github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-30 01:53:29 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI

Browse Source 
The kernel's CFI implementation uses the KCFI ABI specifically, and is
not strictly tied to a particular compiler. In preparation for GCC
supporting KCFI, rename CONFIG_CFI_CLANG to CONFIG_CFI (along with
associated options).

Use new "transitional" Kconfig option for old CONFIG_CFI_CLANG that will
enable CONFIG_CFI during olddefconfig.

Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Link: https://lore.kernel.org/r/20250923213422.1105654-3-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
This commit is contained in:
Kees Cook 2025-09-23 14:34:19 -07:00
parent f9afce4f32
commit 23ef9d4397
55 changed files with 100 additions and 90 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@ -1020,7 +1020,7 @@ KBUILD_AFLAGS += -fno-lto
export CC_FLAGS_LTO export CC_FLAGS_LTO
endif endif
ifdef CONFIG_CFI_CLANG ifdef CONFIG_CFI
CC_FLAGS_CFI := -fsanitize=kcfi CC_FLAGS_CFI := -fsanitize=kcfi
ifdef CONFIG_CFI_ICALL_NORMALIZE_INTEGERS ifdef CONFIG_CFI_ICALL_NORMALIZE_INTEGERS
CC_FLAGS_CFI += -fsanitize-cfi-icall-experimental-normalize-integers CC_FLAGS_CFI += -fsanitize-cfi-icall-experimental-normalize-integers

36
arch/Kconfig
View File

@ -867,22 +867,26 @@ config PROPELLER_CLANG
If unsure, say N. If unsure, say N.
config ARCH_SUPPORTS_CFI_CLANG config ARCH_SUPPORTS_CFI
bool bool
help help
An architecture should select this option if it can support Clang's An architecture should select this option if it can support Kernel
Control-Flow Integrity (CFI) checking. Control-Flow Integrity (CFI) checking (-fsanitize=kcfi).
config ARCH_USES_CFI_TRAPS config ARCH_USES_CFI_TRAPS
bool bool
help
An architecture should select this option if it requires the
.kcfi_traps section for KCFI trap handling.
config CFI_CLANG config CFI
bool "Use Clang's Control Flow Integrity (CFI)" bool "Use Kernel Control Flow Integrity (kCFI)"
depends on ARCH_SUPPORTS_CFI_CLANG default CFI_CLANG
depends on ARCH_SUPPORTS_CFI
depends on $(cc-option,-fsanitize=kcfi) depends on $(cc-option,-fsanitize=kcfi)
help help
This option enables Clang's forward-edge Control Flow Integrity This option enables forward-edge Control Flow Integrity (CFI)
(CFI) checking, where the compiler injects a runtime check to each checking, where the compiler injects a runtime check to each
indirect function call to ensure the target is a valid function with indirect function call to ensure the target is a valid function with
the correct static type. This restricts possible call targets and the correct static type. This restricts possible call targets and
makes it more difficult for an attacker to exploit bugs that allow makes it more difficult for an attacker to exploit bugs that allow
@ -891,10 +895,16 @@ config CFI_CLANG
https://clang.llvm.org/docs/ControlFlowIntegrity.html https://clang.llvm.org/docs/ControlFlowIntegrity.html
config CFI_CLANG
bool
transitional
help
Transitional config for CFI_CLANG to CFI migration.
config CFI_ICALL_NORMALIZE_INTEGERS config CFI_ICALL_NORMALIZE_INTEGERS
bool "Normalize CFI tags for integers" bool "Normalize CFI tags for integers"
depends on CFI_CLANG depends on CFI
depends on HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG depends on HAVE_CFI_ICALL_NORMALIZE_INTEGERS
help help
This option normalizes the CFI tags for integer types so that all This option normalizes the CFI tags for integer types so that all
integer types of the same size and signedness receive the same CFI integer types of the same size and signedness receive the same CFI
@ -907,7 +917,7 @@ config CFI_ICALL_NORMALIZE_INTEGERS
This option is necessary for using CFI with Rust. If unsure, say N. This option is necessary for using CFI with Rust. If unsure, say N.
config HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG config HAVE_CFI_ICALL_NORMALIZE_INTEGERS
def_bool y def_bool y
depends on $(cc-option,-fsanitize=kcfi -fsanitize-cfi-icall-experimental-normalize-integers) depends on $(cc-option,-fsanitize=kcfi -fsanitize-cfi-icall-experimental-normalize-integers)
# With GCOV/KASAN we need this fix: https://github.com/llvm/llvm-project/pull/104826 # With GCOV/KASAN we need this fix: https://github.com/llvm/llvm-project/pull/104826
@ -915,7 +925,7 @@ config HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG
config HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC config HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC
def_bool y def_bool y
depends on HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG depends on HAVE_CFI_ICALL_NORMALIZE_INTEGERS
depends on RUSTC_VERSION >= 107900 depends on RUSTC_VERSION >= 107900
# With GCOV/KASAN we need this fix: https://github.com/rust-lang/rust/pull/129373 # With GCOV/KASAN we need this fix: https://github.com/rust-lang/rust/pull/129373
depends on (RUSTC_LLVM_VERSION >= 190103 && RUSTC_VERSION >= 108200) || \ depends on (RUSTC_LLVM_VERSION >= 190103 && RUSTC_VERSION >= 108200) || \
@ -923,7 +933,7 @@ config HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC
config CFI_PERMISSIVE config CFI_PERMISSIVE
bool "Use CFI in permissive mode" bool "Use CFI in permissive mode"
depends on CFI_CLANG depends on CFI
help help
When selected, Control Flow Integrity (CFI) violations result in a When selected, Control Flow Integrity (CFI) violations result in a
warning instead of a kernel panic. This option should only be used warning instead of a kernel panic. This option should only be used

2
arch/arm/Kconfig
View File

@ -38,7 +38,7 @@ config ARM
select ARCH_OPTIONAL_KERNEL_RWX_DEFAULT if CPU_V7 select ARCH_OPTIONAL_KERNEL_RWX_DEFAULT if CPU_V7
select ARCH_NEED_CMPXCHG_1_EMU if CPU_V6 select ARCH_NEED_CMPXCHG_1_EMU if CPU_V6
select ARCH_SUPPORTS_ATOMIC_RMW select ARCH_SUPPORTS_ATOMIC_RMW
select ARCH_SUPPORTS_CFI_CLANG select ARCH_SUPPORTS_CFI
select ARCH_SUPPORTS_HUGETLBFS if ARM_LPAE select ARCH_SUPPORTS_HUGETLBFS if ARM_LPAE
select ARCH_SUPPORTS_PER_VMA_LOCK select ARCH_SUPPORTS_PER_VMA_LOCK
select ARCH_USE_BUILTIN_BSWAP select ARCH_USE_BUILTIN_BSWAP

2
arch/arm/kernel/hw_breakpoint.c
View File

@ -904,7 +904,7 @@ static void breakpoint_handler(unsigned long unknown, struct pt_regs *regs)
watchpoint_single_step_handler(addr); watchpoint_single_step_handler(addr);
} }
#ifdef CONFIG_CFI_CLANG #ifdef CONFIG_CFI
static void hw_breakpoint_cfi_handler(struct pt_regs *regs) static void hw_breakpoint_cfi_handler(struct pt_regs *regs)
{ {
/* /*

2
arch/arm/mm/Makefile
View File

@ -89,7 +89,7 @@ obj-$(CONFIG_CPU_V6) += proc-v6.o
obj-$(CONFIG_CPU_V6K) += proc-v6.o obj-$(CONFIG_CPU_V6K) += proc-v6.o
obj-$(CONFIG_CPU_V7) += proc-v7.o proc-v7-bugs.o obj-$(CONFIG_CPU_V7) += proc-v7.o proc-v7-bugs.o
obj-$(CONFIG_CPU_V7M) += proc-v7m.o obj-$(CONFIG_CPU_V7M) += proc-v7m.o
obj-$(CONFIG_CFI_CLANG) += proc.o obj-$(CONFIG_CFI) += proc.o
obj-$(CONFIG_OUTER_CACHE) += l2c-common.o obj-$(CONFIG_OUTER_CACHE) += l2c-common.o
obj-$(CONFIG_CACHE_B15_RAC) += cache-b15-rac.o obj-$(CONFIG_CACHE_B15_RAC) += cache-b15-rac.o

2
arch/arm/mm/cache-fa.S
View File

@ -112,7 +112,7 @@ SYM_FUNC_END(fa_flush_user_cache_range)
* - end - virtual end address * - end - virtual end address
*/ */
SYM_TYPED_FUNC_START(fa_coherent_kern_range) SYM_TYPED_FUNC_START(fa_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b fa_coherent_user_range b fa_coherent_user_range
#endif #endif
SYM_FUNC_END(fa_coherent_kern_range) SYM_FUNC_END(fa_coherent_kern_range)

2
arch/arm/mm/cache-v4.S
View File

@ -104,7 +104,7 @@ SYM_FUNC_END(v4_coherent_user_range)
* - size - region size * - size - region size
*/ */
SYM_TYPED_FUNC_START(v4_flush_kern_dcache_area) SYM_TYPED_FUNC_START(v4_flush_kern_dcache_area)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b v4_dma_flush_range b v4_dma_flush_range
#endif #endif
SYM_FUNC_END(v4_flush_kern_dcache_area) SYM_FUNC_END(v4_flush_kern_dcache_area)

4
arch/arm/mm/cache-v4wb.S
View File

@ -136,7 +136,7 @@ SYM_FUNC_END(v4wb_flush_user_cache_range)
*/ */
SYM_TYPED_FUNC_START(v4wb_flush_kern_dcache_area) SYM_TYPED_FUNC_START(v4wb_flush_kern_dcache_area)
add r1, r0, r1 add r1, r0, r1
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b v4wb_coherent_user_range b v4wb_coherent_user_range
#endif #endif
SYM_FUNC_END(v4wb_flush_kern_dcache_area) SYM_FUNC_END(v4wb_flush_kern_dcache_area)
@ -152,7 +152,7 @@ SYM_FUNC_END(v4wb_flush_kern_dcache_area)
* - end - virtual end address * - end - virtual end address
*/ */
SYM_TYPED_FUNC_START(v4wb_coherent_kern_range) SYM_TYPED_FUNC_START(v4wb_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b v4wb_coherent_user_range b v4wb_coherent_user_range
#endif #endif
SYM_FUNC_END(v4wb_coherent_kern_range) SYM_FUNC_END(v4wb_coherent_kern_range)

2
arch/arm/mm/cache-v4wt.S
View File

@ -108,7 +108,7 @@ SYM_FUNC_END(v4wt_flush_user_cache_range)
* - end - virtual end address * - end - virtual end address
*/ */
SYM_TYPED_FUNC_START(v4wt_coherent_kern_range) SYM_TYPED_FUNC_START(v4wt_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b v4wt_coherent_user_range b v4wt_coherent_user_range
#endif #endif
SYM_FUNC_END(v4wt_coherent_kern_range) SYM_FUNC_END(v4wt_coherent_kern_range)

2
arch/arm/mm/cache-v6.S
View File

@ -117,7 +117,7 @@ SYM_FUNC_END(v6_flush_user_cache_range)
* - the Icache does not read data from the write buffer * - the Icache does not read data from the write buffer
*/ */
SYM_TYPED_FUNC_START(v6_coherent_kern_range) SYM_TYPED_FUNC_START(v6_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b v6_coherent_user_range b v6_coherent_user_range
#endif #endif
SYM_FUNC_END(v6_coherent_kern_range) SYM_FUNC_END(v6_coherent_kern_range)

2
arch/arm/mm/cache-v7.S
View File

@ -261,7 +261,7 @@ SYM_FUNC_END(v7_flush_user_cache_range)
* - the Icache does not read data from the write buffer * - the Icache does not read data from the write buffer
*/ */
SYM_TYPED_FUNC_START(v7_coherent_kern_range) SYM_TYPED_FUNC_START(v7_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b v7_coherent_user_range b v7_coherent_user_range
#endif #endif
SYM_FUNC_END(v7_coherent_kern_range) SYM_FUNC_END(v7_coherent_kern_range)

2
arch/arm/mm/cache-v7m.S
View File

@ -286,7 +286,7 @@ SYM_FUNC_END(v7m_flush_user_cache_range)
* - the Icache does not read data from the write buffer * - the Icache does not read data from the write buffer
*/ */
SYM_TYPED_FUNC_START(v7m_coherent_kern_range) SYM_TYPED_FUNC_START(v7m_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b v7m_coherent_user_range b v7m_coherent_user_range
#endif #endif
SYM_FUNC_END(v7m_coherent_kern_range) SYM_FUNC_END(v7m_coherent_kern_range)

2
arch/arm/mm/proc-arm1020.S
View File

@ -203,7 +203,7 @@ SYM_FUNC_END(arm1020_flush_user_cache_range)
* - end - virtual end address * - end - virtual end address
*/ */
SYM_TYPED_FUNC_START(arm1020_coherent_kern_range) SYM_TYPED_FUNC_START(arm1020_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b arm1020_coherent_user_range b arm1020_coherent_user_range
#endif #endif
SYM_FUNC_END(arm1020_coherent_kern_range) SYM_FUNC_END(arm1020_coherent_kern_range)

2
arch/arm/mm/proc-arm1020e.S
View File

@ -200,7 +200,7 @@ SYM_FUNC_END(arm1020e_flush_user_cache_range)
* - end - virtual end address * - end - virtual end address
*/ */
SYM_TYPED_FUNC_START(arm1020e_coherent_kern_range) SYM_TYPED_FUNC_START(arm1020e_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b arm1020e_coherent_user_range b arm1020e_coherent_user_range
#endif #endif
SYM_FUNC_END(arm1020e_coherent_kern_range) SYM_FUNC_END(arm1020e_coherent_kern_range)

2
arch/arm/mm/proc-arm1022.S
View File

@ -199,7 +199,7 @@ SYM_FUNC_END(arm1022_flush_user_cache_range)
* - end - virtual end address * - end - virtual end address
*/ */
SYM_TYPED_FUNC_START(arm1022_coherent_kern_range) SYM_TYPED_FUNC_START(arm1022_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b arm1022_coherent_user_range b arm1022_coherent_user_range
#endif #endif
SYM_FUNC_END(arm1022_coherent_kern_range) SYM_FUNC_END(arm1022_coherent_kern_range)

2
arch/arm/mm/proc-arm1026.S
View File

@ -194,7 +194,7 @@ SYM_FUNC_END(arm1026_flush_user_cache_range)
* - end - virtual end address * - end - virtual end address
*/ */
SYM_TYPED_FUNC_START(arm1026_coherent_kern_range) SYM_TYPED_FUNC_START(arm1026_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b arm1026_coherent_user_range b arm1026_coherent_user_range
#endif #endif
SYM_FUNC_END(arm1026_coherent_kern_range) SYM_FUNC_END(arm1026_coherent_kern_range)

2
arch/arm/mm/proc-arm920.S
View File

@ -180,7 +180,7 @@ SYM_FUNC_END(arm920_flush_user_cache_range)
* - end - virtual end address * - end - virtual end address
*/ */
SYM_TYPED_FUNC_START(arm920_coherent_kern_range) SYM_TYPED_FUNC_START(arm920_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b arm920_coherent_user_range b arm920_coherent_user_range
#endif #endif
SYM_FUNC_END(arm920_coherent_kern_range) SYM_FUNC_END(arm920_coherent_kern_range)

2
arch/arm/mm/proc-arm922.S
View File

@ -182,7 +182,7 @@ SYM_FUNC_END(arm922_flush_user_cache_range)
* - end - virtual end address * - end - virtual end address
*/ */
SYM_TYPED_FUNC_START(arm922_coherent_kern_range) SYM_TYPED_FUNC_START(arm922_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b arm922_coherent_user_range b arm922_coherent_user_range
#endif #endif
SYM_FUNC_END(arm922_coherent_kern_range) SYM_FUNC_END(arm922_coherent_kern_range)

2
arch/arm/mm/proc-arm925.S
View File

@ -229,7 +229,7 @@ SYM_FUNC_END(arm925_flush_user_cache_range)
* - end - virtual end address * - end - virtual end address
*/ */
SYM_TYPED_FUNC_START(arm925_coherent_kern_range) SYM_TYPED_FUNC_START(arm925_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b arm925_coherent_user_range b arm925_coherent_user_range
#endif #endif
SYM_FUNC_END(arm925_coherent_kern_range) SYM_FUNC_END(arm925_coherent_kern_range)

2
arch/arm/mm/proc-arm926.S
View File

@ -192,7 +192,7 @@ SYM_FUNC_END(arm926_flush_user_cache_range)
* - end - virtual end address * - end - virtual end address
*/ */
SYM_TYPED_FUNC_START(arm926_coherent_kern_range) SYM_TYPED_FUNC_START(arm926_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b arm926_coherent_user_range b arm926_coherent_user_range
#endif #endif
SYM_FUNC_END(arm926_coherent_kern_range) SYM_FUNC_END(arm926_coherent_kern_range)

2
arch/arm/mm/proc-arm940.S
View File

@ -153,7 +153,7 @@ SYM_FUNC_END(arm940_coherent_kern_range)
* - end - virtual end address * - end - virtual end address
*/ */
SYM_TYPED_FUNC_START(arm940_coherent_user_range) SYM_TYPED_FUNC_START(arm940_coherent_user_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b arm940_flush_kern_dcache_area b arm940_flush_kern_dcache_area
#endif #endif
SYM_FUNC_END(arm940_coherent_user_range) SYM_FUNC_END(arm940_coherent_user_range)

2
arch/arm/mm/proc-arm946.S
View File

@ -173,7 +173,7 @@ SYM_FUNC_END(arm946_flush_user_cache_range)
* - end - virtual end address * - end - virtual end address
*/ */
SYM_TYPED_FUNC_START(arm946_coherent_kern_range) SYM_TYPED_FUNC_START(arm946_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b arm946_coherent_user_range b arm946_coherent_user_range
#endif #endif
SYM_FUNC_END(arm946_coherent_kern_range) SYM_FUNC_END(arm946_coherent_kern_range)

2
arch/arm/mm/proc-feroceon.S
View File

@ -208,7 +208,7 @@ SYM_FUNC_END(feroceon_flush_user_cache_range)
*/ */
.align 5 .align 5
SYM_TYPED_FUNC_START(feroceon_coherent_kern_range) SYM_TYPED_FUNC_START(feroceon_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b feroceon_coherent_user_range b feroceon_coherent_user_range
#endif #endif
SYM_FUNC_END(feroceon_coherent_kern_range) SYM_FUNC_END(feroceon_coherent_kern_range)

2
arch/arm/mm/proc-mohawk.S
View File

@ -163,7 +163,7 @@ SYM_FUNC_END(mohawk_flush_user_cache_range)
* - end - virtual end address * - end - virtual end address
*/ */
SYM_TYPED_FUNC_START(mohawk_coherent_kern_range) SYM_TYPED_FUNC_START(mohawk_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b mohawk_coherent_user_range b mohawk_coherent_user_range
#endif #endif
SYM_FUNC_END(mohawk_coherent_kern_range) SYM_FUNC_END(mohawk_coherent_kern_range)

2
arch/arm/mm/proc-xsc3.S
View File

@ -223,7 +223,7 @@ SYM_FUNC_END(xsc3_flush_user_cache_range)
* it also trashes the mini I-cache used by JTAG debuggers. * it also trashes the mini I-cache used by JTAG debuggers.
*/ */
SYM_TYPED_FUNC_START(xsc3_coherent_kern_range) SYM_TYPED_FUNC_START(xsc3_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */ #ifdef CONFIG_CFI /* Fallthrough if !CFI */
b xsc3_coherent_user_range b xsc3_coherent_user_range
#endif #endif
SYM_FUNC_END(xsc3_coherent_kern_range) SYM_FUNC_END(xsc3_coherent_kern_range)

2
arch/arm/mm/tlb-v4.S
View File

@ -52,7 +52,7 @@ SYM_FUNC_END(v4_flush_user_tlb_range)
* - start - virtual address (may not be aligned) * - start - virtual address (may not be aligned)
* - end - virtual address (may not be aligned) * - end - virtual address (may not be aligned)
*/ */
#ifdef CONFIG_CFI_CLANG #ifdef CONFIG_CFI
SYM_TYPED_FUNC_START(v4_flush_kern_tlb_range) SYM_TYPED_FUNC_START(v4_flush_kern_tlb_range)
b .v4_flush_kern_tlb_range b .v4_flush_kern_tlb_range
SYM_FUNC_END(v4_flush_kern_tlb_range) SYM_FUNC_END(v4_flush_kern_tlb_range)

4
arch/arm64/Kconfig
View File

@ -100,7 +100,7 @@ config ARM64
select ARCH_SUPPORTS_SHADOW_CALL_STACK if CC_HAVE_SHADOW_CALL_STACK select ARCH_SUPPORTS_SHADOW_CALL_STACK if CC_HAVE_SHADOW_CALL_STACK
select ARCH_SUPPORTS_LTO_CLANG if CPU_LITTLE_ENDIAN select ARCH_SUPPORTS_LTO_CLANG if CPU_LITTLE_ENDIAN
select ARCH_SUPPORTS_LTO_CLANG_THIN select ARCH_SUPPORTS_LTO_CLANG_THIN
select ARCH_SUPPORTS_CFI_CLANG select ARCH_SUPPORTS_CFI
select ARCH_SUPPORTS_ATOMIC_RMW select ARCH_SUPPORTS_ATOMIC_RMW
select ARCH_SUPPORTS_INT128 if CC_HAS_INT128 select ARCH_SUPPORTS_INT128 if CC_HAS_INT128
select ARCH_SUPPORTS_NUMA_BALANCING select ARCH_SUPPORTS_NUMA_BALANCING
@ -212,7 +212,7 @@ config ARM64
select HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS \ select HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS \
if DYNAMIC_FTRACE_WITH_ARGS && DYNAMIC_FTRACE_WITH_CALL_OPS if DYNAMIC_FTRACE_WITH_ARGS && DYNAMIC_FTRACE_WITH_CALL_OPS
select HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS \ select HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS \
if (DYNAMIC_FTRACE_WITH_ARGS && !CFI_CLANG && \ if (DYNAMIC_FTRACE_WITH_ARGS && !CFI && \
(CC_IS_CLANG || !CC_OPTIMIZE_FOR_SIZE)) (CC_IS_CLANG || !CC_OPTIMIZE_FOR_SIZE))
select FTRACE_MCOUNT_USE_PATCHABLE_FUNCTION_ENTRY \ select FTRACE_MCOUNT_USE_PATCHABLE_FUNCTION_ENTRY \
if DYNAMIC_FTRACE_WITH_ARGS if DYNAMIC_FTRACE_WITH_ARGS

2
arch/arm64/kernel/debug-monitors.c
View File

@ -212,7 +212,7 @@ static int call_el1_break_hook(struct pt_regs *regs, unsigned long esr)
if (esr_brk_comment(esr) == BUG_BRK_IMM) if (esr_brk_comment(esr) == BUG_BRK_IMM)
return bug_brk_handler(regs, esr); return bug_brk_handler(regs, esr);
if (IS_ENABLED(CONFIG_CFI_CLANG) && esr_is_cfi_brk(esr)) if (IS_ENABLED(CONFIG_CFI) && esr_is_cfi_brk(esr))
return cfi_brk_handler(regs, esr); return cfi_brk_handler(regs, esr);
if (esr_brk_comment(esr) == FAULT_BRK_IMM) if (esr_brk_comment(esr) == FAULT_BRK_IMM)

4
arch/arm64/kernel/traps.c
View File

@ -1015,7 +1015,7 @@ int bug_brk_handler(struct pt_regs *regs, unsigned long esr)
return DBG_HOOK_HANDLED; return DBG_HOOK_HANDLED;
} }
#ifdef CONFIG_CFI_CLANG #ifdef CONFIG_CFI
int cfi_brk_handler(struct pt_regs *regs, unsigned long esr) int cfi_brk_handler(struct pt_regs *regs, unsigned long esr)
{ {
unsigned long target; unsigned long target;
@ -1039,7 +1039,7 @@ int cfi_brk_handler(struct pt_regs *regs, unsigned long esr)
arm64_skip_faulting_instruction(regs, AARCH64_INSN_SIZE); arm64_skip_faulting_instruction(regs, AARCH64_INSN_SIZE);
return DBG_HOOK_HANDLED; return DBG_HOOK_HANDLED;
} }
#endif /* CONFIG_CFI_CLANG */ #endif /* CONFIG_CFI */
int reserved_fault_brk_handler(struct pt_regs *regs, unsigned long esr) int reserved_fault_brk_handler(struct pt_regs *regs, unsigned long esr)
{ {

2
arch/arm64/kvm/handle_exit.c
View File

@ -545,7 +545,7 @@ void __noreturn __cold nvhe_hyp_panic_handler(u64 esr, u64 spsr,
kvm_err("nVHE hyp BUG at: %s:%u!\n", file, line); kvm_err("nVHE hyp BUG at: %s:%u!\n", file, line);
else else
print_nvhe_hyp_panic("BUG", panic_addr); print_nvhe_hyp_panic("BUG", panic_addr);
} else if (IS_ENABLED(CONFIG_CFI_CLANG) && esr_is_cfi_brk(esr)) { } else if (IS_ENABLED(CONFIG_CFI) && esr_is_cfi_brk(esr)) {
kvm_nvhe_report_cfi_failure(panic_addr); kvm_nvhe_report_cfi_failure(panic_addr);
} else if (IS_ENABLED(CONFIG_UBSAN_KVM_EL2) && } else if (IS_ENABLED(CONFIG_UBSAN_KVM_EL2) &&
ESR_ELx_EC(esr) == ESR_ELx_EC_BRK64 && ESR_ELx_EC(esr) == ESR_ELx_EC_BRK64 &&

2
arch/arm64/net/bpf_jit_comp.c
View File

@ -185,7 +185,7 @@ static inline void emit_bti(u32 insn, struct jit_ctx *ctx)
static inline void emit_kcfi(u32 hash, struct jit_ctx *ctx) static inline void emit_kcfi(u32 hash, struct jit_ctx *ctx)
{ {
if (IS_ENABLED(CONFIG_CFI_CLANG)) if (IS_ENABLED(CONFIG_CFI))
emit_u32_data(hash, ctx); emit_u32_data(hash, ctx);
} }

6
arch/riscv/Kconfig
View File

@ -60,7 +60,7 @@ config RISCV
select ARCH_STACKWALK select ARCH_STACKWALK
select ARCH_SUPPORTS_ATOMIC_RMW select ARCH_SUPPORTS_ATOMIC_RMW
# clang >= 17: https://github.com/llvm/llvm-project/commit/62fa708ceb027713b386c7e0efda994f8bdc27e2 # clang >= 17: https://github.com/llvm/llvm-project/commit/62fa708ceb027713b386c7e0efda994f8bdc27e2
select ARCH_SUPPORTS_CFI_CLANG if CLANG_VERSION >= 170000 select ARCH_SUPPORTS_CFI if (!CC_IS_CLANG || CLANG_VERSION >= 170000)
select ARCH_SUPPORTS_DEBUG_PAGEALLOC if MMU select ARCH_SUPPORTS_DEBUG_PAGEALLOC if MMU
select ARCH_SUPPORTS_HUGE_PFNMAP if TRANSPARENT_HUGEPAGE select ARCH_SUPPORTS_HUGE_PFNMAP if TRANSPARENT_HUGEPAGE
select ARCH_SUPPORTS_HUGETLBFS if MMU select ARCH_SUPPORTS_HUGETLBFS if MMU
@ -76,7 +76,7 @@ config RISCV
select ARCH_USE_MEMTEST select ARCH_USE_MEMTEST
select ARCH_USE_QUEUED_RWLOCKS select ARCH_USE_QUEUED_RWLOCKS
select ARCH_USE_SYM_ANNOTATIONS select ARCH_USE_SYM_ANNOTATIONS
select ARCH_USES_CFI_TRAPS if CFI_CLANG select ARCH_USES_CFI_TRAPS if CFI
select ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH if MMU select ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH if MMU
select ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT if MMU select ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT if MMU
select ARCH_WANT_FRAME_POINTERS select ARCH_WANT_FRAME_POINTERS
@ -154,7 +154,7 @@ config RISCV
select HAVE_DYNAMIC_FTRACE if !XIP_KERNEL && MMU && (CLANG_SUPPORTS_DYNAMIC_FTRACE || GCC_SUPPORTS_DYNAMIC_FTRACE) select HAVE_DYNAMIC_FTRACE if !XIP_KERNEL && MMU && (CLANG_SUPPORTS_DYNAMIC_FTRACE || GCC_SUPPORTS_DYNAMIC_FTRACE)
select FUNCTION_ALIGNMENT_4B if HAVE_DYNAMIC_FTRACE && RISCV_ISA_C select FUNCTION_ALIGNMENT_4B if HAVE_DYNAMIC_FTRACE && RISCV_ISA_C
select HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS if HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS select HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS if HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS
select HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS if (DYNAMIC_FTRACE_WITH_ARGS && !CFI_CLANG) select HAVE_DYNAMIC_FTRACE_WITH_CALL_OPS if (DYNAMIC_FTRACE_WITH_ARGS && !CFI)
select HAVE_DYNAMIC_FTRACE_WITH_ARGS if HAVE_DYNAMIC_FTRACE select HAVE_DYNAMIC_FTRACE_WITH_ARGS if HAVE_DYNAMIC_FTRACE
select HAVE_FTRACE_GRAPH_FUNC select HAVE_FTRACE_GRAPH_FUNC
select HAVE_FUNCTION_GRAPH_TRACER if HAVE_DYNAMIC_FTRACE_WITH_ARGS select HAVE_FUNCTION_GRAPH_TRACER if HAVE_DYNAMIC_FTRACE_WITH_ARGS

4
arch/riscv/include/asm/cfi.h
View File

@ -11,7 +11,7 @@
struct pt_regs; struct pt_regs;
#ifdef CONFIG_CFI_CLANG #ifdef CONFIG_CFI
enum bug_trap_type handle_cfi_failure(struct pt_regs *regs); enum bug_trap_type handle_cfi_failure(struct pt_regs *regs);
#define __bpfcall #define __bpfcall
#else #else
@ -19,6 +19,6 @@ static inline enum bug_trap_type handle_cfi_failure(struct pt_regs *regs)
{ {
return BUG_TRAP_TYPE_NONE; return BUG_TRAP_TYPE_NONE;
} }
#endif /* CONFIG_CFI_CLANG */ #endif /* CONFIG_CFI */
#endif /* _ASM_RISCV_CFI_H */ #endif /* _ASM_RISCV_CFI_H */

2
arch/riscv/kernel/Makefile
View File

@ -113,7 +113,7 @@ obj-$(CONFIG_VMCORE_INFO) += vmcore_info.o
obj-$(CONFIG_JUMP_LABEL) += jump_label.o obj-$(CONFIG_JUMP_LABEL) += jump_label.o
obj-$(CONFIG_CFI_CLANG) += cfi.o obj-$(CONFIG_CFI) += cfi.o
obj-$(CONFIG_EFI) += efi.o obj-$(CONFIG_EFI) += efi.o
obj-$(CONFIG_COMPAT) += compat_syscall_table.o obj-$(CONFIG_COMPAT) += compat_syscall_table.o

4
arch/riscv/net/bpf_jit_comp64.c
View File

@ -18,7 +18,7 @@
#define RV_MAX_REG_ARGS 8 #define RV_MAX_REG_ARGS 8
#define RV_FENTRY_NINSNS 2 #define RV_FENTRY_NINSNS 2
#define RV_FENTRY_NBYTES (RV_FENTRY_NINSNS * 4) #define RV_FENTRY_NBYTES (RV_FENTRY_NINSNS * 4)
#define RV_KCFI_NINSNS (IS_ENABLED(CONFIG_CFI_CLANG) ? 1 : 0) #define RV_KCFI_NINSNS (IS_ENABLED(CONFIG_CFI) ? 1 : 0)
/* imm that allows emit_imm to emit max count insns */ /* imm that allows emit_imm to emit max count insns */
#define RV_MAX_COUNT_IMM 0x7FFF7FF7FF7FF7FF #define RV_MAX_COUNT_IMM 0x7FFF7FF7FF7FF7FF
@ -469,7 +469,7 @@ static int emit_call(u64 addr, bool fixed_addr, struct rv_jit_context *ctx)
static inline void emit_kcfi(u32 hash, struct rv_jit_context *ctx) static inline void emit_kcfi(u32 hash, struct rv_jit_context *ctx)
{ {
if (IS_ENABLED(CONFIG_CFI_CLANG)) if (IS_ENABLED(CONFIG_CFI))
emit(hash, ctx); emit(hash, ctx);
} }

2
arch/riscv/purgatory/Makefile
View File

@ -71,7 +71,7 @@ ifdef CONFIG_STACKPROTECTOR_STRONG
PURGATORY_CFLAGS_REMOVE += -fstack-protector-strong PURGATORY_CFLAGS_REMOVE += -fstack-protector-strong
endif endif
ifdef CONFIG_CFI_CLANG ifdef CONFIG_CFI
PURGATORY_CFLAGS_REMOVE += $(CC_FLAGS_CFI) PURGATORY_CFLAGS_REMOVE += $(CC_FLAGS_CFI)
endif endif

12
arch/x86/Kconfig
View File

@ -127,8 +127,8 @@ config X86
select ARCH_SUPPORTS_PAGE_TABLE_CHECK if X86_64 select ARCH_SUPPORTS_PAGE_TABLE_CHECK if X86_64
select ARCH_SUPPORTS_NUMA_BALANCING if X86_64 select ARCH_SUPPORTS_NUMA_BALANCING if X86_64
select ARCH_SUPPORTS_KMAP_LOCAL_FORCE_MAP if NR_CPUS <= 4096 select ARCH_SUPPORTS_KMAP_LOCAL_FORCE_MAP if NR_CPUS <= 4096
select ARCH_SUPPORTS_CFI_CLANG if X86_64 select ARCH_SUPPORTS_CFI if X86_64
select ARCH_USES_CFI_TRAPS if X86_64 && CFI_CLANG select ARCH_USES_CFI_TRAPS if X86_64 && CFI
select ARCH_SUPPORTS_LTO_CLANG select ARCH_SUPPORTS_LTO_CLANG
select ARCH_SUPPORTS_LTO_CLANG_THIN select ARCH_SUPPORTS_LTO_CLANG_THIN
select ARCH_SUPPORTS_RT select ARCH_SUPPORTS_RT
@ -2396,11 +2396,11 @@ config FUNCTION_PADDING_CFI
default 3 if FUNCTION_ALIGNMENT_8B default 3 if FUNCTION_ALIGNMENT_8B
default 0 default 0
# Basically: FUNCTION_ALIGNMENT - 5*CFI_CLANG # Basically: FUNCTION_ALIGNMENT - 5*CFI
# except Kconfig can't do arithmetic :/ # except Kconfig can't do arithmetic :/
config FUNCTION_PADDING_BYTES config FUNCTION_PADDING_BYTES
int int
default FUNCTION_PADDING_CFI if CFI_CLANG default FUNCTION_PADDING_CFI if CFI
default FUNCTION_ALIGNMENT default FUNCTION_ALIGNMENT
config CALL_PADDING config CALL_PADDING
@ -2410,7 +2410,7 @@ config CALL_PADDING
config FINEIBT config FINEIBT
def_bool y def_bool y
depends on X86_KERNEL_IBT && CFI_CLANG && MITIGATION_RETPOLINE depends on X86_KERNEL_IBT && CFI && MITIGATION_RETPOLINE
select CALL_PADDING select CALL_PADDING
config FINEIBT_BHI config FINEIBT_BHI
@ -2427,7 +2427,7 @@ config CALL_THUNKS
config PREFIX_SYMBOLS config PREFIX_SYMBOLS
def_bool y def_bool y
depends on CALL_PADDING && !CFI_CLANG depends on CALL_PADDING && !CFI
menuconfig CPU_MITIGATIONS menuconfig CPU_MITIGATIONS
bool "Mitigations for CPU vulnerabilities" bool "Mitigations for CPU vulnerabilities"

4
arch/x86/include/asm/cfi.h
View File

@ -113,7 +113,7 @@ extern bhi_thunk __bhi_args_end[];
struct pt_regs; struct pt_regs;
#ifdef CONFIG_CFI_CLANG #ifdef CONFIG_CFI
enum bug_trap_type handle_cfi_failure(struct pt_regs *regs); enum bug_trap_type handle_cfi_failure(struct pt_regs *regs);
#define __bpfcall #define __bpfcall
@ -157,7 +157,7 @@ static inline int cfi_get_func_arity(void *func)
{ {
return 0; return 0;
} }
#endif /* CONFIG_CFI_CLANG */ #endif /* CONFIG_CFI */
#if HAS_KERNEL_IBT == 1 #if HAS_KERNEL_IBT == 1
#define CFI_NOSEAL(x) asm(IBT_NOSEAL(__stringify(x))) #define CFI_NOSEAL(x) asm(IBT_NOSEAL(__stringify(x)))

2
arch/x86/kernel/Makefile
View File

@ -148,7 +148,7 @@ obj-$(CONFIG_UNWINDER_ORC) += unwind_orc.o
obj-$(CONFIG_UNWINDER_FRAME_POINTER) += unwind_frame.o obj-$(CONFIG_UNWINDER_FRAME_POINTER) += unwind_frame.o
obj-$(CONFIG_UNWINDER_GUESS) += unwind_guess.o obj-$(CONFIG_UNWINDER_GUESS) += unwind_guess.o
obj-$(CONFIG_CFI_CLANG) += cfi.o obj-$(CONFIG_CFI) += cfi.o
obj-$(CONFIG_CALL_THUNKS) += callthunks.o obj-$(CONFIG_CALL_THUNKS) += callthunks.o

4
arch/x86/kernel/alternative.c
View File

@ -1170,7 +1170,7 @@ void __init_or_module apply_seal_endbr(s32 *start, s32 *end) { }
#ifdef CONFIG_CFI_AUTO_DEFAULT #ifdef CONFIG_CFI_AUTO_DEFAULT
# define __CFI_DEFAULT CFI_AUTO # define __CFI_DEFAULT CFI_AUTO
#elif defined(CONFIG_CFI_CLANG) #elif defined(CONFIG_CFI)
# define __CFI_DEFAULT CFI_KCFI # define __CFI_DEFAULT CFI_KCFI
#else #else
# define __CFI_DEFAULT CFI_OFF # define __CFI_DEFAULT CFI_OFF
@ -1182,7 +1182,7 @@ enum cfi_mode cfi_mode __ro_after_init = __CFI_DEFAULT;
bool cfi_bhi __ro_after_init = false; bool cfi_bhi __ro_after_init = false;
#endif #endif
#ifdef CONFIG_CFI_CLANG #ifdef CONFIG_CFI
u32 cfi_get_func_hash(void *func) u32 cfi_get_func_hash(void *func)
{ {
u32 hash; u32 hash;

2
arch/x86/kernel/kprobes/core.c
View File

@ -339,7 +339,7 @@ static bool can_probe(unsigned long paddr)
if (is_exception_insn(&insn)) if (is_exception_insn(&insn))
return false; return false;
if (IS_ENABLED(CONFIG_CFI_CLANG)) { if (IS_ENABLED(CONFIG_CFI)) {
/* /*
* The compiler generates the following instruction sequence * The compiler generates the following instruction sequence
* for indirect call checks and cfi.c decodes this; * for indirect call checks and cfi.c decodes this;

2
arch/x86/purgatory/Makefile
View File

@ -57,7 +57,7 @@ ifdef CONFIG_MITIGATION_RETPOLINE
PURGATORY_CFLAGS_REMOVE += $(RETPOLINE_CFLAGS) PURGATORY_CFLAGS_REMOVE += $(RETPOLINE_CFLAGS)
endif endif
ifdef CONFIG_CFI_CLANG ifdef CONFIG_CFI
PURGATORY_CFLAGS_REMOVE += $(CC_FLAGS_CFI) PURGATORY_CFLAGS_REMOVE += $(CC_FLAGS_CFI)
endif endif

2
drivers/misc/lkdtm/cfi.c
View File

@ -43,7 +43,7 @@ static void lkdtm_CFI_FORWARD_PROTO(void)
lkdtm_indirect_call((void *)lkdtm_increment_int); lkdtm_indirect_call((void *)lkdtm_increment_int);
pr_err("FAIL: survived mismatched prototype function call!\n"); pr_err("FAIL: survived mismatched prototype function call!\n");
pr_expected_config(CONFIG_CFI_CLANG); pr_expected_config(CONFIG_CFI);
} }
/* /*

2
include/asm-generic/vmlinux.lds.h
View File

@ -157,7 +157,7 @@ defined(CONFIG_AUTOFDO_CLANG) || defined(CONFIG_PROPELLER_CLANG)
#define PATCHABLE_DISCARDS *(__patchable_function_entries) #define PATCHABLE_DISCARDS *(__patchable_function_entries)
#endif #endif
#ifndef CONFIG_ARCH_SUPPORTS_CFI_CLANG #ifndef CONFIG_ARCH_SUPPORTS_CFI
/* /*
* Simply points to ftrace_stub, but with the proper protocol. * Simply points to ftrace_stub, but with the proper protocol.
* Defined by the linker script in linux/vmlinux.lds.h * Defined by the linker script in linux/vmlinux.lds.h

6
include/linux/cfi.h
View File

@ -11,7 +11,7 @@
#include <linux/module.h> #include <linux/module.h>
#include <asm/cfi.h> #include <asm/cfi.h>
#ifdef CONFIG_CFI_CLANG #ifdef CONFIG_CFI
extern bool cfi_warn; extern bool cfi_warn;
enum bug_trap_type report_cfi_failure(struct pt_regs *regs, unsigned long addr, enum bug_trap_type report_cfi_failure(struct pt_regs *regs, unsigned long addr,
@ -52,7 +52,7 @@ static inline u32 cfi_get_func_hash(void *func)
extern u32 cfi_bpf_hash; extern u32 cfi_bpf_hash;
extern u32 cfi_bpf_subprog_hash; extern u32 cfi_bpf_subprog_hash;
#else /* CONFIG_CFI_CLANG */ #else /* CONFIG_CFI */
static inline int cfi_get_offset(void) { return 0; } static inline int cfi_get_offset(void) { return 0; }
static inline u32 cfi_get_func_hash(void *func) { return 0; } static inline u32 cfi_get_func_hash(void *func) { return 0; }
@ -60,7 +60,7 @@ static inline u32 cfi_get_func_hash(void *func) { return 0; }
#define cfi_bpf_hash 0U #define cfi_bpf_hash 0U
#define cfi_bpf_subprog_hash 0U #define cfi_bpf_subprog_hash 0U
#endif /* CONFIG_CFI_CLANG */ #endif /* CONFIG_CFI */
#ifdef CONFIG_ARCH_USES_CFI_TRAPS #ifdef CONFIG_ARCH_USES_CFI_TRAPS
bool is_cfi_trap(unsigned long addr); bool is_cfi_trap(unsigned long addr);

8
include/linux/cfi_types.h
View File

@ -8,7 +8,7 @@
#ifdef __ASSEMBLY__ #ifdef __ASSEMBLY__
#include <linux/linkage.h> #include <linux/linkage.h>
#ifdef CONFIG_CFI_CLANG #ifdef CONFIG_CFI
/* /*
* Use the __kcfi_typeid_<function> type identifier symbol to * Use the __kcfi_typeid_<function> type identifier symbol to
* annotate indirectly called assembly functions. The compiler emits * annotate indirectly called assembly functions. The compiler emits
@ -29,12 +29,12 @@
#define SYM_TYPED_START(name, linkage, align...) \ #define SYM_TYPED_START(name, linkage, align...) \
SYM_TYPED_ENTRY(name, linkage, align) SYM_TYPED_ENTRY(name, linkage, align)
#else /* CONFIG_CFI_CLANG */ #else /* CONFIG_CFI */
#define SYM_TYPED_START(name, linkage, align...) \ #define SYM_TYPED_START(name, linkage, align...) \
SYM_START(name, linkage, align) SYM_START(name, linkage, align)
#endif /* CONFIG_CFI_CLANG */ #endif /* CONFIG_CFI */
#ifndef SYM_TYPED_FUNC_START #ifndef SYM_TYPED_FUNC_START
#define SYM_TYPED_FUNC_START(name) \ #define SYM_TYPED_FUNC_START(name) \
@ -43,7 +43,7 @@
#else /* __ASSEMBLY__ */ #else /* __ASSEMBLY__ */
#ifdef CONFIG_CFI_CLANG #ifdef CONFIG_CFI
#define DEFINE_CFI_TYPE(name, func) \ #define DEFINE_CFI_TYPE(name, func) \
/* \ /* \
* Force a reference to the function so the compiler generates \ * Force a reference to the function so the compiler generates \

2
include/linux/compiler.h
View File

@ -248,7 +248,7 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
#endif /* __KERNEL__ */ #endif /* __KERNEL__ */
#if defined(CONFIG_CFI_CLANG) && !defined(__DISABLE_EXPORTS) && !defined(BUILD_VDSO) #if defined(CONFIG_CFI) && !defined(__DISABLE_EXPORTS) && !defined(BUILD_VDSO)
/* /*
* Force a reference to the external symbol so the compiler generates * Force a reference to the external symbol so the compiler generates
* __kcfi_typid. * __kcfi_typid.

4
init/Kconfig
View File

@ -2063,8 +2063,8 @@ config RUST
depends on !GCC_PLUGIN_RANDSTRUCT depends on !GCC_PLUGIN_RANDSTRUCT
depends on !RANDSTRUCT depends on !RANDSTRUCT
depends on !DEBUG_INFO_BTF || (PAHOLE_HAS_LANG_EXCLUDE && !LTO) depends on !DEBUG_INFO_BTF || (PAHOLE_HAS_LANG_EXCLUDE && !LTO)
depends on !CFI_CLANG || HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC depends on !CFI || HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC
select CFI_ICALL_NORMALIZE_INTEGERS if CFI_CLANG select CFI_ICALL_NORMALIZE_INTEGERS if CFI
depends on !CALL_PADDING || RUSTC_VERSION >= 108100 depends on !CALL_PADDING || RUSTC_VERSION >= 108100
depends on !KASAN_SW_TAGS depends on !KASAN_SW_TAGS
depends on !(MITIGATION_RETHUNK && KASAN) || RUSTC_VERSION >= 108300 depends on !(MITIGATION_RETHUNK && KASAN) || RUSTC_VERSION >= 108300

2
kernel/Makefile
View File

@ -122,7 +122,7 @@ obj-$(CONFIG_KCSAN) += kcsan/
obj-$(CONFIG_SHADOW_CALL_STACK) += scs.o obj-$(CONFIG_SHADOW_CALL_STACK) += scs.o
obj-$(CONFIG_HAVE_STATIC_CALL) += static_call.o obj-$(CONFIG_HAVE_STATIC_CALL) += static_call.o
obj-$(CONFIG_HAVE_STATIC_CALL_INLINE) += static_call_inline.o obj-$(CONFIG_HAVE_STATIC_CALL_INLINE) += static_call_inline.o
obj-$(CONFIG_CFI_CLANG) += cfi.o obj-$(CONFIG_CFI) += cfi.o
obj-$(CONFIG_PERF_EVENTS) += events/ obj-$(CONFIG_PERF_EVENTS) += events/

4
kernel/configs/hardening.config
View File

@ -93,8 +93,8 @@ CONFIG_SECCOMP_FILTER=y
# Provides some protections against SYN flooding. # Provides some protections against SYN flooding.
CONFIG_SYN_COOKIES=y CONFIG_SYN_COOKIES=y
# Enable Kernel Control Flow Integrity (currently Clang only). # Enable Kernel Control Flow Integrity.
CONFIG_CFI_CLANG=y CONFIG_CFI=y
# CONFIG_CFI_PERMISSIVE is not set # CONFIG_CFI_PERMISSIVE is not set
# Attack surface reduction: do not autoload TTY line disciplines. # Attack surface reduction: do not autoload TTY line disciplines.

2
kernel/module/Kconfig
View File

@ -460,6 +460,6 @@ config UNUSED_KSYMS_WHITELIST
config MODULES_TREE_LOOKUP config MODULES_TREE_LOOKUP
def_bool y def_bool y
depends on PERF_EVENTS || TRACING || CFI_CLANG depends on PERF_EVENTS || TRACING || CFI
endif # MODULES endif # MODULES

2
kernel/module/tree_lookup.c
View File

@ -14,7 +14,7 @@
* Use a latched RB-tree for __module_address(); this allows us to use * Use a latched RB-tree for __module_address(); this allows us to use
* RCU lookups of the address from any context. * RCU lookups of the address from any context.
* *
* This is conditional on PERF_EVENTS || TRACING || CFI_CLANG because those can * This is conditional on PERF_EVENTS || TRACING || CFI because those can
* really hit __module_address() hard by doing a lot of stack unwinding; * really hit __module_address() hard by doing a lot of stack unwinding;
* potentially from NMI context. * potentially from NMI context.
*/ */

2
lib/Kconfig.debug
View File

@ -2894,7 +2894,7 @@ config FORTIFY_KUNIT_TEST
config LONGEST_SYM_KUNIT_TEST config LONGEST_SYM_KUNIT_TEST
tristate "Test the longest symbol possible" if !KUNIT_ALL_TESTS tristate "Test the longest symbol possible" if !KUNIT_ALL_TESTS
depends on KUNIT && KPROBES depends on KUNIT && KPROBES
depends on !PREFIX_SYMBOLS && !CFI_CLANG && !GCOV_KERNEL depends on !PREFIX_SYMBOLS && !CFI && !GCOV_KERNEL
default KUNIT_ALL_TESTS default KUNIT_ALL_TESTS
help help
Tests the longest symbol possible Tests the longest symbol possible

6
tools/include/linux/cfi_types.h
View File

@ -8,7 +8,7 @@
#ifdef __ASSEMBLY__ #ifdef __ASSEMBLY__
#include <linux/linkage.h> #include <linux/linkage.h>
#ifdef CONFIG_CFI_CLANG #ifdef CONFIG_CFI
/* /*
* Use the __kcfi_typeid_<function> type identifier symbol to * Use the __kcfi_typeid_<function> type identifier symbol to
* annotate indirectly called assembly functions. The compiler emits * annotate indirectly called assembly functions. The compiler emits
@ -29,12 +29,12 @@
#define SYM_TYPED_START(name, linkage, align...) \ #define SYM_TYPED_START(name, linkage, align...) \
SYM_TYPED_ENTRY(name, linkage, align) SYM_TYPED_ENTRY(name, linkage, align)
#else /* CONFIG_CFI_CLANG */ #else /* CONFIG_CFI */
#define SYM_TYPED_START(name, linkage, align...) \ #define SYM_TYPED_START(name, linkage, align...) \
SYM_START(name, linkage, align) SYM_START(name, linkage, align)
#endif /* CONFIG_CFI_CLANG */ #endif /* CONFIG_CFI */
#ifndef SYM_TYPED_FUNC_START #ifndef SYM_TYPED_FUNC_START
#define SYM_TYPED_FUNC_START(name) \ #define SYM_TYPED_FUNC_START(name) \

2
tools/perf/util/include/linux/linkage.h
View File

@ -120,7 +120,7 @@
#endif #endif
// In the kernel sources (include/linux/cfi_types.h), this has a different // In the kernel sources (include/linux/cfi_types.h), this has a different
// definition when CONFIG_CFI_CLANG is used, for tools/ just use the !clang // definition when CONFIG_CFI is used, for tools/ just use the !cfi
// definition: // definition:
#ifndef SYM_TYPED_START #ifndef SYM_TYPED_START
#define SYM_TYPED_START(name, linkage, align...) \ #define SYM_TYPED_START(name, linkage, align...) \