On Fri, Apr 16, 2021 at 2:18 PM Borislav Petkov <b...@alien8.de> wrote: > > On Fri, Apr 16, 2021 at 01:38:34PM -0700, Sami Tolvanen wrote: > > With CONFIG_CFI_CLANG, the compiler replaces function addresses in > > instrumented C code with jump table addresses. This change implements > > the function_nocfi() macro, which returns the actual function address > > instead. > > > > Signed-off-by: Sami Tolvanen <samitolva...@google.com> > > --- > > arch/x86/include/asm/page.h | 14 ++++++++++++++ > > 1 file changed, 14 insertions(+) > > > > diff --git a/arch/x86/include/asm/page.h b/arch/x86/include/asm/page.h > > index 7555b48803a8..5499a05c44fc 100644 > > --- a/arch/x86/include/asm/page.h > > +++ b/arch/x86/include/asm/page.h > > @@ -71,6 +71,20 @@ static inline void copy_user_page(void *to, void *from, > > unsigned long vaddr, > > extern bool __virt_addr_valid(unsigned long kaddr); > > #define virt_addr_valid(kaddr) __virt_addr_valid((unsigned long) > > (kaddr)) > > > > +#ifdef CONFIG_CFI_CLANG > > Almost every patch is talking about this magical config symbol but it > is nowhere to be found. How do I disable it, is there a Kconfig entry > somewhere, etc, etc?
As I mentioned in the cover letter, this series is based on linux-next. I forgot to include a link to the original patch series that adds CONFIG_CFI_CLANG, but I'll be sure to point to it in the next version. Sorry about the confusion. > > +/* > > + * With CONFIG_CFI_CLANG, the compiler replaces function address > > + * references with the address of the function's CFI jump table > > + * entry. The function_nocfi macro always returns the address of the > > + * actual function instead. > > + */ > > +#define function_nocfi(x) ({ \ > > + void *addr; \ > > + asm("leaq " __stringify(x) "(%%rip), %0\n\t" : "=r" (addr)); \ > > + addr; \ > > +}) > > Also, eww. > > It seems all these newfangled things we get, mean obfuscating code even > more. What's wrong with using __nocfi instead? That's nicely out of the > way so slap that in front of functions. __nocfi only disables CFI checking in a function, the compiler still changes function addresses to point to the CFI jump table, which is why we need function_nocfi(). > Also, did you even build this on, say, 32-bit allmodconfig? > > Oh well. > > In file included from ./include/linux/ftrace.h:22:0, > from ./include/linux/init_task.h:9, > from init/init_task.c:2: > ./include/linux/ftrace.h: In function ‘ftrace_init_nop’: > ./arch/x86/include/asm/ftrace.h:9:40: error: implicit declaration of function > ‘function_nocfi’ [-Werror=implicit-function-declaration] This is defined in linux-next, but I do see another issue, which I'll fix in v2. Note that CFI_CLANG itself cannot be selected on 32-bit x86. Sami