cmd/link: disallow pull-only linknames

As mentioned in CL 584598, linkname is a mechanism that, when
abused, can break API integrity and even safety of Go programs.
CL 584598 is a first step to restrict the use of linknames, by
implementing a blocklist. This CL takes a step further, tightening
up the restriction by allowing linkname references ("pull") only
when the definition side explicitly opts into it, by having a
linkname on the definition (possibly to itself). This way, it is at
least clear on the definition side that the symbol, despite being
unexported, is accessed outside of the package. Unexported symbols
without linkname can now be actually private. This is similar to
the symbol visibility rule used by gccgo for years (which defines
unexported non-linknamed symbols as C static symbols).

As there can be pull-only linknames in the wild that may be broken
by this change, we currently only enforce this rule for symbols
defined in the standard library. Push linknames are added in the
standard library to allow things build.

Linkname references to external (non-Go) symbols are still allowed,
as their visibility is controlled by the C symbol visibility rules
and enforced by the C (static or dynamic) linker.

Assembly symbols are treated similar to linknamed symbols.

This is controlled by -checklinkname linker flag, currently not
enabled by default. A follow-up CL will enable it by default.

Change-Id: I07344f5c7a02124dbbef0fbc8fec3b666a4b2b0e
Reviewed-on: https://go-review.googlesource.com/c/go/+/585358
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Than McIntosh <thanm@google.com>
Reviewed-by: Russ Cox <rsc@golang.org>

4 files changed, 14 insertions, 0 deletions

diff --git a/src/internal/cpu/cpu.go b/src/internal/cpu/cpu.go
index d794e53cee..9be280c6ba 100644
--- a/src/internal/cpu/cpu.go
+++ b/src/internal/cpu/cpu.go
@@ -6,6 +6,8 @@
 // used by the Go standard library.
 package cpu
 
+import _ "unsafe" // for linkname
+
 // DebugOptions is set to true by the runtime if the OS supports reading
 // GODEBUG early in runtime startup.
 // This should not be changed after it is initialized.
@@ -121,6 +123,14 @@ var S390X struct {
 	_         CacheLinePad
 }
 
+// CPU feature variables are accessed by assembly code in various packages.
+//go:linkname X86
+//go:linkname ARM
+//go:linkname ARM64
+//go:linkname MIPS64X
+//go:linkname PPC64
+//go:linkname S390X
+
 // Initialize examines the processor and sets the relevant variables above.
 // This is called by the runtime package early in program initialization,
 // before normal init functions are run. env is set by runtime if the OS supports
diff --git a/src/internal/runtime/atomic/atomic_386.go b/src/internal/runtime/atomic/atomic_386.go
index e74dcaa92d..a023baddb7 100644
--- a/src/internal/runtime/atomic/atomic_386.go
+++ b/src/internal/runtime/atomic/atomic_386.go
@@ -12,6 +12,7 @@ import "unsafe"
 //
 //go:linkname Load
 //go:linkname Loadp
+//go:linkname LoadAcquintptr
 
 //go:nosplit
 //go:noinline
diff --git a/src/internal/runtime/atomic/atomic_arm.go b/src/internal/runtime/atomic/atomic_arm.go
index 567e951244..b58f643ca3 100644
--- a/src/internal/runtime/atomic/atomic_arm.go
+++ b/src/internal/runtime/atomic/atomic_arm.go
@@ -19,6 +19,7 @@ const (
 //
 //go:linkname Xchg
 //go:linkname Xchguintptr
+//go:linkname Xadd
 
 type spinlock struct {
 	v uint32
diff --git a/src/internal/runtime/atomic/atomic_wasm.go b/src/internal/runtime/atomic/atomic_wasm.go
index 835fc43ccf..d1dcfec7ad 100644
--- a/src/internal/runtime/atomic/atomic_wasm.go
+++ b/src/internal/runtime/atomic/atomic_wasm.go
@@ -13,6 +13,7 @@
 //go:linkname Loadint32
 //go:linkname Loadint64
 //go:linkname Loaduintptr
+//go:linkname LoadAcquintptr
 //go:linkname Xadd
 //go:linkname Xaddint32
 //go:linkname Xaddint64
@@ -33,6 +34,7 @@
 //go:linkname Storeint32
 //go:linkname Storeint64
 //go:linkname Storeuintptr
+//go:linkname StoreReluintptr
 
 package atomic