1 //===- X86.cpp ------------------------------------------------------------===// 2 // 3 // The LLVM Linker 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 10 #include "InputFiles.h" 11 #include "Symbols.h" 12 #include "SyntheticSections.h" 13 #include "Target.h" 14 #include "lld/Common/ErrorHandler.h" 15 #include "llvm/Support/Endian.h" 16 17 using namespace llvm; 18 using namespace llvm::support::endian; 19 using namespace llvm::ELF; 20 using namespace lld; 21 using namespace lld::elf; 22 23 namespace { 24 class X86 : public TargetInfo { 25 public: 26 X86(); 27 RelExpr getRelExpr(RelType Type, const Symbol &S, 28 const uint8_t *Loc) const override; 29 int64_t getImplicitAddend(const uint8_t *Buf, RelType Type) const override; 30 void writeGotPltHeader(uint8_t *Buf) const override; 31 RelType getDynRel(RelType Type) const override; 32 void writeGotPlt(uint8_t *Buf, const Symbol &S) const override; 33 void writeIgotPlt(uint8_t *Buf, const Symbol &S) const override; 34 void writePltHeader(uint8_t *Buf) const override; 35 void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr, 36 int32_t Index, unsigned RelOff) const override; 37 void relocateOne(uint8_t *Loc, RelType Type, uint64_t Val) const override; 38 39 RelExpr adjustRelaxExpr(RelType Type, const uint8_t *Data, 40 RelExpr Expr) const override; 41 void relaxTlsGdToIe(uint8_t *Loc, RelType Type, uint64_t Val) const override; 42 void relaxTlsGdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override; 43 void relaxTlsIeToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override; 44 void relaxTlsLdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override; 45 }; 46 } // namespace 47 48 X86::X86() { 49 CopyRel = R_386_COPY; 50 GotRel = R_386_GLOB_DAT; 51 NoneRel = R_386_NONE; 52 PltRel = R_386_JUMP_SLOT; 53 IRelativeRel = R_386_IRELATIVE; 54 RelativeRel = R_386_RELATIVE; 55 TlsGotRel = R_386_TLS_TPOFF; 56 TlsModuleIndexRel = R_386_TLS_DTPMOD32; 57 TlsOffsetRel = R_386_TLS_DTPOFF32; 58 GotEntrySize = 4; 59 GotPltEntrySize = 4; 60 PltEntrySize = 16; 61 PltHeaderSize = 16; 62 TlsGdRelaxSkip = 2; 63 TrapInstr = 0xcccccccc; // 0xcc = INT3 64 65 // Align to the non-PAE large page size (known as a superpage or huge page). 66 // FreeBSD automatically promotes large, superpage-aligned allocations. 67 DefaultImageBase = 0x400000; 68 } 69 70 static bool hasBaseReg(uint8_t ModRM) { return (ModRM & 0xc7) != 0x5; } 71 72 RelExpr X86::getRelExpr(RelType Type, const Symbol &S, 73 const uint8_t *Loc) const { 74 switch (Type) { 75 case R_386_8: 76 case R_386_16: 77 case R_386_32: 78 case R_386_TLS_LDO_32: 79 return R_ABS; 80 case R_386_TLS_GD: 81 return R_TLSGD_GOT_FROM_END; 82 case R_386_TLS_LDM: 83 return R_TLSLD_GOT_FROM_END; 84 case R_386_PLT32: 85 return R_PLT_PC; 86 case R_386_PC8: 87 case R_386_PC16: 88 case R_386_PC32: 89 return R_PC; 90 case R_386_GOTPC: 91 return R_GOTONLY_PC_FROM_END; 92 case R_386_TLS_IE: 93 return R_GOT; 94 case R_386_GOT32: 95 case R_386_GOT32X: 96 // These relocations are arguably mis-designed because their calculations 97 // depend on the instructions they are applied to. This is bad because we 98 // usually don't care about whether the target section contains valid 99 // machine instructions or not. But this is part of the documented ABI, so 100 // we had to implement as the standard requires. 101 // 102 // x86 does not support PC-relative data access. Therefore, in order to 103 // access GOT contents, a GOT address needs to be known at link-time 104 // (which means non-PIC) or compilers have to emit code to get a GOT 105 // address at runtime (which means code is position-independent but 106 // compilers need to emit extra code for each GOT access.) This decision 107 // is made at compile-time. In the latter case, compilers emit code to 108 // load an GOT address to a register, which is usually %ebx. 109 // 110 // So, there are two ways to refer to symbol foo's GOT entry: foo@GOT or 111 // foo@GOT(%reg). 112 // 113 // foo@GOT is not usable in PIC. If we are creating a PIC output and if we 114 // find such relocation, we should report an error. foo@GOT is resolved to 115 // an *absolute* address of foo's GOT entry, because both GOT address and 116 // foo's offset are known. In other words, it's G + A. 117 // 118 // foo@GOT(%reg) needs to be resolved to a *relative* offset from a GOT to 119 // foo's GOT entry in the table, because GOT address is not known but foo's 120 // offset in the table is known. It's G + A - GOT. 121 // 122 // It's unfortunate that compilers emit the same relocation for these 123 // different use cases. In order to distinguish them, we have to read a 124 // machine instruction. 125 // 126 // The following code implements it. We assume that Loc[0] is the first 127 // byte of a displacement or an immediate field of a valid machine 128 // instruction. That means a ModRM byte is at Loc[-1]. By taking a look at 129 // the byte, we can determine whether the instruction is register-relative 130 // (i.e. it was generated for foo@GOT(%reg)) or absolute (i.e. foo@GOT). 131 return hasBaseReg(Loc[-1]) ? R_GOT_FROM_END : R_GOT; 132 case R_386_TLS_GOTIE: 133 return R_GOT_FROM_END; 134 case R_386_GOTOFF: 135 return R_GOTREL_FROM_END; 136 case R_386_TLS_LE: 137 return R_TLS; 138 case R_386_TLS_LE_32: 139 return R_NEG_TLS; 140 case R_386_NONE: 141 return R_NONE; 142 default: 143 return R_INVALID; 144 } 145 } 146 147 RelExpr X86::adjustRelaxExpr(RelType Type, const uint8_t *Data, 148 RelExpr Expr) const { 149 switch (Expr) { 150 default: 151 return Expr; 152 case R_RELAX_TLS_GD_TO_IE: 153 return R_RELAX_TLS_GD_TO_IE_END; 154 case R_RELAX_TLS_GD_TO_LE: 155 return R_RELAX_TLS_GD_TO_LE_NEG; 156 } 157 } 158 159 void X86::writeGotPltHeader(uint8_t *Buf) const { 160 write32le(Buf, In.Dynamic->getVA()); 161 } 162 163 void X86::writeGotPlt(uint8_t *Buf, const Symbol &S) const { 164 // Entries in .got.plt initially points back to the corresponding 165 // PLT entries with a fixed offset to skip the first instruction. 166 write32le(Buf, S.getPltVA() + 6); 167 } 168 169 void X86::writeIgotPlt(uint8_t *Buf, const Symbol &S) const { 170 // An x86 entry is the address of the ifunc resolver function. 171 write32le(Buf, S.getVA()); 172 } 173 174 RelType X86::getDynRel(RelType Type) const { 175 if (Type == R_386_TLS_LE) 176 return R_386_TLS_TPOFF; 177 if (Type == R_386_TLS_LE_32) 178 return R_386_TLS_TPOFF32; 179 return Type; 180 } 181 182 void X86::writePltHeader(uint8_t *Buf) const { 183 if (Config->Pic) { 184 const uint8_t V[] = { 185 0xff, 0xb3, 0x04, 0x00, 0x00, 0x00, // pushl GOTPLT+4(%ebx) 186 0xff, 0xa3, 0x08, 0x00, 0x00, 0x00, // jmp *GOTPLT+8(%ebx) 187 0x90, 0x90, 0x90, 0x90 // nop 188 }; 189 memcpy(Buf, V, sizeof(V)); 190 191 uint32_t Ebx = In.Got->getVA() + In.Got->getSize(); 192 uint32_t GotPlt = In.GotPlt->getVA() - Ebx; 193 write32le(Buf + 2, GotPlt + 4); 194 write32le(Buf + 8, GotPlt + 8); 195 return; 196 } 197 198 const uint8_t PltData[] = { 199 0xff, 0x35, 0, 0, 0, 0, // pushl (GOTPLT+4) 200 0xff, 0x25, 0, 0, 0, 0, // jmp *(GOTPLT+8) 201 0x90, 0x90, 0x90, 0x90, // nop 202 }; 203 memcpy(Buf, PltData, sizeof(PltData)); 204 uint32_t GotPlt = In.GotPlt->getVA(); 205 write32le(Buf + 2, GotPlt + 4); 206 write32le(Buf + 8, GotPlt + 8); 207 } 208 209 void X86::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, 210 uint64_t PltEntryAddr, int32_t Index, 211 unsigned RelOff) const { 212 const uint8_t Inst[] = { 213 0xff, 0x00, 0, 0, 0, 0, // jmp *foo_in_GOT or jmp *foo@GOT(%ebx) 214 0x68, 0, 0, 0, 0, // pushl $reloc_offset 215 0xe9, 0, 0, 0, 0, // jmp .PLT0@PC 216 }; 217 memcpy(Buf, Inst, sizeof(Inst)); 218 219 if (Config->Pic) { 220 // jmp *foo@GOT(%ebx) 221 uint32_t Ebx = In.Got->getVA() + In.Got->getSize(); 222 Buf[1] = 0xa3; 223 write32le(Buf + 2, GotPltEntryAddr - Ebx); 224 } else { 225 // jmp *foo_in_GOT 226 Buf[1] = 0x25; 227 write32le(Buf + 2, GotPltEntryAddr); 228 } 229 230 write32le(Buf + 7, RelOff); 231 write32le(Buf + 12, -getPltEntryOffset(Index) - 16); 232 } 233 234 int64_t X86::getImplicitAddend(const uint8_t *Buf, RelType Type) const { 235 switch (Type) { 236 case R_386_8: 237 case R_386_PC8: 238 return SignExtend64<8>(*Buf); 239 case R_386_16: 240 case R_386_PC16: 241 return SignExtend64<16>(read16le(Buf)); 242 case R_386_32: 243 case R_386_GOT32: 244 case R_386_GOT32X: 245 case R_386_GOTOFF: 246 case R_386_GOTPC: 247 case R_386_PC32: 248 case R_386_PLT32: 249 case R_386_TLS_LDO_32: 250 case R_386_TLS_LE: 251 return SignExtend64<32>(read32le(Buf)); 252 default: 253 return 0; 254 } 255 } 256 257 void X86::relocateOne(uint8_t *Loc, RelType Type, uint64_t Val) const { 258 switch (Type) { 259 case R_386_8: 260 // R_386_{PC,}{8,16} are not part of the i386 psABI, but they are 261 // being used for some 16-bit programs such as boot loaders, so 262 // we want to support them. 263 checkIntUInt(Loc, Val, 8, Type); 264 *Loc = Val; 265 break; 266 case R_386_PC8: 267 checkInt(Loc, Val, 8, Type); 268 *Loc = Val; 269 break; 270 case R_386_16: 271 checkIntUInt(Loc, Val, 16, Type); 272 write16le(Loc, Val); 273 break; 274 case R_386_PC16: 275 // R_386_PC16 is normally used with 16 bit code. In that situation 276 // the PC is 16 bits, just like the addend. This means that it can 277 // point from any 16 bit address to any other if the possibility 278 // of wrapping is included. 279 // The only restriction we have to check then is that the destination 280 // address fits in 16 bits. That is impossible to do here. The problem is 281 // that we are passed the final value, which already had the 282 // current location subtracted from it. 283 // We just check that Val fits in 17 bits. This misses some cases, but 284 // should have no false positives. 285 checkInt(Loc, Val, 17, Type); 286 write16le(Loc, Val); 287 break; 288 case R_386_32: 289 case R_386_GLOB_DAT: 290 case R_386_GOT32: 291 case R_386_GOT32X: 292 case R_386_GOTOFF: 293 case R_386_GOTPC: 294 case R_386_PC32: 295 case R_386_PLT32: 296 case R_386_RELATIVE: 297 case R_386_TLS_DTPMOD32: 298 case R_386_TLS_DTPOFF32: 299 case R_386_TLS_GD: 300 case R_386_TLS_GOTIE: 301 case R_386_TLS_IE: 302 case R_386_TLS_LDM: 303 case R_386_TLS_LDO_32: 304 case R_386_TLS_LE: 305 case R_386_TLS_LE_32: 306 case R_386_TLS_TPOFF: 307 case R_386_TLS_TPOFF32: 308 checkInt(Loc, Val, 32, Type); 309 write32le(Loc, Val); 310 break; 311 default: 312 error(getErrorLocation(Loc) + "unrecognized reloc " + Twine(Type)); 313 } 314 } 315 316 void X86::relaxTlsGdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const { 317 // Convert 318 // leal x@tlsgd(, %ebx, 1), 319 // call __tls_get_addr@plt 320 // to 321 // movl %gs:0,%eax 322 // subl $x@ntpoff,%eax 323 const uint8_t Inst[] = { 324 0x65, 0xa1, 0x00, 0x00, 0x00, 0x00, // movl %gs:0, %eax 325 0x81, 0xe8, 0, 0, 0, 0, // subl Val(%ebx), %eax 326 }; 327 memcpy(Loc - 3, Inst, sizeof(Inst)); 328 write32le(Loc + 5, Val); 329 } 330 331 void X86::relaxTlsGdToIe(uint8_t *Loc, RelType Type, uint64_t Val) const { 332 // Convert 333 // leal x@tlsgd(, %ebx, 1), 334 // call __tls_get_addr@plt 335 // to 336 // movl %gs:0, %eax 337 // addl x@gotntpoff(%ebx), %eax 338 const uint8_t Inst[] = { 339 0x65, 0xa1, 0x00, 0x00, 0x00, 0x00, // movl %gs:0, %eax 340 0x03, 0x83, 0, 0, 0, 0, // addl Val(%ebx), %eax 341 }; 342 memcpy(Loc - 3, Inst, sizeof(Inst)); 343 write32le(Loc + 5, Val); 344 } 345 346 // In some conditions, relocations can be optimized to avoid using GOT. 347 // This function does that for Initial Exec to Local Exec case. 348 void X86::relaxTlsIeToLe(uint8_t *Loc, RelType Type, uint64_t Val) const { 349 // Ulrich's document section 6.2 says that @gotntpoff can 350 // be used with MOVL or ADDL instructions. 351 // @indntpoff is similar to @gotntpoff, but for use in 352 // position dependent code. 353 uint8_t Reg = (Loc[-1] >> 3) & 7; 354 355 if (Type == R_386_TLS_IE) { 356 if (Loc[-1] == 0xa1) { 357 // "movl foo@indntpoff,%eax" -> "movl $foo,%eax" 358 // This case is different from the generic case below because 359 // this is a 5 byte instruction while below is 6 bytes. 360 Loc[-1] = 0xb8; 361 } else if (Loc[-2] == 0x8b) { 362 // "movl foo@indntpoff,%reg" -> "movl $foo,%reg" 363 Loc[-2] = 0xc7; 364 Loc[-1] = 0xc0 | Reg; 365 } else { 366 // "addl foo@indntpoff,%reg" -> "addl $foo,%reg" 367 Loc[-2] = 0x81; 368 Loc[-1] = 0xc0 | Reg; 369 } 370 } else { 371 assert(Type == R_386_TLS_GOTIE); 372 if (Loc[-2] == 0x8b) { 373 // "movl foo@gottpoff(%rip),%reg" -> "movl $foo,%reg" 374 Loc[-2] = 0xc7; 375 Loc[-1] = 0xc0 | Reg; 376 } else { 377 // "addl foo@gotntpoff(%rip),%reg" -> "leal foo(%reg),%reg" 378 Loc[-2] = 0x8d; 379 Loc[-1] = 0x80 | (Reg << 3) | Reg; 380 } 381 } 382 write32le(Loc, Val); 383 } 384 385 void X86::relaxTlsLdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const { 386 if (Type == R_386_TLS_LDO_32) { 387 write32le(Loc, Val); 388 return; 389 } 390 391 // Convert 392 // leal foo(%reg),%eax 393 // call ___tls_get_addr 394 // to 395 // movl %gs:0,%eax 396 // nop 397 // leal 0(%esi,1),%esi 398 const uint8_t Inst[] = { 399 0x65, 0xa1, 0x00, 0x00, 0x00, 0x00, // movl %gs:0,%eax 400 0x90, // nop 401 0x8d, 0x74, 0x26, 0x00, // leal 0(%esi,1),%esi 402 }; 403 memcpy(Loc - 2, Inst, sizeof(Inst)); 404 } 405 406 namespace { 407 class RetpolinePic : public X86 { 408 public: 409 RetpolinePic(); 410 void writeGotPlt(uint8_t *Buf, const Symbol &S) const override; 411 void writePltHeader(uint8_t *Buf) const override; 412 void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr, 413 int32_t Index, unsigned RelOff) const override; 414 }; 415 416 class RetpolineNoPic : public X86 { 417 public: 418 RetpolineNoPic(); 419 void writeGotPlt(uint8_t *Buf, const Symbol &S) const override; 420 void writePltHeader(uint8_t *Buf) const override; 421 void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr, 422 int32_t Index, unsigned RelOff) const override; 423 }; 424 } // namespace 425 426 RetpolinePic::RetpolinePic() { 427 PltHeaderSize = 48; 428 PltEntrySize = 32; 429 } 430 431 void RetpolinePic::writeGotPlt(uint8_t *Buf, const Symbol &S) const { 432 write32le(Buf, S.getPltVA() + 17); 433 } 434 435 void RetpolinePic::writePltHeader(uint8_t *Buf) const { 436 const uint8_t Insn[] = { 437 0xff, 0xb3, 0, 0, 0, 0, // 0: pushl GOTPLT+4(%ebx) 438 0x50, // 6: pushl %eax 439 0x8b, 0x83, 0, 0, 0, 0, // 7: mov GOTPLT+8(%ebx), %eax 440 0xe8, 0x0e, 0x00, 0x00, 0x00, // d: call next 441 0xf3, 0x90, // 12: loop: pause 442 0x0f, 0xae, 0xe8, // 14: lfence 443 0xeb, 0xf9, // 17: jmp loop 444 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 19: int3; .align 16 445 0x89, 0x0c, 0x24, // 20: next: mov %ecx, (%esp) 446 0x8b, 0x4c, 0x24, 0x04, // 23: mov 0x4(%esp), %ecx 447 0x89, 0x44, 0x24, 0x04, // 27: mov %eax ,0x4(%esp) 448 0x89, 0xc8, // 2b: mov %ecx, %eax 449 0x59, // 2d: pop %ecx 450 0xc3, // 2e: ret 451 0xcc, // 2f: int3; padding 452 }; 453 memcpy(Buf, Insn, sizeof(Insn)); 454 455 uint32_t Ebx = In.Got->getVA() + In.Got->getSize(); 456 uint32_t GotPlt = In.GotPlt->getVA() - Ebx; 457 write32le(Buf + 2, GotPlt + 4); 458 write32le(Buf + 9, GotPlt + 8); 459 } 460 461 void RetpolinePic::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, 462 uint64_t PltEntryAddr, int32_t Index, 463 unsigned RelOff) const { 464 const uint8_t Insn[] = { 465 0x50, // pushl %eax 466 0x8b, 0x83, 0, 0, 0, 0, // mov foo@GOT(%ebx), %eax 467 0xe8, 0, 0, 0, 0, // call plt+0x20 468 0xe9, 0, 0, 0, 0, // jmp plt+0x12 469 0x68, 0, 0, 0, 0, // pushl $reloc_offset 470 0xe9, 0, 0, 0, 0, // jmp plt+0 471 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // int3; padding 472 }; 473 memcpy(Buf, Insn, sizeof(Insn)); 474 475 uint32_t Ebx = In.Got->getVA() + In.Got->getSize(); 476 unsigned Off = getPltEntryOffset(Index); 477 write32le(Buf + 3, GotPltEntryAddr - Ebx); 478 write32le(Buf + 8, -Off - 12 + 32); 479 write32le(Buf + 13, -Off - 17 + 18); 480 write32le(Buf + 18, RelOff); 481 write32le(Buf + 23, -Off - 27); 482 } 483 484 RetpolineNoPic::RetpolineNoPic() { 485 PltHeaderSize = 48; 486 PltEntrySize = 32; 487 } 488 489 void RetpolineNoPic::writeGotPlt(uint8_t *Buf, const Symbol &S) const { 490 write32le(Buf, S.getPltVA() + 16); 491 } 492 493 void RetpolineNoPic::writePltHeader(uint8_t *Buf) const { 494 const uint8_t Insn[] = { 495 0xff, 0x35, 0, 0, 0, 0, // 0: pushl GOTPLT+4 496 0x50, // 6: pushl %eax 497 0xa1, 0, 0, 0, 0, // 7: mov GOTPLT+8, %eax 498 0xe8, 0x0f, 0x00, 0x00, 0x00, // c: call next 499 0xf3, 0x90, // 11: loop: pause 500 0x0f, 0xae, 0xe8, // 13: lfence 501 0xeb, 0xf9, // 16: jmp loop 502 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 18: int3 503 0xcc, 0xcc, 0xcc, // 1f: int3; .align 16 504 0x89, 0x0c, 0x24, // 20: next: mov %ecx, (%esp) 505 0x8b, 0x4c, 0x24, 0x04, // 23: mov 0x4(%esp), %ecx 506 0x89, 0x44, 0x24, 0x04, // 27: mov %eax ,0x4(%esp) 507 0x89, 0xc8, // 2b: mov %ecx, %eax 508 0x59, // 2d: pop %ecx 509 0xc3, // 2e: ret 510 0xcc, // 2f: int3; padding 511 }; 512 memcpy(Buf, Insn, sizeof(Insn)); 513 514 uint32_t GotPlt = In.GotPlt->getVA(); 515 write32le(Buf + 2, GotPlt + 4); 516 write32le(Buf + 8, GotPlt + 8); 517 } 518 519 void RetpolineNoPic::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, 520 uint64_t PltEntryAddr, int32_t Index, 521 unsigned RelOff) const { 522 const uint8_t Insn[] = { 523 0x50, // 0: pushl %eax 524 0xa1, 0, 0, 0, 0, // 1: mov foo_in_GOT, %eax 525 0xe8, 0, 0, 0, 0, // 6: call plt+0x20 526 0xe9, 0, 0, 0, 0, // b: jmp plt+0x11 527 0x68, 0, 0, 0, 0, // 10: pushl $reloc_offset 528 0xe9, 0, 0, 0, 0, // 15: jmp plt+0 529 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1a: int3; padding 530 0xcc, // 1f: int3; padding 531 }; 532 memcpy(Buf, Insn, sizeof(Insn)); 533 534 unsigned Off = getPltEntryOffset(Index); 535 write32le(Buf + 2, GotPltEntryAddr); 536 write32le(Buf + 7, -Off - 11 + 32); 537 write32le(Buf + 12, -Off - 16 + 17); 538 write32le(Buf + 17, RelOff); 539 write32le(Buf + 22, -Off - 26); 540 } 541 542 TargetInfo *elf::getX86TargetInfo() { 543 if (Config->ZRetpolineplt) { 544 if (Config->Pic) { 545 static RetpolinePic T; 546 return &T; 547 } 548 static RetpolineNoPic T; 549 return &T; 550 } 551 552 static X86 T; 553 return &T; 554 } 555