[v16,0/7] Introduce Kernel Control Flow Integrity ABI [PR107048]

Hi,

This series implements[1][2] the Linux Kernel Control Flow Integrity
ABI, which provides a function prototype based forward edge control flow
integrity protection by instrumenting every indirect call to check for
a hash value before the target function address. If the hash at the call
site and the hash at the target do not match, execution will trap.

Regarding the recent AI policy[3], I appear to be compliant, though the
use of the Assisted-by tag in GCC isn't clear to me: it won't distinguish
between the human code and the AI-assisted work in a single patch? So
I left those off in this series but I seek guidance on how it should be
done. Regardless, to clarify: I have been used LLMs to help me research
the GCC codebase, debug crashes, minimize PoCs, generate test cases,
construct and run my multiple architecture build and test orchestration,
and perform code reviews.

For folks that are interested in even more details on this series, I
presented at FOSSY about the work (and have submitted it to the Cauldron
CFP too); slides here[4], and there should be video up eventually,
but FOSSY hasn't published it yet.

I'd really like to be in a position where more people can test with GCC
snapshots, etc, and there can be some follow-up patches if people find
issues. Since I don't have commit access, who is the right person to
commit this?

Thanks!

-Kees

Changes since v15[5]:

 - Rebase to latest master.
 - Fix missing "_ZTS" prefix in gcc.dg tests, missed during v15 fixes.
   (Found by Linaro `tcwg_gcc_check` armv8l precommit-CI.)
 - Added more comments to x86 ENDBR filtering to explain why it is how it is.
   (Addressing Uros Bizjak's feedback.)
 - Improved various comments through-out.

[1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107048
[2] https://github.com/KSPP/linux/issues/369
[3] https://gcc.gnu.org/ai-policy.html
[4] https://outflux.net/slides/2026/fossy/gcc-kcfi.pdf
[5] https://inbox.sourceware.org/gcc-patches/20260825235748.i.456-kees@kernel.org/


Kees Cook (7):
  kcfi: Introduce KCFI typeinfo mangling API
  kcfi: Add core Kernel Control Flow Integrity infrastructure
  kcfi: Add regression test suite
  x86: Add x86_64 Kernel Control Flow Integrity implementation
  aarch64: Add AArch64 Kernel Control Flow Integrity implementation
  arm: Add ARM 32-bit Kernel Control Flow Integrity implementation
  riscv: Add RISC-V Kernel Control Flow Integrity implementation

 gcc/kcfi.h                                    |   59 +
 gcc/kcfi.cc                                   |  622 ++++++++++
 gcc/config/aarch64/aarch64-protos.h           |    4 +
 gcc/config/arm/arm-protos.h                   |    4 +
 gcc/config/i386/i386-protos.h                 |    2 +-
 gcc/config/i386/i386.h                        |    3 +-
 gcc/config/riscv/riscv-protos.h               |    3 +
 gcc/config/aarch64/aarch64.md                 |   56 +
 gcc/config/arm/arm.md                         |   62 +
 gcc/config/i386/i386.md                       |   63 +-
 gcc/config/riscv/riscv.md                     |   76 +-
 gcc/config/aarch64/aarch64.cc                 |  127 +++
 gcc/config/arm/arm.cc                         |  217 +++-
 gcc/config/i386/i386-expand.cc                |   28 +-
 gcc/config/i386/i386.cc                       |  210 +++-
 gcc/config/riscv/riscv.cc                     |  199 ++++
 gcc/doc/extend.texi                           |  141 +++
 gcc/doc/invoke.texi                           |  141 +++
 gcc/doc/tm.texi                               |   32 +
 .../gcc.dg/kcfi-compat/kcfi-compat.exp        |   87 ++
 gcc/testsuite/gcc.dg/kcfi/kcfi.exp            |   51 +
 gcc/testsuite/lib/target-supports.exp         |   14 +
 .../gcc.dg/builtin-typeinfo-bitint.c          |   82 ++
 gcc/testsuite/gcc.dg/builtin-typeinfo-c23.c   |   72 ++
 .../gcc.dg/builtin-typeinfo-errors.c          |   28 +
 gcc/testsuite/gcc.dg/builtin-typeinfo-fixed.c |   58 +
 gcc/testsuite/gcc.dg/builtin-typeinfo.c       |  375 ++++++
 .../gcc.dg/kcfi-compat/kcfi-indirect-1.h      |   22 +
 .../gcc.dg/kcfi-compat/kcfi-indirect-1_main.c |   22 +
 .../gcc.dg/kcfi-compat/kcfi-indirect-1_x.c    |   37 +
 .../gcc.dg/kcfi-compat/kcfi-indirect-1_y.c    |   34 +
 .../gcc.dg/kcfi/kcfi-aarch64-ilp32.c          |    7 +
 gcc/testsuite/gcc.dg/kcfi/kcfi-adjacency.c    |  142 +++
 gcc/testsuite/gcc.dg/kcfi/kcfi-arm-fixed-ip.c |   15 +
 .../gcc.dg/kcfi/kcfi-arm-fixed-r12.c          |   15 +
 .../gcc.dg/kcfi/kcfi-arm-sibcall-r3.c         |   50 +
 gcc/testsuite/gcc.dg/kcfi/kcfi-asm-name.c     |   16 +
 gcc/testsuite/gcc.dg/kcfi/kcfi-basics.c       |  168 +++
 gcc/testsuite/gcc.dg/kcfi/kcfi-call-sharing.c |   92 ++
 .../gcc.dg/kcfi/kcfi-cold-partition.c         |  126 ++
 .../gcc.dg/kcfi/kcfi-complex-addressing.c     |  206 ++++
 .../gcc.dg/kcfi/kcfi-direct-call-shapes.c     |   36 +
 .../gcc.dg/kcfi/kcfi-ipa-robustness.c         |   54 +
 gcc/testsuite/gcc.dg/kcfi/kcfi-lto-offset.c   |   26 +
 .../gcc.dg/kcfi/kcfi-move-preservation.c      |  138 +++
 .../gcc.dg/kcfi/kcfi-no-sanitize-inline.c     |  100 ++
 gcc/testsuite/gcc.dg/kcfi/kcfi-no-sanitize.c  |   41 +
 .../gcc.dg/kcfi/kcfi-offset-validation.c      |   40 +
 .../gcc.dg/kcfi/kcfi-patchable-entry-only.c   |   64 ++
 .../gcc.dg/kcfi/kcfi-patchable-incompatible.c |    7 +
 .../gcc.dg/kcfi/kcfi-patchable-large.c        |   57 +
 .../gcc.dg/kcfi/kcfi-patchable-medium.c       |   63 +
 .../gcc.dg/kcfi/kcfi-patchable-prefix-only.c  |   64 ++
 gcc/testsuite/gcc.dg/kcfi/kcfi-riscv-32bit.c  |    7 +
 .../gcc.dg/kcfi/kcfi-riscv-fixed-t1.c         |    7 +
 .../gcc.dg/kcfi/kcfi-riscv-fixed-t2.c         |    7 +
 .../gcc.dg/kcfi/kcfi-riscv-fixed-t3.c         |    7 +
 gcc/testsuite/gcc.dg/kcfi/kcfi-runtime.c      |  276 +++++
 gcc/testsuite/gcc.dg/kcfi/kcfi-tail-calls.c   |  144 +++
 .../gcc.dg/kcfi/kcfi-trap-encoding.c          |   88 ++
 .../gcc.dg/kcfi/kcfi-trap-section-per-func.c  |   23 +
 gcc/testsuite/gcc.dg/kcfi/kcfi-trap-section.c |   29 +
 gcc/testsuite/gcc.dg/kcfi/kcfi-x86-32bit.c    |    7 +
 gcc/testsuite/gcc.dg/kcfi/kcfi-x86-arity.c    |   93 ++
 .../gcc.dg/kcfi/kcfi-x86-endbr-collision.c    |   55 +
 .../gcc.dg/kcfi/kcfi-x86-fixed-r10.c          |    7 +
 .../gcc.dg/kcfi/kcfi-x86-fixed-r11.c          |    7 +
 .../gcc.dg/kcfi/kcfi-x86-retpoline-r11.c      |   40 +
 gcc/testsuite/gcc.dg/pch/kcfi-1.c             |   50 +
 gcc/testsuite/gcc.dg/pch/kcfi-1.hs            |   20 +
 gcc/Makefile.in                               |    3 +
 gcc/c-family/c-common.h                       |    1 +
 gcc/flag-types.h                              |    2 +
 gcc/gimple.h                                  |   22 +
 gcc/kcfi-typeinfo.h                           |   31 +
 gcc/selftest.h                                |    1 +
 gcc/c-family/c-attribs.cc                     |   17 +-
 gcc/c-family/c-common.cc                      |    2 +
 gcc/c/c-parser.cc                             |   72 ++
 gcc/common.opt                                |    8 +
 gcc/df-scan.cc                                |    7 +
 gcc/doc/tm.texi.in                            |   12 +
 gcc/final.cc                                  |   17 +
 gcc/kcfi-typeinfo.cc                          | 1009 +++++++++++++++++
 gcc/opts.cc                                   |    5 +-
 gcc/rtl.def                                   |    6 +
 gcc/rtlanal.cc                                |    5 +
 gcc/selftest-run-tests.cc                     |    1 +
 gcc/target.def                                |   39 +
 gcc/toplev.cc                                 |   12 +
 gcc/tree-inline.cc                            |   10 +
 gcc/varasm.cc                                 |   44 +-
 92 files changed, 6595 insertions(+), 56 deletions(-)
 create mode 100644 gcc/kcfi.h
 create mode 100644 gcc/kcfi.cc
 create mode 100644 gcc/testsuite/gcc.dg/kcfi-compat/kcfi-compat.exp
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi.exp
 create mode 100644 gcc/testsuite/gcc.dg/builtin-typeinfo-bitint.c
 create mode 100644 gcc/testsuite/gcc.dg/builtin-typeinfo-c23.c
 create mode 100644 gcc/testsuite/gcc.dg/builtin-typeinfo-errors.c
 create mode 100644 gcc/testsuite/gcc.dg/builtin-typeinfo-fixed.c
 create mode 100644 gcc/testsuite/gcc.dg/builtin-typeinfo.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi-compat/kcfi-indirect-1.h
 create mode 100644 gcc/testsuite/gcc.dg/kcfi-compat/kcfi-indirect-1_main.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi-compat/kcfi-indirect-1_x.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi-compat/kcfi-indirect-1_y.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-aarch64-ilp32.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-adjacency.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-arm-fixed-ip.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-arm-fixed-r12.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-arm-sibcall-r3.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-asm-name.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-basics.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-call-sharing.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-cold-partition.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-complex-addressing.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-direct-call-shapes.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-ipa-robustness.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-lto-offset.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-move-preservation.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-no-sanitize-inline.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-no-sanitize.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-offset-validation.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-entry-only.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-incompatible.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-large.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-medium.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-patchable-prefix-only.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-riscv-32bit.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-riscv-fixed-t1.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-riscv-fixed-t2.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-riscv-fixed-t3.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-runtime.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-tail-calls.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-trap-encoding.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-trap-section-per-func.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-trap-section.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-x86-32bit.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-x86-arity.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-x86-endbr-collision.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-x86-fixed-r10.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-x86-fixed-r11.c
 create mode 100644 gcc/testsuite/gcc.dg/kcfi/kcfi-x86-retpoline-r11.c
 create mode 100644 gcc/testsuite/gcc.dg/pch/kcfi-1.c
 create mode 100644 gcc/testsuite/gcc.dg/pch/kcfi-1.hs
 create mode 100644 gcc/kcfi-typeinfo.h
 create mode 100644 gcc/kcfi-typeinfo.cc