From: Kees Cook <kees@kernel.org>
To: Andrea Pinski <andrew.pinski@oss.qualcomm.com>
Cc: Kees Cook <kees@kernel.org>, Richard Biener <rguenther@suse.de>,
Jeffrey Law <jefflaw@qti.qualcomm.com>,
Joseph Myers <josmyers@redhat.com>,
Jakub Jelinek <jakub@redhat.com>,
Martin Uecker <uecker@tugraz.at>,
Peter Zijlstra <peterz@infradead.org>,
Ard Biesheuvel <ardb@kernel.org>, Jan Hubicka <hubicka@ucw.cz>,
Uros Bizjak <ubizjak@gmail.com>,
Richard Earnshaw <richard.earnshaw@arm.com>,
Richard Sandiford <richard.sandiford@arm.com>,
Marcus Shawcroft <marcus.shawcroft@arm.com>,
Kyrylo Tkachov <kyrylo.tkachov@arm.com>,
Kito Cheng <kito.cheng@gmail.com>,
Palmer Dabbelt <palmer@dabbelt.com>,
Andrew Waterman <andrew@sifive.com>,
Jim Wilson <jim.wilson.gcc@gmail.com>,
Juergen Christ <jchrist@linux.ibm.com>,
Dan Li <ashimida.1990@gmail.com>,
Sami Tolvanen <samitolvanen@google.com>,
Ramon de C Valle <rcvalle@google.com>,
Joao Moreira <joao@overdrivepizza.com>,
Nathan Chancellor <nathan@kernel.org>,
Bill Wendling <morbo@google.com>,
"Osterlund Sebastian" <sebastian.osterlund@intel.com>,
"Constable Scott D" <scott.d.constable@intel.com>,
gcc-patches@gcc.gnu.org, linux-hardening@vger.kernel.org
Subject: [PATCH v17 0/7] Introduce Kernel Control Flow Integrity ABI [PR107048]
Date: Mon, 5 Oct 2026 08:40:29 -0700 [thread overview]
Message-ID: <20261005154028.out.839-kees@kernel.org> (raw)
Hi,
This series implements[1][2] the Linux Kernel Control Flow Integrity
ABI, which provides a function prototype based forward edge control flow
integrity protection by instrumenting every indirect call to check for
a hash value before the target function address. If the hash at the call
site and the hash at the target do not match, execution will trap.
Regarding the recent AI policy[3], I appear to be compliant, though the
use of the Assisted-by tag doesn't distinguish between the human code and
the AI-assisted work in a single patch. I used LLMs to help me research
the GCC codebase, debug crashes, minimize PoCs, generate test cases,
construct and run my multiple architecture build and test orchestration,
and perform code reviews. Based on the feedback from Cauldron[4], I've
included the tag on every patch that carries tests.
As before, I'd really like to be in a position where more people can
test with GCC snapshots, etc, and there can be some follow-up patches
if(when) people find issues. It sounded like Andrea and Jeff were going
to hopefully get this landed in the next month? *cross fingers*
Thanks!
-Kees
Changes since v16[5]:
- Rebase to latest master.
- Use the target's long double mangling (from targetm.mangle_type)
in the typeinfo selftest and gcc.dg test instead of hard-coding "e".
(Reported by Juergen Christ; fix suggested by Andrea Pinski and Jakub
Jelinek.)
- RISC-V: use the pointer mode (:P) for the KCFI call patterns' address
operands, which silences genrecog's "missing mode" warnings without
hard-coding DImode. (Follow-up to Jeff Law's v2 and v12 feedback.)
- ARM: fix a scan-assembler-not in kcfi-call-sharing.c that could never
match, and make it also catch a single call using the wrong type ID.
- Require the lto effective target in kcfi-lto-offset.c, so it is
UNSUPPORTED rather than failing when GCC is built without LTO.
- AArch64: drop an unused kcfi_emit_trap_with_section prototype.
- AArch64: give the KCFI call patterns their real length (28 bytes, up
to 36 for sibcalls with SLS hardening). They were counted as 4 bytes,
so a conditional branch over many KCFI calls could be out of range.
- Use a volatile function pointer in kcfi-trap-encoding.c so its call
stays indirect (and KCFI-checked) when the testsuite is run at -O2.
- Don't mangle top-level qualifiers on pointer parameters ("int *const
p", "int *restrict p") or on anonymous-typedef parameters into the
type-id: they are not part of the function type, and Clang drops them.
Such functions trapped when called through compatible pointer types
like "void (*)(int *)". This changes their type-ids to match Clang.
- Add mangling tests for bool and for restrict below the top level
(with the qualifier order), with expected strings checked against
Clang.
- Fix tail merging combining indirect calls that get different KCFI
checks: calls through members of a union share one pointer value.
[1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107048
[2] https://github.com/KSPP/linux/issues/369
[3] https://gcc.gnu.org/ai-policy.html
[4] https://outflux.net/slides/2026/cauldron/gcc-kcfi.pdf
[5] https://inbox.sourceware.org/gcc-patches/20260902164928.stay.466-kees@kernel.org/
Kees Cook (7):
kcfi: Introduce KCFI typeinfo mangling API
kcfi: Add core Kernel Control Flow Integrity infrastructure
kcfi: Add regression test suite
x86: Add x86_64 Kernel Control Flow Integrity implementation
aarch64: Add AArch64 Kernel Control Flow Integrity implementation
arm: Add ARM 32-bit Kernel Control Flow Integrity implementation
riscv: Add RISC-V Kernel Control Flow Integrity implementation
gcc/kcfi.h | 71 ++
gcc/kcfi.cc | 650 ++++++++++
gcc/config/aarch64/aarch64-protos.h | 3 +
gcc/config/arm/arm-protos.h | 4 +
gcc/config/i386/i386-protos.h | 2 +-
gcc/config/i386/i386.h | 3 +-
gcc/config/riscv/riscv-protos.h | 3 +
gcc/config/aarch64/aarch64.md | 66 +
gcc/config/arm/arm.md | 62 +
gcc/config/i386/i386.md | 63 +-
gcc/config/riscv/riscv.md | 76 +-
gcc/config/aarch64/aarch64.cc | 127 ++
gcc/config/arm/arm.cc | 217 +++-
gcc/config/i386/i386-expand.cc | 28 +-
gcc/config/i386/i386.cc | 210 +++-
gcc/config/riscv/riscv.cc | 199 +++
gcc/doc/extend.texi | 141 +++
gcc/doc/invoke.texi | 141 +++
gcc/doc/tm.texi | 32 +
.../gcc.dg/kcfi-compat/kcfi-compat.exp | 87 ++
gcc/testsuite/gcc.dg/kcfi/kcfi.exp | 51 +
gcc/testsuite/lib/target-supports.exp | 14 +
.../gcc.dg/builtin-typeinfo-bitint.c | 82 ++
gcc/testsuite/gcc.dg/builtin-typeinfo-c23.c | 72 ++
.../gcc.dg/builtin-typeinfo-errors.c | 28 +
gcc/testsuite/gcc.dg/builtin-typeinfo-fixed.c | 58 +
gcc/testsuite/gcc.dg/builtin-typeinfo.c | 429 +++++++
.../gcc.dg/kcfi-compat/kcfi-indirect-1.h | 26 +
.../gcc.dg/kcfi-compat/kcfi-indirect-1_main.c | 22 +
.../gcc.dg/kcfi-compat/kcfi-indirect-1_x.c | 43 +
.../gcc.dg/kcfi-compat/kcfi-indirect-1_y.c | 40 +
.../gcc.dg/kcfi/kcfi-aarch64-branch-range.c | 29 +
.../gcc.dg/kcfi/kcfi-aarch64-ilp32.c | 7 +
.../kcfi/kcfi-aarch64-insn-length-sls.c | 32 +
.../gcc.dg/kcfi/kcfi-aarch64-insn-length.c | 38 +
gcc/testsuite/gcc.dg/kcfi/kcfi-adjacency.c | 142 +++
gcc/testsuite/gcc.dg/kcfi/kcfi-arm-fixed-ip.c | 15 +
.../gcc.dg/kcfi/kcfi-arm-fixed-r12.c | 15 +
.../gcc.dg/kcfi/kcfi-arm-sibcall-r3.c | 50 +
gcc/testsuite/gcc.dg/kcfi/kcfi-asm-name.c | 16 +
gcc/testsuite/gcc.dg/kcfi/kcfi-basics.c | 168 +++
gcc/testsuite/gcc.dg/kcfi/kcfi-call-sharing.c | 95 ++
.../gcc.dg/kcfi/kcfi-cold-partition.c | 126 ++
.../gcc.dg/kcfi/kcfi-complex-addressing.c | 206 ++++
.../gcc.dg/kcfi/kcfi-direct-call-shapes.c | 36 +
.../gcc.dg/kcfi/kcfi-ipa-robustness.c | 54 +
gcc/testsuite/gcc.dg/kcfi/kcfi-lto-offset.c | 27 +
.../gcc.dg/kcfi/kcfi-move-preservation.c | 138 +++
.../gcc.dg/kcfi/kcfi-no-sanitize-inline.c | 100 ++
gcc/testsuite/gcc.dg/kcfi/kcfi-no-sanitize.c | 41 +
.../gcc.dg/kcfi/kcfi-offset-validation.c | 40 +
.../gcc.dg/kcfi/kcfi-patchable-entry-only.c | 64 +
.../gcc.dg/kcfi/kcfi-patchable-incompatible.c | 7 +
.../gcc.dg/kcfi/kcfi-patchable-large.c | 57 +
.../gcc.dg/kcfi/kcfi-patchable-medium.c | 63 +
.../gcc.dg/kcfi/kcfi-patchable-prefix-only.c | 64 +
.../gcc.dg/kcfi/kcfi-qualified-params.c | 58 +
gcc/testsuite/gcc.dg/kcfi/kcfi-riscv-32bit.c | 7 +
.../gcc.dg/kcfi/kcfi-riscv-fixed-t1.c | 7 +
.../gcc.dg/kcfi/kcfi-riscv-fixed-t2.c | 7 +
.../gcc.dg/kcfi/kcfi-riscv-fixed-t3.c | 7 +
gcc/testsuite/gcc.dg/kcfi/kcfi-runtime.c | 276 +++++
gcc/testsuite/gcc.dg/kcfi/kcfi-tail-calls.c | 144 +++
.../gcc.dg/kcfi/kcfi-tail-merge-run.c | 54 +
gcc/testsuite/gcc.dg/kcfi/kcfi-tail-merge.c | 36 +
.../gcc.dg/kcfi/kcfi-trap-encoding.c | 89 ++
.../gcc.dg/kcfi/kcfi-trap-section-per-func.c | 23 +
gcc/testsuite/gcc.dg/kcfi/kcfi-trap-section.c | 29 +
gcc/testsuite/gcc.dg/kcfi/kcfi-x86-32bit.c | 7 +
gcc/testsuite/gcc.dg/kcfi/kcfi-x86-arity.c | 93 ++
.../gcc.dg/kcfi/kcfi-x86-endbr-collision.c | 55 +
.../gcc.dg/kcfi/kcfi-x86-fixed-r10.c | 7 +
.../gcc.dg/kcfi/kcfi-x86-fixed-r11.c | 7 +
.../gcc.dg/kcfi/kcfi-x86-retpoline-r11.c | 40 +
gcc/testsuite/gcc.dg/pch/kcfi-1.c | 50 +
gcc/testsuite/gcc.dg/pch/kcfi-1.hs | 20 +
gcc/Makefile.in | 3 +
gcc/c-family/c-common.h | 1 +
gcc/flag-types.h | 2 +
gcc/gimple.h | 22 +
gcc/kcfi-typeinfo.h | 31 +
gcc/selftest.h | 1 +
gcc/c-family/c-attribs.cc | 17 +-
gcc/c-family/c-common.cc | 2 +
gcc/c/c-parser.cc | 72 ++
gcc/common.opt | 8 +
gcc/df-scan.cc | 7 +
gcc/doc/tm.texi.in | 12 +
gcc/final.cc | 17 +
gcc/kcfi-typeinfo.cc | 1071 +++++++++++++++++
gcc/opts.cc | 5 +-
gcc/rtl.def | 6 +
gcc/rtlanal.cc | 5 +
gcc/selftest-run-tests.cc | 1 +
gcc/target.def | 39 +
gcc/toplev.cc | 12 +
gcc/tree-inline.cc | 10 +
gcc/tree-ssa-tail-merge.cc | 6 +
gcc/varasm.cc | 44 +-
99 files changed, 7034 insertions(+), 56 deletions(-)
create mode 100644 gcc/kcfi.h
create mode 100644 gcc/kcfi.cc
create mode 100644 gcc/testsuite/gcc.dg/kcfi-compat/kcfi-compat.exp
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi.exp
create mode 100644 gcc/testsuite/gcc.dg/builtin-typeinfo-bitint.c
create mode 100644 gcc/testsuite/gcc.dg/builtin-typeinfo-c23.c
create mode 100644 gcc/testsuite/gcc.dg/builtin-typeinfo-errors.c
create mode 100644 gcc/testsuite/gcc.dg/builtin-typeinfo-fixed.c
create mode 100644 gcc/testsuite/gcc.dg/builtin-typeinfo.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi-compat/kcfi-indirect-1.h
create mode 100644 gcc/testsuite/gcc.dg/kcfi-compat/kcfi-indirect-1_main.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi-compat/kcfi-indirect-1_x.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi-compat/kcfi-indirect-1_y.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-aarch64-branch-range.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-aarch64-ilp32.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-aarch64-insn-length-sls.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-aarch64-insn-length.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-adjacency.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-arm-fixed-ip.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-arm-fixed-r12.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-arm-sibcall-r3.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-asm-name.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-basics.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-call-sharing.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-cold-partition.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-complex-addressing.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-direct-call-shapes.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-ipa-robustness.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-lto-offset.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-move-preservation.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-no-sanitize-inline.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-no-sanitize.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-offset-validation.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-entry-only.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-incompatible.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-large.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-medium.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-prefix-only.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-qualified-params.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-riscv-32bit.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-riscv-fixed-t1.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-riscv-fixed-t2.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-riscv-fixed-t3.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-runtime.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-tail-calls.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-tail-merge-run.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-tail-merge.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-trap-encoding.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-trap-section-per-func.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-trap-section.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-x86-32bit.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-x86-arity.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-x86-endbr-collision.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-x86-fixed-r10.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-x86-fixed-r11.c
create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-x86-retpoline-r11.c
create mode 100644 gcc/testsuite/gcc.dg/pch/kcfi-1.c
create mode 100644 gcc/testsuite/gcc.dg/pch/kcfi-1.hs
create mode 100644 gcc/kcfi-typeinfo.h
create mode 100644 gcc/kcfi-typeinfo.cc
--
2.55.0
next reply other threads:[~2026-10-05 15:40 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-05 15:40 Kees Cook [this message]
2026-10-05 15:40 ` [PATCH v17 1/7] kcfi: Introduce KCFI typeinfo mangling API Kees Cook
2026-10-05 15:40 ` [PATCH v17 2/7] kcfi: Add core Kernel Control Flow Integrity infrastructure Kees Cook
2026-10-05 15:40 ` [PATCH v17 3/7] kcfi: Add regression test suite Kees Cook
2026-10-05 15:40 ` [PATCH v17 4/7] x86: Add x86_64 Kernel Control Flow Integrity implementation Kees Cook
2026-10-05 15:40 ` [PATCH v17 5/7] aarch64: Add AArch64 " Kees Cook
2026-10-05 15:40 ` [PATCH v17 6/7] arm: Add ARM 32-bit " Kees Cook
2026-10-05 15:40 ` [PATCH v17 7/7] riscv: Add RISC-V " Kees Cook
2026-10-09 4:39 ` Jeff Law
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261005154028.out.839-kees@kernel.org \
--to=kees@kernel.org \
--cc=andrew.pinski@oss.qualcomm.com \
--cc=andrew@sifive.com \
--cc=ardb@kernel.org \
--cc=ashimida.1990@gmail.com \
--cc=gcc-patches@gcc.gnu.org \
--cc=hubicka@ucw.cz \
--cc=jakub@redhat.com \
--cc=jchrist@linux.ibm.com \
--cc=jefflaw@qti.qualcomm.com \
--cc=jim.wilson.gcc@gmail.com \
--cc=joao@overdrivepizza.com \
--cc=josmyers@redhat.com \
--cc=kito.cheng@gmail.com \
--cc=kyrylo.tkachov@arm.com \
--cc=linux-hardening@vger.kernel.org \
--cc=marcus.shawcroft@arm.com \
--cc=morbo@google.com \
--cc=nathan@kernel.org \
--cc=palmer@dabbelt.com \
--cc=peterz@infradead.org \
--cc=rcvalle@google.com \
--cc=rguenther@suse.de \
--cc=richard.earnshaw@arm.com \
--cc=richard.sandiford@arm.com \
--cc=samitolvanen@google.com \
--cc=scott.d.constable@intel.com \
--cc=sebastian.osterlund@intel.com \
--cc=ubizjak@gmail.com \
--cc=uecker@tugraz.at \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox