[LLD] [COFF] Make sections with runtime pseudo relocations writable

[mstorsjo]

Summary

If there are runtime pseudo relocations in a section that isn't writable, the relocation code will try to make the section writable first by calling VirtualProtect, and restore it to read only mode afterwards, before giving the control over to user code.

In Windows Store apps, the VirtualProtect function isn't allowed (and can be stubbed out with a dummy that just returns an error).

To avoid having to use this function, the linker can move all section chunks that require runtime relocations to a writable section. When moving data from .rdata to .data, this works ideally. If there are runtime pseudo relocs in the .text section though, we create a separate writable text section .wtext. As long as the compiler produces .refptr stubs from all variables that might be imported from another dll, we shouldn't ever need to make the text section writable.

[rnk]

Won't this effectively move Itanium vtables into .data? That seems... dangerous.

[mstorsjo]

In D51454#1218266, @rnk wrote:

Won't this effectively move Itanium vtables into .data? That seems... dangerous.

I'm not fluent enough in the itanium ABI to off-hand say what pointers there actually are there. For RTTI data, with the libc++ in a separate DLL, it'll at least need to make them writable for the type info vtable pointer (see D43184 for old discussion on that). And probably also for other cases if things are autoimported.

As long as nothing is autoimported and needs pseudo relocs, nothing is made writable.

If you feel this is generally something that one generally would want to avoid, we perhaps should make it an option instead. Then someone linking things for Windows Store/UWP configurations (where VirtualProtect is unusable) can enable it. For other cases, making things writable only for a short time on load while fixing relocations probably is better.

[rnk]

I think the extra option is worth it. I expect regular old desktop apps are the common case for most users, and they'd rather have the improved security.

[smeenai]

You can still use VirtualProtectFromApp with UWP; you just can't do W+X.

[mstorsjo]

In D51454#1218384, @smeenai wrote:

You can still use VirtualProtectFromApp with UWP; you just can't do W+X.

Oh, I'll look into that. As long as all references from code use refptr, that should be fine then, and we could drop this patch.

[mstorsjo]

In D51454#1218718, @mstorsjo wrote:

In D51454#1218384, @smeenai wrote:

You can still use VirtualProtectFromApp with UWP; you just can't do W+X.

Oh, I'll look into that. As long as all references from code use refptr, that should be fine then, and we could drop this patch.

Let's skip this patch, at least for now. VirtualProtectFromApp isn't available for Win8.x Store Apps though, but I don't know if that really is an issue for anybody.

What we could add, though, is a warning if there are runtime pseudo relocs in executable sections.

COFF/Chunks.h

public:
 
   SectionChunk(ObjFile *File, const coff_section *Header);
   static bool classof(const Chunk *C) { return C->kind() == SectionKind; }
   size_t getSize() const override { return Header->SizeOfRawData; }
   ArrayRef<uint8_t> getContents() const;
   void writeTo(uint8_t *Buf) const override;
   bool hasData() const override;
   uint32_t getOutputCharacteristics() const override;
-  StringRef getSectionName() const override { return SectionName; }
+  StringRef getSectionName() const override;
   void getBaserels(std::vector<Baserel> *Res) override;
   bool isCOMDAT() const;
   void applyRelX64(uint8_t *Off, uint16_t Type, OutputSection *OS, uint64_t S,
                    uint64_t P) const;
   void applyRelX86(uint8_t *Off, uint16_t Type, OutputSection *OS, uint64_t S,
                    uint64_t P) const;
   void applyRelARM(uint8_t *Off, uint16_t Type, OutputSection *OS, uint64_t S,
                    uint64_t P) const;
   void applyRelARM64(uint8_t *Off, uint16_t Type, OutputSection *OS, uint64_t S,
                      uint64_t P) const;
 
-  void getRuntimePseudoRelocs(std::vector<RuntimePseudoReloc> &Res);
+  bool getRuntimePseudoRelocs(std::vector<RuntimePseudoReloc> &Res);
 
   // Called if the garbage collector decides to not include this chunk
   // in a final output. It's supposed to print out a log message to stdout.
   void printDiscardedMessage() const;
 
   // Adds COMDAT associative sections to this COMDAT section. A chunk
   // and its children are treated as a group by the garbage collector.
   void addAssociative(SectionChunk *Child);
 
   StringRef getDebugName() override;
 
   // Returns true if the chunk was not dropped by GC.
   bool isLive() { return Live; }
 
   // Used by the garbage collector.
   void markLive() {
     assert(Config->DoGC && "should only mark things live from GC");
     assert(!isLive() && "Cannot mark an already live section!");
     Live = true;
   }
 
+  void forceWritable() { ForceWritable = true; }
+
   // True if this is a codeview debug info chunk. These will not be laid out in
   // the image. Instead they will end up in the PDB, if one is requested.
   bool isCodeView() const {
     return SectionName == ".debug" || SectionName.startswith(".debug$");
   }
 
   // True if this is a DWARF debug info or exception handling chunk.
   bool isDWARF() const {

 
 private:
   StringRef SectionName;
   std::vector<SectionChunk *> AssocChildren;
 
   // Used by the garbage collector.
   bool Live;
 
+  // Used for chunks that contain relocations that need runtime fixups.
+  bool ForceWritable = false;
+
   // Used for ICF (Identical COMDAT Folding)
   void replace(SectionChunk *Other);
   uint32_t Class[2] = {0, 0};
 };
 
 // This class is used to implement an lld-specific feature (not implemented in
 // MSVC) that minimizes the output size by finding string literals sharing tail
 // parts and merging them.

COFF/Chunks.cpp

static int getRuntimePseudoRelocSize(uint16_t Type) {
   }
 }
 
 // MinGW specific.
 // Append information to the provided vector about all relocations that
 // need to be handled at runtime as runtime pseudo relocations (references
 // to a module local variable, which turned out to actually need to be
 // imported from another DLL).
-void SectionChunk::getRuntimePseudoRelocs(
+bool SectionChunk::getRuntimePseudoRelocs(
     std::vector<RuntimePseudoReloc> &Res) {
+  bool Found = false;
   for (const coff_relocation &Rel : Relocs) {
     auto *Target = dyn_cast_or_null<DefinedImportData>(
         File->getSymbol(Rel.SymbolTableIndex));
     if (!Target || !Target->IsRuntimePseudoReloc)
       continue;
     int SizeInBits = getRuntimePseudoRelocSize(Rel.Type);
     if (SizeInBits == 0) {
       error("unable to automatically import from " + Target->getName() +
             " with relocation type " +
             File->getCOFFObj()->getRelocationTypeName(Rel.Type) + " in " +
             toString(File));
       continue;
     }
     // SizeInBits is used to initialize the Flags field; currently no
     // other flags are defined.
     Res.emplace_back(
         RuntimePseudoReloc(Target, this, Rel.VirtualAddress, SizeInBits));
+    Found = true;
   }
+  return Found;
 }
 
 bool SectionChunk::hasData() const {
   return !(Header->Characteristics & IMAGE_SCN_CNT_UNINITIALIZED_DATA);
 }
 
 uint32_t SectionChunk::getOutputCharacteristics() const {
-  return Header->Characteristics & (PermMask | TypeMask);
+  uint32_t C = Header->Characteristics & (PermMask | TypeMask);
+  if (ForceWritable)
+    C |= IMAGE_SCN_MEM_WRITE;
+  return C;
+}
+
+StringRef SectionChunk::getSectionName() const {
+  if (ForceWritable) {
+    if (SectionName == ".rdata")
+      return ".data";
+    if (SectionName == ".text")
+      return ".wtext";
+  }
+  return SectionName;
 }
 
 bool SectionChunk::isCOMDAT() const {
   return Header->Characteristics & IMAGE_SCN_LNK_COMDAT;
 }
 
 void SectionChunk::printDiscardedMessage() const {
   // Removed by dead-stripping. If it's removed by ICF, ICF already

COFF/Writer.cpp

private:
   void mergeSections();
   void assignAddresses();
   void removeEmptySections();
   void createSymbolAndStringTable();
   void openFile(StringRef OutputPath);
   template <typename PEHeaderTy> void writeHeader();
   void createSEHTable();
   void createRuntimePseudoRelocs();
+  void insertRuntimePseudoRelocs();
   void createGuardCFTables();
   void markSymbolsForRVATable(ObjFile *File,
                               ArrayRef<SectionChunk *> SymIdxChunks,
                               SymbolRVASet &TableSymbols);
   void maybeAddRVATable(SymbolRVASet TableSymbols, StringRef TableSym,
                         StringRef CountSym);
   void setSectionPermissions();
   void writeSections();
static Optional<codeview::DebugInfo> loadExistingBuildId(StringRef Path) {
   }
   return None;
 }
 
 // The main function of the writer.
 void Writer::run() {
   ScopedTimer T1(CodeLayoutTimer);
 
+  // Find pseudo relocs early, to allow marking the corresponding
+  // section chunks as writable, before assigning them to output sections.
+  if (Config->MinGW)
+    createRuntimePseudoRelocs();
+
   createSections();
   createMiscChunks();
   createImportTables();
   createExportTable();
   mergeSections();
   assignAddresses();
   removeEmptySections();
   setSectionPermissions();
void Writer::createMiscChunks() {
   if (Config->Machine == I386)
     createSEHTable();
 
   // Create /guard:cf tables if requested.
   if (Config->GuardCF != GuardCFLevel::Off)
     createGuardCFTables();
 
   if (Config->MinGW)
-    createRuntimePseudoRelocs();
+    insertRuntimePseudoRelocs();
 }
 
 // Create .idata section for the DLL-imported symbol table.
 // The format of this section is inherently Windows-specific.
 // IdataContents class abstracted away the details for us,
 // so we just let it create chunks and add them to the section.
 void Writer::createImportTables() {
   if (ImportFile::Instances.empty())
void Writer::maybeAddRVATable(SymbolRVASet TableSymbols, StringRef TableSym,
   replaceSymbol<DefinedSynthetic>(T, T->getName(), TableChunk);
   cast<DefinedAbsolute>(C)->setVA(TableChunk->getSize() / 4);
 }
 
 // MinGW specific. Gather all relocations that are imported from a DLL even
 // though the code didn't expect it to, produce the table that the runtime
 // uses for fixing them up, and provide the synthetic symbols that the
 // runtime uses for finding the table.
+//
+// Mark sections that need to be written  to at runtime as writable, to avoid
+// that the runtime has to use VirtualProtect, which isn't available in
+// Windows Store/UWP apps.
 void Writer::createRuntimePseudoRelocs() {
   std::vector<RuntimePseudoReloc> Rels;
 
   for (Chunk *C : Symtab->getChunks()) {
     auto *SC = dyn_cast<SectionChunk>(C);
     if (!SC || !SC->isLive())
       continue;
-    SC->getRuntimePseudoRelocs(Rels);
+    if (SC->getRuntimePseudoRelocs(Rels))
+      SC->forceWritable();
   }
 
   if (!Rels.empty())
     log("Writing " + Twine(Rels.size()) + " runtime pseudo relocations");
   PseudoRelocTableChunk *Table = make<PseudoRelocTableChunk>(Rels);
-  RdataSec->addChunk(Table);
   EmptyChunk *EndOfList = make<EmptyChunk>();
-  RdataSec->addChunk(EndOfList);
 
   Symbol *HeadSym = Symtab->findUnderscore("__RUNTIME_PSEUDO_RELOC_LIST__");
   Symbol *EndSym = Symtab->findUnderscore("__RUNTIME_PSEUDO_RELOC_LIST_END__");
   replaceSymbol<DefinedSynthetic>(HeadSym, HeadSym->getName(), Table);
   replaceSymbol<DefinedSynthetic>(EndSym, EndSym->getName(), EndOfList);
 }
 
+// MinGW specific.
+void Writer::insertRuntimePseudoRelocs() {
+  DefinedSynthetic *HeadSym = dyn_cast_or_null<DefinedSynthetic>(
+      Symtab->findUnderscore("__RUNTIME_PSEUDO_RELOC_LIST__"));
+  DefinedSynthetic *EndSym = dyn_cast_or_null<DefinedSynthetic>(
+      Symtab->findUnderscore("__RUNTIME_PSEUDO_RELOC_LIST_END__"));
+  if (HeadSym)
+    RdataSec->addChunk(HeadSym->getChunk());
+  if (EndSym)
+    RdataSec->addChunk(EndSym->getChunk());
+}
+
 // Handles /section options to allow users to overwrite
 // section attributes.
 void Writer::setSectionPermissions() {
   for (auto &P : Config->Section) {
     StringRef Name = P.first;
     uint32_t Perm = P.second;
     for (OutputSection *Sec : OutputSections)
       if (Sec->Name == Name)

test/COFF/autoimport-x86.s

 # REQUIRES: x86
 
 # RUN: echo -e ".global variable\n.global DllMainCRTStartup\n.text\nDllMainCRTStartup:\nret\n.data\nvariable:\n.long 42" > %t-lib.s
 # RUN: llvm-mc -triple=x86_64-windows-gnu %t-lib.s -filetype=obj -o %t-lib.obj
 # RUN: lld-link -out:%t-lib.dll -dll -entry:DllMainCRTStartup %t-lib.obj -lldmingw -implib:%t-lib.lib
 
 # RUN: llvm-mc -triple=x86_64-windows-gnu %s -filetype=obj -o %t.obj
 # RUN: lld-link -lldmingw -out:%t.exe -entry:main %t.obj %t-lib.lib -verbose
 
 # RUN: llvm-readobj -coff-imports %t.exe | FileCheck -check-prefix=IMPORTS %s
 # RUN: llvm-objdump -d %t.exe | FileCheck -check-prefix=DISASM %s
 # RUN: llvm-objdump -s %t.exe | FileCheck -check-prefix=CONTENTS %s
+# RUN: llvm-readobj -sections %t.exe | FileCheck -check-prefix=SECTIONS %s
 
 # IMPORTS: Import {
 # IMPORTS-NEXT: Name: autoimport-x86.s.tmp-lib.dll
-# IMPORTS-NEXT: ImportLookupTableRVA: 0x2050
-# IMPORTS-NEXT: ImportAddressTableRVA: 0x2060
+# IMPORTS-NEXT: ImportLookupTableRVA: 0x1050
+# IMPORTS-NEXT: ImportAddressTableRVA: 0x1060
 # IMPORTS-NEXT: Symbol: variable (0)
 # IMPORTS-NEXT: }
 
-# DISASM: Disassembly of section .text:
-# DISASM: .text:
-# Relative offset at 0x1002 pointing at the IAT at 0x2060.
-# DISASM: 140001000:      8b 05 5a 10 00 00       movl    4186(%rip), %eax
-# DISASM: 140001006:      c3      retq
+# DISASM: Disassembly of section .wtext:
+# DISASM: .wtext:
+# Relative offset at 0x3002 pointing at the IAT at 0x1060.
+# DISASM: 140003000:      8b 05 5a e0 ff ff       movl    -8102(%rip), %eax
+# DISASM: 140003006:      c3      retq
 
 # Runtime pseudo reloc list header consisting of 0x0, 0x0, 0x1.
-# First runtime pseudo reloc, with import from 0x2060,
-# applied at 0x1002, with a size of 32 bits.
-# Second runtime pseudo reloc, with import from 0x2060,
-# applied at 0x3000, with a size of 64 bits.
+# First runtime pseudo reloc, with import from 0x1060,
+# applied at 0x3002, with a size of 32 bits.
+# Second runtime pseudo reloc, with import from 0x1060,
+# applied at 0x2000, with a size of 64 bits.
 # CONTENTS: Contents of section .rdata:
-# CONTENTS:  140002000 00000000 00000000 01000000 60200000
-# CONTENTS:  140002010 02100000 20000000 60200000 00300000
-# CONTENTS:  140002020 40000000
-# ptr: pointing at the IAT RVA at 0x2060
+# CONTENTS:  140001000 00000000 00000000 01000000 60100000
+# CONTENTS:  140001010 02300000 20000000 60100000 00200000
+# CONTENTS:  140001020 40000000
+# ptr: pointing at the IAT RVA at 0x1060
 # relocs: pointing at the runtime pseudo reloc list at
-# 0x2000 - 0x2024.
+# 0x1000 - 0x1024.
 # CONTENTS: Contents of section .data:
-# CONTENTS:  140003000 60200040 01000000 00200040 01000000
-# CONTENTS:  140003010 24200040 01000000
+# CONTENTS:  140002000 60100040 01000000 00100040 01000000
+# CONTENTS:  140002010 24100040 01000000
+
+# SECTIONS:        Name: .wtext (2E 77 74 65 78 74 00 00)
+# SECTIONS:        VirtualAddress: 0x3000
+# SECTIONS:        Characteristics [ (0xE0000020)
+# SECTIONS-NEXT:     IMAGE_SCN_CNT_CODE (0x20)
+# SECTIONS-NEXT:     IMAGE_SCN_MEM_EXECUTE (0x20000000)
+# SECTIONS-NEXT:     IMAGE_SCN_MEM_READ (0x40000000)
+# SECTIONS-NEXT:     IMAGE_SCN_MEM_WRITE (0x80000000)
+# SECTIONS-NEXT:   ]
 
     .global main
     .text
 main:
     movl variable(%rip), %eax
     ret
     .data
 ptr:
     .quad variable
 relocs:
     .quad __RUNTIME_PSEUDO_RELOC_LIST__
     .quad __RUNTIME_PSEUDO_RELOC_LIST_END__