* [PATCH] x86/boot: Disable jump tables in PIC code
@ 2025-04-22 21:05 Ard Biesheuvel
2025-04-23 7:48 ` [tip: x86/boot] " tip-bot2 for Ard Biesheuvel
0 siblings, 1 reply; 6+ messages in thread
From: Ard Biesheuvel @ 2025-04-22 21:05 UTC (permalink / raw)
To: linux-kernel; +Cc: linux-efi, mingo, x86, Ard Biesheuvel
From: Ard Biesheuvel <ardb@kernel.org>
objtool already struggles to identify jump tables correctly in non-PIC
code, where the idiom is something like
jmpq *table(,%idx,8)
and the table is a list of absolute addresses of jump targets.
When using -fPIC, both the table reference as well as the jump targets
are emitted in a RIP-relative manner, resulting in something like
leaq table(%rip), %tbl
movslq (%tbl,%idx,4), %offset
addq %offset, %tbl
jmpq *%tbl
and the table is a list of offsets of the jump targets relative to the
start of the entire table.
Considering that this sequence of instructions can be interleaved with
other instructions that have nothing to do with the jump table in
question, it is extremely difficult to infer the control flow by
deriving the jump targets from the indirect jump, the location of the
table and the relative offsets it contains.
So let's not bother and disable jump tables for code built with -fPIC
under arch/x86/boot/startup.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
arch/x86/boot/startup/Makefile | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/boot/startup/Makefile b/arch/x86/boot/startup/Makefile
index e5f77e65c083..4062582144f6 100644
--- a/arch/x86/boot/startup/Makefile
+++ b/arch/x86/boot/startup/Makefile
@@ -5,6 +5,7 @@ KBUILD_CFLAGS += -D__DISABLE_EXPORTS -mcmodel=small -fPIC \
-Os -DDISABLE_BRANCH_PROFILING \
$(DISABLE_STACKLEAK_PLUGIN) \
-fno-stack-protector -D__NO_FORTIFY \
+ -fno-jump-tables \
-include $(srctree)/include/linux/hidden.h
# disable ftrace hooks and LTO
base-commit: ff4c0560ab020d34baf0aa6434f66333d25ae524
--
2.49.0.805.g082f7c87e0-goog
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [tip: x86/boot] x86/boot: Disable jump tables in PIC code
2025-04-22 21:05 [PATCH] x86/boot: Disable jump tables in PIC code Ard Biesheuvel
@ 2025-04-23 7:48 ` tip-bot2 for Ard Biesheuvel
2025-04-23 14:54 ` Josh Poimboeuf
0 siblings, 1 reply; 6+ messages in thread
From: tip-bot2 for Ard Biesheuvel @ 2025-04-23 7:48 UTC (permalink / raw)
To: linux-tip-commits
Cc: Ard Biesheuvel, Ingo Molnar, Josh Poimboeuf, Peter Zijlstra,
linux-efi, x86, linux-kernel
The following commit has been merged into the x86/boot branch of tip:
Commit-ID: 121c335b36e02d6aefb72501186e060474fdf33c
Gitweb: https://git.kernel.org/tip/121c335b36e02d6aefb72501186e060474fdf33c
Author: Ard Biesheuvel <ardb@kernel.org>
AuthorDate: Tue, 22 Apr 2025 23:05:11 +02:00
Committer: Ingo Molnar <mingo@kernel.org>
CommitterDate: Wed, 23 Apr 2025 09:30:57 +02:00
x86/boot: Disable jump tables in PIC code
objtool already struggles to identify jump tables correctly in non-PIC
code, where the idiom is something like
jmpq *table(,%idx,8)
and the table is a list of absolute addresses of jump targets.
When using -fPIC, both the table reference as well as the jump targets
are emitted in a RIP-relative manner, resulting in something like
leaq table(%rip), %tbl
movslq (%tbl,%idx,4), %offset
addq %offset, %tbl
jmpq *%tbl
and the table is a list of offsets of the jump targets relative to the
start of the entire table.
Considering that this sequence of instructions can be interleaved with
other instructions that have nothing to do with the jump table in
question, it is extremely difficult to infer the control flow by
deriving the jump targets from the indirect jump, the location of the
table and the relative offsets it contains.
So let's not bother and disable jump tables for code built with -fPIC
under arch/x86/boot/startup.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: linux-efi@vger.kernel.org
Link: https://lore.kernel.org/r/20250422210510.600354-2-ardb+git@google.com
---
arch/x86/boot/startup/Makefile | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/boot/startup/Makefile b/arch/x86/boot/startup/Makefile
index 21d911b..b514f7e 100644
--- a/arch/x86/boot/startup/Makefile
+++ b/arch/x86/boot/startup/Makefile
@@ -5,6 +5,7 @@ KBUILD_CFLAGS += -D__DISABLE_EXPORTS -mcmodel=small -fPIC \
-Os -DDISABLE_BRANCH_PROFILING \
$(DISABLE_STACKLEAK_PLUGIN) \
-fno-stack-protector -D__NO_FORTIFY \
+ -fno-jump-tables \
-include $(srctree)/include/linux/hidden.h
# disable ftrace hooks and LTO
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [tip: x86/boot] x86/boot: Disable jump tables in PIC code
2025-04-23 7:48 ` [tip: x86/boot] " tip-bot2 for Ard Biesheuvel
@ 2025-04-23 14:54 ` Josh Poimboeuf
2025-04-23 15:01 ` Ard Biesheuvel
0 siblings, 1 reply; 6+ messages in thread
From: Josh Poimboeuf @ 2025-04-23 14:54 UTC (permalink / raw)
To: tip-bot2 for Ard Biesheuvel
Cc: linux-tip-commits, Ard Biesheuvel, Ingo Molnar, Peter Zijlstra,
linux-efi, x86, linux-kernel
On Wed, Apr 23, 2025 at 07:48:01AM +0000, tip-bot2 for Ard Biesheuvel wrote:
> The following commit has been merged into the x86/boot branch of tip:
>
> Commit-ID: 121c335b36e02d6aefb72501186e060474fdf33c
> Gitweb: https://git.kernel.org/tip/121c335b36e02d6aefb72501186e060474fdf33c
> Author: Ard Biesheuvel <ardb@kernel.org>
> AuthorDate: Tue, 22 Apr 2025 23:05:11 +02:00
> Committer: Ingo Molnar <mingo@kernel.org>
> CommitterDate: Wed, 23 Apr 2025 09:30:57 +02:00
>
> x86/boot: Disable jump tables in PIC code
>
> objtool already struggles to identify jump tables correctly in non-PIC
> code, where the idiom is something like
>
> jmpq *table(,%idx,8)
>
> and the table is a list of absolute addresses of jump targets.
>
> When using -fPIC, both the table reference as well as the jump targets
> are emitted in a RIP-relative manner, resulting in something like
>
> leaq table(%rip), %tbl
> movslq (%tbl,%idx,4), %offset
> addq %offset, %tbl
> jmpq *%tbl
>
> and the table is a list of offsets of the jump targets relative to the
> start of the entire table.
>
> Considering that this sequence of instructions can be interleaved with
> other instructions that have nothing to do with the jump table in
> question, it is extremely difficult to infer the control flow by
> deriving the jump targets from the indirect jump, the location of the
> table and the relative offsets it contains.
>
> So let's not bother and disable jump tables for code built with -fPIC
> under arch/x86/boot/startup.
Hm, does objtool even run on boot code?
--
Josh
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [tip: x86/boot] x86/boot: Disable jump tables in PIC code
2025-04-23 14:54 ` Josh Poimboeuf
@ 2025-04-23 15:01 ` Ard Biesheuvel
2025-04-23 16:41 ` Josh Poimboeuf
0 siblings, 1 reply; 6+ messages in thread
From: Ard Biesheuvel @ 2025-04-23 15:01 UTC (permalink / raw)
To: Josh Poimboeuf
Cc: tip-bot2 for Ard Biesheuvel, linux-tip-commits, Ingo Molnar,
Peter Zijlstra, linux-efi, x86, linux-kernel
On Wed, 23 Apr 2025 at 16:55, Josh Poimboeuf <jpoimboe@kernel.org> wrote:
>
> On Wed, Apr 23, 2025 at 07:48:01AM +0000, tip-bot2 for Ard Biesheuvel wrote:
> > The following commit has been merged into the x86/boot branch of tip:
> >
> > Commit-ID: 121c335b36e02d6aefb72501186e060474fdf33c
> > Gitweb: https://git.kernel.org/tip/121c335b36e02d6aefb72501186e060474fdf33c
> > Author: Ard Biesheuvel <ardb@kernel.org>
> > AuthorDate: Tue, 22 Apr 2025 23:05:11 +02:00
> > Committer: Ingo Molnar <mingo@kernel.org>
> > CommitterDate: Wed, 23 Apr 2025 09:30:57 +02:00
> >
> > x86/boot: Disable jump tables in PIC code
> >
> > objtool already struggles to identify jump tables correctly in non-PIC
> > code, where the idiom is something like
> >
> > jmpq *table(,%idx,8)
> >
> > and the table is a list of absolute addresses of jump targets.
> >
> > When using -fPIC, both the table reference as well as the jump targets
> > are emitted in a RIP-relative manner, resulting in something like
> >
> > leaq table(%rip), %tbl
> > movslq (%tbl,%idx,4), %offset
> > addq %offset, %tbl
> > jmpq *%tbl
> >
> > and the table is a list of offsets of the jump targets relative to the
> > start of the entire table.
> >
> > Considering that this sequence of instructions can be interleaved with
> > other instructions that have nothing to do with the jump table in
> > question, it is extremely difficult to infer the control flow by
> > deriving the jump targets from the indirect jump, the location of the
> > table and the relative offsets it contains.
> >
> > So let's not bother and disable jump tables for code built with -fPIC
> > under arch/x86/boot/startup.
>
> Hm, does objtool even run on boot code?
>
This is about startup code, not boot code. This is code that is part
of vmlinux, but runs from a different mapping of memory than the one
the linker assumes, and so it needs to be built with -fPIC to
discourage the compiler and linker from inserting symbol references
via the kernel virtual mapping, which may not be up yet when this code
runs.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [tip: x86/boot] x86/boot: Disable jump tables in PIC code
2025-04-23 15:01 ` Ard Biesheuvel
@ 2025-04-23 16:41 ` Josh Poimboeuf
2025-04-23 17:02 ` Ard Biesheuvel
0 siblings, 1 reply; 6+ messages in thread
From: Josh Poimboeuf @ 2025-04-23 16:41 UTC (permalink / raw)
To: Ard Biesheuvel
Cc: tip-bot2 for Ard Biesheuvel, linux-tip-commits, Ingo Molnar,
Peter Zijlstra, linux-efi, x86, linux-kernel
On Wed, Apr 23, 2025 at 05:01:42PM +0200, Ard Biesheuvel wrote:
> > > So let's not bother and disable jump tables for code built with -fPIC
> > > under arch/x86/boot/startup.
> >
> > Hm, does objtool even run on boot code?
> >
>
> This is about startup code, not boot code. This is code that is part
> of vmlinux, but runs from a different mapping of memory than the one
> the linker assumes, and so it needs to be built with -fPIC to
> discourage the compiler and linker from inserting symbol references
> via the kernel virtual mapping, which may not be up yet when this code
> runs.
Maybe objtool should ignore .head.text. It doesn't need ORC, static
calls, uaccess validation, retpolines, etc.
--
Josh
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [tip: x86/boot] x86/boot: Disable jump tables in PIC code
2025-04-23 16:41 ` Josh Poimboeuf
@ 2025-04-23 17:02 ` Ard Biesheuvel
0 siblings, 0 replies; 6+ messages in thread
From: Ard Biesheuvel @ 2025-04-23 17:02 UTC (permalink / raw)
To: Josh Poimboeuf
Cc: tip-bot2 for Ard Biesheuvel, linux-tip-commits, Ingo Molnar,
Peter Zijlstra, linux-efi, x86, linux-kernel
On Wed, 23 Apr 2025 at 18:41, Josh Poimboeuf <jpoimboe@kernel.org> wrote:
>
> On Wed, Apr 23, 2025 at 05:01:42PM +0200, Ard Biesheuvel wrote:
> > > > So let's not bother and disable jump tables for code built with -fPIC
> > > > under arch/x86/boot/startup.
> > >
> > > Hm, does objtool even run on boot code?
> > >
> >
> > This is about startup code, not boot code. This is code that is part
> > of vmlinux, but runs from a different mapping of memory than the one
> > the linker assumes, and so it needs to be built with -fPIC to
> > discourage the compiler and linker from inserting symbol references
> > via the kernel virtual mapping, which may not be up yet when this code
> > runs.
>
> Maybe objtool should ignore .head.text. It doesn't need ORC, static
> calls, uaccess validation, retpolines, etc.
>
I am trying to get rid of .head.text.
But some of the startup code may still be in use later, so I don't
think we should disable objtool validation entirely unless we really
have to.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2025-04-23 17:02 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-04-22 21:05 [PATCH] x86/boot: Disable jump tables in PIC code Ard Biesheuvel
2025-04-23 7:48 ` [tip: x86/boot] " tip-bot2 for Ard Biesheuvel
2025-04-23 14:54 ` Josh Poimboeuf
2025-04-23 15:01 ` Ard Biesheuvel
2025-04-23 16:41 ` Josh Poimboeuf
2025-04-23 17:02 ` Ard Biesheuvel
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).