Clang 14 added support for the __builtin_function_start function,
which allows us to implement the function_nocfi macro without
architecture-specific inline assembly and in a way that also works
with static initializers.
Change CONFIG_CFI_CLANG to depend on Clang >= 14, define
function_nocfi using __builtin_function_start, and remove the arm64
inline assembly implementation.
Link: https://github.com/llvm/llvm-project/commit/ec2e26eaf63558934f5b73a6e530edc453cf9508
Link: https://github.com/ClangBuiltLinux/linux/issues/1353
Signed-off-by: Sami Tolvanen <[email protected]>
Reviewed-by: Nick Desaulniers <[email protected]>
Reviewed-by: Mark Rutland <[email protected]>
Tested-by: Mark Rutland <[email protected]>
Acked-by: Will Deacon <[email protected]> # arm64
---
v2:
- Changed CFI_CLANG to depend on Clang 14 instead of
__builtin_function_start.
- Squashed all three patches into one.
---
arch/Kconfig | 5 +----
arch/arm64/include/asm/compiler.h | 16 ----------------
include/linux/compiler-clang.h | 10 ++++++++++
3 files changed, 11 insertions(+), 20 deletions(-)
diff --git a/arch/Kconfig b/arch/Kconfig
index 29b0167c088b..c1627bce4a3a 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -723,10 +723,7 @@ config ARCH_SUPPORTS_CFI_CLANG
config CFI_CLANG
bool "Use Clang's Control Flow Integrity (CFI)"
depends on LTO_CLANG && ARCH_SUPPORTS_CFI_CLANG
- # Clang >= 12:
- # - https://bugs.llvm.org/show_bug.cgi?id=46258
- # - https://bugs.llvm.org/show_bug.cgi?id=47479
- depends on CLANG_VERSION >= 120000
+ depends on CLANG_VERSION >= 140000
select KALLSYMS
help
This option enables Clang’s forward-edge Control Flow Integrity
diff --git a/arch/arm64/include/asm/compiler.h b/arch/arm64/include/asm/compiler.h
index dc3ea4080e2e..6fb2e6bcc392 100644
--- a/arch/arm64/include/asm/compiler.h
+++ b/arch/arm64/include/asm/compiler.h
@@ -23,20 +23,4 @@
#define __builtin_return_address(val) \
(void *)(ptrauth_clear_pac((unsigned long)__builtin_return_address(val)))
-#ifdef CONFIG_CFI_CLANG
-/*
- * With CONFIG_CFI_CLANG, the compiler replaces function address
- * references with the address of the function's CFI jump table
- * entry. The function_nocfi macro always returns the address of the
- * actual function instead.
- */
-#define function_nocfi(x) ({ \
- void *addr; \
- asm("adrp %0, " __stringify(x) "\n\t" \
- "add %0, %0, :lo12:" __stringify(x) \
- : "=r" (addr)); \
- addr; \
-})
-#endif
-
#endif /* __ASM_COMPILER_H */
diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
index babb1347148c..c84fec767445 100644
--- a/include/linux/compiler-clang.h
+++ b/include/linux/compiler-clang.h
@@ -69,6 +69,16 @@
#define __nocfi __attribute__((__no_sanitize__("cfi")))
#define __cficanonical __attribute__((__cfi_canonical_jump_table__))
+#if defined(CONFIG_CFI_CLANG)
+/*
+ * With CONFIG_CFI_CLANG, the compiler replaces function address
+ * references with the address of the function's CFI jump table
+ * entry. The function_nocfi macro always returns the address of the
+ * actual function instead.
+ */
+#define function_nocfi(x) __builtin_function_start(x)
+#endif
+
/*
* Turn individual warnings and errors on and off locally, depending
* on version.
--
2.35.1.1094.g7c7d902a7c-goog
On Tue, Apr 05, 2022 at 03:16:18PM -0700, Sami Tolvanen wrote:
> Clang 14 added support for the __builtin_function_start function,
> which allows us to implement the function_nocfi macro without
> architecture-specific inline assembly and in a way that also works
> with static initializers.
>
> Change CONFIG_CFI_CLANG to depend on Clang >= 14, define
> function_nocfi using __builtin_function_start, and remove the arm64
> inline assembly implementation.
>
> Link: https://github.com/llvm/llvm-project/commit/ec2e26eaf63558934f5b73a6e530edc453cf9508
> Link: https://github.com/ClangBuiltLinux/linux/issues/1353
> Signed-off-by: Sami Tolvanen <[email protected]>
> Reviewed-by: Nick Desaulniers <[email protected]>
> Reviewed-by: Mark Rutland <[email protected]>
> Tested-by: Mark Rutland <[email protected]>
> Acked-by: Will Deacon <[email protected]> # arm64
Reviewed-by: Nathan Chancellor <[email protected]>
> ---
> v2:
> - Changed CFI_CLANG to depend on Clang 14 instead of
> __builtin_function_start.
> - Squashed all three patches into one.
>
> ---
> arch/Kconfig | 5 +----
> arch/arm64/include/asm/compiler.h | 16 ----------------
> include/linux/compiler-clang.h | 10 ++++++++++
> 3 files changed, 11 insertions(+), 20 deletions(-)
>
> diff --git a/arch/Kconfig b/arch/Kconfig
> index 29b0167c088b..c1627bce4a3a 100644
> --- a/arch/Kconfig
> +++ b/arch/Kconfig
> @@ -723,10 +723,7 @@ config ARCH_SUPPORTS_CFI_CLANG
> config CFI_CLANG
> bool "Use Clang's Control Flow Integrity (CFI)"
> depends on LTO_CLANG && ARCH_SUPPORTS_CFI_CLANG
> - # Clang >= 12:
> - # - https://bugs.llvm.org/show_bug.cgi?id=46258
> - # - https://bugs.llvm.org/show_bug.cgi?id=47479
> - depends on CLANG_VERSION >= 120000
> + depends on CLANG_VERSION >= 140000
> select KALLSYMS
> help
> This option enables Clang’s forward-edge Control Flow Integrity
> diff --git a/arch/arm64/include/asm/compiler.h b/arch/arm64/include/asm/compiler.h
> index dc3ea4080e2e..6fb2e6bcc392 100644
> --- a/arch/arm64/include/asm/compiler.h
> +++ b/arch/arm64/include/asm/compiler.h
> @@ -23,20 +23,4 @@
> #define __builtin_return_address(val) \
> (void *)(ptrauth_clear_pac((unsigned long)__builtin_return_address(val)))
>
> -#ifdef CONFIG_CFI_CLANG
> -/*
> - * With CONFIG_CFI_CLANG, the compiler replaces function address
> - * references with the address of the function's CFI jump table
> - * entry. The function_nocfi macro always returns the address of the
> - * actual function instead.
> - */
> -#define function_nocfi(x) ({ \
> - void *addr; \
> - asm("adrp %0, " __stringify(x) "\n\t" \
> - "add %0, %0, :lo12:" __stringify(x) \
> - : "=r" (addr)); \
> - addr; \
> -})
> -#endif
> -
> #endif /* __ASM_COMPILER_H */
> diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h
> index babb1347148c..c84fec767445 100644
> --- a/include/linux/compiler-clang.h
> +++ b/include/linux/compiler-clang.h
> @@ -69,6 +69,16 @@
> #define __nocfi __attribute__((__no_sanitize__("cfi")))
> #define __cficanonical __attribute__((__cfi_canonical_jump_table__))
>
> +#if defined(CONFIG_CFI_CLANG)
> +/*
> + * With CONFIG_CFI_CLANG, the compiler replaces function address
> + * references with the address of the function's CFI jump table
> + * entry. The function_nocfi macro always returns the address of the
> + * actual function instead.
> + */
> +#define function_nocfi(x) __builtin_function_start(x)
> +#endif
> +
> /*
> * Turn individual warnings and errors on and off locally, depending
> * on version.
> --
> 2.35.1.1094.g7c7d902a7c-goog
>
On Tue, 5 Apr 2022 15:16:18 -0700, Sami Tolvanen wrote:
> Clang 14 added support for the __builtin_function_start function,
> which allows us to implement the function_nocfi macro without
> architecture-specific inline assembly and in a way that also works
> with static initializers.
>
> Change CONFIG_CFI_CLANG to depend on Clang >= 14, define
> function_nocfi using __builtin_function_start, and remove the arm64
> inline assembly implementation.
>
> [...]
Applied to for-next/hardening, thanks!
[1/1] cfi: Use __builtin_function_start
https://git.kernel.org/kees/c/e6f3b3c9c109
--
Kees Cook