diff options
Diffstat (limited to 'include/linux/cfi.h')
| -rw-r--r-- | include/linux/cfi.h | 83 |
1 files changed, 64 insertions, 19 deletions
diff --git a/include/linux/cfi.h b/include/linux/cfi.h index 879744aaa6e0..1fd22ea6eba4 100644 --- a/include/linux/cfi.h +++ b/include/linux/cfi.h @@ -2,40 +2,85 @@ /* * Clang Control Flow Integrity (CFI) support. * - * Copyright (C) 2021 Google LLC + * Copyright (C) 2022 Google LLC */ #ifndef _LINUX_CFI_H #define _LINUX_CFI_H -#ifdef CONFIG_CFI_CLANG -typedef void (*cfi_check_fn)(uint64_t id, void *ptr, void *diag); +#include <linux/bug.h> +#include <linux/module.h> +#include <asm/cfi.h> -/* Compiler-generated function in each module, and the kernel */ -extern void __cfi_check(uint64_t id, void *ptr, void *diag); +#ifdef CONFIG_CFI +extern bool cfi_warn; +enum bug_trap_type report_cfi_failure(struct pt_regs *regs, unsigned long addr, + unsigned long *target, u32 type); + +static inline enum bug_trap_type report_cfi_failure_noaddr(struct pt_regs *regs, + unsigned long addr) +{ + return report_cfi_failure(regs, addr, NULL, 0); +} + +#ifndef cfi_get_offset /* - * Force the compiler to generate a CFI jump table entry for a function - * and store the jump table address to __cfi_jt_<function>. + * Returns the CFI prefix offset. By default, the compiler emits only + * a 4-byte CFI type hash before the function. If an architecture + * uses -fpatchable-function-entry=N,M where M>0 to change the prefix + * offset, they must override this function. */ -#define __CFI_ADDRESSABLE(fn, __attr) \ - const void *__cfi_jt_ ## fn __visible __attr = (void *)&fn +static inline int cfi_get_offset(void) +{ + return 4; +} +#endif -#ifdef CONFIG_CFI_CLANG_SHADOW +#ifndef cfi_get_func_hash +static inline u32 cfi_get_func_hash(void *func) +{ + u32 hash; -extern void cfi_module_add(struct module *mod, unsigned long base_addr); -extern void cfi_module_remove(struct module *mod, unsigned long base_addr); + if (get_kernel_nofault(hash, func - cfi_get_offset())) + return 0; -#else + return hash; +} +#endif + +/* CFI type hashes for BPF function types */ +extern u32 cfi_bpf_hash; +extern u32 cfi_bpf_subprog_hash; -static inline void cfi_module_add(struct module *mod, unsigned long base_addr) {} -static inline void cfi_module_remove(struct module *mod, unsigned long base_addr) {} +#else /* CONFIG_CFI */ -#endif /* CONFIG_CFI_CLANG_SHADOW */ +static inline int cfi_get_offset(void) { return 0; } +static inline u32 cfi_get_func_hash(void *func) { return 0; } -#else /* !CONFIG_CFI_CLANG */ +#define cfi_bpf_hash 0U +#define cfi_bpf_subprog_hash 0U -#define __CFI_ADDRESSABLE(fn, __attr) +#endif /* CONFIG_CFI */ + +#ifdef CONFIG_ARCH_USES_CFI_TRAPS +bool is_cfi_trap(unsigned long addr); +#else +static inline bool is_cfi_trap(unsigned long addr) { return false; } +#endif + +#ifdef CONFIG_MODULES +#ifdef CONFIG_ARCH_USES_CFI_TRAPS +void module_cfi_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs, + struct module *mod); +#else +static inline void module_cfi_finalize(const Elf_Ehdr *hdr, + const Elf_Shdr *sechdrs, + struct module *mod) {} +#endif /* CONFIG_ARCH_USES_CFI_TRAPS */ +#endif /* CONFIG_MODULES */ -#endif /* CONFIG_CFI_CLANG */ +#ifndef CFI_NOSEAL +#define CFI_NOSEAL(x) +#endif #endif /* _LINUX_CFI_H */ |