Re: [PATCH] arm64/module: Fix livepatch BTI exceptions with Clang 21+
From: Nick Desaulniers <ndesaulniers@google.com>
Date: 2026-08-11 16:27:57
Also in:
linux-arm-kernel, lkml
On Tue, Aug 11, 2026 at 7:23 AM Will Deacon [off-list ref] wrote:
On Tue, Aug 11, 2026 at 03:18:17PM +0200, Ard Biesheuvel wrote:quoted
On Tue, 11 Aug 2026, at 14:02, Ard Biesheuvel wrote:quoted
On Tue, 11 Aug 2026, at 11:44, Will Deacon wrote:quoted
On Mon, Aug 10, 2026 at 09:41:35AM -0700, Nick Desaulniers wrote:quoted
quoted
Sure, but let's replace this with a link to a bug report in llvm's issue tracker?Yes, please! I can apply the patch once we have the bug number.I can look into that.https://github.com/llvm/llvm-project/issues/215547Thanks, Ard. I've ended up with the patch below.
What's the extent that HAVE_LIVEPATCH will be used? Does this penalize kernels built with BTI in favor of HAVE_LIVEPATCH? For example, with my Android hat on, if we have a kernel that's built with ARM64_BTI_KERNEL=y, and _dont_ use HAVE_LIVEPATCH, we're going to turn off BTI for a feature we're not using? But maybe we _do_ intend to use HAVE_LIVEPATCH, and my assumption was wrong?
quoted hunk ↗ jump to hunk
Will --->8 Author: Josh Poimboeuf [off-list ref] Date: Tue Aug 11 14:11:44 2026 +0000 arm64: bti: Disable in-kernel BTI with recent versions of Clang The following BTI exception was seen when loading a livepatch module: Internal error: Oops - BTI: 0000000036000001 [#1] SMP pstate: 634004c9 (nZCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=jc) pc : kill_orphaned_pgrp+0x0/0x150 lr : do_exit+0x498/0xaf0 [livepatch_combined] The problem is that the patch module's do_exit() is branching to a static function in vmlinux using a module PLT veneer (indirect branch), but the target function doesn't have a BTI landing pad. Clang 21+ omits the landing pad for static functions which can only be reached by a direct branch. That's normally fine for ordinary modules which only branch to global exported functions, but Mark Brown points out [1] that this isn't guaranteed if the module branches between sections. Futhermore, livepatch modules use klp relocations to reference arbitrary kernel symbols, so with CONFIG_RANDOMIZE_MODULE_REGION_FULL the module is far enough from the kernel that every R_AARCH64_CALL26 needs a PLT. Put Clang 21+ in the naughty corner alongside GCC, which suffers from the same issue, by disabling CONFIG_ARM64_BTI_KERNEL until we have a version of the toolchain with the problem resolved. Cc: Ard Biesheuvel [off-list ref] Link: https://lore.kernel.org/r/da06bbd3-d04b-4d0f-b331-f5b91bc373a5@sirena.org.uk (local) [1] Fixes: fd1e0fd71f65 ("arm64: Implement HAVE_LIVEPATCH") Signed-off-by: Josh Poimboeuf [off-list ref] [will: Stitched together commit message, diff and bug number] Signed-off-by: Will Deacon [off-list ref]diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index b3afe0688919..fc57d90d92c1 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig@@ -2116,6 +2116,8 @@ config ARM64_BTI_KERNEL depends on !CC_IS_GCC || GCC_VERSION >= 100100 # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106671 depends on !CC_IS_GCC + # https://github.com/llvm/llvm-project/issues/215547 + depends on !CC_IS_CLANG || CLANG_VERSION < 210000 depends on (!FUNCTION_GRAPH_TRACER || DYNAMIC_FTRACE_WITH_ARGS) help Build the kernel with Branch Target Identification annotations
-- Thanks, ~Nick Desaulniers