Re: [PATCH 06/15] x86: Avoid CFI jump tables in IDT and entry points

2021-04-16 Thread Thomas Gleixner
On Fri, Apr 16 2021 at 16:56, Kees Cook wrote: > On Sat, Apr 17, 2021 at 12:26:56AM +0200, Thomas Gleixner wrote: >> Where is the analysis why excluding >> >> > +CFLAGS_REMOVE_idt.o := $(CC_FLAGS_CFI) >> > +CFLAGS_REMOVE_paravirt.o := $(CC_FLAGS_CFI) >> >> all of idt.c and paravir

Re: [PATCH 06/15] x86: Avoid CFI jump tables in IDT and entry points

2021-04-16 Thread Kees Cook
On Sat, Apr 17, 2021 at 12:26:56AM +0200, Thomas Gleixner wrote: > On Fri, Apr 16 2021 at 13:38, Sami Tolvanen wrote: > > With CONFIG_CFI_CLANG, the compiler replaces function addresses in C > > code with jump table addresses. > > Fine. > > > To avoid referring to jump tables in entry code with P

Re: [PATCH 06/15] x86: Avoid CFI jump tables in IDT and entry points

2021-04-16 Thread Thomas Gleixner
On Fri, Apr 16 2021 at 13:38, Sami Tolvanen wrote: > With CONFIG_CFI_CLANG, the compiler replaces function addresses in C > code with jump table addresses. Fine. > To avoid referring to jump tables in entry code with PTI, What has this to do with PTI? > disable CFI for IDT and paravirt code, an

[PATCH 06/15] x86: Avoid CFI jump tables in IDT and entry points

2021-04-16 Thread Sami Tolvanen
With CONFIG_CFI_CLANG, the compiler replaces function addresses in C code with jump table addresses. To avoid referring to jump tables in entry code with PTI, disable CFI for IDT and paravirt code, and use function_nocfi() to prevent jump table addresses from being added to the IDT or system call e