Re: [RFC 3/3] arm64: bti: Drop compiler specific BTI checks

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] arm64: Kconfig: GCC 9 BTI code generation defect exposed
--

commit 1d7b856a59cb9c3b290733174839f2dcf79cb2c1
Author: Jeremy Linton <jeremy.linton@arm.com>

arm64: bti: Drop compiler specific BTI checks

This commit drops compiler-specific version checks for ARM64_BTI_KERNEL,
relying on a link pass to correct specific cases of missing BTI landing
pads in modules generated by clang and gcc.

> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
> index 41ce1fd6ca91e..3c9b89fc215c2 100644
> --- a/arch/arm64/Kconfig
> +++ b/arch/arm64/Kconfig
> @@ -2140,12 +2140,6 @@ config ARM64_BTI_KERNEL
>  	depends on ARM64_BTI
>  	depends on ARM64_PTR_AUTH_KERNEL
>  	depends on CC_HAS_BRANCH_PROT_PAC_RET_BTI
> -	# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94697
> -	depends on !CC_IS_GCC || GCC_VERSION >= 100100

[Severity: High]
Does the newly added module link script mitigate the specific code generation
defect from GCC bug 94697?

The new script scans for and mitigates missing landing pads for cross-section
direct module calls to address GCC bug 106671 and LLVM issue 215547. However,
GCC bug 94697 is a separate defect present in GCC 9 where the compiler fails
to emit BTI landing pads for internal indirect branches to address-taken local
labels.

If the script does not rewrite internal indirect branches, dropping this check
will allow GCC 9 to build a BTI-enabled kernel with incorrectly annotated
machine code. Will this result in runtime Branch Target exceptions when
executing those internal indirect branches?

> -	# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106671
> -	depends on !CC_IS_GCC
> -	# https://github.com/llvm/llvm-project/issues/215547
> -	depends on !CC_IS_CLANG || CLANG_VERSION < 210000
>  	depends on (!FUNCTION_GRAPH_TRACER || DYNAMIC_FTRACE_WITH_ARGS)
>  	help
>  	  Build the kernel with Branch Target Identification annotations

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261006221815.2823252-1-jeremy.linton@arm.com?part=3