arm64: handle inlined kCFI failure reporting

[xeropresence]

Summary

Extend KernelPatch's existing KP/KPM-only CFI exception policy to the arm64 cfi_handler entry point. This covers kernels where LTO inlines report_cfi_failure, bypassing the existing hook on that function.

Problem

On the stock Pixel 8 (shiba) GrapheneOS 2026081300 kernel, disassembly of cfi_handler shows inlined failure reporting instead of a call to the separately emitted report_cfi_failure symbol. Hooking the latter therefore does not intercept the actual trap path.

Kernel-to-KernelPatch callbacks can still fault under kCFI. Observed paths include directory iteration, RCU reclamation, and stop_machine during runtime hook removal. Adding separate typed trampolines at each call site works around the missed interception point but is unnecessary when the existing compatibility policy is applied at the trap handler.

Changes

• Resolve cfi_handler and arm64_skip_faulting_instruction and install an arm64-only before-hook when both exist.
• Decode the target register from the CFI BRK immediate in ESR.
• Reject user-mode traps and register 31, then apply the existing should_cfi_pass() address-range check.
• For permitted KP/KPM targets only, use the kernel's instruction-advance helper and return DBG_HOOK_HANDLED.
• Leave other targets on the original handler path. Preserve the existing report_cfi_failure and legacy __cfi_slowpath hooks, and the current cfi_bypass completion flag.

This does not make CFI globally permissive. It retains the existing scoped exception for KernelPatch text, hook memory, and KPM executable memory. No callback allocator, syscall-hook changes, task-observer changes, or persistent preset-layout changes are introduced.

Verification

Built the Android ARM64 payload and kptools on this branch.

Device testing used all three fixes on KernelPatch 0.13.8, with a Pixel 8 running GrapheneOS 2026081300:

• Directory scans and runtime hook removal completed with strict kCFI enabled.
• 128 RCU-backed profile replacements completed without CFI faults.

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved critical and moderate findings remain in the arm64 CFI handling.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Return the handled value for consumed arm64 CFI traps · New

What changed in this PR

Extends KernelPatch’s scoped arm64 kCFI bypass to handle inlined failure reporting.

Changes:

• Adds cfi_handler interception with CFI target decoding and validation.
• Advances permitted KP/KPM faults while preserving existing hooks.
• Adds fallback setup for required arm64 symbols.

File	Summary
kernel/​patch/​common/​secpass.c	Implements arm64 cfi_handler interception and fallback CFI hook setup.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[xeropresence]

@Admirepowered pushed the suggested fix.

[Admirepowered]

i think should use kallsyms_lookup_name_by_suffix to search it?Or it is impossible for LTO to do so？

[xeropresence]

i think should use kallsyms_lookup_name_by_suffix to search it?Or it is impossible for LTO to do so？

kallsyms_lookup_name_by_suffix() would help if LTO only renamed the function, but the issue here is actual inlining. On the tested GrapheneOS kernel, report_cfi_failure still exists as a separate symbol, but the disassembly of cfi_handler shows the failure-reporting logic inlined rather than a call to that symbol. Hooking the standalone function therefore misses this path; suffix lookup would not change that.