[RFC PATCH 0/7] Introduce Kernel Control Flow Integrity ABI [PR107048]

[Kees Cook <kees@kernel.org>]

Hi!

Repeating the start of the 3rd (core kcfi) patch's commit log:

    This series implements the Linux Kernel Control Flow Integrity ABI,
    which provides a function prototype based forward edge control flow
    integrity protection by instrumenting every indirect call to check for
    a hash value before the target function address. If the hash at the call
    site and the hash at the target do not match, execution will trap.

    Just to set expectations, this is an RFC because this is my first time
    working on most of the affected areas in GCC, and it is likely I have
    missed really obvious stuff, or gone about doing things in very wrong
    ways. I tried to find the best way to do stuff, but I was left with many
    questions. :) All that said, this works for x86_64 and aarch64 Linux
    kernels. (I have implemented riscv64 as well, but I lack a viable test
    environment -- I am working on this still.)

I tried to get comments and code style into reasonable shape so as
to not distract horribly from the actual implementation details, but
I suspect I'm still missing some correct style in places. The commit
logs are not in proper ChangeLog format either. I am planning to get
that sorted once this series has gotten some review and I've actually
got code in the right places.

I gave up on trying to keep the testsuite files wrapped at 80
characters. It seemed much less readable, but I will defer to whatever
folks want to see there. :)

Thanks!

-Kees

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107048
https://github.com/KSPP/linux/issues/369

Kees Cook (7):
  sanitizer: Expand sanitizer flag from 32-bit to 64-bit
  mangle: Introduce C typeinfo mangling API
  kcfi: Add core Kernel Control Flow Integrity infrastructure
  x86: Add x86_64 Kernel Control Flow Integrity implementation
  aarch64: Add AArch64 Kernel Control Flow Integrity implementation
  riscv: Add RISC-V Kernel Control Flow Integrity implementation
  kcfi: Add regression test suite

 gcc/Makefile.in                               |   2 +
 gcc/asan.h                                    |   4 +-
 gcc/c-family/c-common.h                       |   2 +-
 gcc/config/aarch64/aarch64-protos.h           |   4 +
 gcc/config/i386/i386-protos.h                 |   4 +
 gcc/config/riscv/riscv-protos.h               |   1 +
 gcc/flag-types.h                              |  66 +-
 gcc/kcfi.h                                    |  85 ++
 gcc/mangle.h                                  |  29 +
 gcc/opts.h                                    |   8 +-
 gcc/selftest.h                                |   1 +
 gcc/tree-pass.h                               |   1 +
 gcc/testsuite/gcc.dg/kcfi/kcfi-aarch64-esr.c  |  36 +
 gcc/testsuite/gcc.dg/kcfi/kcfi-adjacency.c    |  83 ++
 gcc/testsuite/gcc.dg/kcfi/kcfi-basics.c       |  83 ++
 gcc/testsuite/gcc.dg/kcfi/kcfi-call-sharing.c |  75 ++
 .../gcc.dg/kcfi/kcfi-cold-partition.c         | 133 +++
 .../gcc.dg/kcfi/kcfi-complex-addressing.c     | 116 +++
 .../gcc.dg/kcfi/kcfi-insn-sequence.c          |  42 +
 .../gcc.dg/kcfi/kcfi-ipa-robustness.c         |  54 ++
 .../gcc.dg/kcfi/kcfi-no-sanitize-inline.c     |  96 ++
 gcc/testsuite/gcc.dg/kcfi/kcfi-no-sanitize.c  |  39 +
 .../gcc.dg/kcfi/kcfi-offset-validation.c      |  41 +
 .../gcc.dg/kcfi/kcfi-patchable-basic.c        |  54 ++
 .../gcc.dg/kcfi/kcfi-patchable-entry-only.c   |  36 +
 .../gcc.dg/kcfi/kcfi-patchable-large.c        |  47 +
 .../gcc.dg/kcfi/kcfi-patchable-medium.c       |  52 ++
 .../gcc.dg/kcfi/kcfi-patchable-none.c         |  18 +
 .../gcc.dg/kcfi/kcfi-patchable-prefix-only.c  |  48 +
 .../gcc.dg/kcfi/kcfi-pic-addressing.c         |  98 ++
 gcc/testsuite/gcc.dg/kcfi/kcfi-tail-calls.c   | 111 +++
 gcc/testsuite/gcc.dg/kcfi/kcfi-trap-section.c |  56 ++
 .../gcc.dg/kcfi/kcfi-type-mangling.c          | 864 ++++++++++++++++++
 gcc/c-family/c-attribs.cc                     |  19 +-
 gcc/c/c-parser.cc                             |   4 +-
 gcc/cfgcleanup.cc                             |  20 +
 gcc/cfgexpand.cc                              |  61 ++
 gcc/combine.cc                                |   1 +
 gcc/common.opt                                |   2 +-
 gcc/config/aarch64/aarch64.cc                 | 112 +++
 gcc/config/aarch64/aarch64.md                 | 137 +++
 gcc/config/i386/i386-options.cc               |   3 +
 gcc/config/i386/i386.cc                       | 128 +++
 gcc/config/i386/i386.md                       | 144 +++
 gcc/config/riscv/riscv.cc                     | 157 ++++
 gcc/config/riscv/riscv.md                     |  49 +
 gcc/cp/typeck.cc                              |   2 +-
 gcc/d/d-attribs.cc                            |   8 +-
 gcc/doc/invoke.texi                           |  76 ++
 gcc/dwarf2asm.cc                              |   2 +-
 gcc/emit-rtl.cc                               |   1 +
 gcc/kcfi.cc                                   | 783 ++++++++++++++++
 gcc/mangle.cc                                 | 548 +++++++++++
 gcc/opts.cc                                   |  17 +-
 gcc/passes.cc                                 |   1 +
 gcc/passes.def                                |   3 +
 gcc/recog.cc                                  |   1 +
 gcc/reg-notes.def                             |   6 +
 gcc/targhooks.cc                              |  50 +-
 gcc/testsuite/gcc.dg/kcfi/kcfi.exp            |  36 +
 gcc/toplev.cc                                 |   8 +
 gcc/varasm.cc                                 |  18 +
 62 files changed, 4721 insertions(+), 65 deletions(-)
 create mode 100644 gcc/kcfi.h
 create mode 100644 gcc/mangle.h
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-aarch64-esr.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-adjacency.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-basics.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-call-sharing.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-cold-partition.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-complex-addressing.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-insn-sequence.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-ipa-robustness.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-no-sanitize-inline.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-no-sanitize.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-offset-validation.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-basic.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-entry-only.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-large.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-medium.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-none.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-prefix-only.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-pic-addressing.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-tail-calls.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-trap-section.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-type-mangling.c
 create mode 100644 gcc/kcfi.cc
 create mode 100644 gcc/mangle.cc
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi.exp

-- 
2.34.1