Finer-grained kernel control flow integrity and challenges
summary
Kernel RFCs add riscv hardware-assisted forward CFI using a 20-bit label in LPAD matched against a caller-set X7 register and finer-grained KCFI-like hashing via a label-scheme=function-signature toolchain; backward CFI piggybacks on the hardware shadow stack using CSR SSP but hits vmalloc direct-map/TLB shootdown pain that slows fork. Patches propose a kernel CFI config, runtime-disable for UEFI/modules, tracing/eBPF handling, and a preallocated shadow-stack pool (example: 84 MB for 10,000 stacks) to avoid frequent shootdowns.
AI-written summary · about
chapters (9)
- 0:00Introduction and motivation
- 1:44Forward CFI overview
- 4:51Backward CFI and shadow stack
- 5:56RISC-V kernel CFI
- 8:10Hardware-assisted shadow stack
- 9:58Open challenges and solutions
- 15:53EFI runtime and CFI compatibility
- 16:55Shadow stack allocation issues
- 23:10Q&A discussion
related talks
35mControl Flow Integrity on RISC-V Linux
44mLinux Kernel Control-Flow Integrity Sup...
41mRISC-V Control-Flow Integrity (CFI)
20mControl Flow Integrity on RISCV
32mAdvancing Kernel Control Flow Integrity with eBPF
39mControl Flow Integrity in the Linux Kernel
45mControl Flow Integrity in the Linux Kernel
01h 46mA little Introduction to Control Flow Integrity