[PATCH v4 03/14] livepatch/klp-build: use -fPIC and drop direct-extern-access on LoongArch

[George Guo <dongtai.guo@linux.dev>]

From: George Guo <guodongtai@kylinos.cn>

On LoongArch, the klp relocation machinery redirects a livepatch's
reference to a core-kernel symbol through a GOT entry. klp-build extracts
the patched function into a separate module while the referenced symbol
stays in the core kernel, so the reference must be GOT-indirect for that
redirect to work. Two default compiler behaviours defeat this and make a
loaded livepatch module fault.

The first is a same-unit global (the syscall test patches sys_newuname()
in kernel/sys.c, which reads 'uts_sem', a rw_semaphore defined in the
same file). With CONFIG_RELOCATABLE=y the kernel is built -fPIE. For
a global defined in the same unit, -fPIE emits a direct PC-relative
reference (R_LARCH_PCALA_*) and skips the GOT, while -fPIC routes it
through the GOT (R_LARCH_GOT_PC_*). Once klp-build moves the patched
function into the livepatch module, the direct reference has no GOT
slot to redirect and faults.

The second is an extern global. -mdirect-extern-access replaces GOT-based
external symbol access with direct addressing. A livepatch reference to
such a symbol then has no GOT slot to fix up, and the wrong address faults
the kernel. This optimization was added by commit 38b10b269d04
("LoongArch: Tweak CFLAGS for Clang compatibility") as a nice-to-have that
reduces GOT accesses.

For LoongArch KLP builds, keep both forms GOT-indirect:

 - Add -fPIC via KCFLAGS. -fPIE is not enough; it optimizes away the very
   GOT indirection KLP relies on.
 - Disable direct-extern-access: -mno-direct-extern-access for GCC,
   -fno-direct-access-external-data for Clang.

Co-developed-by: Kexin Liu <liukexin@kylinos.cn>
Signed-off-by: Kexin Liu <liukexin@kylinos.cn>
Signed-off-by: George Guo <guodongtai@kylinos.cn>
---
 scripts/livepatch/klp-build | 43 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 42 insertions(+), 1 deletion(-)

diff --git a/scripts/livepatch/klp-build b/scripts/livepatch/klp-build
index e83973567c87..27463def08f8 100755
--- a/scripts/livepatch/klp-build
+++ b/scripts/livepatch/klp-build
@@ -278,6 +278,13 @@ validate_config() {
 	[[ -x "$OBJTOOL" ]] && "$OBJTOOL" klp 2>&1 | command grep -q "not implemented" && \
 		die "objtool not built with KLP support; install xxhash-devel/libxxhash-dev (version >= 0.8) and recompile"
 
+	if [[ -v CONFIG_LOONGARCH ]]; then
+		[[ -v CONFIG_AS_HAS_EXPLICIT_RELOCS ]] ||	\
+			die "LoongArch klp-build requires CONFIG_AS_HAS_EXPLICIT_RELOCS=y"
+		[[ -v CONFIG_RELOCATABLE ]] ||			\
+			die "LoongArch klp-build requires CONFIG_RELOCATABLE=y"
+	fi
+
 	return 0
 }
 
@@ -556,6 +563,31 @@ build_kernel() {
 	local log="$TMP_DIR/build.log"
 	local cmd=()
 
+	local ARCH_KBUILD_CFLAGS_KERNEL=""
+	local ARCH_KCFLAGS=""
+
+	# For KLP, LoongArch symbol references must stay GOT-indirect so the klp
+	# relocation machinery can redirect a cross-object reference through a
+	# GOT entry.  Two default behaviours defeat that (CONFIG_RELOCATABLE and
+	# CONFIG_AS_HAS_EXPLICIT_RELOCS are checked in validate_config()):
+	#
+	#  - -fPIE (added under CONFIG_RELOCATABLE) emits a direct PC-relative
+	#    reference for a same-unit global and skips the GOT; -fPIC routes it
+	#    through the GOT.  Add -fPIC via KCFLAGS.
+	#  - -mdirect-extern-access replaces GOT access for an extern global with
+	#    direct addressing.  Disable it.
+	if [[ -v CONFIG_LOONGARCH ]]; then
+		ARCH_KCFLAGS="-fPIC"
+
+		if [[ "${CONFIG_CC_IS_CLANG:-}" == "y" ]]; then
+			ARCH_KBUILD_CFLAGS_KERNEL="-fno-direct-access-external-data"
+		else
+			ARCH_KBUILD_CFLAGS_KERNEL="-mno-direct-extern-access"
+		fi
+
+		status "LoongArch detected: adding $ARCH_KBUILD_CFLAGS_KERNEL to KBUILD_CFLAGS_KERNEL"
+	fi
+
 	cmd=("make")
 
 	# When a patch to a kernel module references a newly created unexported
@@ -581,7 +613,16 @@ build_kernel() {
 		cmd+=("-s")
 	fi
 	cmd+=("-j$JOBS")
-	cmd+=("KCFLAGS=-ffunction-sections -fdata-sections")
+	cmd+=("KCFLAGS=-ffunction-sections -fdata-sections${ARCH_KCFLAGS:+ $ARCH_KCFLAGS}")
+	# -fPIC is added for KLP via KCFLAGS above; the arch adds -fPIE via
+	# KBUILD_CFLAGS_KERNEL, which kbuild places after KCFLAGS on the
+	# built-in compile line.  -fPIC/-fPIE is last-one-wins, so -fPIE would
+	# win.  Setting KBUILD_CFLAGS_KERNEL on the command line replaces the
+	# arch value (not append), which drops -fPIE and lets -fPIC win.  Only
+	# do this when an arch needs it (LoongArch).
+	if [[ -n "$ARCH_KBUILD_CFLAGS_KERNEL" ]]; then
+		cmd+=("KBUILD_CFLAGS_KERNEL=$ARCH_KBUILD_CFLAGS_KERNEL")
+	fi
 	cmd+=("vmlinux")
 	cmd+=("modules")
 
-- 
2.53.0