Split CFI jump tables between core kernel and entry code so KPTI doesn't have to map the entire jump table #23

kees · 2019-11-21T05:02:29Z

https://outflux.net/blog/archives/2019/11/20/experimenting-with-clang-cfi-in-upstream-linux/

There seems to be some generated code that is being run at syscall entry that is not mapped. I suspect there is something still doing CFI checks on entry (and their resulting jump tables are missing), but I haven't found them yet. For now, disable KPTI under CFI (at run time, so test kernels can still boot with "pti" to enable it again).

kees · 2020-02-25T18:52:02Z

Looks like current best solution is to just always map the jump tables.

kees · 2021-09-16T20:59:58Z

No longer an issue; the entry code is using the opaque types to avoid CFI instrumentation.

kees added [ARCH] x86_64 [Feature] CFI labels Nov 21, 2019

kees added the [PATCH] Exists label Feb 25, 2020

kees changed the title ~~KPTI+CFI on x86 trips over something in entry code~~ Split CFI jump tables between core kernel and entry code so KPTI doesn't have to map the entire jump table Mar 11, 2021

kees removed the [PATCH] Exists label Mar 11, 2021

kees mentioned this issue Mar 24, 2021

booting x86 with LTO+CFI+KPTI leads to hung init task ClangBuiltLinux/linux#740

Closed

kees closed this as completed Oct 13, 2021

KSPP / linux Public

Split CFI jump tables between core kernel and entry code so KPTI doesn't have to map the entire jump table #23

Split CFI jump tables between core kernel and entry code so KPTI doesn't have to map the entire jump table #23

kees commented Nov 21, 2019

kees commented Feb 25, 2020

kees commented Sep 16, 2021

KSPP / linux Public

Split CFI jump tables between core kernel and entry code so KPTI doesn't have to map the entire jump table #23

Split CFI jump tables between core kernel and entry code so KPTI doesn't have to map the entire jump table #23

Comments

kees commented Nov 21, 2019

kees commented Feb 25, 2020

kees commented Sep 16, 2021