1 /* SPDX-License-Identifier: GPL-2.0 */
2 #ifndef _ASM_X86_CFI_H
3 #define _ASM_X86_CFI_H
4
5 /*
6 * Clang Control Flow Integrity (CFI) support.
7 *
8 * Copyright (C) 2022 Google LLC
9 */
10 #include <linux/bug.h>
11 #include <asm/ibt.h>
12
13 /*
14 * An overview of the various calling conventions...
15 *
16 * Traditional:
17 *
18 * foo:
19 * ... code here ...
20 * ret
21 *
22 * direct caller:
23 * call foo
24 *
25 * indirect caller:
26 * lea foo(%rip), %r11
27 * ...
28 * call *%r11
29 *
30 *
31 * IBT:
32 *
33 * foo:
34 * endbr64
35 * ... code here ...
36 * ret
37 *
38 * direct caller:
39 * call foo / call foo+4
40 *
41 * indirect caller:
42 * lea foo(%rip), %r11
43 * ...
44 * call *%r11
45 *
46 *
47 * kCFI:
48 *
49 * __cfi_foo:
50 * movl $0x12345678, %eax
51 * # 11 nops when CONFIG_CALL_PADDING
52 * foo:
53 * endbr64 # when IBT
54 * ... code here ...
55 * ret
56 *
57 * direct call:
58 * call foo # / call foo+4 when IBT
59 *
60 * indirect call:
61 * lea foo(%rip), %r11
62 * ...
63 * movl $(-0x12345678), %r10d
64 * addl -4(%r11), %r10d # -15 when CONFIG_CALL_PADDING
65 * jz 1f
66 * ud2
67 * 1:call *%r11
68 *
69 *
70 * FineIBT (builds as kCFI + CALL_PADDING + IBT + RETPOLINE and runtime patches into):
71 *
72 * __cfi_foo:
73 * endbr64
74 * subl 0x12345678, %r10d
75 * jz foo
76 * ud2
77 * nop
78 * foo:
79 * osp nop3 # was endbr64
80 * ... code here ...
81 * ret
82 *
83 * direct caller:
84 * call foo / call foo+4
85 *
86 * indirect caller:
87 * lea foo(%rip), %r11
88 * ...
89 * movl $0x12345678, %r10d
90 * subl $16, %r11
91 * nop4
92 * call *%r11
93 *
94 */
95 enum cfi_mode {
96 CFI_AUTO, /* FineIBT if hardware has IBT, otherwise kCFI */
97 CFI_OFF, /* Taditional / IBT depending on .config */
98 CFI_KCFI, /* Optionally CALL_PADDING, IBT, RETPOLINE */
99 CFI_FINEIBT, /* see arch/x86/kernel/alternative.c */
100 };
101
102 extern enum cfi_mode cfi_mode;
103
104 #ifdef CONFIG_FINEIBT_BHI
105 extern bool cfi_bhi;
106 #else
107 #define cfi_bhi (0)
108 #endif
109
110 typedef u8 bhi_thunk[32];
111 extern bhi_thunk __bhi_args[];
112 extern bhi_thunk __bhi_args_end[];
113
114 struct pt_regs;
115
116 #ifdef CONFIG_CFI_CLANG
117 enum bug_trap_type handle_cfi_failure(struct pt_regs *regs);
118 #define __bpfcall
119 extern u32 cfi_bpf_hash;
120 extern u32 cfi_bpf_subprog_hash;
121
cfi_get_offset(void)122 static inline int cfi_get_offset(void)
123 {
124 switch (cfi_mode) {
125 case CFI_FINEIBT:
126 return 16;
127 case CFI_KCFI:
128 if (IS_ENABLED(CONFIG_CALL_PADDING))
129 return 16;
130 return 5;
131 default:
132 return 0;
133 }
134 }
135 #define cfi_get_offset cfi_get_offset
136
137 extern u32 cfi_get_func_hash(void *func);
138 extern int cfi_get_func_arity(void *func);
139
140 #ifdef CONFIG_FINEIBT
141 extern bool decode_fineibt_insn(struct pt_regs *regs, unsigned long *target, u32 *type);
142 #else
143 static inline bool
decode_fineibt_insn(struct pt_regs * regs,unsigned long * target,u32 * type)144 decode_fineibt_insn(struct pt_regs *regs, unsigned long *target, u32 *type)
145 {
146 return false;
147 }
148
149 #endif
150
151 #else
handle_cfi_failure(struct pt_regs * regs)152 static inline enum bug_trap_type handle_cfi_failure(struct pt_regs *regs)
153 {
154 return BUG_TRAP_TYPE_NONE;
155 }
156 #define cfi_bpf_hash 0U
157 #define cfi_bpf_subprog_hash 0U
cfi_get_func_hash(void * func)158 static inline u32 cfi_get_func_hash(void *func)
159 {
160 return 0;
161 }
cfi_get_func_arity(void * func)162 static inline int cfi_get_func_arity(void *func)
163 {
164 return 0;
165 }
166 #endif /* CONFIG_CFI_CLANG */
167
168 #if HAS_KERNEL_IBT == 1
169 #define CFI_NOSEAL(x) asm(IBT_NOSEAL(__stringify(x)))
170 #endif
171
172 #endif /* _ASM_X86_CFI_H */
173