arm64: scs: Work around full LTO issue with dynamic SCS
PATCH 1/1 arm64: scs: Work around full LTO issue with dynamic SCS
From: Ard Biesheuvel <[email protected]>
Full LTO takes the '-mbranch-protection=none' passed to the compiler when generating the dynamic shadow call stack patching code as a hint to stop emitting PAC instructions altogether. (Thin LTO appears unaffected by this)
Work around this by stripping unwind tables from the object in question, which should be sufficient to prevent the patching code from attempting to patch itself.
--- arch/arm64/kernel/Makefile | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
arch/arm64/kernel/Makefile +7 -1
@@ -73,7 +73,13 @@ obj-$(CONFIG_ARM64_MTE) += mte.o obj-y += vdso-wrap.o obj-$(CONFIG_COMPAT_VDSO) += vdso32-wrap.o obj-$(CONFIG_UNWIND_PATCH_PAC_INTO_SCS) += patch-scs.o -CFLAGS_patch-scs.o += -mbranch-protection=none + +# We need to prevent the SCS patching code from patching itself. Using +# -mbranch-protection=none here to avoid the patchable PAC opcodes from being +# generated triggers an issue with full LTO on Clang, which stops emitting PAC +# instructions altogether. So instead, omit the unwind tables used by the +# patching code, so it will not be able to locate its own PAC instructions. +CFLAGS_patch-scs.o += -fno-asynchronous-unwind-tables -fno-unwind-tables # Force dependency (vdso*-wrap.S includes vdso.so through incbin) $(obj)/vdso-wrap.o: $(obj)/vdso/vdso.so
Signature · 7 lines
2.43.0.472.g3155946c3a-goog _______________________________________________ linux-arm-kernel mailing list [email protected] http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
Quoted 7 lines · Ard Biesheuvel
From: Ard Biesheuvel <[email protected]>
Full LTO takes the '-mbranch-protection=none' passed to the compiler when generating the dynamic shadow call stack patching code as a hint to stop emitting PAC instructions altogether. (Thin LTO appears unaffected by this)
Quoted 5 lines
Work around this by stripping unwind tables from the object in question, which should be sufficient to prevent the patching code from attempting to patch itself.
Signed-off-by Ard Biesheuvel <[email protected]>
Thanks for finding a work-around for this! Do you want to include the Reported-by: or Cc: stable@... tags for this?
-Kees
Quoted 26 lines
--- arch/arm64/kernel/Makefile | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)arch/arm64/kernel/Makefile +7
-1@@ -73,7 +73,13 @@ obj-$(CONFIG_ARM64_MTE) += mte.o obj-y += vdso-wrap.o obj-$(CONFIG_COMPAT_VDSO) += vdso32-wrap.o obj-$(CONFIG_UNWIND_PATCH_PAC_INTO_SCS) += patch-scs.o -CFLAGS_patch-scs.o += -mbranch-protection=none + +# We need to prevent the SCS patching code from patching itself. Using +# -mbranch-protection=none here to avoid the patchable PAC opcodes from being +# generated triggers an issue with full LTO on Clang, which stops emitting PAC +# instructions altogether. So instead, omit the unwind tables used by the +# patching code, so it will not be able to locate its own PAC instructions. +CFLAGS_patch-scs.o += -fno-asynchronous-unwind-tables -fno-unwind-tables # Force dependency (vdso*-wrap.S includes vdso.so through incbin) $(obj)/vdso-wrap.o: $(obj)/vdso/vdso.soSignature · 1 line
2.43.0.472.g3155946c3a-goog
Signature · 6 lines
Kees Cook _______________________________________________ linux-arm-kernel mailing list [email protected] http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
Hi Ard,
Quoted 7 lines · Ard Biesheuvel
From: Ard Biesheuvel <[email protected]>
Full LTO takes the '-mbranch-protection=none' passed to the compiler when generating the dynamic shadow call stack patching code as a hint to stop emitting PAC instructions altogether. (Thin LTO appears unaffected by this)
Does this affect all Clang versions? Is there a compiler bug filed for this issue?
Quoted 5 lines
Work around this by stripping unwind tables from the object in question, which should be sufficient to prevent the patching code from attempting to patch itself.
Signed-off-by Ard Biesheuvel <[email protected]>
Please add a Fixes tag to ensure this gets backported. Otherwise, looks like a reasonable workaround to me.
Sami
_______________________________________________
linux-arm-kernel mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
(cc Nathan)
Quoted 7 lines · Sami Tolvanen
Hi Ard,
Quoted 3 lines · Ard Biesheuvel
From: Ard Biesheuvel <[email protected]>
Quoted 8 lines
Quoted 4 lines
Full LTO takes the '-mbranch-protection=none' passed to the compiler when generating the dynamic shadow call stack patching code as a hint to stop emitting PAC instructions altogether. (Thin LTO appears unaffected by this)
Does this affect all Clang versions? Is there a compiler bug filed for this issue?
No, not yet.
I suppose reporting this as-is with LLVM is not going to be practical, but I'm not sure how to isolate a reproducer. Note that there are other compilation units (under arch/arm64/kernel/pi) that are also built with -mbranch-protection=none, but those don't appear to trigger this issue in the same way.
Quoted 9 lines
Quoted 5 lines
Work around this by stripping unwind tables from the object in question, which should be sufficient to prevent the patching code from attempting to patch itself.
Signed-off-by Ard Biesheuvel <[email protected]>Please add a Fixes tag to ensure this gets backported. Otherwise, looks like a reasonable workaround to me.
Ok
Quoted 2 lines
Reviewed-by Sami Tolvanen <[email protected]>
Thanks
Quoted 1 line
Sami
_______________________________________________
linux-arm-kernel mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
Quoted 20 lines · Ard Biesheuvel
(cc Nathan)
Quoted 7 lines · Sami Tolvanen
Hi Ard,
Quoted 3 lines · Ard Biesheuvel
From: Ard Biesheuvel <[email protected]>
Quoted 8 lines
Quoted 4 lines
Full LTO takes the '-mbranch-protection=none' passed to the compiler when generating the dynamic shadow call stack patching code as a hint to stop emitting PAC instructions altogether. (Thin LTO appears unaffected by this)
Does this affect all Clang versions? Is there a compiler bug filed for this issue?
Quoted 7 lines
No, not yet.
I suppose reporting this as-is with LLVM is not going to be practical, but I'm not sure how to isolate a reproducer. Note that there are other compilation units (under
arch/arm64/kernel/pi) that are also built with -mbranch-protection=none, but those don't appear to trigger this issue in the same way.
It's probably because LTO is disabled for the directory, so the TUs there get compiled separately.
Sami
_______________________________________________
linux-arm-kernel mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
Quoted 8 lines · Ard Biesheuvel
From: Ard Biesheuvel <[email protected]>
Full LTO takes the '-mbranch-protection=none' passed to the compiler when generating the dynamic shadow call stack patching code as a hint to stop emitting PAC instructions altogether. (Thin LTO appears unaffected by this)
[...]
Applied to arm64 (for-next/core), thanks!
[1/1] arm64: scs: Work around full LTO issue with dynamic SCS
https://git.kernel.org/arm64/c/8c5a19cb17a7
Cheers,
Signature · 10 lines
Will https://fixes.arm64.dev https://next.arm64.dev https://will.arm64.dev _______________________________________________ linux-arm-kernel mailing list [email protected] http://lists.infradead.org/mailman/listinfo/linux-arm-kernel