On Fri, 30 Jan 2026 14:28:24 +0100
Marco Elver <elver@google.com> wrote:
> The implementation of __READ_ONCE() under CONFIG_LTO=y incorrectly
> qualified the fallback "once" access for types larger than 8 bytes,
> which are not atomic but should still happen "once" and suppress common
> compiler optimizations.
>
> The cast `volatile typeof(__x)` applied the volatile qualifier to the
> pointer type itself rather than the pointee. This created a volatile
> pointer to a non-volatile type, which violated __READ_ONCE() semantics.
>
> Fix this by casting to `volatile typeof(*__x) *`.
>
> With a defconfig + LTO + debug options build, we see the following
> functions to be affected:
>
> xen_manage_runstate_time (884 -> 944 bytes)
> xen_steal_clock (248 -> 340 bytes)
> ^-- use __READ_ONCE() to load vcpu_runstate_info structs
>
> Fixes: e35123d83ee3 ("arm64: lto: Strengthen READ_ONCE() to acquire when CONFIG_LTO=y")
> Cc: <stable@vger.kernel.org>
> Reviewed-by: Boqun Feng <boqun@kernel.org>
> Signed-off-by: Marco Elver <elver@google.com>
I found this in some testing (on godbolt), so:
Tested-by: David Laight <david.laight.linux@gmail.com>
> ---
> arch/arm64/include/asm/rwonce.h | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/arm64/include/asm/rwonce.h b/arch/arm64/include/asm/rwonce.h
> index 78beceec10cd..fc0fb42b0b64 100644
> --- a/arch/arm64/include/asm/rwonce.h
> +++ b/arch/arm64/include/asm/rwonce.h
> @@ -58,7 +58,7 @@
> default: \
> atomic = 0; \
> } \
> - atomic ? (typeof(*__x))__u.__val : (*(volatile typeof(__x))__x);\
> + atomic ? (typeof(*__x))__u.__val : (*(volatile typeof(*__x) *)__x);\
> })
>
> #endif /* !BUILD_VDSO */