[RFC PATCH PoC 09/11] x86/boot: Disallow absolute symbol references in startup code

Ard Biesheuvel
2025-04-23T11:10:54Z

Check that the objects built under arch/x86/boot/startup do not contain
any absolute symbol reference. Given that the code is built with -fPIC,
such references can only be emitted using R_X86_64_64 relocations, so
checking that those are absent is sufficient.

Note that debug sections and __patchable_funtion_entries section may
contain such relocations nonetheless, but these are unnecessary in the
startup code, so they can be dropped first.

Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
arch/x86/boot/startup/Makefile | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/arch/x86/boot/startup/Makefile b/arch/x86/boot/startup/Makefile
index 4062582144f6..43560ab9e21a 100644
--- a/arch/x86/boot/startup/Makefile
+++ b/arch/x86/boot/startup/Makefile
@@ -36,9 +36,17 @@ $(patsubst %.o,$(obj)/%.o,$(lib-y)): OBJECT_FILES_NON_STANDARD := y
# code, or code that has explicitly been made accessible to it via a symbol
# alias.
#
-$(obj)/%.pi.o: OBJCOPYFLAGS := --prefix-symbols=__pi_
+$(obj)/%.pi.o: OBJCOPYFLAGS := --prefix-symbols=__pi_ --strip-debug \
+ --remove-section=.rela__patchable_function_entries
$(obj)/%.pi.o: $(obj)/%.o FORCE
- $(call if_changed,objcopy)
+ $(call if_changed,piobjcopy)
+
+quiet_cmd_piobjcopy = $(quiet_cmd_objcopy)
+ cmd_piobjcopy = $(cmd_objcopy); \
+ if $(READELF) -r $(@) | grep R_X86_64_64; then \
+ echo "$@: R_X86_64_64 references not allowed in startup code" >&2; \
+ /bin/false; \
+ fi

extra-y := $(pi-obj-y)
obj-y += $(patsubst %.o,%.pi.o,$(pi-obj-y))
--
2.49.0.805.g082f7c87e0-goog