[PATCH 1/3] winebuild: Added support for entry points generated in runtime.

[Jacek Caban]

On 01/19/16 13:29, Alexandre Julliard wrote:
> Sebastian Lackner <sebastian at fds-team.de> writes:
>
>> @ Alexandre: Do you have a preferrence? Suggestions we had so far:
>>
>> - JIT compilation of thunks (only x86)
>> - Winebuild generated static thunks (see http://ix.io/nxT )
>> - Macro-generated thunks (see staging repo)
>>
>> To my knowledge, all have the same limitations: x86, non-wow64 and race-conditions when
>> forwarding Ldr* functions through the syscall thunks.
> As long as we have these limitations, I don't feel like committing any
> of them. I'm not convinced that there's a reasonable way to make that
> sort of thing work, and maintaining a complex piece of code that doesn't
> truly solve the problem isn't very appealing. Has anybody tried
> submitting a patch to Chrome to disable the sandbox under Wine?

Are you suggesting disabling the whole sandbox on Wine? How about
something less radical? There are a few things that we could try to
change in Chrome that would still require changes in Wine, but would
give us a working sandboxing and wouldn't have to be Wine-specific (at
least not in an explicit way). A few ideas would be:

- Make checks less strict.
If checks for sysenter would be removed or changed to allow some sort of
regular call, it would allow us to implement problematic calls in Wine.
That would be a trivial change in Chome, making it more likely that they
would take it.

- Change code inspecting functions to try to match all known function
bodies instead of expecting exactly one of them depending on Windows
version.
With this change, implementing one variant in Wine would solve the
problem for us and we wouldn't need win8 and wow64 variants (although it
wouldn't be enough for 64-bit).

- Recognize hotpatchable functions in Chrome as valid syscalls
This should be easy to do on their side and we can easily make all Nt*
calls in Wine hotpatchable. Sadly, we don't have support for this on Mac
(and clang in general) and 64-bit yet, but that would mostly increase
importance of an already existing problem.

All such solutions require changes in both Chrome and Wine, which makes
it tricky to decide on a solution. What's your opinion?

Thanks,
Jacek