Page MenuHomeFreeBSD

WIP: add all KCFI modification and wait for discuss
Needs ReviewPublic

Authored by aokblast on Jul 31 2024, 3:10 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Nov 17, 3:32 PM
Unknown Object (File)
Mon, Nov 11, 6:11 PM
Unknown Object (File)
Fri, Nov 8, 11:47 AM
Unknown Object (File)
Thu, Oct 31, 4:11 AM
Unknown Object (File)
Oct 14 2024, 12:26 AM
Unknown Object (File)
Oct 7 2024, 6:39 PM
Unknown Object (File)
Oct 5 2024, 2:33 PM
Unknown Object (File)
Sep 24 2024, 4:23 AM

Details

Reviewers
gnn
emaste
Summary

This is a WIP for KCFI in FreeBSD

I have implemented a basic function which enable KCFI be triggered as expected. But there are some topic needs to be discussed because we have to disable in some part of kernel.
Currently, we are able to boot into kernel because I jump the ud2 by rip += 2 in trap handler in default

What I think disable is reasonable so I disabled it in default:

  1. link_elf_invoke_cbs, elf_lookup_ifunc: The kernel elf loader cannot know the actual return type of ifunc (they can only know ifunc will return a pointer), so the case of cbs.
  2. ccfn in vsscanf: vsscanf may get strtoq or strtouq which return the different type
  3. vs->func in vnet_register_sysinit: take void * but caller has the detailed type
  4. se->sy_call in syscallenter: kernel pack all parameter into a void * but the callee has the detailed type (For example: read_args, write_args).

What disable works but maybe able to fix:

  1. callout parameter in fork_exit: the first parameter of callout is void *, but the type of callout maybe dependes on the vm_machdep per platform, we can change all callee to take void * as parameter
  2. post_ithread in ithread_execute_handlers: same as before, the parameter of post_ithread is void * and change all callee may also work.

What needs discussion:

  1. .m interface file calls kobj_error_methos in subr_kobj.c when no default function specified, we need some automation to fix it.
  2. eventhandler registration in kernel sometime doesn't follow the calling convention in eventhandler definition. Take iprreass_drain in sys/netinet/ip_reass.c which register a vm_lowmem and mbuf_lowmem. It use no parameter but the signature should be (void *, int). This can be fixed by manual or automation
  3. subsystems in kernel has their general error function. Takes sys/kern/vfs_default.c for example, we have vop_ebadf, vop_eopnotsupp, ...etc. But the signature is wrong in kcfi. I propsed a solution for this but I don't know if it is good. Please take a look in sys/kern/kern_conf.c and dtrace.

Still investigated but disable it now:

  1. _run_module: in linuxKP

My TODO List:
Check if the ud2 is triggerd by kcfi
Some file is not compiled with KCFI without setting CFLAG in kern.mk

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 58896
Build 55783: arc lint + arc unit