blob d4bdb373 (23129B) - Raw
1 //===- X86_64.cpp ---------------------------------------------------------===// 2 // 3 // The LLVM Linker 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 10 #include "InputFiles.h" 11 #include "Symbols.h" 12 #include "SyntheticSections.h" 13 #include "Target.h" 14 #include "lld/Common/ErrorHandler.h" 15 #include "llvm/Object/ELF.h" 16 #include "llvm/Support/Endian.h" 17 18 using namespace llvm; 19 using namespace llvm::object; 20 using namespace llvm::support::endian; 21 using namespace llvm::ELF; 22 using namespace lld; 23 using namespace lld::elf; 24 25 namespace { 26 template <class ELFT> class X86_64 : public TargetInfo { 27 public: 28 X86_64(); 29 RelExpr getRelExpr(RelType Type, const Symbol &S, 30 const uint8_t *Loc) const override; 31 RelType getDynRel(RelType Type) const override; 32 void writeGotPltHeader(uint8_t *Buf) const override; 33 void writeGotPlt(uint8_t *Buf, const Symbol &S) const override; 34 void writePltHeader(uint8_t *Buf) const override; 35 void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr, 36 int32_t Index, unsigned RelOff) const override; 37 void relocateOne(uint8_t *Loc, RelType Type, uint64_t Val) const override; 38 39 RelExpr adjustRelaxExpr(RelType Type, const uint8_t *Data, 40 RelExpr Expr) const override; 41 void relaxGot(uint8_t *Loc, uint64_t Val) const override; 42 void relaxTlsGdToIe(uint8_t *Loc, RelType Type, uint64_t Val) const override; 43 void relaxTlsGdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override; 44 void relaxTlsIeToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override; 45 void relaxTlsLdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override; 46 bool adjustPrologueForCrossSplitStack(uint8_t *Loc, 47 uint8_t *End) const override; 48 49 private: 50 void relaxGotNoPic(uint8_t *Loc, uint64_t Val, uint8_t Op, 51 uint8_t ModRm) const; 52 }; 53 } // namespace 54 55 template <class ELFT> X86_64<ELFT>::X86_64() { 56 CopyRel = R_X86_64_COPY; 57 GotRel = R_X86_64_GLOB_DAT; 58 PltRel = R_X86_64_JUMP_SLOT; 59 RelativeRel = R_X86_64_RELATIVE; 60 IRelativeRel = R_X86_64_IRELATIVE; 61 TlsGotRel = R_X86_64_TPOFF64; 62 TlsModuleIndexRel = R_X86_64_DTPMOD64; 63 TlsOffsetRel = R_X86_64_DTPOFF64; 64 GotEntrySize = 8; 65 GotPltEntrySize = 8; 66 PltEntrySize = 16; 67 PltHeaderSize = 16; 68 TlsGdRelaxSkip = 2; 69 TrapInstr = 0xcccccccc; // 0xcc = INT3 70 71 // Align to the large page size (known as a superpage or huge page). 72 // FreeBSD automatically promotes large, superpage-aligned allocations. 73 DefaultImageBase = 0x200000; 74 } 75 76 template <class ELFT> 77 RelExpr X86_64<ELFT>::getRelExpr(RelType Type, const Symbol &S, 78 const uint8_t *Loc) const { 79 switch (Type) { 80 case R_X86_64_8: 81 case R_X86_64_16: 82 case R_X86_64_32: 83 case R_X86_64_32S: 84 case R_X86_64_64: 85 case R_X86_64_DTPOFF32: 86 case R_X86_64_DTPOFF64: 87 return R_ABS; 88 case R_X86_64_TPOFF32: 89 return R_TLS; 90 case R_X86_64_TLSLD: 91 return R_TLSLD_PC; 92 case R_X86_64_TLSGD: 93 return R_TLSGD_PC; 94 case R_X86_64_SIZE32: 95 case R_X86_64_SIZE64: 96 return R_SIZE; 97 case R_X86_64_PLT32: 98 return R_PLT_PC; 99 case R_X86_64_PC32: 100 case R_X86_64_PC64: 101 return R_PC; 102 case R_X86_64_GOT32: 103 case R_X86_64_GOT64: 104 return R_GOT_FROM_END; 105 case R_X86_64_GOTPCREL: 106 case R_X86_64_GOTPCRELX: 107 case R_X86_64_REX_GOTPCRELX: 108 case R_X86_64_GOTTPOFF: 109 return R_GOT_PC; 110 case R_X86_64_GOTOFF64: 111 return R_GOTREL_FROM_END; 112 case R_X86_64_GOTPC32: 113 case R_X86_64_GOTPC64: 114 return R_GOTONLY_PC_FROM_END; 115 case R_X86_64_NONE: 116 return R_NONE; 117 default: 118 return R_INVALID; 119 } 120 } 121 122 template <class ELFT> void X86_64<ELFT>::writeGotPltHeader(uint8_t *Buf) const { 123 // The first entry holds the value of _DYNAMIC. It is not clear why that is 124 // required, but it is documented in the psabi and the glibc dynamic linker 125 // seems to use it (note that this is relevant for linking ld.so, not any 126 // other program). 127 write64le(Buf, InX::Dynamic->getVA()); 128 } 129 130 template <class ELFT> 131 void X86_64<ELFT>::writeGotPlt(uint8_t *Buf, const Symbol &S) const { 132 // See comments in X86::writeGotPlt. 133 write64le(Buf, S.getPltVA() + 6); 134 } 135 136 template <class ELFT> void X86_64<ELFT>::writePltHeader(uint8_t *Buf) const { 137 const uint8_t PltData[] = { 138 0xff, 0x35, 0, 0, 0, 0, // pushq GOTPLT+8(%rip) 139 0xff, 0x25, 0, 0, 0, 0, // jmp *GOTPLT+16(%rip) 140 0x0f, 0x1f, 0x40, 0x00, // nop 141 }; 142 memcpy(Buf, PltData, sizeof(PltData)); 143 uint64_t GotPlt = InX::GotPlt->getVA(); 144 uint64_t Plt = InX::Plt->getVA(); 145 write32le(Buf + 2, GotPlt - Plt + 2); // GOTPLT+8 146 write32le(Buf + 8, GotPlt - Plt + 4); // GOTPLT+16 147 } 148 149 template <class ELFT> 150 void X86_64<ELFT>::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, 151 uint64_t PltEntryAddr, int32_t Index, 152 unsigned RelOff) const { 153 const uint8_t Inst[] = { 154 0xff, 0x25, 0, 0, 0, 0, // jmpq *got(%rip) 155 0x68, 0, 0, 0, 0, // pushq <relocation index> 156 0xe9, 0, 0, 0, 0, // jmpq plt[0] 157 }; 158 memcpy(Buf, Inst, sizeof(Inst)); 159 160 write32le(Buf + 2, GotPltEntryAddr - PltEntryAddr - 6); 161 write32le(Buf + 7, Index); 162 write32le(Buf + 12, -getPltEntryOffset(Index) - 16); 163 } 164 165 template <class ELFT> RelType X86_64<ELFT>::getDynRel(RelType Type) const { 166 if (Type == R_X86_64_64 || Type == R_X86_64_PC64 || Type == R_X86_64_SIZE32 || 167 Type == R_X86_64_SIZE64) 168 return Type; 169 return R_X86_64_NONE; 170 } 171 172 template <class ELFT> 173 void X86_64<ELFT>::relaxTlsGdToLe(uint8_t *Loc, RelType Type, 174 uint64_t Val) const { 175 // Convert 176 // .byte 0x66 177 // leaq x@tlsgd(%rip), %rdi 178 // .word 0x6666 179 // rex64 180 // call __tls_get_addr@plt 181 // to 182 // mov %fs:0x0,%rax 183 // lea x@tpoff,%rax 184 const uint8_t Inst[] = { 185 0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 0x00, 0x00, // mov %fs:0x0,%rax 186 0x48, 0x8d, 0x80, 0, 0, 0, 0, // lea x@tpoff,%rax 187 }; 188 memcpy(Loc - 4, Inst, sizeof(Inst)); 189 190 // The original code used a pc relative relocation and so we have to 191 // compensate for the -4 in had in the addend. 192 write32le(Loc + 8, Val + 4); 193 } 194 195 template <class ELFT> 196 void X86_64<ELFT>::relaxTlsGdToIe(uint8_t *Loc, RelType Type, 197 uint64_t Val) const { 198 // Convert 199 // .byte 0x66 200 // leaq x@tlsgd(%rip), %rdi 201 // .word 0x6666 202 // rex64 203 // call __tls_get_addr@plt 204 // to 205 // mov %fs:0x0,%rax 206 // addq x@tpoff,%rax 207 const uint8_t Inst[] = { 208 0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 0x00, 0x00, // mov %fs:0x0,%rax 209 0x48, 0x03, 0x05, 0, 0, 0, 0, // addq x@tpoff,%rax 210 }; 211 memcpy(Loc - 4, Inst, sizeof(Inst)); 212 213 // Both code sequences are PC relatives, but since we are moving the constant 214 // forward by 8 bytes we have to subtract the value by 8. 215 write32le(Loc + 8, Val - 8); 216 } 217 218 // In some conditions, R_X86_64_GOTTPOFF relocation can be optimized to 219 // R_X86_64_TPOFF32 so that it does not use GOT. 220 template <class ELFT> 221 void X86_64<ELFT>::relaxTlsIeToLe(uint8_t *Loc, RelType Type, 222 uint64_t Val) const { 223 uint8_t *Inst = Loc - 3; 224 uint8_t Reg = Loc[-1] >> 3; 225 uint8_t *RegSlot = Loc - 1; 226 227 // Note that ADD with RSP or R12 is converted to ADD instead of LEA 228 // because LEA with these registers needs 4 bytes to encode and thus 229 // wouldn't fit the space. 230 231 if (memcmp(Inst, "\x48\x03\x25", 3) == 0) { 232 // "addq foo@gottpoff(%rip),%rsp" -> "addq $foo,%rsp" 233 memcpy(Inst, "\x48\x81\xc4", 3); 234 } else if (memcmp(Inst, "\x4c\x03\x25", 3) == 0) { 235 // "addq foo@gottpoff(%rip),%r12" -> "addq $foo,%r12" 236 memcpy(Inst, "\x49\x81\xc4", 3); 237 } else if (memcmp(Inst, "\x4c\x03", 2) == 0) { 238 // "addq foo@gottpoff(%rip),%r[8-15]" -> "leaq foo(%r[8-15]),%r[8-15]" 239 memcpy(Inst, "\x4d\x8d", 2); 240 *RegSlot = 0x80 | (Reg << 3) | Reg; 241 } else if (memcmp(Inst, "\x48\x03", 2) == 0) { 242 // "addq foo@gottpoff(%rip),%reg -> "leaq foo(%reg),%reg" 243 memcpy(Inst, "\x48\x8d", 2); 244 *RegSlot = 0x80 | (Reg << 3) | Reg; 245 } else if (memcmp(Inst, "\x4c\x8b", 2) == 0) { 246 // "movq foo@gottpoff(%rip),%r[8-15]" -> "movq $foo,%r[8-15]" 247 memcpy(Inst, "\x49\xc7", 2); 248 *RegSlot = 0xc0 | Reg; 249 } else if (memcmp(Inst, "\x48\x8b", 2) == 0) { 250 // "movq foo@gottpoff(%rip),%reg" -> "movq $foo,%reg" 251 memcpy(Inst, "\x48\xc7", 2); 252 *RegSlot = 0xc0 | Reg; 253 } else { 254 error(getErrorLocation(Loc - 3) + 255 "R_X86_64_GOTTPOFF must be used in MOVQ or ADDQ instructions only"); 256 } 257 258 // The original code used a PC relative relocation. 259 // Need to compensate for the -4 it had in the addend. 260 write32le(Loc, Val + 4); 261 } 262 263 template <class ELFT> 264 void X86_64<ELFT>::relaxTlsLdToLe(uint8_t *Loc, RelType Type, 265 uint64_t Val) const { 266 // Convert 267 // leaq bar@tlsld(%rip), %rdi 268 // callq __tls_get_addr@PLT 269 // leaq bar@dtpoff(%rax), %rcx 270 // to 271 // .word 0x6666 272 // .byte 0x66 273 // mov %fs:0,%rax 274 // leaq bar@tpoff(%rax), %rcx 275 if (Type == R_X86_64_DTPOFF64) { 276 write64le(Loc, Val); 277 return; 278 } 279 if (Type == R_X86_64_DTPOFF32) { 280 write32le(Loc, Val); 281 return; 282 } 283 284 const uint8_t Inst[] = { 285 0x66, 0x66, // .word 0x6666 286 0x66, // .byte 0x66 287 0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 0x00, 0x00, // mov %fs:0,%rax 288 }; 289 memcpy(Loc - 3, Inst, sizeof(Inst)); 290 } 291 292 template <class ELFT> 293 void X86_64<ELFT>::relocateOne(uint8_t *Loc, RelType Type, uint64_t Val) const { 294 switch (Type) { 295 case R_X86_64_8: 296 checkUInt(Loc, Val, 8, Type); 297 *Loc = Val; 298 break; 299 case R_X86_64_16: 300 checkUInt(Loc, Val, 16, Type); 301 write16le(Loc, Val); 302 break; 303 case R_X86_64_32: 304 checkUInt(Loc, Val, 32, Type); 305 write32le(Loc, Val); 306 break; 307 case R_X86_64_32S: 308 case R_X86_64_TPOFF32: 309 case R_X86_64_GOT32: 310 case R_X86_64_GOTPC32: 311 case R_X86_64_GOTPCREL: 312 case R_X86_64_GOTPCRELX: 313 case R_X86_64_REX_GOTPCRELX: 314 case R_X86_64_PC32: 315 case R_X86_64_GOTTPOFF: 316 case R_X86_64_PLT32: 317 case R_X86_64_TLSGD: 318 case R_X86_64_TLSLD: 319 case R_X86_64_DTPOFF32: 320 case R_X86_64_SIZE32: 321 checkInt(Loc, Val, 32, Type); 322 write32le(Loc, Val); 323 break; 324 case R_X86_64_64: 325 case R_X86_64_DTPOFF64: 326 case R_X86_64_GLOB_DAT: 327 case R_X86_64_PC64: 328 case R_X86_64_SIZE64: 329 case R_X86_64_GOT64: 330 case R_X86_64_GOTOFF64: 331 case R_X86_64_GOTPC64: 332 write64le(Loc, Val); 333 break; 334 default: 335 error(getErrorLocation(Loc) + "unrecognized reloc " + Twine(Type)); 336 } 337 } 338 339 template <class ELFT> 340 RelExpr X86_64<ELFT>::adjustRelaxExpr(RelType Type, const uint8_t *Data, 341 RelExpr RelExpr) const { 342 if (Type != R_X86_64_GOTPCRELX && Type != R_X86_64_REX_GOTPCRELX) 343 return RelExpr; 344 const uint8_t Op = Data[-2]; 345 const uint8_t ModRm = Data[-1]; 346 347 // FIXME: When PIC is disabled and foo is defined locally in the 348 // lower 32 bit address space, memory operand in mov can be converted into 349 // immediate operand. Otherwise, mov must be changed to lea. We support only 350 // latter relaxation at this moment. 351 if (Op == 0x8b) 352 return R_RELAX_GOT_PC; 353 354 // Relax call and jmp. 355 if (Op == 0xff && (ModRm == 0x15 || ModRm == 0x25)) 356 return R_RELAX_GOT_PC; 357 358 // Relaxation of test, adc, add, and, cmp, or, sbb, sub, xor. 359 // If PIC then no relaxation is available. 360 // We also don't relax test/binop instructions without REX byte, 361 // they are 32bit operations and not common to have. 362 assert(Type == R_X86_64_REX_GOTPCRELX); 363 return Config->Pic ? RelExpr : R_RELAX_GOT_PC_NOPIC; 364 } 365 366 // A subset of relaxations can only be applied for no-PIC. This method 367 // handles such relaxations. Instructions encoding information was taken from: 368 // "Intel 64 and IA-32 Architectures Software Developer's Manual V2" 369 // (http://www.intel.com/content/dam/www/public/us/en/documents/manuals/ 370 // 64-ia-32-architectures-software-developer-instruction-set-reference-manual-325383.pdf) 371 template <class ELFT> 372 void X86_64<ELFT>::relaxGotNoPic(uint8_t *Loc, uint64_t Val, uint8_t Op, 373 uint8_t ModRm) const { 374 const uint8_t Rex = Loc[-3]; 375 // Convert "test %reg, foo@GOTPCREL(%rip)" to "test $foo, %reg". 376 if (Op == 0x85) { 377 // See "TEST-Logical Compare" (4-428 Vol. 2B), 378 // TEST r/m64, r64 uses "full" ModR / M byte (no opcode extension). 379 380 // ModR/M byte has form XX YYY ZZZ, where 381 // YYY is MODRM.reg(register 2), ZZZ is MODRM.rm(register 1). 382 // XX has different meanings: 383 // 00: The operand's memory address is in reg1. 384 // 01: The operand's memory address is reg1 + a byte-sized displacement. 385 // 10: The operand's memory address is reg1 + a word-sized displacement. 386 // 11: The operand is reg1 itself. 387 // If an instruction requires only one operand, the unused reg2 field 388 // holds extra opcode bits rather than a register code 389 // 0xC0 == 11 000 000 binary. 390 // 0x38 == 00 111 000 binary. 391 // We transfer reg2 to reg1 here as operand. 392 // See "2.1.3 ModR/M and SIB Bytes" (Vol. 2A 2-3). 393 Loc[-1] = 0xc0 | (ModRm & 0x38) >> 3; // ModR/M byte. 394 395 // Change opcode from TEST r/m64, r64 to TEST r/m64, imm32 396 // See "TEST-Logical Compare" (4-428 Vol. 2B). 397 Loc[-2] = 0xf7; 398 399 // Move R bit to the B bit in REX byte. 400 // REX byte is encoded as 0100WRXB, where 401 // 0100 is 4bit fixed pattern. 402 // REX.W When 1, a 64-bit operand size is used. Otherwise, when 0, the 403 // default operand size is used (which is 32-bit for most but not all 404 // instructions). 405 // REX.R This 1-bit value is an extension to the MODRM.reg field. 406 // REX.X This 1-bit value is an extension to the SIB.index field. 407 // REX.B This 1-bit value is an extension to the MODRM.rm field or the 408 // SIB.base field. 409 // See "2.2.1.2 More on REX Prefix Fields " (2-8 Vol. 2A). 410 Loc[-3] = (Rex & ~0x4) | (Rex & 0x4) >> 2; 411 write32le(Loc, Val); 412 return; 413 } 414 415 // If we are here then we need to relax the adc, add, and, cmp, or, sbb, sub 416 // or xor operations. 417 418 // Convert "binop foo@GOTPCREL(%rip), %reg" to "binop $foo, %reg". 419 // Logic is close to one for test instruction above, but we also 420 // write opcode extension here, see below for details. 421 Loc[-1] = 0xc0 | (ModRm & 0x38) >> 3 | (Op & 0x3c); // ModR/M byte. 422 423 // Primary opcode is 0x81, opcode extension is one of: 424 // 000b = ADD, 001b is OR, 010b is ADC, 011b is SBB, 425 // 100b is AND, 101b is SUB, 110b is XOR, 111b is CMP. 426 // This value was wrote to MODRM.reg in a line above. 427 // See "3.2 INSTRUCTIONS (A-M)" (Vol. 2A 3-15), 428 // "INSTRUCTION SET REFERENCE, N-Z" (Vol. 2B 4-1) for 429 // descriptions about each operation. 430 Loc[-2] = 0x81; 431 Loc[-3] = (Rex & ~0x4) | (Rex & 0x4) >> 2; 432 write32le(Loc, Val); 433 } 434 435 template <class ELFT> 436 void X86_64<ELFT>::relaxGot(uint8_t *Loc, uint64_t Val) const { 437 const uint8_t Op = Loc[-2]; 438 const uint8_t ModRm = Loc[-1]; 439 440 // Convert "mov foo@GOTPCREL(%rip),%reg" to "lea foo(%rip),%reg". 441 if (Op == 0x8b) { 442 Loc[-2] = 0x8d; 443 write32le(Loc, Val); 444 return; 445 } 446 447 if (Op != 0xff) { 448 // We are relaxing a rip relative to an absolute, so compensate 449 // for the old -4 addend. 450 assert(!Config->Pic); 451 relaxGotNoPic(Loc, Val + 4, Op, ModRm); 452 return; 453 } 454 455 // Convert call/jmp instructions. 456 if (ModRm == 0x15) { 457 // ABI says we can convert "call *foo@GOTPCREL(%rip)" to "nop; call foo". 458 // Instead we convert to "addr32 call foo" where addr32 is an instruction 459 // prefix. That makes result expression to be a single instruction. 460 Loc[-2] = 0x67; // addr32 prefix 461 Loc[-1] = 0xe8; // call 462 write32le(Loc, Val); 463 return; 464 } 465 466 // Convert "jmp *foo@GOTPCREL(%rip)" to "jmp foo; nop". 467 // jmp doesn't return, so it is fine to use nop here, it is just a stub. 468 assert(ModRm == 0x25); 469 Loc[-2] = 0xe9; // jmp 470 Loc[3] = 0x90; // nop 471 write32le(Loc - 1, Val + 1); 472 } 473 474 // This anonymous namespace works around a warning bug in 475 // old versions of gcc. See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=56480 476 namespace { 477 478 // A split-stack prologue starts by checking the amount of stack remaining 479 // in one of two ways: 480 // A) Comparing of the stack pointer to a field in the tcb. 481 // B) Or a load of a stack pointer offset with an lea to r10 or r11. 482 template <> 483 bool X86_64<ELF64LE>::adjustPrologueForCrossSplitStack(uint8_t *Loc, 484 uint8_t *End) const { 485 // Replace "cmp %fs:0x70,%rsp" and subsequent branch 486 // with "stc, nopl 0x0(%rax,%rax,1)" 487 if (Loc + 8 < End && memcmp(Loc, "\x64\x48\x3b\x24\x25", 4) == 0) { 488 memcpy(Loc, "\xf9\x0f\x1f\x84\x00\x00\x00\x00", 8); 489 return true; 490 } 491 492 // Adjust "lea -0x200(%rsp),%r10" to lea "-0x4200(%rsp),%r10" 493 if (Loc + 7 < End && memcmp(Loc, "\x4c\x8d\x94\x24\x00\xfe\xff", 7) == 0) { 494 memcpy(Loc, "\x4c\x8d\x94\x24\x00\xbe\xff", 7); 495 return true; 496 } 497 498 // Adjust "lea -0x200(%rsp),%r11" to lea "-0x4200(%rsp),%r11" 499 if (Loc + 7 < End && memcmp(Loc, "\x4c\x8d\x9c\x24\x00\xfe\xff", 7) == 0) { 500 memcpy(Loc, "\x4c\x8d\x9c\x24\x00\xbe\xff", 7); 501 return true; 502 } 503 return false; 504 } 505 506 template <> 507 bool X86_64<ELF32LE>::adjustPrologueForCrossSplitStack(uint8_t *Loc, 508 uint8_t *End) const { 509 llvm_unreachable("Target doesn't support split stacks."); 510 } 511 512 } // namespace 513 514 // These nonstandard PLT entries are to migtigate Spectre v2 security 515 // vulnerability. In order to mitigate Spectre v2, we want to avoid indirect 516 // branch instructions such as `jmp *GOTPLT(%rip)`. So, in the following PLT 517 // entries, we use a CALL followed by MOV and RET to do the same thing as an 518 // indirect jump. That instruction sequence is so-called "retpoline". 519 // 520 // We have two types of retpoline PLTs as a size optimization. If `-z now` 521 // is specified, all dynamic symbols are resolved at load-time. Thus, when 522 // that option is given, we can omit code for symbol lazy resolution. 523 namespace { 524 template <class ELFT> class Retpoline : public X86_64<ELFT> { 525 public: 526 Retpoline(); 527 void writeGotPlt(uint8_t *Buf, const Symbol &S) const override; 528 void writePltHeader(uint8_t *Buf) const override; 529 void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr, 530 int32_t Index, unsigned RelOff) const override; 531 }; 532 533 template <class ELFT> class RetpolineZNow : public X86_64<ELFT> { 534 public: 535 RetpolineZNow(); 536 void writeGotPlt(uint8_t *Buf, const Symbol &S) const override {} 537 void writePltHeader(uint8_t *Buf) const override; 538 void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr, 539 int32_t Index, unsigned RelOff) const override; 540 }; 541 } // namespace 542 543 template <class ELFT> Retpoline<ELFT>::Retpoline() { 544 TargetInfo::PltHeaderSize = 48; 545 TargetInfo::PltEntrySize = 32; 546 } 547 548 template <class ELFT> 549 void Retpoline<ELFT>::writeGotPlt(uint8_t *Buf, const Symbol &S) const { 550 write64le(Buf, S.getPltVA() + 17); 551 } 552 553 template <class ELFT> void Retpoline<ELFT>::writePltHeader(uint8_t *Buf) const { 554 const uint8_t Insn[] = { 555 0xff, 0x35, 0, 0, 0, 0, // 0: pushq GOTPLT+8(%rip) 556 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // 6: mov GOTPLT+16(%rip), %r11 557 0xe8, 0x0e, 0x00, 0x00, 0x00, // d: callq next 558 0xf3, 0x90, // 12: loop: pause 559 0x0f, 0xae, 0xe8, // 14: lfence 560 0xeb, 0xf9, // 17: jmp loop 561 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 19: int3; .align 16 562 0x4c, 0x89, 0x1c, 0x24, // 20: next: mov %r11, (%rsp) 563 0xc3, // 24: ret 564 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 25: int3; padding 565 0xcc, 0xcc, 0xcc, 0xcc, // 2c: int3; padding 566 }; 567 memcpy(Buf, Insn, sizeof(Insn)); 568 569 uint64_t GotPlt = InX::GotPlt->getVA(); 570 uint64_t Plt = InX::Plt->getVA(); 571 write32le(Buf + 2, GotPlt - Plt - 6 + 8); 572 write32le(Buf + 9, GotPlt - Plt - 13 + 16); 573 } 574 575 template <class ELFT> 576 void Retpoline<ELFT>::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, 577 uint64_t PltEntryAddr, int32_t Index, 578 unsigned RelOff) const { 579 const uint8_t Insn[] = { 580 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // 0: mov foo@GOTPLT(%rip), %r11 581 0xe8, 0, 0, 0, 0, // 7: callq plt+0x20 582 0xe9, 0, 0, 0, 0, // c: jmp plt+0x12 583 0x68, 0, 0, 0, 0, // 11: pushq <relocation index> 584 0xe9, 0, 0, 0, 0, // 16: jmp plt+0 585 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1b: int3; padding 586 }; 587 memcpy(Buf, Insn, sizeof(Insn)); 588 589 uint64_t Off = TargetInfo::getPltEntryOffset(Index); 590 591 write32le(Buf + 3, GotPltEntryAddr - PltEntryAddr - 7); 592 write32le(Buf + 8, -Off - 12 + 32); 593 write32le(Buf + 13, -Off - 17 + 18); 594 write32le(Buf + 18, Index); 595 write32le(Buf + 23, -Off - 27); 596 } 597 598 template <class ELFT> RetpolineZNow<ELFT>::RetpolineZNow() { 599 TargetInfo::PltHeaderSize = 32; 600 TargetInfo::PltEntrySize = 16; 601 } 602 603 template <class ELFT> 604 void RetpolineZNow<ELFT>::writePltHeader(uint8_t *Buf) const { 605 const uint8_t Insn[] = { 606 0xe8, 0x0b, 0x00, 0x00, 0x00, // 0: call next 607 0xf3, 0x90, // 5: loop: pause 608 0x0f, 0xae, 0xe8, // 7: lfence 609 0xeb, 0xf9, // a: jmp loop 610 0xcc, 0xcc, 0xcc, 0xcc, // c: int3; .align 16 611 0x4c, 0x89, 0x1c, 0x24, // 10: next: mov %r11, (%rsp) 612 0xc3, // 14: ret 613 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 15: int3; padding 614 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1a: int3; padding 615 0xcc, // 1f: int3; padding 616 }; 617 memcpy(Buf, Insn, sizeof(Insn)); 618 } 619 620 template <class ELFT> 621 void RetpolineZNow<ELFT>::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, 622 uint64_t PltEntryAddr, int32_t Index, 623 unsigned RelOff) const { 624 const uint8_t Insn[] = { 625 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // mov foo@GOTPLT(%rip), %r11 626 0xe9, 0, 0, 0, 0, // jmp plt+0 627 0xcc, 0xcc, 0xcc, 0xcc, // int3; padding 628 }; 629 memcpy(Buf, Insn, sizeof(Insn)); 630 631 write32le(Buf + 3, GotPltEntryAddr - PltEntryAddr - 7); 632 write32le(Buf + 8, -TargetInfo::getPltEntryOffset(Index) - 12); 633 } 634 635 template <class ELFT> static TargetInfo *getTargetInfo() { 636 if (Config->ZRetpolineplt) { 637 if (Config->ZNow) { 638 static RetpolineZNow<ELFT> T; 639 return &T; 640 } 641 static Retpoline<ELFT> T; 642 return &T; 643 } 644 645 static X86_64<ELFT> T; 646 return &T; 647 } 648 649 TargetInfo *elf::getX32TargetInfo() { return getTargetInfo<ELF32LE>(); } 650 TargetInfo *elf::getX86_64TargetInfo() { return getTargetInfo<ELF64LE>(); }