mbox series

[v5,00/22] KCFI support

Message ID 20220908215504.3686827-1-samitolvanen@google.com (mailing list archive)
Headers show
Series KCFI support | expand

Message

Sami Tolvanen Sept. 8, 2022, 9:54 p.m. UTC
KCFI is a forward-edge control-flow integrity scheme in the upcoming
Clang 16 release, which is more suitable for kernel use than the
existing CFI scheme used by CONFIG_CFI_CLANG. KCFI doesn't require
LTO, doesn't alter function references to point to a jump table, and
won't break function address equality.

This series replaces the current arm64 CFI implementation with KCFI
and adds support for x86_64.

KCFI requires assembly functions that are indirectly called from C
code to be annotated with type identifiers. As type information is
only available in C, the compiler emits expected type identifiers
into the symbol table, so they can be referenced from assembly
without having to hardcode type hashes. Patch 6 adds helper macros
for annotating functions, and patches 9 and 20 add annotations.

In case of a type mismatch, KCFI always traps. To support error
handling, the compiler generates a .kcfi_traps section for x86_64,
which contains the locations of each trap, and for arm64, encodes
the necessary register information to the ESR. Patches 10 and 22 add
arch-specific error handlers.

To test this series, you'll need a ToT Clang toolchain. The series
is also available pn GitHub:

  https://github.com/samitolvanen/linux/commits/kcfi-v5

---
Changes in v5:
- Cleaned up the manual CFI type annotation macros, and ensured
  the IBT/BTI landing pads are correctly emitted.

- Added a patch to fix an objtool issue in elf_update_symbol, which
  could end up marking __kcfi_typeid_ SHN_ABS symbols undefined.

Changes in v4:
- Dropped the RFC now that Clang support is merged.

- Changed the x86_64 function preamble to match the the preamble
  generated by the compiler, and fixed a code generation issue,
  which Peter pointed out.

- Added a patch to fix arm64 psci_initcall_t type mismatch based
  on Mark's suggestion.

Changes in v3:
- Merged the patches that split CC_FLAGS_CFI from CC_FLAGS_LTO.

- Dropped the psci_initcall_t patch as Mark volunteered to send a
  patch for this. Note that this patch is still needed to boot a
  CFI kernel on certain arm64 systems:
  https://lore.kernel.org/lkml/YoNhKaTT3EDukxXY@FVFF77S0Q05N/

- Added a patch to remove the now unnecessary workarounds with
  CFI+ThinLTO in kallsyms.

- Added an lkdtm patch to ensure the test actually generates an
  indirect call.

- Changed report_cfi_failure to clearly indicate if we failed to
  decode target address.

- Switched to relative offsets for .kcfi_traps.

- On x86_64, moved CFI error handling from traps.c to cfi.c, and
  as we only call memcpy indirectly w/ CONFIG_MODULES, ensured that
  the compiler emits __kcfi_typeid_memcpy also without modules.

- On x86_64, added a check for the cmpl REX prefix to handle the
  case where the compiler might not use r8-r15 registers for the
  call target.

- On the compiler side, ensured that on x86_64 calls are emitted
  immediately after the CFI check, fixed the __cfi_ preamble
  linkage, and changed the compiler to emit relative offsets in
  .kcfi_traps.

Changes in v2:
- Changed the compiler patch to encode arm64 target and type details
  in the ESR, and updated the kernel error handling patch accordingly.

- Changed the compiler patch to embed the x86_64 type hash in a valid
  instruction to avoid special casing objtool instruction decoding, and
  added a __cfi_ symbol for the preamble. Changed the kernel error
  handling and manual type annotations to match.

- Dropped the .kcfi_types section as that’s no longer needed by
  objtool, and changed the objtool patch to simply ignore the __cfi_
  preambles falling through.

- Dropped the .kcfi_traps section on arm64 as it’s no longer needed,
  and moved the trap look-up code behind CONFIG_ARCH_USES_CFI_TRAPS,
  which is selected only for x86_64.

- Dropped __nocfi attributes from arm64 code where CFI was disabled
  due to address space confusion issues, and added type annotations to
  relevant assembly functions.

- Dropped __nocfi from __init.


Sami Tolvanen (22):
  treewide: Filter out CC_FLAGS_CFI
  scripts/kallsyms: Ignore __kcfi_typeid_
  cfi: Remove CONFIG_CFI_CLANG_SHADOW
  cfi: Drop __CFI_ADDRESSABLE
  cfi: Switch to -fsanitize=kcfi
  cfi: Add type helper macros
  lkdtm: Emit an indirect call for CFI tests
  psci: Fix the function type for psci_initcall_t
  arm64: Add types to indirect called assembly functions
  arm64: Add CFI error handling
  arm64: Drop unneeded __nocfi attributes
  init: Drop __nocfi from __init
  treewide: Drop function_nocfi
  treewide: Drop WARN_ON_FUNCTION_MISMATCH
  treewide: Drop __cficanonical
  objtool: Preserve special st_shndx indexes in elf_update_symbol
  objtool: Disable CFI warnings
  kallsyms: Drop CONFIG_CFI_CLANG workarounds
  x86/tools/relocs: Ignore __kcfi_typeid_ relocations
  x86: Add types to indirectly called assembly functions
  x86/purgatory: Disable CFI
  x86: Add support for CONFIG_CFI_CLANG

 Makefile                                  |  13 +-
 arch/Kconfig                              |  18 +-
 arch/arm64/crypto/ghash-ce-core.S         |   5 +-
 arch/arm64/crypto/sm3-ce-core.S           |   3 +-
 arch/arm64/include/asm/brk-imm.h          |   6 +
 arch/arm64/include/asm/ftrace.h           |   2 +-
 arch/arm64/include/asm/linkage.h          |   4 +
 arch/arm64/include/asm/mmu_context.h      |   4 +-
 arch/arm64/kernel/acpi_parking_protocol.c |   2 +-
 arch/arm64/kernel/alternative.c           |   2 +-
 arch/arm64/kernel/cpu-reset.S             |   5 +-
 arch/arm64/kernel/cpufeature.c            |   4 +-
 arch/arm64/kernel/ftrace.c                |   2 +-
 arch/arm64/kernel/machine_kexec.c         |   2 +-
 arch/arm64/kernel/psci.c                  |   2 +-
 arch/arm64/kernel/smp_spin_table.c        |   2 +-
 arch/arm64/kernel/traps.c                 |  47 ++-
 arch/arm64/kernel/vdso/Makefile           |   3 +-
 arch/arm64/mm/proc.S                      |   5 +-
 arch/x86/Kconfig                          |   2 +
 arch/x86/crypto/blowfish-x86_64-asm_64.S  |   5 +-
 arch/x86/entry/vdso/Makefile              |   3 +-
 arch/x86/include/asm/cfi.h                |  22 ++
 arch/x86/include/asm/linkage.h            |  12 +
 arch/x86/kernel/Makefile                  |   2 +
 arch/x86/kernel/cfi.c                     |  86 ++++++
 arch/x86/kernel/traps.c                   |   4 +-
 arch/x86/lib/memcpy_64.S                  |   3 +-
 arch/x86/purgatory/Makefile               |   4 +
 arch/x86/tools/relocs.c                   |   1 +
 drivers/firmware/efi/libstub/Makefile     |   2 +
 drivers/firmware/psci/psci.c              |  12 +-
 drivers/misc/lkdtm/cfi.c                  |  15 +-
 drivers/misc/lkdtm/usercopy.c             |   2 +-
 include/asm-generic/bug.h                 |  16 -
 include/asm-generic/vmlinux.lds.h         |  37 +--
 include/linux/cfi.h                       |  59 ++--
 include/linux/cfi_types.h                 |  45 +++
 include/linux/compiler-clang.h            |  14 +-
 include/linux/compiler.h                  |  16 +-
 include/linux/compiler_types.h            |   4 -
 include/linux/init.h                      |   6 +-
 include/linux/module.h                    |  10 +-
 include/linux/pci.h                       |   4 +-
 kernel/cfi.c                              | 352 ++++------------------
 kernel/kallsyms.c                         |  17 --
 kernel/kthread.c                          |   3 +-
 kernel/module/main.c                      |  50 +--
 kernel/workqueue.c                        |   2 +-
 scripts/kallsyms.c                        |   1 +
 scripts/module.lds.S                      |  23 +-
 tools/objtool/check.c                     |   7 +-
 tools/objtool/elf.c                       |   7 +-
 53 files changed, 425 insertions(+), 554 deletions(-)
 create mode 100644 arch/x86/include/asm/cfi.h
 create mode 100644 arch/x86/kernel/cfi.c
 create mode 100644 include/linux/cfi_types.h


base-commit: 506357871c18e06565840d71c2ef9f818e19f460

Comments

Peter Zijlstra Sept. 26, 2022, 12:39 p.m. UTC | #1
On Thu, Sep 08, 2022 at 02:54:42PM -0700, Sami Tolvanen wrote:
> KCFI is a forward-edge control-flow integrity scheme in the upcoming
> Clang 16 release, which is more suitable for kernel use than the
> existing CFI scheme used by CONFIG_CFI_CLANG. KCFI doesn't require
> LTO, doesn't alter function references to point to a jump table, and
> won't break function address equality.
> 
> This series replaces the current arm64 CFI implementation with KCFI
> and adds support for x86_64.
> 
> KCFI requires assembly functions that are indirectly called from C
> code to be annotated with type identifiers. As type information is
> only available in C, the compiler emits expected type identifiers
> into the symbol table, so they can be referenced from assembly
> without having to hardcode type hashes. Patch 6 adds helper macros
> for annotating functions, and patches 9 and 20 add annotations.
> 
> In case of a type mismatch, KCFI always traps. To support error
> handling, the compiler generates a .kcfi_traps section for x86_64,
> which contains the locations of each trap, and for arm64, encodes
> the necessary register information to the ESR. Patches 10 and 22 add
> arch-specific error handlers.
> 
> To test this series, you'll need a ToT Clang toolchain. The series
> is also available pn GitHub:
> 
>   https://github.com/samitolvanen/linux/commits/kcfi-v5

As mentioned at plumbers, my only concern is somewhat excessive use of
CFI_CLANG as oposed to something more compiler neutral. But I suppose
that's something we can cleanup/fix when GCC grows support for this.

Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Tested-by: Peter Zijlstra (Intel) <peterz@infradead.org>

(as in I ran kCFI + call-depth-tracking + FineIBT on a bunch of
hardware)

HJL, can you look at adding kCFI support to GCC ?
Kees Cook Sept. 26, 2022, 5:20 p.m. UTC | #2
On Thu, 8 Sep 2022 14:54:42 -0700, Sami Tolvanen wrote:
> KCFI is a forward-edge control-flow integrity scheme in the upcoming
> Clang 16 release, which is more suitable for kernel use than the
> existing CFI scheme used by CONFIG_CFI_CLANG. KCFI doesn't require
> LTO, doesn't alter function references to point to a jump table, and
> won't break function address equality.
> 
> This series replaces the current arm64 CFI implementation with KCFI
> and adds support for x86_64.
> 
> [...]

I assume that Peter's Ack means I should carry the tree, so, to that end:

Applied to for-next/kcfi, thanks!

[01/22] treewide: Filter out CC_FLAGS_CFI
        https://git.kernel.org/kees/c/f143ff397a3f
[02/22] scripts/kallsyms: Ignore __kcfi_typeid_
        https://git.kernel.org/kees/c/d0f9562ee43a
[03/22] cfi: Remove CONFIG_CFI_CLANG_SHADOW
        https://git.kernel.org/kees/c/9fca7115827b
[04/22] cfi: Drop __CFI_ADDRESSABLE
        https://git.kernel.org/kees/c/92efda8eb152
[05/22] cfi: Switch to -fsanitize=kcfi
        https://git.kernel.org/kees/c/89245600941e
[06/22] cfi: Add type helper macros
        https://git.kernel.org/kees/c/e84e008e7b02
[07/22] lkdtm: Emit an indirect call for CFI tests
        https://git.kernel.org/kees/c/cf90d0383560
[08/22] psci: Fix the function type for psci_initcall_t
        https://git.kernel.org/kees/c/44f665b69c67
[09/22] arm64: Add types to indirect called assembly functions
        https://git.kernel.org/kees/c/c50d32859e70
[10/22] arm64: Add CFI error handling
        https://git.kernel.org/kees/c/b26e484b8bb3
[11/22] arm64: Drop unneeded __nocfi attributes
        https://git.kernel.org/kees/c/5f20997c194e
[12/22] init: Drop __nocfi from __init
        https://git.kernel.org/kees/c/5dbbb3eaa2a7
[13/22] treewide: Drop function_nocfi
        https://git.kernel.org/kees/c/607289a7cd7a
[14/22] treewide: Drop WARN_ON_FUNCTION_MISMATCH
        https://git.kernel.org/kees/c/4b24356312fb
[15/22] treewide: Drop __cficanonical
        https://git.kernel.org/kees/c/5659b598b4dc
[16/22] objtool: Preserve special st_shndx indexes in elf_update_symbol
        https://git.kernel.org/kees/c/5141d3a06b2d
[17/22] objtool: Disable CFI warnings
        https://git.kernel.org/kees/c/3c68a92d17ad
[18/22] kallsyms: Drop CONFIG_CFI_CLANG workarounds
        https://git.kernel.org/kees/c/dfb352ab1162
[19/22] x86/tools/relocs: Ignore __kcfi_typeid_ relocations
        https://git.kernel.org/kees/c/ca7e10bff196
[20/22] x86: Add types to indirectly called assembly functions
        https://git.kernel.org/kees/c/ccace936eec7
[21/22] x86/purgatory: Disable CFI
        https://git.kernel.org/kees/c/a4b7a12c5594
[22/22] x86: Add support for CONFIG_CFI_CLANG
        https://git.kernel.org/kees/c/3c516f89e17e
H.J. Lu Sept. 26, 2022, 8:16 p.m. UTC | #3
On Mon, Sep 26, 2022 at 5:39 AM Peter Zijlstra <peterz@infradead.org> wrote:
>
> On Thu, Sep 08, 2022 at 02:54:42PM -0700, Sami Tolvanen wrote:
> > KCFI is a forward-edge control-flow integrity scheme in the upcoming
> > Clang 16 release, which is more suitable for kernel use than the
> > existing CFI scheme used by CONFIG_CFI_CLANG. KCFI doesn't require
> > LTO, doesn't alter function references to point to a jump table, and
> > won't break function address equality.
> >
> > This series replaces the current arm64 CFI implementation with KCFI
> > and adds support for x86_64.
> >
> > KCFI requires assembly functions that are indirectly called from C
> > code to be annotated with type identifiers. As type information is
> > only available in C, the compiler emits expected type identifiers
> > into the symbol table, so they can be referenced from assembly
> > without having to hardcode type hashes. Patch 6 adds helper macros
> > for annotating functions, and patches 9 and 20 add annotations.
> >
> > In case of a type mismatch, KCFI always traps. To support error
> > handling, the compiler generates a .kcfi_traps section for x86_64,
> > which contains the locations of each trap, and for arm64, encodes
> > the necessary register information to the ESR. Patches 10 and 22 add
> > arch-specific error handlers.
> >
> > To test this series, you'll need a ToT Clang toolchain. The series
> > is also available pn GitHub:
> >
> >   https://github.com/samitolvanen/linux/commits/kcfi-v5
>
> As mentioned at plumbers, my only concern is somewhat excessive use of
> CFI_CLANG as oposed to something more compiler neutral. But I suppose
> that's something we can cleanup/fix when GCC grows support for this.
>
> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
> Tested-by: Peter Zijlstra (Intel) <peterz@infradead.org>
>
> (as in I ran kCFI + call-depth-tracking + FineIBT on a bunch of
> hardware)
>
> HJL, can you look at adding kCFI support to GCC ?

Adding -fsanitize=kcfi to GCC is a big effort.  Please open a
GCC bug:

https://gcc.gnu.org/bugzilla/enter_bug.cgi?product=gcc
Peter Zijlstra Sept. 27, 2022, 7:29 a.m. UTC | #4
On Mon, Sep 26, 2022 at 01:16:04PM -0700, H.J. Lu wrote:
> On Mon, Sep 26, 2022 at 5:39 AM Peter Zijlstra <peterz@infradead.org> wrote:
> >
> > On Thu, Sep 08, 2022 at 02:54:42PM -0700, Sami Tolvanen wrote:
> > > KCFI is a forward-edge control-flow integrity scheme in the upcoming
> > > Clang 16 release, which is more suitable for kernel use than the
> > > existing CFI scheme used by CONFIG_CFI_CLANG. KCFI doesn't require
> > > LTO, doesn't alter function references to point to a jump table, and
> > > won't break function address equality.
> > >
> > > This series replaces the current arm64 CFI implementation with KCFI
> > > and adds support for x86_64.
> > >
> > > KCFI requires assembly functions that are indirectly called from C
> > > code to be annotated with type identifiers. As type information is
> > > only available in C, the compiler emits expected type identifiers
> > > into the symbol table, so they can be referenced from assembly
> > > without having to hardcode type hashes. Patch 6 adds helper macros
> > > for annotating functions, and patches 9 and 20 add annotations.
> > >
> > > In case of a type mismatch, KCFI always traps. To support error
> > > handling, the compiler generates a .kcfi_traps section for x86_64,
> > > which contains the locations of each trap, and for arm64, encodes
> > > the necessary register information to the ESR. Patches 10 and 22 add
> > > arch-specific error handlers.
> > >
> > > To test this series, you'll need a ToT Clang toolchain. The series
> > > is also available pn GitHub:
> > >
> > >   https://github.com/samitolvanen/linux/commits/kcfi-v5
> >
> > As mentioned at plumbers, my only concern is somewhat excessive use of
> > CFI_CLANG as oposed to something more compiler neutral. But I suppose
> > that's something we can cleanup/fix when GCC grows support for this.
> >
> > Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
> > Tested-by: Peter Zijlstra (Intel) <peterz@infradead.org>
> >
> > (as in I ran kCFI + call-depth-tracking + FineIBT on a bunch of
> > hardware)
> >
> > HJL, can you look at adding kCFI support to GCC ?
> 
> Adding -fsanitize=kcfi to GCC is a big effort.  Please open a
> GCC bug:
> 
> https://gcc.gnu.org/bugzilla/enter_bug.cgi?product=gcc

Here goes:

  https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107048
Sedat Dilek Sept. 28, 2022, 9:01 a.m. UTC | #5
On Mon, Sep 26, 2022 at 7:21 PM Kees Cook <keescook@chromium.org> wrote:
>
> On Thu, 8 Sep 2022 14:54:42 -0700, Sami Tolvanen wrote:
> > KCFI is a forward-edge control-flow integrity scheme in the upcoming
> > Clang 16 release, which is more suitable for kernel use than the
> > existing CFI scheme used by CONFIG_CFI_CLANG. KCFI doesn't require
> > LTO, doesn't alter function references to point to a jump table, and
> > won't break function address equality.
> >
> > This series replaces the current arm64 CFI implementation with KCFI
> > and adds support for x86_64.
> >
> > [...]
>
> I assume that Peter's Ack means I should carry the tree, so, to that end:
>
> Applied to for-next/kcfi, thanks!
>

Hi,

I did regularly KCFI testing.

1. Used Sami's samitolvanen.github#linux/kcfi Git on the Linux side.

2. Used *not* LLVM-16 (including KCFI) but with LLVM-15 from
samitolvanen.github#llvm-project/15.x/kcfi Git on the toolchain side.

My last testing was with [1] (Linux v6.0-rc7 + KCFI) and [2] (LLVM
v15.0.1 + KCFI) plus drm-i915-gt/KCFI for Linux v6.0-rc7 patch from
Nathan (see [3]).
Thanks Sami for updating 15.x/kcfi on LLVM side on my request.

So, feel free to add my:

Tested-by: Sedat Dilek <sedat.dilek@gmail.com> # LLVM-15 (with KCFI
support) on x86-64

Thanks to all involved people!

Best regards,
-Sedat-

[1] https://github.com/samitolvanen/linux/commits/kcfi
[2] https://github.com/samitolvanen/llvm-project/commits/15.x/kcfi
[3] https://github.com/ClangBuiltLinux/linux/issues/1716#issuecomment-1257311327

> [01/22] treewide: Filter out CC_FLAGS_CFI
>         https://git.kernel.org/kees/c/f143ff397a3f
> [02/22] scripts/kallsyms: Ignore __kcfi_typeid_
>         https://git.kernel.org/kees/c/d0f9562ee43a
> [03/22] cfi: Remove CONFIG_CFI_CLANG_SHADOW
>         https://git.kernel.org/kees/c/9fca7115827b
> [04/22] cfi: Drop __CFI_ADDRESSABLE
>         https://git.kernel.org/kees/c/92efda8eb152
> [05/22] cfi: Switch to -fsanitize=kcfi
>         https://git.kernel.org/kees/c/89245600941e
> [06/22] cfi: Add type helper macros
>         https://git.kernel.org/kees/c/e84e008e7b02
> [07/22] lkdtm: Emit an indirect call for CFI tests
>         https://git.kernel.org/kees/c/cf90d0383560
> [08/22] psci: Fix the function type for psci_initcall_t
>         https://git.kernel.org/kees/c/44f665b69c67
> [09/22] arm64: Add types to indirect called assembly functions
>         https://git.kernel.org/kees/c/c50d32859e70
> [10/22] arm64: Add CFI error handling
>         https://git.kernel.org/kees/c/b26e484b8bb3
> [11/22] arm64: Drop unneeded __nocfi attributes
>         https://git.kernel.org/kees/c/5f20997c194e
> [12/22] init: Drop __nocfi from __init
>         https://git.kernel.org/kees/c/5dbbb3eaa2a7
> [13/22] treewide: Drop function_nocfi
>         https://git.kernel.org/kees/c/607289a7cd7a
> [14/22] treewide: Drop WARN_ON_FUNCTION_MISMATCH
>         https://git.kernel.org/kees/c/4b24356312fb
> [15/22] treewide: Drop __cficanonical
>         https://git.kernel.org/kees/c/5659b598b4dc
> [16/22] objtool: Preserve special st_shndx indexes in elf_update_symbol
>         https://git.kernel.org/kees/c/5141d3a06b2d
> [17/22] objtool: Disable CFI warnings
>         https://git.kernel.org/kees/c/3c68a92d17ad
> [18/22] kallsyms: Drop CONFIG_CFI_CLANG workarounds
>         https://git.kernel.org/kees/c/dfb352ab1162
> [19/22] x86/tools/relocs: Ignore __kcfi_typeid_ relocations
>         https://git.kernel.org/kees/c/ca7e10bff196
> [20/22] x86: Add types to indirectly called assembly functions
>         https://git.kernel.org/kees/c/ccace936eec7
> [21/22] x86/purgatory: Disable CFI
>         https://git.kernel.org/kees/c/a4b7a12c5594
> [22/22] x86: Add support for CONFIG_CFI_CLANG
>         https://git.kernel.org/kees/c/3c516f89e17e
>
> --
> Kees Cook
>