10b57cec5SDimitry Andric //===- X86_64.cpp ---------------------------------------------------------===// 20b57cec5SDimitry Andric // 30b57cec5SDimitry Andric // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 40b57cec5SDimitry Andric // See https://llvm.org/LICENSE.txt for license information. 50b57cec5SDimitry Andric // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 60b57cec5SDimitry Andric // 70b57cec5SDimitry Andric //===----------------------------------------------------------------------===// 80b57cec5SDimitry Andric 95ffd83dbSDimitry Andric #include "OutputSections.h" 105f757f3fSDimitry Andric #include "Relocations.h" 110b57cec5SDimitry Andric #include "Symbols.h" 120b57cec5SDimitry Andric #include "SyntheticSections.h" 130b57cec5SDimitry Andric #include "Target.h" 140b57cec5SDimitry Andric #include "lld/Common/ErrorHandler.h" 1581ad6265SDimitry Andric #include "llvm/BinaryFormat/ELF.h" 160b57cec5SDimitry Andric #include "llvm/Support/Endian.h" 175f757f3fSDimitry Andric #include "llvm/Support/MathExtras.h" 180b57cec5SDimitry Andric 190b57cec5SDimitry Andric using namespace llvm; 200b57cec5SDimitry Andric using namespace llvm::object; 210b57cec5SDimitry Andric using namespace llvm::support::endian; 220b57cec5SDimitry Andric using namespace llvm::ELF; 235ffd83dbSDimitry Andric using namespace lld; 245ffd83dbSDimitry Andric using namespace lld::elf; 250b57cec5SDimitry Andric 260b57cec5SDimitry Andric namespace { 270b57cec5SDimitry Andric class X86_64 : public TargetInfo { 280b57cec5SDimitry Andric public: 290b57cec5SDimitry Andric X86_64(); 300b57cec5SDimitry Andric int getTlsGdRelaxSkip(RelType type) const override; 310b57cec5SDimitry Andric RelExpr getRelExpr(RelType type, const Symbol &s, 320b57cec5SDimitry Andric const uint8_t *loc) const override; 330b57cec5SDimitry Andric RelType getDynRel(RelType type) const override; 340b57cec5SDimitry Andric void writeGotPltHeader(uint8_t *buf) const override; 350b57cec5SDimitry Andric void writeGotPlt(uint8_t *buf, const Symbol &s) const override; 36fe6060f1SDimitry Andric void writeIgotPlt(uint8_t *buf, const Symbol &s) const override; 370b57cec5SDimitry Andric void writePltHeader(uint8_t *buf) const override; 38480093f4SDimitry Andric void writePlt(uint8_t *buf, const Symbol &sym, 39480093f4SDimitry Andric uint64_t pltEntryAddr) const override; 405ffd83dbSDimitry Andric void relocate(uint8_t *loc, const Relocation &rel, 415ffd83dbSDimitry Andric uint64_t val) const override; 42fe6060f1SDimitry Andric int64_t getImplicitAddend(const uint8_t *buf, RelType type) const override; 435ffd83dbSDimitry Andric void applyJumpInstrMod(uint8_t *loc, JumpModType type, 445ffd83dbSDimitry Andric unsigned size) const override; 45e8d8bef9SDimitry Andric RelExpr adjustGotPcExpr(RelType type, int64_t addend, 46e8d8bef9SDimitry Andric const uint8_t *loc) const override; 47bdd1243dSDimitry Andric void relocateAlloc(InputSectionBase &sec, uint8_t *buf) const override; 480b57cec5SDimitry Andric bool adjustPrologueForCrossSplitStack(uint8_t *loc, uint8_t *end, 490b57cec5SDimitry Andric uint8_t stOther) const override; 505ffd83dbSDimitry Andric bool deleteFallThruJmpInsn(InputSection &is, InputFile *file, 515ffd83dbSDimitry Andric InputSection *nextIS) const override; 525f757f3fSDimitry Andric bool relaxOnce(int pass) const override; 530b57cec5SDimitry Andric }; 540b57cec5SDimitry Andric } // namespace 550b57cec5SDimitry Andric 565ffd83dbSDimitry Andric // This is vector of NOP instructions of sizes from 1 to 8 bytes. The 575ffd83dbSDimitry Andric // appropriately sized instructions are used to fill the gaps between sections 585ffd83dbSDimitry Andric // which are executed during fall through. 595ffd83dbSDimitry Andric static const std::vector<std::vector<uint8_t>> nopInstructions = { 605ffd83dbSDimitry Andric {0x90}, 615ffd83dbSDimitry Andric {0x66, 0x90}, 625ffd83dbSDimitry Andric {0x0f, 0x1f, 0x00}, 635ffd83dbSDimitry Andric {0x0f, 0x1f, 0x40, 0x00}, 645ffd83dbSDimitry Andric {0x0f, 0x1f, 0x44, 0x00, 0x00}, 655ffd83dbSDimitry Andric {0x66, 0x0f, 0x1f, 0x44, 0x00, 0x00}, 665ffd83dbSDimitry Andric {0x0F, 0x1F, 0x80, 0x00, 0x00, 0x00, 0x00}, 675ffd83dbSDimitry Andric {0x0F, 0x1F, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00}, 685ffd83dbSDimitry Andric {0x66, 0x0F, 0x1F, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00}}; 695ffd83dbSDimitry Andric 700b57cec5SDimitry Andric X86_64::X86_64() { 710b57cec5SDimitry Andric copyRel = R_X86_64_COPY; 720b57cec5SDimitry Andric gotRel = R_X86_64_GLOB_DAT; 730b57cec5SDimitry Andric pltRel = R_X86_64_JUMP_SLOT; 740b57cec5SDimitry Andric relativeRel = R_X86_64_RELATIVE; 750b57cec5SDimitry Andric iRelativeRel = R_X86_64_IRELATIVE; 760b57cec5SDimitry Andric symbolicRel = R_X86_64_64; 770b57cec5SDimitry Andric tlsDescRel = R_X86_64_TLSDESC; 780b57cec5SDimitry Andric tlsGotRel = R_X86_64_TPOFF64; 790b57cec5SDimitry Andric tlsModuleIndexRel = R_X86_64_DTPMOD64; 800b57cec5SDimitry Andric tlsOffsetRel = R_X86_64_DTPOFF64; 81349cc55cSDimitry Andric gotBaseSymInGotPlt = true; 82fe6060f1SDimitry Andric gotEntrySize = 8; 830b57cec5SDimitry Andric pltHeaderSize = 16; 84480093f4SDimitry Andric pltEntrySize = 16; 85480093f4SDimitry Andric ipltEntrySize = 16; 860b57cec5SDimitry Andric trapInstr = {0xcc, 0xcc, 0xcc, 0xcc}; // 0xcc = INT3 875ffd83dbSDimitry Andric nopInstrs = nopInstructions; 880b57cec5SDimitry Andric 890b57cec5SDimitry Andric // Align to the large page size (known as a superpage or huge page). 900b57cec5SDimitry Andric // FreeBSD automatically promotes large, superpage-aligned allocations. 910b57cec5SDimitry Andric defaultImageBase = 0x200000; 920b57cec5SDimitry Andric } 930b57cec5SDimitry Andric 944824e7fdSDimitry Andric int X86_64::getTlsGdRelaxSkip(RelType type) const { 954824e7fdSDimitry Andric // TLSDESC relocations are processed separately. See relaxTlsGdToLe below. 964824e7fdSDimitry Andric return type == R_X86_64_GOTPC32_TLSDESC || type == R_X86_64_TLSDESC_CALL ? 1 974824e7fdSDimitry Andric : 2; 984824e7fdSDimitry Andric } 990b57cec5SDimitry Andric 1005ffd83dbSDimitry Andric // Opcodes for the different X86_64 jmp instructions. 1015ffd83dbSDimitry Andric enum JmpInsnOpcode : uint32_t { 1025ffd83dbSDimitry Andric J_JMP_32, 1035ffd83dbSDimitry Andric J_JNE_32, 1045ffd83dbSDimitry Andric J_JE_32, 1055ffd83dbSDimitry Andric J_JG_32, 1065ffd83dbSDimitry Andric J_JGE_32, 1075ffd83dbSDimitry Andric J_JB_32, 1085ffd83dbSDimitry Andric J_JBE_32, 1095ffd83dbSDimitry Andric J_JL_32, 1105ffd83dbSDimitry Andric J_JLE_32, 1115ffd83dbSDimitry Andric J_JA_32, 1125ffd83dbSDimitry Andric J_JAE_32, 1135ffd83dbSDimitry Andric J_UNKNOWN, 1145ffd83dbSDimitry Andric }; 1155ffd83dbSDimitry Andric 1165ffd83dbSDimitry Andric // Given the first (optional) and second byte of the insn's opcode, this 1175ffd83dbSDimitry Andric // returns the corresponding enum value. 1185ffd83dbSDimitry Andric static JmpInsnOpcode getJmpInsnType(const uint8_t *first, 1195ffd83dbSDimitry Andric const uint8_t *second) { 1205ffd83dbSDimitry Andric if (*second == 0xe9) 1215ffd83dbSDimitry Andric return J_JMP_32; 1225ffd83dbSDimitry Andric 1235ffd83dbSDimitry Andric if (first == nullptr) 1245ffd83dbSDimitry Andric return J_UNKNOWN; 1255ffd83dbSDimitry Andric 1265ffd83dbSDimitry Andric if (*first == 0x0f) { 1275ffd83dbSDimitry Andric switch (*second) { 1285ffd83dbSDimitry Andric case 0x84: 1295ffd83dbSDimitry Andric return J_JE_32; 1305ffd83dbSDimitry Andric case 0x85: 1315ffd83dbSDimitry Andric return J_JNE_32; 1325ffd83dbSDimitry Andric case 0x8f: 1335ffd83dbSDimitry Andric return J_JG_32; 1345ffd83dbSDimitry Andric case 0x8d: 1355ffd83dbSDimitry Andric return J_JGE_32; 1365ffd83dbSDimitry Andric case 0x82: 1375ffd83dbSDimitry Andric return J_JB_32; 1385ffd83dbSDimitry Andric case 0x86: 1395ffd83dbSDimitry Andric return J_JBE_32; 1405ffd83dbSDimitry Andric case 0x8c: 1415ffd83dbSDimitry Andric return J_JL_32; 1425ffd83dbSDimitry Andric case 0x8e: 1435ffd83dbSDimitry Andric return J_JLE_32; 1445ffd83dbSDimitry Andric case 0x87: 1455ffd83dbSDimitry Andric return J_JA_32; 1465ffd83dbSDimitry Andric case 0x83: 1475ffd83dbSDimitry Andric return J_JAE_32; 1485ffd83dbSDimitry Andric } 1495ffd83dbSDimitry Andric } 1505ffd83dbSDimitry Andric return J_UNKNOWN; 1515ffd83dbSDimitry Andric } 1525ffd83dbSDimitry Andric 1535ffd83dbSDimitry Andric // Return the relocation index for input section IS with a specific Offset. 1545ffd83dbSDimitry Andric // Returns the maximum size of the vector if no such relocation is found. 1555ffd83dbSDimitry Andric static unsigned getRelocationWithOffset(const InputSection &is, 1565ffd83dbSDimitry Andric uint64_t offset) { 157bdd1243dSDimitry Andric unsigned size = is.relocs().size(); 1585ffd83dbSDimitry Andric for (unsigned i = size - 1; i + 1 > 0; --i) { 159bdd1243dSDimitry Andric if (is.relocs()[i].offset == offset && is.relocs()[i].expr != R_NONE) 1605ffd83dbSDimitry Andric return i; 1615ffd83dbSDimitry Andric } 1625ffd83dbSDimitry Andric return size; 1635ffd83dbSDimitry Andric } 1645ffd83dbSDimitry Andric 1655ffd83dbSDimitry Andric // Returns true if R corresponds to a relocation used for a jump instruction. 1665ffd83dbSDimitry Andric // TODO: Once special relocations for relaxable jump instructions are available, 1675ffd83dbSDimitry Andric // this should be modified to use those relocations. 1685ffd83dbSDimitry Andric static bool isRelocationForJmpInsn(Relocation &R) { 1695ffd83dbSDimitry Andric return R.type == R_X86_64_PLT32 || R.type == R_X86_64_PC32 || 1705ffd83dbSDimitry Andric R.type == R_X86_64_PC8; 1715ffd83dbSDimitry Andric } 1725ffd83dbSDimitry Andric 1735ffd83dbSDimitry Andric // Return true if Relocation R points to the first instruction in the 1745ffd83dbSDimitry Andric // next section. 1755ffd83dbSDimitry Andric // TODO: Delete this once psABI reserves a new relocation type for fall thru 1765ffd83dbSDimitry Andric // jumps. 1775ffd83dbSDimitry Andric static bool isFallThruRelocation(InputSection &is, InputFile *file, 1785ffd83dbSDimitry Andric InputSection *nextIS, Relocation &r) { 1795ffd83dbSDimitry Andric if (!isRelocationForJmpInsn(r)) 1805ffd83dbSDimitry Andric return false; 1815ffd83dbSDimitry Andric 1825ffd83dbSDimitry Andric uint64_t addrLoc = is.getOutputSection()->addr + is.outSecOff + r.offset; 1835ffd83dbSDimitry Andric uint64_t targetOffset = InputSectionBase::getRelocTargetVA( 1845ffd83dbSDimitry Andric file, r.type, r.addend, addrLoc, *r.sym, r.expr); 1855ffd83dbSDimitry Andric 1865ffd83dbSDimitry Andric // If this jmp is a fall thru, the target offset is the beginning of the 1875ffd83dbSDimitry Andric // next section. 1885ffd83dbSDimitry Andric uint64_t nextSectionOffset = 1895ffd83dbSDimitry Andric nextIS->getOutputSection()->addr + nextIS->outSecOff; 1905ffd83dbSDimitry Andric return (addrLoc + 4 + targetOffset) == nextSectionOffset; 1915ffd83dbSDimitry Andric } 1925ffd83dbSDimitry Andric 1935ffd83dbSDimitry Andric // Return the jmp instruction opcode that is the inverse of the given 1945ffd83dbSDimitry Andric // opcode. For example, JE inverted is JNE. 1955ffd83dbSDimitry Andric static JmpInsnOpcode invertJmpOpcode(const JmpInsnOpcode opcode) { 1965ffd83dbSDimitry Andric switch (opcode) { 1975ffd83dbSDimitry Andric case J_JE_32: 1985ffd83dbSDimitry Andric return J_JNE_32; 1995ffd83dbSDimitry Andric case J_JNE_32: 2005ffd83dbSDimitry Andric return J_JE_32; 2015ffd83dbSDimitry Andric case J_JG_32: 2025ffd83dbSDimitry Andric return J_JLE_32; 2035ffd83dbSDimitry Andric case J_JGE_32: 2045ffd83dbSDimitry Andric return J_JL_32; 2055ffd83dbSDimitry Andric case J_JB_32: 2065ffd83dbSDimitry Andric return J_JAE_32; 2075ffd83dbSDimitry Andric case J_JBE_32: 2085ffd83dbSDimitry Andric return J_JA_32; 2095ffd83dbSDimitry Andric case J_JL_32: 2105ffd83dbSDimitry Andric return J_JGE_32; 2115ffd83dbSDimitry Andric case J_JLE_32: 2125ffd83dbSDimitry Andric return J_JG_32; 2135ffd83dbSDimitry Andric case J_JA_32: 2145ffd83dbSDimitry Andric return J_JBE_32; 2155ffd83dbSDimitry Andric case J_JAE_32: 2165ffd83dbSDimitry Andric return J_JB_32; 2175ffd83dbSDimitry Andric default: 2185ffd83dbSDimitry Andric return J_UNKNOWN; 2195ffd83dbSDimitry Andric } 2205ffd83dbSDimitry Andric } 2215ffd83dbSDimitry Andric 2225ffd83dbSDimitry Andric // Deletes direct jump instruction in input sections that jumps to the 2235ffd83dbSDimitry Andric // following section as it is not required. If there are two consecutive jump 2245ffd83dbSDimitry Andric // instructions, it checks if they can be flipped and one can be deleted. 2255ffd83dbSDimitry Andric // For example: 2265ffd83dbSDimitry Andric // .section .text 2275ffd83dbSDimitry Andric // a.BB.foo: 2285ffd83dbSDimitry Andric // ... 2295ffd83dbSDimitry Andric // 10: jne aa.BB.foo 2305ffd83dbSDimitry Andric // 16: jmp bar 2315ffd83dbSDimitry Andric // aa.BB.foo: 2325ffd83dbSDimitry Andric // ... 2335ffd83dbSDimitry Andric // 2345ffd83dbSDimitry Andric // can be converted to: 2355ffd83dbSDimitry Andric // a.BB.foo: 2365ffd83dbSDimitry Andric // ... 2375ffd83dbSDimitry Andric // 10: je bar #jne flipped to je and the jmp is deleted. 2385ffd83dbSDimitry Andric // aa.BB.foo: 2395ffd83dbSDimitry Andric // ... 2405ffd83dbSDimitry Andric bool X86_64::deleteFallThruJmpInsn(InputSection &is, InputFile *file, 2415ffd83dbSDimitry Andric InputSection *nextIS) const { 2425ffd83dbSDimitry Andric const unsigned sizeOfDirectJmpInsn = 5; 2435ffd83dbSDimitry Andric 2445ffd83dbSDimitry Andric if (nextIS == nullptr) 2455ffd83dbSDimitry Andric return false; 2465ffd83dbSDimitry Andric 2475ffd83dbSDimitry Andric if (is.getSize() < sizeOfDirectJmpInsn) 2485ffd83dbSDimitry Andric return false; 2495ffd83dbSDimitry Andric 2505ffd83dbSDimitry Andric // If this jmp insn can be removed, it is the last insn and the 2515ffd83dbSDimitry Andric // relocation is 4 bytes before the end. 2525ffd83dbSDimitry Andric unsigned rIndex = getRelocationWithOffset(is, is.getSize() - 4); 253bdd1243dSDimitry Andric if (rIndex == is.relocs().size()) 2545ffd83dbSDimitry Andric return false; 2555ffd83dbSDimitry Andric 256bdd1243dSDimitry Andric Relocation &r = is.relocs()[rIndex]; 2575ffd83dbSDimitry Andric 2585ffd83dbSDimitry Andric // Check if the relocation corresponds to a direct jmp. 259bdd1243dSDimitry Andric const uint8_t *secContents = is.content().data(); 2605ffd83dbSDimitry Andric // If it is not a direct jmp instruction, there is nothing to do here. 2615ffd83dbSDimitry Andric if (*(secContents + r.offset - 1) != 0xe9) 2625ffd83dbSDimitry Andric return false; 2635ffd83dbSDimitry Andric 2645ffd83dbSDimitry Andric if (isFallThruRelocation(is, file, nextIS, r)) { 2655ffd83dbSDimitry Andric // This is a fall thru and can be deleted. 2665ffd83dbSDimitry Andric r.expr = R_NONE; 2675ffd83dbSDimitry Andric r.offset = 0; 2685ffd83dbSDimitry Andric is.drop_back(sizeOfDirectJmpInsn); 2695ffd83dbSDimitry Andric is.nopFiller = true; 2705ffd83dbSDimitry Andric return true; 2715ffd83dbSDimitry Andric } 2725ffd83dbSDimitry Andric 2735ffd83dbSDimitry Andric // Now, check if flip and delete is possible. 2745ffd83dbSDimitry Andric const unsigned sizeOfJmpCCInsn = 6; 2755ffd83dbSDimitry Andric // To flip, there must be at least one JmpCC and one direct jmp. 2765ffd83dbSDimitry Andric if (is.getSize() < sizeOfDirectJmpInsn + sizeOfJmpCCInsn) 27704eeddc0SDimitry Andric return false; 2785ffd83dbSDimitry Andric 2795ffd83dbSDimitry Andric unsigned rbIndex = 2805ffd83dbSDimitry Andric getRelocationWithOffset(is, (is.getSize() - sizeOfDirectJmpInsn - 4)); 281bdd1243dSDimitry Andric if (rbIndex == is.relocs().size()) 28204eeddc0SDimitry Andric return false; 2835ffd83dbSDimitry Andric 284bdd1243dSDimitry Andric Relocation &rB = is.relocs()[rbIndex]; 2855ffd83dbSDimitry Andric 2865ffd83dbSDimitry Andric const uint8_t *jmpInsnB = secContents + rB.offset - 1; 2875ffd83dbSDimitry Andric JmpInsnOpcode jmpOpcodeB = getJmpInsnType(jmpInsnB - 1, jmpInsnB); 2885ffd83dbSDimitry Andric if (jmpOpcodeB == J_UNKNOWN) 2895ffd83dbSDimitry Andric return false; 2905ffd83dbSDimitry Andric 2915ffd83dbSDimitry Andric if (!isFallThruRelocation(is, file, nextIS, rB)) 2925ffd83dbSDimitry Andric return false; 2935ffd83dbSDimitry Andric 2945ffd83dbSDimitry Andric // jmpCC jumps to the fall thru block, the branch can be flipped and the 2955ffd83dbSDimitry Andric // jmp can be deleted. 2965ffd83dbSDimitry Andric JmpInsnOpcode jInvert = invertJmpOpcode(jmpOpcodeB); 2975ffd83dbSDimitry Andric if (jInvert == J_UNKNOWN) 2985ffd83dbSDimitry Andric return false; 29904eeddc0SDimitry Andric is.jumpInstrMod = make<JumpInstrMod>(); 30004eeddc0SDimitry Andric *is.jumpInstrMod = {rB.offset - 1, jInvert, 4}; 3015ffd83dbSDimitry Andric // Move R's values to rB except the offset. 3025ffd83dbSDimitry Andric rB = {r.expr, r.type, rB.offset, r.addend, r.sym}; 3035ffd83dbSDimitry Andric // Cancel R 3045ffd83dbSDimitry Andric r.expr = R_NONE; 3055ffd83dbSDimitry Andric r.offset = 0; 3065ffd83dbSDimitry Andric is.drop_back(sizeOfDirectJmpInsn); 3075ffd83dbSDimitry Andric is.nopFiller = true; 3085ffd83dbSDimitry Andric return true; 3095ffd83dbSDimitry Andric } 3105ffd83dbSDimitry Andric 3115f757f3fSDimitry Andric bool X86_64::relaxOnce(int pass) const { 3125f757f3fSDimitry Andric uint64_t minVA = UINT64_MAX, maxVA = 0; 3135f757f3fSDimitry Andric for (OutputSection *osec : outputSections) { 3145f757f3fSDimitry Andric minVA = std::min(minVA, osec->addr); 3155f757f3fSDimitry Andric maxVA = std::max(maxVA, osec->addr + osec->size); 3165f757f3fSDimitry Andric } 3175f757f3fSDimitry Andric // If the max VA difference is under 2^31, GOT-generating relocations with a 32-bit range cannot overflow. 3185f757f3fSDimitry Andric if (isUInt<31>(maxVA - minVA)) 3195f757f3fSDimitry Andric return false; 3205f757f3fSDimitry Andric 3215f757f3fSDimitry Andric SmallVector<InputSection *, 0> storage; 3225f757f3fSDimitry Andric bool changed = false; 3235f757f3fSDimitry Andric for (OutputSection *osec : outputSections) { 3245f757f3fSDimitry Andric if (!(osec->flags & SHF_EXECINSTR)) 3255f757f3fSDimitry Andric continue; 3265f757f3fSDimitry Andric for (InputSection *sec : getInputSections(*osec, storage)) { 3275f757f3fSDimitry Andric for (Relocation &rel : sec->relocs()) { 3285f757f3fSDimitry Andric if (rel.expr != R_RELAX_GOT_PC) 3295f757f3fSDimitry Andric continue; 3305f757f3fSDimitry Andric 331*439352acSDimitry Andric uint64_t v = sec->getRelocTargetVA(sec->file, rel.type, rel.addend, 332*439352acSDimitry Andric sec->getOutputSection()->addr + 333*439352acSDimitry Andric sec->outSecOff + rel.offset, 334*439352acSDimitry Andric *rel.sym, rel.expr); 3355f757f3fSDimitry Andric if (isInt<32>(v)) 3365f757f3fSDimitry Andric continue; 3375f757f3fSDimitry Andric if (rel.sym->auxIdx == 0) { 3385f757f3fSDimitry Andric rel.sym->allocateAux(); 3395f757f3fSDimitry Andric addGotEntry(*rel.sym); 3405f757f3fSDimitry Andric changed = true; 3415f757f3fSDimitry Andric } 3425f757f3fSDimitry Andric rel.expr = R_GOT_PC; 3435f757f3fSDimitry Andric } 3445f757f3fSDimitry Andric } 3455f757f3fSDimitry Andric } 3465f757f3fSDimitry Andric return changed; 3475f757f3fSDimitry Andric } 3485f757f3fSDimitry Andric 3490b57cec5SDimitry Andric RelExpr X86_64::getRelExpr(RelType type, const Symbol &s, 3500b57cec5SDimitry Andric const uint8_t *loc) const { 3510b57cec5SDimitry Andric switch (type) { 3520b57cec5SDimitry Andric case R_X86_64_8: 3530b57cec5SDimitry Andric case R_X86_64_16: 3540b57cec5SDimitry Andric case R_X86_64_32: 3550b57cec5SDimitry Andric case R_X86_64_32S: 3560b57cec5SDimitry Andric case R_X86_64_64: 3570b57cec5SDimitry Andric return R_ABS; 3580b57cec5SDimitry Andric case R_X86_64_DTPOFF32: 3590b57cec5SDimitry Andric case R_X86_64_DTPOFF64: 3600b57cec5SDimitry Andric return R_DTPREL; 3610b57cec5SDimitry Andric case R_X86_64_TPOFF32: 3621db9f3b2SDimitry Andric case R_X86_64_TPOFF64: 363e8d8bef9SDimitry Andric return R_TPREL; 3640b57cec5SDimitry Andric case R_X86_64_TLSDESC_CALL: 3650b57cec5SDimitry Andric return R_TLSDESC_CALL; 3660b57cec5SDimitry Andric case R_X86_64_TLSLD: 3670b57cec5SDimitry Andric return R_TLSLD_PC; 3680b57cec5SDimitry Andric case R_X86_64_TLSGD: 3690b57cec5SDimitry Andric return R_TLSGD_PC; 3700b57cec5SDimitry Andric case R_X86_64_SIZE32: 3710b57cec5SDimitry Andric case R_X86_64_SIZE64: 3720b57cec5SDimitry Andric return R_SIZE; 3730b57cec5SDimitry Andric case R_X86_64_PLT32: 3740b57cec5SDimitry Andric return R_PLT_PC; 3750b57cec5SDimitry Andric case R_X86_64_PC8: 3760b57cec5SDimitry Andric case R_X86_64_PC16: 3770b57cec5SDimitry Andric case R_X86_64_PC32: 3780b57cec5SDimitry Andric case R_X86_64_PC64: 3790b57cec5SDimitry Andric return R_PC; 3800b57cec5SDimitry Andric case R_X86_64_GOT32: 3810b57cec5SDimitry Andric case R_X86_64_GOT64: 3820b57cec5SDimitry Andric return R_GOTPLT; 3830b57cec5SDimitry Andric case R_X86_64_GOTPC32_TLSDESC: 3840b57cec5SDimitry Andric return R_TLSDESC_PC; 3850b57cec5SDimitry Andric case R_X86_64_GOTPCREL: 3860b57cec5SDimitry Andric case R_X86_64_GOTPCRELX: 3870b57cec5SDimitry Andric case R_X86_64_REX_GOTPCRELX: 3880b57cec5SDimitry Andric case R_X86_64_GOTTPOFF: 3890b57cec5SDimitry Andric return R_GOT_PC; 3900b57cec5SDimitry Andric case R_X86_64_GOTOFF64: 3910b57cec5SDimitry Andric return R_GOTPLTREL; 392349cc55cSDimitry Andric case R_X86_64_PLTOFF64: 393349cc55cSDimitry Andric return R_PLT_GOTPLT; 3940b57cec5SDimitry Andric case R_X86_64_GOTPC32: 3950b57cec5SDimitry Andric case R_X86_64_GOTPC64: 3960b57cec5SDimitry Andric return R_GOTPLTONLY_PC; 3970b57cec5SDimitry Andric case R_X86_64_NONE: 3980b57cec5SDimitry Andric return R_NONE; 3990b57cec5SDimitry Andric default: 4000b57cec5SDimitry Andric error(getErrorLocation(loc) + "unknown relocation (" + Twine(type) + 4010b57cec5SDimitry Andric ") against symbol " + toString(s)); 4020b57cec5SDimitry Andric return R_NONE; 4030b57cec5SDimitry Andric } 4040b57cec5SDimitry Andric } 4050b57cec5SDimitry Andric 4060b57cec5SDimitry Andric void X86_64::writeGotPltHeader(uint8_t *buf) const { 4077a6dacacSDimitry Andric // The first entry holds the link-time address of _DYNAMIC. It is documented 4087a6dacacSDimitry Andric // in the psABI and glibc before Aug 2021 used the entry to compute run-time 4097a6dacacSDimitry Andric // load address of the shared object (note that this is relevant for linking 4107a6dacacSDimitry Andric // ld.so, not any other program). 4110b57cec5SDimitry Andric write64le(buf, mainPart->dynamic->getVA()); 4120b57cec5SDimitry Andric } 4130b57cec5SDimitry Andric 4140b57cec5SDimitry Andric void X86_64::writeGotPlt(uint8_t *buf, const Symbol &s) const { 4150b57cec5SDimitry Andric // See comments in X86::writeGotPlt. 4160b57cec5SDimitry Andric write64le(buf, s.getPltVA() + 6); 4170b57cec5SDimitry Andric } 4180b57cec5SDimitry Andric 419fe6060f1SDimitry Andric void X86_64::writeIgotPlt(uint8_t *buf, const Symbol &s) const { 420fe6060f1SDimitry Andric // An x86 entry is the address of the ifunc resolver function (for -z rel). 421fe6060f1SDimitry Andric if (config->writeAddends) 422fe6060f1SDimitry Andric write64le(buf, s.getVA()); 423fe6060f1SDimitry Andric } 424fe6060f1SDimitry Andric 4250b57cec5SDimitry Andric void X86_64::writePltHeader(uint8_t *buf) const { 4260b57cec5SDimitry Andric const uint8_t pltData[] = { 4270b57cec5SDimitry Andric 0xff, 0x35, 0, 0, 0, 0, // pushq GOTPLT+8(%rip) 4280b57cec5SDimitry Andric 0xff, 0x25, 0, 0, 0, 0, // jmp *GOTPLT+16(%rip) 4290b57cec5SDimitry Andric 0x0f, 0x1f, 0x40, 0x00, // nop 4300b57cec5SDimitry Andric }; 4310b57cec5SDimitry Andric memcpy(buf, pltData, sizeof(pltData)); 4320b57cec5SDimitry Andric uint64_t gotPlt = in.gotPlt->getVA(); 433480093f4SDimitry Andric uint64_t plt = in.ibtPlt ? in.ibtPlt->getVA() : in.plt->getVA(); 4340b57cec5SDimitry Andric write32le(buf + 2, gotPlt - plt + 2); // GOTPLT+8 4350b57cec5SDimitry Andric write32le(buf + 8, gotPlt - plt + 4); // GOTPLT+16 4360b57cec5SDimitry Andric } 4370b57cec5SDimitry Andric 438480093f4SDimitry Andric void X86_64::writePlt(uint8_t *buf, const Symbol &sym, 439480093f4SDimitry Andric uint64_t pltEntryAddr) const { 4400b57cec5SDimitry Andric const uint8_t inst[] = { 4410b57cec5SDimitry Andric 0xff, 0x25, 0, 0, 0, 0, // jmpq *got(%rip) 4420b57cec5SDimitry Andric 0x68, 0, 0, 0, 0, // pushq <relocation index> 4430b57cec5SDimitry Andric 0xe9, 0, 0, 0, 0, // jmpq plt[0] 4440b57cec5SDimitry Andric }; 4450b57cec5SDimitry Andric memcpy(buf, inst, sizeof(inst)); 4460b57cec5SDimitry Andric 447480093f4SDimitry Andric write32le(buf + 2, sym.getGotPltVA() - pltEntryAddr - 6); 44804eeddc0SDimitry Andric write32le(buf + 7, sym.getPltIdx()); 449480093f4SDimitry Andric write32le(buf + 12, in.plt->getVA() - pltEntryAddr - 16); 4500b57cec5SDimitry Andric } 4510b57cec5SDimitry Andric 4520b57cec5SDimitry Andric RelType X86_64::getDynRel(RelType type) const { 4530b57cec5SDimitry Andric if (type == R_X86_64_64 || type == R_X86_64_PC64 || type == R_X86_64_SIZE32 || 4540b57cec5SDimitry Andric type == R_X86_64_SIZE64) 4550b57cec5SDimitry Andric return type; 4560b57cec5SDimitry Andric return R_X86_64_NONE; 4570b57cec5SDimitry Andric } 4580b57cec5SDimitry Andric 459bdd1243dSDimitry Andric static void relaxTlsGdToLe(uint8_t *loc, const Relocation &rel, uint64_t val) { 4605ffd83dbSDimitry Andric if (rel.type == R_X86_64_TLSGD) { 4610b57cec5SDimitry Andric // Convert 4620b57cec5SDimitry Andric // .byte 0x66 4630b57cec5SDimitry Andric // leaq x@tlsgd(%rip), %rdi 4640b57cec5SDimitry Andric // .word 0x6666 4650b57cec5SDimitry Andric // rex64 4660b57cec5SDimitry Andric // call __tls_get_addr@plt 4670b57cec5SDimitry Andric // to the following two instructions. 4680b57cec5SDimitry Andric const uint8_t inst[] = { 4690b57cec5SDimitry Andric 0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 4700b57cec5SDimitry Andric 0x00, 0x00, // mov %fs:0x0,%rax 4710b57cec5SDimitry Andric 0x48, 0x8d, 0x80, 0, 0, 0, 0, // lea x@tpoff,%rax 4720b57cec5SDimitry Andric }; 4730b57cec5SDimitry Andric memcpy(loc - 4, inst, sizeof(inst)); 4740b57cec5SDimitry Andric 4750b57cec5SDimitry Andric // The original code used a pc relative relocation and so we have to 4760b57cec5SDimitry Andric // compensate for the -4 in had in the addend. 4770b57cec5SDimitry Andric write32le(loc + 8, val + 4); 4784824e7fdSDimitry Andric } else if (rel.type == R_X86_64_GOTPC32_TLSDESC) { 4794824e7fdSDimitry Andric // Convert leaq x@tlsdesc(%rip), %REG to movq $x@tpoff, %REG. 4804824e7fdSDimitry Andric if ((loc[-3] & 0xfb) != 0x48 || loc[-2] != 0x8d || 4814824e7fdSDimitry Andric (loc[-1] & 0xc7) != 0x05) { 4824824e7fdSDimitry Andric errorOrWarn(getErrorLocation(loc - 3) + 4834824e7fdSDimitry Andric "R_X86_64_GOTPC32_TLSDESC must be used " 4844824e7fdSDimitry Andric "in leaq x@tlsdesc(%rip), %REG"); 4850b57cec5SDimitry Andric return; 4860b57cec5SDimitry Andric } 4874824e7fdSDimitry Andric loc[-3] = 0x48 | ((loc[-3] >> 2) & 1); 4880b57cec5SDimitry Andric loc[-2] = 0xc7; 4894824e7fdSDimitry Andric loc[-1] = 0xc0 | ((loc[-1] >> 3) & 7); 4900b57cec5SDimitry Andric write32le(loc, val + 4); 4914824e7fdSDimitry Andric } else { 4924824e7fdSDimitry Andric // Convert call *x@tlsdesc(%REG) to xchg ax, ax. 4934824e7fdSDimitry Andric assert(rel.type == R_X86_64_TLSDESC_CALL); 4944824e7fdSDimitry Andric loc[0] = 0x66; 4954824e7fdSDimitry Andric loc[1] = 0x90; 4960b57cec5SDimitry Andric } 4970b57cec5SDimitry Andric } 4980b57cec5SDimitry Andric 499bdd1243dSDimitry Andric static void relaxTlsGdToIe(uint8_t *loc, const Relocation &rel, uint64_t val) { 5005ffd83dbSDimitry Andric if (rel.type == R_X86_64_TLSGD) { 5010b57cec5SDimitry Andric // Convert 5020b57cec5SDimitry Andric // .byte 0x66 5030b57cec5SDimitry Andric // leaq x@tlsgd(%rip), %rdi 5040b57cec5SDimitry Andric // .word 0x6666 5050b57cec5SDimitry Andric // rex64 5060b57cec5SDimitry Andric // call __tls_get_addr@plt 5070b57cec5SDimitry Andric // to the following two instructions. 5080b57cec5SDimitry Andric const uint8_t inst[] = { 5090b57cec5SDimitry Andric 0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 5100b57cec5SDimitry Andric 0x00, 0x00, // mov %fs:0x0,%rax 5110b57cec5SDimitry Andric 0x48, 0x03, 0x05, 0, 0, 0, 0, // addq x@gottpoff(%rip),%rax 5120b57cec5SDimitry Andric }; 5130b57cec5SDimitry Andric memcpy(loc - 4, inst, sizeof(inst)); 5140b57cec5SDimitry Andric 5150b57cec5SDimitry Andric // Both code sequences are PC relatives, but since we are moving the 5160b57cec5SDimitry Andric // constant forward by 8 bytes we have to subtract the value by 8. 5170b57cec5SDimitry Andric write32le(loc + 8, val - 8); 5184824e7fdSDimitry Andric } else if (rel.type == R_X86_64_GOTPC32_TLSDESC) { 5194824e7fdSDimitry Andric // Convert leaq x@tlsdesc(%rip), %REG to movq x@gottpoff(%rip), %REG. 5205ffd83dbSDimitry Andric assert(rel.type == R_X86_64_GOTPC32_TLSDESC); 5214824e7fdSDimitry Andric if ((loc[-3] & 0xfb) != 0x48 || loc[-2] != 0x8d || 5224824e7fdSDimitry Andric (loc[-1] & 0xc7) != 0x05) { 5234824e7fdSDimitry Andric errorOrWarn(getErrorLocation(loc - 3) + 5244824e7fdSDimitry Andric "R_X86_64_GOTPC32_TLSDESC must be used " 5254824e7fdSDimitry Andric "in leaq x@tlsdesc(%rip), %REG"); 5260b57cec5SDimitry Andric return; 5270b57cec5SDimitry Andric } 5280b57cec5SDimitry Andric loc[-2] = 0x8b; 5290b57cec5SDimitry Andric write32le(loc, val); 5304824e7fdSDimitry Andric } else { 5314824e7fdSDimitry Andric // Convert call *x@tlsdesc(%rax) to xchg ax, ax. 5324824e7fdSDimitry Andric assert(rel.type == R_X86_64_TLSDESC_CALL); 5334824e7fdSDimitry Andric loc[0] = 0x66; 5344824e7fdSDimitry Andric loc[1] = 0x90; 5350b57cec5SDimitry Andric } 5360b57cec5SDimitry Andric } 5370b57cec5SDimitry Andric 5380b57cec5SDimitry Andric // In some conditions, R_X86_64_GOTTPOFF relocation can be optimized to 5390b57cec5SDimitry Andric // R_X86_64_TPOFF32 so that it does not use GOT. 540bdd1243dSDimitry Andric static void relaxTlsIeToLe(uint8_t *loc, const Relocation &, uint64_t val) { 5410b57cec5SDimitry Andric uint8_t *inst = loc - 3; 5420b57cec5SDimitry Andric uint8_t reg = loc[-1] >> 3; 5430b57cec5SDimitry Andric uint8_t *regSlot = loc - 1; 5440b57cec5SDimitry Andric 5450b57cec5SDimitry Andric // Note that ADD with RSP or R12 is converted to ADD instead of LEA 5460b57cec5SDimitry Andric // because LEA with these registers needs 4 bytes to encode and thus 5470b57cec5SDimitry Andric // wouldn't fit the space. 5480b57cec5SDimitry Andric 5490b57cec5SDimitry Andric if (memcmp(inst, "\x48\x03\x25", 3) == 0) { 5500b57cec5SDimitry Andric // "addq foo@gottpoff(%rip),%rsp" -> "addq $foo,%rsp" 5510b57cec5SDimitry Andric memcpy(inst, "\x48\x81\xc4", 3); 5520b57cec5SDimitry Andric } else if (memcmp(inst, "\x4c\x03\x25", 3) == 0) { 5530b57cec5SDimitry Andric // "addq foo@gottpoff(%rip),%r12" -> "addq $foo,%r12" 5540b57cec5SDimitry Andric memcpy(inst, "\x49\x81\xc4", 3); 5550b57cec5SDimitry Andric } else if (memcmp(inst, "\x4c\x03", 2) == 0) { 5560b57cec5SDimitry Andric // "addq foo@gottpoff(%rip),%r[8-15]" -> "leaq foo(%r[8-15]),%r[8-15]" 5570b57cec5SDimitry Andric memcpy(inst, "\x4d\x8d", 2); 5580b57cec5SDimitry Andric *regSlot = 0x80 | (reg << 3) | reg; 5590b57cec5SDimitry Andric } else if (memcmp(inst, "\x48\x03", 2) == 0) { 5600b57cec5SDimitry Andric // "addq foo@gottpoff(%rip),%reg -> "leaq foo(%reg),%reg" 5610b57cec5SDimitry Andric memcpy(inst, "\x48\x8d", 2); 5620b57cec5SDimitry Andric *regSlot = 0x80 | (reg << 3) | reg; 5630b57cec5SDimitry Andric } else if (memcmp(inst, "\x4c\x8b", 2) == 0) { 5640b57cec5SDimitry Andric // "movq foo@gottpoff(%rip),%r[8-15]" -> "movq $foo,%r[8-15]" 5650b57cec5SDimitry Andric memcpy(inst, "\x49\xc7", 2); 5660b57cec5SDimitry Andric *regSlot = 0xc0 | reg; 5670b57cec5SDimitry Andric } else if (memcmp(inst, "\x48\x8b", 2) == 0) { 5680b57cec5SDimitry Andric // "movq foo@gottpoff(%rip),%reg" -> "movq $foo,%reg" 5690b57cec5SDimitry Andric memcpy(inst, "\x48\xc7", 2); 5700b57cec5SDimitry Andric *regSlot = 0xc0 | reg; 5710b57cec5SDimitry Andric } else { 5720b57cec5SDimitry Andric error(getErrorLocation(loc - 3) + 5730b57cec5SDimitry Andric "R_X86_64_GOTTPOFF must be used in MOVQ or ADDQ instructions only"); 5740b57cec5SDimitry Andric } 5750b57cec5SDimitry Andric 5760b57cec5SDimitry Andric // The original code used a PC relative relocation. 5770b57cec5SDimitry Andric // Need to compensate for the -4 it had in the addend. 5780b57cec5SDimitry Andric write32le(loc, val + 4); 5790b57cec5SDimitry Andric } 5800b57cec5SDimitry Andric 581bdd1243dSDimitry Andric static void relaxTlsLdToLe(uint8_t *loc, const Relocation &rel, uint64_t val) { 5820b57cec5SDimitry Andric const uint8_t inst[] = { 5830b57cec5SDimitry Andric 0x66, 0x66, // .word 0x6666 5840b57cec5SDimitry Andric 0x66, // .byte 0x66 5850b57cec5SDimitry Andric 0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 0x00, 0x00, // mov %fs:0,%rax 5860b57cec5SDimitry Andric }; 5870b57cec5SDimitry Andric 5880b57cec5SDimitry Andric if (loc[4] == 0xe8) { 5890b57cec5SDimitry Andric // Convert 5900b57cec5SDimitry Andric // leaq bar@tlsld(%rip), %rdi # 48 8d 3d <Loc> 5910b57cec5SDimitry Andric // callq __tls_get_addr@PLT # e8 <disp32> 5920b57cec5SDimitry Andric // leaq bar@dtpoff(%rax), %rcx 5930b57cec5SDimitry Andric // to 5940b57cec5SDimitry Andric // .word 0x6666 5950b57cec5SDimitry Andric // .byte 0x66 5960b57cec5SDimitry Andric // mov %fs:0,%rax 5970b57cec5SDimitry Andric // leaq bar@tpoff(%rax), %rcx 5980b57cec5SDimitry Andric memcpy(loc - 3, inst, sizeof(inst)); 5990b57cec5SDimitry Andric return; 6000b57cec5SDimitry Andric } 6010b57cec5SDimitry Andric 6020b57cec5SDimitry Andric if (loc[4] == 0xff && loc[5] == 0x15) { 6030b57cec5SDimitry Andric // Convert 6040b57cec5SDimitry Andric // leaq x@tlsld(%rip),%rdi # 48 8d 3d <Loc> 6050b57cec5SDimitry Andric // call *__tls_get_addr@GOTPCREL(%rip) # ff 15 <disp32> 6060b57cec5SDimitry Andric // to 6070b57cec5SDimitry Andric // .long 0x66666666 6080b57cec5SDimitry Andric // movq %fs:0,%rax 6090b57cec5SDimitry Andric // See "Table 11.9: LD -> LE Code Transition (LP64)" in 6100b57cec5SDimitry Andric // https://raw.githubusercontent.com/wiki/hjl-tools/x86-psABI/x86-64-psABI-1.0.pdf 6110b57cec5SDimitry Andric loc[-3] = 0x66; 6120b57cec5SDimitry Andric memcpy(loc - 2, inst, sizeof(inst)); 6130b57cec5SDimitry Andric return; 6140b57cec5SDimitry Andric } 6150b57cec5SDimitry Andric 6160b57cec5SDimitry Andric error(getErrorLocation(loc - 3) + 6170b57cec5SDimitry Andric "expected R_X86_64_PLT32 or R_X86_64_GOTPCRELX after R_X86_64_TLSLD"); 6180b57cec5SDimitry Andric } 6190b57cec5SDimitry Andric 6205ffd83dbSDimitry Andric // A JumpInstrMod at a specific offset indicates that the jump instruction 6215ffd83dbSDimitry Andric // opcode at that offset must be modified. This is specifically used to relax 6225ffd83dbSDimitry Andric // jump instructions with basic block sections. This function looks at the 6235ffd83dbSDimitry Andric // JumpMod and effects the change. 6245ffd83dbSDimitry Andric void X86_64::applyJumpInstrMod(uint8_t *loc, JumpModType type, 6255ffd83dbSDimitry Andric unsigned size) const { 6260b57cec5SDimitry Andric switch (type) { 6275ffd83dbSDimitry Andric case J_JMP_32: 6285ffd83dbSDimitry Andric if (size == 4) 6295ffd83dbSDimitry Andric *loc = 0xe9; 6305ffd83dbSDimitry Andric else 6315ffd83dbSDimitry Andric *loc = 0xeb; 6325ffd83dbSDimitry Andric break; 6335ffd83dbSDimitry Andric case J_JE_32: 6345ffd83dbSDimitry Andric if (size == 4) { 6355ffd83dbSDimitry Andric loc[-1] = 0x0f; 6365ffd83dbSDimitry Andric *loc = 0x84; 6375ffd83dbSDimitry Andric } else 6385ffd83dbSDimitry Andric *loc = 0x74; 6395ffd83dbSDimitry Andric break; 6405ffd83dbSDimitry Andric case J_JNE_32: 6415ffd83dbSDimitry Andric if (size == 4) { 6425ffd83dbSDimitry Andric loc[-1] = 0x0f; 6435ffd83dbSDimitry Andric *loc = 0x85; 6445ffd83dbSDimitry Andric } else 6455ffd83dbSDimitry Andric *loc = 0x75; 6465ffd83dbSDimitry Andric break; 6475ffd83dbSDimitry Andric case J_JG_32: 6485ffd83dbSDimitry Andric if (size == 4) { 6495ffd83dbSDimitry Andric loc[-1] = 0x0f; 6505ffd83dbSDimitry Andric *loc = 0x8f; 6515ffd83dbSDimitry Andric } else 6525ffd83dbSDimitry Andric *loc = 0x7f; 6535ffd83dbSDimitry Andric break; 6545ffd83dbSDimitry Andric case J_JGE_32: 6555ffd83dbSDimitry Andric if (size == 4) { 6565ffd83dbSDimitry Andric loc[-1] = 0x0f; 6575ffd83dbSDimitry Andric *loc = 0x8d; 6585ffd83dbSDimitry Andric } else 6595ffd83dbSDimitry Andric *loc = 0x7d; 6605ffd83dbSDimitry Andric break; 6615ffd83dbSDimitry Andric case J_JB_32: 6625ffd83dbSDimitry Andric if (size == 4) { 6635ffd83dbSDimitry Andric loc[-1] = 0x0f; 6645ffd83dbSDimitry Andric *loc = 0x82; 6655ffd83dbSDimitry Andric } else 6665ffd83dbSDimitry Andric *loc = 0x72; 6675ffd83dbSDimitry Andric break; 6685ffd83dbSDimitry Andric case J_JBE_32: 6695ffd83dbSDimitry Andric if (size == 4) { 6705ffd83dbSDimitry Andric loc[-1] = 0x0f; 6715ffd83dbSDimitry Andric *loc = 0x86; 6725ffd83dbSDimitry Andric } else 6735ffd83dbSDimitry Andric *loc = 0x76; 6745ffd83dbSDimitry Andric break; 6755ffd83dbSDimitry Andric case J_JL_32: 6765ffd83dbSDimitry Andric if (size == 4) { 6775ffd83dbSDimitry Andric loc[-1] = 0x0f; 6785ffd83dbSDimitry Andric *loc = 0x8c; 6795ffd83dbSDimitry Andric } else 6805ffd83dbSDimitry Andric *loc = 0x7c; 6815ffd83dbSDimitry Andric break; 6825ffd83dbSDimitry Andric case J_JLE_32: 6835ffd83dbSDimitry Andric if (size == 4) { 6845ffd83dbSDimitry Andric loc[-1] = 0x0f; 6855ffd83dbSDimitry Andric *loc = 0x8e; 6865ffd83dbSDimitry Andric } else 6875ffd83dbSDimitry Andric *loc = 0x7e; 6885ffd83dbSDimitry Andric break; 6895ffd83dbSDimitry Andric case J_JA_32: 6905ffd83dbSDimitry Andric if (size == 4) { 6915ffd83dbSDimitry Andric loc[-1] = 0x0f; 6925ffd83dbSDimitry Andric *loc = 0x87; 6935ffd83dbSDimitry Andric } else 6945ffd83dbSDimitry Andric *loc = 0x77; 6955ffd83dbSDimitry Andric break; 6965ffd83dbSDimitry Andric case J_JAE_32: 6975ffd83dbSDimitry Andric if (size == 4) { 6985ffd83dbSDimitry Andric loc[-1] = 0x0f; 6995ffd83dbSDimitry Andric *loc = 0x83; 7005ffd83dbSDimitry Andric } else 7015ffd83dbSDimitry Andric *loc = 0x73; 7025ffd83dbSDimitry Andric break; 7035ffd83dbSDimitry Andric case J_UNKNOWN: 7045ffd83dbSDimitry Andric llvm_unreachable("Unknown Jump Relocation"); 7055ffd83dbSDimitry Andric } 7065ffd83dbSDimitry Andric } 7075ffd83dbSDimitry Andric 708fe6060f1SDimitry Andric int64_t X86_64::getImplicitAddend(const uint8_t *buf, RelType type) const { 709fe6060f1SDimitry Andric switch (type) { 710fe6060f1SDimitry Andric case R_X86_64_8: 711fe6060f1SDimitry Andric case R_X86_64_PC8: 712fe6060f1SDimitry Andric return SignExtend64<8>(*buf); 713fe6060f1SDimitry Andric case R_X86_64_16: 714fe6060f1SDimitry Andric case R_X86_64_PC16: 715fe6060f1SDimitry Andric return SignExtend64<16>(read16le(buf)); 716fe6060f1SDimitry Andric case R_X86_64_32: 717fe6060f1SDimitry Andric case R_X86_64_32S: 718fe6060f1SDimitry Andric case R_X86_64_TPOFF32: 719fe6060f1SDimitry Andric case R_X86_64_GOT32: 720fe6060f1SDimitry Andric case R_X86_64_GOTPC32: 721fe6060f1SDimitry Andric case R_X86_64_GOTPC32_TLSDESC: 722fe6060f1SDimitry Andric case R_X86_64_GOTPCREL: 723fe6060f1SDimitry Andric case R_X86_64_GOTPCRELX: 724fe6060f1SDimitry Andric case R_X86_64_REX_GOTPCRELX: 725fe6060f1SDimitry Andric case R_X86_64_PC32: 726fe6060f1SDimitry Andric case R_X86_64_GOTTPOFF: 727fe6060f1SDimitry Andric case R_X86_64_PLT32: 728fe6060f1SDimitry Andric case R_X86_64_TLSGD: 729fe6060f1SDimitry Andric case R_X86_64_TLSLD: 730fe6060f1SDimitry Andric case R_X86_64_DTPOFF32: 731fe6060f1SDimitry Andric case R_X86_64_SIZE32: 732fe6060f1SDimitry Andric return SignExtend64<32>(read32le(buf)); 733fe6060f1SDimitry Andric case R_X86_64_64: 734fe6060f1SDimitry Andric case R_X86_64_TPOFF64: 735fe6060f1SDimitry Andric case R_X86_64_DTPOFF64: 736fe6060f1SDimitry Andric case R_X86_64_DTPMOD64: 737fe6060f1SDimitry Andric case R_X86_64_PC64: 738fe6060f1SDimitry Andric case R_X86_64_SIZE64: 739fe6060f1SDimitry Andric case R_X86_64_GLOB_DAT: 740fe6060f1SDimitry Andric case R_X86_64_GOT64: 741fe6060f1SDimitry Andric case R_X86_64_GOTOFF64: 742fe6060f1SDimitry Andric case R_X86_64_GOTPC64: 743349cc55cSDimitry Andric case R_X86_64_PLTOFF64: 744fe6060f1SDimitry Andric case R_X86_64_IRELATIVE: 745fe6060f1SDimitry Andric case R_X86_64_RELATIVE: 746fe6060f1SDimitry Andric return read64le(buf); 747349cc55cSDimitry Andric case R_X86_64_TLSDESC: 748349cc55cSDimitry Andric return read64le(buf + 8); 749fe6060f1SDimitry Andric case R_X86_64_JUMP_SLOT: 750fe6060f1SDimitry Andric case R_X86_64_NONE: 751fe6060f1SDimitry Andric // These relocations are defined as not having an implicit addend. 752fe6060f1SDimitry Andric return 0; 753fe6060f1SDimitry Andric default: 754fe6060f1SDimitry Andric internalLinkerError(getErrorLocation(buf), 755fe6060f1SDimitry Andric "cannot read addend for relocation " + toString(type)); 756fe6060f1SDimitry Andric return 0; 757fe6060f1SDimitry Andric } 758fe6060f1SDimitry Andric } 759fe6060f1SDimitry Andric 760bdd1243dSDimitry Andric static void relaxGot(uint8_t *loc, const Relocation &rel, uint64_t val); 761bdd1243dSDimitry Andric 7625ffd83dbSDimitry Andric void X86_64::relocate(uint8_t *loc, const Relocation &rel, uint64_t val) const { 7635ffd83dbSDimitry Andric switch (rel.type) { 7640b57cec5SDimitry Andric case R_X86_64_8: 7655ffd83dbSDimitry Andric checkIntUInt(loc, val, 8, rel); 7660b57cec5SDimitry Andric *loc = val; 7670b57cec5SDimitry Andric break; 7680b57cec5SDimitry Andric case R_X86_64_PC8: 7695ffd83dbSDimitry Andric checkInt(loc, val, 8, rel); 7700b57cec5SDimitry Andric *loc = val; 7710b57cec5SDimitry Andric break; 7720b57cec5SDimitry Andric case R_X86_64_16: 7735ffd83dbSDimitry Andric checkIntUInt(loc, val, 16, rel); 7740b57cec5SDimitry Andric write16le(loc, val); 7750b57cec5SDimitry Andric break; 7760b57cec5SDimitry Andric case R_X86_64_PC16: 7775ffd83dbSDimitry Andric checkInt(loc, val, 16, rel); 7780b57cec5SDimitry Andric write16le(loc, val); 7790b57cec5SDimitry Andric break; 7800b57cec5SDimitry Andric case R_X86_64_32: 7815ffd83dbSDimitry Andric checkUInt(loc, val, 32, rel); 7820b57cec5SDimitry Andric write32le(loc, val); 7830b57cec5SDimitry Andric break; 7840b57cec5SDimitry Andric case R_X86_64_32S: 7850b57cec5SDimitry Andric case R_X86_64_GOT32: 7860b57cec5SDimitry Andric case R_X86_64_GOTPC32: 7870b57cec5SDimitry Andric case R_X86_64_GOTPCREL: 7880b57cec5SDimitry Andric case R_X86_64_PC32: 7890b57cec5SDimitry Andric case R_X86_64_PLT32: 7900b57cec5SDimitry Andric case R_X86_64_DTPOFF32: 7910b57cec5SDimitry Andric case R_X86_64_SIZE32: 7925ffd83dbSDimitry Andric checkInt(loc, val, 32, rel); 7930b57cec5SDimitry Andric write32le(loc, val); 7940b57cec5SDimitry Andric break; 7950b57cec5SDimitry Andric case R_X86_64_64: 7961db9f3b2SDimitry Andric case R_X86_64_TPOFF64: 7970b57cec5SDimitry Andric case R_X86_64_DTPOFF64: 7980b57cec5SDimitry Andric case R_X86_64_PC64: 7990b57cec5SDimitry Andric case R_X86_64_SIZE64: 8000b57cec5SDimitry Andric case R_X86_64_GOT64: 8010b57cec5SDimitry Andric case R_X86_64_GOTOFF64: 8020b57cec5SDimitry Andric case R_X86_64_GOTPC64: 803349cc55cSDimitry Andric case R_X86_64_PLTOFF64: 8040b57cec5SDimitry Andric write64le(loc, val); 8050b57cec5SDimitry Andric break; 806bdd1243dSDimitry Andric case R_X86_64_GOTPCRELX: 807bdd1243dSDimitry Andric case R_X86_64_REX_GOTPCRELX: 808bdd1243dSDimitry Andric if (rel.expr != R_GOT_PC) { 809bdd1243dSDimitry Andric relaxGot(loc, rel, val); 810bdd1243dSDimitry Andric } else { 811bdd1243dSDimitry Andric checkInt(loc, val, 32, rel); 812bdd1243dSDimitry Andric write32le(loc, val); 813bdd1243dSDimitry Andric } 814bdd1243dSDimitry Andric break; 815bdd1243dSDimitry Andric case R_X86_64_GOTPC32_TLSDESC: 816bdd1243dSDimitry Andric case R_X86_64_TLSDESC_CALL: 817bdd1243dSDimitry Andric case R_X86_64_TLSGD: 818bdd1243dSDimitry Andric if (rel.expr == R_RELAX_TLS_GD_TO_LE) { 819bdd1243dSDimitry Andric relaxTlsGdToLe(loc, rel, val); 820bdd1243dSDimitry Andric } else if (rel.expr == R_RELAX_TLS_GD_TO_IE) { 821bdd1243dSDimitry Andric relaxTlsGdToIe(loc, rel, val); 822bdd1243dSDimitry Andric } else { 823bdd1243dSDimitry Andric checkInt(loc, val, 32, rel); 824bdd1243dSDimitry Andric write32le(loc, val); 825bdd1243dSDimitry Andric } 826bdd1243dSDimitry Andric break; 827bdd1243dSDimitry Andric case R_X86_64_TLSLD: 828bdd1243dSDimitry Andric if (rel.expr == R_RELAX_TLS_LD_TO_LE) { 829bdd1243dSDimitry Andric relaxTlsLdToLe(loc, rel, val); 830bdd1243dSDimitry Andric } else { 831bdd1243dSDimitry Andric checkInt(loc, val, 32, rel); 832bdd1243dSDimitry Andric write32le(loc, val); 833bdd1243dSDimitry Andric } 834bdd1243dSDimitry Andric break; 835bdd1243dSDimitry Andric case R_X86_64_GOTTPOFF: 836bdd1243dSDimitry Andric if (rel.expr == R_RELAX_TLS_IE_TO_LE) { 837bdd1243dSDimitry Andric relaxTlsIeToLe(loc, rel, val); 838bdd1243dSDimitry Andric } else { 839bdd1243dSDimitry Andric checkInt(loc, val, 32, rel); 840bdd1243dSDimitry Andric write32le(loc, val); 841bdd1243dSDimitry Andric } 842bdd1243dSDimitry Andric break; 843bdd1243dSDimitry Andric case R_X86_64_TPOFF32: 844bdd1243dSDimitry Andric checkInt(loc, val, 32, rel); 845bdd1243dSDimitry Andric write32le(loc, val); 846bdd1243dSDimitry Andric break; 847bdd1243dSDimitry Andric 848349cc55cSDimitry Andric case R_X86_64_TLSDESC: 849349cc55cSDimitry Andric // The addend is stored in the second 64-bit word. 850349cc55cSDimitry Andric write64le(loc + 8, val); 851349cc55cSDimitry Andric break; 8520b57cec5SDimitry Andric default: 8530b57cec5SDimitry Andric llvm_unreachable("unknown relocation"); 8540b57cec5SDimitry Andric } 8550b57cec5SDimitry Andric } 8560b57cec5SDimitry Andric 857e8d8bef9SDimitry Andric RelExpr X86_64::adjustGotPcExpr(RelType type, int64_t addend, 858e8d8bef9SDimitry Andric const uint8_t *loc) const { 859e8d8bef9SDimitry Andric // Only R_X86_64_[REX_]GOTPCRELX can be relaxed. GNU as may emit GOTPCRELX 860e8d8bef9SDimitry Andric // with addend != -4. Such an instruction does not load the full GOT entry, so 861e8d8bef9SDimitry Andric // we cannot relax the relocation. E.g. movl x@GOTPCREL+4(%rip), %rax 862e8d8bef9SDimitry Andric // (addend=0) loads the high 32 bits of the GOT entry. 863349cc55cSDimitry Andric if (!config->relax || addend != -4 || 864349cc55cSDimitry Andric (type != R_X86_64_GOTPCRELX && type != R_X86_64_REX_GOTPCRELX)) 865e8d8bef9SDimitry Andric return R_GOT_PC; 866e8d8bef9SDimitry Andric const uint8_t op = loc[-2]; 867e8d8bef9SDimitry Andric const uint8_t modRm = loc[-1]; 8680b57cec5SDimitry Andric 8690b57cec5SDimitry Andric // FIXME: When PIC is disabled and foo is defined locally in the 8700b57cec5SDimitry Andric // lower 32 bit address space, memory operand in mov can be converted into 8710b57cec5SDimitry Andric // immediate operand. Otherwise, mov must be changed to lea. We support only 8720b57cec5SDimitry Andric // latter relaxation at this moment. 8730b57cec5SDimitry Andric if (op == 0x8b) 8740b57cec5SDimitry Andric return R_RELAX_GOT_PC; 8750b57cec5SDimitry Andric 8760b57cec5SDimitry Andric // Relax call and jmp. 8770b57cec5SDimitry Andric if (op == 0xff && (modRm == 0x15 || modRm == 0x25)) 8780b57cec5SDimitry Andric return R_RELAX_GOT_PC; 8790b57cec5SDimitry Andric 880e8d8bef9SDimitry Andric // We don't support test/binop instructions without a REX prefix. 881e8d8bef9SDimitry Andric if (type == R_X86_64_GOTPCRELX) 882e8d8bef9SDimitry Andric return R_GOT_PC; 883e8d8bef9SDimitry Andric 8840b57cec5SDimitry Andric // Relaxation of test, adc, add, and, cmp, or, sbb, sub, xor. 8850b57cec5SDimitry Andric // If PIC then no relaxation is available. 886e8d8bef9SDimitry Andric return config->isPic ? R_GOT_PC : R_RELAX_GOT_PC_NOPIC; 8870b57cec5SDimitry Andric } 8880b57cec5SDimitry Andric 8890b57cec5SDimitry Andric // A subset of relaxations can only be applied for no-PIC. This method 8900b57cec5SDimitry Andric // handles such relaxations. Instructions encoding information was taken from: 8910b57cec5SDimitry Andric // "Intel 64 and IA-32 Architectures Software Developer's Manual V2" 8920b57cec5SDimitry Andric // (http://www.intel.com/content/dam/www/public/us/en/documents/manuals/ 8930b57cec5SDimitry Andric // 64-ia-32-architectures-software-developer-instruction-set-reference-manual-325383.pdf) 8940b57cec5SDimitry Andric static void relaxGotNoPic(uint8_t *loc, uint64_t val, uint8_t op, 8950b57cec5SDimitry Andric uint8_t modRm) { 8960b57cec5SDimitry Andric const uint8_t rex = loc[-3]; 8970b57cec5SDimitry Andric // Convert "test %reg, foo@GOTPCREL(%rip)" to "test $foo, %reg". 8980b57cec5SDimitry Andric if (op == 0x85) { 8990b57cec5SDimitry Andric // See "TEST-Logical Compare" (4-428 Vol. 2B), 9000b57cec5SDimitry Andric // TEST r/m64, r64 uses "full" ModR / M byte (no opcode extension). 9010b57cec5SDimitry Andric 9020b57cec5SDimitry Andric // ModR/M byte has form XX YYY ZZZ, where 9030b57cec5SDimitry Andric // YYY is MODRM.reg(register 2), ZZZ is MODRM.rm(register 1). 9040b57cec5SDimitry Andric // XX has different meanings: 9050b57cec5SDimitry Andric // 00: The operand's memory address is in reg1. 9060b57cec5SDimitry Andric // 01: The operand's memory address is reg1 + a byte-sized displacement. 9070b57cec5SDimitry Andric // 10: The operand's memory address is reg1 + a word-sized displacement. 9080b57cec5SDimitry Andric // 11: The operand is reg1 itself. 9090b57cec5SDimitry Andric // If an instruction requires only one operand, the unused reg2 field 9100b57cec5SDimitry Andric // holds extra opcode bits rather than a register code 9110b57cec5SDimitry Andric // 0xC0 == 11 000 000 binary. 9120b57cec5SDimitry Andric // 0x38 == 00 111 000 binary. 9130b57cec5SDimitry Andric // We transfer reg2 to reg1 here as operand. 9140b57cec5SDimitry Andric // See "2.1.3 ModR/M and SIB Bytes" (Vol. 2A 2-3). 9150b57cec5SDimitry Andric loc[-1] = 0xc0 | (modRm & 0x38) >> 3; // ModR/M byte. 9160b57cec5SDimitry Andric 9170b57cec5SDimitry Andric // Change opcode from TEST r/m64, r64 to TEST r/m64, imm32 9180b57cec5SDimitry Andric // See "TEST-Logical Compare" (4-428 Vol. 2B). 9190b57cec5SDimitry Andric loc[-2] = 0xf7; 9200b57cec5SDimitry Andric 9210b57cec5SDimitry Andric // Move R bit to the B bit in REX byte. 9220b57cec5SDimitry Andric // REX byte is encoded as 0100WRXB, where 9230b57cec5SDimitry Andric // 0100 is 4bit fixed pattern. 9240b57cec5SDimitry Andric // REX.W When 1, a 64-bit operand size is used. Otherwise, when 0, the 9250b57cec5SDimitry Andric // default operand size is used (which is 32-bit for most but not all 9260b57cec5SDimitry Andric // instructions). 9270b57cec5SDimitry Andric // REX.R This 1-bit value is an extension to the MODRM.reg field. 9280b57cec5SDimitry Andric // REX.X This 1-bit value is an extension to the SIB.index field. 9290b57cec5SDimitry Andric // REX.B This 1-bit value is an extension to the MODRM.rm field or the 9300b57cec5SDimitry Andric // SIB.base field. 9310b57cec5SDimitry Andric // See "2.2.1.2 More on REX Prefix Fields " (2-8 Vol. 2A). 9320b57cec5SDimitry Andric loc[-3] = (rex & ~0x4) | (rex & 0x4) >> 2; 9330b57cec5SDimitry Andric write32le(loc, val); 9340b57cec5SDimitry Andric return; 9350b57cec5SDimitry Andric } 9360b57cec5SDimitry Andric 9370b57cec5SDimitry Andric // If we are here then we need to relax the adc, add, and, cmp, or, sbb, sub 9380b57cec5SDimitry Andric // or xor operations. 9390b57cec5SDimitry Andric 9400b57cec5SDimitry Andric // Convert "binop foo@GOTPCREL(%rip), %reg" to "binop $foo, %reg". 9410b57cec5SDimitry Andric // Logic is close to one for test instruction above, but we also 9420b57cec5SDimitry Andric // write opcode extension here, see below for details. 9430b57cec5SDimitry Andric loc[-1] = 0xc0 | (modRm & 0x38) >> 3 | (op & 0x3c); // ModR/M byte. 9440b57cec5SDimitry Andric 9450b57cec5SDimitry Andric // Primary opcode is 0x81, opcode extension is one of: 9460b57cec5SDimitry Andric // 000b = ADD, 001b is OR, 010b is ADC, 011b is SBB, 9470b57cec5SDimitry Andric // 100b is AND, 101b is SUB, 110b is XOR, 111b is CMP. 9480b57cec5SDimitry Andric // This value was wrote to MODRM.reg in a line above. 9490b57cec5SDimitry Andric // See "3.2 INSTRUCTIONS (A-M)" (Vol. 2A 3-15), 9500b57cec5SDimitry Andric // "INSTRUCTION SET REFERENCE, N-Z" (Vol. 2B 4-1) for 9510b57cec5SDimitry Andric // descriptions about each operation. 9520b57cec5SDimitry Andric loc[-2] = 0x81; 9530b57cec5SDimitry Andric loc[-3] = (rex & ~0x4) | (rex & 0x4) >> 2; 9540b57cec5SDimitry Andric write32le(loc, val); 9550b57cec5SDimitry Andric } 9560b57cec5SDimitry Andric 957bdd1243dSDimitry Andric static void relaxGot(uint8_t *loc, const Relocation &rel, uint64_t val) { 9585f757f3fSDimitry Andric assert(isInt<32>(val) && 9595f757f3fSDimitry Andric "GOTPCRELX should not have been relaxed if it overflows"); 9600b57cec5SDimitry Andric const uint8_t op = loc[-2]; 9610b57cec5SDimitry Andric const uint8_t modRm = loc[-1]; 9620b57cec5SDimitry Andric 9630b57cec5SDimitry Andric // Convert "mov foo@GOTPCREL(%rip),%reg" to "lea foo(%rip),%reg". 9640b57cec5SDimitry Andric if (op == 0x8b) { 9650b57cec5SDimitry Andric loc[-2] = 0x8d; 9660b57cec5SDimitry Andric write32le(loc, val); 9670b57cec5SDimitry Andric return; 9680b57cec5SDimitry Andric } 9690b57cec5SDimitry Andric 9700b57cec5SDimitry Andric if (op != 0xff) { 9710b57cec5SDimitry Andric // We are relaxing a rip relative to an absolute, so compensate 9720b57cec5SDimitry Andric // for the old -4 addend. 9730b57cec5SDimitry Andric assert(!config->isPic); 9740b57cec5SDimitry Andric relaxGotNoPic(loc, val + 4, op, modRm); 9750b57cec5SDimitry Andric return; 9760b57cec5SDimitry Andric } 9770b57cec5SDimitry Andric 9780b57cec5SDimitry Andric // Convert call/jmp instructions. 9790b57cec5SDimitry Andric if (modRm == 0x15) { 9800b57cec5SDimitry Andric // ABI says we can convert "call *foo@GOTPCREL(%rip)" to "nop; call foo". 9810b57cec5SDimitry Andric // Instead we convert to "addr32 call foo" where addr32 is an instruction 9820b57cec5SDimitry Andric // prefix. That makes result expression to be a single instruction. 9830b57cec5SDimitry Andric loc[-2] = 0x67; // addr32 prefix 9840b57cec5SDimitry Andric loc[-1] = 0xe8; // call 9850b57cec5SDimitry Andric write32le(loc, val); 9860b57cec5SDimitry Andric return; 9870b57cec5SDimitry Andric } 9880b57cec5SDimitry Andric 9890b57cec5SDimitry Andric // Convert "jmp *foo@GOTPCREL(%rip)" to "jmp foo; nop". 9900b57cec5SDimitry Andric // jmp doesn't return, so it is fine to use nop here, it is just a stub. 9910b57cec5SDimitry Andric assert(modRm == 0x25); 9920b57cec5SDimitry Andric loc[-2] = 0xe9; // jmp 9930b57cec5SDimitry Andric loc[3] = 0x90; // nop 9940b57cec5SDimitry Andric write32le(loc - 1, val + 1); 9950b57cec5SDimitry Andric } 9960b57cec5SDimitry Andric 9970b57cec5SDimitry Andric // A split-stack prologue starts by checking the amount of stack remaining 9980b57cec5SDimitry Andric // in one of two ways: 9990b57cec5SDimitry Andric // A) Comparing of the stack pointer to a field in the tcb. 10000b57cec5SDimitry Andric // B) Or a load of a stack pointer offset with an lea to r10 or r11. 10010b57cec5SDimitry Andric bool X86_64::adjustPrologueForCrossSplitStack(uint8_t *loc, uint8_t *end, 10020b57cec5SDimitry Andric uint8_t stOther) const { 10030b57cec5SDimitry Andric if (!config->is64) { 100404eeddc0SDimitry Andric error("target doesn't support split stacks"); 10050b57cec5SDimitry Andric return false; 10060b57cec5SDimitry Andric } 10070b57cec5SDimitry Andric 10080b57cec5SDimitry Andric if (loc + 8 >= end) 10090b57cec5SDimitry Andric return false; 10100b57cec5SDimitry Andric 10110b57cec5SDimitry Andric // Replace "cmp %fs:0x70,%rsp" and subsequent branch 10120b57cec5SDimitry Andric // with "stc, nopl 0x0(%rax,%rax,1)" 10130b57cec5SDimitry Andric if (memcmp(loc, "\x64\x48\x3b\x24\x25", 5) == 0) { 10140b57cec5SDimitry Andric memcpy(loc, "\xf9\x0f\x1f\x84\x00\x00\x00\x00", 8); 10150b57cec5SDimitry Andric return true; 10160b57cec5SDimitry Andric } 10170b57cec5SDimitry Andric 10180b57cec5SDimitry Andric // Adjust "lea X(%rsp),%rYY" to lea "(X - 0x4000)(%rsp),%rYY" where rYY could 10190b57cec5SDimitry Andric // be r10 or r11. The lea instruction feeds a subsequent compare which checks 10200b57cec5SDimitry Andric // if there is X available stack space. Making X larger effectively reserves 10210b57cec5SDimitry Andric // that much additional space. The stack grows downward so subtract the value. 10220b57cec5SDimitry Andric if (memcmp(loc, "\x4c\x8d\x94\x24", 4) == 0 || 10230b57cec5SDimitry Andric memcmp(loc, "\x4c\x8d\x9c\x24", 4) == 0) { 10240b57cec5SDimitry Andric // The offset bytes are encoded four bytes after the start of the 10250b57cec5SDimitry Andric // instruction. 10260b57cec5SDimitry Andric write32le(loc + 4, read32le(loc + 4) - 0x4000); 10270b57cec5SDimitry Andric return true; 10280b57cec5SDimitry Andric } 10290b57cec5SDimitry Andric return false; 10300b57cec5SDimitry Andric } 10310b57cec5SDimitry Andric 1032bdd1243dSDimitry Andric void X86_64::relocateAlloc(InputSectionBase &sec, uint8_t *buf) const { 1033bdd1243dSDimitry Andric uint64_t secAddr = sec.getOutputSection()->addr; 1034bdd1243dSDimitry Andric if (auto *s = dyn_cast<InputSection>(&sec)) 1035bdd1243dSDimitry Andric secAddr += s->outSecOff; 10365f757f3fSDimitry Andric else if (auto *ehIn = dyn_cast<EhInputSection>(&sec)) 10375f757f3fSDimitry Andric secAddr += ehIn->getParent()->outSecOff; 1038bdd1243dSDimitry Andric for (const Relocation &rel : sec.relocs()) { 1039bdd1243dSDimitry Andric if (rel.expr == R_NONE) // See deleteFallThruJmpInsn 1040bdd1243dSDimitry Andric continue; 1041bdd1243dSDimitry Andric uint8_t *loc = buf + rel.offset; 1042bdd1243dSDimitry Andric const uint64_t val = 1043bdd1243dSDimitry Andric sec.getRelocTargetVA(sec.file, rel.type, rel.addend, 1044bdd1243dSDimitry Andric secAddr + rel.offset, *rel.sym, rel.expr); 1045bdd1243dSDimitry Andric relocate(loc, rel, val); 1046bdd1243dSDimitry Andric } 1047bdd1243dSDimitry Andric if (sec.jumpInstrMod) { 1048bdd1243dSDimitry Andric applyJumpInstrMod(buf + sec.jumpInstrMod->offset, 1049bdd1243dSDimitry Andric sec.jumpInstrMod->original, sec.jumpInstrMod->size); 1050bdd1243dSDimitry Andric } 1051bdd1243dSDimitry Andric } 1052bdd1243dSDimitry Andric 1053480093f4SDimitry Andric // If Intel Indirect Branch Tracking is enabled, we have to emit special PLT 1054480093f4SDimitry Andric // entries containing endbr64 instructions. A PLT entry will be split into two 1055480093f4SDimitry Andric // parts, one in .plt.sec (writePlt), and the other in .plt (writeIBTPlt). 1056480093f4SDimitry Andric namespace { 1057480093f4SDimitry Andric class IntelIBT : public X86_64 { 1058480093f4SDimitry Andric public: 1059480093f4SDimitry Andric IntelIBT(); 1060480093f4SDimitry Andric void writeGotPlt(uint8_t *buf, const Symbol &s) const override; 1061480093f4SDimitry Andric void writePlt(uint8_t *buf, const Symbol &sym, 1062480093f4SDimitry Andric uint64_t pltEntryAddr) const override; 1063480093f4SDimitry Andric void writeIBTPlt(uint8_t *buf, size_t numEntries) const override; 1064480093f4SDimitry Andric 1065480093f4SDimitry Andric static const unsigned IBTPltHeaderSize = 16; 1066480093f4SDimitry Andric }; 1067480093f4SDimitry Andric } // namespace 1068480093f4SDimitry Andric 1069480093f4SDimitry Andric IntelIBT::IntelIBT() { pltHeaderSize = 0; } 1070480093f4SDimitry Andric 1071480093f4SDimitry Andric void IntelIBT::writeGotPlt(uint8_t *buf, const Symbol &s) const { 1072480093f4SDimitry Andric uint64_t va = 107304eeddc0SDimitry Andric in.ibtPlt->getVA() + IBTPltHeaderSize + s.getPltIdx() * pltEntrySize; 1074480093f4SDimitry Andric write64le(buf, va); 1075480093f4SDimitry Andric } 1076480093f4SDimitry Andric 1077480093f4SDimitry Andric void IntelIBT::writePlt(uint8_t *buf, const Symbol &sym, 1078480093f4SDimitry Andric uint64_t pltEntryAddr) const { 1079480093f4SDimitry Andric const uint8_t Inst[] = { 1080480093f4SDimitry Andric 0xf3, 0x0f, 0x1e, 0xfa, // endbr64 1081480093f4SDimitry Andric 0xff, 0x25, 0, 0, 0, 0, // jmpq *got(%rip) 1082480093f4SDimitry Andric 0x66, 0x0f, 0x1f, 0x44, 0, 0, // nop 1083480093f4SDimitry Andric }; 1084480093f4SDimitry Andric memcpy(buf, Inst, sizeof(Inst)); 1085480093f4SDimitry Andric write32le(buf + 6, sym.getGotPltVA() - pltEntryAddr - 10); 1086480093f4SDimitry Andric } 1087480093f4SDimitry Andric 1088480093f4SDimitry Andric void IntelIBT::writeIBTPlt(uint8_t *buf, size_t numEntries) const { 1089480093f4SDimitry Andric writePltHeader(buf); 1090480093f4SDimitry Andric buf += IBTPltHeaderSize; 1091480093f4SDimitry Andric 1092480093f4SDimitry Andric const uint8_t inst[] = { 1093480093f4SDimitry Andric 0xf3, 0x0f, 0x1e, 0xfa, // endbr64 1094480093f4SDimitry Andric 0x68, 0, 0, 0, 0, // pushq <relocation index> 1095480093f4SDimitry Andric 0xe9, 0, 0, 0, 0, // jmpq plt[0] 1096480093f4SDimitry Andric 0x66, 0x90, // nop 1097480093f4SDimitry Andric }; 1098480093f4SDimitry Andric 1099480093f4SDimitry Andric for (size_t i = 0; i < numEntries; ++i) { 1100480093f4SDimitry Andric memcpy(buf, inst, sizeof(inst)); 1101480093f4SDimitry Andric write32le(buf + 5, i); 1102480093f4SDimitry Andric write32le(buf + 10, -pltHeaderSize - sizeof(inst) * i - 30); 1103480093f4SDimitry Andric buf += sizeof(inst); 1104480093f4SDimitry Andric } 1105480093f4SDimitry Andric } 1106480093f4SDimitry Andric 11070b57cec5SDimitry Andric // These nonstandard PLT entries are to migtigate Spectre v2 security 11080b57cec5SDimitry Andric // vulnerability. In order to mitigate Spectre v2, we want to avoid indirect 11090b57cec5SDimitry Andric // branch instructions such as `jmp *GOTPLT(%rip)`. So, in the following PLT 11100b57cec5SDimitry Andric // entries, we use a CALL followed by MOV and RET to do the same thing as an 11110b57cec5SDimitry Andric // indirect jump. That instruction sequence is so-called "retpoline". 11120b57cec5SDimitry Andric // 11130b57cec5SDimitry Andric // We have two types of retpoline PLTs as a size optimization. If `-z now` 11140b57cec5SDimitry Andric // is specified, all dynamic symbols are resolved at load-time. Thus, when 11150b57cec5SDimitry Andric // that option is given, we can omit code for symbol lazy resolution. 11160b57cec5SDimitry Andric namespace { 11170b57cec5SDimitry Andric class Retpoline : public X86_64 { 11180b57cec5SDimitry Andric public: 11190b57cec5SDimitry Andric Retpoline(); 11200b57cec5SDimitry Andric void writeGotPlt(uint8_t *buf, const Symbol &s) const override; 11210b57cec5SDimitry Andric void writePltHeader(uint8_t *buf) const override; 1122480093f4SDimitry Andric void writePlt(uint8_t *buf, const Symbol &sym, 1123480093f4SDimitry Andric uint64_t pltEntryAddr) const override; 11240b57cec5SDimitry Andric }; 11250b57cec5SDimitry Andric 11260b57cec5SDimitry Andric class RetpolineZNow : public X86_64 { 11270b57cec5SDimitry Andric public: 11280b57cec5SDimitry Andric RetpolineZNow(); 11290b57cec5SDimitry Andric void writeGotPlt(uint8_t *buf, const Symbol &s) const override {} 11300b57cec5SDimitry Andric void writePltHeader(uint8_t *buf) const override; 1131480093f4SDimitry Andric void writePlt(uint8_t *buf, const Symbol &sym, 1132480093f4SDimitry Andric uint64_t pltEntryAddr) const override; 11330b57cec5SDimitry Andric }; 11340b57cec5SDimitry Andric } // namespace 11350b57cec5SDimitry Andric 11360b57cec5SDimitry Andric Retpoline::Retpoline() { 11370b57cec5SDimitry Andric pltHeaderSize = 48; 11380b57cec5SDimitry Andric pltEntrySize = 32; 1139480093f4SDimitry Andric ipltEntrySize = 32; 11400b57cec5SDimitry Andric } 11410b57cec5SDimitry Andric 11420b57cec5SDimitry Andric void Retpoline::writeGotPlt(uint8_t *buf, const Symbol &s) const { 11430b57cec5SDimitry Andric write64le(buf, s.getPltVA() + 17); 11440b57cec5SDimitry Andric } 11450b57cec5SDimitry Andric 11460b57cec5SDimitry Andric void Retpoline::writePltHeader(uint8_t *buf) const { 11470b57cec5SDimitry Andric const uint8_t insn[] = { 11480b57cec5SDimitry Andric 0xff, 0x35, 0, 0, 0, 0, // 0: pushq GOTPLT+8(%rip) 11490b57cec5SDimitry Andric 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // 6: mov GOTPLT+16(%rip), %r11 11500b57cec5SDimitry Andric 0xe8, 0x0e, 0x00, 0x00, 0x00, // d: callq next 11510b57cec5SDimitry Andric 0xf3, 0x90, // 12: loop: pause 11520b57cec5SDimitry Andric 0x0f, 0xae, 0xe8, // 14: lfence 11530b57cec5SDimitry Andric 0xeb, 0xf9, // 17: jmp loop 11540b57cec5SDimitry Andric 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 19: int3; .align 16 11550b57cec5SDimitry Andric 0x4c, 0x89, 0x1c, 0x24, // 20: next: mov %r11, (%rsp) 11560b57cec5SDimitry Andric 0xc3, // 24: ret 11570b57cec5SDimitry Andric 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 25: int3; padding 11580b57cec5SDimitry Andric 0xcc, 0xcc, 0xcc, 0xcc, // 2c: int3; padding 11590b57cec5SDimitry Andric }; 11600b57cec5SDimitry Andric memcpy(buf, insn, sizeof(insn)); 11610b57cec5SDimitry Andric 11620b57cec5SDimitry Andric uint64_t gotPlt = in.gotPlt->getVA(); 11630b57cec5SDimitry Andric uint64_t plt = in.plt->getVA(); 11640b57cec5SDimitry Andric write32le(buf + 2, gotPlt - plt - 6 + 8); 11650b57cec5SDimitry Andric write32le(buf + 9, gotPlt - plt - 13 + 16); 11660b57cec5SDimitry Andric } 11670b57cec5SDimitry Andric 1168480093f4SDimitry Andric void Retpoline::writePlt(uint8_t *buf, const Symbol &sym, 1169480093f4SDimitry Andric uint64_t pltEntryAddr) const { 11700b57cec5SDimitry Andric const uint8_t insn[] = { 11710b57cec5SDimitry Andric 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // 0: mov foo@GOTPLT(%rip), %r11 11720b57cec5SDimitry Andric 0xe8, 0, 0, 0, 0, // 7: callq plt+0x20 11730b57cec5SDimitry Andric 0xe9, 0, 0, 0, 0, // c: jmp plt+0x12 11740b57cec5SDimitry Andric 0x68, 0, 0, 0, 0, // 11: pushq <relocation index> 11750b57cec5SDimitry Andric 0xe9, 0, 0, 0, 0, // 16: jmp plt+0 11760b57cec5SDimitry Andric 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1b: int3; padding 11770b57cec5SDimitry Andric }; 11780b57cec5SDimitry Andric memcpy(buf, insn, sizeof(insn)); 11790b57cec5SDimitry Andric 1180480093f4SDimitry Andric uint64_t off = pltEntryAddr - in.plt->getVA(); 11810b57cec5SDimitry Andric 1182480093f4SDimitry Andric write32le(buf + 3, sym.getGotPltVA() - pltEntryAddr - 7); 11830b57cec5SDimitry Andric write32le(buf + 8, -off - 12 + 32); 11840b57cec5SDimitry Andric write32le(buf + 13, -off - 17 + 18); 118504eeddc0SDimitry Andric write32le(buf + 18, sym.getPltIdx()); 11860b57cec5SDimitry Andric write32le(buf + 23, -off - 27); 11870b57cec5SDimitry Andric } 11880b57cec5SDimitry Andric 11890b57cec5SDimitry Andric RetpolineZNow::RetpolineZNow() { 11900b57cec5SDimitry Andric pltHeaderSize = 32; 11910b57cec5SDimitry Andric pltEntrySize = 16; 1192480093f4SDimitry Andric ipltEntrySize = 16; 11930b57cec5SDimitry Andric } 11940b57cec5SDimitry Andric 11950b57cec5SDimitry Andric void RetpolineZNow::writePltHeader(uint8_t *buf) const { 11960b57cec5SDimitry Andric const uint8_t insn[] = { 11970b57cec5SDimitry Andric 0xe8, 0x0b, 0x00, 0x00, 0x00, // 0: call next 11980b57cec5SDimitry Andric 0xf3, 0x90, // 5: loop: pause 11990b57cec5SDimitry Andric 0x0f, 0xae, 0xe8, // 7: lfence 12000b57cec5SDimitry Andric 0xeb, 0xf9, // a: jmp loop 12010b57cec5SDimitry Andric 0xcc, 0xcc, 0xcc, 0xcc, // c: int3; .align 16 12020b57cec5SDimitry Andric 0x4c, 0x89, 0x1c, 0x24, // 10: next: mov %r11, (%rsp) 12030b57cec5SDimitry Andric 0xc3, // 14: ret 12040b57cec5SDimitry Andric 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 15: int3; padding 12050b57cec5SDimitry Andric 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1a: int3; padding 12060b57cec5SDimitry Andric 0xcc, // 1f: int3; padding 12070b57cec5SDimitry Andric }; 12080b57cec5SDimitry Andric memcpy(buf, insn, sizeof(insn)); 12090b57cec5SDimitry Andric } 12100b57cec5SDimitry Andric 1211480093f4SDimitry Andric void RetpolineZNow::writePlt(uint8_t *buf, const Symbol &sym, 1212480093f4SDimitry Andric uint64_t pltEntryAddr) const { 12130b57cec5SDimitry Andric const uint8_t insn[] = { 12140b57cec5SDimitry Andric 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // mov foo@GOTPLT(%rip), %r11 12150b57cec5SDimitry Andric 0xe9, 0, 0, 0, 0, // jmp plt+0 12160b57cec5SDimitry Andric 0xcc, 0xcc, 0xcc, 0xcc, // int3; padding 12170b57cec5SDimitry Andric }; 12180b57cec5SDimitry Andric memcpy(buf, insn, sizeof(insn)); 12190b57cec5SDimitry Andric 1220480093f4SDimitry Andric write32le(buf + 3, sym.getGotPltVA() - pltEntryAddr - 7); 1221480093f4SDimitry Andric write32le(buf + 8, in.plt->getVA() - pltEntryAddr - 12); 12220b57cec5SDimitry Andric } 12230b57cec5SDimitry Andric 12240b57cec5SDimitry Andric static TargetInfo *getTargetInfo() { 12250b57cec5SDimitry Andric if (config->zRetpolineplt) { 12260b57cec5SDimitry Andric if (config->zNow) { 12270b57cec5SDimitry Andric static RetpolineZNow t; 12280b57cec5SDimitry Andric return &t; 12290b57cec5SDimitry Andric } 12300b57cec5SDimitry Andric static Retpoline t; 12310b57cec5SDimitry Andric return &t; 12320b57cec5SDimitry Andric } 12330b57cec5SDimitry Andric 1234480093f4SDimitry Andric if (config->andFeatures & GNU_PROPERTY_X86_FEATURE_1_IBT) { 1235480093f4SDimitry Andric static IntelIBT t; 1236480093f4SDimitry Andric return &t; 1237480093f4SDimitry Andric } 1238480093f4SDimitry Andric 12390b57cec5SDimitry Andric static X86_64 t; 12400b57cec5SDimitry Andric return &t; 12410b57cec5SDimitry Andric } 12420b57cec5SDimitry Andric 12435ffd83dbSDimitry Andric TargetInfo *elf::getX86_64TargetInfo() { return getTargetInfo(); } 1244