On a kernel whose text exceeds the +/128MB direct branch range, the linker inserts veneers. With BTI enabled, the veneers' indirect branch targets need a BTI landing pad, which not all functions have starting with Clang 21 (and for all versions of GCC).
In such cases the linker can emit a second veneer close to the target which has the landing pad along with a direct branch to the target. But a long branch to .idmap.text never gets one because it's missing the executable section flag. With the LLVM linker, it's a silent failure, presumably only discovered by a BTI exception at runtime. With the GNU linker it's even worse, as it dereferences the missing stub/veneer group entry and seg faults (this was how I discovered it). Make sure the section is executable by adding the "x" flag to all the creators of the input section. Also manually add "bti c" to primary_entry() and enter_vhe(), otherwise the linker-generated veneer page pushes the .idmap.text past its asserted 4KB size: ld.bfd: ID map text too big or misaligned Link: https://sourceware.org/bugzilla/show_bug.cgi?id=34525 Signed-off-by: Josh Poimboeuf <[email protected]> --- arch/arm64/kernel/cpu-reset.S | 2 +- arch/arm64/kernel/head.S | 7 ++++--- arch/arm64/kernel/hyp-stub.S | 1 + arch/arm64/kernel/sleep.S | 2 +- arch/arm64/mm/proc.S | 8 ++++---- 5 files changed, 11 insertions(+), 9 deletions(-) diff --git a/arch/arm64/kernel/cpu-reset.S b/arch/arm64/kernel/cpu-reset.S index c87445dde6745..9943a7c70f6b0 100644 --- a/arch/arm64/kernel/cpu-reset.S +++ b/arch/arm64/kernel/cpu-reset.S @@ -14,7 +14,7 @@ #include <asm/virt.h> .text -.pushsection .idmap.text, "a" +.pushsection .idmap.text, "ax" /* * cpu_soft_restart(el2_switch, entry, arg0, arg1, arg2) diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S index 87a822e5c4ca8..541721488bef9 100644 --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -71,7 +71,7 @@ __EFI_PE_HEADER - .section ".idmap.text","a" + .section ".idmap.text","ax" /* * The following callee saved general purpose registers are used on the @@ -83,6 +83,7 @@ * x21 primary_entry() .. start_kernel() FDT pointer passed at boot in x0 */ SYM_CODE_START(primary_entry) + bti c bl record_mmu_state bl preserve_boot_args @@ -251,7 +252,7 @@ SYM_FUNC_END(__primary_switched) * end early head section, begin head code that is also used for * hotplug and needs to have the same protections as the text region */ - .section ".idmap.text","a" + .section ".idmap.text","ax" /* * Starting from EL2 or EL1, configure the CPU to execute at the highest @@ -455,7 +456,7 @@ SYM_FUNC_END(set_cpu_boot_mode_flag) * Checks if the selected granule size is supported by the CPU. * If it isn't, park the CPU */ - .section ".idmap.text","a" + .section ".idmap.text","ax" SYM_FUNC_START(__enable_mmu) mrs x3, ID_AA64MMFR0_EL1 ubfx x3, x3, #ID_AA64MMFR0_EL1_TGRAN_SHIFT, 4 diff --git a/arch/arm64/kernel/hyp-stub.S b/arch/arm64/kernel/hyp-stub.S index 37c6976e44a4c..5f9c5ffb4afc1 100644 --- a/arch/arm64/kernel/hyp-stub.S +++ b/arch/arm64/kernel/hyp-stub.S @@ -167,6 +167,7 @@ SYM_CODE_END(__finalise_el2) .pushsection .idmap.text, "ax" SYM_CODE_START_LOCAL(enter_vhe) + bti c // Invalidate TLBs before enabling the MMU tlbi vmalle1 dsb nsh diff --git a/arch/arm64/kernel/sleep.S b/arch/arm64/kernel/sleep.S index f093cdf71be11..dfb5b8bc8cdb5 100644 --- a/arch/arm64/kernel/sleep.S +++ b/arch/arm64/kernel/sleep.S @@ -97,7 +97,7 @@ SYM_FUNC_START(__cpu_suspend_enter) ret SYM_FUNC_END(__cpu_suspend_enter) - .pushsection ".idmap.text", "a" + .pushsection ".idmap.text", "ax" SYM_CODE_START(cpu_resume) mov x0, xzr bl init_kernel_el diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S index 22866b49be372..b8ff93c748bf1 100644 --- a/arch/arm64/mm/proc.S +++ b/arch/arm64/mm/proc.S @@ -175,7 +175,7 @@ alternative_else_nop_endif SYM_FUNC_END(cpu_do_resume) #endif - .pushsection ".idmap.text", "a" + .pushsection ".idmap.text", "ax" .macro __idmap_cpu_set_reserved_ttbr1, tmp1, tmp2 adrp \tmp1, reserved_pg_dir @@ -211,7 +211,7 @@ SYM_FUNC_ALIAS(__pi_idmap_cpu_replace_ttbr1, idmap_cpu_replace_ttbr1) #define KPTI_NG_PTE_FLAGS (PTE_ATTRINDX(MT_NORMAL) | PTE_TYPE_PAGE | \ PTE_AF | PTE_SHARED | PTE_UXN | PTE_WRITE) - .pushsection ".idmap.text", "a" + .pushsection ".idmap.text", "ax" .macro pte_to_phys, phys, pte and \phys, \pte, #PTE_ADDR_LOW @@ -438,7 +438,7 @@ SYM_FUNC_END(idmap_kpti_install_ng_mappings) .popsection #endif - .pushsection ".idmap.text", "a" + .pushsection ".idmap.text", "ax" SYM_TYPED_FUNC_START(wait_linear_map_split_to_ptes) /* Must be same registers as in idmap_kpti_install_ng_mappings */ swapper_ttb .req x3 @@ -479,7 +479,7 @@ SYM_FUNC_END(wait_linear_map_split_to_ptes) * Output: * Return in x0 the value of the SCTLR_EL1 register. */ - .pushsection ".idmap.text", "a" + .pushsection ".idmap.text", "ax" SYM_FUNC_START(__cpu_setup) tlbi vmalle1 // Invalidate local TLB dsb nsh -- 2.55.0
