Symbol export whitelist

Before modules were dynamically loaded the boundary between GPL and
non-GPL code was implicit because of the separate link domains for
each module. With dynamic modules we need an explicit whitelist of
core symbols that non-GPL code can link against at runtime without
needing to be re-licensed under the GPL.

Mark such symbols with __export, so that it is explicitly clear which
symbols in the core can be linked against by non-GPL code.

Reduce the visibility of symbols in both the core and ldlinux.c32 with
-fvisibility=hidden. __export changes the visibility to 'default'.

Signed-off-by: Matt Fleming <matt.fleming@intel.com>

44 files changed, 103 insertions, 92 deletions

diff --git a/com32/elflink/ldlinux/Makefile b/com32/elflink/ldlinux/Makefile
index b4e5cfa1..93ca127d 100644
--- a/com32/elflink/ldlinux/Makefile
+++ b/com32/elflink/ldlinux/Makefile
@@ -14,7 +14,7 @@ topdir = ../../..
 MAKEDIR = $(topdir)/mk
 include $(MAKEDIR)/elf.mk
 
-CFLAGS += -I$(topdir)/core/elflink -I$(topdir)/core/include -I$(topdir)/com32/lib
+CFLAGS += -I$(topdir)/core/elflink -I$(topdir)/core/include -I$(topdir)/com32/lib -fvisibility=hidden
 LIBS = --whole-archive $(com32)/lib/libcom32min.a
 
 all: ldlinux.c32 ldlinux_lnx.a
@@ -24,6 +24,7 @@ ldlinux.c32 : ldlinux.o cli.o readconfig.o refstr.o colors.o getadv.o \
 		advwrite.o setadv.o eprintf.o loadhigh.o msg.o
 	$(LD) $(LDFLAGS) -o $@ $^ $(LIBS)
 
+LNXCFLAGS += -D__export='__attribute__((visibility("default")))'
 LNXLIBOBJS = get_key.lo
 ldlinux_lnx.a: $(LNXLIBOBJS)
 	rm -f $@
diff --git a/com32/elflink/ldlinux/adv.c b/com32/elflink/ldlinux/adv.c
index b81361f2..4c3ad508 100644
--- a/com32/elflink/ldlinux/adv.c
+++ b/com32/elflink/ldlinux/adv.c
@@ -36,8 +36,8 @@
 #include <inttypes.h>
 #include <com32.h>
 
-void *__syslinux_adv_ptr;
-size_t __syslinux_adv_size;
+__export void *__syslinux_adv_ptr;
+__export size_t __syslinux_adv_size;
 
 extern void adv_init(void);
 void __constructor __syslinux_init(void)
diff --git a/com32/elflink/ldlinux/advwrite.c b/com32/elflink/ldlinux/advwrite.c
index 4152eea5..35829c1c 100644
--- a/com32/elflink/ldlinux/advwrite.c
+++ b/com32/elflink/ldlinux/advwrite.c
@@ -35,7 +35,7 @@
 #include <klibc/compiler.h>
 #include <com32.h>
 
-int syslinux_adv_write(void)
+__export int syslinux_adv_write(void)
 {
     static com32sys_t reg;
 
diff --git a/com32/elflink/ldlinux/execute.c b/com32/elflink/ldlinux/execute.c
index 4b4faf82..bfb26ffb 100644
--- a/com32/elflink/ldlinux/execute.c
+++ b/com32/elflink/ldlinux/execute.c
@@ -47,7 +47,7 @@ const struct image_types image_boot_types[] = {
 
 extern int create_args_and_load(char *);
 
-void execute(const char *cmdline, uint32_t type)
+__export void execute(const char *cmdline, uint32_t type)
 {
 	const char *kernel, *args;
 	const char *p;
diff --git a/com32/elflink/ldlinux/get_key.c b/com32/elflink/ldlinux/get_key.c
index 123171ae..cece0f81 100644
--- a/com32/elflink/ldlinux/get_key.c
+++ b/com32/elflink/ldlinux/get_key.c
@@ -166,7 +166,7 @@ int raw_read(int fd, void *buf, size_t count)
 extern int raw_read(int fd, void *buf, size_t count);
 #endif
 
-int get_key(FILE * f, clock_t timeout)
+__export int get_key(FILE * f, clock_t timeout)
 {
     char buffer[KEY_MAXLEN];
     int nc, rv;
diff --git a/com32/elflink/ldlinux/getadv.c b/com32/elflink/ldlinux/getadv.c
index 5578313e..1c27f1b8 100644
--- a/com32/elflink/ldlinux/getadv.c
+++ b/com32/elflink/ldlinux/getadv.c
@@ -36,7 +36,7 @@
 #include <klibc/compiler.h>
 #include <inttypes.h>
 
-const void *syslinux_getadv(int tag, size_t * size)
+__export const void *syslinux_getadv(int tag, size_t * size)
 {
     const uint8_t *p;
     size_t left;
diff --git a/com32/elflink/ldlinux/ldlinux.c b/com32/elflink/ldlinux/ldlinux.c
index 62db2f71..484ebe52 100644
--- a/com32/elflink/ldlinux/ldlinux.c
+++ b/com32/elflink/ldlinux/ldlinux.c
@@ -46,7 +46,7 @@ static inline const char *find_command(const char *str)
 	return p;
 }
 
-uint32_t parse_image_type(const char *kernel)
+__export uint32_t parse_image_type(const char *kernel)
 {
 	const struct file_ext *ext;
 	const char *p;
@@ -141,7 +141,7 @@ const char *apply_extension(const char *kernel, const char *ext)
  * the the kernel. If we return the caller should call enter_cmdline()
  * so that the user can help us out.
  */
-void load_kernel(const char *command_line)
+__export void load_kernel(const char *command_line)
 {
 	struct menu_entry *me;
 	const char *cmdline;
@@ -278,7 +278,7 @@ void ldlinux_console_init(void)
 	openconsole(&dev_stdcon_r, &dev_ansiserial_w);
 }
 
-int main(int argc __unused, char **argv __unused)
+__export int main(int argc __unused, char **argv __unused)
 {
 	const void *adv;
 	const char *cmdline;
diff --git a/com32/elflink/ldlinux/readconfig.c b/com32/elflink/ldlinux/readconfig.c
index 7411fcaf..6a419c6d 100644
--- a/com32/elflink/ldlinux/readconfig.c
+++ b/com32/elflink/ldlinux/readconfig.c
@@ -82,10 +82,11 @@ short vkernel = 0;		//have we seen any "label" statements?
 short displaycon = 1;		//conio.inc
 extern short NoHalt;		//idle.c
 
-const char *default_cmd = NULL;	//"default" command line
 const char *onerror = NULL;	//"onerror" command line
 const char *ontimeout = NULL;	//"ontimeout" command line
 
+__export const char *default_cmd = NULL;	//"default" command line
+
 /* Empty refstring */
 const char *empty_string;
 
@@ -599,7 +600,7 @@ uint32_t parse_argb(char **p)
 //static const char *append = NULL;
 extern const char *append;
 //static unsigned int ipappend = 0;
-unsigned int ipappend = 0;
+__export unsigned int ipappend = 0;
 extern uint16_t PXERetry;
 static struct labeldata ld;
 
diff --git a/com32/elflink/ldlinux/setadv.c b/com32/elflink/ldlinux/setadv.c
index 40f00a4e..2e386213 100644
--- a/com32/elflink/ldlinux/setadv.c
+++ b/com32/elflink/ldlinux/setadv.c
@@ -45,7 +45,7 @@
 #include <errno.h>
 #include <alloca.h>
 
-int syslinux_setadv(int tag, size_t size, const void *data)
+__export int syslinux_setadv(int tag, size_t size, const void *data)
 {
     uint8_t *p, *advtmp;
     size_t rleft, left;
diff --git a/com32/include/klibc/compiler.h b/com32/include/klibc/compiler.h
index 210971f1..e8548b59 100644
--- a/com32/include/klibc/compiler.h
+++ b/com32/include/klibc/compiler.h
@@ -139,4 +139,6 @@
 /* Weak symbols */
 #define __weak			__attribute__((weak))
 
+#define __export		__attribute__((visibility("default")))
+
 #endif
diff --git a/core/call16.c b/core/call16.c
index 095f814f..3ef6690c 100644
--- a/core/call16.c
+++ b/core/call16.c
@@ -20,7 +20,7 @@
 #include <stdio.h>
 #include "core.h"
 
-const com32sys_t zero_regs;	/* Common all-zero register set */
+__export const com32sys_t zero_regs;	/* Common all-zero register set */
 
 static inline uint32_t eflags(void)
 {
@@ -30,7 +30,8 @@ static inline uint32_t eflags(void)
     return v;
 }
 
-void call16(void (*func)(void), const com32sys_t *ireg, com32sys_t *oreg)
+__export void call16(void (*func)(void), const com32sys_t *ireg,
+		     com32sys_t *oreg)
 {
     com32sys_t xreg = *ireg;
 
diff --git a/core/callback.inc b/core/callback.inc
index d98d8008..454b4522 100644
--- a/core/callback.inc
+++ b/core/callback.inc
@@ -37,12 +37,12 @@
 ; - Return segment (== real mode cs == 0)
 ; - Return flags
 ;
-		global core_farcall
+		global core_farcall:function hidden
 core_farcall:
 		mov eax,[esp+1*4]		; CS:IP
 		jmp core_syscall
 
-		global core_intcall
+		global core_intcall:function hidden
 core_intcall:
 		movzx eax,byte [esp+1*4]	; INT number
 		mov eax,[eax*4]			; Get CS:IP from low memory
@@ -142,7 +142,7 @@ core_syscall:
 ; followed by the return CS:IP and the CS:IP of the target function.
 ; The value of IF is copied from the calling routine.
 ;
-		global core_cfarcall
+		global core_cfarcall:function hidden
 core_cfarcall:
 		pushfd				; Save IF among other things...
 		push ebx
diff --git a/core/cleanup.c b/core/cleanup.c
index 7bf1df2e..73b63dbf 100644
--- a/core/cleanup.c
+++ b/core/cleanup.c
@@ -27,7 +27,7 @@ extern void comboot_cleanup_api(void);
  *
  *	Shut down anything transient.
  */
-void cleanup_hardware(void)
+__export void cleanup_hardware(void)
 {
 	/*
 	 * TODO
diff --git a/core/com32.inc b/core/com32.inc
index 929f50ec..9c565f1d 100644
--- a/core/com32.inc
+++ b/core/com32.inc
@@ -40,7 +40,7 @@ com32_entry	equ	free_high_memory
 		;
 		; Danger, Will Robinson: it's not clear the use of
 		; core_xfer_buf is safe here.
-		global __entry_esp, __com32
+		global __com32:data hidden
 		alignz 4
 __entry_esp:
 		dd 0				; Dummy to avoid _exit issues
diff --git a/core/comboot.inc b/core/comboot.inc
index 2e690ff8..b11ae18d 100644
--- a/core/comboot.inc
+++ b/core/comboot.inc
@@ -95,7 +95,7 @@ comboot_setup_api:
 ; Restore the original state of the COMBOOT API vectors, and free
 ; any low memory allocated by the comboot module.
 ;
-		global comboot_cleanup_api
+		global comboot_cleanup_api:function hidden
 comboot_cleanup_api:
 		pusha
 		mov si,DOSSaveVectors
@@ -530,6 +530,6 @@ err_comlarge	db 'COMBOOT image too large.', CR, LF, 0
 DOSErrTramp	resd	33		; Error trampolines
 
 %ifndef HAVE_CURRENTDIRNAME
-		global CurrentDirName
+		global CurrentDirName:data hidden
 CurrentDirName	resb	FILENAME_MAX
 %endif
diff --git a/core/conio.c b/core/conio.c
index be7f7d48..abfceb88 100644
--- a/core/conio.c
+++ b/core/conio.c
@@ -37,21 +37,21 @@ union screen _screensize;
 /*
  * Serial console stuff.
  */
-uint16_t SerialPort = 0;	    /* Serial port base (or 0 for no serial port) */
-uint16_t BaudDivisor = 115200/9600; /* Baud rate divisor */
-uint8_t FlowOutput = 0;		    /* Output to assert for serial flow */
-uint8_t FlowInput = 0;		    /* Input bits for serial flow */
-uint8_t FlowIgnore = 0;		    /* Ignore input unless these bits set */
+__export uint16_t SerialPort = 0;   /* Serial port base (or 0 for no serial port) */
+__export uint8_t FlowInput = 0;	    /* Input bits for serial flow */
+__export uint16_t BaudDivisor = 115200/9600; /* Baud rate divisor */
+__export uint8_t FlowIgnore = 0;    /* Ignore input unless these bits set */
+__export uint16_t DisplayCon = 0x01;	/* Display console enabled */
+__export uint8_t FlowOutput = 0;	/* Output to assert for serial flow */
 
 uint8_t ScrollAttribute = 0x07; /* Grey on white (normal text color) */
-uint16_t DisplayCon = 0x01;	/* Display console enabled */
 
 /*
  * loadkeys:	Load a LILO-style keymap
  *
  * Returns 0 on success, or -1 on error.
  */
-int loadkeys(char *filename)
+__export int loadkeys(char *filename)
 {
 	FILE *f;
 
@@ -69,7 +69,7 @@ int loadkeys(char *filename)
  * write_serial: If serial output is enabled, write character on
  * serial port.
  */
-void write_serial(char data)
+__export void write_serial(char data)
 {
 	if (!SerialPort)
 		return;
@@ -124,7 +124,7 @@ void pm_serialcfg(com32sys_t *regs)
 /*
  * write_serial_str: write_serial for strings
  */
-void write_serial_str(char *data)
+__export void write_serial_str(char *data)
 {
 	char ch;
 
@@ -137,7 +137,7 @@ void write_serial_str(char *data)
  *
  * Returns 1 if character pending.
  */
-int pollchar(void)
+__export int pollchar(void)
 {
 	com32sys_t ireg, oreg;
 	uint8_t data = 0;
@@ -190,7 +190,7 @@ extern void do_idle(void);
 /*
  * getchar: Read a character from keyboard or serial port
  */
-char getchar(char *hi)
+__export char getchar(char *hi)
 {
 	com32sys_t ireg, oreg;
 	unsigned char data;
diff --git a/core/diskboot.inc b/core/diskboot.inc
index 3e42044a..89bdd968 100644
--- a/core/diskboot.inc
+++ b/core/diskboot.inc
@@ -103,7 +103,6 @@ superblock_len_fat32	equ $-superblock+54
 		zb 54			; Maximum needed size
 superblock_max	equ $-superblock
 
-		global SecPerClust
 SecPerClust	equ bxSecPerClust
 
 ;
@@ -385,7 +384,11 @@ getonesec_cbios:
 ;
 ; kaboom: write a message and bail out.
 ;
+%ifdef BINFMT
 		global kaboom
+%else
+		global kaboom:function hidden
+%endif
 disk_error:
 kaboom:
 		xor si,si
diff --git a/core/diskfs.inc b/core/diskfs.inc
index 9c9da267..827f5003 100644
--- a/core/diskfs.inc
+++ b/core/diskfs.inc
@@ -60,7 +60,7 @@ vk_end:		equ $			; Should be <= vk_size
 ; Memory below this point is reserved for the BIOS and the MBR
 ;
 		section .earlybss
-		global trackbuf
+		global trackbuf:data hidden
 trackbufsize	equ 8192
 trackbuf	resb trackbufsize	; Track buffer goes here
 		; ends at 2800h
diff --git a/core/diskstart.inc b/core/diskstart.inc
index 8806593d..a2ede959 100644
--- a/core/diskstart.inc
+++ b/core/diskstart.inc
@@ -92,7 +92,7 @@ BannerPtr	dw syslinux_banner - LDLINUX_SYS
 ; Base directory name and subvolume, if applicable.
 ;
 %define HAVE_CURRENTDIRNAME
-		global CurrentDirName, SubvolName
+		global CurrentDirName:data hidden, SubvolName:data hidden
 CurrentDirName	times CURRENTDIR_MAX db 0
 SubvolName	times SUBVOL_MAX db 0
 
@@ -232,7 +232,7 @@ verify_checksum:
 ;
 ;            This routine assumes CS == DS.
 ;
-		global getlinsec
+		global getlinsec:function hidden
 getlinsec:
 		pushad
 		add eax,[Hidden]		; Add partition offset
diff --git a/core/elflink/load_env32.c b/core/elflink/load_env32.c
index 4797b270..7c0afacf 100644
--- a/core/elflink/load_env32.c
+++ b/core/elflink/load_env32.c
@@ -59,7 +59,7 @@ void init_module_subsystem(struct elf_module *module)
     list_add(&module->list, &modules_head);
 }
 
-int start_ldlinux(char **argv)
+__export int start_ldlinux(char **argv)
 {
 	int rv;
 
@@ -154,7 +154,7 @@ void load_env32(com32sys_t * regs __unused)
 	writestr("\nFailed to load ldlinux.c32");
 }
 
-int create_args_and_load(char *cmdline)
+__export int create_args_and_load(char *cmdline)
 {
 	char *p, **argv;
 	int argc;
diff --git a/core/font.c b/core/font.c
index 38f03f58..85330808 100644
--- a/core/font.c
+++ b/core/font.c
@@ -26,9 +26,9 @@
 #include "graphics.h"
 #include "core.h"
 
-uint8_t UserFont = 0;		/* Using a user-specified font */
+__export uint8_t UserFont = 0;		/* Using a user-specified font */
 
-__lowmem char fontbuf[8192];
+__export __lowmem char fontbuf[8192];
 
 uint16_t GXPixCols = 1;		/* Graphics mode pixel columns */
 uint16_t GXPixRows = 1;		/* Graphics mode pixel rows */
@@ -37,7 +37,7 @@ uint16_t GXPixRows = 1;		/* Graphics mode pixel rows */
  * loadfont:	Load a .psf font file and install it onto the VGA console
  *		(if we're not on a VGA screen then ignore.)
  */
-void loadfont(const char *filename)
+__export void loadfont(const char *filename)
 {
 	struct psfheader {
 		uint16_t magic;
diff --git a/core/fs/chdir.c b/core/fs/chdir.c
index 903cabce..5d3a545f 100644
--- a/core/fs/chdir.c
+++ b/core/fs/chdir.c
@@ -54,7 +54,7 @@ static size_t generic_inode_to_path(struct inode *inode, char *dst, size_t bufsi
     return s;
 }
 
-size_t realpath(char *dst, const char *src, size_t bufsize)
+__export size_t realpath(char *dst, const char *src, size_t bufsize)
 {
     int rv;
     struct file *file;
@@ -83,7 +83,7 @@ size_t realpath(char *dst, const char *src, size_t bufsize)
     return s;
 }
 
-int chdir(const char *src)
+__export int chdir(const char *src)
 {
     int rv;
     struct file *file;
diff --git a/core/fs/fs.c b/core/fs/fs.c
index c85e132d..2ad33755 100644
--- a/core/fs/fs.c
+++ b/core/fs/fs.c
@@ -9,13 +9,13 @@
 #include "fs.h"
 #include "cache.h"
 
-char *PATH;
+__export char *PATH;
 
 /* The currently mounted filesystem */
-struct fs_info *this_fs = NULL;		/* Root filesystem */
+__export struct fs_info *this_fs = NULL;		/* Root filesystem */
 
 /* Actual file structures (we don't have malloc yet...) */
-struct file files[MAX_OPEN];
+__export struct file files[MAX_OPEN];
 
 /* Symlink hard limits */
 #define MAX_SYMLINK_CNT	20
@@ -74,7 +74,7 @@ static inline void free_file(struct file *file)
     memset(file, 0, sizeof *file);
 }
 
-void _close_file(struct file *file)
+__export void _close_file(struct file *file)
 {
     if (file->fs)
 	file->fs->fs_ops->close_file(file);
@@ -84,7 +84,7 @@ void _close_file(struct file *file)
 /*
  * Find and open the configuration file
  */
-int open_config(void)
+__export int open_config(void)
 {
     int fd, handle;
     struct file_info *fp;
@@ -116,7 +116,7 @@ void pm_mangle_name(com32sys_t *regs)
     mangle_name(dst, src);
 }
 
-void mangle_name(char *dst, const char *src)
+__export void mangle_name(char *dst, const char *src)
 {
     this_fs->fs_ops->mangle_name(dst, src);
 }
@@ -415,7 +415,7 @@ err_no_close:
     return -1;
 }
 
-int open_file(const char *name, struct com32_filedata *filedata)
+__export int open_file(const char *name, struct com32_filedata *filedata)
 {
     int rv;
     struct file *file;
@@ -465,7 +465,7 @@ void pm_open_file(com32sys_t *regs)
     }
 }
 
-void close_file(uint16_t handle)
+__export void close_file(uint16_t handle)
 {
     struct file *file;
 
diff --git a/core/fs/getcwd.c b/core/fs/getcwd.c
index ee62411f..70b93152 100644
--- a/core/fs/getcwd.c
+++ b/core/fs/getcwd.c
@@ -1,7 +1,7 @@
 #include <string.h>
 #include "fs.h"
 
-char *core_getcwd(char *buf, size_t size)
+__export char *core_getcwd(char *buf, size_t size)
 {
     char *ret = NULL;
 
diff --git a/core/fs/lib/searchconfig.c b/core/fs/lib/searchconfig.c
index f2d740b3..b2a964e8 100644
--- a/core/fs/lib/searchconfig.c
+++ b/core/fs/lib/searchconfig.c
@@ -4,8 +4,8 @@
 #include <core.h>
 #include <fs.h>
 
-char ConfigName[FILENAME_MAX];
-char config_cwd[FILENAME_MAX];
+__export char ConfigName[FILENAME_MAX];
+__export char config_cwd[FILENAME_MAX];
 
 /*
  * This searches for a specified set of filenames in a specified set
diff --git a/core/fs/pxe/pxe.c b/core/fs/pxe/pxe.c
index ee818ecd..11270044 100644
--- a/core/fs/pxe/pxe.c
+++ b/core/fs/pxe/pxe.c
@@ -645,7 +645,7 @@ static uint32_t pxe_getfssec(struct file *file, char *buf,
  *
  */
 static void __pxe_searchdir(const char *filename, struct file *file);
-uint16_t PXERetry;
+extern uint16_t PXERetry;
 
 static void pxe_searchdir(const char *filename, struct file *file)
 {
diff --git a/core/fs/readdir.c b/core/fs/readdir.c
index d071affd..e2d593fc 100644
--- a/core/fs/readdir.c
+++ b/core/fs/readdir.c
@@ -7,7 +7,7 @@
 /* 
  * Open a directory
  */
-DIR *opendir(const char *path)
+__export DIR *opendir(const char *path)
 {
     int rv;
     struct file *file;
@@ -29,7 +29,7 @@ DIR *opendir(const char *path)
 /*
  * Read one directory entry at one time. 
  */
-struct dirent *readdir(DIR *dir)
+__export struct dirent *readdir(DIR *dir)
 {
     static struct dirent buf;
     struct file *dd_dir = (struct file *)dir;
@@ -47,7 +47,7 @@ struct dirent *readdir(DIR *dir)
 /*
  * Close a directory
  */
-int closedir(DIR *dir)
+__export int closedir(DIR *dir)
 {
     struct file *dd_dir = (struct file *)dir;
     _close_file(dd_dir);
diff --git a/core/graphics.c b/core/graphics.c
index 55d91d7e..834372ff 100644
--- a/core/graphics.c
+++ b/core/graphics.c
@@ -25,13 +25,13 @@
 #include "bios.h"
 #include "graphics.h"
 
-uint8_t UsingVGA = 0;
+__export uint8_t UsingVGA = 0;
 uint16_t VGAPos;		/* Pointer into VGA memory */
-uint16_t *VGAFilePtr;		/* Pointer into VGAFileBuf */
-uint16_t VGAFontSize = 16;	/* Defaults to 16 byte font */
+__export uint16_t *VGAFilePtr;	/* Pointer into VGAFileBuf */
+__export uint16_t VGAFontSize = 16;	/* Defaults to 16 byte font */
 
-char VGAFileBuf[VGA_FILE_BUF_SIZE]; /* Unmangled VGA image name */
-char VGAFileMBuf[FILENAME_MAX];	/* Mangled VGA image name */
+__export char VGAFileBuf[VGA_FILE_BUF_SIZE];	/* Unmangled VGA image name */
+__export char VGAFileMBuf[FILENAME_MAX];	/* Mangled VGA image name */
 
 static uint8_t VGARowBuffer[640 + 80];	/* Decompression buffer */
 static uint8_t VGAPlaneBuffer[(640/8) * 4]; /* Plane buffers */
@@ -230,7 +230,7 @@ static void outputvga(const void *in, void *out)
 /*
  * Display a graphical splash screen.
  */
-void vgadisplayfile(FILE *_fd)
+__export void vgadisplayfile(FILE *_fd)
 {
 	char *p;
 	int size;
@@ -305,7 +305,7 @@ void vgadisplayfile(FILE *_fd)
 /*
  * Disable VGA graphics.
  */
-void syslinux_force_text_mode(void)
+__export void syslinux_force_text_mode(void)
 {
 	com32sys_t ireg, oreg;
 
@@ -357,7 +357,7 @@ void vgashowcursor(void)
 	vgacursorcommon('_');
 }
 
-void using_vga(uint8_t vga, uint16_t pix_cols, uint16_t pix_rows)
+__export void using_vga(uint8_t vga, uint16_t pix_cols, uint16_t pix_rows)
 {
     UsingVGA = vga;
     GXPixCols = pix_cols;
diff --git a/core/idle.c b/core/idle.c
index 137e0ea7..9514df88 100644
--- a/core/idle.c
+++ b/core/idle.c
@@ -25,7 +25,7 @@
 #define TICKS_TO_IDLE	4	/* Also in idle.inc */
 
 extern uint32_t _IdleTimer;
-uint16_t NoHalt = 0;
+__export uint16_t NoHalt = 0;
 
 int (*idle_hook_func)(void);
 
@@ -34,7 +34,7 @@ void reset_idle(void)
     _IdleTimer = jiffies();
 }
 
-void __idle(void)
+__export void __idle(void)
 {
     if (jiffies() - _IdleTimer < TICKS_TO_IDLE)
 	return;
diff --git a/core/idle.inc b/core/idle.inc
index 09a3771e..65d6c5c8 100644
--- a/core/idle.inc
+++ b/core/idle.inc
@@ -22,7 +22,7 @@ reset_idle:
 		sti		; Guard against BIOS/PXE brokenness...
 		ret
 
-		global do_idle
+		global do_idle:function hidden
 do_idle:
 		push eax
 		push ds
@@ -72,7 +72,7 @@ do_idle:
 
 		section .data16
 		alignz 4
-		global _IdleTimer
+		global _IdleTimer:data hidden
 _IdleTimer	dd 0
 
 hlt_err		db 'ERROR: idle with IF=0', CR, LF, 0 
diff --git a/core/init.c b/core/init.c
index ca9e413f..a1412252 100644
--- a/core/init.c
+++ b/core/init.c
@@ -7,7 +7,9 @@
 static uint32_t min_lowmem_heap = 65536;
 extern char __lowmem_heap[];
 uint8_t KbdFlags;		/* Check for keyboard escapes */
-uint8_t KbdMap[256];		/* Keyboard map */
+__export uint8_t KbdMap[256];	/* Keyboard map */
+
+__export uint16_t PXERetry;
 
 static inline void check_escapes(void)
 {
diff --git a/core/kaboom.c b/core/kaboom.c
index 9bb30736..03dd917b 100644
--- a/core/kaboom.c
+++ b/core/kaboom.c
@@ -18,7 +18,7 @@ __noreturn __bad_SEG(const volatile void *p)
 
 #undef kaboom
 
-__noreturn _kaboom(void)
+__export __noreturn _kaboom(void)
 {
     extern void kaboom(void);
     call16(kaboom, &zero_regs, NULL);
diff --git a/core/layout.inc b/core/layout.inc
index 6d31b18e..be797ede 100644
--- a/core/layout.inc
+++ b/core/layout.inc
@@ -134,7 +134,7 @@ serial_buf_size	equ 4096		; Should be a power of 2
 ;
 		extern	xfer_buf_seg
 		section .xfer_buf	write nobits align=65536
-		global	core_xfer_buf
+		global	core_xfer_buf:data hidden
 core_xfer_buf	resb 65536
 
 ;
@@ -144,7 +144,7 @@ core_xfer_buf	resb 65536
 ;
 		extern	real_mode_seg
 		section .real_mode	write nobits align=65536
-		global	core_real_mode
+		global	core_real_mode:data hidden
 core_real_mode	resb 65536
 comboot_seg	equ real_mode_seg	; COMBOOT image loading zone
 
diff --git a/core/localboot.c b/core/localboot.c
index 03ac866d..0f4b5820 100644
--- a/core/localboot.c
+++ b/core/localboot.c
@@ -34,7 +34,7 @@ extern void local_boot16(void);
  * Boot a specified local disk.  AX specifies the BIOS disk number; or
  * -1 in case we should execute INT 18h ("next device.")
  */
-void local_boot(int16_t ax)
+__export void local_boot(int16_t ax)
 {
 	com32sys_t ireg, oreg;
 	int i;
diff --git a/core/localboot.inc b/core/localboot.inc
index ce971ae4..b7840427 100644
--- a/core/localboot.inc
+++ b/core/localboot.inc
@@ -1,5 +1,5 @@
 		section .text16
-		global local_boot16
+		global local_boot16:function hidden
 local_boot16:
 		mov cx,0
 		mov ss,cx
diff --git a/core/mem/free.c b/core/mem/free.c
index 2908943b..9c28e144 100644
--- a/core/mem/free.c
+++ b/core/mem/free.c
@@ -66,7 +66,7 @@ __free_block(struct free_arena_header *ah)
     return ah;
 }
 
-void free(void *ptr)
+__export void free(void *ptr)
 {
     struct free_arena_header *ah;
 
diff --git a/core/mem/malloc.c b/core/mem/malloc.c
index 19681726..02e60614 100644
--- a/core/mem/malloc.c
+++ b/core/mem/malloc.c
@@ -86,12 +86,12 @@ static void *_malloc(size_t size, enum heap heap, malloc_tag_t tag)
     return p;
 }
 
-void *malloc(size_t size)
+__export void *malloc(size_t size)
 {
     return _malloc(size, HEAP_MAIN, MALLOC_CORE);
 }
 
-void *lmalloc(size_t size)
+__export void *lmalloc(size_t size)
 {
     void *p;
 
@@ -106,7 +106,7 @@ void *pmapi_lmalloc(size_t size)
     return _malloc(size, HEAP_LOWMEM, MALLOC_MODULE);
 }
 
-void *realloc(void *ptr, size_t size)
+__export void *realloc(void *ptr, size_t size)
 {
     struct free_arena_header *ah, *nah;
     struct free_arena_header *head;
@@ -207,7 +207,7 @@ void *realloc(void *ptr, size_t size)
     }
 }
 
-void *zalloc(size_t size)
+__export void *zalloc(size_t size)
 {
     void *ptr;
 
diff --git a/core/plaincon.c b/core/plaincon.c
index dfeb9784..8f8ca7ca 100644
--- a/core/plaincon.c
+++ b/core/plaincon.c
@@ -9,7 +9,7 @@
  * Write a single character in AL to the console without
  * mangling any registers; handle video pages correctly.
  */
-void writechr(char data)
+__export void writechr(char data)
 {
 	com32sys_t ireg, oreg;
 
diff --git a/core/rawcon.c b/core/rawcon.c
index 1a52c954..92f0898a 100644
--- a/core/rawcon.c
+++ b/core/rawcon.c
@@ -10,7 +10,7 @@
 #include "bios.h"
 #include "graphics.h"
 
-void writechr(char data)
+__export void writechr(char data)
 {
 	if (UsingVGA & 0x08)
 		syslinux_force_text_mode();
diff --git a/core/serirq.c b/core/serirq.c
index e0675c9a..e230b98d 100644
--- a/core/serirq.c
+++ b/core/serirq.c
@@ -123,7 +123,7 @@ static inline void install_irq_vectors(uint32_t *dst, int first)
 	}
 }
 
-void sirq_install(void)
+__export void sirq_install(void)
 {
 	char val, val2;
 
@@ -164,7 +164,7 @@ void sirq_install(void)
 	outb(0xA1, 0);
 }
 
-void sirq_cleanup_nowipe(void)
+__export void sirq_cleanup_nowipe(void)
 {
 	uint32_t *dst;
 	int i;
diff --git a/core/stack.inc b/core/stack.inc
index 788db647..838d6bab 100644
--- a/core/stack.inc
+++ b/core/stack.inc
@@ -38,7 +38,7 @@
 
 		section .data16
 		alignz 4
-		global BaseStack
+		global BaseStack:data hidden
 BaseStack	dd StackHome		; ESP of the "home" stack pointer
 		dw 0			; SS of the "home" stack pointer
 
diff --git a/core/timer.inc b/core/timer.inc
index 2bf0a219..64f81a72 100644
--- a/core/timer.inc
+++ b/core/timer.inc
@@ -32,7 +32,7 @@ timer_init:
 		mov dword [BIOS_timer_hook],timer_irq
 		ret
 
-		global timer_cleanup
+		global timer_cleanup:function hidden
 timer_cleanup:
 		; Unhook INT 1Ch
 		mov eax,[BIOS_timer_next]
@@ -43,18 +43,18 @@ timer_cleanup:
 ; The specified frequency is 14.31818 MHz/12/65536; this turns out
 ; to be a period of 54.92542 ms, or 0x36.ece8(187c) hexadecimal.
 ;
-		global timer_irq
+		global timer_irq:function hidden
 timer_irq:
 		inc dword [cs:__jiffies]
 		add word  [cs:__ms_timer_adj],0xece8
 		adc dword [cs:__ms_timer],0x36
 		jmp 0:0
-		global BIOS_timer_next
+		global BIOS_timer_next:data hidden
 BIOS_timer_next	equ $-4
 
 		section .data16
 		alignz 4
-		global __jiffies, __ms_timer
+		global __jiffies:data hidden, __ms_timer
 __jiffies	dd 0			; Clock tick timer
 __ms_timer	dd 0			; Millisecond timer
 __ms_timer_adj	dw 0			; Millisecond timer correction factor
diff --git a/diag/geodsp/Makefile b/diag/geodsp/Makefile
index 55160859..91225b18 100644
--- a/diag/geodsp/Makefile
+++ b/diag/geodsp/Makefile
@@ -26,7 +26,7 @@ coredir = $(topdir)/core
 BTARGET = geodsp1s.bin geodspms.bin \
 	geodsp1s.img.xz geodspms.img.xz
 
-NASMOPT = -i $(coredir)/ -Ox -f bin
+NASMOPT = -i $(coredir)/ -Ox -f bin -dBINFMT
 NASMOPT += -w+orphan-labels
 CFLAGS = -g -O
 
diff --git a/mk/embedded.mk b/mk/embedded.mk
index e8f3ae30..c2f4edf3 100644
--- a/mk/embedded.mk
+++ b/mk/embedded.mk
@@ -32,6 +32,7 @@ GCCOPT    += $(call gcc_ok,-falign-labels=0,-malign-labels=0)
 GCCOPT    += $(call gcc_ok,-falign-loops=0,-malign-loops=0)
 GCCOPT    += $(call gcc_ok,-mpreferred-stack-boundary=2,)
 GCCOPT    += $(call gcc_ok,-mincoming-stack-boundary=2,)
+GCCOPT    += $(call gcc_ok,-fvisibility=hidden)
 
 LIBGCC    := $(shell $(CC) $(GCCOPT) --print-libgcc)