cmd/internal/ld: put read-only relocated data into .data.rel.ro when making a shared object

Currently Go produces shared libraries that cannot be shared between processes
because they have relocations against the text segment (not text section). This
fixes this by moving some data from .rodata to .data.rel.ro and by marking some
sections rw (so the program linker puts them into a different segment).

I think this is all way too much for 1.5 but I wanted to hammer my way to
something working. Will fix after 1.6.

Fixes golang#10914

Change-Id: I7178daadc0ae87953d5a084aa3d580f4e3b46d47

Author: mwhudson

misc/cgo/testshared/shared_test.go

@@ -47,10 +47,17 @@ func goCmd(t *testing.T, args ...string) {
 	}
 	newargs = append(newargs, args[1:]...)
 	c := exec.Command("go", newargs...)
+	var output []byte
+	var err error
 	if testing.Verbose() {
 		fmt.Printf("+ go %s\n", strings.Join(newargs, " "))
+		c.Stdout = os.Stdout
+		c.Stderr = os.Stderr
+		err = c.Run()
+	} else {
+		output, err = c.CombinedOutput()
 	}
-	if output, err := c.CombinedOutput(); err != nil {
+	if err != nil {
 		if t != nil {
 			t.Errorf("executing %s failed %v:\n%s", strings.Join(c.Args, " "), err, output)
 		} else {
@@ -86,15 +93,15 @@ func testMain(m *testing.M) (int, error) {
 	if gorootInstallDir == "" {
 		return 0, errors.New("could not create temporary directory after 10000 tries")
 	}
-	defer os.RemoveAll(gorootInstallDir)
+	//defer os.RemoveAll(gorootInstallDir)
 
 	// Some tests need to edit the source in GOPATH, so copy this directory to a
 	// temporary directory and chdir to that.
 	scratchDir, err := ioutil.TempDir("", "testshared")
 	if err != nil {
 		return 0, fmt.Errorf("TempDir failed: %v", err)
 	}
-	defer os.RemoveAll(scratchDir)
+	//defer os.RemoveAll(scratchDir)
 	err = filepath.Walk(".", func(path string, info os.FileInfo, err error) error {
 		scratchPath := filepath.Join(scratchDir, path)
 		if info.IsDir() {
@@ -121,7 +128,7 @@ func testMain(m *testing.M) (int, error) {
 	// that takes a few seconds, do it here and have all tests use the version
 	// built here.
 	suffix = strings.Split(filepath.Base(gorootInstallDir), "_")[2]
-	goCmd(nil, append([]string{"install", "-buildmode=shared"}, minpkgs...)...)
+	goCmd(nil, append([]string{"install", "-buildmode=shared", "-ldflags=-tmpdir=/home/mwhudson/tmp/hl/std"}, minpkgs...)...)
 
 	myContext.InstallSuffix = suffix + "_dynlink"
 	depP, err := myContext.Import("dep", ".", build.ImportComment)
@@ -149,6 +156,45 @@ func TestSOBuilt(t *testing.T) {
 	}
 }
 
+func hasDynTag(f *elf.File, tag elf.DynTag) bool {
+	ds := f.SectionByType(elf.SHT_DYNAMIC)
+	if ds == nil {
+		return false
+	}
+	d, err := ds.Data()
+	if err != nil {
+		return false
+	}
+	for len(d) > 0 {
+		var t elf.DynTag
+		switch f.Class {
+		case elf.ELFCLASS32:
+			t = elf.DynTag(f.ByteOrder.Uint32(d[0:4]))
+			d = d[8:]
+		case elf.ELFCLASS64:
+			t = elf.DynTag(f.ByteOrder.Uint64(d[0:8]))
+			d = d[16:]
+		}
+		if t == tag {
+			return true
+		}
+	}
+	return false
+}
+
+// The shared library does not have relocations against the text segment.
+func TestNoTextrel(t *testing.T) {
+	sopath := filepath.Join(gorootInstallDir, soname)
+	f, err := elf.Open(sopath)
+	defer f.Close()
+	if err != nil {
+		log.Fatal("elf.Open failed: ", err)
+	}
+	if hasDynTag(f, elf.DT_TEXTREL) {
+		t.Errorf("%s has DT_TEXTREL set", soname)
+	}
+}
+
 // The install command should have created a "shlibname" file for the
 // listed packages (and runtime/cgo) indicating the name of the shared
 // library containing it.

src/cmd/internal/obj/link.go

@@ -321,12 +321,30 @@ const (
 	Sxxx = iota
 	STEXT
 	SELFRXSECT
+
 	STYPE
 	SSTRING
 	SGOSTRING
 	SGOFUNC
 	SRODATA
 	SFUNCTAB
+
+	// Types STYPE-SFUNCTAB above are written to the .rodata section by default.
+	// When linking a shared object, some conceptually "read only" types need to
+	// be written to by relocations and putting them in a section called
+	// ".rodata" interacts poorly with the system linkers. So in this case the
+	// linker checks all the objects of the above types and bumps any object that
+	// has a relocation to it to the corresponding type below, and objects of
+	// these types are written to another magically named section,
+	// ".data.rel.ro", that will be mprotected read only by the dynamic linker
+	// after relocations have been applied.
+	STYPERELRO
+	SSTRINGRELRO
+	SGOSTRINGRELRO
+	SGOFUNCRELRO
+	SRODATARELRO
+	SFUNCTABRELRO
+
 	STYPELINK
 	SSYMTAB
 	SPCLNTAB

src/cmd/link/internal/ld/data.go

@@ -1183,6 +1183,29 @@ func dodata() {
 
 	*l = nil
 
+	if Buildmode == BuildmodeShared {
+		// "read only" data with relocations needs to go in its own section
+		// when building a shared library.
+		for s := datap; s != nil; s = s.Next {
+			if s.Type >= obj.STYPE && s.Type <= obj.SFUNCTAB && len(s.R) > 0 {
+				s.Type += (obj.STYPERELRO - obj.STYPE)
+				if s.Outer != nil && s.Outer.Type != s.Type {
+					s.Outer.Type = s.Type
+				}
+			}
+		}
+		// Check that we haven't made two symbols with the same .Outer into
+		// different types.
+		for s := datap; s != nil; s = s.Next {
+			if s.Outer != nil && s.Outer.Type != s.Type {
+				Diag(
+					"inconsisent types for %s and its Outer %s (%d != %d)",
+					s.Name, s.Outer.Name, s.Type, s.Outer.Type)
+			}
+		}
+
+	}
+
 	datap = listsort(datap, datcmp, listnextp)
 
 	if Iself {
@@ -1442,12 +1465,12 @@ func dodata() {
 	/* read-only data */
 	sect = addsection(segro, ".rodata", 04)
 
-	sect.Align = maxalign(s, obj.STYPELINK-1)
+	sect.Align = maxalign(s, obj.STYPERELRO-1)
 	datsize = Rnd(datsize, int64(sect.Align))
 	sect.Vaddr = 0
 	Linklookup(Ctxt, "runtime.rodata", 0).Sect = sect
 	Linklookup(Ctxt, "runtime.erodata", 0).Sect = sect
-	for ; s != nil && s.Type < obj.STYPELINK; s = s.Next {
+	for ; s != nil && s.Type < obj.STYPERELRO; s = s.Next {
 		datsize = aligndatsize(datsize, s)
 		s.Sect = sect
 		s.Type = obj.SRODATA
@@ -1457,8 +1480,43 @@ func dodata() {
 
 	sect.Length = uint64(datsize) - sect.Vaddr
 
+	// There are a few sections that are conceptually read-only but are written
+	// to by relocations. We can arrange for the dynamic linker to mprotect
+	// exactly one section after relocations are applied by calling it
+	// ".data.rel.ro". We use that section for things that would ordinarily be go
+	// into .rodata and leave the other sections (.typelink, .gosymtab,
+	// .gopclntab) writable.
+	// TODO(mwhudson): Why can't we just put the typelink table and so on into
+	// .data.rel.ro? What exactly depends on them being their own sections?
+	relro_perms := 04
+
+	if Buildmode == BuildmodeShared {
+		relro_perms = 06
+		/* data only written by relocations */
+		sect = addsection(segro, ".data.rel.ro", 06)
+
+		sect.Align = maxalign(s, obj.STYPELINK-1)
+		datsize = Rnd(datsize, int64(sect.Align))
+		sect.Vaddr = 0
+		Linklookup(Ctxt, "runtime.rodata", 0).Sect = sect
+		Linklookup(Ctxt, "runtime.erodata", 0).Sect = sect
+		for ; s != nil && s.Type < obj.STYPELINK; s = s.Next {
+			datsize = aligndatsize(datsize, s)
+			if s.Outer != nil && s.Outer.Sect != nil && s.Outer.Sect != sect {
+				Diag("vomit %s", s.Name)
+			}
+			s.Sect = sect
+			s.Type = obj.SRODATA
+			s.Value = int64(uint64(datsize) - sect.Vaddr)
+			growdatsize(&datsize, s)
+		}
+
+		sect.Length = uint64(datsize) - sect.Vaddr
+
+	}
+
 	/* typelink */
-	sect = addsection(segro, ".typelink", 04)
+	sect = addsection(segro, ".typelink", relro_perms)
 
 	sect.Align = maxalign(s, obj.STYPELINK)
 	datsize = Rnd(datsize, int64(sect.Align))
@@ -1476,7 +1534,7 @@ func dodata() {
 	sect.Length = uint64(datsize) - sect.Vaddr
 
 	/* gosymtab */
-	sect = addsection(segro, ".gosymtab", 04)
+	sect = addsection(segro, ".gosymtab", relro_perms)
 
 	sect.Align = maxalign(s, obj.SPCLNTAB-1)
 	datsize = Rnd(datsize, int64(sect.Align))
@@ -1494,7 +1552,7 @@ func dodata() {
 	sect.Length = uint64(datsize) - sect.Vaddr
 
 	/* gopclntab */
-	sect = addsection(segro, ".gopclntab", 04)
+	sect = addsection(segro, ".gopclntab", relro_perms)
 
 	sect.Align = maxalign(s, obj.SELFROSECT-1)
 	datsize = Rnd(datsize, int64(sect.Align))
@@ -1674,6 +1732,10 @@ func address() {
 		rodata = text.Next
 	}
 	typelink := rodata.Next
+	if Buildmode == BuildmodeShared {
+		// There is another section (.data.rel.ro) when building a shared object...
+		typelink = typelink.Next
+	}
 	symtab := typelink.Next
 	pclntab := symtab.Next
 

src/cmd/link/internal/ld/elf.go

@@ -1611,6 +1611,7 @@ func doelf() {
 	Addstring(shstrtab, ".text")
 	Addstring(shstrtab, ".noptrdata")
 	Addstring(shstrtab, ".data")
+	Addstring(shstrtab, ".data.rel.ro")
 	Addstring(shstrtab, ".bss")
 	Addstring(shstrtab, ".noptrbss")
 
@@ -1655,6 +1656,7 @@ func doelf() {
 			Addstring(shstrtab, ".rela.gopclntab")
 			Addstring(shstrtab, ".rela.noptrdata")
 			Addstring(shstrtab, ".rela.data")
+			Addstring(shstrtab, ".rela.data.rel.ro")
 
 		default:
 			Addstring(shstrtab, ".rel.text")
@@ -1664,6 +1666,7 @@ func doelf() {
 			Addstring(shstrtab, ".rel.gopclntab")
 			Addstring(shstrtab, ".rel.noptrdata")
 			Addstring(shstrtab, ".rel.data")
+			Addstring(shstrtab, ".rel.data.rel.ro")
 		}
 
 		// add a .note.GNU-stack section to mark the stack as non-executable

src/cmd/link/internal/ld/lib.go

@@ -1154,7 +1154,7 @@ func readelfsymboldata(f *elf.File, sym *elf.Symbol) []byte {
 	if sect.Type != elf.SHT_PROGBITS {
 		Diag("reading %s from non-PROGBITS section", sym.Name)
 	}
-	n, err := sect.ReadAt(data, int64(sym.Value-sect.Offset))
+	n, err := sect.ReadAt(data, int64(sym.Value-sect.Addr))
 	if uint64(n) != sym.Size {
 		Diag("reading contents of %s: %v", sym.Name, err)
 	}
@@ -1682,6 +1682,11 @@ func genasmsym(put func(*LSym, string, int, int64, int64, int, *LSym)) {
 			obj.SSTRING,
 			obj.SGOSTRING,
 			obj.SGOFUNC,
+			obj.STYPERELRO,
+			obj.SSTRINGRELRO,
+			obj.SGOSTRINGRELRO,
+			obj.SGOFUNCRELRO,
+			obj.SRODATARELRO,
 			obj.SWINDOWS:
 			if !s.Reachable {
 				continue

src/cmd/link/internal/ld/symtab.go

@@ -376,6 +376,7 @@ func symtab() {
 	symgofunc := s
 
 	symtypelink := Linklookup(Ctxt, "runtime.typelink", 0)
+	symtypelink.Type = obj.STYPELINK
 
 	symt = Linklookup(Ctxt, "runtime.symtab", 0)
 	symt.Local = true