summaryrefslogtreecommitdiffstats
path: root/arch/Kconfig
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2022-10-03 17:11:07 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2022-10-03 17:11:07 -0700
commit865dad2022c52ac6c5c9a87c5cec78a69f633fb6 (patch)
tree12cbd2fec8623d506d4a444129d68cddbd1c2223 /arch/Kconfig
parent12ed00ba01abf39e0869c02ccdde5e24a357466b (diff)
parent3c516f89e17e56b4738f05588e51267e295b5e63 (diff)
downloadlinux-865dad2022c52ac6c5c9a87c5cec78a69f633fb6.tar.gz
linux-865dad2022c52ac6c5c9a87c5cec78a69f633fb6.tar.bz2
linux-865dad2022c52ac6c5c9a87c5cec78a69f633fb6.zip
Merge tag 'kcfi-v6.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull kcfi updates from Kees Cook: "This replaces the prior support for Clang's standard Control Flow Integrity (CFI) instrumentation, which has required a lot of special conditions (e.g. LTO) and work-arounds. The new implementation ("Kernel CFI") is specific to C, directly designed for the Linux kernel, and takes advantage of architectural features like x86's IBT. This series retains arm64 support and adds x86 support. GCC support is expected in the future[1], and additional "generic" architectural support is expected soon[2]. Summary: - treewide: Remove old CFI support details - arm64: Replace Clang CFI support with Clang KCFI support - x86: Introduce Clang KCFI support" Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107048 [1] Link: https://github.com/samitolvanen/llvm-project/commits/kcfi_generic [2] * tag 'kcfi-v6.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (22 commits) x86: Add support for CONFIG_CFI_CLANG x86/purgatory: Disable CFI x86: Add types to indirectly called assembly functions x86/tools/relocs: Ignore __kcfi_typeid_ relocations kallsyms: Drop CONFIG_CFI_CLANG workarounds objtool: Disable CFI warnings objtool: Preserve special st_shndx indexes in elf_update_symbol treewide: Drop __cficanonical treewide: Drop WARN_ON_FUNCTION_MISMATCH treewide: Drop function_nocfi init: Drop __nocfi from __init arm64: Drop unneeded __nocfi attributes arm64: Add CFI error handling arm64: Add types to indirect called assembly functions psci: Fix the function type for psci_initcall_t lkdtm: Emit an indirect call for CFI tests cfi: Add type helper macros cfi: Switch to -fsanitize=kcfi cfi: Drop __CFI_ADDRESSABLE cfi: Remove CONFIG_CFI_CLANG_SHADOW ...
Diffstat (limited to 'arch/Kconfig')
-rw-r--r--arch/Kconfig18
1 files changed, 5 insertions, 13 deletions
diff --git a/arch/Kconfig b/arch/Kconfig
index d9b4ae0fc805..266862428a84 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -744,11 +744,13 @@ config ARCH_SUPPORTS_CFI_CLANG
An architecture should select this option if it can support Clang's
Control-Flow Integrity (CFI) checking.
+config ARCH_USES_CFI_TRAPS
+ bool
+
config CFI_CLANG
bool "Use Clang's Control Flow Integrity (CFI)"
- depends on LTO_CLANG && ARCH_SUPPORTS_CFI_CLANG
- depends on CLANG_VERSION >= 140000
- select KALLSYMS
+ depends on ARCH_SUPPORTS_CFI_CLANG
+ depends on $(cc-option,-fsanitize=kcfi)
help
This option enables Clang’s forward-edge Control Flow Integrity
(CFI) checking, where the compiler injects a runtime check to each
@@ -760,16 +762,6 @@ config CFI_CLANG
https://clang.llvm.org/docs/ControlFlowIntegrity.html
-config CFI_CLANG_SHADOW
- bool "Use CFI shadow to speed up cross-module checks"
- default y
- depends on CFI_CLANG && MODULES
- help
- If you select this option, the kernel builds a fast look-up table of
- CFI check functions in loaded modules to reduce performance overhead.
-
- If unsure, say Y.
-
config CFI_PERMISSIVE
bool "Use CFI in permissive mode"
depends on CFI_CLANG