linuxmsm/laptops-kernel
0
0
Fork 0
mirror of https://github.com/linux-msm/laptops-kernel.git synced 2026-08-13 14:19:53 -07:00
Code Issues Packages Projects Releases Wiki Activity

kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI

Browse Source 
The kernel's CFI implementation uses the KCFI ABI specifically, and is
not strictly tied to a particular compiler. In preparation for GCC
supporting KCFI, rename CONFIG_CFI_CLANG to CONFIG_CFI (along with
associated options).

Use new "transitional" Kconfig option for old CONFIG_CFI_CLANG that will
enable CONFIG_CFI during olddefconfig.

Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Link: https://lore.kernel.org/r/20250923213422.1105654-3-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
This commit is contained in:
Kees Cook
2025-09-24 14:29:14 -07:00
parent f9afce4f32
commit 23ef9d4397
55 changed files with 100 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+1 -1
View File
@@ -1020,7 +1020,7 @@ KBUILD_AFLAGS += -fno-lto
export CC_FLAGS_LTO
endif
ifdef CONFIG_CFI_CLANG
ifdef CONFIG_CFI
CC_FLAGS_CFI := -fsanitize=kcfi
ifdef CONFIG_CFI_ICALL_NORMALIZE_INTEGERS
CC_FLAGS_CFI += -fsanitize-cfi-icall-experimental-normalize-integers
arch/Kconfig
+23 -13
View File
@@ -867,22 +867,26 @@ config PROPELLER_CLANG
If unsure, say N.
config ARCH_SUPPORTS_CFI_CLANG
config ARCH_SUPPORTS_CFI
bool
help
An architecture should select this option if it can support Clang's
Control-Flow Integrity (CFI) checking.
An architecture should select this option if it can support Kernel
Control-Flow Integrity (CFI) checking (-fsanitize=kcfi).
config ARCH_USES_CFI_TRAPS
bool
help
An architecture should select this option if it requires the
.kcfi_traps section for KCFI trap handling.
config CFI_CLANG
bool "Use Clang's Control Flow Integrity (CFI)"
depends on ARCH_SUPPORTS_CFI_CLANG
config CFI
bool "Use Kernel Control Flow Integrity (kCFI)"
default CFI_CLANG
depends on ARCH_SUPPORTS_CFI
depends on $(cc-option,-fsanitize=kcfi)
help
This option enables Clang's forward-edge Control Flow Integrity
(CFI) checking, where the compiler injects a runtime check to each
This option enables forward-edge Control Flow Integrity (CFI)
checking, where the compiler injects a runtime check to each
indirect function call to ensure the target is a valid function with
the correct static type. This restricts possible call targets and
makes it more difficult for an attacker to exploit bugs that allow
@@ -891,10 +895,16 @@ config CFI_CLANG
https://clang.llvm.org/docs/ControlFlowIntegrity.html
config CFI_CLANG
bool
transitional
help
Transitional config for CFI_CLANG to CFI migration.
config CFI_ICALL_NORMALIZE_INTEGERS
bool "Normalize CFI tags for integers"
depends on CFI_CLANG
depends on HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG
depends on CFI
depends on HAVE_CFI_ICALL_NORMALIZE_INTEGERS
help
This option normalizes the CFI tags for integer types so that all
integer types of the same size and signedness receive the same CFI
@@ -907,7 +917,7 @@ config CFI_ICALL_NORMALIZE_INTEGERS
This option is necessary for using CFI with Rust. If unsure, say N.
config HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG
config HAVE_CFI_ICALL_NORMALIZE_INTEGERS
def_bool y
depends on $(cc-option,-fsanitize=kcfi -fsanitize-cfi-icall-experimental-normalize-integers)
# With GCOV/KASAN we need this fix: https://github.com/llvm/llvm-project/pull/104826
@@ -915,7 +925,7 @@ config HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG
config HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC
def_bool y
depends on HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG
depends on HAVE_CFI_ICALL_NORMALIZE_INTEGERS
depends on RUSTC_VERSION >= 107900
# With GCOV/KASAN we need this fix: https://github.com/rust-lang/rust/pull/129373
depends on (RUSTC_LLVM_VERSION >= 190103 && RUSTC_VERSION >= 108200) || \
@@ -923,7 +933,7 @@ config HAVE_CFI_ICALL_NORMALIZE_INTEGERS_RUSTC
config CFI_PERMISSIVE
bool "Use CFI in permissive mode"
depends on CFI_CLANG
depends on CFI
help
When selected, Control Flow Integrity (CFI) violations result in a
warning instead of a kernel panic. This option should only be used
arch/arm/Kconfig
+1 -1
View File
@@ -38,7 +38,7 @@ config ARM
select ARCH_OPTIONAL_KERNEL_RWX_DEFAULT if CPU_V7
select ARCH_NEED_CMPXCHG_1_EMU if CPU_V6
select ARCH_SUPPORTS_ATOMIC_RMW
select ARCH_SUPPORTS_CFI_CLANG
select ARCH_SUPPORTS_CFI
select ARCH_SUPPORTS_HUGETLBFS if ARM_LPAE
select ARCH_SUPPORTS_PER_VMA_LOCK
select ARCH_USE_BUILTIN_BSWAP
arch/arm/kernel/hw_breakpoint.c
+1 -1
View File
@@ -904,7 +904,7 @@ unlock:
watchpoint_single_step_handler(addr);
}
#ifdef CONFIG_CFI_CLANG
#ifdef CONFIG_CFI
static void hw_breakpoint_cfi_handler(struct pt_regs *regs)
{
/*
arch/arm/mm/Makefile
+1 -1
View File
@@ -89,7 +89,7 @@ obj-$(CONFIG_CPU_V6) += proc-v6.o
obj-$(CONFIG_CPU_V6K) += proc-v6.o
obj-$(CONFIG_CPU_V7) += proc-v7.o proc-v7-bugs.o
obj-$(CONFIG_CPU_V7M) += proc-v7m.o
obj-$(CONFIG_CFI_CLANG) += proc.o
obj-$(CONFIG_CFI) += proc.o
obj-$(CONFIG_OUTER_CACHE) += l2c-common.o
obj-$(CONFIG_CACHE_B15_RAC) += cache-b15-rac.o
arch/arm/mm/cache-fa.S
+1 -1
View File
@@ -112,7 +112,7 @@ SYM_FUNC_END(fa_flush_user_cache_range)
* - end - virtual end address
*/
SYM_TYPED_FUNC_START(fa_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */
#ifdef CONFIG_CFI /* Fallthrough if !CFI */
b fa_coherent_user_range
#endif
SYM_FUNC_END(fa_coherent_kern_range)
arch/arm/mm/cache-v4.S
+1 -1
View File
@@ -104,7 +104,7 @@ SYM_FUNC_END(v4_coherent_user_range)
* - size - region size
*/
SYM_TYPED_FUNC_START(v4_flush_kern_dcache_area)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */
#ifdef CONFIG_CFI /* Fallthrough if !CFI */
b v4_dma_flush_range
#endif
SYM_FUNC_END(v4_flush_kern_dcache_area)
arch/arm/mm/cache-v4wb.S
+2 -2
View File
@@ -136,7 +136,7 @@ SYM_FUNC_END(v4wb_flush_user_cache_range)
*/
SYM_TYPED_FUNC_START(v4wb_flush_kern_dcache_area)
add r1, r0, r1
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */
#ifdef CONFIG_CFI /* Fallthrough if !CFI */
b v4wb_coherent_user_range
#endif
SYM_FUNC_END(v4wb_flush_kern_dcache_area)
@@ -152,7 +152,7 @@ SYM_FUNC_END(v4wb_flush_kern_dcache_area)
* - end - virtual end address
*/
SYM_TYPED_FUNC_START(v4wb_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */
#ifdef CONFIG_CFI /* Fallthrough if !CFI */
b v4wb_coherent_user_range
#endif
SYM_FUNC_END(v4wb_coherent_kern_range)
arch/arm/mm/cache-v4wt.S
+1 -1
View File
@@ -108,7 +108,7 @@ SYM_FUNC_END(v4wt_flush_user_cache_range)
* - end - virtual end address
*/
SYM_TYPED_FUNC_START(v4wt_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */
#ifdef CONFIG_CFI /* Fallthrough if !CFI */
b v4wt_coherent_user_range
#endif
SYM_FUNC_END(v4wt_coherent_kern_range)
arch/arm/mm/cache-v6.S
+1 -1
View File
@@ -117,7 +117,7 @@ SYM_FUNC_END(v6_flush_user_cache_range)
* - the Icache does not read data from the write buffer
*/
SYM_TYPED_FUNC_START(v6_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */
#ifdef CONFIG_CFI /* Fallthrough if !CFI */
b v6_coherent_user_range
#endif
SYM_FUNC_END(v6_coherent_kern_range)
arch/arm/mm/cache-v7.S
+1 -1
View File
@@ -261,7 +261,7 @@ SYM_FUNC_END(v7_flush_user_cache_range)
* - the Icache does not read data from the write buffer
*/
SYM_TYPED_FUNC_START(v7_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */
#ifdef CONFIG_CFI /* Fallthrough if !CFI */
b v7_coherent_user_range
#endif
SYM_FUNC_END(v7_coherent_kern_range)
arch/arm/mm/cache-v7m.S
+1 -1
View File
@@ -286,7 +286,7 @@ SYM_FUNC_END(v7m_flush_user_cache_range)
* - the Icache does not read data from the write buffer
*/
SYM_TYPED_FUNC_START(v7m_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */
#ifdef CONFIG_CFI /* Fallthrough if !CFI */
b v7m_coherent_user_range
#endif
SYM_FUNC_END(v7m_coherent_kern_range)
arch/arm/mm/proc-arm1020.S
+1 -1
View File
@@ -203,7 +203,7 @@ SYM_FUNC_END(arm1020_flush_user_cache_range)
* - end - virtual end address
*/
SYM_TYPED_FUNC_START(arm1020_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */
#ifdef CONFIG_CFI /* Fallthrough if !CFI */
b arm1020_coherent_user_range
#endif
SYM_FUNC_END(arm1020_coherent_kern_range)
arch/arm/mm/proc-arm1020e.S
+1 -1
View File
@@ -200,7 +200,7 @@ SYM_FUNC_END(arm1020e_flush_user_cache_range)
* - end - virtual end address
*/
SYM_TYPED_FUNC_START(arm1020e_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */
#ifdef CONFIG_CFI /* Fallthrough if !CFI */
b arm1020e_coherent_user_range
#endif
SYM_FUNC_END(arm1020e_coherent_kern_range)
arch/arm/mm/proc-arm1022.S
+1 -1
View File
@@ -199,7 +199,7 @@ SYM_FUNC_END(arm1022_flush_user_cache_range)
* - end - virtual end address
*/
SYM_TYPED_FUNC_START(arm1022_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */
#ifdef CONFIG_CFI /* Fallthrough if !CFI */
b arm1022_coherent_user_range
#endif
SYM_FUNC_END(arm1022_coherent_kern_range)
arch/arm/mm/proc-arm1026.S
+1 -1
View File
@@ -194,7 +194,7 @@ SYM_FUNC_END(arm1026_flush_user_cache_range)
* - end - virtual end address
*/
SYM_TYPED_FUNC_START(arm1026_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */
#ifdef CONFIG_CFI /* Fallthrough if !CFI */
b arm1026_coherent_user_range
#endif
SYM_FUNC_END(arm1026_coherent_kern_range)
arch/arm/mm/proc-arm920.S
+1 -1
View File
@@ -180,7 +180,7 @@ SYM_FUNC_END(arm920_flush_user_cache_range)
* - end - virtual end address
*/
SYM_TYPED_FUNC_START(arm920_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */
#ifdef CONFIG_CFI /* Fallthrough if !CFI */
b arm920_coherent_user_range
#endif
SYM_FUNC_END(arm920_coherent_kern_range)
arch/arm/mm/proc-arm922.S
+1 -1
View File
@@ -182,7 +182,7 @@ SYM_FUNC_END(arm922_flush_user_cache_range)
* - end - virtual end address
*/
SYM_TYPED_FUNC_START(arm922_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */
#ifdef CONFIG_CFI /* Fallthrough if !CFI */
b arm922_coherent_user_range
#endif
SYM_FUNC_END(arm922_coherent_kern_range)
arch/arm/mm/proc-arm925.S
+1 -1
View File
@@ -229,7 +229,7 @@ SYM_FUNC_END(arm925_flush_user_cache_range)
* - end - virtual end address
*/
SYM_TYPED_FUNC_START(arm925_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */
#ifdef CONFIG_CFI /* Fallthrough if !CFI */
b arm925_coherent_user_range
#endif
SYM_FUNC_END(arm925_coherent_kern_range)
arch/arm/mm/proc-arm926.S
+1 -1
View File
@@ -192,7 +192,7 @@ SYM_FUNC_END(arm926_flush_user_cache_range)
* - end - virtual end address
*/
SYM_TYPED_FUNC_START(arm926_coherent_kern_range)
#ifdef CONFIG_CFI_CLANG /* Fallthrough if !CFI */
#ifdef CONFIG_CFI /* Fallthrough if !CFI */
b arm926_coherent_user_range
#endif
SYM_FUNC_END(arm926_coherent_kern_range)

Some files were not shown because too many files have changed in this diff Show More