --- /dev/null +++ b/scripts/kconfig/tests/transitional/initial_config @@ -0,0 +1,16 @@ +CONFIG_MODULES=3Dy +CONFIG_OLD_BOOL=3Dy +CONFIG_OLD_TRISTATE=3Dm +CONFIG_OLD_STRING=3D"test string" +CONFIG_OLD_HEX=3D0x1234 +CONFIG_OLD_INT=3D42 +# CONFIG_NEW_BOOL_PRECEDENCE is not set +CONFIG_OLD_BOOL_PRECEDENCE=3Dy +CONFIG_NEW_STRING_PRECEDENCE=3D"user value" +CONFIG_OLD_STRING_PRECEDENCE=3D"old value" +CONFIG_NEW_TRISTATE_PRECEDENCE=3Dy +CONFIG_OLD_TRISTATE_PRECEDENCE=3Dm +CONFIG_NEW_HEX_PRECEDENCE=3D0xABCD +CONFIG_OLD_HEX_PRECEDENCE=3D0x5678 +CONFIG_NEW_INT_PRECEDENCE=3D100 +CONFIG_OLD_INT_PRECEDENCE=3D200 diff --git a/Documentation/kbuild/kconfig-language.rst b/Documentation/kbui= ld/kconfig-language.rst index a91abb8f6840..abce88f15d7c 100644 --- a/Documentation/kbuild/kconfig-language.rst +++ b/Documentation/kbuild/kconfig-language.rst @@ -232,6 +232,38 @@ applicable everywhere (see syntax). enables the third modular state for all config symbols. At most one symbol may have the "modules" option set. =20 +- transitional attribute: "transitional" + This declares the symbol as transitional, meaning it should be processed + during configuration but omitted from newly written .config files. + Transitional symbols are useful for backward compatibility during config + option migrations - they allow olddefconfig to process existing .config + files while ensuring the old option doesn't appear in new configurations. + + A transitional symbol: + - Has no prompt (is not visible to users in menus) + - Is processed normally during configuration (values are read and used) + - Can be referenced in default expressions of other symbols + - Is not written to new .config files + - Cannot have any other properties (it is a pass-through option) + + Example migration from OLD_NAME to NEW_NAME:: + + config NEW_NAME + bool "New option name" + default OLD_NAME + help + This replaces the old CONFIG_OLD_NAME option. + + config OLD_NAME + bool + transitional + help + Transitional config for OLD_NAME to NEW_NAME migration. + + With this setup, existing .config files with "CONFIG_OLD_NAME=3Dy" will + result in "CONFIG_NEW_NAME=3Dy" being set, while CONFIG_OLD_NAME will be + omitted from newly written .config files. + Menu dependencies ----------------- =20 --=20 2.34.1 From nobody Fri Oct 3 06:33:25 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 28265225A59; Thu, 4 Sep 2025 03:46:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756957617; cv=none; b=gFwegxHO/0pku9FYAwc4SVR3q8uzZxXIFE12jnP73z7yDuOtklgSep55Bclot1IEG/KSLsivCZJP/botxQYi5okcQl+QYgoQDhUIWOU7BIDacMitZP8zmoNcglgo9MlMI7fq/04EW0oZ688RCpEvhz7zX+/ZV7mPxwxaiKkcE/U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756957617; c=relaxed/simple; bh=9Nf7SM+4eFVlF6JSPbchsishG9lrVTRY9JXyNZuYXuY=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Y4BWuM3TeZlyqLmMqSU8r7u1Gcs5EqbuUy/wQCvjF1xv3uuU5XyNgdBviwfl/PnHTrmnhGviXdQmlQXv6ob7PlpgBkUI6D+G8w06EDYKTKRCZKAjHKb8bLsvS5IdmMZ5wUzQPfLzIwJCyvIp/12q18wdihbPjnKcYtWEv/pJg+A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=DxkP1+qb; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="DxkP1+qb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D890FC4CEFF; Thu, 4 Sep 2025 03:46:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1756957617; bh=9Nf7SM+4eFVlF6JSPbchsishG9lrVTRY9JXyNZuYXuY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DxkP1+qbpGnpOUiiKQmE1zkPsMnu4o68Kn+S31yLJRSVLnFeLRtvuouMRTd2M6TpC 5FoWJnUfuT6cKGLPaUh5fmy798W+yt/tITEPlCkzqYQbfGX+ku3Rm5A6z9NQi3neba Bnn5JULc7BfQVOhCxEY747Dg/n9rNCof7RbkgmtG5x6geRNiA2RmKuK/r9vTFAsZOw mzxpL4ph5lxFyRhWaQ15GFJQ+QhHQS0/4gvsxHW805koaBSS7ZxvHbIHgROS4aAeWk oQWZN3/aB+sbRnVuO4IRgXnudrnejIoSnNAVsUCVLs4MV++esmSYa2ga6Bdm08Afe5 qXsqxcJgqXo1w== From: Kees Cook To: Peter Zijlstra Cc: Kees Cook , Linus Walleij , Sami Tolvanen , Mark Rutland , Puranjay Mohan , Nathan Chancellor , Vegard Nossum , Miguel Ojeda , Jeff Johnson , Randy Dunlap , David Woodhouse , "Russell King (Oracle)" , Nick Desaulniers , Bill Wendling , Justin Stitt , Marco Elver , Przemek Kitszel , Ramon de C Valle , Jonathan Corbet , "Paul E. McKenney" , Nicolas Schier , Masahiro Yamada , Arnd Bergmann , Krzysztof Kozlowski , linux-kernel@vger.kernel.org, llvm@lists.linux.dev, linux-doc@vger.kernel.org, linux-kbuild@vger.kernel.org, linux-arm-kernel@lists.infradead.org, x86@kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 8/9] kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI Date: Wed, 3 Sep 2025 20:46:47 -0700 Message-Id: <20250904034656.3670313-8-kees@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250904033217.it.414-kees@kernel.org> References: <20250904033217.it.414-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=39732; i=kees@kernel.org; h=from:subject; bh=9Nf7SM+4eFVlF6JSPbchsishG9lrVTRY9JXyNZuYXuY=; b=owGbwMvMwCVmps19z/KJym7G02pJDBk7OUuWshxOP/0w8nXIoWqNc9Ja1i4XNQ9l1JvLXNdT2 uqjezuqo5SFQYyLQVZMkSXIzj3OxeNte7j7XEWYOaxMIEMYuDgFYCLKtxkZFm0OnqTHb+1T7VK0 N5UrcmPztJBpu+Vyouq4n6+aVCDgyfCHd99Ux5C6rVvkqkR3+y5bqi76xlrwc4Ss1kYukRjBX++ ZAA== X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The kernel's CFI implementation uses the KCFI ABI specifically, and is not strictly tied to a particular compiler. In preparation for GCC supporting KCFI, rename CONFIG_CFI_CLANG to CONFIG_CFI (along with associated options). Use new "transitional" Kconfig option for old CONFIG_CFI_CLANG that will enable CONFIG_CFI during olddefconfig. Reviewed-by: Linus Walleij Signed-off-by: Kees Cook --- Cc: Sami Tolvanen Cc: Linus Walleij Cc: Mark Rutland Cc: Peter Zijlstra Cc: Puranjay Mohan --- arch/Kconfig | 36 ++++++++++++++++--------- arch/arm/Kconfig | 2 +- arch/arm64/Kconfig | 4 +-- arch/riscv/Kconfig | 6 ++--- arch/x86/Kconfig | 12 ++++----- init/Kconfig | 4 +-- kernel/module/Kconfig | 2 +- lib/Kconfig.debug | 2 +- Makefile | 2 +- arch/arm/mm/Makefile | 2 +- arch/riscv/kernel/Makefile | 2 +- arch/riscv/purgatory/Makefile | 2 +- arch/x86/kernel/Makefile | 2 +- arch/x86/purgatory/Makefile | 2 +- kernel/Makefile | 2 +- arch/riscv/include/asm/cfi.h | 4 +-- arch/x86/include/asm/cfi.h | 4 +-- include/asm-generic/vmlinux.lds.h | 2 +- include/linux/cfi.h | 6 ++--- include/linux/cfi_types.h | 8 +++--- include/linux/compiler.h | 2 +- include/linux/compiler_types.h | 2 +- tools/include/linux/cfi_types.h | 6 ++--- tools/perf/util/include/linux/linkage.h | 2 +- arch/arm/mm/cache-fa.S | 2 +- arch/arm/mm/cache-v4.S | 2 +- arch/arm/mm/cache-v4wb.S | 4 +-- arch/arm/mm/cache-v4wt.S | 2 +- arch/arm/mm/cache-v6.S | 2 +- arch/arm/mm/cache-v7.S | 2 +- arch/arm/mm/cache-v7m.S | 2 +- arch/arm/mm/proc-arm1020.S | 2 +- arch/arm/mm/proc-arm1020e.S | 2 +- arch/arm/mm/proc-arm1022.S | 2 +- arch/arm/mm/proc-arm1026.S | 2 +- arch/arm/mm/proc-arm920.S | 2 +- arch/arm/mm/proc-arm922.S | 2 +- arch/arm/mm/proc-arm925.S | 2 +- arch/arm/mm/proc-arm926.S | 2 +- arch/arm/mm/proc-arm940.S | 2 +- arch/arm/mm/proc-arm946.S | 2 +- arch/arm/mm/proc-feroceon.S | 2 +- arch/arm/mm/proc-mohawk.S | 2 +- arch/arm/mm/proc-xsc3.S | 2 +- arch/arm/mm/tlb-v4.S | 2 +- arch/arm/kernel/hw_breakpoint.c | 2 +- arch/arm64/kernel/debug-monitors.c | 2 +- arch/arm64/kernel/traps.c | 4 +-- arch/arm64/kvm/handle_exit.c | 2 +- arch/arm64/net/bpf_jit_comp.c | 2 +- arch/riscv/net/bpf_jit_comp64.c | 4 +-- arch/x86/kernel/alternative.c | 4 +-- arch/x86/kernel/kprobes/core.c | 2 +- drivers/misc/lkdtm/cfi.c | 2 +- kernel/module/tree_lookup.c | 2 +- kernel/configs/hardening.config | 2 +- 56 files changed, 100 insertions(+), 90 deletions(-) diff --git a/arch/Kconfig b/arch/Kconfig index d1b4ffd6e085..97642c08a124 100644 --- a/arch/Kconfig +++ b/arch/Kconfig @@ -867,22 +867,26 @@ config PROPELLER_CLANG =20 If unsure, say N. =20 -config ARCH_SUPPORTS_CFI_CLANG +config ARCH_SUPPORTS_CFI bool help - An architecture should select this option if it can support Clang's - Control-Flow Integrity (CFI) checking. + An architecture should select this option if it can support Kernel + Control-Flow Integrity (CFI) checking (-fsanitize=3Dkcfi). =20 config ARCH_USES_CFI_TRAPS bool + help + An architecture should select this option if it requires the + .kcfi_traps section for KCFI trap handling. =20 -config CFI_CLANG - bool "Use Clang's Control Flow Integrity (CFI)" - depends on ARCH_SUPPORTS_CFI_CLANG +config CFI + bool "Use Kernel Control Flow Integrity (kCFI)" + default CFI_CLANG + depends on ARCH_SUPPORTS_CFI depends on $(cc-option,-fsanitize=3Dkcfi) help - This option enables Clang's forward-edge Control Flow Integrity - (CFI) checking, where the compiler injects a runtime check to each + This option enables forward-edge Control Flow Integrity (CFI) + checking, where the compiler injects a runtime check to each indirect function call to ensure the target is a valid function with the correct static type. This restricts possible call targets and makes it more difficult for an attacker to exploit bugs that allow @@ -891,10 +895,16 @@ config CFI_CLANG =20 https://clang.llvm.org/docs/ControlFlowIntegrity.html =20 +config CFI_CLANG + bool + transitional + help + Transitional config for CFI_CLANG to CFI migration. + config CFI_ICALL_NORMALIZE_INTEGERS bool "Normalize CFI tags for integers" - depends on CFI_CLANG - depends on HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG + depends on CFI + depends on HAVE_CFI_ICALL_NORMALIZE_INTEGERS help This option normalizes the CFI tags for integer types so that all integer types of the same size and signedness receive the same CFI @@ -907,7 +917,7 @@ config CFI_ICALL_NORMALIZE_INTEGERS =20 This option is necessary for using CFI with Rust. If unsure, say N. =20 -config HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG +config HAVE_CFI_ICALL_NORMALIZE_INTEGERS def_bool y depends on $(cc-option,-fsanitize=3Dkcfi -fsanitize-cfi-icall-experimenta= l-normalize-integers) # With GCOV/KASAN we need this fix: https://github.com/llvm/llvm-project/= pull/104826 @@ -915,7 +925,7 @@ config HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG =20 config HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC def_bool y - depends on HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG + depends on HAVE_CFI_ICALL_NORMALIZE_INTEGERS depends on RUSTC_VERSION >=3D 107900 # With GCOV/KASAN we need this fix: https://github.com/rust-lang/rust/pul= l/129373 depends on (RUSTC_LLVM_VERSION >=3D 190103 && RUSTC_VERSION >=3D 108200) = || \ @@ -923,7 +933,7 @@ config HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC =20 config CFI_PERMISSIVE bool "Use CFI in permissive mode" - depends on CFI_CLANG + depends on CFI help When selected, Control Flow Integrity (CFI) violations result in a warning instead of a kernel panic. This option should only be used diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig index b1f3df39ed40..36ab8625be72 100644 --- a/arch/arm/Kconfig +++ b/arch/arm/Kconfig @@ -38,7 +38,7 @@ config ARM select ARCH_OPTIONAL_KERNEL_RWX_DEFAULT if CPU_V7 select ARCH_NEED_CMPXCHG_1_EMU if CPU_V6 select ARCH_SUPPORTS_ATOMIC_RMW - select ARCH_SUPPORTS_CFI_CLANG + select ARCH_SUPPORTS_CFI select ARCH_SUPPORTS_HUGETLBFS if ARM_LPAE select ARCH_SUPPORTS_PER_VMA_LOCK select ARCH_USE_BUILTIN_BSWAP diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index e9bbfacc35a6..1e38b8885a46 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -100,7 +100,7 @@ config ARM64 select ARCH_SUPPORTS_SHADOW_CALL_STACK if CC_HAVE_SHADOW_CALL_STACK select ARCH_SUPPORTS_LTO_CLANG if CPU_LITTLE_ENDIAN select ARCH_SUPPORTS_LTO_CLANG_THIN - select ARCH_SUPPORTS_CFI_CLANG + select ARCH_SUPPORTS_CFI select ARCH_SUPPORTS_ATOMIC_RMW select ARCH_SUPPORTS_INT128 if CC_HAS_INT128 select ARCH_SUPPORTS_NUMA_BALANCING @@ -212,7 +212,7 @@ config ARM64 select HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS \ if DYNAMIC_FTRACE_WITH_ARGS && DYNAMIC_FTRACE_WITH_CALL_OPS select HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS \ - if (DYNAMIC_FTRACE_WITH_ARGS && !CFI_CLANG && \ + if (DYNAMIC_FTRACE_WITH_ARGS && !CFI && \ (CC_IS_CLANG || !CC_OPTIMIZE_FOR_SIZE)) select FTRACE_MCOUNT_USE_PATCHABLE_FUNCTION_ENTRY \ if DYNAMIC_FTRACE_WITH_ARGS diff --git a/arch/riscv/Kconfig b/arch/riscv/Kconfig index a4b233a0659e..6043ad82b73c 100644 --- a/arch/riscv/Kconfig +++ b/arch/riscv/Kconfig @@ -60,7 +60,7 @@ config RISCV select ARCH_STACKWALK select ARCH_SUPPORTS_ATOMIC_RMW # clang >=3D 17: https://github.com/llvm/llvm-project/commit/62fa708ceb02= 7713b386c7e0efda994f8bdc27e2 - select ARCH_SUPPORTS_CFI_CLANG if CLANG_VERSION >=3D 170000 + select ARCH_SUPPORTS_CFI if (!CC_IS_CLANG || CLANG_VERSION >=3D 170000) select ARCH_SUPPORTS_DEBUG_PAGEALLOC if MMU select ARCH_SUPPORTS_HUGE_PFNMAP if TRANSPARENT_HUGEPAGE select ARCH_SUPPORTS_HUGETLBFS if MMU @@ -76,7 +76,7 @@ config RISCV select ARCH_USE_MEMTEST select ARCH_USE_QUEUED_RWLOCKS select ARCH_USE_SYM_ANNOTATIONS - select ARCH_USES_CFI_TRAPS if CFI_CLANG + select ARCH_USES_CFI_TRAPS if CFI select ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH if MMU select ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT if MMU select ARCH_WANT_FRAME_POINTERS @@ -154,7 +154,7 @@ config RISCV select HAVE_DYNAMIC_FTRACE if !XIP_KERNEL && MMU && (CLANG_SUPPORTS_DYNAM= IC_FTRACE || GCC_SUPPORTS_DYNAMIC_FTRACE) select FUNCTION_ALIGNMENT_4B if HAVE_DYNAMIC_FTRACE && RISCV_ISA_C select HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS if HAVE_DYNAMIC_FTRACE_WITH_= CALL_OPS - select HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS if (DYNAMIC_FTRACE_WITH_ARGS && = !CFI_CLANG) + select HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS if (DYNAMIC_FTRACE_WITH_ARGS && = !CFI) select HAVE_DYNAMIC_FTRACE_WITH_ARGS if HAVE_DYNAMIC_FTRACE select HAVE_FTRACE_GRAPH_FUNC select HAVE_FUNCTION_GRAPH_TRACER if HAVE_DYNAMIC_FTRACE_WITH_ARGS diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 58d890fe2100..b6da2d37cfd1 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -127,8 +127,8 @@ config X86 select ARCH_SUPPORTS_PAGE_TABLE_CHECK if X86_64 select ARCH_SUPPORTS_NUMA_BALANCING if X86_64 select ARCH_SUPPORTS_KMAP_LOCAL_FORCE_MAP if NR_CPUS <=3D 4096 - select ARCH_SUPPORTS_CFI_CLANG if X86_64 - select ARCH_USES_CFI_TRAPS if X86_64 && CFI_CLANG + select ARCH_SUPPORTS_CFI if X86_64 + select ARCH_USES_CFI_TRAPS if X86_64 && CFI select ARCH_SUPPORTS_LTO_CLANG select ARCH_SUPPORTS_LTO_CLANG_THIN select ARCH_SUPPORTS_RT @@ -2396,11 +2396,11 @@ config FUNCTION_PADDING_CFI default 3 if FUNCTION_ALIGNMENT_8B default 0 =20 -# Basically: FUNCTION_ALIGNMENT - 5*CFI_CLANG +# Basically: FUNCTION_ALIGNMENT - 5*CFI # except Kconfig can't do arithmetic :/ config FUNCTION_PADDING_BYTES int - default FUNCTION_PADDING_CFI if CFI_CLANG + default FUNCTION_PADDING_CFI if CFI default FUNCTION_ALIGNMENT =20 config CALL_PADDING @@ -2410,7 +2410,7 @@ config CALL_PADDING =20 config FINEIBT def_bool y - depends on X86_KERNEL_IBT && CFI_CLANG && MITIGATION_RETPOLINE + depends on X86_KERNEL_IBT && CFI && MITIGATION_RETPOLINE select CALL_PADDING =20 config FINEIBT_BHI @@ -2427,7 +2427,7 @@ config CALL_THUNKS =20 config PREFIX_SYMBOLS def_bool y - depends on CALL_PADDING && !CFI_CLANG + depends on CALL_PADDING && !CFI =20 menuconfig CPU_MITIGATIONS bool "Mitigations for CPU vulnerabilities" diff --git a/init/Kconfig b/init/Kconfig index 836320251219..67f10d8a33b7 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -2063,8 +2063,8 @@ config RUST depends on !GCC_PLUGIN_RANDSTRUCT depends on !RANDSTRUCT depends on !DEBUG_INFO_BTF || (PAHOLE_HAS_LANG_EXCLUDE && !LTO) - depends on !CFI_CLANG || HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC - select CFI_ICALL_NORMALIZE_INTEGERS if CFI_CLANG + depends on !CFI || HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC + select CFI_ICALL_NORMALIZE_INTEGERS if CFI depends on !CALL_PADDING || RUSTC_VERSION >=3D 108100 depends on !KASAN_SW_TAGS depends on !(MITIGATION_RETHUNK && KASAN) || RUSTC_VERSION >=3D 108300 diff --git a/kernel/module/Kconfig b/kernel/module/Kconfig index 39278737bb68..2a1beebf1d37 100644 --- a/kernel/module/Kconfig +++ b/kernel/module/Kconfig @@ -460,6 +460,6 @@ config UNUSED_KSYMS_WHITELIST =20 config MODULES_TREE_LOOKUP def_bool y - depends on PERF_EVENTS || TRACING || CFI_CLANG + depends on PERF_EVENTS || TRACING || CFI =20 endif # MODULES diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug index dc0e0c6ed075..e3e69df19e78 100644 --- a/lib/Kconfig.debug +++ b/lib/Kconfig.debug @@ -2894,7 +2894,7 @@ config FORTIFY_KUNIT_TEST config LONGEST_SYM_KUNIT_TEST tristate "Test the longest symbol possible" if !KUNIT_ALL_TESTS depends on KUNIT && KPROBES - depends on !PREFIX_SYMBOLS && !CFI_CLANG && !GCOV_KERNEL + depends on !PREFIX_SYMBOLS && !CFI && !GCOV_KERNEL default KUNIT_ALL_TESTS help Tests the longest symbol possible diff --git a/Makefile b/Makefile index d1adb78c3596..437989d6e0be 100644 --- a/Makefile +++ b/Makefile @@ -1020,7 +1020,7 @@ KBUILD_AFLAGS +=3D -fno-lto export CC_FLAGS_LTO endif =20 -ifdef CONFIG_CFI_CLANG +ifdef CONFIG_CFI CC_FLAGS_CFI :=3D -fsanitize=3Dkcfi ifdef CONFIG_CFI_ICALL_NORMALIZE_INTEGERS CC_FLAGS_CFI +=3D -fsanitize-cfi-icall-experimental-normalize-integers diff --git a/arch/arm/mm/Makefile b/arch/arm/mm/Makefile index a195cd1d3e6d..1e2201013371 100644 --- a/arch/arm/mm/Makefile +++ b/arch/arm/mm/Makefile @@ -89,7 +89,7 @@ obj-$(CONFIG_CPU_V6) +=3D proc-v6.o obj-$(CONFIG_CPU_V6K) +=3D proc-v6.o obj-$(CONFIG_CPU_V7) +=3D proc-v7.o proc-v7-bugs.o obj-$(CONFIG_CPU_V7M) +=3D proc-v7m.o -obj-$(CONFIG_CFI_CLANG) +=3D proc.o +obj-$(CONFIG_CFI) +=3D proc.o =20 obj-$(CONFIG_OUTER_CACHE) +=3D l2c-common.o obj-$(CONFIG_CACHE_B15_RAC) +=3D cache-b15-rac.o diff --git a/arch/riscv/kernel/Makefile b/arch/riscv/kernel/Makefile index c7b542573407..f60fce69b725 100644 --- a/arch/riscv/kernel/Makefile +++ b/arch/riscv/kernel/Makefile @@ -113,7 +113,7 @@ obj-$(CONFIG_VMCORE_INFO) +=3D vmcore_info.o =20 obj-$(CONFIG_JUMP_LABEL) +=3D jump_label.o =20 -obj-$(CONFIG_CFI_CLANG) +=3D cfi.o +obj-$(CONFIG_CFI) +=3D cfi.o =20 obj-$(CONFIG_EFI) +=3D efi.o obj-$(CONFIG_COMPAT) +=3D compat_syscall_table.o diff --git a/arch/riscv/purgatory/Makefile b/arch/riscv/purgatory/Makefile index 240592e3f5c2..530e497ca2f9 100644 --- a/arch/riscv/purgatory/Makefile +++ b/arch/riscv/purgatory/Makefile @@ -71,7 +71,7 @@ ifdef CONFIG_STACKPROTECTOR_STRONG PURGATORY_CFLAGS_REMOVE +=3D -fstack-protector-strong endif =20 -ifdef CONFIG_CFI_CLANG +ifdef CONFIG_CFI PURGATORY_CFLAGS_REMOVE +=3D $(CC_FLAGS_CFI) endif =20 diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile index 0d2a6d953be9..bc184dd38d99 100644 --- a/arch/x86/kernel/Makefile +++ b/arch/x86/kernel/Makefile @@ -148,7 +148,7 @@ obj-$(CONFIG_UNWINDER_ORC) +=3D unwind_orc.o obj-$(CONFIG_UNWINDER_FRAME_POINTER) +=3D unwind_frame.o obj-$(CONFIG_UNWINDER_GUESS) +=3D unwind_guess.o =20 -obj-$(CONFIG_CFI_CLANG) +=3D cfi.o +obj-$(CONFIG_CFI) +=3D cfi.o =20 obj-$(CONFIG_CALL_THUNKS) +=3D callthunks.o =20 diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile index e0a607a14e7e..5ce1d4263000 100644 --- a/arch/x86/purgatory/Makefile +++ b/arch/x86/purgatory/Makefile @@ -57,7 +57,7 @@ ifdef CONFIG_MITIGATION_RETPOLINE PURGATORY_CFLAGS_REMOVE +=3D $(RETPOLINE_CFLAGS) endif =20 -ifdef CONFIG_CFI_CLANG +ifdef CONFIG_CFI PURGATORY_CFLAGS_REMOVE +=3D $(CC_FLAGS_CFI) endif =20 diff --git a/kernel/Makefile b/kernel/Makefile index c60623448235..27e0e6a33610 100644 --- a/kernel/Makefile +++ b/kernel/Makefile @@ -122,7 +122,7 @@ obj-$(CONFIG_KCSAN) +=3D kcsan/ obj-$(CONFIG_SHADOW_CALL_STACK) +=3D scs.o obj-$(CONFIG_HAVE_STATIC_CALL) +=3D static_call.o obj-$(CONFIG_HAVE_STATIC_CALL_INLINE) +=3D static_call_inline.o -obj-$(CONFIG_CFI_CLANG) +=3D cfi.o +obj-$(CONFIG_CFI) +=3D cfi.o =20 obj-$(CONFIG_PERF_EVENTS) +=3D events/ =20 diff --git a/arch/riscv/include/asm/cfi.h b/arch/riscv/include/asm/cfi.h index 4508aaa7a2fd..710aa8192edd 100644 --- a/arch/riscv/include/asm/cfi.h +++ b/arch/riscv/include/asm/cfi.h @@ -11,7 +11,7 @@ =20 struct pt_regs; =20 -#ifdef CONFIG_CFI_CLANG +#ifdef CONFIG_CFI enum bug_trap_type handle_cfi_failure(struct pt_regs *regs); #define __bpfcall #else @@ -19,6 +19,6 @@ static inline enum bug_trap_type handle_cfi_failure(struc= t pt_regs *regs) { return BUG_TRAP_TYPE_NONE; } -#endif /* CONFIG_CFI_CLANG */ +#endif /* CONFIG_CFI */ =20 #endif /* _ASM_RISCV_CFI_H */ diff --git a/arch/x86/include/asm/cfi.h b/arch/x86/include/asm/cfi.h index 1751f1eb95ef..976b90a3d190 100644 --- a/arch/x86/include/asm/cfi.h +++ b/arch/x86/include/asm/cfi.h @@ -113,7 +113,7 @@ extern bhi_thunk __bhi_args_end[]; =20 struct pt_regs; =20 -#ifdef CONFIG_CFI_CLANG +#ifdef CONFIG_CFI enum bug_trap_type handle_cfi_failure(struct pt_regs *regs); #define __bpfcall =20 @@ -157,7 +157,7 @@ static inline int cfi_get_func_arity(void *func) { return 0; } -#endif /* CONFIG_CFI_CLANG */ +#endif /* CONFIG_CFI */ =20 #if HAS_KERNEL_IBT =3D=3D 1 #define CFI_NOSEAL(x) asm(IBT_NOSEAL(__stringify(x))) diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinu= x.lds.h index ae2d2359b79e..a65a87366c48 100644 --- a/include/asm-generic/vmlinux.lds.h +++ b/include/asm-generic/vmlinux.lds.h @@ -157,7 +157,7 @@ defined(CONFIG_AUTOFDO_CLANG) || defined(CONFIG_PROPELL= ER_CLANG) #define PATCHABLE_DISCARDS *(__patchable_function_entries) #endif =20 -#ifndef CONFIG_ARCH_SUPPORTS_CFI_CLANG +#ifndef CONFIG_ARCH_SUPPORTS_CFI /* * Simply points to ftrace_stub, but with the proper protocol. * Defined by the linker script in linux/vmlinux.lds.h diff --git a/include/linux/cfi.h b/include/linux/cfi.h index 52a98886a455..1fd22ea6eba4 100644 --- a/include/linux/cfi.h +++ b/include/linux/cfi.h @@ -11,7 +11,7 @@ #include #include =20 -#ifdef CONFIG_CFI_CLANG +#ifdef CONFIG_CFI extern bool cfi_warn; =20 enum bug_trap_type report_cfi_failure(struct pt_regs *regs, unsigned long = addr, @@ -52,7 +52,7 @@ static inline u32 cfi_get_func_hash(void *func) extern u32 cfi_bpf_hash; extern u32 cfi_bpf_subprog_hash; =20 -#else /* CONFIG_CFI_CLANG */ +#else /* CONFIG_CFI */ =20 static inline int cfi_get_offset(void) { return 0; } static inline u32 cfi_get_func_hash(void *func) { return 0; } @@ -60,7 +60,7 @@ static inline u32 cfi_get_func_hash(void *func) { return = 0; } #define cfi_bpf_hash 0U #define cfi_bpf_subprog_hash 0U =20 -#endif /* CONFIG_CFI_CLANG */ +#endif /* CONFIG_CFI */ =20 #ifdef CONFIG_ARCH_USES_CFI_TRAPS bool is_cfi_trap(unsigned long addr); diff --git a/include/linux/cfi_types.h b/include/linux/cfi_types.h index 685f7181780f..a86af9bc8bdc 100644 --- a/include/linux/cfi_types.h +++ b/include/linux/cfi_types.h @@ -8,7 +8,7 @@ #ifdef __ASSEMBLY__ #include =20 -#ifdef CONFIG_CFI_CLANG +#ifdef CONFIG_CFI /* * Use the __kcfi_typeid_ type identifier symbol to * annotate indirectly called assembly functions. The compiler emits @@ -29,12 +29,12 @@ #define SYM_TYPED_START(name, linkage, align...) \ SYM_TYPED_ENTRY(name, linkage, align) =20 -#else /* CONFIG_CFI_CLANG */ +#else /* CONFIG_CFI */ =20 #define SYM_TYPED_START(name, linkage, align...) \ SYM_START(name, linkage, align) =20 -#endif /* CONFIG_CFI_CLANG */ +#endif /* CONFIG_CFI */ =20 #ifndef SYM_TYPED_FUNC_START #define SYM_TYPED_FUNC_START(name) \ @@ -43,7 +43,7 @@ =20 #else /* __ASSEMBLY__ */ =20 -#ifdef CONFIG_CFI_CLANG +#ifdef CONFIG_CFI #define DEFINE_CFI_TYPE(name, func) \ /* \ * Force a reference to the function so the compiler generates \ diff --git a/include/linux/compiler.h b/include/linux/compiler.h index 6f04a1d8c720..fb27da2221ee 100644 --- a/include/linux/compiler.h +++ b/include/linux/compiler.h @@ -248,7 +248,7 @@ void ftrace_likely_update(struct ftrace_likely_data *f,= int val, =20 #endif /* __KERNEL__ */ =20 -#if defined(CONFIG_CFI_CLANG) && !defined(__DISABLE_EXPORTS) && !defined(B= UILD_VDSO) +#if defined(CONFIG_CFI) && !defined(__DISABLE_EXPORTS) && !defined(BUILD_V= DSO) /* * Force a reference to the external symbol so the compiler generates * __kcfi_typid. diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h index a910f9fa5341..27026752aec8 100644 --- a/include/linux/compiler_types.h +++ b/include/linux/compiler_types.h @@ -432,7 +432,7 @@ struct ftrace_likely_data { # define __noscs #endif =20 -#if defined(CONFIG_CFI_CLANG) +#if defined(CONFIG_CFI) # define __nocfi __attribute__((__no_sanitize__("kcfi"))) #else # define __nocfi diff --git a/tools/include/linux/cfi_types.h b/tools/include/linux/cfi_type= s.h index 6b8713675765..2e098274e45c 100644 --- a/tools/include/linux/cfi_types.h +++ b/tools/include/linux/cfi_types.h @@ -8,7 +8,7 @@ #ifdef __ASSEMBLY__ #include =20 -#ifdef CONFIG_CFI_CLANG +#ifdef CONFIG_CFI /* * Use the __kcfi_typeid_ type identifier symbol to * annotate indirectly called assembly functions. The compiler emits @@ -29,12 +29,12 @@ #define SYM_TYPED_START(name, linkage, align...) \ SYM_TYPED_ENTRY(name, linkage, align) =20 -#else /* CONFIG_CFI_CLANG */ +#else /* CONFIG_CFI */ =20 #define SYM_TYPED_START(name, linkage, align...) \ SYM_START(name, linkage, align) =20 -#endif /* CONFIG_CFI_CLANG */ +#endif /* CONFIG_CFI */ =20 #ifndef SYM_TYPED_FUNC_START #define SYM_TYPED_FUNC_START(name) \ diff --git a/tools/perf/util/include/linux/linkage.h b/tools/perf/util/incl= ude/linux/linkage.h index 89979ca23c3f..34e2fdfe7300 100644 --- a/tools/perf/util/include/linux/linkage.h +++ b/tools/perf/util/include/linux/linkage.h @@ -120,7 +120,7 @@ #endif =20 // In the kernel sources (include/linux/cfi_types.h), this has a different -// definition when CONFIG_CFI_CLANG is used, for tools/ just use the !clang +// definition when CONFIG_CFI is used, for tools/ just use the !cfi // definition: #ifndef SYM_TYPED_START #define SYM_TYPED_START(name, linkage, align...) \ diff --git a/arch/arm/mm/cache-fa.S b/arch/arm/mm/cache-fa.S index 4a3668b52a2d..e1641799569b 100644 --- a/arch/arm/mm/cache-fa.S +++ b/arch/arm/mm/cache-fa.S @@ -112,7 +112,7 @@ SYM_FUNC_END(fa_flush_user_cache_range) * - end - virtual end address */ SYM_TYPED_FUNC_START(fa_coherent_kern_range) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b fa_coherent_user_range #endif SYM_FUNC_END(fa_coherent_kern_range) diff --git a/arch/arm/mm/cache-v4.S b/arch/arm/mm/cache-v4.S index 0e94e5193dbd..001d7042bd46 100644 --- a/arch/arm/mm/cache-v4.S +++ b/arch/arm/mm/cache-v4.S @@ -104,7 +104,7 @@ SYM_FUNC_END(v4_coherent_user_range) * - size - region size */ SYM_TYPED_FUNC_START(v4_flush_kern_dcache_area) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b v4_dma_flush_range #endif SYM_FUNC_END(v4_flush_kern_dcache_area) diff --git a/arch/arm/mm/cache-v4wb.S b/arch/arm/mm/cache-v4wb.S index ce55a2eef5da..874fe5310f9a 100644 --- a/arch/arm/mm/cache-v4wb.S +++ b/arch/arm/mm/cache-v4wb.S @@ -136,7 +136,7 @@ SYM_FUNC_END(v4wb_flush_user_cache_range) */ SYM_TYPED_FUNC_START(v4wb_flush_kern_dcache_area) add r1, r0, r1 -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b v4wb_coherent_user_range #endif SYM_FUNC_END(v4wb_flush_kern_dcache_area) @@ -152,7 +152,7 @@ SYM_FUNC_END(v4wb_flush_kern_dcache_area) * - end - virtual end address */ SYM_TYPED_FUNC_START(v4wb_coherent_kern_range) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b v4wb_coherent_user_range #endif SYM_FUNC_END(v4wb_coherent_kern_range) diff --git a/arch/arm/mm/cache-v4wt.S b/arch/arm/mm/cache-v4wt.S index a97dc267b3b0..2ee62e4b2b07 100644 --- a/arch/arm/mm/cache-v4wt.S +++ b/arch/arm/mm/cache-v4wt.S @@ -108,7 +108,7 @@ SYM_FUNC_END(v4wt_flush_user_cache_range) * - end - virtual end address */ SYM_TYPED_FUNC_START(v4wt_coherent_kern_range) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b v4wt_coherent_user_range #endif SYM_FUNC_END(v4wt_coherent_kern_range) diff --git a/arch/arm/mm/cache-v6.S b/arch/arm/mm/cache-v6.S index 9f415476e218..5ceea8965ea1 100644 --- a/arch/arm/mm/cache-v6.S +++ b/arch/arm/mm/cache-v6.S @@ -117,7 +117,7 @@ SYM_FUNC_END(v6_flush_user_cache_range) * - the Icache does not read data from the write buffer */ SYM_TYPED_FUNC_START(v6_coherent_kern_range) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b v6_coherent_user_range #endif SYM_FUNC_END(v6_coherent_kern_range) diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S index 201ca05436fa..726681fb7d4d 100644 --- a/arch/arm/mm/cache-v7.S +++ b/arch/arm/mm/cache-v7.S @@ -261,7 +261,7 @@ SYM_FUNC_END(v7_flush_user_cache_range) * - the Icache does not read data from the write buffer */ SYM_TYPED_FUNC_START(v7_coherent_kern_range) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b v7_coherent_user_range #endif SYM_FUNC_END(v7_coherent_kern_range) diff --git a/arch/arm/mm/cache-v7m.S b/arch/arm/mm/cache-v7m.S index 14d719eba729..7f9cfad2ea21 100644 --- a/arch/arm/mm/cache-v7m.S +++ b/arch/arm/mm/cache-v7m.S @@ -286,7 +286,7 @@ SYM_FUNC_END(v7m_flush_user_cache_range) * - the Icache does not read data from the write buffer */ SYM_TYPED_FUNC_START(v7m_coherent_kern_range) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b v7m_coherent_user_range #endif SYM_FUNC_END(v7m_coherent_kern_range) diff --git a/arch/arm/mm/proc-arm1020.S b/arch/arm/mm/proc-arm1020.S index d0ce3414a13e..4612a4961e81 100644 --- a/arch/arm/mm/proc-arm1020.S +++ b/arch/arm/mm/proc-arm1020.S @@ -203,7 +203,7 @@ SYM_FUNC_END(arm1020_flush_user_cache_range) * - end - virtual end address */ SYM_TYPED_FUNC_START(arm1020_coherent_kern_range) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b arm1020_coherent_user_range #endif SYM_FUNC_END(arm1020_coherent_kern_range) diff --git a/arch/arm/mm/proc-arm1020e.S b/arch/arm/mm/proc-arm1020e.S index 64f031bf6eff..b4a8a3a8eda3 100644 --- a/arch/arm/mm/proc-arm1020e.S +++ b/arch/arm/mm/proc-arm1020e.S @@ -200,7 +200,7 @@ SYM_FUNC_END(arm1020e_flush_user_cache_range) * - end - virtual end address */ SYM_TYPED_FUNC_START(arm1020e_coherent_kern_range) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b arm1020e_coherent_user_range #endif SYM_FUNC_END(arm1020e_coherent_kern_range) diff --git a/arch/arm/mm/proc-arm1022.S b/arch/arm/mm/proc-arm1022.S index 42ed5ed07252..709870e99e19 100644 --- a/arch/arm/mm/proc-arm1022.S +++ b/arch/arm/mm/proc-arm1022.S @@ -199,7 +199,7 @@ SYM_FUNC_END(arm1022_flush_user_cache_range) * - end - virtual end address */ SYM_TYPED_FUNC_START(arm1022_coherent_kern_range) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b arm1022_coherent_user_range #endif SYM_FUNC_END(arm1022_coherent_kern_range) diff --git a/arch/arm/mm/proc-arm1026.S b/arch/arm/mm/proc-arm1026.S index b3ae62cd553a..02f7370a8c5c 100644 --- a/arch/arm/mm/proc-arm1026.S +++ b/arch/arm/mm/proc-arm1026.S @@ -194,7 +194,7 @@ SYM_FUNC_END(arm1026_flush_user_cache_range) * - end - virtual end address */ SYM_TYPED_FUNC_START(arm1026_coherent_kern_range) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b arm1026_coherent_user_range #endif SYM_FUNC_END(arm1026_coherent_kern_range) diff --git a/arch/arm/mm/proc-arm920.S b/arch/arm/mm/proc-arm920.S index a30df54ad5fa..4727f4b5b6e8 100644 --- a/arch/arm/mm/proc-arm920.S +++ b/arch/arm/mm/proc-arm920.S @@ -180,7 +180,7 @@ SYM_FUNC_END(arm920_flush_user_cache_range) * - end - virtual end address */ SYM_TYPED_FUNC_START(arm920_coherent_kern_range) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b arm920_coherent_user_range #endif SYM_FUNC_END(arm920_coherent_kern_range) diff --git a/arch/arm/mm/proc-arm922.S b/arch/arm/mm/proc-arm922.S index aac4e048100d..5a4a3f4f2683 100644 --- a/arch/arm/mm/proc-arm922.S +++ b/arch/arm/mm/proc-arm922.S @@ -182,7 +182,7 @@ SYM_FUNC_END(arm922_flush_user_cache_range) * - end - virtual end address */ SYM_TYPED_FUNC_START(arm922_coherent_kern_range) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b arm922_coherent_user_range #endif SYM_FUNC_END(arm922_coherent_kern_range) diff --git a/arch/arm/mm/proc-arm925.S b/arch/arm/mm/proc-arm925.S index 035941faeb2e..1c4830afe1d3 100644 --- a/arch/arm/mm/proc-arm925.S +++ b/arch/arm/mm/proc-arm925.S @@ -229,7 +229,7 @@ SYM_FUNC_END(arm925_flush_user_cache_range) * - end - virtual end address */ SYM_TYPED_FUNC_START(arm925_coherent_kern_range) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b arm925_coherent_user_range #endif SYM_FUNC_END(arm925_coherent_kern_range) diff --git a/arch/arm/mm/proc-arm926.S b/arch/arm/mm/proc-arm926.S index 6f43d6af2d9a..a09cc3e02efd 100644 --- a/arch/arm/mm/proc-arm926.S +++ b/arch/arm/mm/proc-arm926.S @@ -192,7 +192,7 @@ SYM_FUNC_END(arm926_flush_user_cache_range) * - end - virtual end address */ SYM_TYPED_FUNC_START(arm926_coherent_kern_range) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b arm926_coherent_user_range #endif SYM_FUNC_END(arm926_coherent_kern_range) diff --git a/arch/arm/mm/proc-arm940.S b/arch/arm/mm/proc-arm940.S index 0d30bb25c42b..545c076c36d2 100644 --- a/arch/arm/mm/proc-arm940.S +++ b/arch/arm/mm/proc-arm940.S @@ -153,7 +153,7 @@ SYM_FUNC_END(arm940_coherent_kern_range) * - end - virtual end address */ SYM_TYPED_FUNC_START(arm940_coherent_user_range) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b arm940_flush_kern_dcache_area #endif SYM_FUNC_END(arm940_coherent_user_range) diff --git a/arch/arm/mm/proc-arm946.S b/arch/arm/mm/proc-arm946.S index 27750ace2ced..f3d4e18c3fba 100644 --- a/arch/arm/mm/proc-arm946.S +++ b/arch/arm/mm/proc-arm946.S @@ -173,7 +173,7 @@ SYM_FUNC_END(arm946_flush_user_cache_range) * - end - virtual end address */ SYM_TYPED_FUNC_START(arm946_coherent_kern_range) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b arm946_coherent_user_range #endif SYM_FUNC_END(arm946_coherent_kern_range) diff --git a/arch/arm/mm/proc-feroceon.S b/arch/arm/mm/proc-feroceon.S index f67b2ffac854..7f08d06c9625 100644 --- a/arch/arm/mm/proc-feroceon.S +++ b/arch/arm/mm/proc-feroceon.S @@ -208,7 +208,7 @@ SYM_FUNC_END(feroceon_flush_user_cache_range) */ .align 5 SYM_TYPED_FUNC_START(feroceon_coherent_kern_range) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b feroceon_coherent_user_range #endif SYM_FUNC_END(feroceon_coherent_kern_range) diff --git a/arch/arm/mm/proc-mohawk.S b/arch/arm/mm/proc-mohawk.S index 8e9f38da863a..4669c63e3121 100644 --- a/arch/arm/mm/proc-mohawk.S +++ b/arch/arm/mm/proc-mohawk.S @@ -163,7 +163,7 @@ SYM_FUNC_END(mohawk_flush_user_cache_range) * - end - virtual end address */ SYM_TYPED_FUNC_START(mohawk_coherent_kern_range) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b mohawk_coherent_user_range #endif SYM_FUNC_END(mohawk_coherent_kern_range) diff --git a/arch/arm/mm/proc-xsc3.S b/arch/arm/mm/proc-xsc3.S index 14927b380452..fd25634a2ed5 100644 --- a/arch/arm/mm/proc-xsc3.S +++ b/arch/arm/mm/proc-xsc3.S @@ -223,7 +223,7 @@ SYM_FUNC_END(xsc3_flush_user_cache_range) * it also trashes the mini I-cache used by JTAG debuggers. */ SYM_TYPED_FUNC_START(xsc3_coherent_kern_range) -#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ +#ifdef CONFIG_CFI /* Fallthrough if !CFI */ b xsc3_coherent_user_range #endif SYM_FUNC_END(xsc3_coherent_kern_range) diff --git a/arch/arm/mm/tlb-v4.S b/arch/arm/mm/tlb-v4.S index 09ff69008d94..079774a02be6 100644 --- a/arch/arm/mm/tlb-v4.S +++ b/arch/arm/mm/tlb-v4.S @@ -52,7 +52,7 @@ SYM_FUNC_END(v4_flush_user_tlb_range) * - start - virtual address (may not be aligned) * - end - virtual address (may not be aligned) */ -#ifdef CONFIG_CFI_CLANG +#ifdef CONFIG_CFI SYM_TYPED_FUNC_START(v4_flush_kern_tlb_range) b .v4_flush_kern_tlb_range SYM_FUNC_END(v4_flush_kern_tlb_range) diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoin= t.c index a12efd0f43e8..cd4b34c96e35 100644 --- a/arch/arm/kernel/hw_breakpoint.c +++ b/arch/arm/kernel/hw_breakpoint.c @@ -904,7 +904,7 @@ static void breakpoint_handler(unsigned long unknown, s= truct pt_regs *regs) watchpoint_single_step_handler(addr); } =20 -#ifdef CONFIG_CFI_CLANG +#ifdef CONFIG_CFI static void hw_breakpoint_cfi_handler(struct pt_regs *regs) { /* diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-m= onitors.c index 110d9ff54174..ebf010443e22 100644 --- a/arch/arm64/kernel/debug-monitors.c +++ b/arch/arm64/kernel/debug-monitors.c @@ -212,7 +212,7 @@ static int call_el1_break_hook(struct pt_regs *regs, un= signed long esr) if (esr_brk_comment(esr) =3D=3D BUG_BRK_IMM) return bug_brk_handler(regs, esr); =20 - if (IS_ENABLED(CONFIG_CFI_CLANG) && esr_is_cfi_brk(esr)) + if (IS_ENABLED(CONFIG_CFI) && esr_is_cfi_brk(esr)) return cfi_brk_handler(regs, esr); =20 if (esr_brk_comment(esr) =3D=3D FAULT_BRK_IMM) diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c index f528b6041f6a..5041817af267 100644 --- a/arch/arm64/kernel/traps.c +++ b/arch/arm64/kernel/traps.c @@ -1015,7 +1015,7 @@ int bug_brk_handler(struct pt_regs *regs, unsigned lo= ng esr) return DBG_HOOK_HANDLED; } =20 -#ifdef CONFIG_CFI_CLANG +#ifdef CONFIG_CFI int cfi_brk_handler(struct pt_regs *regs, unsigned long esr) { unsigned long target; @@ -1039,7 +1039,7 @@ int cfi_brk_handler(struct pt_regs *regs, unsigned lo= ng esr) arm64_skip_faulting_instruction(regs, AARCH64_INSN_SIZE); return DBG_HOOK_HANDLED; } -#endif /* CONFIG_CFI_CLANG */ +#endif /* CONFIG_CFI */ =20 int reserved_fault_brk_handler(struct pt_regs *regs, unsigned long esr) { diff --git a/arch/arm64/kvm/handle_exit.c b/arch/arm64/kvm/handle_exit.c index a598072f36d2..8bdb1eed090a 100644 --- a/arch/arm64/kvm/handle_exit.c +++ b/arch/arm64/kvm/handle_exit.c @@ -545,7 +545,7 @@ void __noreturn __cold nvhe_hyp_panic_handler(u64 esr, = u64 spsr, kvm_err("nVHE hyp BUG at: %s:%u!\n", file, line); else print_nvhe_hyp_panic("BUG", panic_addr); - } else if (IS_ENABLED(CONFIG_CFI_CLANG) && esr_is_cfi_brk(esr)) { + } else if (IS_ENABLED(CONFIG_CFI) && esr_is_cfi_brk(esr)) { kvm_nvhe_report_cfi_failure(panic_addr); } else if (IS_ENABLED(CONFIG_UBSAN_KVM_EL2) && ESR_ELx_EC(esr) =3D=3D ESR_ELx_EC_BRK64 && diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index 52ffe115a8c4..28996e0a9b00 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -185,7 +185,7 @@ static inline void emit_bti(u32 insn, struct jit_ctx *c= tx) =20 static inline void emit_kcfi(u32 hash, struct jit_ctx *ctx) { - if (IS_ENABLED(CONFIG_CFI_CLANG)) + if (IS_ENABLED(CONFIG_CFI)) emit_u32_data(hash, ctx); } =20 diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp6= 4.c index 10e01ff06312..24ba546a1c0e 100644 --- a/arch/riscv/net/bpf_jit_comp64.c +++ b/arch/riscv/net/bpf_jit_comp64.c @@ -18,7 +18,7 @@ #define RV_MAX_REG_ARGS 8 #define RV_FENTRY_NINSNS 2 #define RV_FENTRY_NBYTES (RV_FENTRY_NINSNS * 4) -#define RV_KCFI_NINSNS (IS_ENABLED(CONFIG_CFI_CLANG) ? 1 : 0) +#define RV_KCFI_NINSNS (IS_ENABLED(CONFIG_CFI) ? 1 : 0) /* imm that allows emit_imm to emit max count insns */ #define RV_MAX_COUNT_IMM 0x7FFF7FF7FF7FF7FF =20 @@ -469,7 +469,7 @@ static int emit_call(u64 addr, bool fixed_addr, struct = rv_jit_context *ctx) =20 static inline void emit_kcfi(u32 hash, struct rv_jit_context *ctx) { - if (IS_ENABLED(CONFIG_CFI_CLANG)) + if (IS_ENABLED(CONFIG_CFI)) emit(hash, ctx); } =20 diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c index b311e31a9056..9afd765873ca 100644 --- a/arch/x86/kernel/alternative.c +++ b/arch/x86/kernel/alternative.c @@ -1170,7 +1170,7 @@ void __init_or_module apply_seal_endbr(s32 *start, s3= 2 *end) { } =20 #ifdef CONFIG_CFI_AUTO_DEFAULT # define __CFI_DEFAULT CFI_AUTO -#elif defined(CONFIG_CFI_CLANG) +#elif defined(CONFIG_CFI) # define __CFI_DEFAULT CFI_KCFI #else # define __CFI_DEFAULT CFI_OFF @@ -1183,7 +1183,7 @@ static bool cfi_debug __ro_after_init; bool cfi_bhi __ro_after_init =3D false; #endif =20 -#ifdef CONFIG_CFI_CLANG +#ifdef CONFIG_CFI u32 cfi_get_func_hash(void *func) { u32 hash; diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c index 6079d15dab8c..3863d7709386 100644 --- a/arch/x86/kernel/kprobes/core.c +++ b/arch/x86/kernel/kprobes/core.c @@ -339,7 +339,7 @@ static bool can_probe(unsigned long paddr) if (is_exception_insn(&insn)) return false; =20 - if (IS_ENABLED(CONFIG_CFI_CLANG)) { + if (IS_ENABLED(CONFIG_CFI)) { /* * The compiler generates the following instruction sequence * for indirect call checks and cfi.c decodes this; diff --git a/drivers/misc/lkdtm/cfi.c b/drivers/misc/lkdtm/cfi.c index 6a33889d0902..c3971f7caa65 100644 --- a/drivers/misc/lkdtm/cfi.c +++ b/drivers/misc/lkdtm/cfi.c @@ -43,7 +43,7 @@ static void lkdtm_CFI_FORWARD_PROTO(void) lkdtm_indirect_call((void *)lkdtm_increment_int); =20 pr_err("FAIL: survived mismatched prototype function call!\n"); - pr_expected_config(CONFIG_CFI_CLANG); + pr_expected_config(CONFIG_CFI); } =20 /* diff --git a/kernel/module/tree_lookup.c b/kernel/module/tree_lookup.c index d3204c5c74eb..f8e8c126705c 100644 --- a/kernel/module/tree_lookup.c +++ b/kernel/module/tree_lookup.c @@ -14,7 +14,7 @@ * Use a latched RB-tree for __module_address(); this allows us to use * RCU lookups of the address from any context. * - * This is conditional on PERF_EVENTS || TRACING || CFI_CLANG because thos= e can + * This is conditional on PERF_EVENTS || TRACING || CFI because those can * really hit __module_address() hard by doing a lot of stack unwinding; * potentially from NMI context. */ diff --git a/kernel/configs/hardening.config b/kernel/configs/hardening.con= fig index 64caaf997fc0..94a3d023e15e 100644 --- a/kernel/configs/hardening.config +++ b/kernel/configs/hardening.config @@ -94,7 +94,7 @@ CONFIG_SECCOMP_FILTER=3Dy CONFIG_SYN_COOKIES=3Dy =20 # Enable Kernel Control Flow Integrity (currently Clang only). -CONFIG_CFI_CLANG=3Dy +CONFIG_CFI=3Dy # CONFIG_CFI_PERMISSIVE is not set =20 # Attack surface reduction: do not autoload TTY line disciplines. --=20 2.34.1 From nobody Fri Oct 3 06:33:25 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 489262288CB; Thu, 4 Sep 2025 03:46:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756957617; cv=none; b=IfMzR35Ya+s9JUoUei3LtkEtWWKtpHBAWZ+5/ZKb1WfPc+SCW2FoQDuhDcqu4TTaG8Z96b3B534+vtl71Xjl4xrlTvblpRqoLTylUNS0GD9ontpOdu0oDUrq0cLqVgzpu8bcmd/xYx8Pro5WJv2D12fDKkMrJOhPWQOercdEUfA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756957617; c=relaxed/simple; bh=gygAMbYS4/B7LWfdzKi5nAbFlKtsg4fEng11C4rHscA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version:Content-Type; b=RuAaseUNNZtgsk2DO/25F1UKw/ysdoNz8Zhd1P7sll9/s1UCzJ9YeAxqA4g+WMY4WlOS3YYqKsVkQQEuTTIE3ROjFC/0YZtiesbxEJSEdZMpPJvpzCKCX1E3WPyft4etRCysuhp3m4lHJ9YlMffz1sBXpami045KVk5D667pBz8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ax77Piwh; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ax77Piwh" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D57B5C4CEFB; Thu, 4 Sep 2025 03:46:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1756957616; bh=gygAMbYS4/B7LWfdzKi5nAbFlKtsg4fEng11C4rHscA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ax77PiwhKcQSmL+erPQOSQzZtwHMjB7MlrBfQJMwgdIsaxbt+573t0SUH6yHrHkJ3 MkT+5bEPP6ahiL4X3gvDSnlCKUBMkFLF8vbl053+vkwlFs0RPik7MNgDTSwHdxm/V2 Y83JLwcOw35riFnhHzBlZ3s0oit68/A2QdGsOM7+WcdUBA2/0ouo74mLA6iAAmKXrs xjB/uwejT5g799laygAHq46UhgFrmajI57kspqGI5QtFomOny8Y4lVPFFevWIMlWXj 1gu7EPzf0cBMhXuAULqTZSIj1HcBgF8lAEGs2Fa232iAMVQcHfE0DM9Zpg0Z4GQLlp shQFx2TjNSQhQ== From: Kees Cook To: Peter Zijlstra Cc: Kees Cook , "Russell King (Oracle)" , Zhen Lei , Arnd Bergmann , =?UTF-8?q?Micha=C5=82=20Pecio?= , Sebastian Andrzej Siewior , Sami Tolvanen , linux-arm-kernel@lists.infradead.org, Nathan Chancellor , Vegard Nossum , Miguel Ojeda , Linus Walleij , Jeff Johnson , Randy Dunlap , David Woodhouse , Nick Desaulniers , Bill Wendling , Justin Stitt , Marco Elver , Przemek Kitszel , Ramon de C Valle , Jonathan Corbet , "Paul E. McKenney" , Nicolas Schier , Masahiro Yamada , Krzysztof Kozlowski , Mark Rutland , linux-kernel@vger.kernel.org, llvm@lists.linux.dev, linux-doc@vger.kernel.org, linux-kbuild@vger.kernel.org, x86@kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 9/9] ARM: traps: Implement KCFI trap handler for ARM32 Date: Wed, 3 Sep 2025 20:46:48 -0700 Message-Id: <20250904034656.3670313-9-kees@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250904033217.it.414-kees@kernel.org> References: <20250904033217.it.414-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" X-Developer-Signature: v=1; a=openpgp-sha256; l=5332; i=kees@kernel.org; h=from:subject; bh=gygAMbYS4/B7LWfdzKi5nAbFlKtsg4fEng11C4rHscA=; b=owGbwMvMwCVmps19z/KJym7G02pJDBk7OUv3bN80e35o3zHx0myb+o8qKnZfg7IPSfIduFpVL 71eyfxERykLgxgXg6yYIkuQnXuci8fb9nD3uYowc1iZQIYwcHEKwEQ+dDD8FfttyuvjKDe7J/Di h2WqfeW1jRw+wb032a1sLxWWimQ+YPgft3Ij5+HZqmcvrGNlTr+uq1A4R/QWm9aTPZevstUHL0j hBwA= X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Content-Transfer-Encoding: quoted-printable ARM32 KCFI violations currently show as generic "Oops - undefined instruction" errors, making debugging CFI failures difficult. Add a proper KCFI trap handler similar to the aarch64 implementation to provide clear CFI error messages. The GCC ARM32 KCFI implementation uses UDF instructions with a specific encoding pattern: - UDF instruction format: cccc 0111 1111 imm12 1111 imm4 - 16-bit immediate reconstructed from bits 19-8 and 3-0 - KCFI encoding: 0x8000 | (type_reg_num << 5) | (target_reg_num & 31) - Bit 15: KCFI trap identifier (0x8000) - Bits 9-5: Type ID register field (0x1F when unavailable) - Bits 4-0: Target address register number When the type register field is 0x1F (unavailable due to stack spilling), the handler walks back up to 5 preceding instructions to locate the movw/movt instruction pair that loads the 32-bit type ID, similar to x86 CFI trap reconstruction. The undef_hook pattern matching includes the KCFI bit requirement to ensure the handler is only called for KCFI violations, not arbitrary UDF instructions. Signed-off-by: Kees Cook --- Cc: "Russell King (Oracle)" Cc: Zhen Lei Cc: Arnd Bergmann Cc: "Micha=C5=82 Pecio" Cc: Sebastian Andrzej Siewior Cc: Sami Tolvanen Cc: --- arch/arm/kernel/traps.c | 102 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 102 insertions(+) diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c index afbd2ebe5c39..f2e4e18541e0 100644 --- a/arch/arm/kernel/traps.c +++ b/arch/arm/kernel/traps.c @@ -27,6 +27,7 @@ #include #include #include +#include =20 #include #include @@ -40,6 +41,7 @@ #include #include #include +#include =20 =20 static const char *handler[]=3D { @@ -685,6 +687,106 @@ asmlinkage int arm_syscall(int no, struct pt_regs *re= gs) return 0; } =20 +#ifdef CONFIG_CFI +/* + * ARM32 KCFI trap handler. + * UDF instruction format: cccc 0111 1111 imm12 1111 imm4 + * Immediate is reconstructed from bits 19-8 (12 bits) and bits 3-0 (4 bit= s) + * KCFI immediate encoding: 0x8000 | (0x1F << 5) | (target_reg_num & 31) + * - Bit 15: KCFI trap identifier (0x8000) + * - Bits 9-5: Type ID register field (0x1F when invalid due to stack spil= ling) + * - Bits 4-0: Target address register number + */ +#define CFI_UDF_KCFI_BIT BIT(15) /* KCFI identifier bit (0x8000) */ +#define CFI_UDF_IMM_TARGET GENMASK(4, 0) /* Target register (bits 4:0) */ +#define CFI_UDF_IMM_TYPE GENMASK(9, 5) /* Type register (bits 9:5) */ + +/* UDF base pattern with KCFI bit: cond=3D0xe, 0x7f, xxxx, 1xxx, 0xf, xxxx= */ +#define CFI_UDF_IMM_BASE 0xe7f008f0 +#define CFI_UDF_IMM_MASK 0xfff008f0 /* Mask for UDF + KCFI bit matching= */ + +static int cfi_udf_handler(struct pt_regs *regs, unsigned int instr) +{ + unsigned long target; + u32 target_reg, type_reg, type, imm16; + + /* Reconstruct 16-bit immediate from bits 19-8 and 3-0 */ + imm16 =3D ((instr >> 4) & 0xfff0) | (instr & 0x0f); + + target_reg =3D FIELD_GET(CFI_UDF_IMM_TARGET, imm16); + type_reg =3D FIELD_GET(CFI_UDF_IMM_TYPE, imm16); + + if (target_reg >=3D 16) { + pr_err("CFI UDF handler: invalid target register %u\n", target_reg); + return 1; + } + + target =3D regs->uregs[target_reg]; + + /* Type register field is set to all 1s (0x1F) when invalid due to stack = spilling */ + if (type_reg =3D=3D 0x1F) { + u32 *pc =3D (u32 *)regs->ARM_pc; + int i; + + type =3D 0; + /* Walk back up to 5 instructions to find movw/movt pair for type ID */ + for (i =3D 1; i <=3D 5; i++) { + u32 instr_prev =3D __mem_to_opcode_arm(pc[-i]); + + /* Check for movw: cccc 0011 0000 imm4 Rd imm12 */ + if ((instr_prev & 0x0ff00000) =3D=3D 0x03000000) { + u32 imm16 =3D ((instr_prev >> 4) & 0xf000) | (instr_prev & 0xfff); + type |=3D imm16; + } + /* Check for movt: cccc 0011 0100 imm4 Rd imm12 */ + else if ((instr_prev & 0x0ff00000) =3D=3D 0x03400000) { + u32 imm16 =3D ((instr_prev >> 4) & 0xf000) | (instr_prev & 0xfff); + type |=3D (imm16 << 16); + } + } + if (type =3D=3D 0) + pr_err("CFI UDF handler: failed to find type value\n"); + } else { + if (type_reg >=3D 16) { + pr_err("CFI UDF handler: invalid type register %u\n", type_reg); + return 1; + } + + type =3D regs->uregs[type_reg]; + } + + switch (report_cfi_failure(regs, regs->ARM_pc, &target, type)) { + case BUG_TRAP_TYPE_BUG: + die("Oops - CFI", regs, 0); + break; + case BUG_TRAP_TYPE_WARN: + break; + default: + return 1; + } + + /* Skip the UDF instruction */ + regs->ARM_pc +=3D 4; + return 0; +} + +static struct undef_hook cfi_undef_hook =3D { + .instr_mask =3D CFI_UDF_IMM_MASK, + .instr_val =3D CFI_UDF_IMM_BASE, + .cpsr_mask =3D 0, + .cpsr_val =3D 0, + .fn =3D cfi_udf_handler, +}; + +static int __init arm_cfi_init(void) +{ + register_undef_hook(&cfi_undef_hook); + return 0; +} + +early_initcall(arm_cfi_init); +#endif /* CONFIG_CFI */ + #ifdef CONFIG_TLS_REG_EMUL =20 /* --=20 2.34.1