[PATCH v1 0/2] aarch64: check GCS feature in GNU properties of input dynamic objects

[Matthieu Longo]

The Guarded Control Stack (GCS) feature requires that two things:
- at static link time, all the input objects of a link unit have to be compatible with GCS.
- at runtime, the executable and the shared libraries which it depends on have to be compatible with GCS.
Both of those criteria are checked with the GCS feature stored in the GNU property note.

The previous patch [1] adding support the GCS feature check in GNU note properties for input objects ignored the input dynamic objects.
Although this support was better than no check, it was still delaying the detection of compatibility issues up to the runtime linker.

In order to help the developer in detecting such an incompatibility issue as early as possible, this patch adds a check for input dynamic objects lacking the GCS marking. This check can be controlled via the linker option '-z gcs-report-dynamic[=none|warning|error]'. By default, if the option is omitted, it inherits the value from '-z gcs-report'. However, the inherited value is capped to 'warning' as a user might want to only report errors in the currently built module, and not the shared dependencies. If a user also wants to error on GCS issues in the shared libraries, '-z gcs-report-dynamic=error' will have to be specified explicitly.

This patch series also adds GCS tests for linking issues with dynamic objects.

Regression tested on aarch64-unknown-linux-gnu.
Ok for binutils-master?

Regards,
Matthieu.

[1]: https://inbox.sourceware.org/binutils/20241202143758.3429709-1-matthieu.longo@arm.com/

Matthieu Longo (2):
  aarch64: check GCS feature in GNU properties of input dynamic objects
  aarch64: GCS tests for linking issues with dynamic objects

 bfd/elfnn-aarch64.c                           |  14 +++
 bfd/elfxx-aarch64.c                           | 119 +++++++++++++++---
 bfd/elfxx-aarch64.h                           |  13 +-
 ld/emultempl/aarch64elf.em                    |  34 ++++-
 ld/ld.texi                                    |  30 ++++-
 .../protections/aarch64-protections.exp       |  15 +++
 .../ld-aarch64/protections/gcs-dynamic-1-a.d  |  12 ++
 .../ld-aarch64/protections/gcs-dynamic-1-b.d  |  12 ++
 .../protections/gcs-dynamic-2-a-i.d           |  15 +++
 .../protections/gcs-dynamic-2-a-ii.d          |   8 ++
 .../protections/gcs-dynamic-2-a-iii.d         |  15 +++
 .../protections/gcs-dynamic-2-a-iv.d          |  12 ++
 .../ld-aarch64/protections/gcs-dynamic-2-b.d  |  14 +++
 .../ld-aarch64/protections/gcs-dynamic-2-c.d  |  12 ++
 .../ld-aarch64/protections/gcs-dynamic-2-d.d  |  14 +++
 .../ld-aarch64/protections/gcs-dynamic-3-a.d  |  15 +++
 .../ld-aarch64/protections/gcs-dynamic-3-b.d  |  14 +++
 .../ld-aarch64/protections/gcs-dynamic-3-c.d  |  12 ++
 .../ld-aarch64/protections/gcs-dynamic-4-a.d  |   7 ++
 .../ld-aarch64/protections/gcs-dynamic-4-b.d  |   7 ++
 .../ld-aarch64/protections/gcs-dynamic-4-c.d  |   7 ++
 ld/testsuite/ld-aarch64/protections/gcs-so.s  |  28 +++++
 ld/testsuite/ld-aarch64/protections/gcs-so2.s |  28 +++++
 23 files changed, 428 insertions(+), 29 deletions(-)
 create mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-1-a.d
 create mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-1-b.d
 create mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-i.d
 create mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-ii.d
 create mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-iii.d
 create mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-a-iv.d
 create mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-b.d
 create mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-c.d
 create mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-2-d.d
 create mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-3-a.d
 create mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-3-b.d
 create mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-3-c.d
 create mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-4-a.d
 create mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-4-b.d
 create mode 100644 ld/testsuite/ld-aarch64/protections/gcs-dynamic-4-c.d
 create mode 100644 ld/testsuite/ld-aarch64/protections/gcs-so.s
 create mode 100644 ld/testsuite/ld-aarch64/protections/gcs-so2.s

-- 
2.47.1