Hi, This series implements[1][2] the Linux Kernel Control Flow Integrity ABI, which provides a function prototype based forward edge control flow integrity protection by instrumenting every indirect call to check for a hash value before the target function address. If the hash at the call site and the hash at the target do not match, execution will trap.
Regarding the recent AI policy[4], I appear to be compliant, though the use of the Assisted-by tag in GCC isn't clear to me: it won't distinguish between the human code and the AI-assisted work in a single patch? So I left those off in this series but I seek guidance on how it should be done. Regardless, to clarify: I have been used LLMs to help me research the GCC codebase, debug crashes, minimize PoCs, generate test cases, construct and run my multiple architecture build and test orchestration, and perform code reviews. For folks that are interested in even more details, I presented at FOSSY about this work (and will submit it to the Cauldron CFP too); slides here[5], and there should be video up eventually, but FOSSY hasn't published it yet. I'd really like to be in a position where more people can test with GCC snapshots, etc, and there can be some follow-up patches if people find issues. Since I don't have commit access, who is the right person to commit this? Thanks! -Kees Changes since v14[3]: - Rebase to latest master. - Add a cross-TU / cross-compiler indirect-call compat test. I used ALT_CC_UNDER_TEST to compare against Clang -fsanitize-kcfi-hash=FNV-1a. - Correctly match the existing type-id ABI (the Itanium typeinfo name was missing the "_ZTS" prefix *cough*). - Replace the per-function-type type-id attribute with a hash_map cache to avoiding touching shared TYPE_ATTRIBUTES. - Add a PCH test confirming KCFI type-ids and labels are stable across a precompiled header (KCFI state is all codegen-time.) - Various small comment tweaks/corrections. [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107048 [2] https://github.com/KSPP/linux/issues/369 [3] https://inbox.sourceware.org/gcc-patches/[email protected]/ [4] https://gcc.gnu.org/ai-policy.html [5] https://outflux.net/slides/2026/fossy/gcc-kcfi.pdf Kees Cook (7): kcfi: Introduce KCFI typeinfo mangling API kcfi: Add core Kernel Control Flow Integrity infrastructure kcfi: Add regression test suite x86: Add x86_64 Kernel Control Flow Integrity implementation aarch64: Add AArch64 Kernel Control Flow Integrity implementation arm: Add ARM 32-bit Kernel Control Flow Integrity implementation riscv: Add RISC-V Kernel Control Flow Integrity implementation gcc/kcfi.h | 59 + gcc/kcfi.cc | 622 ++++++++++ gcc/config/aarch64/aarch64-protos.h | 4 + gcc/config/arm/arm-protos.h | 4 + gcc/config/i386/i386-protos.h | 2 +- gcc/config/i386/i386.h | 3 +- gcc/config/riscv/riscv-protos.h | 3 + gcc/config/aarch64/aarch64.md | 56 + gcc/config/arm/arm.md | 62 + gcc/config/i386/i386.md | 63 +- gcc/config/riscv/riscv.md | 76 +- gcc/config/aarch64/aarch64.cc | 127 +++ gcc/config/arm/arm.cc | 217 +++- gcc/config/i386/i386-expand.cc | 28 +- gcc/config/i386/i386.cc | 210 +++- gcc/config/riscv/riscv.cc | 199 ++++ gcc/doc/extend.texi | 141 +++ gcc/doc/invoke.texi | 141 +++ gcc/doc/tm.texi | 32 + .../gcc.dg/kcfi-compat/kcfi-compat.exp | 87 ++ gcc/testsuite/gcc.dg/kcfi/kcfi.exp | 51 + gcc/testsuite/lib/target-supports.exp | 14 + .../gcc.dg/builtin-typeinfo-bitint.c | 82 ++ gcc/testsuite/gcc.dg/builtin-typeinfo-c23.c | 72 ++ .../gcc.dg/builtin-typeinfo-errors.c | 28 + gcc/testsuite/gcc.dg/builtin-typeinfo-fixed.c | 57 + gcc/testsuite/gcc.dg/builtin-typeinfo.c | 375 ++++++ .../gcc.dg/kcfi-compat/kcfi-indirect-1.h | 22 + .../gcc.dg/kcfi-compat/kcfi-indirect-1_main.c | 22 + .../gcc.dg/kcfi-compat/kcfi-indirect-1_x.c | 37 + .../gcc.dg/kcfi-compat/kcfi-indirect-1_y.c | 34 + .../gcc.dg/kcfi/kcfi-aarch64-ilp32.c | 7 + gcc/testsuite/gcc.dg/kcfi/kcfi-adjacency.c | 142 +++ gcc/testsuite/gcc.dg/kcfi/kcfi-arm-fixed-ip.c | 15 + .../gcc.dg/kcfi/kcfi-arm-fixed-r12.c | 15 + .../gcc.dg/kcfi/kcfi-arm-sibcall-r3.c | 50 + gcc/testsuite/gcc.dg/kcfi/kcfi-asm-name.c | 16 + gcc/testsuite/gcc.dg/kcfi/kcfi-basics.c | 168 +++ gcc/testsuite/gcc.dg/kcfi/kcfi-call-sharing.c | 92 ++ .../gcc.dg/kcfi/kcfi-cold-partition.c | 126 ++ .../gcc.dg/kcfi/kcfi-complex-addressing.c | 206 ++++ .../gcc.dg/kcfi/kcfi-direct-call-shapes.c | 36 + .../gcc.dg/kcfi/kcfi-ipa-robustness.c | 54 + gcc/testsuite/gcc.dg/kcfi/kcfi-lto-offset.c | 26 + .../gcc.dg/kcfi/kcfi-move-preservation.c | 138 +++ .../gcc.dg/kcfi/kcfi-no-sanitize-inline.c | 100 ++ gcc/testsuite/gcc.dg/kcfi/kcfi-no-sanitize.c | 41 + .../gcc.dg/kcfi/kcfi-offset-validation.c | 40 + .../gcc.dg/kcfi/kcfi-patchable-entry-only.c | 64 ++ .../gcc.dg/kcfi/kcfi-patchable-incompatible.c | 7 + .../gcc.dg/kcfi/kcfi-patchable-large.c | 57 + .../gcc.dg/kcfi/kcfi-patchable-medium.c | 63 + .../gcc.dg/kcfi/kcfi-patchable-prefix-only.c | 64 ++ gcc/testsuite/gcc.dg/kcfi/kcfi-riscv-32bit.c | 7 + .../gcc.dg/kcfi/kcfi-riscv-fixed-t1.c | 7 + .../gcc.dg/kcfi/kcfi-riscv-fixed-t2.c | 7 + .../gcc.dg/kcfi/kcfi-riscv-fixed-t3.c | 7 + gcc/testsuite/gcc.dg/kcfi/kcfi-runtime.c | 276 +++++ gcc/testsuite/gcc.dg/kcfi/kcfi-tail-calls.c | 144 +++ .../gcc.dg/kcfi/kcfi-trap-encoding.c | 88 ++ .../gcc.dg/kcfi/kcfi-trap-section-per-func.c | 23 + gcc/testsuite/gcc.dg/kcfi/kcfi-trap-section.c | 29 + gcc/testsuite/gcc.dg/kcfi/kcfi-x86-32bit.c | 7 + gcc/testsuite/gcc.dg/kcfi/kcfi-x86-arity.c | 93 ++ .../gcc.dg/kcfi/kcfi-x86-fixed-r10.c | 7 + .../gcc.dg/kcfi/kcfi-x86-fixed-r11.c | 7 + .../gcc.dg/kcfi/kcfi-x86-retpoline-r11.c | 40 + gcc/testsuite/gcc.dg/pch/kcfi-1.c | 50 + gcc/testsuite/gcc.dg/pch/kcfi-1.hs | 20 + gcc/Makefile.in | 3 + gcc/c-family/c-common.h | 1 + gcc/flag-types.h | 2 + gcc/gimple.h | 22 + gcc/kcfi-typeinfo.h | 31 + gcc/selftest.h | 1 + gcc/c-family/c-attribs.cc | 17 +- gcc/c-family/c-common.cc | 2 + gcc/c/c-parser.cc | 72 ++ gcc/common.opt | 8 + gcc/df-scan.cc | 7 + gcc/doc/tm.texi.in | 12 + gcc/final.cc | 17 + gcc/kcfi-typeinfo.cc | 1009 +++++++++++++++++ gcc/opts.cc | 5 +- gcc/rtl.def | 6 + gcc/rtlanal.cc | 5 + gcc/selftest-run-tests.cc | 1 + gcc/target.def | 39 + gcc/toplev.cc | 12 + gcc/tree-inline.cc | 10 + gcc/varasm.cc | 44 +- 91 files changed, 6539 insertions(+), 56 deletions(-) create mode 100644 gcc/kcfi.h create mode 100644 gcc/kcfi.cc create mode 100644 gcc/testsuite/gcc.dg/kcfi-compat/kcfi-compat.exp create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi.exp create mode 100644 gcc/testsuite/gcc.dg/builtin-typeinfo-bitint.c create mode 100644 gcc/testsuite/gcc.dg/builtin-typeinfo-c23.c create mode 100644 gcc/testsuite/gcc.dg/builtin-typeinfo-errors.c create mode 100644 gcc/testsuite/gcc.dg/builtin-typeinfo-fixed.c create mode 100644 gcc/testsuite/gcc.dg/builtin-typeinfo.c create mode 100644 gcc/testsuite/gcc.dg/kcfi-compat/kcfi-indirect-1.h create mode 100644 gcc/testsuite/gcc.dg/kcfi-compat/kcfi-indirect-1_main.c create mode 100644 gcc/testsuite/gcc.dg/kcfi-compat/kcfi-indirect-1_x.c create mode 100644 gcc/testsuite/gcc.dg/kcfi-compat/kcfi-indirect-1_y.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-aarch64-ilp32.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-adjacency.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-arm-fixed-ip.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-arm-fixed-r12.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-arm-sibcall-r3.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-asm-name.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-basics.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-call-sharing.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-cold-partition.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-complex-addressing.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-direct-call-shapes.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-ipa-robustness.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-lto-offset.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-move-preservation.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-no-sanitize-inline.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-no-sanitize.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-offset-validation.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-entry-only.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-incompatible.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-large.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-medium.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-prefix-only.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-riscv-32bit.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-riscv-fixed-t1.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-riscv-fixed-t2.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-riscv-fixed-t3.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-runtime.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-tail-calls.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-trap-encoding.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-trap-section-per-func.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-trap-section.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-x86-32bit.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-x86-arity.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-x86-fixed-r10.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-x86-fixed-r11.c create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-x86-retpoline-r11.c create mode 100644 gcc/testsuite/gcc.dg/pch/kcfi-1.c create mode 100644 gcc/testsuite/gcc.dg/pch/kcfi-1.hs create mode 100644 gcc/kcfi-typeinfo.h create mode 100644 gcc/kcfi-typeinfo.cc -- 2.34.1
