linux-kernel - Re: [PATCH v3 1/7] x86/boot/startup: Disable objtool validation for library code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f4ac5bf3-d380-45c3-a48c-2969cd49b32c@intel.com>
Date: Wed, 9 Apr 2025 13:45:09 +0530
From: "Borah, Chaitanya Kumar" <chaitanya.kumar.borah@...el.com>
To: Ard Biesheuvel <ardb+git@...gle.com>, <linux-efi@...r.kernel.org>
CC: <x86@...nel.org>, <mingo@...nel.org>, <linux-kernel@...r.kernel.org>, "Ard
 Biesheuvel" <ardb@...nel.org>, Tom Lendacky <thomas.lendacky@....com>,
	"Dionna Amalie Glaze" <dionnaglaze@...gle.com>, Kevin Loughlin
	<kevinloughlin@...gle.com>, <chaitanya.kumar.borah@...el.com>
Subject: Re: [PATCH v3 1/7] x86/boot/startup: Disable objtool validation for
 library code


On 4/8/2025 2:22 PM, Ard Biesheuvel wrote:
> From: Ard Biesheuvel <ardb@...nel.org>
>
> The library code built under arch/x86/boot/startup is not intended to be
> linked into vmlinux but only into the decompressor and/or the EFI stub.
>
> This means objtool validation is not needed here, and may result in
> false positive errors for things like missing retpolines.
>
> So disable it for all objects added to lib-y
>
> Signed-off-by: Ard Biesheuvel <ardb@...nel.org>

Solves 
https://lore.kernel.org/intel-gfx/CAMj1kXEfBMczOmA2+dMMubuD-qE59GTAiV2E_9m8KNG4-rgP6Q@mail.gmail.com/T/#mbf2913e778475b70617390d4a5d0244295b9cb8c

Tested-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@...el.com>

> ---
>   arch/x86/boot/startup/Makefile | 6 ++++++
>   1 file changed, 6 insertions(+)
>
> diff --git a/arch/x86/boot/startup/Makefile b/arch/x86/boot/startup/Makefile
> index 73946a3f6b3b..8919a1cbcb5a 100644
> --- a/arch/x86/boot/startup/Makefile
> +++ b/arch/x86/boot/startup/Makefile
> @@ -4,3 +4,9 @@ KBUILD_AFLAGS		+= -D__DISABLE_EXPORTS
>   
>   lib-$(CONFIG_X86_64)		+= la57toggle.o
>   lib-$(CONFIG_EFI_MIXED)		+= efi-mixed.o
> +
> +#
> +# Disable objtool validation for all library code, which is intended
> +# to be linked into the decompressor or the EFI stub but not vmlinux
> +#
> +$(patsubst %.o,$(obj)/%.o,$(lib-y)): OBJECT_FILES_NON_STANDARD := y