Linux-EFI Archive on
 help / color / Atom feed
From: Ard Biesheuvel <>
	Ard Biesheuvel <>,
	Maarten Lankhorst <>,
	Linus Torvalds <>,
	Arvind Sankar <>
Subject: [PATCH v2 0/3] x86/boot: get rid of GOT entries and associated fixup code
Date: Sat, 23 May 2020 14:00:18 +0200
Message-ID: <> (raw)

Building position independent code using GCC by default results in references
to symbols with external linkage to be resolved via GOT entries, which
carry the absolute addresses of the symbols, and thus need to be corrected
if the load time address of the executable != the link time address.

For fully linked binaries, such GOT indirected references are completely
useless, and actually make the startup code more complicated than necessary,
since these corrections may need to be applied more than once. In fact, we
have been very careful to avoid such references in the EFI stub code, since
it would require yet another [earlier] pass of GOT fixups which we currently
don't implement.

Older GCCs were quirky when it came to overriding this behavior using symbol
visibility, but now that we have increased the minimum GCC version to 4.6,
we can actually start setting the symbol visibility to 'hidden' globally for
all symbol references in the decompressor, getting rid of the GOT entirely.
This means we can get rid of the GOT fixup code right away, and we can start
using ordinary external symbol references in the EFI stub without running the
risk of boot regressions. (v2 note: we have already started doing this)

CC'ing Linus and Maarten, who were involved in diagnosing an issue related
to GOT entries emitted from the EFI stub ~5 years ago. [0] [1]

Many thanks to Arvind for the suggestions and the help in testing these
changes. Tested on GCC 4.6 + binutils 2.24 (Ubuntu 14.04), and GCC 8 +
binutils 2.31 (Debian Buster)

Changes since v1 [2]:
Rebase only - recent EFI changes have moved all the C code into
drivers/firmware/efi/libstub/, which is also built with hidden
visibility, and contains an additional objdump pass to detect (and
reject) absolute symbol references.

Unless anyone objects, I'd like to incorporate these changes into my
late EFI PR for v5.8, which will go out in a day or two.

Cc: Maarten Lankhorst <>
Cc: Linus Torvalds <>
Cc: Arvind Sankar <>


Ard Biesheuvel (3):
  x86/boot/compressed: move .got.plt entries out of the .got section
  x86/boot/compressed: force hidden visibility for all symbol references
  x86/boot/compressed: get rid of GOT fixup code

 arch/x86/boot/compressed/Makefile      |  1 +
 arch/x86/boot/compressed/head_32.S     | 22 ++------
 arch/x86/boot/compressed/head_64.S     | 57 --------------------
 arch/x86/boot/compressed/hidden.h      | 19 +++++++
 arch/x86/boot/compressed/ | 16 ++++--
 5 files changed, 36 insertions(+), 79 deletions(-)
 create mode 100644 arch/x86/boot/compressed/hidden.h


             reply index

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-23 12:00 Ard Biesheuvel [this message]
2020-05-23 12:00 ` [PATCH v2 1/3] x86/boot/compressed: move .got.plt entries out of the .got section Ard Biesheuvel
2020-05-24 15:08   ` Ingo Molnar
2020-05-24 15:11     ` Ard Biesheuvel
2020-05-24 15:14       ` Ingo Molnar
2020-05-23 12:00 ` [PATCH v2 2/3] x86/boot/compressed: force hidden visibility for all symbol references Ard Biesheuvel
2020-05-24 15:12   ` Ingo Molnar
2020-05-24 15:15     ` Ard Biesheuvel
2020-05-27 14:36   ` Arvind Sankar
2020-05-27 18:29     ` Brian Gerst
2020-05-27 18:30       ` Ard Biesheuvel
2020-05-28  7:46     ` Ard Biesheuvel
2020-05-23 12:00 ` [PATCH v2 3/3] x86/boot/compressed: get rid of GOT fixup code Ard Biesheuvel
2020-05-23 15:17   ` Arvind Sankar
2020-05-24  8:42     ` Ard Biesheuvel
2020-05-23 15:16 ` [PATCH v2 0/3] x86/boot: get rid of GOT entries and associated " Arvind Sankar

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-EFI Archive on

Archives are clonable:
	git clone --mirror linux-efi/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-efi linux-efi/ \
	public-inbox-index linux-efi

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone