10b57cec5SDimitry Andric //===- X86_64.cpp ---------------------------------------------------------===// 20b57cec5SDimitry Andric // 30b57cec5SDimitry Andric // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 40b57cec5SDimitry Andric // See https://llvm.org/LICENSE.txt for license information. 50b57cec5SDimitry Andric // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 60b57cec5SDimitry Andric // 70b57cec5SDimitry Andric //===----------------------------------------------------------------------===// 80b57cec5SDimitry Andric 90b57cec5SDimitry Andric #include "InputFiles.h" 100b57cec5SDimitry Andric #include "Symbols.h" 110b57cec5SDimitry Andric #include "SyntheticSections.h" 120b57cec5SDimitry Andric #include "Target.h" 130b57cec5SDimitry Andric #include "lld/Common/ErrorHandler.h" 140b57cec5SDimitry Andric #include "llvm/Object/ELF.h" 150b57cec5SDimitry Andric #include "llvm/Support/Endian.h" 160b57cec5SDimitry Andric 170b57cec5SDimitry Andric using namespace llvm; 180b57cec5SDimitry Andric using namespace llvm::object; 190b57cec5SDimitry Andric using namespace llvm::support::endian; 200b57cec5SDimitry Andric using namespace llvm::ELF; 2185868e8aSDimitry Andric 2285868e8aSDimitry Andric namespace lld { 2385868e8aSDimitry Andric namespace elf { 240b57cec5SDimitry Andric 250b57cec5SDimitry Andric namespace { 260b57cec5SDimitry Andric class X86_64 : public TargetInfo { 270b57cec5SDimitry Andric public: 280b57cec5SDimitry Andric X86_64(); 290b57cec5SDimitry Andric int getTlsGdRelaxSkip(RelType type) const override; 300b57cec5SDimitry Andric RelExpr getRelExpr(RelType type, const Symbol &s, 310b57cec5SDimitry Andric const uint8_t *loc) const override; 320b57cec5SDimitry Andric RelType getDynRel(RelType type) const override; 330b57cec5SDimitry Andric void writeGotPltHeader(uint8_t *buf) const override; 340b57cec5SDimitry Andric void writeGotPlt(uint8_t *buf, const Symbol &s) const override; 350b57cec5SDimitry Andric void writePltHeader(uint8_t *buf) const override; 36*480093f4SDimitry Andric void writePlt(uint8_t *buf, const Symbol &sym, 37*480093f4SDimitry Andric uint64_t pltEntryAddr) const override; 380b57cec5SDimitry Andric void relocateOne(uint8_t *loc, RelType type, uint64_t val) const override; 390b57cec5SDimitry Andric 400b57cec5SDimitry Andric RelExpr adjustRelaxExpr(RelType type, const uint8_t *data, 410b57cec5SDimitry Andric RelExpr expr) const override; 420b57cec5SDimitry Andric void relaxGot(uint8_t *loc, RelType type, uint64_t val) const override; 430b57cec5SDimitry Andric void relaxTlsGdToIe(uint8_t *loc, RelType type, uint64_t val) const override; 440b57cec5SDimitry Andric void relaxTlsGdToLe(uint8_t *loc, RelType type, uint64_t val) const override; 450b57cec5SDimitry Andric void relaxTlsIeToLe(uint8_t *loc, RelType type, uint64_t val) const override; 460b57cec5SDimitry Andric void relaxTlsLdToLe(uint8_t *loc, RelType type, uint64_t val) const override; 470b57cec5SDimitry Andric bool adjustPrologueForCrossSplitStack(uint8_t *loc, uint8_t *end, 480b57cec5SDimitry Andric uint8_t stOther) const override; 490b57cec5SDimitry Andric }; 500b57cec5SDimitry Andric } // namespace 510b57cec5SDimitry Andric 520b57cec5SDimitry Andric X86_64::X86_64() { 530b57cec5SDimitry Andric copyRel = R_X86_64_COPY; 540b57cec5SDimitry Andric gotRel = R_X86_64_GLOB_DAT; 550b57cec5SDimitry Andric noneRel = R_X86_64_NONE; 560b57cec5SDimitry Andric pltRel = R_X86_64_JUMP_SLOT; 570b57cec5SDimitry Andric relativeRel = R_X86_64_RELATIVE; 580b57cec5SDimitry Andric iRelativeRel = R_X86_64_IRELATIVE; 590b57cec5SDimitry Andric symbolicRel = R_X86_64_64; 600b57cec5SDimitry Andric tlsDescRel = R_X86_64_TLSDESC; 610b57cec5SDimitry Andric tlsGotRel = R_X86_64_TPOFF64; 620b57cec5SDimitry Andric tlsModuleIndexRel = R_X86_64_DTPMOD64; 630b57cec5SDimitry Andric tlsOffsetRel = R_X86_64_DTPOFF64; 640b57cec5SDimitry Andric pltHeaderSize = 16; 65*480093f4SDimitry Andric pltEntrySize = 16; 66*480093f4SDimitry Andric ipltEntrySize = 16; 670b57cec5SDimitry Andric trapInstr = {0xcc, 0xcc, 0xcc, 0xcc}; // 0xcc = INT3 680b57cec5SDimitry Andric 690b57cec5SDimitry Andric // Align to the large page size (known as a superpage or huge page). 700b57cec5SDimitry Andric // FreeBSD automatically promotes large, superpage-aligned allocations. 710b57cec5SDimitry Andric defaultImageBase = 0x200000; 720b57cec5SDimitry Andric } 730b57cec5SDimitry Andric 740b57cec5SDimitry Andric int X86_64::getTlsGdRelaxSkip(RelType type) const { return 2; } 750b57cec5SDimitry Andric 760b57cec5SDimitry Andric RelExpr X86_64::getRelExpr(RelType type, const Symbol &s, 770b57cec5SDimitry Andric const uint8_t *loc) const { 780b57cec5SDimitry Andric if (type == R_X86_64_GOTTPOFF) 790b57cec5SDimitry Andric config->hasStaticTlsModel = true; 800b57cec5SDimitry Andric 810b57cec5SDimitry Andric switch (type) { 820b57cec5SDimitry Andric case R_X86_64_8: 830b57cec5SDimitry Andric case R_X86_64_16: 840b57cec5SDimitry Andric case R_X86_64_32: 850b57cec5SDimitry Andric case R_X86_64_32S: 860b57cec5SDimitry Andric case R_X86_64_64: 870b57cec5SDimitry Andric return R_ABS; 880b57cec5SDimitry Andric case R_X86_64_DTPOFF32: 890b57cec5SDimitry Andric case R_X86_64_DTPOFF64: 900b57cec5SDimitry Andric return R_DTPREL; 910b57cec5SDimitry Andric case R_X86_64_TPOFF32: 920b57cec5SDimitry Andric return R_TLS; 930b57cec5SDimitry Andric case R_X86_64_TLSDESC_CALL: 940b57cec5SDimitry Andric return R_TLSDESC_CALL; 950b57cec5SDimitry Andric case R_X86_64_TLSLD: 960b57cec5SDimitry Andric return R_TLSLD_PC; 970b57cec5SDimitry Andric case R_X86_64_TLSGD: 980b57cec5SDimitry Andric return R_TLSGD_PC; 990b57cec5SDimitry Andric case R_X86_64_SIZE32: 1000b57cec5SDimitry Andric case R_X86_64_SIZE64: 1010b57cec5SDimitry Andric return R_SIZE; 1020b57cec5SDimitry Andric case R_X86_64_PLT32: 1030b57cec5SDimitry Andric return R_PLT_PC; 1040b57cec5SDimitry Andric case R_X86_64_PC8: 1050b57cec5SDimitry Andric case R_X86_64_PC16: 1060b57cec5SDimitry Andric case R_X86_64_PC32: 1070b57cec5SDimitry Andric case R_X86_64_PC64: 1080b57cec5SDimitry Andric return R_PC; 1090b57cec5SDimitry Andric case R_X86_64_GOT32: 1100b57cec5SDimitry Andric case R_X86_64_GOT64: 1110b57cec5SDimitry Andric return R_GOTPLT; 1120b57cec5SDimitry Andric case R_X86_64_GOTPC32_TLSDESC: 1130b57cec5SDimitry Andric return R_TLSDESC_PC; 1140b57cec5SDimitry Andric case R_X86_64_GOTPCREL: 1150b57cec5SDimitry Andric case R_X86_64_GOTPCRELX: 1160b57cec5SDimitry Andric case R_X86_64_REX_GOTPCRELX: 1170b57cec5SDimitry Andric case R_X86_64_GOTTPOFF: 1180b57cec5SDimitry Andric return R_GOT_PC; 1190b57cec5SDimitry Andric case R_X86_64_GOTOFF64: 1200b57cec5SDimitry Andric return R_GOTPLTREL; 1210b57cec5SDimitry Andric case R_X86_64_GOTPC32: 1220b57cec5SDimitry Andric case R_X86_64_GOTPC64: 1230b57cec5SDimitry Andric return R_GOTPLTONLY_PC; 1240b57cec5SDimitry Andric case R_X86_64_NONE: 1250b57cec5SDimitry Andric return R_NONE; 1260b57cec5SDimitry Andric default: 1270b57cec5SDimitry Andric error(getErrorLocation(loc) + "unknown relocation (" + Twine(type) + 1280b57cec5SDimitry Andric ") against symbol " + toString(s)); 1290b57cec5SDimitry Andric return R_NONE; 1300b57cec5SDimitry Andric } 1310b57cec5SDimitry Andric } 1320b57cec5SDimitry Andric 1330b57cec5SDimitry Andric void X86_64::writeGotPltHeader(uint8_t *buf) const { 1340b57cec5SDimitry Andric // The first entry holds the value of _DYNAMIC. It is not clear why that is 1350b57cec5SDimitry Andric // required, but it is documented in the psabi and the glibc dynamic linker 1360b57cec5SDimitry Andric // seems to use it (note that this is relevant for linking ld.so, not any 1370b57cec5SDimitry Andric // other program). 1380b57cec5SDimitry Andric write64le(buf, mainPart->dynamic->getVA()); 1390b57cec5SDimitry Andric } 1400b57cec5SDimitry Andric 1410b57cec5SDimitry Andric void X86_64::writeGotPlt(uint8_t *buf, const Symbol &s) const { 1420b57cec5SDimitry Andric // See comments in X86::writeGotPlt. 1430b57cec5SDimitry Andric write64le(buf, s.getPltVA() + 6); 1440b57cec5SDimitry Andric } 1450b57cec5SDimitry Andric 1460b57cec5SDimitry Andric void X86_64::writePltHeader(uint8_t *buf) const { 1470b57cec5SDimitry Andric const uint8_t pltData[] = { 1480b57cec5SDimitry Andric 0xff, 0x35, 0, 0, 0, 0, // pushq GOTPLT+8(%rip) 1490b57cec5SDimitry Andric 0xff, 0x25, 0, 0, 0, 0, // jmp *GOTPLT+16(%rip) 1500b57cec5SDimitry Andric 0x0f, 0x1f, 0x40, 0x00, // nop 1510b57cec5SDimitry Andric }; 1520b57cec5SDimitry Andric memcpy(buf, pltData, sizeof(pltData)); 1530b57cec5SDimitry Andric uint64_t gotPlt = in.gotPlt->getVA(); 154*480093f4SDimitry Andric uint64_t plt = in.ibtPlt ? in.ibtPlt->getVA() : in.plt->getVA(); 1550b57cec5SDimitry Andric write32le(buf + 2, gotPlt - plt + 2); // GOTPLT+8 1560b57cec5SDimitry Andric write32le(buf + 8, gotPlt - plt + 4); // GOTPLT+16 1570b57cec5SDimitry Andric } 1580b57cec5SDimitry Andric 159*480093f4SDimitry Andric void X86_64::writePlt(uint8_t *buf, const Symbol &sym, 160*480093f4SDimitry Andric uint64_t pltEntryAddr) const { 1610b57cec5SDimitry Andric const uint8_t inst[] = { 1620b57cec5SDimitry Andric 0xff, 0x25, 0, 0, 0, 0, // jmpq *got(%rip) 1630b57cec5SDimitry Andric 0x68, 0, 0, 0, 0, // pushq <relocation index> 1640b57cec5SDimitry Andric 0xe9, 0, 0, 0, 0, // jmpq plt[0] 1650b57cec5SDimitry Andric }; 1660b57cec5SDimitry Andric memcpy(buf, inst, sizeof(inst)); 1670b57cec5SDimitry Andric 168*480093f4SDimitry Andric write32le(buf + 2, sym.getGotPltVA() - pltEntryAddr - 6); 169*480093f4SDimitry Andric write32le(buf + 7, sym.pltIndex); 170*480093f4SDimitry Andric write32le(buf + 12, in.plt->getVA() - pltEntryAddr - 16); 1710b57cec5SDimitry Andric } 1720b57cec5SDimitry Andric 1730b57cec5SDimitry Andric RelType X86_64::getDynRel(RelType type) const { 1740b57cec5SDimitry Andric if (type == R_X86_64_64 || type == R_X86_64_PC64 || type == R_X86_64_SIZE32 || 1750b57cec5SDimitry Andric type == R_X86_64_SIZE64) 1760b57cec5SDimitry Andric return type; 1770b57cec5SDimitry Andric return R_X86_64_NONE; 1780b57cec5SDimitry Andric } 1790b57cec5SDimitry Andric 1800b57cec5SDimitry Andric void X86_64::relaxTlsGdToLe(uint8_t *loc, RelType type, uint64_t val) const { 1810b57cec5SDimitry Andric if (type == R_X86_64_TLSGD) { 1820b57cec5SDimitry Andric // Convert 1830b57cec5SDimitry Andric // .byte 0x66 1840b57cec5SDimitry Andric // leaq x@tlsgd(%rip), %rdi 1850b57cec5SDimitry Andric // .word 0x6666 1860b57cec5SDimitry Andric // rex64 1870b57cec5SDimitry Andric // call __tls_get_addr@plt 1880b57cec5SDimitry Andric // to the following two instructions. 1890b57cec5SDimitry Andric const uint8_t inst[] = { 1900b57cec5SDimitry Andric 0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 1910b57cec5SDimitry Andric 0x00, 0x00, // mov %fs:0x0,%rax 1920b57cec5SDimitry Andric 0x48, 0x8d, 0x80, 0, 0, 0, 0, // lea x@tpoff,%rax 1930b57cec5SDimitry Andric }; 1940b57cec5SDimitry Andric memcpy(loc - 4, inst, sizeof(inst)); 1950b57cec5SDimitry Andric 1960b57cec5SDimitry Andric // The original code used a pc relative relocation and so we have to 1970b57cec5SDimitry Andric // compensate for the -4 in had in the addend. 1980b57cec5SDimitry Andric write32le(loc + 8, val + 4); 1990b57cec5SDimitry Andric } else { 2000b57cec5SDimitry Andric // Convert 2010b57cec5SDimitry Andric // lea x@tlsgd(%rip), %rax 2020b57cec5SDimitry Andric // call *(%rax) 2030b57cec5SDimitry Andric // to the following two instructions. 2040b57cec5SDimitry Andric assert(type == R_X86_64_GOTPC32_TLSDESC); 2050b57cec5SDimitry Andric if (memcmp(loc - 3, "\x48\x8d\x05", 3)) { 2060b57cec5SDimitry Andric error(getErrorLocation(loc - 3) + "R_X86_64_GOTPC32_TLSDESC must be used " 2070b57cec5SDimitry Andric "in callq *x@tlsdesc(%rip), %rax"); 2080b57cec5SDimitry Andric return; 2090b57cec5SDimitry Andric } 2100b57cec5SDimitry Andric // movq $x@tpoff(%rip),%rax 2110b57cec5SDimitry Andric loc[-2] = 0xc7; 2120b57cec5SDimitry Andric loc[-1] = 0xc0; 2130b57cec5SDimitry Andric write32le(loc, val + 4); 2140b57cec5SDimitry Andric // xchg ax,ax 2150b57cec5SDimitry Andric loc[4] = 0x66; 2160b57cec5SDimitry Andric loc[5] = 0x90; 2170b57cec5SDimitry Andric } 2180b57cec5SDimitry Andric } 2190b57cec5SDimitry Andric 2200b57cec5SDimitry Andric void X86_64::relaxTlsGdToIe(uint8_t *loc, RelType type, uint64_t val) const { 2210b57cec5SDimitry Andric if (type == R_X86_64_TLSGD) { 2220b57cec5SDimitry Andric // Convert 2230b57cec5SDimitry Andric // .byte 0x66 2240b57cec5SDimitry Andric // leaq x@tlsgd(%rip), %rdi 2250b57cec5SDimitry Andric // .word 0x6666 2260b57cec5SDimitry Andric // rex64 2270b57cec5SDimitry Andric // call __tls_get_addr@plt 2280b57cec5SDimitry Andric // to the following two instructions. 2290b57cec5SDimitry Andric const uint8_t inst[] = { 2300b57cec5SDimitry Andric 0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 2310b57cec5SDimitry Andric 0x00, 0x00, // mov %fs:0x0,%rax 2320b57cec5SDimitry Andric 0x48, 0x03, 0x05, 0, 0, 0, 0, // addq x@gottpoff(%rip),%rax 2330b57cec5SDimitry Andric }; 2340b57cec5SDimitry Andric memcpy(loc - 4, inst, sizeof(inst)); 2350b57cec5SDimitry Andric 2360b57cec5SDimitry Andric // Both code sequences are PC relatives, but since we are moving the 2370b57cec5SDimitry Andric // constant forward by 8 bytes we have to subtract the value by 8. 2380b57cec5SDimitry Andric write32le(loc + 8, val - 8); 2390b57cec5SDimitry Andric } else { 2400b57cec5SDimitry Andric // Convert 2410b57cec5SDimitry Andric // lea x@tlsgd(%rip), %rax 2420b57cec5SDimitry Andric // call *(%rax) 2430b57cec5SDimitry Andric // to the following two instructions. 2440b57cec5SDimitry Andric assert(type == R_X86_64_GOTPC32_TLSDESC); 2450b57cec5SDimitry Andric if (memcmp(loc - 3, "\x48\x8d\x05", 3)) { 2460b57cec5SDimitry Andric error(getErrorLocation(loc - 3) + "R_X86_64_GOTPC32_TLSDESC must be used " 2470b57cec5SDimitry Andric "in callq *x@tlsdesc(%rip), %rax"); 2480b57cec5SDimitry Andric return; 2490b57cec5SDimitry Andric } 2500b57cec5SDimitry Andric // movq x@gottpoff(%rip),%rax 2510b57cec5SDimitry Andric loc[-2] = 0x8b; 2520b57cec5SDimitry Andric write32le(loc, val); 2530b57cec5SDimitry Andric // xchg ax,ax 2540b57cec5SDimitry Andric loc[4] = 0x66; 2550b57cec5SDimitry Andric loc[5] = 0x90; 2560b57cec5SDimitry Andric } 2570b57cec5SDimitry Andric } 2580b57cec5SDimitry Andric 2590b57cec5SDimitry Andric // In some conditions, R_X86_64_GOTTPOFF relocation can be optimized to 2600b57cec5SDimitry Andric // R_X86_64_TPOFF32 so that it does not use GOT. 2610b57cec5SDimitry Andric void X86_64::relaxTlsIeToLe(uint8_t *loc, RelType type, uint64_t val) const { 2620b57cec5SDimitry Andric uint8_t *inst = loc - 3; 2630b57cec5SDimitry Andric uint8_t reg = loc[-1] >> 3; 2640b57cec5SDimitry Andric uint8_t *regSlot = loc - 1; 2650b57cec5SDimitry Andric 2660b57cec5SDimitry Andric // Note that ADD with RSP or R12 is converted to ADD instead of LEA 2670b57cec5SDimitry Andric // because LEA with these registers needs 4 bytes to encode and thus 2680b57cec5SDimitry Andric // wouldn't fit the space. 2690b57cec5SDimitry Andric 2700b57cec5SDimitry Andric if (memcmp(inst, "\x48\x03\x25", 3) == 0) { 2710b57cec5SDimitry Andric // "addq foo@gottpoff(%rip),%rsp" -> "addq $foo,%rsp" 2720b57cec5SDimitry Andric memcpy(inst, "\x48\x81\xc4", 3); 2730b57cec5SDimitry Andric } else if (memcmp(inst, "\x4c\x03\x25", 3) == 0) { 2740b57cec5SDimitry Andric // "addq foo@gottpoff(%rip),%r12" -> "addq $foo,%r12" 2750b57cec5SDimitry Andric memcpy(inst, "\x49\x81\xc4", 3); 2760b57cec5SDimitry Andric } else if (memcmp(inst, "\x4c\x03", 2) == 0) { 2770b57cec5SDimitry Andric // "addq foo@gottpoff(%rip),%r[8-15]" -> "leaq foo(%r[8-15]),%r[8-15]" 2780b57cec5SDimitry Andric memcpy(inst, "\x4d\x8d", 2); 2790b57cec5SDimitry Andric *regSlot = 0x80 | (reg << 3) | reg; 2800b57cec5SDimitry Andric } else if (memcmp(inst, "\x48\x03", 2) == 0) { 2810b57cec5SDimitry Andric // "addq foo@gottpoff(%rip),%reg -> "leaq foo(%reg),%reg" 2820b57cec5SDimitry Andric memcpy(inst, "\x48\x8d", 2); 2830b57cec5SDimitry Andric *regSlot = 0x80 | (reg << 3) | reg; 2840b57cec5SDimitry Andric } else if (memcmp(inst, "\x4c\x8b", 2) == 0) { 2850b57cec5SDimitry Andric // "movq foo@gottpoff(%rip),%r[8-15]" -> "movq $foo,%r[8-15]" 2860b57cec5SDimitry Andric memcpy(inst, "\x49\xc7", 2); 2870b57cec5SDimitry Andric *regSlot = 0xc0 | reg; 2880b57cec5SDimitry Andric } else if (memcmp(inst, "\x48\x8b", 2) == 0) { 2890b57cec5SDimitry Andric // "movq foo@gottpoff(%rip),%reg" -> "movq $foo,%reg" 2900b57cec5SDimitry Andric memcpy(inst, "\x48\xc7", 2); 2910b57cec5SDimitry Andric *regSlot = 0xc0 | reg; 2920b57cec5SDimitry Andric } else { 2930b57cec5SDimitry Andric error(getErrorLocation(loc - 3) + 2940b57cec5SDimitry Andric "R_X86_64_GOTTPOFF must be used in MOVQ or ADDQ instructions only"); 2950b57cec5SDimitry Andric } 2960b57cec5SDimitry Andric 2970b57cec5SDimitry Andric // The original code used a PC relative relocation. 2980b57cec5SDimitry Andric // Need to compensate for the -4 it had in the addend. 2990b57cec5SDimitry Andric write32le(loc, val + 4); 3000b57cec5SDimitry Andric } 3010b57cec5SDimitry Andric 3020b57cec5SDimitry Andric void X86_64::relaxTlsLdToLe(uint8_t *loc, RelType type, uint64_t val) const { 3030b57cec5SDimitry Andric if (type == R_X86_64_DTPOFF64) { 3040b57cec5SDimitry Andric write64le(loc, val); 3050b57cec5SDimitry Andric return; 3060b57cec5SDimitry Andric } 3070b57cec5SDimitry Andric if (type == R_X86_64_DTPOFF32) { 3080b57cec5SDimitry Andric write32le(loc, val); 3090b57cec5SDimitry Andric return; 3100b57cec5SDimitry Andric } 3110b57cec5SDimitry Andric 3120b57cec5SDimitry Andric const uint8_t inst[] = { 3130b57cec5SDimitry Andric 0x66, 0x66, // .word 0x6666 3140b57cec5SDimitry Andric 0x66, // .byte 0x66 3150b57cec5SDimitry Andric 0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 0x00, 0x00, // mov %fs:0,%rax 3160b57cec5SDimitry Andric }; 3170b57cec5SDimitry Andric 3180b57cec5SDimitry Andric if (loc[4] == 0xe8) { 3190b57cec5SDimitry Andric // Convert 3200b57cec5SDimitry Andric // leaq bar@tlsld(%rip), %rdi # 48 8d 3d <Loc> 3210b57cec5SDimitry Andric // callq __tls_get_addr@PLT # e8 <disp32> 3220b57cec5SDimitry Andric // leaq bar@dtpoff(%rax), %rcx 3230b57cec5SDimitry Andric // to 3240b57cec5SDimitry Andric // .word 0x6666 3250b57cec5SDimitry Andric // .byte 0x66 3260b57cec5SDimitry Andric // mov %fs:0,%rax 3270b57cec5SDimitry Andric // leaq bar@tpoff(%rax), %rcx 3280b57cec5SDimitry Andric memcpy(loc - 3, inst, sizeof(inst)); 3290b57cec5SDimitry Andric return; 3300b57cec5SDimitry Andric } 3310b57cec5SDimitry Andric 3320b57cec5SDimitry Andric if (loc[4] == 0xff && loc[5] == 0x15) { 3330b57cec5SDimitry Andric // Convert 3340b57cec5SDimitry Andric // leaq x@tlsld(%rip),%rdi # 48 8d 3d <Loc> 3350b57cec5SDimitry Andric // call *__tls_get_addr@GOTPCREL(%rip) # ff 15 <disp32> 3360b57cec5SDimitry Andric // to 3370b57cec5SDimitry Andric // .long 0x66666666 3380b57cec5SDimitry Andric // movq %fs:0,%rax 3390b57cec5SDimitry Andric // See "Table 11.9: LD -> LE Code Transition (LP64)" in 3400b57cec5SDimitry Andric // https://raw.githubusercontent.com/wiki/hjl-tools/x86-psABI/x86-64-psABI-1.0.pdf 3410b57cec5SDimitry Andric loc[-3] = 0x66; 3420b57cec5SDimitry Andric memcpy(loc - 2, inst, sizeof(inst)); 3430b57cec5SDimitry Andric return; 3440b57cec5SDimitry Andric } 3450b57cec5SDimitry Andric 3460b57cec5SDimitry Andric error(getErrorLocation(loc - 3) + 3470b57cec5SDimitry Andric "expected R_X86_64_PLT32 or R_X86_64_GOTPCRELX after R_X86_64_TLSLD"); 3480b57cec5SDimitry Andric } 3490b57cec5SDimitry Andric 3500b57cec5SDimitry Andric void X86_64::relocateOne(uint8_t *loc, RelType type, uint64_t val) const { 3510b57cec5SDimitry Andric switch (type) { 3520b57cec5SDimitry Andric case R_X86_64_8: 3530b57cec5SDimitry Andric checkIntUInt(loc, val, 8, type); 3540b57cec5SDimitry Andric *loc = val; 3550b57cec5SDimitry Andric break; 3560b57cec5SDimitry Andric case R_X86_64_PC8: 3570b57cec5SDimitry Andric checkInt(loc, val, 8, type); 3580b57cec5SDimitry Andric *loc = val; 3590b57cec5SDimitry Andric break; 3600b57cec5SDimitry Andric case R_X86_64_16: 3610b57cec5SDimitry Andric checkIntUInt(loc, val, 16, type); 3620b57cec5SDimitry Andric write16le(loc, val); 3630b57cec5SDimitry Andric break; 3640b57cec5SDimitry Andric case R_X86_64_PC16: 3650b57cec5SDimitry Andric checkInt(loc, val, 16, type); 3660b57cec5SDimitry Andric write16le(loc, val); 3670b57cec5SDimitry Andric break; 3680b57cec5SDimitry Andric case R_X86_64_32: 3690b57cec5SDimitry Andric checkUInt(loc, val, 32, type); 3700b57cec5SDimitry Andric write32le(loc, val); 3710b57cec5SDimitry Andric break; 3720b57cec5SDimitry Andric case R_X86_64_32S: 3730b57cec5SDimitry Andric case R_X86_64_TPOFF32: 3740b57cec5SDimitry Andric case R_X86_64_GOT32: 3750b57cec5SDimitry Andric case R_X86_64_GOTPC32: 3760b57cec5SDimitry Andric case R_X86_64_GOTPC32_TLSDESC: 3770b57cec5SDimitry Andric case R_X86_64_GOTPCREL: 3780b57cec5SDimitry Andric case R_X86_64_GOTPCRELX: 3790b57cec5SDimitry Andric case R_X86_64_REX_GOTPCRELX: 3800b57cec5SDimitry Andric case R_X86_64_PC32: 3810b57cec5SDimitry Andric case R_X86_64_GOTTPOFF: 3820b57cec5SDimitry Andric case R_X86_64_PLT32: 3830b57cec5SDimitry Andric case R_X86_64_TLSGD: 3840b57cec5SDimitry Andric case R_X86_64_TLSLD: 3850b57cec5SDimitry Andric case R_X86_64_DTPOFF32: 3860b57cec5SDimitry Andric case R_X86_64_SIZE32: 3870b57cec5SDimitry Andric checkInt(loc, val, 32, type); 3880b57cec5SDimitry Andric write32le(loc, val); 3890b57cec5SDimitry Andric break; 3900b57cec5SDimitry Andric case R_X86_64_64: 3910b57cec5SDimitry Andric case R_X86_64_DTPOFF64: 3920b57cec5SDimitry Andric case R_X86_64_PC64: 3930b57cec5SDimitry Andric case R_X86_64_SIZE64: 3940b57cec5SDimitry Andric case R_X86_64_GOT64: 3950b57cec5SDimitry Andric case R_X86_64_GOTOFF64: 3960b57cec5SDimitry Andric case R_X86_64_GOTPC64: 3970b57cec5SDimitry Andric write64le(loc, val); 3980b57cec5SDimitry Andric break; 3990b57cec5SDimitry Andric default: 4000b57cec5SDimitry Andric llvm_unreachable("unknown relocation"); 4010b57cec5SDimitry Andric } 4020b57cec5SDimitry Andric } 4030b57cec5SDimitry Andric 4040b57cec5SDimitry Andric RelExpr X86_64::adjustRelaxExpr(RelType type, const uint8_t *data, 4050b57cec5SDimitry Andric RelExpr relExpr) const { 4060b57cec5SDimitry Andric if (type != R_X86_64_GOTPCRELX && type != R_X86_64_REX_GOTPCRELX) 4070b57cec5SDimitry Andric return relExpr; 4080b57cec5SDimitry Andric const uint8_t op = data[-2]; 4090b57cec5SDimitry Andric const uint8_t modRm = data[-1]; 4100b57cec5SDimitry Andric 4110b57cec5SDimitry Andric // FIXME: When PIC is disabled and foo is defined locally in the 4120b57cec5SDimitry Andric // lower 32 bit address space, memory operand in mov can be converted into 4130b57cec5SDimitry Andric // immediate operand. Otherwise, mov must be changed to lea. We support only 4140b57cec5SDimitry Andric // latter relaxation at this moment. 4150b57cec5SDimitry Andric if (op == 0x8b) 4160b57cec5SDimitry Andric return R_RELAX_GOT_PC; 4170b57cec5SDimitry Andric 4180b57cec5SDimitry Andric // Relax call and jmp. 4190b57cec5SDimitry Andric if (op == 0xff && (modRm == 0x15 || modRm == 0x25)) 4200b57cec5SDimitry Andric return R_RELAX_GOT_PC; 4210b57cec5SDimitry Andric 4220b57cec5SDimitry Andric // Relaxation of test, adc, add, and, cmp, or, sbb, sub, xor. 4230b57cec5SDimitry Andric // If PIC then no relaxation is available. 4240b57cec5SDimitry Andric // We also don't relax test/binop instructions without REX byte, 4250b57cec5SDimitry Andric // they are 32bit operations and not common to have. 4260b57cec5SDimitry Andric assert(type == R_X86_64_REX_GOTPCRELX); 4270b57cec5SDimitry Andric return config->isPic ? relExpr : R_RELAX_GOT_PC_NOPIC; 4280b57cec5SDimitry Andric } 4290b57cec5SDimitry Andric 4300b57cec5SDimitry Andric // A subset of relaxations can only be applied for no-PIC. This method 4310b57cec5SDimitry Andric // handles such relaxations. Instructions encoding information was taken from: 4320b57cec5SDimitry Andric // "Intel 64 and IA-32 Architectures Software Developer's Manual V2" 4330b57cec5SDimitry Andric // (http://www.intel.com/content/dam/www/public/us/en/documents/manuals/ 4340b57cec5SDimitry Andric // 64-ia-32-architectures-software-developer-instruction-set-reference-manual-325383.pdf) 4350b57cec5SDimitry Andric static void relaxGotNoPic(uint8_t *loc, uint64_t val, uint8_t op, 4360b57cec5SDimitry Andric uint8_t modRm) { 4370b57cec5SDimitry Andric const uint8_t rex = loc[-3]; 4380b57cec5SDimitry Andric // Convert "test %reg, foo@GOTPCREL(%rip)" to "test $foo, %reg". 4390b57cec5SDimitry Andric if (op == 0x85) { 4400b57cec5SDimitry Andric // See "TEST-Logical Compare" (4-428 Vol. 2B), 4410b57cec5SDimitry Andric // TEST r/m64, r64 uses "full" ModR / M byte (no opcode extension). 4420b57cec5SDimitry Andric 4430b57cec5SDimitry Andric // ModR/M byte has form XX YYY ZZZ, where 4440b57cec5SDimitry Andric // YYY is MODRM.reg(register 2), ZZZ is MODRM.rm(register 1). 4450b57cec5SDimitry Andric // XX has different meanings: 4460b57cec5SDimitry Andric // 00: The operand's memory address is in reg1. 4470b57cec5SDimitry Andric // 01: The operand's memory address is reg1 + a byte-sized displacement. 4480b57cec5SDimitry Andric // 10: The operand's memory address is reg1 + a word-sized displacement. 4490b57cec5SDimitry Andric // 11: The operand is reg1 itself. 4500b57cec5SDimitry Andric // If an instruction requires only one operand, the unused reg2 field 4510b57cec5SDimitry Andric // holds extra opcode bits rather than a register code 4520b57cec5SDimitry Andric // 0xC0 == 11 000 000 binary. 4530b57cec5SDimitry Andric // 0x38 == 00 111 000 binary. 4540b57cec5SDimitry Andric // We transfer reg2 to reg1 here as operand. 4550b57cec5SDimitry Andric // See "2.1.3 ModR/M and SIB Bytes" (Vol. 2A 2-3). 4560b57cec5SDimitry Andric loc[-1] = 0xc0 | (modRm & 0x38) >> 3; // ModR/M byte. 4570b57cec5SDimitry Andric 4580b57cec5SDimitry Andric // Change opcode from TEST r/m64, r64 to TEST r/m64, imm32 4590b57cec5SDimitry Andric // See "TEST-Logical Compare" (4-428 Vol. 2B). 4600b57cec5SDimitry Andric loc[-2] = 0xf7; 4610b57cec5SDimitry Andric 4620b57cec5SDimitry Andric // Move R bit to the B bit in REX byte. 4630b57cec5SDimitry Andric // REX byte is encoded as 0100WRXB, where 4640b57cec5SDimitry Andric // 0100 is 4bit fixed pattern. 4650b57cec5SDimitry Andric // REX.W When 1, a 64-bit operand size is used. Otherwise, when 0, the 4660b57cec5SDimitry Andric // default operand size is used (which is 32-bit for most but not all 4670b57cec5SDimitry Andric // instructions). 4680b57cec5SDimitry Andric // REX.R This 1-bit value is an extension to the MODRM.reg field. 4690b57cec5SDimitry Andric // REX.X This 1-bit value is an extension to the SIB.index field. 4700b57cec5SDimitry Andric // REX.B This 1-bit value is an extension to the MODRM.rm field or the 4710b57cec5SDimitry Andric // SIB.base field. 4720b57cec5SDimitry Andric // See "2.2.1.2 More on REX Prefix Fields " (2-8 Vol. 2A). 4730b57cec5SDimitry Andric loc[-3] = (rex & ~0x4) | (rex & 0x4) >> 2; 4740b57cec5SDimitry Andric write32le(loc, val); 4750b57cec5SDimitry Andric return; 4760b57cec5SDimitry Andric } 4770b57cec5SDimitry Andric 4780b57cec5SDimitry Andric // If we are here then we need to relax the adc, add, and, cmp, or, sbb, sub 4790b57cec5SDimitry Andric // or xor operations. 4800b57cec5SDimitry Andric 4810b57cec5SDimitry Andric // Convert "binop foo@GOTPCREL(%rip), %reg" to "binop $foo, %reg". 4820b57cec5SDimitry Andric // Logic is close to one for test instruction above, but we also 4830b57cec5SDimitry Andric // write opcode extension here, see below for details. 4840b57cec5SDimitry Andric loc[-1] = 0xc0 | (modRm & 0x38) >> 3 | (op & 0x3c); // ModR/M byte. 4850b57cec5SDimitry Andric 4860b57cec5SDimitry Andric // Primary opcode is 0x81, opcode extension is one of: 4870b57cec5SDimitry Andric // 000b = ADD, 001b is OR, 010b is ADC, 011b is SBB, 4880b57cec5SDimitry Andric // 100b is AND, 101b is SUB, 110b is XOR, 111b is CMP. 4890b57cec5SDimitry Andric // This value was wrote to MODRM.reg in a line above. 4900b57cec5SDimitry Andric // See "3.2 INSTRUCTIONS (A-M)" (Vol. 2A 3-15), 4910b57cec5SDimitry Andric // "INSTRUCTION SET REFERENCE, N-Z" (Vol. 2B 4-1) for 4920b57cec5SDimitry Andric // descriptions about each operation. 4930b57cec5SDimitry Andric loc[-2] = 0x81; 4940b57cec5SDimitry Andric loc[-3] = (rex & ~0x4) | (rex & 0x4) >> 2; 4950b57cec5SDimitry Andric write32le(loc, val); 4960b57cec5SDimitry Andric } 4970b57cec5SDimitry Andric 4980b57cec5SDimitry Andric void X86_64::relaxGot(uint8_t *loc, RelType type, uint64_t val) const { 4990b57cec5SDimitry Andric const uint8_t op = loc[-2]; 5000b57cec5SDimitry Andric const uint8_t modRm = loc[-1]; 5010b57cec5SDimitry Andric 5020b57cec5SDimitry Andric // Convert "mov foo@GOTPCREL(%rip),%reg" to "lea foo(%rip),%reg". 5030b57cec5SDimitry Andric if (op == 0x8b) { 5040b57cec5SDimitry Andric loc[-2] = 0x8d; 5050b57cec5SDimitry Andric write32le(loc, val); 5060b57cec5SDimitry Andric return; 5070b57cec5SDimitry Andric } 5080b57cec5SDimitry Andric 5090b57cec5SDimitry Andric if (op != 0xff) { 5100b57cec5SDimitry Andric // We are relaxing a rip relative to an absolute, so compensate 5110b57cec5SDimitry Andric // for the old -4 addend. 5120b57cec5SDimitry Andric assert(!config->isPic); 5130b57cec5SDimitry Andric relaxGotNoPic(loc, val + 4, op, modRm); 5140b57cec5SDimitry Andric return; 5150b57cec5SDimitry Andric } 5160b57cec5SDimitry Andric 5170b57cec5SDimitry Andric // Convert call/jmp instructions. 5180b57cec5SDimitry Andric if (modRm == 0x15) { 5190b57cec5SDimitry Andric // ABI says we can convert "call *foo@GOTPCREL(%rip)" to "nop; call foo". 5200b57cec5SDimitry Andric // Instead we convert to "addr32 call foo" where addr32 is an instruction 5210b57cec5SDimitry Andric // prefix. That makes result expression to be a single instruction. 5220b57cec5SDimitry Andric loc[-2] = 0x67; // addr32 prefix 5230b57cec5SDimitry Andric loc[-1] = 0xe8; // call 5240b57cec5SDimitry Andric write32le(loc, val); 5250b57cec5SDimitry Andric return; 5260b57cec5SDimitry Andric } 5270b57cec5SDimitry Andric 5280b57cec5SDimitry Andric // Convert "jmp *foo@GOTPCREL(%rip)" to "jmp foo; nop". 5290b57cec5SDimitry Andric // jmp doesn't return, so it is fine to use nop here, it is just a stub. 5300b57cec5SDimitry Andric assert(modRm == 0x25); 5310b57cec5SDimitry Andric loc[-2] = 0xe9; // jmp 5320b57cec5SDimitry Andric loc[3] = 0x90; // nop 5330b57cec5SDimitry Andric write32le(loc - 1, val + 1); 5340b57cec5SDimitry Andric } 5350b57cec5SDimitry Andric 5360b57cec5SDimitry Andric // A split-stack prologue starts by checking the amount of stack remaining 5370b57cec5SDimitry Andric // in one of two ways: 5380b57cec5SDimitry Andric // A) Comparing of the stack pointer to a field in the tcb. 5390b57cec5SDimitry Andric // B) Or a load of a stack pointer offset with an lea to r10 or r11. 5400b57cec5SDimitry Andric bool X86_64::adjustPrologueForCrossSplitStack(uint8_t *loc, uint8_t *end, 5410b57cec5SDimitry Andric uint8_t stOther) const { 5420b57cec5SDimitry Andric if (!config->is64) { 5430b57cec5SDimitry Andric error("Target doesn't support split stacks."); 5440b57cec5SDimitry Andric return false; 5450b57cec5SDimitry Andric } 5460b57cec5SDimitry Andric 5470b57cec5SDimitry Andric if (loc + 8 >= end) 5480b57cec5SDimitry Andric return false; 5490b57cec5SDimitry Andric 5500b57cec5SDimitry Andric // Replace "cmp %fs:0x70,%rsp" and subsequent branch 5510b57cec5SDimitry Andric // with "stc, nopl 0x0(%rax,%rax,1)" 5520b57cec5SDimitry Andric if (memcmp(loc, "\x64\x48\x3b\x24\x25", 5) == 0) { 5530b57cec5SDimitry Andric memcpy(loc, "\xf9\x0f\x1f\x84\x00\x00\x00\x00", 8); 5540b57cec5SDimitry Andric return true; 5550b57cec5SDimitry Andric } 5560b57cec5SDimitry Andric 5570b57cec5SDimitry Andric // Adjust "lea X(%rsp),%rYY" to lea "(X - 0x4000)(%rsp),%rYY" where rYY could 5580b57cec5SDimitry Andric // be r10 or r11. The lea instruction feeds a subsequent compare which checks 5590b57cec5SDimitry Andric // if there is X available stack space. Making X larger effectively reserves 5600b57cec5SDimitry Andric // that much additional space. The stack grows downward so subtract the value. 5610b57cec5SDimitry Andric if (memcmp(loc, "\x4c\x8d\x94\x24", 4) == 0 || 5620b57cec5SDimitry Andric memcmp(loc, "\x4c\x8d\x9c\x24", 4) == 0) { 5630b57cec5SDimitry Andric // The offset bytes are encoded four bytes after the start of the 5640b57cec5SDimitry Andric // instruction. 5650b57cec5SDimitry Andric write32le(loc + 4, read32le(loc + 4) - 0x4000); 5660b57cec5SDimitry Andric return true; 5670b57cec5SDimitry Andric } 5680b57cec5SDimitry Andric return false; 5690b57cec5SDimitry Andric } 5700b57cec5SDimitry Andric 571*480093f4SDimitry Andric // If Intel Indirect Branch Tracking is enabled, we have to emit special PLT 572*480093f4SDimitry Andric // entries containing endbr64 instructions. A PLT entry will be split into two 573*480093f4SDimitry Andric // parts, one in .plt.sec (writePlt), and the other in .plt (writeIBTPlt). 574*480093f4SDimitry Andric namespace { 575*480093f4SDimitry Andric class IntelIBT : public X86_64 { 576*480093f4SDimitry Andric public: 577*480093f4SDimitry Andric IntelIBT(); 578*480093f4SDimitry Andric void writeGotPlt(uint8_t *buf, const Symbol &s) const override; 579*480093f4SDimitry Andric void writePlt(uint8_t *buf, const Symbol &sym, 580*480093f4SDimitry Andric uint64_t pltEntryAddr) const override; 581*480093f4SDimitry Andric void writeIBTPlt(uint8_t *buf, size_t numEntries) const override; 582*480093f4SDimitry Andric 583*480093f4SDimitry Andric static const unsigned IBTPltHeaderSize = 16; 584*480093f4SDimitry Andric }; 585*480093f4SDimitry Andric } // namespace 586*480093f4SDimitry Andric 587*480093f4SDimitry Andric IntelIBT::IntelIBT() { pltHeaderSize = 0; } 588*480093f4SDimitry Andric 589*480093f4SDimitry Andric void IntelIBT::writeGotPlt(uint8_t *buf, const Symbol &s) const { 590*480093f4SDimitry Andric uint64_t va = 591*480093f4SDimitry Andric in.ibtPlt->getVA() + IBTPltHeaderSize + s.pltIndex * pltEntrySize; 592*480093f4SDimitry Andric write64le(buf, va); 593*480093f4SDimitry Andric } 594*480093f4SDimitry Andric 595*480093f4SDimitry Andric void IntelIBT::writePlt(uint8_t *buf, const Symbol &sym, 596*480093f4SDimitry Andric uint64_t pltEntryAddr) const { 597*480093f4SDimitry Andric const uint8_t Inst[] = { 598*480093f4SDimitry Andric 0xf3, 0x0f, 0x1e, 0xfa, // endbr64 599*480093f4SDimitry Andric 0xff, 0x25, 0, 0, 0, 0, // jmpq *got(%rip) 600*480093f4SDimitry Andric 0x66, 0x0f, 0x1f, 0x44, 0, 0, // nop 601*480093f4SDimitry Andric }; 602*480093f4SDimitry Andric memcpy(buf, Inst, sizeof(Inst)); 603*480093f4SDimitry Andric write32le(buf + 6, sym.getGotPltVA() - pltEntryAddr - 10); 604*480093f4SDimitry Andric } 605*480093f4SDimitry Andric 606*480093f4SDimitry Andric void IntelIBT::writeIBTPlt(uint8_t *buf, size_t numEntries) const { 607*480093f4SDimitry Andric writePltHeader(buf); 608*480093f4SDimitry Andric buf += IBTPltHeaderSize; 609*480093f4SDimitry Andric 610*480093f4SDimitry Andric const uint8_t inst[] = { 611*480093f4SDimitry Andric 0xf3, 0x0f, 0x1e, 0xfa, // endbr64 612*480093f4SDimitry Andric 0x68, 0, 0, 0, 0, // pushq <relocation index> 613*480093f4SDimitry Andric 0xe9, 0, 0, 0, 0, // jmpq plt[0] 614*480093f4SDimitry Andric 0x66, 0x90, // nop 615*480093f4SDimitry Andric }; 616*480093f4SDimitry Andric 617*480093f4SDimitry Andric for (size_t i = 0; i < numEntries; ++i) { 618*480093f4SDimitry Andric memcpy(buf, inst, sizeof(inst)); 619*480093f4SDimitry Andric write32le(buf + 5, i); 620*480093f4SDimitry Andric write32le(buf + 10, -pltHeaderSize - sizeof(inst) * i - 30); 621*480093f4SDimitry Andric buf += sizeof(inst); 622*480093f4SDimitry Andric } 623*480093f4SDimitry Andric } 624*480093f4SDimitry Andric 6250b57cec5SDimitry Andric // These nonstandard PLT entries are to migtigate Spectre v2 security 6260b57cec5SDimitry Andric // vulnerability. In order to mitigate Spectre v2, we want to avoid indirect 6270b57cec5SDimitry Andric // branch instructions such as `jmp *GOTPLT(%rip)`. So, in the following PLT 6280b57cec5SDimitry Andric // entries, we use a CALL followed by MOV and RET to do the same thing as an 6290b57cec5SDimitry Andric // indirect jump. That instruction sequence is so-called "retpoline". 6300b57cec5SDimitry Andric // 6310b57cec5SDimitry Andric // We have two types of retpoline PLTs as a size optimization. If `-z now` 6320b57cec5SDimitry Andric // is specified, all dynamic symbols are resolved at load-time. Thus, when 6330b57cec5SDimitry Andric // that option is given, we can omit code for symbol lazy resolution. 6340b57cec5SDimitry Andric namespace { 6350b57cec5SDimitry Andric class Retpoline : public X86_64 { 6360b57cec5SDimitry Andric public: 6370b57cec5SDimitry Andric Retpoline(); 6380b57cec5SDimitry Andric void writeGotPlt(uint8_t *buf, const Symbol &s) const override; 6390b57cec5SDimitry Andric void writePltHeader(uint8_t *buf) const override; 640*480093f4SDimitry Andric void writePlt(uint8_t *buf, const Symbol &sym, 641*480093f4SDimitry Andric uint64_t pltEntryAddr) const override; 6420b57cec5SDimitry Andric }; 6430b57cec5SDimitry Andric 6440b57cec5SDimitry Andric class RetpolineZNow : public X86_64 { 6450b57cec5SDimitry Andric public: 6460b57cec5SDimitry Andric RetpolineZNow(); 6470b57cec5SDimitry Andric void writeGotPlt(uint8_t *buf, const Symbol &s) const override {} 6480b57cec5SDimitry Andric void writePltHeader(uint8_t *buf) const override; 649*480093f4SDimitry Andric void writePlt(uint8_t *buf, const Symbol &sym, 650*480093f4SDimitry Andric uint64_t pltEntryAddr) const override; 6510b57cec5SDimitry Andric }; 6520b57cec5SDimitry Andric } // namespace 6530b57cec5SDimitry Andric 6540b57cec5SDimitry Andric Retpoline::Retpoline() { 6550b57cec5SDimitry Andric pltHeaderSize = 48; 6560b57cec5SDimitry Andric pltEntrySize = 32; 657*480093f4SDimitry Andric ipltEntrySize = 32; 6580b57cec5SDimitry Andric } 6590b57cec5SDimitry Andric 6600b57cec5SDimitry Andric void Retpoline::writeGotPlt(uint8_t *buf, const Symbol &s) const { 6610b57cec5SDimitry Andric write64le(buf, s.getPltVA() + 17); 6620b57cec5SDimitry Andric } 6630b57cec5SDimitry Andric 6640b57cec5SDimitry Andric void Retpoline::writePltHeader(uint8_t *buf) const { 6650b57cec5SDimitry Andric const uint8_t insn[] = { 6660b57cec5SDimitry Andric 0xff, 0x35, 0, 0, 0, 0, // 0: pushq GOTPLT+8(%rip) 6670b57cec5SDimitry Andric 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // 6: mov GOTPLT+16(%rip), %r11 6680b57cec5SDimitry Andric 0xe8, 0x0e, 0x00, 0x00, 0x00, // d: callq next 6690b57cec5SDimitry Andric 0xf3, 0x90, // 12: loop: pause 6700b57cec5SDimitry Andric 0x0f, 0xae, 0xe8, // 14: lfence 6710b57cec5SDimitry Andric 0xeb, 0xf9, // 17: jmp loop 6720b57cec5SDimitry Andric 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 19: int3; .align 16 6730b57cec5SDimitry Andric 0x4c, 0x89, 0x1c, 0x24, // 20: next: mov %r11, (%rsp) 6740b57cec5SDimitry Andric 0xc3, // 24: ret 6750b57cec5SDimitry Andric 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 25: int3; padding 6760b57cec5SDimitry Andric 0xcc, 0xcc, 0xcc, 0xcc, // 2c: int3; padding 6770b57cec5SDimitry Andric }; 6780b57cec5SDimitry Andric memcpy(buf, insn, sizeof(insn)); 6790b57cec5SDimitry Andric 6800b57cec5SDimitry Andric uint64_t gotPlt = in.gotPlt->getVA(); 6810b57cec5SDimitry Andric uint64_t plt = in.plt->getVA(); 6820b57cec5SDimitry Andric write32le(buf + 2, gotPlt - plt - 6 + 8); 6830b57cec5SDimitry Andric write32le(buf + 9, gotPlt - plt - 13 + 16); 6840b57cec5SDimitry Andric } 6850b57cec5SDimitry Andric 686*480093f4SDimitry Andric void Retpoline::writePlt(uint8_t *buf, const Symbol &sym, 687*480093f4SDimitry Andric uint64_t pltEntryAddr) const { 6880b57cec5SDimitry Andric const uint8_t insn[] = { 6890b57cec5SDimitry Andric 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // 0: mov foo@GOTPLT(%rip), %r11 6900b57cec5SDimitry Andric 0xe8, 0, 0, 0, 0, // 7: callq plt+0x20 6910b57cec5SDimitry Andric 0xe9, 0, 0, 0, 0, // c: jmp plt+0x12 6920b57cec5SDimitry Andric 0x68, 0, 0, 0, 0, // 11: pushq <relocation index> 6930b57cec5SDimitry Andric 0xe9, 0, 0, 0, 0, // 16: jmp plt+0 6940b57cec5SDimitry Andric 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1b: int3; padding 6950b57cec5SDimitry Andric }; 6960b57cec5SDimitry Andric memcpy(buf, insn, sizeof(insn)); 6970b57cec5SDimitry Andric 698*480093f4SDimitry Andric uint64_t off = pltEntryAddr - in.plt->getVA(); 6990b57cec5SDimitry Andric 700*480093f4SDimitry Andric write32le(buf + 3, sym.getGotPltVA() - pltEntryAddr - 7); 7010b57cec5SDimitry Andric write32le(buf + 8, -off - 12 + 32); 7020b57cec5SDimitry Andric write32le(buf + 13, -off - 17 + 18); 703*480093f4SDimitry Andric write32le(buf + 18, sym.pltIndex); 7040b57cec5SDimitry Andric write32le(buf + 23, -off - 27); 7050b57cec5SDimitry Andric } 7060b57cec5SDimitry Andric 7070b57cec5SDimitry Andric RetpolineZNow::RetpolineZNow() { 7080b57cec5SDimitry Andric pltHeaderSize = 32; 7090b57cec5SDimitry Andric pltEntrySize = 16; 710*480093f4SDimitry Andric ipltEntrySize = 16; 7110b57cec5SDimitry Andric } 7120b57cec5SDimitry Andric 7130b57cec5SDimitry Andric void RetpolineZNow::writePltHeader(uint8_t *buf) const { 7140b57cec5SDimitry Andric const uint8_t insn[] = { 7150b57cec5SDimitry Andric 0xe8, 0x0b, 0x00, 0x00, 0x00, // 0: call next 7160b57cec5SDimitry Andric 0xf3, 0x90, // 5: loop: pause 7170b57cec5SDimitry Andric 0x0f, 0xae, 0xe8, // 7: lfence 7180b57cec5SDimitry Andric 0xeb, 0xf9, // a: jmp loop 7190b57cec5SDimitry Andric 0xcc, 0xcc, 0xcc, 0xcc, // c: int3; .align 16 7200b57cec5SDimitry Andric 0x4c, 0x89, 0x1c, 0x24, // 10: next: mov %r11, (%rsp) 7210b57cec5SDimitry Andric 0xc3, // 14: ret 7220b57cec5SDimitry Andric 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 15: int3; padding 7230b57cec5SDimitry Andric 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1a: int3; padding 7240b57cec5SDimitry Andric 0xcc, // 1f: int3; padding 7250b57cec5SDimitry Andric }; 7260b57cec5SDimitry Andric memcpy(buf, insn, sizeof(insn)); 7270b57cec5SDimitry Andric } 7280b57cec5SDimitry Andric 729*480093f4SDimitry Andric void RetpolineZNow::writePlt(uint8_t *buf, const Symbol &sym, 730*480093f4SDimitry Andric uint64_t pltEntryAddr) const { 7310b57cec5SDimitry Andric const uint8_t insn[] = { 7320b57cec5SDimitry Andric 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // mov foo@GOTPLT(%rip), %r11 7330b57cec5SDimitry Andric 0xe9, 0, 0, 0, 0, // jmp plt+0 7340b57cec5SDimitry Andric 0xcc, 0xcc, 0xcc, 0xcc, // int3; padding 7350b57cec5SDimitry Andric }; 7360b57cec5SDimitry Andric memcpy(buf, insn, sizeof(insn)); 7370b57cec5SDimitry Andric 738*480093f4SDimitry Andric write32le(buf + 3, sym.getGotPltVA() - pltEntryAddr - 7); 739*480093f4SDimitry Andric write32le(buf + 8, in.plt->getVA() - pltEntryAddr - 12); 7400b57cec5SDimitry Andric } 7410b57cec5SDimitry Andric 7420b57cec5SDimitry Andric static TargetInfo *getTargetInfo() { 7430b57cec5SDimitry Andric if (config->zRetpolineplt) { 7440b57cec5SDimitry Andric if (config->zNow) { 7450b57cec5SDimitry Andric static RetpolineZNow t; 7460b57cec5SDimitry Andric return &t; 7470b57cec5SDimitry Andric } 7480b57cec5SDimitry Andric static Retpoline t; 7490b57cec5SDimitry Andric return &t; 7500b57cec5SDimitry Andric } 7510b57cec5SDimitry Andric 752*480093f4SDimitry Andric if (config->andFeatures & GNU_PROPERTY_X86_FEATURE_1_IBT) { 753*480093f4SDimitry Andric static IntelIBT t; 754*480093f4SDimitry Andric return &t; 755*480093f4SDimitry Andric } 756*480093f4SDimitry Andric 7570b57cec5SDimitry Andric static X86_64 t; 7580b57cec5SDimitry Andric return &t; 7590b57cec5SDimitry Andric } 7600b57cec5SDimitry Andric 76185868e8aSDimitry Andric TargetInfo *getX86_64TargetInfo() { return getTargetInfo(); } 76285868e8aSDimitry Andric 76385868e8aSDimitry Andric } // namespace elf 76485868e8aSDimitry Andric } // namespace lld 765