add support for Clang CFI

[linux-2.6-block.git] / arch / Kconfig

diff --git a/arch/Kconfig b/arch/Kconfig
index 2bb30673d8e6fbd5e7c3d41e8fe0800020c0f779..f6a85ba6cba2a1a651dd21273bdf06a292f41138 100644 (file)
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -632,13 +632,12 @@ config HAS_LTO_CLANG
        def_bool y
        # Clang >= 11: https://github.com/ClangBuiltLinux/linux/issues/510
        depends on CC_IS_CLANG && CLANG_VERSION >= 110000 && LD_IS_LLD
-       depends on $(success,test $(LLVM) -eq 1)
        depends on $(success,test $(LLVM_IAS) -eq 1)
        depends on $(success,$(NM) --help | head -n 1 | grep -qi llvm)
        depends on $(success,$(AR) --help | head -n 1 | grep -qi llvm)
        depends on ARCH_SUPPORTS_LTO_CLANG
        depends on !FTRACE_MCOUNT_USE_RECORDMCOUNT
-       depends on !KASAN
+       depends on !KASAN || KASAN_HW_TAGS
        depends on !GCOV_KERNEL
        help
          The compiler and Kconfig options support building with Clang's
@@ -693,6 +692,51 @@ config LTO_CLANG_THIN
          If unsure, say Y.
 endchoice
 
+config ARCH_SUPPORTS_CFI_CLANG
+       bool
+       help
+         An architecture should select this option if it can support Clang's
+         Control-Flow Integrity (CFI) checking.
+
+config CFI_CLANG
+       bool "Use Clang's Control Flow Integrity (CFI)"
+       depends on LTO_CLANG && ARCH_SUPPORTS_CFI_CLANG
+       # Clang >= 12:
+       # - https://bugs.llvm.org/show_bug.cgi?id=46258
+       # - https://bugs.llvm.org/show_bug.cgi?id=47479
+       depends on CLANG_VERSION >= 120000
+       select KALLSYMS
+       help
+         This option enables Clang’s forward-edge Control Flow Integrity
+         (CFI) checking, where the compiler injects a runtime check to each
+         indirect function call to ensure the target is a valid function with
+         the correct static type. This restricts possible call targets and
+         makes it more difficult for an attacker to exploit bugs that allow
+         the modification of stored function pointers. More information can be
+         found from Clang's documentation:
+
+           https://clang.llvm.org/docs/ControlFlowIntegrity.html
+
+config CFI_CLANG_SHADOW
+       bool "Use CFI shadow to speed up cross-module checks"
+       default y
+       depends on CFI_CLANG && MODULES
+       help
+         If you select this option, the kernel builds a fast look-up table of
+         CFI check functions in loaded modules to reduce performance overhead.
+
+         If unsure, say Y.
+
+config CFI_PERMISSIVE
+       bool "Use CFI in permissive mode"
+       depends on CFI_CLANG
+       help
+         When selected, Control Flow Integrity (CFI) violations result in a
+         warning instead of a kernel panic. This option should only be used
+         for finding indirect call type mismatches during development.
+
+         If unsure, say N.
+
 config HAVE_ARCH_WITHIN_STACK_FRAMES
        bool
        help