1 //===- X86_64.cpp ---------------------------------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8
9 #include "OutputSections.h"
10 #include "Symbols.h"
11 #include "SyntheticSections.h"
12 #include "Target.h"
13 #include "lld/Common/ErrorHandler.h"
14 #include "llvm/BinaryFormat/ELF.h"
15 #include "llvm/Support/Endian.h"
16
17 using namespace llvm;
18 using namespace llvm::object;
19 using namespace llvm::support::endian;
20 using namespace llvm::ELF;
21 using namespace lld;
22 using namespace lld::elf;
23
24 namespace {
25 class X86_64 : public TargetInfo {
26 public:
27 X86_64();
28 int getTlsGdRelaxSkip(RelType type) const override;
29 RelExpr getRelExpr(RelType type, const Symbol &s,
30 const uint8_t *loc) const override;
31 RelType getDynRel(RelType type) const override;
32 void writeGotPltHeader(uint8_t *buf) const override;
33 void writeGotPlt(uint8_t *buf, const Symbol &s) const override;
34 void writeIgotPlt(uint8_t *buf, const Symbol &s) const override;
35 void writePltHeader(uint8_t *buf) const override;
36 void writePlt(uint8_t *buf, const Symbol &sym,
37 uint64_t pltEntryAddr) const override;
38 void relocate(uint8_t *loc, const Relocation &rel,
39 uint64_t val) const override;
40 int64_t getImplicitAddend(const uint8_t *buf, RelType type) const override;
41 void applyJumpInstrMod(uint8_t *loc, JumpModType type,
42 unsigned size) const override;
43
44 RelExpr adjustGotPcExpr(RelType type, int64_t addend,
45 const uint8_t *loc) const override;
46 void relaxGot(uint8_t *loc, const Relocation &rel,
47 uint64_t val) const override;
48 void relaxTlsGdToIe(uint8_t *loc, const Relocation &rel,
49 uint64_t val) const override;
50 void relaxTlsGdToLe(uint8_t *loc, const Relocation &rel,
51 uint64_t val) const override;
52 void relaxTlsIeToLe(uint8_t *loc, const Relocation &rel,
53 uint64_t val) const override;
54 void relaxTlsLdToLe(uint8_t *loc, const Relocation &rel,
55 uint64_t val) const override;
56 bool adjustPrologueForCrossSplitStack(uint8_t *loc, uint8_t *end,
57 uint8_t stOther) const override;
58 bool deleteFallThruJmpInsn(InputSection &is, InputFile *file,
59 InputSection *nextIS) const override;
60 };
61 } // namespace
62
63 // This is vector of NOP instructions of sizes from 1 to 8 bytes. The
64 // appropriately sized instructions are used to fill the gaps between sections
65 // which are executed during fall through.
66 static const std::vector<std::vector<uint8_t>> nopInstructions = {
67 {0x90},
68 {0x66, 0x90},
69 {0x0f, 0x1f, 0x00},
70 {0x0f, 0x1f, 0x40, 0x00},
71 {0x0f, 0x1f, 0x44, 0x00, 0x00},
72 {0x66, 0x0f, 0x1f, 0x44, 0x00, 0x00},
73 {0x0F, 0x1F, 0x80, 0x00, 0x00, 0x00, 0x00},
74 {0x0F, 0x1F, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00},
75 {0x66, 0x0F, 0x1F, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00}};
76
X86_64()77 X86_64::X86_64() {
78 copyRel = R_X86_64_COPY;
79 gotRel = R_X86_64_GLOB_DAT;
80 pltRel = R_X86_64_JUMP_SLOT;
81 relativeRel = R_X86_64_RELATIVE;
82 iRelativeRel = R_X86_64_IRELATIVE;
83 symbolicRel = R_X86_64_64;
84 tlsDescRel = R_X86_64_TLSDESC;
85 tlsGotRel = R_X86_64_TPOFF64;
86 tlsModuleIndexRel = R_X86_64_DTPMOD64;
87 tlsOffsetRel = R_X86_64_DTPOFF64;
88 gotBaseSymInGotPlt = true;
89 gotEntrySize = 8;
90 pltHeaderSize = 16;
91 pltEntrySize = 16;
92 ipltEntrySize = 16;
93 trapInstr = {0xcc, 0xcc, 0xcc, 0xcc}; // 0xcc = INT3
94 nopInstrs = nopInstructions;
95
96 // Align to the large page size (known as a superpage or huge page).
97 // FreeBSD automatically promotes large, superpage-aligned allocations.
98 defaultImageBase = 0x200000;
99 }
100
getTlsGdRelaxSkip(RelType type) const101 int X86_64::getTlsGdRelaxSkip(RelType type) const {
102 // TLSDESC relocations are processed separately. See relaxTlsGdToLe below.
103 return type == R_X86_64_GOTPC32_TLSDESC || type == R_X86_64_TLSDESC_CALL ? 1
104 : 2;
105 }
106
107 // Opcodes for the different X86_64 jmp instructions.
108 enum JmpInsnOpcode : uint32_t {
109 J_JMP_32,
110 J_JNE_32,
111 J_JE_32,
112 J_JG_32,
113 J_JGE_32,
114 J_JB_32,
115 J_JBE_32,
116 J_JL_32,
117 J_JLE_32,
118 J_JA_32,
119 J_JAE_32,
120 J_UNKNOWN,
121 };
122
123 // Given the first (optional) and second byte of the insn's opcode, this
124 // returns the corresponding enum value.
getJmpInsnType(const uint8_t * first,const uint8_t * second)125 static JmpInsnOpcode getJmpInsnType(const uint8_t *first,
126 const uint8_t *second) {
127 if (*second == 0xe9)
128 return J_JMP_32;
129
130 if (first == nullptr)
131 return J_UNKNOWN;
132
133 if (*first == 0x0f) {
134 switch (*second) {
135 case 0x84:
136 return J_JE_32;
137 case 0x85:
138 return J_JNE_32;
139 case 0x8f:
140 return J_JG_32;
141 case 0x8d:
142 return J_JGE_32;
143 case 0x82:
144 return J_JB_32;
145 case 0x86:
146 return J_JBE_32;
147 case 0x8c:
148 return J_JL_32;
149 case 0x8e:
150 return J_JLE_32;
151 case 0x87:
152 return J_JA_32;
153 case 0x83:
154 return J_JAE_32;
155 }
156 }
157 return J_UNKNOWN;
158 }
159
160 // Return the relocation index for input section IS with a specific Offset.
161 // Returns the maximum size of the vector if no such relocation is found.
getRelocationWithOffset(const InputSection & is,uint64_t offset)162 static unsigned getRelocationWithOffset(const InputSection &is,
163 uint64_t offset) {
164 unsigned size = is.relocations.size();
165 for (unsigned i = size - 1; i + 1 > 0; --i) {
166 if (is.relocations[i].offset == offset && is.relocations[i].expr != R_NONE)
167 return i;
168 }
169 return size;
170 }
171
172 // Returns true if R corresponds to a relocation used for a jump instruction.
173 // TODO: Once special relocations for relaxable jump instructions are available,
174 // this should be modified to use those relocations.
isRelocationForJmpInsn(Relocation & R)175 static bool isRelocationForJmpInsn(Relocation &R) {
176 return R.type == R_X86_64_PLT32 || R.type == R_X86_64_PC32 ||
177 R.type == R_X86_64_PC8;
178 }
179
180 // Return true if Relocation R points to the first instruction in the
181 // next section.
182 // TODO: Delete this once psABI reserves a new relocation type for fall thru
183 // jumps.
isFallThruRelocation(InputSection & is,InputFile * file,InputSection * nextIS,Relocation & r)184 static bool isFallThruRelocation(InputSection &is, InputFile *file,
185 InputSection *nextIS, Relocation &r) {
186 if (!isRelocationForJmpInsn(r))
187 return false;
188
189 uint64_t addrLoc = is.getOutputSection()->addr + is.outSecOff + r.offset;
190 uint64_t targetOffset = InputSectionBase::getRelocTargetVA(
191 file, r.type, r.addend, addrLoc, *r.sym, r.expr);
192
193 // If this jmp is a fall thru, the target offset is the beginning of the
194 // next section.
195 uint64_t nextSectionOffset =
196 nextIS->getOutputSection()->addr + nextIS->outSecOff;
197 return (addrLoc + 4 + targetOffset) == nextSectionOffset;
198 }
199
200 // Return the jmp instruction opcode that is the inverse of the given
201 // opcode. For example, JE inverted is JNE.
invertJmpOpcode(const JmpInsnOpcode opcode)202 static JmpInsnOpcode invertJmpOpcode(const JmpInsnOpcode opcode) {
203 switch (opcode) {
204 case J_JE_32:
205 return J_JNE_32;
206 case J_JNE_32:
207 return J_JE_32;
208 case J_JG_32:
209 return J_JLE_32;
210 case J_JGE_32:
211 return J_JL_32;
212 case J_JB_32:
213 return J_JAE_32;
214 case J_JBE_32:
215 return J_JA_32;
216 case J_JL_32:
217 return J_JGE_32;
218 case J_JLE_32:
219 return J_JG_32;
220 case J_JA_32:
221 return J_JBE_32;
222 case J_JAE_32:
223 return J_JB_32;
224 default:
225 return J_UNKNOWN;
226 }
227 }
228
229 // Deletes direct jump instruction in input sections that jumps to the
230 // following section as it is not required. If there are two consecutive jump
231 // instructions, it checks if they can be flipped and one can be deleted.
232 // For example:
233 // .section .text
234 // a.BB.foo:
235 // ...
236 // 10: jne aa.BB.foo
237 // 16: jmp bar
238 // aa.BB.foo:
239 // ...
240 //
241 // can be converted to:
242 // a.BB.foo:
243 // ...
244 // 10: je bar #jne flipped to je and the jmp is deleted.
245 // aa.BB.foo:
246 // ...
deleteFallThruJmpInsn(InputSection & is,InputFile * file,InputSection * nextIS) const247 bool X86_64::deleteFallThruJmpInsn(InputSection &is, InputFile *file,
248 InputSection *nextIS) const {
249 const unsigned sizeOfDirectJmpInsn = 5;
250
251 if (nextIS == nullptr)
252 return false;
253
254 if (is.getSize() < sizeOfDirectJmpInsn)
255 return false;
256
257 // If this jmp insn can be removed, it is the last insn and the
258 // relocation is 4 bytes before the end.
259 unsigned rIndex = getRelocationWithOffset(is, is.getSize() - 4);
260 if (rIndex == is.relocations.size())
261 return false;
262
263 Relocation &r = is.relocations[rIndex];
264
265 // Check if the relocation corresponds to a direct jmp.
266 const uint8_t *secContents = is.rawData.data();
267 // If it is not a direct jmp instruction, there is nothing to do here.
268 if (*(secContents + r.offset - 1) != 0xe9)
269 return false;
270
271 if (isFallThruRelocation(is, file, nextIS, r)) {
272 // This is a fall thru and can be deleted.
273 r.expr = R_NONE;
274 r.offset = 0;
275 is.drop_back(sizeOfDirectJmpInsn);
276 is.nopFiller = true;
277 return true;
278 }
279
280 // Now, check if flip and delete is possible.
281 const unsigned sizeOfJmpCCInsn = 6;
282 // To flip, there must be at least one JmpCC and one direct jmp.
283 if (is.getSize() < sizeOfDirectJmpInsn + sizeOfJmpCCInsn)
284 return false;
285
286 unsigned rbIndex =
287 getRelocationWithOffset(is, (is.getSize() - sizeOfDirectJmpInsn - 4));
288 if (rbIndex == is.relocations.size())
289 return false;
290
291 Relocation &rB = is.relocations[rbIndex];
292
293 const uint8_t *jmpInsnB = secContents + rB.offset - 1;
294 JmpInsnOpcode jmpOpcodeB = getJmpInsnType(jmpInsnB - 1, jmpInsnB);
295 if (jmpOpcodeB == J_UNKNOWN)
296 return false;
297
298 if (!isFallThruRelocation(is, file, nextIS, rB))
299 return false;
300
301 // jmpCC jumps to the fall thru block, the branch can be flipped and the
302 // jmp can be deleted.
303 JmpInsnOpcode jInvert = invertJmpOpcode(jmpOpcodeB);
304 if (jInvert == J_UNKNOWN)
305 return false;
306 is.jumpInstrMod = make<JumpInstrMod>();
307 *is.jumpInstrMod = {rB.offset - 1, jInvert, 4};
308 // Move R's values to rB except the offset.
309 rB = {r.expr, r.type, rB.offset, r.addend, r.sym};
310 // Cancel R
311 r.expr = R_NONE;
312 r.offset = 0;
313 is.drop_back(sizeOfDirectJmpInsn);
314 is.nopFiller = true;
315 return true;
316 }
317
getRelExpr(RelType type,const Symbol & s,const uint8_t * loc) const318 RelExpr X86_64::getRelExpr(RelType type, const Symbol &s,
319 const uint8_t *loc) const {
320 if (type == R_X86_64_GOTTPOFF)
321 config->hasTlsIe = true;
322
323 switch (type) {
324 case R_X86_64_8:
325 case R_X86_64_16:
326 case R_X86_64_32:
327 case R_X86_64_32S:
328 case R_X86_64_64:
329 return R_ABS;
330 case R_X86_64_DTPOFF32:
331 case R_X86_64_DTPOFF64:
332 return R_DTPREL;
333 case R_X86_64_TPOFF32:
334 return R_TPREL;
335 case R_X86_64_TLSDESC_CALL:
336 return R_TLSDESC_CALL;
337 case R_X86_64_TLSLD:
338 return R_TLSLD_PC;
339 case R_X86_64_TLSGD:
340 return R_TLSGD_PC;
341 case R_X86_64_SIZE32:
342 case R_X86_64_SIZE64:
343 return R_SIZE;
344 case R_X86_64_PLT32:
345 return R_PLT_PC;
346 case R_X86_64_PC8:
347 case R_X86_64_PC16:
348 case R_X86_64_PC32:
349 case R_X86_64_PC64:
350 return R_PC;
351 case R_X86_64_GOT32:
352 case R_X86_64_GOT64:
353 return R_GOTPLT;
354 case R_X86_64_GOTPC32_TLSDESC:
355 return R_TLSDESC_PC;
356 case R_X86_64_GOTPCREL:
357 case R_X86_64_GOTPCRELX:
358 case R_X86_64_REX_GOTPCRELX:
359 case R_X86_64_GOTTPOFF:
360 return R_GOT_PC;
361 case R_X86_64_GOTOFF64:
362 return R_GOTPLTREL;
363 case R_X86_64_PLTOFF64:
364 return R_PLT_GOTPLT;
365 case R_X86_64_GOTPC32:
366 case R_X86_64_GOTPC64:
367 return R_GOTPLTONLY_PC;
368 case R_X86_64_NONE:
369 return R_NONE;
370 default:
371 error(getErrorLocation(loc) + "unknown relocation (" + Twine(type) +
372 ") against symbol " + toString(s));
373 return R_NONE;
374 }
375 }
376
writeGotPltHeader(uint8_t * buf) const377 void X86_64::writeGotPltHeader(uint8_t *buf) const {
378 // The first entry holds the value of _DYNAMIC. It is not clear why that is
379 // required, but it is documented in the psabi and the glibc dynamic linker
380 // seems to use it (note that this is relevant for linking ld.so, not any
381 // other program).
382 write64le(buf, mainPart->dynamic->getVA());
383 }
384
writeGotPlt(uint8_t * buf,const Symbol & s) const385 void X86_64::writeGotPlt(uint8_t *buf, const Symbol &s) const {
386 // See comments in X86::writeGotPlt.
387 write64le(buf, s.getPltVA() + 6);
388 }
389
writeIgotPlt(uint8_t * buf,const Symbol & s) const390 void X86_64::writeIgotPlt(uint8_t *buf, const Symbol &s) const {
391 // An x86 entry is the address of the ifunc resolver function (for -z rel).
392 if (config->writeAddends)
393 write64le(buf, s.getVA());
394 }
395
writePltHeader(uint8_t * buf) const396 void X86_64::writePltHeader(uint8_t *buf) const {
397 const uint8_t pltData[] = {
398 0xff, 0x35, 0, 0, 0, 0, // pushq GOTPLT+8(%rip)
399 0xff, 0x25, 0, 0, 0, 0, // jmp *GOTPLT+16(%rip)
400 0x0f, 0x1f, 0x40, 0x00, // nop
401 };
402 memcpy(buf, pltData, sizeof(pltData));
403 uint64_t gotPlt = in.gotPlt->getVA();
404 uint64_t plt = in.ibtPlt ? in.ibtPlt->getVA() : in.plt->getVA();
405 write32le(buf + 2, gotPlt - plt + 2); // GOTPLT+8
406 write32le(buf + 8, gotPlt - plt + 4); // GOTPLT+16
407 }
408
writePlt(uint8_t * buf,const Symbol & sym,uint64_t pltEntryAddr) const409 void X86_64::writePlt(uint8_t *buf, const Symbol &sym,
410 uint64_t pltEntryAddr) const {
411 const uint8_t inst[] = {
412 0xff, 0x25, 0, 0, 0, 0, // jmpq *got(%rip)
413 0x68, 0, 0, 0, 0, // pushq <relocation index>
414 0xe9, 0, 0, 0, 0, // jmpq plt[0]
415 };
416 memcpy(buf, inst, sizeof(inst));
417
418 write32le(buf + 2, sym.getGotPltVA() - pltEntryAddr - 6);
419 write32le(buf + 7, sym.getPltIdx());
420 write32le(buf + 12, in.plt->getVA() - pltEntryAddr - 16);
421 }
422
getDynRel(RelType type) const423 RelType X86_64::getDynRel(RelType type) const {
424 if (type == R_X86_64_64 || type == R_X86_64_PC64 || type == R_X86_64_SIZE32 ||
425 type == R_X86_64_SIZE64)
426 return type;
427 return R_X86_64_NONE;
428 }
429
relaxTlsGdToLe(uint8_t * loc,const Relocation & rel,uint64_t val) const430 void X86_64::relaxTlsGdToLe(uint8_t *loc, const Relocation &rel,
431 uint64_t val) const {
432 if (rel.type == R_X86_64_TLSGD) {
433 // Convert
434 // .byte 0x66
435 // leaq x@tlsgd(%rip), %rdi
436 // .word 0x6666
437 // rex64
438 // call __tls_get_addr@plt
439 // to the following two instructions.
440 const uint8_t inst[] = {
441 0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00,
442 0x00, 0x00, // mov %fs:0x0,%rax
443 0x48, 0x8d, 0x80, 0, 0, 0, 0, // lea x@tpoff,%rax
444 };
445 memcpy(loc - 4, inst, sizeof(inst));
446
447 // The original code used a pc relative relocation and so we have to
448 // compensate for the -4 in had in the addend.
449 write32le(loc + 8, val + 4);
450 } else if (rel.type == R_X86_64_GOTPC32_TLSDESC) {
451 // Convert leaq x@tlsdesc(%rip), %REG to movq $x@tpoff, %REG.
452 if ((loc[-3] & 0xfb) != 0x48 || loc[-2] != 0x8d ||
453 (loc[-1] & 0xc7) != 0x05) {
454 errorOrWarn(getErrorLocation(loc - 3) +
455 "R_X86_64_GOTPC32_TLSDESC must be used "
456 "in leaq x@tlsdesc(%rip), %REG");
457 return;
458 }
459 loc[-3] = 0x48 | ((loc[-3] >> 2) & 1);
460 loc[-2] = 0xc7;
461 loc[-1] = 0xc0 | ((loc[-1] >> 3) & 7);
462 write32le(loc, val + 4);
463 } else {
464 // Convert call *x@tlsdesc(%REG) to xchg ax, ax.
465 assert(rel.type == R_X86_64_TLSDESC_CALL);
466 loc[0] = 0x66;
467 loc[1] = 0x90;
468 }
469 }
470
relaxTlsGdToIe(uint8_t * loc,const Relocation & rel,uint64_t val) const471 void X86_64::relaxTlsGdToIe(uint8_t *loc, const Relocation &rel,
472 uint64_t val) const {
473 if (rel.type == R_X86_64_TLSGD) {
474 // Convert
475 // .byte 0x66
476 // leaq x@tlsgd(%rip), %rdi
477 // .word 0x6666
478 // rex64
479 // call __tls_get_addr@plt
480 // to the following two instructions.
481 const uint8_t inst[] = {
482 0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00,
483 0x00, 0x00, // mov %fs:0x0,%rax
484 0x48, 0x03, 0x05, 0, 0, 0, 0, // addq x@gottpoff(%rip),%rax
485 };
486 memcpy(loc - 4, inst, sizeof(inst));
487
488 // Both code sequences are PC relatives, but since we are moving the
489 // constant forward by 8 bytes we have to subtract the value by 8.
490 write32le(loc + 8, val - 8);
491 } else if (rel.type == R_X86_64_GOTPC32_TLSDESC) {
492 // Convert leaq x@tlsdesc(%rip), %REG to movq x@gottpoff(%rip), %REG.
493 assert(rel.type == R_X86_64_GOTPC32_TLSDESC);
494 if ((loc[-3] & 0xfb) != 0x48 || loc[-2] != 0x8d ||
495 (loc[-1] & 0xc7) != 0x05) {
496 errorOrWarn(getErrorLocation(loc - 3) +
497 "R_X86_64_GOTPC32_TLSDESC must be used "
498 "in leaq x@tlsdesc(%rip), %REG");
499 return;
500 }
501 loc[-2] = 0x8b;
502 write32le(loc, val);
503 } else {
504 // Convert call *x@tlsdesc(%rax) to xchg ax, ax.
505 assert(rel.type == R_X86_64_TLSDESC_CALL);
506 loc[0] = 0x66;
507 loc[1] = 0x90;
508 }
509 }
510
511 // In some conditions, R_X86_64_GOTTPOFF relocation can be optimized to
512 // R_X86_64_TPOFF32 so that it does not use GOT.
relaxTlsIeToLe(uint8_t * loc,const Relocation &,uint64_t val) const513 void X86_64::relaxTlsIeToLe(uint8_t *loc, const Relocation &,
514 uint64_t val) const {
515 uint8_t *inst = loc - 3;
516 uint8_t reg = loc[-1] >> 3;
517 uint8_t *regSlot = loc - 1;
518
519 // Note that ADD with RSP or R12 is converted to ADD instead of LEA
520 // because LEA with these registers needs 4 bytes to encode and thus
521 // wouldn't fit the space.
522
523 if (memcmp(inst, "\x48\x03\x25", 3) == 0) {
524 // "addq foo@gottpoff(%rip),%rsp" -> "addq $foo,%rsp"
525 memcpy(inst, "\x48\x81\xc4", 3);
526 } else if (memcmp(inst, "\x4c\x03\x25", 3) == 0) {
527 // "addq foo@gottpoff(%rip),%r12" -> "addq $foo,%r12"
528 memcpy(inst, "\x49\x81\xc4", 3);
529 } else if (memcmp(inst, "\x4c\x03", 2) == 0) {
530 // "addq foo@gottpoff(%rip),%r[8-15]" -> "leaq foo(%r[8-15]),%r[8-15]"
531 memcpy(inst, "\x4d\x8d", 2);
532 *regSlot = 0x80 | (reg << 3) | reg;
533 } else if (memcmp(inst, "\x48\x03", 2) == 0) {
534 // "addq foo@gottpoff(%rip),%reg -> "leaq foo(%reg),%reg"
535 memcpy(inst, "\x48\x8d", 2);
536 *regSlot = 0x80 | (reg << 3) | reg;
537 } else if (memcmp(inst, "\x4c\x8b", 2) == 0) {
538 // "movq foo@gottpoff(%rip),%r[8-15]" -> "movq $foo,%r[8-15]"
539 memcpy(inst, "\x49\xc7", 2);
540 *regSlot = 0xc0 | reg;
541 } else if (memcmp(inst, "\x48\x8b", 2) == 0) {
542 // "movq foo@gottpoff(%rip),%reg" -> "movq $foo,%reg"
543 memcpy(inst, "\x48\xc7", 2);
544 *regSlot = 0xc0 | reg;
545 } else {
546 error(getErrorLocation(loc - 3) +
547 "R_X86_64_GOTTPOFF must be used in MOVQ or ADDQ instructions only");
548 }
549
550 // The original code used a PC relative relocation.
551 // Need to compensate for the -4 it had in the addend.
552 write32le(loc, val + 4);
553 }
554
relaxTlsLdToLe(uint8_t * loc,const Relocation & rel,uint64_t val) const555 void X86_64::relaxTlsLdToLe(uint8_t *loc, const Relocation &rel,
556 uint64_t val) const {
557 if (rel.type == R_X86_64_DTPOFF64) {
558 write64le(loc, val);
559 return;
560 }
561 if (rel.type == R_X86_64_DTPOFF32) {
562 write32le(loc, val);
563 return;
564 }
565
566 const uint8_t inst[] = {
567 0x66, 0x66, // .word 0x6666
568 0x66, // .byte 0x66
569 0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 0x00, 0x00, // mov %fs:0,%rax
570 };
571
572 if (loc[4] == 0xe8) {
573 // Convert
574 // leaq bar@tlsld(%rip), %rdi # 48 8d 3d <Loc>
575 // callq __tls_get_addr@PLT # e8 <disp32>
576 // leaq bar@dtpoff(%rax), %rcx
577 // to
578 // .word 0x6666
579 // .byte 0x66
580 // mov %fs:0,%rax
581 // leaq bar@tpoff(%rax), %rcx
582 memcpy(loc - 3, inst, sizeof(inst));
583 return;
584 }
585
586 if (loc[4] == 0xff && loc[5] == 0x15) {
587 // Convert
588 // leaq x@tlsld(%rip),%rdi # 48 8d 3d <Loc>
589 // call *__tls_get_addr@GOTPCREL(%rip) # ff 15 <disp32>
590 // to
591 // .long 0x66666666
592 // movq %fs:0,%rax
593 // See "Table 11.9: LD -> LE Code Transition (LP64)" in
594 // https://raw.githubusercontent.com/wiki/hjl-tools/x86-psABI/x86-64-psABI-1.0.pdf
595 loc[-3] = 0x66;
596 memcpy(loc - 2, inst, sizeof(inst));
597 return;
598 }
599
600 error(getErrorLocation(loc - 3) +
601 "expected R_X86_64_PLT32 or R_X86_64_GOTPCRELX after R_X86_64_TLSLD");
602 }
603
604 // A JumpInstrMod at a specific offset indicates that the jump instruction
605 // opcode at that offset must be modified. This is specifically used to relax
606 // jump instructions with basic block sections. This function looks at the
607 // JumpMod and effects the change.
applyJumpInstrMod(uint8_t * loc,JumpModType type,unsigned size) const608 void X86_64::applyJumpInstrMod(uint8_t *loc, JumpModType type,
609 unsigned size) const {
610 switch (type) {
611 case J_JMP_32:
612 if (size == 4)
613 *loc = 0xe9;
614 else
615 *loc = 0xeb;
616 break;
617 case J_JE_32:
618 if (size == 4) {
619 loc[-1] = 0x0f;
620 *loc = 0x84;
621 } else
622 *loc = 0x74;
623 break;
624 case J_JNE_32:
625 if (size == 4) {
626 loc[-1] = 0x0f;
627 *loc = 0x85;
628 } else
629 *loc = 0x75;
630 break;
631 case J_JG_32:
632 if (size == 4) {
633 loc[-1] = 0x0f;
634 *loc = 0x8f;
635 } else
636 *loc = 0x7f;
637 break;
638 case J_JGE_32:
639 if (size == 4) {
640 loc[-1] = 0x0f;
641 *loc = 0x8d;
642 } else
643 *loc = 0x7d;
644 break;
645 case J_JB_32:
646 if (size == 4) {
647 loc[-1] = 0x0f;
648 *loc = 0x82;
649 } else
650 *loc = 0x72;
651 break;
652 case J_JBE_32:
653 if (size == 4) {
654 loc[-1] = 0x0f;
655 *loc = 0x86;
656 } else
657 *loc = 0x76;
658 break;
659 case J_JL_32:
660 if (size == 4) {
661 loc[-1] = 0x0f;
662 *loc = 0x8c;
663 } else
664 *loc = 0x7c;
665 break;
666 case J_JLE_32:
667 if (size == 4) {
668 loc[-1] = 0x0f;
669 *loc = 0x8e;
670 } else
671 *loc = 0x7e;
672 break;
673 case J_JA_32:
674 if (size == 4) {
675 loc[-1] = 0x0f;
676 *loc = 0x87;
677 } else
678 *loc = 0x77;
679 break;
680 case J_JAE_32:
681 if (size == 4) {
682 loc[-1] = 0x0f;
683 *loc = 0x83;
684 } else
685 *loc = 0x73;
686 break;
687 case J_UNKNOWN:
688 llvm_unreachable("Unknown Jump Relocation");
689 }
690 }
691
getImplicitAddend(const uint8_t * buf,RelType type) const692 int64_t X86_64::getImplicitAddend(const uint8_t *buf, RelType type) const {
693 switch (type) {
694 case R_X86_64_8:
695 case R_X86_64_PC8:
696 return SignExtend64<8>(*buf);
697 case R_X86_64_16:
698 case R_X86_64_PC16:
699 return SignExtend64<16>(read16le(buf));
700 case R_X86_64_32:
701 case R_X86_64_32S:
702 case R_X86_64_TPOFF32:
703 case R_X86_64_GOT32:
704 case R_X86_64_GOTPC32:
705 case R_X86_64_GOTPC32_TLSDESC:
706 case R_X86_64_GOTPCREL:
707 case R_X86_64_GOTPCRELX:
708 case R_X86_64_REX_GOTPCRELX:
709 case R_X86_64_PC32:
710 case R_X86_64_GOTTPOFF:
711 case R_X86_64_PLT32:
712 case R_X86_64_TLSGD:
713 case R_X86_64_TLSLD:
714 case R_X86_64_DTPOFF32:
715 case R_X86_64_SIZE32:
716 return SignExtend64<32>(read32le(buf));
717 case R_X86_64_64:
718 case R_X86_64_TPOFF64:
719 case R_X86_64_DTPOFF64:
720 case R_X86_64_DTPMOD64:
721 case R_X86_64_PC64:
722 case R_X86_64_SIZE64:
723 case R_X86_64_GLOB_DAT:
724 case R_X86_64_GOT64:
725 case R_X86_64_GOTOFF64:
726 case R_X86_64_GOTPC64:
727 case R_X86_64_PLTOFF64:
728 case R_X86_64_IRELATIVE:
729 case R_X86_64_RELATIVE:
730 return read64le(buf);
731 case R_X86_64_TLSDESC:
732 return read64le(buf + 8);
733 case R_X86_64_JUMP_SLOT:
734 case R_X86_64_NONE:
735 // These relocations are defined as not having an implicit addend.
736 return 0;
737 default:
738 internalLinkerError(getErrorLocation(buf),
739 "cannot read addend for relocation " + toString(type));
740 return 0;
741 }
742 }
743
relocate(uint8_t * loc,const Relocation & rel,uint64_t val) const744 void X86_64::relocate(uint8_t *loc, const Relocation &rel, uint64_t val) const {
745 switch (rel.type) {
746 case R_X86_64_8:
747 checkIntUInt(loc, val, 8, rel);
748 *loc = val;
749 break;
750 case R_X86_64_PC8:
751 checkInt(loc, val, 8, rel);
752 *loc = val;
753 break;
754 case R_X86_64_16:
755 checkIntUInt(loc, val, 16, rel);
756 write16le(loc, val);
757 break;
758 case R_X86_64_PC16:
759 checkInt(loc, val, 16, rel);
760 write16le(loc, val);
761 break;
762 case R_X86_64_32:
763 checkUInt(loc, val, 32, rel);
764 write32le(loc, val);
765 break;
766 case R_X86_64_32S:
767 case R_X86_64_TPOFF32:
768 case R_X86_64_GOT32:
769 case R_X86_64_GOTPC32:
770 case R_X86_64_GOTPC32_TLSDESC:
771 case R_X86_64_GOTPCREL:
772 case R_X86_64_GOTPCRELX:
773 case R_X86_64_REX_GOTPCRELX:
774 case R_X86_64_PC32:
775 case R_X86_64_GOTTPOFF:
776 case R_X86_64_PLT32:
777 case R_X86_64_TLSGD:
778 case R_X86_64_TLSLD:
779 case R_X86_64_DTPOFF32:
780 case R_X86_64_SIZE32:
781 checkInt(loc, val, 32, rel);
782 write32le(loc, val);
783 break;
784 case R_X86_64_64:
785 case R_X86_64_DTPOFF64:
786 case R_X86_64_PC64:
787 case R_X86_64_SIZE64:
788 case R_X86_64_GOT64:
789 case R_X86_64_GOTOFF64:
790 case R_X86_64_GOTPC64:
791 case R_X86_64_PLTOFF64:
792 write64le(loc, val);
793 break;
794 case R_X86_64_TLSDESC:
795 // The addend is stored in the second 64-bit word.
796 write64le(loc + 8, val);
797 break;
798 default:
799 llvm_unreachable("unknown relocation");
800 }
801 }
802
adjustGotPcExpr(RelType type,int64_t addend,const uint8_t * loc) const803 RelExpr X86_64::adjustGotPcExpr(RelType type, int64_t addend,
804 const uint8_t *loc) const {
805 // Only R_X86_64_[REX_]GOTPCRELX can be relaxed. GNU as may emit GOTPCRELX
806 // with addend != -4. Such an instruction does not load the full GOT entry, so
807 // we cannot relax the relocation. E.g. movl x@GOTPCREL+4(%rip), %rax
808 // (addend=0) loads the high 32 bits of the GOT entry.
809 if (!config->relax || addend != -4 ||
810 (type != R_X86_64_GOTPCRELX && type != R_X86_64_REX_GOTPCRELX))
811 return R_GOT_PC;
812 const uint8_t op = loc[-2];
813 const uint8_t modRm = loc[-1];
814
815 // FIXME: When PIC is disabled and foo is defined locally in the
816 // lower 32 bit address space, memory operand in mov can be converted into
817 // immediate operand. Otherwise, mov must be changed to lea. We support only
818 // latter relaxation at this moment.
819 if (op == 0x8b)
820 return R_RELAX_GOT_PC;
821
822 // Relax call and jmp.
823 if (op == 0xff && (modRm == 0x15 || modRm == 0x25))
824 return R_RELAX_GOT_PC;
825
826 // We don't support test/binop instructions without a REX prefix.
827 if (type == R_X86_64_GOTPCRELX)
828 return R_GOT_PC;
829
830 // Relaxation of test, adc, add, and, cmp, or, sbb, sub, xor.
831 // If PIC then no relaxation is available.
832 return config->isPic ? R_GOT_PC : R_RELAX_GOT_PC_NOPIC;
833 }
834
835 // A subset of relaxations can only be applied for no-PIC. This method
836 // handles such relaxations. Instructions encoding information was taken from:
837 // "Intel 64 and IA-32 Architectures Software Developer's Manual V2"
838 // (http://www.intel.com/content/dam/www/public/us/en/documents/manuals/
839 // 64-ia-32-architectures-software-developer-instruction-set-reference-manual-325383.pdf)
relaxGotNoPic(uint8_t * loc,uint64_t val,uint8_t op,uint8_t modRm)840 static void relaxGotNoPic(uint8_t *loc, uint64_t val, uint8_t op,
841 uint8_t modRm) {
842 const uint8_t rex = loc[-3];
843 // Convert "test %reg, foo@GOTPCREL(%rip)" to "test $foo, %reg".
844 if (op == 0x85) {
845 // See "TEST-Logical Compare" (4-428 Vol. 2B),
846 // TEST r/m64, r64 uses "full" ModR / M byte (no opcode extension).
847
848 // ModR/M byte has form XX YYY ZZZ, where
849 // YYY is MODRM.reg(register 2), ZZZ is MODRM.rm(register 1).
850 // XX has different meanings:
851 // 00: The operand's memory address is in reg1.
852 // 01: The operand's memory address is reg1 + a byte-sized displacement.
853 // 10: The operand's memory address is reg1 + a word-sized displacement.
854 // 11: The operand is reg1 itself.
855 // If an instruction requires only one operand, the unused reg2 field
856 // holds extra opcode bits rather than a register code
857 // 0xC0 == 11 000 000 binary.
858 // 0x38 == 00 111 000 binary.
859 // We transfer reg2 to reg1 here as operand.
860 // See "2.1.3 ModR/M and SIB Bytes" (Vol. 2A 2-3).
861 loc[-1] = 0xc0 | (modRm & 0x38) >> 3; // ModR/M byte.
862
863 // Change opcode from TEST r/m64, r64 to TEST r/m64, imm32
864 // See "TEST-Logical Compare" (4-428 Vol. 2B).
865 loc[-2] = 0xf7;
866
867 // Move R bit to the B bit in REX byte.
868 // REX byte is encoded as 0100WRXB, where
869 // 0100 is 4bit fixed pattern.
870 // REX.W When 1, a 64-bit operand size is used. Otherwise, when 0, the
871 // default operand size is used (which is 32-bit for most but not all
872 // instructions).
873 // REX.R This 1-bit value is an extension to the MODRM.reg field.
874 // REX.X This 1-bit value is an extension to the SIB.index field.
875 // REX.B This 1-bit value is an extension to the MODRM.rm field or the
876 // SIB.base field.
877 // See "2.2.1.2 More on REX Prefix Fields " (2-8 Vol. 2A).
878 loc[-3] = (rex & ~0x4) | (rex & 0x4) >> 2;
879 write32le(loc, val);
880 return;
881 }
882
883 // If we are here then we need to relax the adc, add, and, cmp, or, sbb, sub
884 // or xor operations.
885
886 // Convert "binop foo@GOTPCREL(%rip), %reg" to "binop $foo, %reg".
887 // Logic is close to one for test instruction above, but we also
888 // write opcode extension here, see below for details.
889 loc[-1] = 0xc0 | (modRm & 0x38) >> 3 | (op & 0x3c); // ModR/M byte.
890
891 // Primary opcode is 0x81, opcode extension is one of:
892 // 000b = ADD, 001b is OR, 010b is ADC, 011b is SBB,
893 // 100b is AND, 101b is SUB, 110b is XOR, 111b is CMP.
894 // This value was wrote to MODRM.reg in a line above.
895 // See "3.2 INSTRUCTIONS (A-M)" (Vol. 2A 3-15),
896 // "INSTRUCTION SET REFERENCE, N-Z" (Vol. 2B 4-1) for
897 // descriptions about each operation.
898 loc[-2] = 0x81;
899 loc[-3] = (rex & ~0x4) | (rex & 0x4) >> 2;
900 write32le(loc, val);
901 }
902
relaxGot(uint8_t * loc,const Relocation & rel,uint64_t val) const903 void X86_64::relaxGot(uint8_t *loc, const Relocation &rel, uint64_t val) const {
904 checkInt(loc, val, 32, rel);
905 const uint8_t op = loc[-2];
906 const uint8_t modRm = loc[-1];
907
908 // Convert "mov foo@GOTPCREL(%rip),%reg" to "lea foo(%rip),%reg".
909 if (op == 0x8b) {
910 loc[-2] = 0x8d;
911 write32le(loc, val);
912 return;
913 }
914
915 if (op != 0xff) {
916 // We are relaxing a rip relative to an absolute, so compensate
917 // for the old -4 addend.
918 assert(!config->isPic);
919 relaxGotNoPic(loc, val + 4, op, modRm);
920 return;
921 }
922
923 // Convert call/jmp instructions.
924 if (modRm == 0x15) {
925 // ABI says we can convert "call *foo@GOTPCREL(%rip)" to "nop; call foo".
926 // Instead we convert to "addr32 call foo" where addr32 is an instruction
927 // prefix. That makes result expression to be a single instruction.
928 loc[-2] = 0x67; // addr32 prefix
929 loc[-1] = 0xe8; // call
930 write32le(loc, val);
931 return;
932 }
933
934 // Convert "jmp *foo@GOTPCREL(%rip)" to "jmp foo; nop".
935 // jmp doesn't return, so it is fine to use nop here, it is just a stub.
936 assert(modRm == 0x25);
937 loc[-2] = 0xe9; // jmp
938 loc[3] = 0x90; // nop
939 write32le(loc - 1, val + 1);
940 }
941
942 // A split-stack prologue starts by checking the amount of stack remaining
943 // in one of two ways:
944 // A) Comparing of the stack pointer to a field in the tcb.
945 // B) Or a load of a stack pointer offset with an lea to r10 or r11.
adjustPrologueForCrossSplitStack(uint8_t * loc,uint8_t * end,uint8_t stOther) const946 bool X86_64::adjustPrologueForCrossSplitStack(uint8_t *loc, uint8_t *end,
947 uint8_t stOther) const {
948 if (!config->is64) {
949 error("target doesn't support split stacks");
950 return false;
951 }
952
953 if (loc + 8 >= end)
954 return false;
955
956 // Replace "cmp %fs:0x70,%rsp" and subsequent branch
957 // with "stc, nopl 0x0(%rax,%rax,1)"
958 if (memcmp(loc, "\x64\x48\x3b\x24\x25", 5) == 0) {
959 memcpy(loc, "\xf9\x0f\x1f\x84\x00\x00\x00\x00", 8);
960 return true;
961 }
962
963 // Adjust "lea X(%rsp),%rYY" to lea "(X - 0x4000)(%rsp),%rYY" where rYY could
964 // be r10 or r11. The lea instruction feeds a subsequent compare which checks
965 // if there is X available stack space. Making X larger effectively reserves
966 // that much additional space. The stack grows downward so subtract the value.
967 if (memcmp(loc, "\x4c\x8d\x94\x24", 4) == 0 ||
968 memcmp(loc, "\x4c\x8d\x9c\x24", 4) == 0) {
969 // The offset bytes are encoded four bytes after the start of the
970 // instruction.
971 write32le(loc + 4, read32le(loc + 4) - 0x4000);
972 return true;
973 }
974 return false;
975 }
976
977 // If Intel Indirect Branch Tracking is enabled, we have to emit special PLT
978 // entries containing endbr64 instructions. A PLT entry will be split into two
979 // parts, one in .plt.sec (writePlt), and the other in .plt (writeIBTPlt).
980 namespace {
981 class IntelIBT : public X86_64 {
982 public:
983 IntelIBT();
984 void writeGotPlt(uint8_t *buf, const Symbol &s) const override;
985 void writePlt(uint8_t *buf, const Symbol &sym,
986 uint64_t pltEntryAddr) const override;
987 void writeIBTPlt(uint8_t *buf, size_t numEntries) const override;
988
989 static const unsigned IBTPltHeaderSize = 16;
990 };
991 } // namespace
992
IntelIBT()993 IntelIBT::IntelIBT() { pltHeaderSize = 0; }
994
writeGotPlt(uint8_t * buf,const Symbol & s) const995 void IntelIBT::writeGotPlt(uint8_t *buf, const Symbol &s) const {
996 uint64_t va =
997 in.ibtPlt->getVA() + IBTPltHeaderSize + s.getPltIdx() * pltEntrySize;
998 write64le(buf, va);
999 }
1000
writePlt(uint8_t * buf,const Symbol & sym,uint64_t pltEntryAddr) const1001 void IntelIBT::writePlt(uint8_t *buf, const Symbol &sym,
1002 uint64_t pltEntryAddr) const {
1003 const uint8_t Inst[] = {
1004 0xf3, 0x0f, 0x1e, 0xfa, // endbr64
1005 0xff, 0x25, 0, 0, 0, 0, // jmpq *got(%rip)
1006 0x66, 0x0f, 0x1f, 0x44, 0, 0, // nop
1007 };
1008 memcpy(buf, Inst, sizeof(Inst));
1009 write32le(buf + 6, sym.getGotPltVA() - pltEntryAddr - 10);
1010 }
1011
writeIBTPlt(uint8_t * buf,size_t numEntries) const1012 void IntelIBT::writeIBTPlt(uint8_t *buf, size_t numEntries) const {
1013 writePltHeader(buf);
1014 buf += IBTPltHeaderSize;
1015
1016 const uint8_t inst[] = {
1017 0xf3, 0x0f, 0x1e, 0xfa, // endbr64
1018 0x68, 0, 0, 0, 0, // pushq <relocation index>
1019 0xe9, 0, 0, 0, 0, // jmpq plt[0]
1020 0x66, 0x90, // nop
1021 };
1022
1023 for (size_t i = 0; i < numEntries; ++i) {
1024 memcpy(buf, inst, sizeof(inst));
1025 write32le(buf + 5, i);
1026 write32le(buf + 10, -pltHeaderSize - sizeof(inst) * i - 30);
1027 buf += sizeof(inst);
1028 }
1029 }
1030
1031 // These nonstandard PLT entries are to migtigate Spectre v2 security
1032 // vulnerability. In order to mitigate Spectre v2, we want to avoid indirect
1033 // branch instructions such as `jmp *GOTPLT(%rip)`. So, in the following PLT
1034 // entries, we use a CALL followed by MOV and RET to do the same thing as an
1035 // indirect jump. That instruction sequence is so-called "retpoline".
1036 //
1037 // We have two types of retpoline PLTs as a size optimization. If `-z now`
1038 // is specified, all dynamic symbols are resolved at load-time. Thus, when
1039 // that option is given, we can omit code for symbol lazy resolution.
1040 namespace {
1041 class Retpoline : public X86_64 {
1042 public:
1043 Retpoline();
1044 void writeGotPlt(uint8_t *buf, const Symbol &s) const override;
1045 void writePltHeader(uint8_t *buf) const override;
1046 void writePlt(uint8_t *buf, const Symbol &sym,
1047 uint64_t pltEntryAddr) const override;
1048 };
1049
1050 class RetpolineZNow : public X86_64 {
1051 public:
1052 RetpolineZNow();
writeGotPlt(uint8_t * buf,const Symbol & s) const1053 void writeGotPlt(uint8_t *buf, const Symbol &s) const override {}
1054 void writePltHeader(uint8_t *buf) const override;
1055 void writePlt(uint8_t *buf, const Symbol &sym,
1056 uint64_t pltEntryAddr) const override;
1057 };
1058 } // namespace
1059
Retpoline()1060 Retpoline::Retpoline() {
1061 pltHeaderSize = 48;
1062 pltEntrySize = 32;
1063 ipltEntrySize = 32;
1064 }
1065
writeGotPlt(uint8_t * buf,const Symbol & s) const1066 void Retpoline::writeGotPlt(uint8_t *buf, const Symbol &s) const {
1067 write64le(buf, s.getPltVA() + 17);
1068 }
1069
writePltHeader(uint8_t * buf) const1070 void Retpoline::writePltHeader(uint8_t *buf) const {
1071 const uint8_t insn[] = {
1072 0xff, 0x35, 0, 0, 0, 0, // 0: pushq GOTPLT+8(%rip)
1073 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // 6: mov GOTPLT+16(%rip), %r11
1074 0xe8, 0x0e, 0x00, 0x00, 0x00, // d: callq next
1075 0xf3, 0x90, // 12: loop: pause
1076 0x0f, 0xae, 0xe8, // 14: lfence
1077 0xeb, 0xf9, // 17: jmp loop
1078 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 19: int3; .align 16
1079 0x4c, 0x89, 0x1c, 0x24, // 20: next: mov %r11, (%rsp)
1080 0xc3, // 24: ret
1081 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 25: int3; padding
1082 0xcc, 0xcc, 0xcc, 0xcc, // 2c: int3; padding
1083 };
1084 memcpy(buf, insn, sizeof(insn));
1085
1086 uint64_t gotPlt = in.gotPlt->getVA();
1087 uint64_t plt = in.plt->getVA();
1088 write32le(buf + 2, gotPlt - plt - 6 + 8);
1089 write32le(buf + 9, gotPlt - plt - 13 + 16);
1090 }
1091
writePlt(uint8_t * buf,const Symbol & sym,uint64_t pltEntryAddr) const1092 void Retpoline::writePlt(uint8_t *buf, const Symbol &sym,
1093 uint64_t pltEntryAddr) const {
1094 const uint8_t insn[] = {
1095 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // 0: mov foo@GOTPLT(%rip), %r11
1096 0xe8, 0, 0, 0, 0, // 7: callq plt+0x20
1097 0xe9, 0, 0, 0, 0, // c: jmp plt+0x12
1098 0x68, 0, 0, 0, 0, // 11: pushq <relocation index>
1099 0xe9, 0, 0, 0, 0, // 16: jmp plt+0
1100 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1b: int3; padding
1101 };
1102 memcpy(buf, insn, sizeof(insn));
1103
1104 uint64_t off = pltEntryAddr - in.plt->getVA();
1105
1106 write32le(buf + 3, sym.getGotPltVA() - pltEntryAddr - 7);
1107 write32le(buf + 8, -off - 12 + 32);
1108 write32le(buf + 13, -off - 17 + 18);
1109 write32le(buf + 18, sym.getPltIdx());
1110 write32le(buf + 23, -off - 27);
1111 }
1112
RetpolineZNow()1113 RetpolineZNow::RetpolineZNow() {
1114 pltHeaderSize = 32;
1115 pltEntrySize = 16;
1116 ipltEntrySize = 16;
1117 }
1118
writePltHeader(uint8_t * buf) const1119 void RetpolineZNow::writePltHeader(uint8_t *buf) const {
1120 const uint8_t insn[] = {
1121 0xe8, 0x0b, 0x00, 0x00, 0x00, // 0: call next
1122 0xf3, 0x90, // 5: loop: pause
1123 0x0f, 0xae, 0xe8, // 7: lfence
1124 0xeb, 0xf9, // a: jmp loop
1125 0xcc, 0xcc, 0xcc, 0xcc, // c: int3; .align 16
1126 0x4c, 0x89, 0x1c, 0x24, // 10: next: mov %r11, (%rsp)
1127 0xc3, // 14: ret
1128 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 15: int3; padding
1129 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1a: int3; padding
1130 0xcc, // 1f: int3; padding
1131 };
1132 memcpy(buf, insn, sizeof(insn));
1133 }
1134
writePlt(uint8_t * buf,const Symbol & sym,uint64_t pltEntryAddr) const1135 void RetpolineZNow::writePlt(uint8_t *buf, const Symbol &sym,
1136 uint64_t pltEntryAddr) const {
1137 const uint8_t insn[] = {
1138 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // mov foo@GOTPLT(%rip), %r11
1139 0xe9, 0, 0, 0, 0, // jmp plt+0
1140 0xcc, 0xcc, 0xcc, 0xcc, // int3; padding
1141 };
1142 memcpy(buf, insn, sizeof(insn));
1143
1144 write32le(buf + 3, sym.getGotPltVA() - pltEntryAddr - 7);
1145 write32le(buf + 8, in.plt->getVA() - pltEntryAddr - 12);
1146 }
1147
getTargetInfo()1148 static TargetInfo *getTargetInfo() {
1149 if (config->zRetpolineplt) {
1150 if (config->zNow) {
1151 static RetpolineZNow t;
1152 return &t;
1153 }
1154 static Retpoline t;
1155 return &t;
1156 }
1157
1158 if (config->andFeatures & GNU_PROPERTY_X86_FEATURE_1_IBT) {
1159 static IntelIBT t;
1160 return &t;
1161 }
1162
1163 static X86_64 t;
1164 return &t;
1165 }
1166
getX86_64TargetInfo()1167 TargetInfo *elf::getX86_64TargetInfo() { return getTargetInfo(); }
1168