Hojun-Cho/ww
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

w6l: route writable globals into a second PT_LOAD

Browse Source 
Second step toward top-level mutable `let`. The static path now loads
.data PROGBITS sections from input .o files, page-aligns them after
.text, and emits a second PT_LOAD (R+W) covering them. Relocations
targeting data symbols compute against the data VA; text→text
displacements still cancel the absolute VAs and stay correct.

Inputs without any .data keep the original single-PT_LOAD layout
byte-for-byte — 992 (selfhost w6l .o diff) and 995 (self-rebuild)
depend on that invariant.

Dynamic-link path (-l/-L) rejects .data for now with a clear error;
folding writable globals into the existing R+W segment alongside
.got.plt/.dynamic is a follow-up.
This commit is contained in:
Hojun-Cho
2026-05-12 11:42:30 +09:00
parent 1b0955c97b
commit 38e0b6510a
8 changed files with 406 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
cmd/w6l/dynout.c
View File

@@ -142,6 +142,18 @@ poke32(u8 *buf, u64 off, u32 v)
int
l_emit_dyn_elf(Lnk *l, FILE *f, u64 base, u64 entry)
{
/* Writable globals on the dynamic-link path need their own R+W
* segment, and the existing R+W segment (gotplt + dynamic) has a
* fixed layout that l_relocate's data_va guess wouldn't match.
* Rather than ship a silently-miscompiled binary, refuse and
* leave the feature for a follow-up. */
if (l->datalen > 0) {
fprintf(stderr, "w6l: top-level mutable globals (.data) are "
"not yet supported with -l/-L; link without shared "
"libraries to use them.\n");
return 1;
}
const int N = l->dyn_n;
/* ---- Pass 1: collect dynamic symbol names + .dynstr layout ---- */

17
cmd/w6l/l.h
View File

@@ -28,8 +28,12 @@ typedef struct Lnk Lnk;
struct Lsym {
const char *name;
u64 val; /* offset within combined .text once linked */
u64 val; /* offset within combined .text (or .data when
* in_data=1) once linked */
int defined; /* 1 if a Lobj defines this symbol */
int in_data; /* 1 if defined in .data (writable globals);
* 0 means .text (the default). Mutually
* exclusive with is_dyn. */
Lobj *owner;
int idx_in_owner;
/* Dynamic-linking fields. Set by l_resolve when an undefined sym
@@ -57,6 +61,8 @@ struct Lobj {
u64 len;
u64 text_off; /* offset of .text in combined output */
u64 text_size;
u64 data_off; /* offset of .data in combined output */
u64 data_size; /* bytes contributed to combined .data (0 if none) */
Lobj *next;
};
@@ -76,6 +82,9 @@ struct Lnk {
Lrel *rels;
u8 *text; /* combined .text */
u64 textcap, textlen;
u8 *data; /* combined .data (writable). Empty unless any
* input .o has a .data PROGBITS section. */
u64 datacap, datalen;
int errs;
int dyn_n; /* number of symbols routed through PLT */
};
@@ -94,7 +103,11 @@ Lsym *l_intern(Lnk*, const char *name);
Lsym *l_lookup(Lnk*, const char *name);
/* pass.c */
int l_resolve(Lnk*);
int l_relocate(Lnk*, u64 base);
/* Patch relocations in l->text. text_va is the VA where .text will be
* mapped; data_va is the VA where .data will be mapped (pass 0 if no
* data symbols). PC32/PLT32 displacements between text symbols cancel
* the absolute VA, but data targets need the real data_va. */
int l_relocate(Lnk*, u64 text_va, u64 data_va);
/* out.c */
int l_emit_elf(Lnk*, FILE *out, u64 base, u64 entry);
/* dynout.c — emit a dynamic-linked ELF executable. Called by

15
cmd/w6l/main.c
View File

@@ -115,7 +115,20 @@ main(int argc, char **argv)
if (l_load(&l, inputs[i]) != 0) return 1;
}
if (l_resolve(&l) != 0) return 1;
if (l_relocate(&l, base + 0x1000) != 0) return 1;
/* Layout for relocation purposes. The static path (out.c) uses
* text_va = base + 0x1000 and places .data at the next page after
* .text — these must agree with the layout in out.c. PC-relative
* displacements between .text symbols cancel the absolute VAs, so
* a dyn-path link whose data_va is "wrong" still relocates text→
* text correctly; text→data is currently rejected in dynout.c. */
u64 text_va = base + 0x1000;
u64 data_va = 0;
if (l.datalen > 0) {
u64 page = 0x1000;
u64 data_off = (0x1000 + l.textlen + page - 1) & ~(page - 1);
data_va = base + data_off;
}
if (l_relocate(&l, text_va, data_va) != 0) return 1;
Lsym *entry = l_lookup(&l, "_start");
if (entry == NULL || !entry->defined) entry = l_lookup(&l, "main");

49
cmd/w6l/obj.c
View File

@@ -84,6 +84,19 @@ emit_text(Lnk *l, const u8 *src, u64 n)
l->textlen += n;
}
static void
emit_data(Lnk *l, const u8 *src, u64 n)
{
if (l->datalen + n > l->datacap) {
u64 nc = l->datacap ? l->datacap * 2 : 256;
while (nc < l->datalen + n) nc *= 2;
l->data = realloc(l->data, nc);
l->datacap = nc;
}
memcpy(l->data + l->datalen, src, n);
l->datalen += n;
}
/* Internal: load a single ELF .o image already in memory. The caller
* gives us the bytes (we own them) and a path tag for diagnostics.
* If the bytes look like an archive (magic "!<arch>\n") we recurse
@@ -116,12 +129,15 @@ elf_globals(const u8 *buf, u64 len)
Ehdr *eh = (Ehdr *)buf;
if (memcmp(eh->e_ident, "\x7f""ELF", 4) != 0) return NULL;
Shdr *sh = (Shdr *)(buf + eh->e_shoff);
int idx_text = -1, idx_symtab = -1;
int idx_text = -1, idx_data = -1, idx_symtab = -1;
const char *shstr = (const char *)(buf + sh[eh->e_shstrndx].sh_offset);
for (u16 i = 0; i < eh->e_shnum; i++) {
if (sh[i].sh_type == SHT_PROGBITS &&
strcmp(shstr + sh[i].sh_name, ".text") == 0)
idx_text = i;
else if (sh[i].sh_type == SHT_PROGBITS &&
strcmp(shstr + sh[i].sh_name, ".data") == 0)
idx_data = i;
else if (sh[i].sh_type == SHT_SYMTAB)
idx_symtab = i;
}
@@ -131,12 +147,15 @@ elf_globals(const u8 *buf, u64 len)
u64 nsyms = sh[idx_symtab].sh_size / sizeof(Sym64);
const char *str = (const char *)(buf + sh[idx_strtab].sh_offset);
/* Include both .text and .data globals so archive members that
* define a data global get pulled in when something references it. */
char **out = calloc(nsyms + 1, sizeof *out);
int n = 0;
for (u64 i = 1; i < nsyms; i++) {
if (symtab[i].st_shndx == 0) continue;
if ((symtab[i].st_info >> 4) != 1) continue; /* STB_GLOBAL */
if ((int)symtab[i].st_shndx != idx_text) continue;
int sx = (int)symtab[i].st_shndx;
if (sx != idx_text && sx != idx_data) continue;
out[n++] = strdup(str + symtab[i].st_name);
}
out[n] = NULL;
@@ -259,12 +278,15 @@ load_image(Lnk *l, const char *path, u8 *buf, u64 len)
if (eh->e_shstrndx >= eh->e_shnum) { free(buf); return -1; }
const char *shstr = (const char *)(buf + sh[eh->e_shstrndx].sh_offset);
/* find .text, .symtab, .strtab, .rela.text */
int idx_text = -1, idx_symtab = -1, idx_strtab = -1, idx_rela = -1;
/* find .text, .data (optional), .symtab, .strtab, .rela.text */
int idx_text = -1, idx_data = -1, idx_symtab = -1, idx_strtab = -1;
int idx_rela = -1;
for (u16 i = 0; i < eh->e_shnum; i++) {
const char *nm = shstr + sh[i].sh_name;
if (sh[i].sh_type == SHT_PROGBITS && strcmp(nm, ".text") == 0)
idx_text = i;
else if (sh[i].sh_type == SHT_PROGBITS && strcmp(nm, ".data") == 0)
idx_data = i;
else if (sh[i].sh_type == SHT_SYMTAB)
idx_symtab = i;
else if (sh[i].sh_type == SHT_RELA && strcmp(nm, ".rela.text") == 0)
@@ -283,11 +305,15 @@ load_image(Lnk *l, const char *path, u8 *buf, u64 len)
ob->len = len;
ob->text_off = l->textlen;
ob->text_size = sh[idx_text].sh_size;
ob->data_off = l->datalen;
ob->data_size = (idx_data >= 0) ? sh[idx_data].sh_size : 0;
ob->next = l->objs;
l->objs = ob;
/* append .text */
/* append .text and (if present) .data */
emit_text(l, buf + sh[idx_text].sh_offset, sh[idx_text].sh_size);
if (idx_data >= 0 && sh[idx_data].sh_size > 0)
emit_data(l, buf + sh[idx_data].sh_offset, sh[idx_data].sh_size);
/* per-object: load symbols */
Sym64 *symtab = (Sym64 *)(buf + sh[idx_symtab].sh_offset);
@@ -300,8 +326,10 @@ load_image(Lnk *l, const char *path, u8 *buf, u64 len)
const char *nm = str + symtab[i].st_name;
if (nm[0] == '\0') continue;
Lsym *gs = l_intern(l, nm);
if (symtab[i].st_shndx != 0 /* SHN_UNDEF */
&& symtab[i].st_shndx == idx_text) {
int sx = (int)symtab[i].st_shndx;
int in_text = (symtab[i].st_shndx != 0 && sx == idx_text);
int in_data = (idx_data >= 0 && sx == idx_data);
if (in_text || in_data) {
if (gs->defined) {
fprintf(stderr, "w6l: %s: duplicate symbol %s\n",
path, nm);
@@ -310,7 +338,12 @@ load_image(Lnk *l, const char *path, u8 *buf, u64 len)
gs->defined = 1;
gs->owner = ob;
gs->idx_in_owner = (int)i;
gs->val = ob->text_off + symtab[i].st_value;
if (in_data) {
gs->in_data = 1;
gs->val = ob->data_off + symtab[i].st_value;
} else {
gs->val = ob->text_off + symtab[i].st_value;
}
}
}
map[i] = gs;

75
cmd/w6l/out.c
View File

@@ -1,15 +1,21 @@
/*
* out.c — emit a static ELF64 executable.
*
* Layout (file order):
* Layout (file order) without .data:
* [0..64) ELF header
* [64..120) program header (one PT_LOAD)
* [64..120) one program header (PT_LOAD R+X)
* [120..0x1000) zero pad
* [0x1000..) .text bytes
*
* The single PT_LOAD covers the whole file, R+X. No interpreter,
* no dynamic, no .bss yet. Entry point is the address of the
* symbol named "_start" (or whatever main supplies via -e).
* With .data (any input .o has writable globals):
* [0..64) ELF header
* [64..176) two program headers (PT_LOAD R+X, PT_LOAD R+W)
* [176..0x1000) zero pad
* [0x1000..) .text bytes
* [data_off..) .data bytes (file offset and vaddr page-aligned)
*
* No interpreter, no dynamic, no .bss yet. Entry point is the address
* of the symbol named "_start" (or whatever main supplies via -e).
*/
#include "l.h"
#include <stdio.h>
@@ -52,9 +58,17 @@ l_emit_elf(Lnk *l, FILE *f, u64 base, u64 entry)
if (l->sos != NULL && l->dyn_n > 0)
return l_emit_dyn_elf(l, f, base, entry);
const u64 page = 0x1000;
const u64 text_off = 0x1000;
const u64 text_va = base + text_off;
const u64 filesz = text_off + l->textlen;
const u64 rx_end = text_off + l->textlen;
const int has_data = (l->datalen > 0);
/* data goes at the next page boundary so the loader can grant a
* fresh page of R+W permissions without overlapping the R+X mapping. */
const u64 data_off = has_data ? ((rx_end + page - 1) & ~(page - 1)) : 0;
const u64 data_va = has_data ? (base + data_off) : 0;
const u64 file_end = has_data ? (data_off + l->datalen) : rx_end;
(void)data_va;
Ehdr eh = {0};
memcpy(eh.e_ident, "\x7f""ELF", 4);
@@ -68,21 +82,36 @@ l_emit_elf(Lnk *l, FILE *f, u64 base, u64 entry)
eh.e_phoff = sizeof(Ehdr);
eh.e_ehsize = sizeof(Ehdr);
eh.e_phentsize = sizeof(Phdr);
eh.e_phnum = 1;
(void)text_va;
eh.e_phnum = has_data ? 2 : 1;
Phdr ph = {0};
ph.p_type = PT_LOAD;
ph.p_flags = PF_R | PF_X;
ph.p_offset = 0;
ph.p_vaddr = base;
ph.p_paddr = base;
ph.p_filesz = filesz;
ph.p_memsz = filesz;
ph.p_align = 0x1000;
/* R+X load covering [0, rx_end). When .data is present we still
* round up to a page in memsz so the loader doesn't try to give
* the same page both R+X and R+W permissions. */
Phdr phx = {0};
phx.p_type = PT_LOAD;
phx.p_flags = PF_R | PF_X;
phx.p_offset = 0;
phx.p_vaddr = base;
phx.p_paddr = base;
phx.p_filesz = rx_end;
phx.p_memsz = rx_end;
phx.p_align = page;
Phdr phw = {0};
if (has_data) {
phw.p_type = PT_LOAD;
phw.p_flags = PF_R | PF_W;
phw.p_offset = data_off;
phw.p_vaddr = base + data_off;
phw.p_paddr = base + data_off;
phw.p_filesz = l->datalen;
phw.p_memsz = l->datalen;
phw.p_align = page;
}
fwrite(&eh, 1, sizeof eh, f);
fwrite(&ph, 1, sizeof ph, f);
fwrite(&phx, 1, sizeof phx, f);
if (has_data) fwrite(&phw, 1, sizeof phw, f);
/* pad to text_off */
long here = ftell(f);
@@ -90,5 +119,13 @@ l_emit_elf(Lnk *l, FILE *f, u64 base, u64 entry)
if (l->textlen) fwrite(l->text, 1, l->textlen, f);
if (has_data) {
/* pad to data_off */
here = ftell(f);
for (long i = here; i < (long)data_off; i++) fputc(0, f);
fwrite(l->data, 1, l->datalen, f);
}
(void)file_end;
return 0;
}

10
cmd/w6l/pass.c
View File

@@ -68,7 +68,7 @@ patch_u32(u8 *p, u32 v)
}
int
l_relocate(Lnk *l, u64 base)
l_relocate(Lnk *l, u64 text_va, u64 data_va)
{
for (Lrel *r = l->rels; r; r = r->next) {
if (r->sym == NULL) continue;
@@ -79,9 +79,11 @@ l_relocate(Lnk *l, u64 base)
switch (r->kind) {
case R_X86_64_PC32:
case R_X86_64_PLT32: {
u64 site = base + r->off;
i64 target = (i64)(base + r->sym->val);
i64 rel = target - (i64)site + r->addend;
u64 site = text_va + r->off;
u64 sym_va = r->sym->in_data
? data_va + r->sym->val
: text_va + r->sym->val;
i64 rel = (i64)sym_va - (i64)site + r->addend;
patch_u32(l->text + r->off, (u32)(i32)rel);
break;
}