On Mon, Apr 09, 2018 at 06:57:51PM +0900, Jean-Baptiste Theou wrote: > On Mon, 9 Apr 2018 11:49:37 +0200 > Ard Biesheuvel <[email protected]> wrote: > > > On 9 April 2018 at 11:30, Greg KH <[email protected]> wrote: > > > On Mon, Apr 09, 2018 at 06:05:34PM +0900, Jean-Baptiste Theou wrote: > > >> Hi, > > >> > > >> After this patchset, a kernel built with CFI fails. Disabling > > >> UNMAP_KERNEL_AT_EL0 fix the issue obviously. > > > > How does one 'build a kernel with CFI' for arm64? > > From Google work on Android-4.9 > > https://android.googlesource.com/kernel/common/+/00a195e7c0752ff5d65c9caadfbcc226270ca232 > > I am not sure what is the plan on their side to upstream (Greg?), but > definitely > useful to isolate actual issues. > > > > Is this a "clean" 4.9.93 tree or a "4.9.93 merged into > > > android-common-4.9? > > It's a "clean 4.9.93" + whatever is needed for Clang/CFI support > > My take is that CFI doesn't like > > * void __kpti_install_ng_mappings(int cpu, int num_cpus, phys_addr_t swapper) > > and > > remap_fn = (void *)__pa_symbol(idmap_kpti_install_ng_mappings); > > Maybe just flag this function to not use CFI? I remember that Sami Tolvanen > did > similar changes.
>From a quick scan, it looks like CFI uses shadow memory for function prologues. Since we're taking the PA of a function pointer, presumably this no longer maps to valid shadow. I'd expect the same to apply to uses of cpu_replace_ttbr1(), but it looks like the only user of that is marked as __init, and that patch adds __nocfi to __init functions. So you probably need to mark kpti_install_ng_mappings() as __nocfi. > I know it's a bit out of context since CFI support for ARM64 is not upstream > yet, > but unfortunate that an stable patchset trigger such failures. This is simply the nature of out-of-tree code. In future, it would be very helpful if you could provide context for out-of-tree patches in the initial report. Thanks, Mark.
