linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Ard Biesheuvel <ardb+git@google.com>
To: linux-kernel@vger.kernel.org
Cc: linux-efi@vger.kernel.org, x86@kernel.org,
	 Ard Biesheuvel <ardb@kernel.org>, Borislav Petkov <bp@alien8.de>,
	Ingo Molnar <mingo@kernel.org>,
	 Kevin Loughlin <kevinloughlin@google.com>,
	Tom Lendacky <thomas.lendacky@amd.com>,
	 Josh Poimboeuf <jpoimboe@kernel.org>,
	Peter Zijlstra <peterz@infradead.org>,
	 Nikunj A Dadhania <nikunj@amd.com>
Subject: [PATCH v5 16/22] x86/boot: Check startup code for absence of absolute relocations
Date: Wed, 16 Jul 2025 05:18:31 +0200	[thread overview]
Message-ID: <20250716031814.2096113-40-ardb+git@google.com> (raw)
In-Reply-To: <20250716031814.2096113-24-ardb+git@google.com>

From: Ard Biesheuvel <ardb@kernel.org>

Invoke objtool on each startup code object individually to check for the
absence of absolute relocations. This is needed because this code will
be invoked from the 1:1 mapping of memory before those absolute virtual
addresses (which are derived from the kernel virtual base address
provided to the linker and possibly shifted at boot) are mapped.

Only objects built under arch/x86/boot/startup/ have this restriction,
and once they have been incorporated into vmlinux.o, this distinction is
difficult to make. So force the invocation of objtool for each object
file individually, even if objtool is deferred to vmlinux.o for the rest
of the build. In the latter case, only pass --noabs and nothing else;
otherwise, append it to the existing objtool command line.

Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
 arch/x86/boot/startup/Makefile | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/x86/boot/startup/Makefile b/arch/x86/boot/startup/Makefile
index b514f7e81332..32737f4ab5a8 100644
--- a/arch/x86/boot/startup/Makefile
+++ b/arch/x86/boot/startup/Makefile
@@ -19,6 +19,7 @@ KCOV_INSTRUMENT	:= n
 
 obj-$(CONFIG_X86_64)		+= gdt_idt.o map_kernel.o
 obj-$(CONFIG_AMD_MEM_ENCRYPT)	+= sme.o sev-startup.o
+pi-objs				:= $(patsubst %.o,$(obj)/%.o,$(obj-y))
 
 lib-$(CONFIG_X86_64)		+= la57toggle.o
 lib-$(CONFIG_EFI_MIXED)		+= efi-mixed.o
@@ -28,3 +29,10 @@ lib-$(CONFIG_EFI_MIXED)		+= efi-mixed.o
 # to be linked into the decompressor or the EFI stub but not vmlinux
 #
 $(patsubst %.o,$(obj)/%.o,$(lib-y)): OBJECT_FILES_NON_STANDARD := y
+
+#
+# Invoke objtool for each object individually to check for absolute
+# relocations, even if other objtool actions are being deferred.
+#
+$(pi-objs): objtool-enabled	= 1
+$(pi-objs): objtool-args	= $(if $(delay-objtool),,$(objtool-args-y)) --noabs
-- 
2.50.0.727.gbf7dc18ff4-goog


  parent reply	other threads:[~2025-07-16  3:22 UTC|newest]

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-07-16  3:18 [PATCH v5 00/22] x86: strict separation of startup code Ard Biesheuvel
2025-07-16  3:18 ` [PATCH v5 01/22] x86/sev: Separate MSR and GHCB based snp_cpuid() via a callback Ard Biesheuvel
2025-07-16 16:52   ` Tom Lendacky
2025-07-16  3:18 ` [PATCH v5 02/22] x86/sev: Use MSR protocol for remapping SVSM calling area Ard Biesheuvel
2025-07-16 17:03   ` Tom Lendacky
2025-07-18  9:45     ` Ard Biesheuvel
2025-07-16  3:18 ` [PATCH v5 03/22] x86/sev: Use MSR protocol only for early SVSM PVALIDATE call Ard Biesheuvel
2025-07-16  3:18 ` [PATCH v5 04/22] x86/sev: Run RMPADJUST on SVSM calling area page to test VMPL Ard Biesheuvel
2025-07-16  3:18 ` [PATCH v5 05/22] x86/sev: Move GHCB page based HV communication out of startup code Ard Biesheuvel
2025-07-16  3:18 ` [PATCH v5 06/22] x86/sev: Avoid global variable to store virtual address of SVSM area Ard Biesheuvel
2025-07-16  3:18 ` [PATCH v5 07/22] x86/sev: Share implementation of MSR-based page state change Ard Biesheuvel
2025-07-16  3:18 ` [PATCH v5 08/22] x86/sev: Pass SVSM calling area down to early page state change API Ard Biesheuvel
2025-07-16  3:18 ` [PATCH v5 09/22] x86/sev: Use boot SVSM CA for all startup and init code Ard Biesheuvel
2025-07-16  3:18 ` [PATCH v5 10/22] x86/boot: Drop redundant RMPADJUST in SEV SVSM presence check Ard Biesheuvel
2025-07-16  3:18 ` [PATCH v5 11/22] x86/boot: Provide PIC aliases for 5-level paging related constants Ard Biesheuvel
2025-07-16  3:18 ` [PATCH v5 12/22] x86/sev: Provide PIC aliases for SEV related data objects Ard Biesheuvel
2025-07-16  3:18 ` [PATCH v5 13/22] x86/sev: Move __sev_[get|put]_ghcb() into separate noinstr object Ard Biesheuvel
2025-07-16  3:18 ` [PATCH v5 14/22] x86/sev: Export startup routines for later use Ard Biesheuvel
2025-07-16  3:18 ` [PATCH v5 15/22] objtool: Add action to check for absence of absolute relocations Ard Biesheuvel
2025-07-16  9:54   ` Peter Zijlstra
2025-07-16 10:26     ` Ard Biesheuvel
2025-07-16 11:32       ` Peter Zijlstra
2025-07-16 20:48         ` Josh Poimboeuf
2025-07-16  3:18 ` Ard Biesheuvel [this message]
2025-07-16  3:18 ` [PATCH v5 17/22] x86/boot: Revert "Reject absolute references in .head.text" Ard Biesheuvel
2025-07-16  3:18 ` [PATCH v5 18/22] x86/kbuild: Incorporate boot/startup/ via Kbuild makefile Ard Biesheuvel
2025-07-16  3:18 ` [PATCH v5 19/22] x86/boot: Create a confined code area for startup code Ard Biesheuvel
2025-07-16  3:18 ` [PATCH v5 20/22] efistub/x86: Remap inittext read-execute when needed Ard Biesheuvel
2025-07-16  3:18 ` [PATCH v5 21/22] x86/boot: Move startup code out of __head section Ard Biesheuvel
2025-07-16  3:18 ` [PATCH v5 22/22] x86/boot: Get rid of the .head.text section Ard Biesheuvel
2025-07-16 14:27 ` [PATCH v5 00/22] x86: strict separation of startup code Tom Lendacky
2025-07-16 22:02   ` Ard Biesheuvel

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250716031814.2096113-40-ardb+git@google.com \
    --to=ardb+git@google.com \
    --cc=ardb@kernel.org \
    --cc=bp@alien8.de \
    --cc=jpoimboe@kernel.org \
    --cc=kevinloughlin@google.com \
    --cc=linux-efi@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@kernel.org \
    --cc=nikunj@amd.com \
    --cc=peterz@infradead.org \
    --cc=thomas.lendacky@amd.com \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).