1 //===- X86.cpp ------------------------------------------------------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 9 #include "InputFiles.h" 10 #include "Symbols.h" 11 #include "SyntheticSections.h" 12 #include "Target.h" 13 #include "lld/Common/ErrorHandler.h" 14 #include "llvm/Support/Endian.h" 15 16 using namespace llvm; 17 using namespace llvm::support::endian; 18 using namespace llvm::ELF; 19 using namespace lld; 20 using namespace lld::elf; 21 22 namespace { 23 class X86 : public TargetInfo { 24 public: 25 X86(); 26 int getTlsGdRelaxSkip(RelType type) const override; 27 RelExpr getRelExpr(RelType type, const Symbol &s, 28 const uint8_t *loc) const override; 29 int64_t getImplicitAddend(const uint8_t *buf, RelType type) const override; 30 void writeGotPltHeader(uint8_t *buf) const override; 31 RelType getDynRel(RelType type) const override; 32 void writeGotPlt(uint8_t *buf, const Symbol &s) const override; 33 void writeIgotPlt(uint8_t *buf, const Symbol &s) const override; 34 void writePltHeader(uint8_t *buf) const override; 35 void writePlt(uint8_t *buf, const Symbol &sym, 36 uint64_t pltEntryAddr) const override; 37 void relocate(uint8_t *loc, const Relocation &rel, 38 uint64_t val) const override; 39 40 RelExpr adjustTlsExpr(RelType type, RelExpr expr) const override; 41 void relaxTlsGdToIe(uint8_t *loc, const Relocation &rel, 42 uint64_t val) const override; 43 void relaxTlsGdToLe(uint8_t *loc, const Relocation &rel, 44 uint64_t val) const override; 45 void relaxTlsIeToLe(uint8_t *loc, const Relocation &rel, 46 uint64_t val) const override; 47 void relaxTlsLdToLe(uint8_t *loc, const Relocation &rel, 48 uint64_t val) const override; 49 }; 50 } // namespace 51 52 X86::X86() { 53 copyRel = R_386_COPY; 54 gotRel = R_386_GLOB_DAT; 55 noneRel = R_386_NONE; 56 pltRel = R_386_JUMP_SLOT; 57 iRelativeRel = R_386_IRELATIVE; 58 relativeRel = R_386_RELATIVE; 59 symbolicRel = R_386_32; 60 tlsGotRel = R_386_TLS_TPOFF; 61 tlsModuleIndexRel = R_386_TLS_DTPMOD32; 62 tlsOffsetRel = R_386_TLS_DTPOFF32; 63 pltHeaderSize = 16; 64 pltEntrySize = 16; 65 ipltEntrySize = 16; 66 trapInstr = {0xcc, 0xcc, 0xcc, 0xcc}; // 0xcc = INT3 67 68 // Align to the non-PAE large page size (known as a superpage or huge page). 69 // FreeBSD automatically promotes large, superpage-aligned allocations. 70 defaultImageBase = 0x400000; 71 } 72 73 int X86::getTlsGdRelaxSkip(RelType type) const { 74 return 2; 75 } 76 77 RelExpr X86::getRelExpr(RelType type, const Symbol &s, 78 const uint8_t *loc) const { 79 // There are 4 different TLS variable models with varying degrees of 80 // flexibility and performance. LocalExec and InitialExec models are fast but 81 // less-flexible models. If they are in use, we set DF_STATIC_TLS flag in the 82 // dynamic section to let runtime know about that. 83 if (type == R_386_TLS_LE || type == R_386_TLS_LE_32 || type == R_386_TLS_IE || 84 type == R_386_TLS_GOTIE) 85 config->hasStaticTlsModel = true; 86 87 switch (type) { 88 case R_386_8: 89 case R_386_16: 90 case R_386_32: 91 return R_ABS; 92 case R_386_TLS_LDO_32: 93 return R_DTPREL; 94 case R_386_TLS_GD: 95 return R_TLSGD_GOTPLT; 96 case R_386_TLS_LDM: 97 return R_TLSLD_GOTPLT; 98 case R_386_PLT32: 99 return R_PLT_PC; 100 case R_386_PC8: 101 case R_386_PC16: 102 case R_386_PC32: 103 return R_PC; 104 case R_386_GOTPC: 105 return R_GOTPLTONLY_PC; 106 case R_386_TLS_IE: 107 return R_GOT; 108 case R_386_GOT32: 109 case R_386_GOT32X: 110 // These relocations are arguably mis-designed because their calculations 111 // depend on the instructions they are applied to. This is bad because we 112 // usually don't care about whether the target section contains valid 113 // machine instructions or not. But this is part of the documented ABI, so 114 // we had to implement as the standard requires. 115 // 116 // x86 does not support PC-relative data access. Therefore, in order to 117 // access GOT contents, a GOT address needs to be known at link-time 118 // (which means non-PIC) or compilers have to emit code to get a GOT 119 // address at runtime (which means code is position-independent but 120 // compilers need to emit extra code for each GOT access.) This decision 121 // is made at compile-time. In the latter case, compilers emit code to 122 // load a GOT address to a register, which is usually %ebx. 123 // 124 // So, there are two ways to refer to symbol foo's GOT entry: foo@GOT or 125 // foo@GOT(%ebx). 126 // 127 // foo@GOT is not usable in PIC. If we are creating a PIC output and if we 128 // find such relocation, we should report an error. foo@GOT is resolved to 129 // an *absolute* address of foo's GOT entry, because both GOT address and 130 // foo's offset are known. In other words, it's G + A. 131 // 132 // foo@GOT(%ebx) needs to be resolved to a *relative* offset from a GOT to 133 // foo's GOT entry in the table, because GOT address is not known but foo's 134 // offset in the table is known. It's G + A - GOT. 135 // 136 // It's unfortunate that compilers emit the same relocation for these 137 // different use cases. In order to distinguish them, we have to read a 138 // machine instruction. 139 // 140 // The following code implements it. We assume that Loc[0] is the first byte 141 // of a displacement or an immediate field of a valid machine 142 // instruction. That means a ModRM byte is at Loc[-1]. By taking a look at 143 // the byte, we can determine whether the instruction uses the operand as an 144 // absolute address (R_GOT) or a register-relative address (R_GOTPLT). 145 return (loc[-1] & 0xc7) == 0x5 ? R_GOT : R_GOTPLT; 146 case R_386_TLS_GOTIE: 147 return R_GOTPLT; 148 case R_386_GOTOFF: 149 return R_GOTPLTREL; 150 case R_386_TLS_LE: 151 return R_TPREL; 152 case R_386_TLS_LE_32: 153 return R_TPREL_NEG; 154 case R_386_NONE: 155 return R_NONE; 156 default: 157 error(getErrorLocation(loc) + "unknown relocation (" + Twine(type) + 158 ") against symbol " + toString(s)); 159 return R_NONE; 160 } 161 } 162 163 RelExpr X86::adjustTlsExpr(RelType type, RelExpr expr) const { 164 switch (expr) { 165 default: 166 return expr; 167 case R_RELAX_TLS_GD_TO_IE: 168 return R_RELAX_TLS_GD_TO_IE_GOTPLT; 169 case R_RELAX_TLS_GD_TO_LE: 170 return R_RELAX_TLS_GD_TO_LE_NEG; 171 } 172 } 173 174 void X86::writeGotPltHeader(uint8_t *buf) const { 175 write32le(buf, mainPart->dynamic->getVA()); 176 } 177 178 void X86::writeGotPlt(uint8_t *buf, const Symbol &s) const { 179 // Entries in .got.plt initially points back to the corresponding 180 // PLT entries with a fixed offset to skip the first instruction. 181 write32le(buf, s.getPltVA() + 6); 182 } 183 184 void X86::writeIgotPlt(uint8_t *buf, const Symbol &s) const { 185 // An x86 entry is the address of the ifunc resolver function. 186 write32le(buf, s.getVA()); 187 } 188 189 RelType X86::getDynRel(RelType type) const { 190 if (type == R_386_TLS_LE) 191 return R_386_TLS_TPOFF; 192 if (type == R_386_TLS_LE_32) 193 return R_386_TLS_TPOFF32; 194 return type; 195 } 196 197 void X86::writePltHeader(uint8_t *buf) const { 198 if (config->isPic) { 199 const uint8_t v[] = { 200 0xff, 0xb3, 0x04, 0x00, 0x00, 0x00, // pushl 4(%ebx) 201 0xff, 0xa3, 0x08, 0x00, 0x00, 0x00, // jmp *8(%ebx) 202 0x90, 0x90, 0x90, 0x90 // nop 203 }; 204 memcpy(buf, v, sizeof(v)); 205 return; 206 } 207 208 const uint8_t pltData[] = { 209 0xff, 0x35, 0, 0, 0, 0, // pushl (GOTPLT+4) 210 0xff, 0x25, 0, 0, 0, 0, // jmp *(GOTPLT+8) 211 0x90, 0x90, 0x90, 0x90, // nop 212 }; 213 memcpy(buf, pltData, sizeof(pltData)); 214 uint32_t gotPlt = in.gotPlt->getVA(); 215 write32le(buf + 2, gotPlt + 4); 216 write32le(buf + 8, gotPlt + 8); 217 } 218 219 void X86::writePlt(uint8_t *buf, const Symbol &sym, 220 uint64_t pltEntryAddr) const { 221 unsigned relOff = in.relaPlt->entsize * sym.pltIndex; 222 if (config->isPic) { 223 const uint8_t inst[] = { 224 0xff, 0xa3, 0, 0, 0, 0, // jmp *foo@GOT(%ebx) 225 0x68, 0, 0, 0, 0, // pushl $reloc_offset 226 0xe9, 0, 0, 0, 0, // jmp .PLT0@PC 227 }; 228 memcpy(buf, inst, sizeof(inst)); 229 write32le(buf + 2, sym.getGotPltVA() - in.gotPlt->getVA()); 230 } else { 231 const uint8_t inst[] = { 232 0xff, 0x25, 0, 0, 0, 0, // jmp *foo@GOT 233 0x68, 0, 0, 0, 0, // pushl $reloc_offset 234 0xe9, 0, 0, 0, 0, // jmp .PLT0@PC 235 }; 236 memcpy(buf, inst, sizeof(inst)); 237 write32le(buf + 2, sym.getGotPltVA()); 238 } 239 240 write32le(buf + 7, relOff); 241 write32le(buf + 12, in.plt->getVA() - pltEntryAddr - 16); 242 } 243 244 int64_t X86::getImplicitAddend(const uint8_t *buf, RelType type) const { 245 switch (type) { 246 case R_386_8: 247 case R_386_PC8: 248 return SignExtend64<8>(*buf); 249 case R_386_16: 250 case R_386_PC16: 251 return SignExtend64<16>(read16le(buf)); 252 case R_386_32: 253 case R_386_GLOB_DAT: 254 case R_386_GOT32: 255 case R_386_GOT32X: 256 case R_386_GOTOFF: 257 case R_386_GOTPC: 258 case R_386_IRELATIVE: 259 case R_386_PC32: 260 case R_386_PLT32: 261 case R_386_RELATIVE: 262 case R_386_TLS_DTPMOD32: 263 case R_386_TLS_DTPOFF32: 264 case R_386_TLS_LDO_32: 265 case R_386_TLS_LDM: 266 case R_386_TLS_IE: 267 case R_386_TLS_IE_32: 268 case R_386_TLS_LE: 269 case R_386_TLS_LE_32: 270 case R_386_TLS_GD: 271 case R_386_TLS_GD_32: 272 case R_386_TLS_GOTIE: 273 case R_386_TLS_TPOFF: 274 case R_386_TLS_TPOFF32: 275 return SignExtend64<32>(read32le(buf)); 276 case R_386_NONE: 277 case R_386_JUMP_SLOT: 278 // These relocations are defined as not having an implicit addend. 279 return 0; 280 default: 281 internalLinkerError(getErrorLocation(buf), 282 "cannot read addend for relocation " + toString(type)); 283 return 0; 284 } 285 } 286 287 void X86::relocate(uint8_t *loc, const Relocation &rel, uint64_t val) const { 288 switch (rel.type) { 289 case R_386_8: 290 // R_386_{PC,}{8,16} are not part of the i386 psABI, but they are 291 // being used for some 16-bit programs such as boot loaders, so 292 // we want to support them. 293 checkIntUInt(loc, val, 8, rel); 294 *loc = val; 295 break; 296 case R_386_PC8: 297 checkInt(loc, val, 8, rel); 298 *loc = val; 299 break; 300 case R_386_16: 301 checkIntUInt(loc, val, 16, rel); 302 write16le(loc, val); 303 break; 304 case R_386_PC16: 305 // R_386_PC16 is normally used with 16 bit code. In that situation 306 // the PC is 16 bits, just like the addend. This means that it can 307 // point from any 16 bit address to any other if the possibility 308 // of wrapping is included. 309 // The only restriction we have to check then is that the destination 310 // address fits in 16 bits. That is impossible to do here. The problem is 311 // that we are passed the final value, which already had the 312 // current location subtracted from it. 313 // We just check that Val fits in 17 bits. This misses some cases, but 314 // should have no false positives. 315 checkInt(loc, val, 17, rel); 316 write16le(loc, val); 317 break; 318 case R_386_32: 319 case R_386_GOT32: 320 case R_386_GOT32X: 321 case R_386_GOTOFF: 322 case R_386_GOTPC: 323 case R_386_PC32: 324 case R_386_PLT32: 325 case R_386_RELATIVE: 326 case R_386_TLS_DTPMOD32: 327 case R_386_TLS_DTPOFF32: 328 case R_386_TLS_GD: 329 case R_386_TLS_GOTIE: 330 case R_386_TLS_IE: 331 case R_386_TLS_LDM: 332 case R_386_TLS_LDO_32: 333 case R_386_TLS_LE: 334 case R_386_TLS_LE_32: 335 case R_386_TLS_TPOFF: 336 case R_386_TLS_TPOFF32: 337 checkInt(loc, val, 32, rel); 338 write32le(loc, val); 339 break; 340 default: 341 llvm_unreachable("unknown relocation"); 342 } 343 } 344 345 void X86::relaxTlsGdToLe(uint8_t *loc, const Relocation &, uint64_t val) const { 346 // Convert 347 // leal x@tlsgd(, %ebx, 1), 348 // call __tls_get_addr@plt 349 // to 350 // movl %gs:0,%eax 351 // subl $x@ntpoff,%eax 352 const uint8_t inst[] = { 353 0x65, 0xa1, 0x00, 0x00, 0x00, 0x00, // movl %gs:0, %eax 354 0x81, 0xe8, 0, 0, 0, 0, // subl Val(%ebx), %eax 355 }; 356 memcpy(loc - 3, inst, sizeof(inst)); 357 write32le(loc + 5, val); 358 } 359 360 void X86::relaxTlsGdToIe(uint8_t *loc, const Relocation &, uint64_t val) const { 361 // Convert 362 // leal x@tlsgd(, %ebx, 1), 363 // call __tls_get_addr@plt 364 // to 365 // movl %gs:0, %eax 366 // addl x@gotntpoff(%ebx), %eax 367 const uint8_t inst[] = { 368 0x65, 0xa1, 0x00, 0x00, 0x00, 0x00, // movl %gs:0, %eax 369 0x03, 0x83, 0, 0, 0, 0, // addl Val(%ebx), %eax 370 }; 371 memcpy(loc - 3, inst, sizeof(inst)); 372 write32le(loc + 5, val); 373 } 374 375 // In some conditions, relocations can be optimized to avoid using GOT. 376 // This function does that for Initial Exec to Local Exec case. 377 void X86::relaxTlsIeToLe(uint8_t *loc, const Relocation &rel, 378 uint64_t val) const { 379 // Ulrich's document section 6.2 says that @gotntpoff can 380 // be used with MOVL or ADDL instructions. 381 // @indntpoff is similar to @gotntpoff, but for use in 382 // position dependent code. 383 uint8_t reg = (loc[-1] >> 3) & 7; 384 385 if (rel.type == R_386_TLS_IE) { 386 if (loc[-1] == 0xa1) { 387 // "movl foo@indntpoff,%eax" -> "movl $foo,%eax" 388 // This case is different from the generic case below because 389 // this is a 5 byte instruction while below is 6 bytes. 390 loc[-1] = 0xb8; 391 } else if (loc[-2] == 0x8b) { 392 // "movl foo@indntpoff,%reg" -> "movl $foo,%reg" 393 loc[-2] = 0xc7; 394 loc[-1] = 0xc0 | reg; 395 } else { 396 // "addl foo@indntpoff,%reg" -> "addl $foo,%reg" 397 loc[-2] = 0x81; 398 loc[-1] = 0xc0 | reg; 399 } 400 } else { 401 assert(rel.type == R_386_TLS_GOTIE); 402 if (loc[-2] == 0x8b) { 403 // "movl foo@gottpoff(%rip),%reg" -> "movl $foo,%reg" 404 loc[-2] = 0xc7; 405 loc[-1] = 0xc0 | reg; 406 } else { 407 // "addl foo@gotntpoff(%rip),%reg" -> "leal foo(%reg),%reg" 408 loc[-2] = 0x8d; 409 loc[-1] = 0x80 | (reg << 3) | reg; 410 } 411 } 412 write32le(loc, val); 413 } 414 415 void X86::relaxTlsLdToLe(uint8_t *loc, const Relocation &rel, 416 uint64_t val) const { 417 if (rel.type == R_386_TLS_LDO_32) { 418 write32le(loc, val); 419 return; 420 } 421 422 // Convert 423 // leal foo(%reg),%eax 424 // call ___tls_get_addr 425 // to 426 // movl %gs:0,%eax 427 // nop 428 // leal 0(%esi,1),%esi 429 const uint8_t inst[] = { 430 0x65, 0xa1, 0x00, 0x00, 0x00, 0x00, // movl %gs:0,%eax 431 0x90, // nop 432 0x8d, 0x74, 0x26, 0x00, // leal 0(%esi,1),%esi 433 }; 434 memcpy(loc - 2, inst, sizeof(inst)); 435 } 436 437 // If Intel Indirect Branch Tracking is enabled, we have to emit special PLT 438 // entries containing endbr32 instructions. A PLT entry will be split into two 439 // parts, one in .plt.sec (writePlt), and the other in .plt (writeIBTPlt). 440 namespace { 441 class IntelIBT : public X86 { 442 public: 443 IntelIBT(); 444 void writeGotPlt(uint8_t *buf, const Symbol &s) const override; 445 void writePlt(uint8_t *buf, const Symbol &sym, 446 uint64_t pltEntryAddr) const override; 447 void writeIBTPlt(uint8_t *buf, size_t numEntries) const override; 448 449 static const unsigned IBTPltHeaderSize = 16; 450 }; 451 } // namespace 452 453 IntelIBT::IntelIBT() { pltHeaderSize = 0; } 454 455 void IntelIBT::writeGotPlt(uint8_t *buf, const Symbol &s) const { 456 uint64_t va = 457 in.ibtPlt->getVA() + IBTPltHeaderSize + s.pltIndex * pltEntrySize; 458 write32le(buf, va); 459 } 460 461 void IntelIBT::writePlt(uint8_t *buf, const Symbol &sym, 462 uint64_t /*pltEntryAddr*/) const { 463 if (config->isPic) { 464 const uint8_t inst[] = { 465 0xf3, 0x0f, 0x1e, 0xfb, // endbr32 466 0xff, 0xa3, 0, 0, 0, 0, // jmp *name@GOT(%ebx) 467 0x66, 0x0f, 0x1f, 0x44, 0, 0, // nop 468 }; 469 memcpy(buf, inst, sizeof(inst)); 470 write32le(buf + 6, sym.getGotPltVA() - in.gotPlt->getVA()); 471 return; 472 } 473 474 const uint8_t inst[] = { 475 0xf3, 0x0f, 0x1e, 0xfb, // endbr32 476 0xff, 0x25, 0, 0, 0, 0, // jmp *foo@GOT 477 0x66, 0x0f, 0x1f, 0x44, 0, 0, // nop 478 }; 479 memcpy(buf, inst, sizeof(inst)); 480 write32le(buf + 6, sym.getGotPltVA()); 481 } 482 483 void IntelIBT::writeIBTPlt(uint8_t *buf, size_t numEntries) const { 484 writePltHeader(buf); 485 buf += IBTPltHeaderSize; 486 487 const uint8_t inst[] = { 488 0xf3, 0x0f, 0x1e, 0xfb, // endbr32 489 0x68, 0, 0, 0, 0, // pushl $reloc_offset 490 0xe9, 0, 0, 0, 0, // jmpq .PLT0@PC 491 0x66, 0x90, // nop 492 }; 493 494 for (size_t i = 0; i < numEntries; ++i) { 495 memcpy(buf, inst, sizeof(inst)); 496 write32le(buf + 5, i * sizeof(object::ELF32LE::Rel)); 497 write32le(buf + 10, -pltHeaderSize - sizeof(inst) * i - 30); 498 buf += sizeof(inst); 499 } 500 } 501 502 namespace { 503 class RetpolinePic : public X86 { 504 public: 505 RetpolinePic(); 506 void writeGotPlt(uint8_t *buf, const Symbol &s) const override; 507 void writePltHeader(uint8_t *buf) const override; 508 void writePlt(uint8_t *buf, const Symbol &sym, 509 uint64_t pltEntryAddr) const override; 510 }; 511 512 class RetpolineNoPic : public X86 { 513 public: 514 RetpolineNoPic(); 515 void writeGotPlt(uint8_t *buf, const Symbol &s) const override; 516 void writePltHeader(uint8_t *buf) const override; 517 void writePlt(uint8_t *buf, const Symbol &sym, 518 uint64_t pltEntryAddr) const override; 519 }; 520 } // namespace 521 522 RetpolinePic::RetpolinePic() { 523 pltHeaderSize = 48; 524 pltEntrySize = 32; 525 ipltEntrySize = 32; 526 } 527 528 void RetpolinePic::writeGotPlt(uint8_t *buf, const Symbol &s) const { 529 write32le(buf, s.getPltVA() + 17); 530 } 531 532 void RetpolinePic::writePltHeader(uint8_t *buf) const { 533 const uint8_t insn[] = { 534 0xff, 0xb3, 4, 0, 0, 0, // 0: pushl 4(%ebx) 535 0x50, // 6: pushl %eax 536 0x8b, 0x83, 8, 0, 0, 0, // 7: mov 8(%ebx), %eax 537 0xe8, 0x0e, 0x00, 0x00, 0x00, // d: call next 538 0xf3, 0x90, // 12: loop: pause 539 0x0f, 0xae, 0xe8, // 14: lfence 540 0xeb, 0xf9, // 17: jmp loop 541 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 19: int3; .align 16 542 0x89, 0x0c, 0x24, // 20: next: mov %ecx, (%esp) 543 0x8b, 0x4c, 0x24, 0x04, // 23: mov 0x4(%esp), %ecx 544 0x89, 0x44, 0x24, 0x04, // 27: mov %eax ,0x4(%esp) 545 0x89, 0xc8, // 2b: mov %ecx, %eax 546 0x59, // 2d: pop %ecx 547 0xc3, // 2e: ret 548 0xcc, // 2f: int3; padding 549 }; 550 memcpy(buf, insn, sizeof(insn)); 551 } 552 553 void RetpolinePic::writePlt(uint8_t *buf, const Symbol &sym, 554 uint64_t pltEntryAddr) const { 555 unsigned relOff = in.relaPlt->entsize * sym.pltIndex; 556 const uint8_t insn[] = { 557 0x50, // pushl %eax 558 0x8b, 0x83, 0, 0, 0, 0, // mov foo@GOT(%ebx), %eax 559 0xe8, 0, 0, 0, 0, // call plt+0x20 560 0xe9, 0, 0, 0, 0, // jmp plt+0x12 561 0x68, 0, 0, 0, 0, // pushl $reloc_offset 562 0xe9, 0, 0, 0, 0, // jmp plt+0 563 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // int3; padding 564 }; 565 memcpy(buf, insn, sizeof(insn)); 566 567 uint32_t ebx = in.gotPlt->getVA(); 568 unsigned off = pltEntryAddr - in.plt->getVA(); 569 write32le(buf + 3, sym.getGotPltVA() - ebx); 570 write32le(buf + 8, -off - 12 + 32); 571 write32le(buf + 13, -off - 17 + 18); 572 write32le(buf + 18, relOff); 573 write32le(buf + 23, -off - 27); 574 } 575 576 RetpolineNoPic::RetpolineNoPic() { 577 pltHeaderSize = 48; 578 pltEntrySize = 32; 579 ipltEntrySize = 32; 580 } 581 582 void RetpolineNoPic::writeGotPlt(uint8_t *buf, const Symbol &s) const { 583 write32le(buf, s.getPltVA() + 16); 584 } 585 586 void RetpolineNoPic::writePltHeader(uint8_t *buf) const { 587 const uint8_t insn[] = { 588 0xff, 0x35, 0, 0, 0, 0, // 0: pushl GOTPLT+4 589 0x50, // 6: pushl %eax 590 0xa1, 0, 0, 0, 0, // 7: mov GOTPLT+8, %eax 591 0xe8, 0x0f, 0x00, 0x00, 0x00, // c: call next 592 0xf3, 0x90, // 11: loop: pause 593 0x0f, 0xae, 0xe8, // 13: lfence 594 0xeb, 0xf9, // 16: jmp loop 595 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 18: int3 596 0xcc, 0xcc, 0xcc, // 1f: int3; .align 16 597 0x89, 0x0c, 0x24, // 20: next: mov %ecx, (%esp) 598 0x8b, 0x4c, 0x24, 0x04, // 23: mov 0x4(%esp), %ecx 599 0x89, 0x44, 0x24, 0x04, // 27: mov %eax ,0x4(%esp) 600 0x89, 0xc8, // 2b: mov %ecx, %eax 601 0x59, // 2d: pop %ecx 602 0xc3, // 2e: ret 603 0xcc, // 2f: int3; padding 604 }; 605 memcpy(buf, insn, sizeof(insn)); 606 607 uint32_t gotPlt = in.gotPlt->getVA(); 608 write32le(buf + 2, gotPlt + 4); 609 write32le(buf + 8, gotPlt + 8); 610 } 611 612 void RetpolineNoPic::writePlt(uint8_t *buf, const Symbol &sym, 613 uint64_t pltEntryAddr) const { 614 unsigned relOff = in.relaPlt->entsize * sym.pltIndex; 615 const uint8_t insn[] = { 616 0x50, // 0: pushl %eax 617 0xa1, 0, 0, 0, 0, // 1: mov foo_in_GOT, %eax 618 0xe8, 0, 0, 0, 0, // 6: call plt+0x20 619 0xe9, 0, 0, 0, 0, // b: jmp plt+0x11 620 0x68, 0, 0, 0, 0, // 10: pushl $reloc_offset 621 0xe9, 0, 0, 0, 0, // 15: jmp plt+0 622 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1a: int3; padding 623 0xcc, // 1f: int3; padding 624 }; 625 memcpy(buf, insn, sizeof(insn)); 626 627 unsigned off = pltEntryAddr - in.plt->getVA(); 628 write32le(buf + 2, sym.getGotPltVA()); 629 write32le(buf + 7, -off - 11 + 32); 630 write32le(buf + 12, -off - 16 + 17); 631 write32le(buf + 17, relOff); 632 write32le(buf + 22, -off - 26); 633 } 634 635 TargetInfo *elf::getX86TargetInfo() { 636 if (config->zRetpolineplt) { 637 if (config->isPic) { 638 static RetpolinePic t; 639 return &t; 640 } 641 static RetpolineNoPic t; 642 return &t; 643 } 644 645 if (config->andFeatures & GNU_PROPERTY_X86_FEATURE_1_IBT) { 646 static IntelIBT t; 647 return &t; 648 } 649 650 static X86 t; 651 return &t; 652 } 653