[RFC/RFT PATCH 18/19] x86/boot: Implement support for RELA/RELR/REL runtime relocations

Ard Biesheuvel
2026-01-08T09:28:47Z

Given that the decompressor already incorporates an ELF loader that
parses the program headers of the decompressed ELF image, support for
dealing with the PT_DYNAMIC program header can be added quite easily,
which describes the location of the RELA and RELR relocation tables in
the image.

This is a more efficient, and more idiomatic format, which allows the
handling of boot-time randomization (KASLR) in a generic manner, rather
than based on a bespoke x86-specific relocation format. This is a
prerequisite for enabling further hardening measures that are
implemented in the ELF domain, i.e., fgkaslr.

Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
arch/x86/boot/compressed/misc.c | 73 +++++++++++++++++++-
include/uapi/linux/elf.h | 3 +
2 files changed, 74 insertions(+), 2 deletions(-)

diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index 1ea419cf88fe..bc5677e697ca 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -278,7 +278,68 @@ static inline void handle_relocations(void *output, unsigned long output_len,
{ }
#endif

-static size_t parse_elf(void *output)
+#define ELF(type) __PASTE(__PASTE(Elf, __LONG_WIDTH__), __PASTE(_, type))
+
+static void handle_dynamic(const ELF(Dyn) *dyn, unsigned long p2v_offset,
+ unsigned long va_shift)
+{
+ const ELF(Rela) *rela = NULL;
+ const ELF(Rel) *rel = NULL;
+ unsigned long *relr = NULL;
+ unsigned long *place;
+ int relasize = 0;
+ int relrsize = 0;
+ int relsize = 0;
+
+ for (auto d = dyn; d->d_tag != DT_NULL; d++) {
+ switch (d->d_tag) {
+ case DT_RELA:
+ rela = (void *)(d->d_un.d_ptr + p2v_offset);
+ break;
+ case DT_RELASZ:
+ relasize = d->d_un.d_val;
+ break;
+ case DT_RELR:
+ relr = (void *)(d->d_un.d_ptr + p2v_offset);
+ break;
+ case DT_RELRSZ:
+ relrsize = d->d_un.d_val;
+ break;
+ case DT_REL:
+ rel = (void *)(d->d_un.d_ptr + p2v_offset);
+ break;
+ case DT_RELSZ:
+ relsize = d->d_un.d_val;
+ break;
+ }
+ }
+
+ for (int i = 0; i < relasize / sizeof(*rela); i++) {
+ place = (unsigned long *)(rela[i].r_offset + p2v_offset);
+ *place += va_shift;
+ }
+
+ for (int i = 0; i < relrsize / sizeof(*relr); i++) {
+ if ((relr[i] & 1) == 0) {
+ place = (unsigned long *)(relr[i] + p2v_offset);
+ *place++ += va_shift;
+ continue;
+ }
+
+ for (unsigned long *p = place, r = relr[i] >> 1; r; p++, r >>= 1)
+ if (r & 1)
+ *p += va_shift;
+ place += 8 * sizeof(*relr) - 1;
+ }
+
+ for (int i = 0; i < relsize / sizeof(*rel); i++) {
+ place = (unsigned long *)(rel[i].r_offset + p2v_offset);
+ *place += va_shift;
+ }
+
+}
+
+static size_t parse_elf(void *output, u64 va_shift)
{
#ifdef CONFIG_X86_64
Elf64_Ehdr ehdr;
@@ -320,6 +381,12 @@ static size_t parse_elf(void *output)
dest += (unsigned long)output - LOAD_PHYSICAL_ADDR;
memmove(dest, output + phdr->p_offset, phdr->p_filesz);
break;
+ case PT_DYNAMIC:
+ if (!va_shift)
+ break;
+ dest = (void *)(output + phdr->p_paddr - LOAD_PHYSICAL_ADDR);
+ handle_dynamic(dest, (unsigned long)dest - phdr->p_vaddr, va_shift);
+ break;
default: /* Ignore other PT_* */ break;
}
}
@@ -351,7 +418,9 @@ unsigned long decompress_kernel(unsigned char *outbuf, unsigned long virt_addr,
NULL, error) < 0)
return ULONG_MAX;

- entry = parse_elf(outbuf);
+ if (IS_ENABLED(CONFIG_X86_32))
+ virt_addr = (unsigned long)outbuf;
+ entry = parse_elf(outbuf, virt_addr - LOAD_PHYSICAL_ADDR);
handle_relocations(outbuf, output_len, virt_addr);

return entry;
diff --git a/include/uapi/linux/elf.h b/include/uapi/linux/elf.h
index 819ded2d39de..868cd67f0ea7 100644
--- a/include/uapi/linux/elf.h
+++ b/include/uapi/linux/elf.h
@@ -103,6 +103,9 @@ typedef __u16 Elf64_Versym;
#define DT_TEXTREL 22
#define DT_JMPREL 23
#define DT_ENCODING 32
+#define DT_RELRSZ 35
+#define DT_RELR 36
+#define DT_RELRENT 37
#define OLD_DT_LOOS 0x60000000
#define DT_LOOS 0x6000000d
#define DT_HIOS 0x6ffff000
--
2.47.3