Hi Pierre-Clément,
On Thu, 14 Mar 2024 20:23:00 +0000,
Pierre-Clément Tosi <ptosi@xxxxxxxxxx> wrote:
>
> CONFIG_CFI_CLANG ("kernel Control Flow Integrity") makes the compiler inject
> runtime type checks before any indirect function call. On AArch64, it generates
> a BRK instruction to be executed on type mismatch and encodes the indices of the
> registers holding the branch target and expected type in the immediate of the
> instruction. As a result, a synchronous exception gets triggered on kCFI failure
> and the fault handler can retrieve the immediate (and indices) from ESR_ELx.
>
> This feature has been supported at EL1 ("host") since it was introduced by
> b26e484b8bb3 ("arm64: Add CFI error handling"), where cfi_handler() decodes
> ESR_EL1, giving informative panic messages such as
>
> [ 21.885179] CFI failure at lkdtm_indirect_call+0x2c/0x44 [lkdtm]
> (target: lkdtm_increment_int+0x0/0x1c [lkdtm]; expected type: 0x7e0c52a)
> [ 21.886593] Internal error: Oops - CFI: 0 [#1] PREEMPT SMP
>
> However, it is not or only partially supported at EL2: in nVHE (or pKVM),
> CONFIG_CFI_CLANG gets filtered out at build time, preventing the compiler from
> injecting the checks. In VHE (or hVHE), EL2 code gets compiled with the checks
Are you sure about hVHE? hVHE is essentially the nVHE object running
with a slightly different HCR_EL2 configuration. So if you don't have
the checks in the nVHE code, you don't have them for hVHE either.
Or am I missing something obvious?
Thanks,
M.
--
Without deviation from the norm, progress is not possible.
