From patchwork Tue Jan 23 13:30:55 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 13527458 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 6EFB1C47DDB for ; Tue, 23 Jan 2024 13:31:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Cc:To:From:Subject:Message-ID: References:Mime-Version:In-Reply-To:Date:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=Hn8/PwQfGn2zMk1yZ0bttzH7l4hh3O5jvH6x01OZqWw=; b=si9I4LijtH8SsawncTrxQQIGHx 5tShXTdkNPg5pGk43QqO6fIGWOqoQmO6rCC46JS3VS+OfQoVVBZOrsf3/g0QkX5LP8sSw9h9ADYma 5/UM2/Mcxe1+ZrM1jkTz07p/lWuc78CP4r4/5yDxg4F6oP7+3+dIettZ/jYQBvhrHBFYIrXfdmHp5 M8wN9QP80QtXELclqFVkmf01E/36+HFTbTXOZEt8Di65jrc7lEzE3RP0eqHtmseNqaUAsde0Wm6EE JF+UWx1YGdVfC+BPk/NDurPS3BUlz3bvHHt80I4Sq0AKE8/9TX/UV8jA7r0dIRtwZFNMWhdaATb2j RHQ+3+cQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1rSGs7-00Gd4R-2V; Tue, 23 Jan 2024 13:31:23 +0000 Received: from mail-yw1-x1149.google.com ([2607:f8b0:4864:20::1149]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1rSGrv-00Gcwm-1u for linux-arm-kernel@lists.infradead.org; Tue, 23 Jan 2024 13:31:12 +0000 Received: by mail-yw1-x1149.google.com with SMTP id 00721157ae682-5ff7cf2fd21so44290177b3.1 for ; Tue, 23 Jan 2024 05:31:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1706016667; x=1706621467; darn=lists.infradead.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=VeQEnQMAaKVbgrVUhl3pEs5BZS3M5I1oxCaLYERlw2Y=; b=mWOQ4FO129VesWAgbLLC/jqcxwMxLpqQAdpYWGDo+TaYGs13pdwZH6yxUUPQCte5EP guH9SlXDU5WtR+Gn9oUY5Pmc+116UpSXcmagbomPYO9Ka7kJxwlWf1M16I8gLHxTiZeg PpWsWes0QJ9/81Xfn1qshrpAvJ09gJTR55wq6eXMJe7HBHh5VVrlJ/STyFUwKIkqxDm5 v+i4BnggneFay2n/CacQJkUXKSlhAtltz7PRirFqxRiDBOw7MyJ5q27HsVb531GgASKl wLzLeUUiO9Nx8QaWoAv59EhvQZWjjOkRO6q5HxRgMb3YEeS7+fPYVRtVMuBDS4pes3PD /xRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1706016667; x=1706621467; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=VeQEnQMAaKVbgrVUhl3pEs5BZS3M5I1oxCaLYERlw2Y=; b=G2zeMX4xM60mjmu+y4pVINEgMBa7wTyb3TS0eSJXxWuU298GuGcvEN7Jua2DDIeEdT Nk6d/AR53asr5rLvjLr0adnefKDYCf3Qx2O5npnDPiFqtZVm6B/EkND1UBpNWVCdhctz zAjCiNa/rcwRmJL8mjd3EoHH304AF5Be4XLPUCbGjcmlQSOMwP10DqOmgkkbHTswXwMm pxLD2Xa4yvDna5ipsSzsXuIKahr325ahasUhSIJUerr4LRIvM0A0riiobbffe7A7CVhX d1JiHmS005ARip/Cv5YaiV0o/doIXyy0BF1LjeLIOLGmMhl2GxipqBSU5rHG1muvXjN9 bkMg== X-Gm-Message-State: AOJu0Yw84YwZ9nqPNfZooow3V/yj69SIx3c7k0cLkepb4AX2fmISrB+6 c2vEZjrT8mJ8YBs0LGo5iBdKklBDc0lZtE2cWHQw09PqDZpjrtvl2JqDAPK55/dl4w1kUAEksaC l1gkCZ+e8tCAVBGjC0AKpys5/aJXOTtgJjNx5Pzn3hy07QHOCk49mvzYcP9ecfv84ebz8ry8hrU e1W/bgZ1DIezyXu/8EePV3ASqVadClAh5dSPQ1HWLg X-Google-Smtp-Source: AGHT+IHQtA5KLOcUl3hbaVrVBQpPthBZcFGFbXocKgIaksQ+yTwL7ZH/HxPNjX4I+V8t+Jgw8qTJcvbj X-Received: from palermo.c.googlers.com ([fda3:e722:ac3:cc00:28:9cb1:c0a8:118a]) (user=ardb job=sendgmr) by 2002:a81:b644:0:b0:5f7:49b7:a57d with SMTP id h4-20020a81b644000000b005f749b7a57dmr3108875ywk.1.1706016666732; Tue, 23 Jan 2024 05:31:06 -0800 (PST) Date: Tue, 23 Jan 2024 14:30:55 +0100 In-Reply-To: <20240123133052.1417449-4-ardb+git@google.com> Mime-Version: 1.0 References: <20240123133052.1417449-4-ardb+git@google.com> X-Developer-Key: i=ardb@kernel.org; a=openpgp; fpr=F43D03328115A198C90016883D200E9CA6329909 X-Developer-Signature: v=1; a=openpgp-sha256; l=1521; i=ardb@kernel.org; h=from:subject; bh=QKIyshRQ/CFFi9hzE0yb4ofr/EWAu3MgxFPO+jOEI3I=; b=owGbwMvMwCFmkMcZplerG8N4Wi2JIXX9/v59Ftvmz0p6vGvJ58uF10uC57xeXWk8Y7XKAYZ73 lc73r+u7ihlYRDjYJAVU2QRmP333c7TE6VqnWfJwsxhZQIZwsDFKQATMahh+F/m2JS63ljU3S6v YUaL8J3NGmF3yt/9zsr+syqm7345vxDDb3YPxi/Hd9bpX/5j1bgn8oraFt+QnUJSf9WWn7/WdPr IXhYA X-Mailer: git-send-email 2.43.0.429.g432eaa2c6b-goog Message-ID: <20240123133052.1417449-6-ardb+git@google.com> Subject: [PATCH 2/2] arm64: scs: Disable LTO for SCS patching code From: Ard Biesheuvel To: linux-arm-kernel@lists.infradead.org Cc: will@kernel.org, catalin.marinas@arm.com, mark.rutland@arm.com, Ard Biesheuvel , Sami Tolvanen , Kees Cook X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240123_053111_640105_AE3696F2 X-CRM114-Status: GOOD ( 11.64 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org From: Ard Biesheuvel Full LTO takes the '-mbranch-protection=none' passed to the compiler when generating the dynamic shadow call stack patching code as a hint to stop emitting PAC instructions altogether. (Thin LTO appears unaffected by this) Work around this by disabling LTO for the compilation unit, which appears to convince the linker that it should still use PAC in the rest of the kernel.. Fixes: 3b619e22c460 ("arm64: implement dynamic shadow call stack for Clang") Signed-off-by: Ard Biesheuvel --- arch/arm64/kernel/Makefile | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile index d95b3d6b471a..467cb7117273 100644 --- a/arch/arm64/kernel/Makefile +++ b/arch/arm64/kernel/Makefile @@ -73,7 +73,13 @@ obj-$(CONFIG_ARM64_MTE) += mte.o obj-y += vdso-wrap.o obj-$(CONFIG_COMPAT_VDSO) += vdso32-wrap.o obj-$(CONFIG_UNWIND_PATCH_PAC_INTO_SCS) += patch-scs.o + +# We need to prevent the SCS patching code from patching itself. Using +# -mbranch-protection=none here to avoid the patchable PAC opcodes from being +# generated triggers an issue with full LTO on Clang, which stops emitting PAC +# instructions altogether. So disable LTO as well for the compilation unit. CFLAGS_patch-scs.o += -mbranch-protection=none +CFLAGS_REMOVE_patch-scs.o += $(CC_FLAGS_LTO) # Force dependency (vdso*-wrap.S includes vdso.so through incbin) $(obj)/vdso-wrap.o: $(obj)/vdso/vdso.so