linux-kernel - [PATCH] objtool: Ignore __pi___cfi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250908-x86-startup-fix-pi-cfi-warnings-v1-1-4b42b43fecf3@kernel.org>
Date: Mon, 08 Sep 2025 13:04:18 -0700
From: Nathan Chancellor <nathan@...nel.org>
To: Josh Poimboeuf <jpoimboe@...nel.org>, 
 Peter Zijlstra <peterz@...radead.org>, Borislav Petkov <bp@...en8.de>, 
 Ard Biesheuvel <ardb@...nel.org>
Cc: x86@...nel.org, linux-kernel@...r.kernel.org, 
 Nathan Chancellor <nathan@...nel.org>
Subject: [PATCH] objtool: Ignore __pi___cfi_ prefixed symbols

When building with CONFIG_CFI_CLANG=y after the recent series to
separate the x86 startup code, there are objtool warnings along the
lines of:

  vmlinux.o: warning: objtool: __pi___cfi_startup_64_load_idt() falls through to next function __pi_startup_64_load_idt()
  vmlinux.o: warning: objtool: __pi___cfi_startup_64_setup_gdt_idt() falls through to next function __pi_startup_64_setup_gdt_idt()
  vmlinux.o: warning: objtool: __pi___cfi___startup_64() falls through to next function __pi___startup_64()

As the comment in validate_branch() states, this is expected, so ignore
these symbols in the same way that __cfi_ and __pfx_ symbols are already
ignored for the rest of the kernel.

Fixes: 7b38dec3c5af ("x86/boot: Create a confined code area for startup code")
Signed-off-by: Nathan Chancellor <nathan@...nel.org>
---
 tools/objtool/check.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 92ce18886477..6d6323508e4b 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -3576,6 +3576,7 @@ static int validate_branch(struct objtool_file *file, struct symbol *func,
 			/* Ignore KCFI type preambles, which always fall through */
 			if (!strncmp(func->name, "__cfi_", 6) ||
 			    !strncmp(func->name, "__pfx_", 6) ||
+			    !strncmp(func->name, "__pi___cfi_", 11) ||
 			    !strncmp(func->name, "__pi___pfx_", 11))
 				return 0;
 

---
base-commit: 8e5b2f272c1801071142af33b193130bbcc5ba9d
change-id: 20250908-x86-startup-fix-pi-cfi-warnings-9edf2970ddfe

Best regards,
--  
Nathan Chancellor <nathan@...nel.org>