On Mon, Dec 19, 2022 at 05:32:04AM -0800, Dan Li wrote: > Hi Peter, > > On 12/19, Peter Zijlstra wrote: > > On Sun, Dec 18, 2022 at 10:17:58PM -0800, Dan Li wrote: > > > > > 1. When a typeid mismatch is detected, the cfi_check_failed function > > > will be called instead of the brk instruction. This function needs > > > to be implemented by the compiler user. > > > If there are user mode programs or other systems that want to use > > > this feature, it may be more convenient to use a callback (so this > > > compilation option is set to -fsanitize=cfi instead of kcfi). > > > > This is not going to be acceptible for x86_64. > > I'm not familiar enough with the x86_64 platform, could you please > tell me why this is not acceptable? Is there a similar situation > on the arm64 platform? > > > > 5. The current implementation of gcc only supports the aarch64 platform. > > > > What, if any, are the plans for x86_64 support? > > I'd like to implement something similar on x86_64 later, but > currently I'm doing this in my spare time, so it might take a > little longer. :( Hi! First of all, thank you thank you for working on this in GCC. This will make a big difference for folks that don't have the option to build with Clang to gain CFI coverage. As for the implementation details, the core issue is really that this type of CFI is specifically designed for the Linux kernel, and it took a rather long time to figure out all the specifics needed (down to the byte counts and instruction layouts). GCC's version will ultimately need to exactly match the Clang output, or Linux is unlikely to support it. We're already on our second CFI -- the original Clang CFI was just too clunky for long-term use in Linux, so unless we're going to improve on the latest Clang KCFI implementation in some way, it's better to stick to exactly byte-for-byte identical results. The KCFI support in Linux depends on the arm64 and x86_64 runtimes for catching the traps, and the post-processing done (on x86_64) with objtool that prepares the kernel for IBT use, and converts to the optional FineIBT CFI mechanism. With all those moving parts, there needs to be a very compelling reason to have GCC KCFI implementation differ from Clang's. Hopefully that context helps a little. I'm excited to try out future versions! -Kees -- Kees Cook
