[PW_SID:995285] kcfi: Prepare for GCC support by linux-riscv-bot · Pull Request #831 · linux-riscv/linux

linux-riscv-bot · 2025-08-25T15:48:18Z

PR for series 995285 applied to workflow__riscv__fixes

Name: kcfi: Prepare for GCC support
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=995285
Version: 1

Prepare for GCC KCFI support and move the __nocfi attribute from compiler-clang.h to compiler_types.h. This was already effectively gated by CONFIG_CFI_CLANG, so this remains safe for non-KCFI GCC builds. Signed-off-by: Kees Cook <kees@outflux.net> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>

Just a nit-picky change to the KCFI indirect call check instruction documentation. The addl offset isn't always -4 (it depends on patchable function entry configuration). Signed-off-by: Kees Cook <kees@kernel.org> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>

Add "debug" option for "cfi=" bootparam to get details on early CFI initialization steps. Standardize CFI pr_info() lines to use "CFI:" prefix. Standardize "CFI: Using ..." to always report which CFI mode is being used, regardless of CONFIG_FINEIBT. Document all the "cfi=" options. Signed-off-by: Kees Cook <kees@outflux.net> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>

Commit 66f7930 ("x86/retpoline: Avoid retpolines for built-in __init functions") disabled retpolines in __init sections (__noinitretpoline) as a precaution against potential issues with retpolines in early boot, but it has not been a problem in practice (i.e. see Clang below). Commit 8735871 ("x86/retpoline: Support retpoline builds with Clang") narrowed this to only GCC, as Clang doesn't have per-function control over retpoline emission. As such, Clang has been booting with retpolines in __init since retpoline support was introduced. Clang KCFI has been instrumenting __init since CFI was introduced. With the introduction of KCFI for GCC, KCFI instrumentation with retpolines disabled means that objtool does not construct .retpoline_sites section entries for the non-retpoline KCFI calls. At boot, the KCFI rehashing code, via __apply_fineibt(), misses all __init KCFI calls (since they are not retpolines), resulting in immediate hash mismatches: all preambles are rehashed (via .cfi_sites) and none of the __init call sites are rehashed. Remove __noinitretpoline since it provides no meaningful utility and creates problems with CFI. Additionally remove __noretpoline since it is now unused. Alternatively, cfi_rand_callers() could walk the .kcfi_traps section which is exactly the list of KCFI instrumentation sites. But it seems better to have as few differences in common instruction sequences between compilers as possible, so better to remove the special handling of retpolines in __init for GCC. Signed-off-by: Kees Cook <kees@outflux.net> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>

The kernel's CFI implementation uses the KCFI ABI specifically, and is not strictly tied to a particular compiler. In preparation for GCC supporting KCFI[1], rename CONFIG_CFI_CLANG to CONFIG_CFI (along with associated options). Link: https://lore.kernel.org/linux-hardening/20250821064202.work.893-kees@kernel.org [1] Signed-off-by: Kees Cook <kees@outflux.net> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>

linux-riscv-bot · 2025-08-25T15:53:44Z

Patch 1: "[1/5] compiler_types.h: Move __nocfi out of compiler-specific header"
build-rv32-defconfig
Desc: Builds riscv32 defconfig
Duration: 103.71 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T16:22:42Z

Patch 1: "[1/5] compiler_types.h: Move __nocfi out of compiler-specific header"
build-rv64-clang-allmodconfig
Desc: Builds riscv64 allmodconfig with Clang, and checks for errors and added warnings
Duration: 1736.17 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T16:58:59Z

Patch 1: "[1/5] compiler_types.h: Move __nocfi out of compiler-specific header"
build-rv64-gcc-allmodconfig
Desc: Builds riscv64 allmodconfig with GCC, and checks for errors and added warnings
Duration: 2174.97 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T16:59:21Z

Patch 1: "[1/5] compiler_types.h: Move __nocfi out of compiler-specific header"
build-rv64-nommu-k210-defconfig
Desc: Builds riscv64 defconfig with NOMMU for K210
Duration: 20.59 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T16:59:44Z

Patch 1: "[1/5] compiler_types.h: Move __nocfi out of compiler-specific header"
build-rv64-nommu-k210-virt
Desc: Builds riscv64 defconfig with NOMMU for the virt platform
Duration: 21.86 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T16:59:47Z

Patch 1: "[1/5] compiler_types.h: Move __nocfi out of compiler-specific header"
checkpatch
Desc: Runs checkpatch.pl on the patch
Duration: 0.94 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T17:01:03Z

Patch 1: "[1/5] compiler_types.h: Move __nocfi out of compiler-specific header"
dtb-warn-rv64
Desc: Checks for Device Tree warnings/errors
Duration: 74.69 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T17:01:05Z

Patch 1: "[1/5] compiler_types.h: Move __nocfi out of compiler-specific header"
header-inline
Desc: Detects static functions without inline keyword in header files
Duration: 0.22 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T17:01:07Z

Patch 1: "[1/5] compiler_types.h: Move __nocfi out of compiler-specific header"
kdoc
Desc: Detects for kdoc errors
Duration: 0.87 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T17:01:09Z

Patch 1: "[1/5] compiler_types.h: Move __nocfi out of compiler-specific header"
module-param
Desc: Detect module_param changes
Duration: 0.25 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T17:01:11Z

Patch 1: "[1/5] compiler_types.h: Move __nocfi out of compiler-specific header"
verify-fixes
Desc: Verifies that the Fixes: tags exist
Duration: 0.21 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T17:01:13Z

Patch 1: "[1/5] compiler_types.h: Move __nocfi out of compiler-specific header"
verify-signedoff
Desc: Verifies that Signed-off-by: tags are correct
Duration: 0.29 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T17:03:11Z

Patch 2: "[2/5] x86/traps: Clarify KCFI instruction layout"
build-rv32-defconfig
Desc: Builds riscv32 defconfig
Duration: 103.60 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T17:20:21Z

Patch 2: "[2/5] x86/traps: Clarify KCFI instruction layout"
build-rv64-clang-allmodconfig
Desc: Builds riscv64 allmodconfig with Clang, and checks for errors and added warnings
Duration: 1028.44 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T17:42:22Z

Patch 2: "[2/5] x86/traps: Clarify KCFI instruction layout"
build-rv64-gcc-allmodconfig
Desc: Builds riscv64 allmodconfig with GCC, and checks for errors and added warnings
Duration: 1319.04 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T17:42:44Z

Patch 2: "[2/5] x86/traps: Clarify KCFI instruction layout"
build-rv64-nommu-k210-defconfig
Desc: Builds riscv64 defconfig with NOMMU for K210
Duration: 20.70 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T17:43:07Z

Patch 2: "[2/5] x86/traps: Clarify KCFI instruction layout"
build-rv64-nommu-k210-virt
Desc: Builds riscv64 defconfig with NOMMU for the virt platform
Duration: 21.86 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T17:43:09Z

Patch 2: "[2/5] x86/traps: Clarify KCFI instruction layout"
checkpatch
Desc: Runs checkpatch.pl on the patch
Duration: 0.70 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T17:44:25Z

Patch 2: "[2/5] x86/traps: Clarify KCFI instruction layout"
dtb-warn-rv64
Desc: Checks for Device Tree warnings/errors
Duration: 74.02 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T17:44:27Z

Patch 2: "[2/5] x86/traps: Clarify KCFI instruction layout"
header-inline
Desc: Detects static functions without inline keyword in header files
Duration: 0.22 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T17:44:29Z

Patch 2: "[2/5] x86/traps: Clarify KCFI instruction layout"
kdoc
Desc: Detects for kdoc errors
Duration: 0.83 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T17:44:31Z

Patch 2: "[2/5] x86/traps: Clarify KCFI instruction layout"
module-param
Desc: Detect module_param changes
Duration: 0.24 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T17:44:32Z

Patch 2: "[2/5] x86/traps: Clarify KCFI instruction layout"
verify-fixes
Desc: Verifies that the Fixes: tags exist
Duration: 0.21 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T17:44:34Z

Patch 2: "[2/5] x86/traps: Clarify KCFI instruction layout"
verify-signedoff
Desc: Verifies that Signed-off-by: tags are correct
Duration: 0.29 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T17:46:34Z

Patch 3: "[3/5] x86/cfi: Add option for cfi=debug bootparam"
build-rv32-defconfig
Desc: Builds riscv32 defconfig
Duration: 103.65 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T18:27:52Z

Patch 3: "[3/5] x86/cfi: Add option for cfi=debug bootparam"
kdoc
Desc: Detects for kdoc errors
Duration: 0.93 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T18:27:53Z

Patch 3: "[3/5] x86/cfi: Add option for cfi=debug bootparam"
module-param
Desc: Detect module_param changes
Duration: 0.28 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T18:27:55Z

Patch 3: "[3/5] x86/cfi: Add option for cfi=debug bootparam"
verify-fixes
Desc: Verifies that the Fixes: tags exist
Duration: 0.22 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T18:27:57Z

Patch 3: "[3/5] x86/cfi: Add option for cfi=debug bootparam"
verify-signedoff
Desc: Verifies that Signed-off-by: tags are correct
Duration: 0.30 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T18:29:55Z

Patch 4: "[4/5] x86/cfi: Remove __noinitretpoline and __noretpoline"
build-rv32-defconfig
Desc: Builds riscv32 defconfig
Duration: 102.81 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T19:07:52Z

Patch 4: "[4/5] x86/cfi: Remove __noinitretpoline and __noretpoline"
build-rv64-clang-allmodconfig
Desc: Builds riscv64 allmodconfig with Clang, and checks for errors and added warnings
Duration: 2275.83 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T19:55:58Z

Patch 4: "[4/5] x86/cfi: Remove __noinitretpoline and __noretpoline"
build-rv64-gcc-allmodconfig
Desc: Builds riscv64 allmodconfig with GCC, and checks for errors and added warnings
Duration: 2884.88 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T19:56:21Z

Patch 4: "[4/5] x86/cfi: Remove __noinitretpoline and __noretpoline"
build-rv64-nommu-k210-defconfig
Desc: Builds riscv64 defconfig with NOMMU for K210
Duration: 20.74 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T19:56:45Z

Patch 4: "[4/5] x86/cfi: Remove __noinitretpoline and __noretpoline"
build-rv64-nommu-k210-virt
Desc: Builds riscv64 defconfig with NOMMU for the virt platform
Duration: 22.45 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T19:56:47Z

Patch 4: "[4/5] x86/cfi: Remove __noinitretpoline and __noretpoline"
checkpatch
Desc: Runs checkpatch.pl on the patch
Duration: 0.92 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T19:58:03Z

Patch 4: "[4/5] x86/cfi: Remove __noinitretpoline and __noretpoline"
dtb-warn-rv64
Desc: Checks for Device Tree warnings/errors
Duration: 74.18 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T19:58:05Z

Patch 4: "[4/5] x86/cfi: Remove __noinitretpoline and __noretpoline"
header-inline
Desc: Detects static functions without inline keyword in header files
Duration: 0.25 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T19:58:07Z

Patch 4: "[4/5] x86/cfi: Remove __noinitretpoline and __noretpoline"
kdoc
Desc: Detects for kdoc errors
Duration: 0.89 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T19:58:10Z

Patch 4: "[4/5] x86/cfi: Remove __noinitretpoline and __noretpoline"
module-param
Desc: Detect module_param changes
Duration: 0.27 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T19:58:12Z

Patch 4: "[4/5] x86/cfi: Remove __noinitretpoline and __noretpoline"
verify-fixes
Desc: Verifies that the Fixes: tags exist
Duration: 0.24 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T19:58:14Z

Patch 4: "[4/5] x86/cfi: Remove __noinitretpoline and __noretpoline"
verify-signedoff
Desc: Verifies that Signed-off-by: tags are correct
Duration: 0.55 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T20:00:12Z

Patch 5: "[5/5] kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI"
build-rv32-defconfig
Desc: Builds riscv32 defconfig
Duration: 103.10 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T20:42:27Z

Patch 5: "[5/5] kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI"
build-rv64-clang-allmodconfig
Desc: Builds riscv64 allmodconfig with Clang, and checks for errors and added warnings
Duration: 2533.11 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T21:18:57Z

Patch 5: "[5/5] kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI"
build-rv64-gcc-allmodconfig
Desc: Builds riscv64 allmodconfig with GCC, and checks for errors and added warnings
Duration: 2188.21 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T21:19:19Z

Patch 5: "[5/5] kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI"
build-rv64-nommu-k210-defconfig
Desc: Builds riscv64 defconfig with NOMMU for K210
Duration: 20.69 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T21:19:42Z

Patch 5: "[5/5] kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI"
build-rv64-nommu-k210-virt
Desc: Builds riscv64 defconfig with NOMMU for the virt platform
Duration: 21.87 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T21:19:55Z

Patch 5: "[5/5] kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI"
checkpatch
Desc: Runs checkpatch.pl on the patch
Duration: 11.88 seconds
Result: WARNING
Output:

WARNING: please write a help paragraph that fully describes the config symbol with at least 4 lines
#106: FILE: arch/Kconfig:879:
+config CFI
+	bool "Use Kernel Control Flow Integrity (kCFI)"
+	depends on ARCH_SUPPORTS_CFI
 	depends on $(cc-option,-fsanitize=kcfi)
 	help
+	  This option enables forward-edge Control Flow Integrity (CFI)
+	  This option enables forward-edge Control Flow Integrity (CFI)
+	  This option enables forward-edge Control Flow Integrity (CFI)
+	  checking, where the compiler injects a runtime check to each
 	  indirect function call to ensure the target is a valid function with
 	  the correct static type. This restricts possible call targets and
 	  makes it more difficult for an attacker to exploit bugs that allow

total: 0 errors, 1 warnings, 0 checks, 655 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

Commit 28eea643cade ("kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI") has style problems, please review.

NOTE: Ignored message types: ALLOC_SIZEOF_STRUCT CAMELCASE COMMIT_LOG_LONG_LINE GIT_COMMIT_ID MACRO_ARG_REUSE NO_AUTHOR_SIGN_OFF

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.
total: 0 errors, 1 warnings, 0 checks, 655 lines checked
WARNING: please write a help paragraph that fully describes the config symbol with at least 4 lines

linux-riscv-bot · 2025-08-25T21:21:12Z

Patch 5: "[5/5] kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI"
dtb-warn-rv64
Desc: Checks for Device Tree warnings/errors
Duration: 75.12 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T21:21:13Z

Patch 5: "[5/5] kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI"
header-inline
Desc: Detects static functions without inline keyword in header files
Duration: 0.27 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T21:21:18Z

Patch 5: "[5/5] kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI"
kdoc
Desc: Detects for kdoc errors
Duration: 3.19 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T21:21:20Z

Patch 5: "[5/5] kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI"
module-param
Desc: Detect module_param changes
Duration: 0.41 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T21:21:21Z

Patch 5: "[5/5] kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI"
verify-fixes
Desc: Verifies that the Fixes: tags exist
Duration: 0.28 seconds
Result: PASS

linux-riscv-bot · 2025-08-25T21:21:23Z

Patch 5: "[5/5] kcfi: Rename CONFIG_CFI_CLANG to CONFIG_CFI"
verify-signedoff
Desc: Verifies that Signed-off-by: tags are correct
Duration: 0.31 seconds
Result: PASS

kees and others added 5 commits August 25, 2025 15:48

linux-riscv-bot closed this Sep 2, 2025

linux-riscv-bot deleted the pw995285 branch September 2, 2025 01:02

Uh oh!

Conversation

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!

linux-riscv-bot commented Aug 25, 2025

Uh oh!