1 //===- AArch64.cpp --------------------------------------------------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 9 #include "Symbols.h" 10 #include "SyntheticSections.h" 11 #include "Target.h" 12 #include "Thunks.h" 13 #include "lld/Common/ErrorHandler.h" 14 #include "llvm/Object/ELF.h" 15 #include "llvm/Support/Endian.h" 16 17 using namespace llvm; 18 using namespace llvm::support::endian; 19 using namespace llvm::ELF; 20 using namespace lld; 21 using namespace lld::elf; 22 23 // Page(Expr) is the page address of the expression Expr, defined 24 // as (Expr & ~0xFFF). (This applies even if the machine page size 25 // supported by the platform has a different value.) 26 uint64_t elf::getAArch64Page(uint64_t Expr) { 27 return Expr & ~static_cast<uint64_t>(0xFFF); 28 } 29 30 namespace { 31 class AArch64 : public TargetInfo { 32 public: 33 AArch64(); 34 RelExpr getRelExpr(RelType Type, const Symbol &S, 35 const uint8_t *Loc) const override; 36 RelType getDynRel(RelType Type) const override; 37 void writeGotPlt(uint8_t *Buf, const Symbol &S) const override; 38 void writePltHeader(uint8_t *Buf) const override; 39 void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr, 40 int32_t Index, unsigned RelOff) const override; 41 bool needsThunk(RelExpr Expr, RelType Type, const InputFile *File, 42 uint64_t BranchAddr, const Symbol &S) const override; 43 uint32_t getThunkSectionSpacing() const override; 44 bool inBranchRange(RelType Type, uint64_t Src, uint64_t Dst) const override; 45 bool usesOnlyLowPageBits(RelType Type) const override; 46 void relocateOne(uint8_t *Loc, RelType Type, uint64_t Val) const override; 47 RelExpr adjustRelaxExpr(RelType Type, const uint8_t *Data, 48 RelExpr Expr) const override; 49 void relaxTlsGdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override; 50 void relaxTlsGdToIe(uint8_t *Loc, RelType Type, uint64_t Val) const override; 51 void relaxTlsIeToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override; 52 }; 53 } // namespace 54 55 AArch64::AArch64() { 56 CopyRel = R_AARCH64_COPY; 57 RelativeRel = R_AARCH64_RELATIVE; 58 IRelativeRel = R_AARCH64_IRELATIVE; 59 GotRel = R_AARCH64_GLOB_DAT; 60 NoneRel = R_AARCH64_NONE; 61 PltRel = R_AARCH64_JUMP_SLOT; 62 SymbolicRel = R_AARCH64_ABS64; 63 TlsDescRel = R_AARCH64_TLSDESC; 64 TlsGotRel = R_AARCH64_TLS_TPREL64; 65 PltEntrySize = 16; 66 PltHeaderSize = 32; 67 DefaultMaxPageSize = 65536; 68 69 // Align to the 2 MiB page size (known as a superpage or huge page). 70 // FreeBSD automatically promotes 2 MiB-aligned allocations. 71 DefaultImageBase = 0x200000; 72 73 NeedsThunks = true; 74 } 75 76 RelExpr AArch64::getRelExpr(RelType Type, const Symbol &S, 77 const uint8_t *Loc) const { 78 switch (Type) { 79 case R_AARCH64_TLSDESC_ADR_PAGE21: 80 return R_AARCH64_TLSDESC_PAGE; 81 case R_AARCH64_TLSDESC_LD64_LO12: 82 case R_AARCH64_TLSDESC_ADD_LO12: 83 return R_TLSDESC; 84 case R_AARCH64_TLSDESC_CALL: 85 return R_TLSDESC_CALL; 86 case R_AARCH64_TLSLE_ADD_TPREL_HI12: 87 case R_AARCH64_TLSLE_ADD_TPREL_LO12_NC: 88 case R_AARCH64_TLSLE_LDST8_TPREL_LO12_NC: 89 case R_AARCH64_TLSLE_LDST16_TPREL_LO12_NC: 90 case R_AARCH64_TLSLE_LDST32_TPREL_LO12_NC: 91 case R_AARCH64_TLSLE_LDST64_TPREL_LO12_NC: 92 case R_AARCH64_TLSLE_LDST128_TPREL_LO12_NC: 93 return R_TLS; 94 case R_AARCH64_CALL26: 95 case R_AARCH64_CONDBR19: 96 case R_AARCH64_JUMP26: 97 case R_AARCH64_TSTBR14: 98 return R_PLT_PC; 99 case R_AARCH64_PREL16: 100 case R_AARCH64_PREL32: 101 case R_AARCH64_PREL64: 102 case R_AARCH64_ADR_PREL_LO21: 103 case R_AARCH64_LD_PREL_LO19: 104 return R_PC; 105 case R_AARCH64_ADR_PREL_PG_HI21: 106 return R_AARCH64_PAGE_PC; 107 case R_AARCH64_LD64_GOT_LO12_NC: 108 case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC: 109 return R_GOT; 110 case R_AARCH64_ADR_GOT_PAGE: 111 case R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21: 112 return R_AARCH64_GOT_PAGE_PC; 113 case R_AARCH64_NONE: 114 return R_NONE; 115 default: 116 return R_ABS; 117 } 118 } 119 120 RelExpr AArch64::adjustRelaxExpr(RelType Type, const uint8_t *Data, 121 RelExpr Expr) const { 122 if (Expr == R_RELAX_TLS_GD_TO_IE) { 123 if (Type == R_AARCH64_TLSDESC_ADR_PAGE21) 124 return R_AARCH64_RELAX_TLS_GD_TO_IE_PAGE_PC; 125 return R_RELAX_TLS_GD_TO_IE_ABS; 126 } 127 return Expr; 128 } 129 130 bool AArch64::usesOnlyLowPageBits(RelType Type) const { 131 switch (Type) { 132 default: 133 return false; 134 case R_AARCH64_ADD_ABS_LO12_NC: 135 case R_AARCH64_LD64_GOT_LO12_NC: 136 case R_AARCH64_LDST128_ABS_LO12_NC: 137 case R_AARCH64_LDST16_ABS_LO12_NC: 138 case R_AARCH64_LDST32_ABS_LO12_NC: 139 case R_AARCH64_LDST64_ABS_LO12_NC: 140 case R_AARCH64_LDST8_ABS_LO12_NC: 141 case R_AARCH64_TLSDESC_ADD_LO12: 142 case R_AARCH64_TLSDESC_LD64_LO12: 143 case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC: 144 return true; 145 } 146 } 147 148 RelType AArch64::getDynRel(RelType Type) const { 149 if (Type == R_AARCH64_ABS64) 150 return Type; 151 return R_AARCH64_NONE; 152 } 153 154 void AArch64::writeGotPlt(uint8_t *Buf, const Symbol &) const { 155 write64le(Buf, In.Plt->getVA()); 156 } 157 158 void AArch64::writePltHeader(uint8_t *Buf) const { 159 const uint8_t PltData[] = { 160 0xf0, 0x7b, 0xbf, 0xa9, // stp x16, x30, [sp,#-16]! 161 0x10, 0x00, 0x00, 0x90, // adrp x16, Page(&(.plt.got[2])) 162 0x11, 0x02, 0x40, 0xf9, // ldr x17, [x16, Offset(&(.plt.got[2]))] 163 0x10, 0x02, 0x00, 0x91, // add x16, x16, Offset(&(.plt.got[2])) 164 0x20, 0x02, 0x1f, 0xd6, // br x17 165 0x1f, 0x20, 0x03, 0xd5, // nop 166 0x1f, 0x20, 0x03, 0xd5, // nop 167 0x1f, 0x20, 0x03, 0xd5 // nop 168 }; 169 memcpy(Buf, PltData, sizeof(PltData)); 170 171 uint64_t Got = In.GotPlt->getVA(); 172 uint64_t Plt = In.Plt->getVA(); 173 relocateOne(Buf + 4, R_AARCH64_ADR_PREL_PG_HI21, 174 getAArch64Page(Got + 16) - getAArch64Page(Plt + 4)); 175 relocateOne(Buf + 8, R_AARCH64_LDST64_ABS_LO12_NC, Got + 16); 176 relocateOne(Buf + 12, R_AARCH64_ADD_ABS_LO12_NC, Got + 16); 177 } 178 179 void AArch64::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, 180 uint64_t PltEntryAddr, int32_t Index, 181 unsigned RelOff) const { 182 const uint8_t Inst[] = { 183 0x10, 0x00, 0x00, 0x90, // adrp x16, Page(&(.plt.got[n])) 184 0x11, 0x02, 0x40, 0xf9, // ldr x17, [x16, Offset(&(.plt.got[n]))] 185 0x10, 0x02, 0x00, 0x91, // add x16, x16, Offset(&(.plt.got[n])) 186 0x20, 0x02, 0x1f, 0xd6 // br x17 187 }; 188 memcpy(Buf, Inst, sizeof(Inst)); 189 190 relocateOne(Buf, R_AARCH64_ADR_PREL_PG_HI21, 191 getAArch64Page(GotPltEntryAddr) - getAArch64Page(PltEntryAddr)); 192 relocateOne(Buf + 4, R_AARCH64_LDST64_ABS_LO12_NC, GotPltEntryAddr); 193 relocateOne(Buf + 8, R_AARCH64_ADD_ABS_LO12_NC, GotPltEntryAddr); 194 } 195 196 bool AArch64::needsThunk(RelExpr Expr, RelType Type, const InputFile *File, 197 uint64_t BranchAddr, const Symbol &S) const { 198 // ELF for the ARM 64-bit architecture, section Call and Jump relocations 199 // only permits range extension thunks for R_AARCH64_CALL26 and 200 // R_AARCH64_JUMP26 relocation types. 201 if (Type != R_AARCH64_CALL26 && Type != R_AARCH64_JUMP26) 202 return false; 203 uint64_t Dst = (Expr == R_PLT_PC) ? S.getPltVA() : S.getVA(); 204 return !inBranchRange(Type, BranchAddr, Dst); 205 } 206 207 uint32_t AArch64::getThunkSectionSpacing() const { 208 // See comment in Arch/ARM.cpp for a more detailed explanation of 209 // getThunkSectionSpacing(). For AArch64 the only branches we are permitted to 210 // Thunk have a range of +/- 128 MiB 211 return (128 * 1024 * 1024) - 0x30000; 212 } 213 214 bool AArch64::inBranchRange(RelType Type, uint64_t Src, uint64_t Dst) const { 215 if (Type != R_AARCH64_CALL26 && Type != R_AARCH64_JUMP26) 216 return true; 217 // The AArch64 call and unconditional branch instructions have a range of 218 // +/- 128 MiB. 219 uint64_t Range = 128 * 1024 * 1024; 220 if (Dst > Src) { 221 // Immediate of branch is signed. 222 Range -= 4; 223 return Dst - Src <= Range; 224 } 225 return Src - Dst <= Range; 226 } 227 228 static void write32AArch64Addr(uint8_t *L, uint64_t Imm) { 229 uint32_t ImmLo = (Imm & 0x3) << 29; 230 uint32_t ImmHi = (Imm & 0x1FFFFC) << 3; 231 uint64_t Mask = (0x3 << 29) | (0x1FFFFC << 3); 232 write32le(L, (read32le(L) & ~Mask) | ImmLo | ImmHi); 233 } 234 235 // Return the bits [Start, End] from Val shifted Start bits. 236 // For instance, getBits(0xF0, 4, 8) returns 0xF. 237 static uint64_t getBits(uint64_t Val, int Start, int End) { 238 uint64_t Mask = ((uint64_t)1 << (End + 1 - Start)) - 1; 239 return (Val >> Start) & Mask; 240 } 241 242 static void or32le(uint8_t *P, int32_t V) { write32le(P, read32le(P) | V); } 243 244 // Update the immediate field in a AARCH64 ldr, str, and add instruction. 245 static void or32AArch64Imm(uint8_t *L, uint64_t Imm) { 246 or32le(L, (Imm & 0xFFF) << 10); 247 } 248 249 void AArch64::relocateOne(uint8_t *Loc, RelType Type, uint64_t Val) const { 250 switch (Type) { 251 case R_AARCH64_ABS16: 252 case R_AARCH64_PREL16: 253 checkIntUInt(Loc, Val, 16, Type); 254 write16le(Loc, Val); 255 break; 256 case R_AARCH64_ABS32: 257 case R_AARCH64_PREL32: 258 checkIntUInt(Loc, Val, 32, Type); 259 write32le(Loc, Val); 260 break; 261 case R_AARCH64_ABS64: 262 case R_AARCH64_PREL64: 263 write64le(Loc, Val); 264 break; 265 case R_AARCH64_ADD_ABS_LO12_NC: 266 or32AArch64Imm(Loc, Val); 267 break; 268 case R_AARCH64_ADR_GOT_PAGE: 269 case R_AARCH64_ADR_PREL_PG_HI21: 270 case R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21: 271 case R_AARCH64_TLSDESC_ADR_PAGE21: 272 checkInt(Loc, Val, 33, Type); 273 write32AArch64Addr(Loc, Val >> 12); 274 break; 275 case R_AARCH64_ADR_PREL_LO21: 276 checkInt(Loc, Val, 21, Type); 277 write32AArch64Addr(Loc, Val); 278 break; 279 case R_AARCH64_JUMP26: 280 // Normally we would just write the bits of the immediate field, however 281 // when patching instructions for the cpu errata fix -fix-cortex-a53-843419 282 // we want to replace a non-branch instruction with a branch immediate 283 // instruction. By writing all the bits of the instruction including the 284 // opcode and the immediate (0 001 | 01 imm26) we can do this 285 // transformation by placing a R_AARCH64_JUMP26 relocation at the offset of 286 // the instruction we want to patch. 287 write32le(Loc, 0x14000000); 288 LLVM_FALLTHROUGH; 289 case R_AARCH64_CALL26: 290 checkInt(Loc, Val, 28, Type); 291 or32le(Loc, (Val & 0x0FFFFFFC) >> 2); 292 break; 293 case R_AARCH64_CONDBR19: 294 case R_AARCH64_LD_PREL_LO19: 295 checkAlignment(Loc, Val, 4, Type); 296 checkInt(Loc, Val, 21, Type); 297 or32le(Loc, (Val & 0x1FFFFC) << 3); 298 break; 299 case R_AARCH64_LDST8_ABS_LO12_NC: 300 case R_AARCH64_TLSLE_LDST8_TPREL_LO12_NC: 301 or32AArch64Imm(Loc, getBits(Val, 0, 11)); 302 break; 303 case R_AARCH64_LDST16_ABS_LO12_NC: 304 case R_AARCH64_TLSLE_LDST16_TPREL_LO12_NC: 305 checkAlignment(Loc, Val, 2, Type); 306 or32AArch64Imm(Loc, getBits(Val, 1, 11)); 307 break; 308 case R_AARCH64_LDST32_ABS_LO12_NC: 309 case R_AARCH64_TLSLE_LDST32_TPREL_LO12_NC: 310 checkAlignment(Loc, Val, 4, Type); 311 or32AArch64Imm(Loc, getBits(Val, 2, 11)); 312 break; 313 case R_AARCH64_LDST64_ABS_LO12_NC: 314 case R_AARCH64_LD64_GOT_LO12_NC: 315 case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC: 316 case R_AARCH64_TLSLE_LDST64_TPREL_LO12_NC: 317 case R_AARCH64_TLSDESC_LD64_LO12: 318 checkAlignment(Loc, Val, 8, Type); 319 or32AArch64Imm(Loc, getBits(Val, 3, 11)); 320 break; 321 case R_AARCH64_LDST128_ABS_LO12_NC: 322 case R_AARCH64_TLSLE_LDST128_TPREL_LO12_NC: 323 checkAlignment(Loc, Val, 16, Type); 324 or32AArch64Imm(Loc, getBits(Val, 4, 11)); 325 break; 326 case R_AARCH64_MOVW_UABS_G0_NC: 327 or32le(Loc, (Val & 0xFFFF) << 5); 328 break; 329 case R_AARCH64_MOVW_UABS_G1_NC: 330 or32le(Loc, (Val & 0xFFFF0000) >> 11); 331 break; 332 case R_AARCH64_MOVW_UABS_G2_NC: 333 or32le(Loc, (Val & 0xFFFF00000000) >> 27); 334 break; 335 case R_AARCH64_MOVW_UABS_G3: 336 or32le(Loc, (Val & 0xFFFF000000000000) >> 43); 337 break; 338 case R_AARCH64_TSTBR14: 339 checkInt(Loc, Val, 16, Type); 340 or32le(Loc, (Val & 0xFFFC) << 3); 341 break; 342 case R_AARCH64_TLSLE_ADD_TPREL_HI12: 343 checkUInt(Loc, Val, 24, Type); 344 or32AArch64Imm(Loc, Val >> 12); 345 break; 346 case R_AARCH64_TLSLE_ADD_TPREL_LO12_NC: 347 case R_AARCH64_TLSDESC_ADD_LO12: 348 or32AArch64Imm(Loc, Val); 349 break; 350 default: 351 error(getErrorLocation(Loc) + "unrecognized relocation " + toString(Type)); 352 } 353 } 354 355 void AArch64::relaxTlsGdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const { 356 // TLSDESC Global-Dynamic relocation are in the form: 357 // adrp x0, :tlsdesc:v [R_AARCH64_TLSDESC_ADR_PAGE21] 358 // ldr x1, [x0, #:tlsdesc_lo12:v [R_AARCH64_TLSDESC_LD64_LO12] 359 // add x0, x0, :tlsdesc_los:v [R_AARCH64_TLSDESC_ADD_LO12] 360 // .tlsdesccall [R_AARCH64_TLSDESC_CALL] 361 // blr x1 362 // And it can optimized to: 363 // movz x0, #0x0, lsl #16 364 // movk x0, #0x10 365 // nop 366 // nop 367 checkUInt(Loc, Val, 32, Type); 368 369 switch (Type) { 370 case R_AARCH64_TLSDESC_ADD_LO12: 371 case R_AARCH64_TLSDESC_CALL: 372 write32le(Loc, 0xd503201f); // nop 373 return; 374 case R_AARCH64_TLSDESC_ADR_PAGE21: 375 write32le(Loc, 0xd2a00000 | (((Val >> 16) & 0xffff) << 5)); // movz 376 return; 377 case R_AARCH64_TLSDESC_LD64_LO12: 378 write32le(Loc, 0xf2800000 | ((Val & 0xffff) << 5)); // movk 379 return; 380 default: 381 llvm_unreachable("unsupported relocation for TLS GD to LE relaxation"); 382 } 383 } 384 385 void AArch64::relaxTlsGdToIe(uint8_t *Loc, RelType Type, uint64_t Val) const { 386 // TLSDESC Global-Dynamic relocation are in the form: 387 // adrp x0, :tlsdesc:v [R_AARCH64_TLSDESC_ADR_PAGE21] 388 // ldr x1, [x0, #:tlsdesc_lo12:v [R_AARCH64_TLSDESC_LD64_LO12] 389 // add x0, x0, :tlsdesc_los:v [R_AARCH64_TLSDESC_ADD_LO12] 390 // .tlsdesccall [R_AARCH64_TLSDESC_CALL] 391 // blr x1 392 // And it can optimized to: 393 // adrp x0, :gottprel:v 394 // ldr x0, [x0, :gottprel_lo12:v] 395 // nop 396 // nop 397 398 switch (Type) { 399 case R_AARCH64_TLSDESC_ADD_LO12: 400 case R_AARCH64_TLSDESC_CALL: 401 write32le(Loc, 0xd503201f); // nop 402 break; 403 case R_AARCH64_TLSDESC_ADR_PAGE21: 404 write32le(Loc, 0x90000000); // adrp 405 relocateOne(Loc, R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21, Val); 406 break; 407 case R_AARCH64_TLSDESC_LD64_LO12: 408 write32le(Loc, 0xf9400000); // ldr 409 relocateOne(Loc, R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC, Val); 410 break; 411 default: 412 llvm_unreachable("unsupported relocation for TLS GD to LE relaxation"); 413 } 414 } 415 416 void AArch64::relaxTlsIeToLe(uint8_t *Loc, RelType Type, uint64_t Val) const { 417 checkUInt(Loc, Val, 32, Type); 418 419 if (Type == R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21) { 420 // Generate MOVZ. 421 uint32_t RegNo = read32le(Loc) & 0x1f; 422 write32le(Loc, (0xd2a00000 | RegNo) | (((Val >> 16) & 0xffff) << 5)); 423 return; 424 } 425 if (Type == R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC) { 426 // Generate MOVK. 427 uint32_t RegNo = read32le(Loc) & 0x1f; 428 write32le(Loc, (0xf2800000 | RegNo) | ((Val & 0xffff) << 5)); 429 return; 430 } 431 llvm_unreachable("invalid relocation for TLS IE to LE relaxation"); 432 } 433 434 // AArch64 may use security features in variant PLT sequences. These are: 435 // Pointer Authentication (PAC), introduced in armv8.3-a and Branch Target 436 // Indicator (BTI) introduced in armv8.5-a. The additional instructions used 437 // in the variant Plt sequences are encoded in the Hint space so they can be 438 // deployed on older architectures, which treat the instructions as a nop. 439 // PAC and BTI can be combined leading to the following combinations: 440 // writePltHeader 441 // writePltHeaderBti (no PAC Header needed) 442 // writePlt 443 // writePltBti (BTI only) 444 // writePltPac (PAC only) 445 // writePltBtiPac (BTI and PAC) 446 // 447 // When PAC is enabled the dynamic loader encrypts the address that it places 448 // in the .got.plt using the pacia1716 instruction which encrypts the value in 449 // x17 using the modifier in x16. The static linker places autia1716 before the 450 // indirect branch to x17 to authenticate the address in x17 with the modifier 451 // in x16. This makes it more difficult for an attacker to modify the value in 452 // the .got.plt. 453 // 454 // When BTI is enabled all indirect branches must land on a bti instruction. 455 // The static linker must place a bti instruction at the start of any PLT entry 456 // that may be the target of an indirect branch. As the PLT entries call the 457 // lazy resolver indirectly this must have a bti instruction at start. In 458 // general a bti instruction is not needed for a PLT entry as indirect calls 459 // are resolved to the function address and not the PLT entry for the function. 460 // There are a small number of cases where the PLT address can escape, such as 461 // taking the address of a function or ifunc via a non got-generating 462 // relocation, and a shared library refers to that symbol. 463 // 464 // We use the bti c variant of the instruction which permits indirect branches 465 // (br) via x16/x17 and indirect function calls (blr) via any register. The ABI 466 // guarantees that all indirect branches from code requiring BTI protection 467 // will go via x16/x17 468 469 namespace { 470 class AArch64BtiPac final : public AArch64 { 471 public: 472 AArch64BtiPac(); 473 void writePltHeader(uint8_t *Buf) const override; 474 void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr, 475 int32_t Index, unsigned RelOff) const override; 476 477 private: 478 bool BtiHeader; // bti instruction needed in PLT Header 479 bool BtiEntry; // bti instruction needed in PLT Entry 480 bool PacEntry; // autia1716 instruction needed in PLT Entry 481 }; 482 } // namespace 483 484 AArch64BtiPac::AArch64BtiPac() { 485 BtiHeader = (Config->AndFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_BTI); 486 // A BTI (Branch Target Indicator) Plt Entry is only required if the 487 // address of the PLT entry can be taken by the program, which permits an 488 // indirect jump to the PLT entry. This can happen when the address 489 // of the PLT entry for a function is canonicalised due to the address of 490 // the function in an executable being taken by a shared library. 491 // FIXME: There is a potential optimization to omit the BTI if we detect 492 // that the address of the PLT entry isn't taken. 493 BtiEntry = BtiHeader && !Config->Shared; 494 PacEntry = (Config->AndFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_PAC); 495 496 if (BtiEntry || PacEntry) 497 PltEntrySize = 24; 498 } 499 500 void AArch64BtiPac::writePltHeader(uint8_t *Buf) const { 501 const uint8_t BtiData[] = { 0x5f, 0x24, 0x03, 0xd5 }; // bti c 502 const uint8_t PltData[] = { 503 0xf0, 0x7b, 0xbf, 0xa9, // stp x16, x30, [sp,#-16]! 504 0x10, 0x00, 0x00, 0x90, // adrp x16, Page(&(.plt.got[2])) 505 0x11, 0x02, 0x40, 0xf9, // ldr x17, [x16, Offset(&(.plt.got[2]))] 506 0x10, 0x02, 0x00, 0x91, // add x16, x16, Offset(&(.plt.got[2])) 507 0x20, 0x02, 0x1f, 0xd6, // br x17 508 0x1f, 0x20, 0x03, 0xd5, // nop 509 0x1f, 0x20, 0x03, 0xd5 // nop 510 }; 511 const uint8_t NopData[] = { 0x1f, 0x20, 0x03, 0xd5 }; // nop 512 513 uint64_t Got = In.GotPlt->getVA(); 514 uint64_t Plt = In.Plt->getVA(); 515 516 if (BtiHeader) { 517 // PltHeader is called indirectly by Plt[N]. Prefix PltData with a BTI C 518 // instruction. 519 memcpy(Buf, BtiData, sizeof(BtiData)); 520 Buf += sizeof(BtiData); 521 Plt += sizeof(BtiData); 522 } 523 memcpy(Buf, PltData, sizeof(PltData)); 524 525 relocateOne(Buf + 4, R_AARCH64_ADR_PREL_PG_HI21, 526 getAArch64Page(Got + 16) - getAArch64Page(Plt + 8)); 527 relocateOne(Buf + 8, R_AARCH64_LDST64_ABS_LO12_NC, Got + 16); 528 relocateOne(Buf + 12, R_AARCH64_ADD_ABS_LO12_NC, Got + 16); 529 if (!BtiHeader) 530 // We didn't add the BTI c instruction so round out size with NOP. 531 memcpy(Buf + sizeof(PltData), NopData, sizeof(NopData)); 532 } 533 534 void AArch64BtiPac::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, 535 uint64_t PltEntryAddr, int32_t Index, 536 unsigned RelOff) const { 537 // The PLT entry is of the form: 538 // [BtiData] AddrInst (PacBr | StdBr) [NopData] 539 const uint8_t BtiData[] = { 0x5f, 0x24, 0x03, 0xd5 }; // bti c 540 const uint8_t AddrInst[] = { 541 0x10, 0x00, 0x00, 0x90, // adrp x16, Page(&(.plt.got[n])) 542 0x11, 0x02, 0x40, 0xf9, // ldr x17, [x16, Offset(&(.plt.got[n]))] 543 0x10, 0x02, 0x00, 0x91 // add x16, x16, Offset(&(.plt.got[n])) 544 }; 545 const uint8_t PacBr[] = { 546 0x9f, 0x21, 0x03, 0xd5, // autia1716 547 0x20, 0x02, 0x1f, 0xd6 // br x17 548 }; 549 const uint8_t StdBr[] = { 550 0x20, 0x02, 0x1f, 0xd6, // br x17 551 0x1f, 0x20, 0x03, 0xd5 // nop 552 }; 553 const uint8_t NopData[] = { 0x1f, 0x20, 0x03, 0xd5 }; // nop 554 555 if (BtiEntry) { 556 memcpy(Buf, BtiData, sizeof(BtiData)); 557 Buf += sizeof(BtiData); 558 PltEntryAddr += sizeof(BtiData); 559 } 560 561 memcpy(Buf, AddrInst, sizeof(AddrInst)); 562 relocateOne(Buf, R_AARCH64_ADR_PREL_PG_HI21, 563 getAArch64Page(GotPltEntryAddr) - 564 getAArch64Page(PltEntryAddr)); 565 relocateOne(Buf + 4, R_AARCH64_LDST64_ABS_LO12_NC, GotPltEntryAddr); 566 relocateOne(Buf + 8, R_AARCH64_ADD_ABS_LO12_NC, GotPltEntryAddr); 567 568 if (PacEntry) 569 memcpy(Buf + sizeof(AddrInst), PacBr, sizeof(PacBr)); 570 else 571 memcpy(Buf + sizeof(AddrInst), StdBr, sizeof(StdBr)); 572 if (!BtiEntry) 573 // We didn't add the BTI c instruction so round out size with NOP. 574 memcpy(Buf + sizeof(AddrInst) + sizeof(StdBr), NopData, sizeof(NopData)); 575 } 576 577 static TargetInfo *getTargetInfo() { 578 if (Config->AndFeatures & (GNU_PROPERTY_AARCH64_FEATURE_1_BTI | 579 GNU_PROPERTY_AARCH64_FEATURE_1_PAC)) { 580 static AArch64BtiPac T; 581 return &T; 582 } 583 static AArch64 T; 584 return &T; 585 } 586 587 TargetInfo *elf::getAArch64TargetInfo() { return getTargetInfo(); } 588