From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8506C433F5 for ; Fri, 29 Apr 2022 22:53:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1381624AbiD2W4h (ORCPT ); Fri, 29 Apr 2022 18:56:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46600 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1381623AbiD2W4g (ORCPT ); Fri, 29 Apr 2022 18:56:36 -0400 Received: from mail-pg1-x535.google.com (mail-pg1-x535.google.com [IPv6:2607:f8b0:4864:20::535]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AA847B3C64 for ; Fri, 29 Apr 2022 15:53:14 -0700 (PDT) Received: by mail-pg1-x535.google.com with SMTP id q76so4485757pgq.10 for ; Fri, 29 Apr 2022 15:53:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:content-transfer-encoding:in-reply-to; bh=JrJ5Up6tIRRW5Mxs+/9PXH6BK6Q48YyALZseWmr3avA=; b=esBlUhglB9jCI2Ncth42eo2IMjtAy4YW4mTLvt3OzArSE3z90VovKH/o+BFbP3EssP JaCdFvrUUP7i40tzjcYF0lquuriKN1llnUUyvzwFwrGkI7j8MjvoA0RgJ17uWCOe5j77 +igUVwBVzTTxT7qU1IAL9BiZ2pi/eoIAUusFM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to; bh=JrJ5Up6tIRRW5Mxs+/9PXH6BK6Q48YyALZseWmr3avA=; b=Ox7qTvu13AaS927dStjmsEWVEh8IbgAt1aG3oioqbi0OC2w30QnDZO5O2SC1fw/1pv 8ZFY6hZFt77okHwchYtNq36x3qJ0k9ADgUqrsXH3z/66FlhVNkRHxgF4ObUS/29i8KDU cv/RPMGAftfCFDc1b2TwYGDiLcjci6+oZZr7GNSrHYBPdGYsaYoF/KBzqsOpMM+n1VvF sPQyHCzP3mGKPejCwGwUyZPliyBif4Dcm3CeK47MjimO2ZNbzLRmqIaG+HF64s9t28v3 Z7n7inlccYDH7DCsTIDOjlh/o3wfsu/QBgY92rhDUbfI2H5Yi8RkCk1hVPGujJ30qN8F Eqlg== X-Gm-Message-State: AOAM531DZP5gpWFB2x6UHgLkCTeteHeaQ3dxmDNIhhKUFsr19AaGwHvm n+RlPyda8dFDFRvQejkS0OmvAA== X-Google-Smtp-Source: ABdhPJxRF8uHZoIH/chjk/MDQLywii0fw4j6ZVHcIMULfWZu1kPW+qVQqzNUfgv+DrkE51BUzUaAxQ== X-Received: by 2002:a63:dd54:0:b0:3a8:f358:5b3f with SMTP id g20-20020a63dd54000000b003a8f3585b3fmr1141335pgj.97.1651272794165; Fri, 29 Apr 2022 15:53:14 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id c8-20020aa78808000000b0050dc7628172sm200051pfo.76.2022.04.29.15.53.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 29 Apr 2022 15:53:13 -0700 (PDT) Date: Fri, 29 Apr 2022 15:53:12 -0700 From: Kees Cook To: Peter Zijlstra , Mark Rutland , Josh Poimboeuf , Will Deacon , Catalin Marinas Cc: Sami Tolvanen , Nathan Chancellor , Nick Desaulniers , Joao Moreira , Sedat Dilek , Steven Rostedt , linux-kernel@vger.kernel.org, x86@kernel.org, linux-hardening@vger.kernel.org, linux-arm-kernel@lists.infradead.org, llvm@lists.linux.dev Subject: Re: [RFC PATCH 00/21] KCFI support Message-ID: <202204291545.47C6A97EA2@keescook> References: <20220429203644.2868448-1-samitolvanen@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20220429203644.2868448-1-samitolvanen@google.com> Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org On Fri, Apr 29, 2022 at 01:36:23PM -0700, Sami Tolvanen wrote: > KCFI is a proposed forward-edge control-flow integrity scheme for > Clang, which is more suitable for kernel use than the existing CFI > scheme used by CONFIG_CFI_CLANG. KCFI doesn't require LTO, doesn't > alter function references to point to a jump table, and won't break > function address equality. 🎉 :) > The latest LLVM patches are here: > > https://reviews.llvm.org/D119296 > https://reviews.llvm.org/D124211 > > [...] > To test this series, you'll need to compile your own Clang toolchain > with the patches linked above. You can also find the complete source > tree here: > > https://github.com/samitolvanen/llvm-project/commits/kcfi-rfc And note that this RFC is seeking to break a bit of a circular dependency with regard to the design of __builtin_kcfi_call_unchecked (D124211 above), as the implementation has gone around a few times in review within LLVM, and we want to make sure that kernel folks are okay with what was settled on. If there are no objections on the kernel side, then we can land the KCFI patches, as this is basically the only remaining blocker. -Kees -- Kees Cook From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 7091BC433F5 for ; Fri, 29 Apr 2022 22:54:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=MkcQHLfd0WW86hDY2PQdkGWbydiiXni8Cq7cY4Poob4=; b=3kK2PlxlV/sv6f C+U4Qxjf5u1YbBlMvAlsrP4sd/us48vneMJJMFORv1elMGvy7R48aKUVIsisJV+7VYJfJ/Q/dgYFM 6RODypDxcJQ/n23dgZsEeoTMhkgXHkejGnEcSVZCMezx+bSFQVjyMmgMQdHv0qI5fMM8LWjs/Fgsd ylcsGhL3QOt2VpBxlILp3gg1cUBuRd2ZbScQW43XsmC/f/t5exp2ntWPX6ySx9cbgQUpxp88soW0w /chxo0PC3Uh8d9MZ15JfzIFaL1C7wZbwalwQOhtyCRCg3cRGiT3pwzgI4y4niYkzG/VXrvoeLYzGj KjtE3umEKxJ1rcPxIfQA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nkZUE-00CyM0-RO; Fri, 29 Apr 2022 22:53:18 +0000 Received: from mail-pf1-x433.google.com ([2607:f8b0:4864:20::433]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1nkZUC-00CyLG-8t for linux-arm-kernel@lists.infradead.org; Fri, 29 Apr 2022 22:53:17 +0000 Received: by mail-pf1-x433.google.com with SMTP id t13so8076039pfg.2 for ; Fri, 29 Apr 2022 15:53:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:content-transfer-encoding:in-reply-to; bh=JrJ5Up6tIRRW5Mxs+/9PXH6BK6Q48YyALZseWmr3avA=; b=esBlUhglB9jCI2Ncth42eo2IMjtAy4YW4mTLvt3OzArSE3z90VovKH/o+BFbP3EssP JaCdFvrUUP7i40tzjcYF0lquuriKN1llnUUyvzwFwrGkI7j8MjvoA0RgJ17uWCOe5j77 +igUVwBVzTTxT7qU1IAL9BiZ2pi/eoIAUusFM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to; bh=JrJ5Up6tIRRW5Mxs+/9PXH6BK6Q48YyALZseWmr3avA=; b=KOBCAw8w6MNs0VhxsmMLev6d4qiydy/HgEHDi9+Sj6B9ZdAcPD/zH9WH4d4HoeJ/Yv UL4euUupkGrSvl4VUf/W3SzlF7shdV5ThXmCj6nSMzEEHgsQW1uNZJF8aAs64tqtet0R uEoVJxns3h/sW8gGGyP2LHes+9wZ4aRsJuRX2nGEXMmdgkS3EpfOK9+JJa8wP/jGXjZi PrSyFJXaicbjrakBiIvoOIXXbZT9agKZCggFN8J2VBWnjxEl2fCbhZy9voazX5mTV4oI JGG9HvQAMcq/NI1/FwyK/RPprOzo4zc/F7tl8EvpF6xstPfehJ3ZIwlj5gx8jafQ9WLO sdBQ== X-Gm-Message-State: AOAM530hX9W25a7mb8asq5eT1Lh7qXoHweJSIqIVfCqaUb4Uh6EbKNMN lIH/SfzU97TqABnx2Ub4JZIthQ== X-Google-Smtp-Source: ABdhPJxRF8uHZoIH/chjk/MDQLywii0fw4j6ZVHcIMULfWZu1kPW+qVQqzNUfgv+DrkE51BUzUaAxQ== X-Received: by 2002:a63:dd54:0:b0:3a8:f358:5b3f with SMTP id g20-20020a63dd54000000b003a8f3585b3fmr1141335pgj.97.1651272794165; Fri, 29 Apr 2022 15:53:14 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id c8-20020aa78808000000b0050dc7628172sm200051pfo.76.2022.04.29.15.53.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 29 Apr 2022 15:53:13 -0700 (PDT) Date: Fri, 29 Apr 2022 15:53:12 -0700 From: Kees Cook To: Peter Zijlstra , Mark Rutland , Josh Poimboeuf , Will Deacon , Catalin Marinas Cc: Sami Tolvanen , Nathan Chancellor , Nick Desaulniers , Joao Moreira , Sedat Dilek , Steven Rostedt , linux-kernel@vger.kernel.org, x86@kernel.org, linux-hardening@vger.kernel.org, linux-arm-kernel@lists.infradead.org, llvm@lists.linux.dev Subject: Re: [RFC PATCH 00/21] KCFI support Message-ID: <202204291545.47C6A97EA2@keescook> References: <20220429203644.2868448-1-samitolvanen@google.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20220429203644.2868448-1-samitolvanen@google.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220429_155316_370876_411886F2 X-CRM114-Status: GOOD ( 15.72 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org T24gRnJpLCBBcHIgMjksIDIwMjIgYXQgMDE6MzY6MjNQTSAtMDcwMCwgU2FtaSBUb2x2YW5lbiB3 cm90ZToKPiBLQ0ZJIGlzIGEgcHJvcG9zZWQgZm9yd2FyZC1lZGdlIGNvbnRyb2wtZmxvdyBpbnRl Z3JpdHkgc2NoZW1lIGZvcgo+IENsYW5nLCB3aGljaCBpcyBtb3JlIHN1aXRhYmxlIGZvciBrZXJu ZWwgdXNlIHRoYW4gdGhlIGV4aXN0aW5nIENGSQo+IHNjaGVtZSB1c2VkIGJ5IENPTkZJR19DRklf Q0xBTkcuIEtDRkkgZG9lc24ndCByZXF1aXJlIExUTywgZG9lc24ndAo+IGFsdGVyIGZ1bmN0aW9u IHJlZmVyZW5jZXMgdG8gcG9pbnQgdG8gYSBqdW1wIHRhYmxlLCBhbmQgd29uJ3QgYnJlYWsKPiBm dW5jdGlvbiBhZGRyZXNzIGVxdWFsaXR5LgoK8J+OiSA6KQoKPiBUaGUgbGF0ZXN0IExMVk0gcGF0 Y2hlcyBhcmUgaGVyZToKPiAKPiAgIGh0dHBzOi8vcmV2aWV3cy5sbHZtLm9yZy9EMTE5Mjk2Cj4g ICBodHRwczovL3Jldmlld3MubGx2bS5vcmcvRDEyNDIxMQo+IAo+IFsuLi5dCj4gVG8gdGVzdCB0 aGlzIHNlcmllcywgeW91J2xsIG5lZWQgdG8gY29tcGlsZSB5b3VyIG93biBDbGFuZyB0b29sY2hh aW4KPiB3aXRoIHRoZSBwYXRjaGVzIGxpbmtlZCBhYm92ZS4gWW91IGNhbiBhbHNvIGZpbmQgdGhl IGNvbXBsZXRlIHNvdXJjZQo+IHRyZWUgaGVyZToKPiAKPiAgIGh0dHBzOi8vZ2l0aHViLmNvbS9z YW1pdG9sdmFuZW4vbGx2bS1wcm9qZWN0L2NvbW1pdHMva2NmaS1yZmMKCkFuZCBub3RlIHRoYXQg dGhpcyBSRkMgaXMgc2Vla2luZyB0byBicmVhayBhIGJpdCBvZiBhIGNpcmN1bGFyIGRlcGVuZGVu Y3kKd2l0aCByZWdhcmQgdG8gdGhlIGRlc2lnbiBvZiBfX2J1aWx0aW5fa2NmaV9jYWxsX3VuY2hl Y2tlZCAoRDEyNDIxMQphYm92ZSksIGFzIHRoZSBpbXBsZW1lbnRhdGlvbiBoYXMgZ29uZSBhcm91 bmQgYSBmZXcgdGltZXMgaW4gcmV2aWV3IHdpdGhpbgpMTFZNLCBhbmQgd2Ugd2FudCB0byBtYWtl IHN1cmUgdGhhdCBrZXJuZWwgZm9sa3MgYXJlIG9rYXkgd2l0aCB3aGF0IHdhcwpzZXR0bGVkIG9u LiBJZiB0aGVyZSBhcmUgbm8gb2JqZWN0aW9ucyBvbiB0aGUga2VybmVsIHNpZGUsIHRoZW4gd2Ug Y2FuCmxhbmQgdGhlIEtDRkkgcGF0Y2hlcywgYXMgdGhpcyBpcyBiYXNpY2FsbHkgdGhlIG9ubHkg cmVtYWluaW5nIGJsb2NrZXIuCgotS2VlcwoKLS0gCktlZXMgQ29vawoKX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KbGludXgtYXJtLWtlcm5lbCBtYWlsaW5n IGxpc3QKbGludXgtYXJtLWtlcm5lbEBsaXN0cy5pbmZyYWRlYWQub3JnCmh0dHA6Ly9saXN0cy5p bmZyYWRlYWQub3JnL21haWxtYW4vbGlzdGluZm8vbGludXgtYXJtLWtlcm5lbAo=