iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cfi: Use __builtin_function_start

Browse Source 
Clang 14 added support for the __builtin_function_start function,
which allows us to implement the function_nocfi macro without
architecture-specific inline assembly and in a way that also works
with static initializers.

Change CONFIG_CFI_CLANG to depend on Clang >= 14, define
function_nocfi using __builtin_function_start, and remove the arm64
inline assembly implementation.

Link: ec2e26eaf6
Link: https://github.com/ClangBuiltLinux/linux/issues/1353
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Will Deacon <will@kernel.org> # arm64
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20220405221618.633743-1-samitolvanen@google.com
This commit is contained in:
Sami Tolvanen 2022-04-05 15:16:18 -07:00 committed by Kees Cook
parent 75c1182e18
commit e6f3b3c9c1
3 changed files with 11 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
arch/Kconfig
View File

@ -723,10 +723,7 @@ config ARCH_SUPPORTS_CFI_CLANG
config CFI_CLANG config CFI_CLANG
bool "Use Clang's Control Flow Integrity (CFI)" bool "Use Clang's Control Flow Integrity (CFI)"
depends on LTO_CLANG && ARCH_SUPPORTS_CFI_CLANG depends on LTO_CLANG && ARCH_SUPPORTS_CFI_CLANG
# Clang >= 12: depends on CLANG_VERSION >= 140000
# - https://bugs.llvm.org/show_bug.cgi?id=46258
# - https://bugs.llvm.org/show_bug.cgi?id=47479
depends on CLANG_VERSION >= 120000
select KALLSYMS select KALLSYMS
help help
This option enables Clang’s forward-edge Control Flow Integrity This option enables Clang’s forward-edge Control Flow Integrity

16
arch/arm64/include/asm/compiler.h
View File

@ -23,20 +23,4 @@
#define __builtin_return_address(val) \ #define __builtin_return_address(val) \
(void *)(ptrauth_clear_pac((unsigned long)__builtin_return_address(val))) (void *)(ptrauth_clear_pac((unsigned long)__builtin_return_address(val)))
#ifdef CONFIG_CFI_CLANG
/*
* With CONFIG_CFI_CLANG, the compiler replaces function address
* references with the address of the function's CFI jump table
* entry. The function_nocfi macro always returns the address of the
* actual function instead.
*/
#define function_nocfi(x) ({ \
void *addr; \
asm("adrp %0, " __stringify(x) "\n\t" \
"add %0, %0, :lo12:" __stringify(x) \
: "=r" (addr)); \
addr; \
})
#endif
#endif /* __ASM_COMPILER_H */ #endif /* __ASM_COMPILER_H */

10
include/linux/compiler-clang.h
View File

@ -69,6 +69,16 @@
#define __nocfi __attribute__((__no_sanitize__("cfi"))) #define __nocfi __attribute__((__no_sanitize__("cfi")))
#define __cficanonical __attribute__((__cfi_canonical_jump_table__)) #define __cficanonical __attribute__((__cfi_canonical_jump_table__))
#if defined(CONFIG_CFI_CLANG)
/*
* With CONFIG_CFI_CLANG, the compiler replaces function address
* references with the address of the function's CFI jump table
* entry. The function_nocfi macro always returns the address of the
* actual function instead.
*/
#define function_nocfi(x) __builtin_function_start(x)
#endif
/* /*
* Turn individual warnings and errors on and off locally, depending * Turn individual warnings and errors on and off locally, depending
* on version. * on version.