Re: [PATCH 11/12] arm64/bti: Force-enable BTI linker veneers

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] ld-option incorrectly evaluates to true for -z force-bti on older GNU ld versions, causing build failures.
--

--- Patch [11]: [PATCH 11/12] arm64/bti: Force-enable BTI linker veneers ---
commit dc92fd3fe21010a76154b8b30a8e4ff7c0d55416
Author: Josh Poimboeuf <jpoimboe@xxxxxxxxxx>

arm64/bti: Force-enable BTI linker veneers

This commit force-enables BTI veneers using the "-z force-bti" linker
option to ensure they are created even if some input objects are missing
the BTI feature bit. This aims to prevent silent runtime BTI exceptions
on larger kernels.

> diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
> index 4eee721c0b278..d0db9a6766a2f 100644
> --- a/arch/arm64/Makefile
> +++ b/arch/arm64/Makefile
> @@ -25,6 +25,7 @@ endif
>  
>  ifeq ($(CONFIG_ARM64_BTI_KERNEL),y)
>  KBUILD_AFLAGS	+= -include $(srctree)/arch/arm64/include/asm/bti-note.h
> +LDFLAGS_vmlinux	+= $(call ld-option,-z force-bti)

[Severity: Medium]
Does this ld-option check reliably detect if the linker supports "-z force-bti"?

When Kbuild's ld-option tests linker support, it executes the linker with "-v".
However, when GNU ld is invoked with "-v" and no input files, it prints its
version information and immediately exits with a 0 status code, completely
bypassing any validation of keyword arguments like "-z".

Because of this, ld-option will falsely report that "-z force-bti" is supported
on all versions of GNU ld, even older versions (prior to 2.34) where the option
was not yet introduced. 

During the actual kernel link, ld parses the "-z" list, fails to recognize
"force-bti", and emits an ignored warning. If CONFIG_WERROR=y is set, the linker
escalates this warning to a fatal error and breaks the build. On builds without
CONFIG_WERROR, the warning is ignored and the patch silently fails to enforce
the intended BTI veneers.

>  endif
>  
>  cc_has_k_constraint := $(call try-run,echo				\

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/cover.1786768375.git.jpoimboe@xxxxxxxxxx?part=11