[Tinycc-devel] tcc assembler emits wrong pc-relative symbol difference reloctions in immediates

[Rich Felker]

A user encountered this bug trying to build musl libc for i386 using
tcc, where an asm source file using pc-relative addressing to load its
data was reading from the wrong address. I tracked it down to the
offset in the immediate to an add instruction, which I simplified down
to the following minimal test case to reproduce the problem:

Simple testcase:

.text
1:  add $1f-1b,%eax
.data
1:  .long 0

The relocation emitted is the pc-relative address based on the
beginning of the add opcode, but it needs to be based on the beginning
of the immediate operand in the add opcode. This is because asm_expr
uses the value of ind at the time it is called to offset symbol value
in pe->v, but this value of ind points to the beginning of the
instruction. Something needs to happen to update it to point to the
location where the immediate is actually emitted.

Here is a really dumb fix, but I don't know if it breaks other things,
and it's likely incomplete:

diff --git a/i386-asm.c b/i386-asm.c
index e134d804..63cfbf6b 100644
--- a/i386-asm.c
+++ b/i386-asm.c
@@ -738,6 +738,8 @@ ST_FUNC void asm_opcode(TCCState *s1, int opcode)
 
 s = 0; /* avoid warning */
 
+int ind0 = ind;
+
 again:
 /* optimize matching by using a lookup table (no hashing is needed
!) */
@@ -1153,6 +1155,7 @@ again:
} else if (pa->op_type[i] == OPT_DISP || pa->op_type[i] == 
OPT_DISP8) {
 gen_disp32([i].e);
 } else {
+if (ops[i].e.pcrel) ops[i].e.v += ind-ind0;
 gen_expr32([i].e);
 }
 }

Please CC me on replies, as I'm not subscribed.

Rich

___
Tinycc-devel mailing list
Tinycc-devel@nongnu.org
https://lists.nongnu.org/mailman/listinfo/tinycc-devel

Re: [Tinycc-devel] problem on win64 with latest commit

[grischka via Tinycc-devel]

On 01.03.2024 07:49, Herman ten Brugge via Tinycc-devel wrote:

On 2/29/24 23:17, grischka wrote:

On 29.02.2024 07:26, Herman ten Brugge via Tinycc-devel wrote:

Setting CONFIG_RUNMEM_RO=0 looks incorrect to me because it sets write in 
executables.
Apple has implemented W^X (Writes can not occur in executables) for security 
reasons.
This may also be implemented in in future linux/bsd releases.


Using CONFIG_RUNMEM_RO=1 may be the right thing to do in
future, however there was a severe off-bounds problem with
the un-mprotect call which I just fixed.  Maybe that was
the reason?


This did not work. We still use 'PROT_READ | PROT_WRITE | PROT_EXEC'.
Apple does not support that for security reasons.


Last time you mentioned "Apple W^X", which according to
   
https://developer.apple.com/documentation/apple-silicon/porting-just-in-time-compilers-to-apple-silicon
would require mmap(), MAP_JIT, and some pthread_jit_write_protect_np()
to work around.

Since that is not what tcc has I was concluding that something else
must be at work.


Why do you want CONFIG_RUNMEM_RO=0? It was allways set to 1 before
and that worked fine on all targets I can test (about 20).
You changed it in "tccrun: resign from "advanced" system calls 
(memaligh/gettid)" on feb 25.
Why?


Some things have been simplified lately, the second argument to
tcc_relocate() was removed, memalign was removed, etc. So in the
course of going back to more simplicity, I did change that in
order to see whether it still would work.

Now it seems that it would work in most cases,  except that it doesn't
on "Apple Silicon M1 arm64". If that is what you're saying.

Btw. I've seem some Apple arm64 related patches in
   https://github.com/frida/tinycc/commits/main/
such as
   
https://github.com/frida/tinycc/commit/263232e8cf53991f195d7f7c028488cbd6f6b117

Anyway, I have no problem setting CONFIG_RUNMEM_RO=1 at all, we just
need to be aware that it increases run-memory size by additional two
pages.  Since we also dropped memalign,  the minimum run-memory size
with CONFIG_RUNMEM_RO=1 now is 3 pages plus one for alignment, that is
minimum 16 kB (4 x 4096 bytes).

-- grischka



 Herman

___
Tinycc-devel mailing list
Tinycc-devel@nongnu.org
https://lists.nongnu.org/mailman/listinfo/tinycc-devel



___
Tinycc-devel mailing list
Tinycc-devel@nongnu.org
https://lists.nongnu.org/mailman/listinfo/tinycc-devel