xref: /freebsd/contrib/llvm-project/lld/ELF/Arch/X86_64.cpp (revision 480093f4440d54b30b3025afeac24b48f2ba7a2e)
10b57cec5SDimitry Andric //===- X86_64.cpp ---------------------------------------------------------===//
20b57cec5SDimitry Andric //
30b57cec5SDimitry Andric // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
40b57cec5SDimitry Andric // See https://llvm.org/LICENSE.txt for license information.
50b57cec5SDimitry Andric // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
60b57cec5SDimitry Andric //
70b57cec5SDimitry Andric //===----------------------------------------------------------------------===//
80b57cec5SDimitry Andric 
90b57cec5SDimitry Andric #include "InputFiles.h"
100b57cec5SDimitry Andric #include "Symbols.h"
110b57cec5SDimitry Andric #include "SyntheticSections.h"
120b57cec5SDimitry Andric #include "Target.h"
130b57cec5SDimitry Andric #include "lld/Common/ErrorHandler.h"
140b57cec5SDimitry Andric #include "llvm/Object/ELF.h"
150b57cec5SDimitry Andric #include "llvm/Support/Endian.h"
160b57cec5SDimitry Andric 
170b57cec5SDimitry Andric using namespace llvm;
180b57cec5SDimitry Andric using namespace llvm::object;
190b57cec5SDimitry Andric using namespace llvm::support::endian;
200b57cec5SDimitry Andric using namespace llvm::ELF;
2185868e8aSDimitry Andric 
2285868e8aSDimitry Andric namespace lld {
2385868e8aSDimitry Andric namespace elf {
240b57cec5SDimitry Andric 
250b57cec5SDimitry Andric namespace {
260b57cec5SDimitry Andric class X86_64 : public TargetInfo {
270b57cec5SDimitry Andric public:
280b57cec5SDimitry Andric   X86_64();
290b57cec5SDimitry Andric   int getTlsGdRelaxSkip(RelType type) const override;
300b57cec5SDimitry Andric   RelExpr getRelExpr(RelType type, const Symbol &s,
310b57cec5SDimitry Andric                      const uint8_t *loc) const override;
320b57cec5SDimitry Andric   RelType getDynRel(RelType type) const override;
330b57cec5SDimitry Andric   void writeGotPltHeader(uint8_t *buf) const override;
340b57cec5SDimitry Andric   void writeGotPlt(uint8_t *buf, const Symbol &s) const override;
350b57cec5SDimitry Andric   void writePltHeader(uint8_t *buf) const override;
36*480093f4SDimitry Andric   void writePlt(uint8_t *buf, const Symbol &sym,
37*480093f4SDimitry Andric                 uint64_t pltEntryAddr) const override;
380b57cec5SDimitry Andric   void relocateOne(uint8_t *loc, RelType type, uint64_t val) const override;
390b57cec5SDimitry Andric 
400b57cec5SDimitry Andric   RelExpr adjustRelaxExpr(RelType type, const uint8_t *data,
410b57cec5SDimitry Andric                           RelExpr expr) const override;
420b57cec5SDimitry Andric   void relaxGot(uint8_t *loc, RelType type, uint64_t val) const override;
430b57cec5SDimitry Andric   void relaxTlsGdToIe(uint8_t *loc, RelType type, uint64_t val) const override;
440b57cec5SDimitry Andric   void relaxTlsGdToLe(uint8_t *loc, RelType type, uint64_t val) const override;
450b57cec5SDimitry Andric   void relaxTlsIeToLe(uint8_t *loc, RelType type, uint64_t val) const override;
460b57cec5SDimitry Andric   void relaxTlsLdToLe(uint8_t *loc, RelType type, uint64_t val) const override;
470b57cec5SDimitry Andric   bool adjustPrologueForCrossSplitStack(uint8_t *loc, uint8_t *end,
480b57cec5SDimitry Andric                                         uint8_t stOther) const override;
490b57cec5SDimitry Andric };
500b57cec5SDimitry Andric } // namespace
510b57cec5SDimitry Andric 
520b57cec5SDimitry Andric X86_64::X86_64() {
530b57cec5SDimitry Andric   copyRel = R_X86_64_COPY;
540b57cec5SDimitry Andric   gotRel = R_X86_64_GLOB_DAT;
550b57cec5SDimitry Andric   noneRel = R_X86_64_NONE;
560b57cec5SDimitry Andric   pltRel = R_X86_64_JUMP_SLOT;
570b57cec5SDimitry Andric   relativeRel = R_X86_64_RELATIVE;
580b57cec5SDimitry Andric   iRelativeRel = R_X86_64_IRELATIVE;
590b57cec5SDimitry Andric   symbolicRel = R_X86_64_64;
600b57cec5SDimitry Andric   tlsDescRel = R_X86_64_TLSDESC;
610b57cec5SDimitry Andric   tlsGotRel = R_X86_64_TPOFF64;
620b57cec5SDimitry Andric   tlsModuleIndexRel = R_X86_64_DTPMOD64;
630b57cec5SDimitry Andric   tlsOffsetRel = R_X86_64_DTPOFF64;
640b57cec5SDimitry Andric   pltHeaderSize = 16;
65*480093f4SDimitry Andric   pltEntrySize = 16;
66*480093f4SDimitry Andric   ipltEntrySize = 16;
670b57cec5SDimitry Andric   trapInstr = {0xcc, 0xcc, 0xcc, 0xcc}; // 0xcc = INT3
680b57cec5SDimitry Andric 
690b57cec5SDimitry Andric   // Align to the large page size (known as a superpage or huge page).
700b57cec5SDimitry Andric   // FreeBSD automatically promotes large, superpage-aligned allocations.
710b57cec5SDimitry Andric   defaultImageBase = 0x200000;
720b57cec5SDimitry Andric }
730b57cec5SDimitry Andric 
740b57cec5SDimitry Andric int X86_64::getTlsGdRelaxSkip(RelType type) const { return 2; }
750b57cec5SDimitry Andric 
760b57cec5SDimitry Andric RelExpr X86_64::getRelExpr(RelType type, const Symbol &s,
770b57cec5SDimitry Andric                            const uint8_t *loc) const {
780b57cec5SDimitry Andric   if (type == R_X86_64_GOTTPOFF)
790b57cec5SDimitry Andric     config->hasStaticTlsModel = true;
800b57cec5SDimitry Andric 
810b57cec5SDimitry Andric   switch (type) {
820b57cec5SDimitry Andric   case R_X86_64_8:
830b57cec5SDimitry Andric   case R_X86_64_16:
840b57cec5SDimitry Andric   case R_X86_64_32:
850b57cec5SDimitry Andric   case R_X86_64_32S:
860b57cec5SDimitry Andric   case R_X86_64_64:
870b57cec5SDimitry Andric     return R_ABS;
880b57cec5SDimitry Andric   case R_X86_64_DTPOFF32:
890b57cec5SDimitry Andric   case R_X86_64_DTPOFF64:
900b57cec5SDimitry Andric     return R_DTPREL;
910b57cec5SDimitry Andric   case R_X86_64_TPOFF32:
920b57cec5SDimitry Andric     return R_TLS;
930b57cec5SDimitry Andric   case R_X86_64_TLSDESC_CALL:
940b57cec5SDimitry Andric     return R_TLSDESC_CALL;
950b57cec5SDimitry Andric   case R_X86_64_TLSLD:
960b57cec5SDimitry Andric     return R_TLSLD_PC;
970b57cec5SDimitry Andric   case R_X86_64_TLSGD:
980b57cec5SDimitry Andric     return R_TLSGD_PC;
990b57cec5SDimitry Andric   case R_X86_64_SIZE32:
1000b57cec5SDimitry Andric   case R_X86_64_SIZE64:
1010b57cec5SDimitry Andric     return R_SIZE;
1020b57cec5SDimitry Andric   case R_X86_64_PLT32:
1030b57cec5SDimitry Andric     return R_PLT_PC;
1040b57cec5SDimitry Andric   case R_X86_64_PC8:
1050b57cec5SDimitry Andric   case R_X86_64_PC16:
1060b57cec5SDimitry Andric   case R_X86_64_PC32:
1070b57cec5SDimitry Andric   case R_X86_64_PC64:
1080b57cec5SDimitry Andric     return R_PC;
1090b57cec5SDimitry Andric   case R_X86_64_GOT32:
1100b57cec5SDimitry Andric   case R_X86_64_GOT64:
1110b57cec5SDimitry Andric     return R_GOTPLT;
1120b57cec5SDimitry Andric   case R_X86_64_GOTPC32_TLSDESC:
1130b57cec5SDimitry Andric     return R_TLSDESC_PC;
1140b57cec5SDimitry Andric   case R_X86_64_GOTPCREL:
1150b57cec5SDimitry Andric   case R_X86_64_GOTPCRELX:
1160b57cec5SDimitry Andric   case R_X86_64_REX_GOTPCRELX:
1170b57cec5SDimitry Andric   case R_X86_64_GOTTPOFF:
1180b57cec5SDimitry Andric     return R_GOT_PC;
1190b57cec5SDimitry Andric   case R_X86_64_GOTOFF64:
1200b57cec5SDimitry Andric     return R_GOTPLTREL;
1210b57cec5SDimitry Andric   case R_X86_64_GOTPC32:
1220b57cec5SDimitry Andric   case R_X86_64_GOTPC64:
1230b57cec5SDimitry Andric     return R_GOTPLTONLY_PC;
1240b57cec5SDimitry Andric   case R_X86_64_NONE:
1250b57cec5SDimitry Andric     return R_NONE;
1260b57cec5SDimitry Andric   default:
1270b57cec5SDimitry Andric     error(getErrorLocation(loc) + "unknown relocation (" + Twine(type) +
1280b57cec5SDimitry Andric           ") against symbol " + toString(s));
1290b57cec5SDimitry Andric     return R_NONE;
1300b57cec5SDimitry Andric   }
1310b57cec5SDimitry Andric }
1320b57cec5SDimitry Andric 
1330b57cec5SDimitry Andric void X86_64::writeGotPltHeader(uint8_t *buf) const {
1340b57cec5SDimitry Andric   // The first entry holds the value of _DYNAMIC. It is not clear why that is
1350b57cec5SDimitry Andric   // required, but it is documented in the psabi and the glibc dynamic linker
1360b57cec5SDimitry Andric   // seems to use it (note that this is relevant for linking ld.so, not any
1370b57cec5SDimitry Andric   // other program).
1380b57cec5SDimitry Andric   write64le(buf, mainPart->dynamic->getVA());
1390b57cec5SDimitry Andric }
1400b57cec5SDimitry Andric 
1410b57cec5SDimitry Andric void X86_64::writeGotPlt(uint8_t *buf, const Symbol &s) const {
1420b57cec5SDimitry Andric   // See comments in X86::writeGotPlt.
1430b57cec5SDimitry Andric   write64le(buf, s.getPltVA() + 6);
1440b57cec5SDimitry Andric }
1450b57cec5SDimitry Andric 
1460b57cec5SDimitry Andric void X86_64::writePltHeader(uint8_t *buf) const {
1470b57cec5SDimitry Andric   const uint8_t pltData[] = {
1480b57cec5SDimitry Andric       0xff, 0x35, 0, 0, 0, 0, // pushq GOTPLT+8(%rip)
1490b57cec5SDimitry Andric       0xff, 0x25, 0, 0, 0, 0, // jmp *GOTPLT+16(%rip)
1500b57cec5SDimitry Andric       0x0f, 0x1f, 0x40, 0x00, // nop
1510b57cec5SDimitry Andric   };
1520b57cec5SDimitry Andric   memcpy(buf, pltData, sizeof(pltData));
1530b57cec5SDimitry Andric   uint64_t gotPlt = in.gotPlt->getVA();
154*480093f4SDimitry Andric   uint64_t plt = in.ibtPlt ? in.ibtPlt->getVA() : in.plt->getVA();
1550b57cec5SDimitry Andric   write32le(buf + 2, gotPlt - plt + 2); // GOTPLT+8
1560b57cec5SDimitry Andric   write32le(buf + 8, gotPlt - plt + 4); // GOTPLT+16
1570b57cec5SDimitry Andric }
1580b57cec5SDimitry Andric 
159*480093f4SDimitry Andric void X86_64::writePlt(uint8_t *buf, const Symbol &sym,
160*480093f4SDimitry Andric                       uint64_t pltEntryAddr) const {
1610b57cec5SDimitry Andric   const uint8_t inst[] = {
1620b57cec5SDimitry Andric       0xff, 0x25, 0, 0, 0, 0, // jmpq *got(%rip)
1630b57cec5SDimitry Andric       0x68, 0, 0, 0, 0,       // pushq <relocation index>
1640b57cec5SDimitry Andric       0xe9, 0, 0, 0, 0,       // jmpq plt[0]
1650b57cec5SDimitry Andric   };
1660b57cec5SDimitry Andric   memcpy(buf, inst, sizeof(inst));
1670b57cec5SDimitry Andric 
168*480093f4SDimitry Andric   write32le(buf + 2, sym.getGotPltVA() - pltEntryAddr - 6);
169*480093f4SDimitry Andric   write32le(buf + 7, sym.pltIndex);
170*480093f4SDimitry Andric   write32le(buf + 12, in.plt->getVA() - pltEntryAddr - 16);
1710b57cec5SDimitry Andric }
1720b57cec5SDimitry Andric 
1730b57cec5SDimitry Andric RelType X86_64::getDynRel(RelType type) const {
1740b57cec5SDimitry Andric   if (type == R_X86_64_64 || type == R_X86_64_PC64 || type == R_X86_64_SIZE32 ||
1750b57cec5SDimitry Andric       type == R_X86_64_SIZE64)
1760b57cec5SDimitry Andric     return type;
1770b57cec5SDimitry Andric   return R_X86_64_NONE;
1780b57cec5SDimitry Andric }
1790b57cec5SDimitry Andric 
1800b57cec5SDimitry Andric void X86_64::relaxTlsGdToLe(uint8_t *loc, RelType type, uint64_t val) const {
1810b57cec5SDimitry Andric   if (type == R_X86_64_TLSGD) {
1820b57cec5SDimitry Andric     // Convert
1830b57cec5SDimitry Andric     //   .byte 0x66
1840b57cec5SDimitry Andric     //   leaq x@tlsgd(%rip), %rdi
1850b57cec5SDimitry Andric     //   .word 0x6666
1860b57cec5SDimitry Andric     //   rex64
1870b57cec5SDimitry Andric     //   call __tls_get_addr@plt
1880b57cec5SDimitry Andric     // to the following two instructions.
1890b57cec5SDimitry Andric     const uint8_t inst[] = {
1900b57cec5SDimitry Andric         0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00,
1910b57cec5SDimitry Andric         0x00, 0x00,                            // mov %fs:0x0,%rax
1920b57cec5SDimitry Andric         0x48, 0x8d, 0x80, 0,    0,    0,    0, // lea x@tpoff,%rax
1930b57cec5SDimitry Andric     };
1940b57cec5SDimitry Andric     memcpy(loc - 4, inst, sizeof(inst));
1950b57cec5SDimitry Andric 
1960b57cec5SDimitry Andric     // The original code used a pc relative relocation and so we have to
1970b57cec5SDimitry Andric     // compensate for the -4 in had in the addend.
1980b57cec5SDimitry Andric     write32le(loc + 8, val + 4);
1990b57cec5SDimitry Andric   } else {
2000b57cec5SDimitry Andric     // Convert
2010b57cec5SDimitry Andric     //   lea x@tlsgd(%rip), %rax
2020b57cec5SDimitry Andric     //   call *(%rax)
2030b57cec5SDimitry Andric     // to the following two instructions.
2040b57cec5SDimitry Andric     assert(type == R_X86_64_GOTPC32_TLSDESC);
2050b57cec5SDimitry Andric     if (memcmp(loc - 3, "\x48\x8d\x05", 3)) {
2060b57cec5SDimitry Andric       error(getErrorLocation(loc - 3) + "R_X86_64_GOTPC32_TLSDESC must be used "
2070b57cec5SDimitry Andric                                         "in callq *x@tlsdesc(%rip), %rax");
2080b57cec5SDimitry Andric       return;
2090b57cec5SDimitry Andric     }
2100b57cec5SDimitry Andric     // movq $x@tpoff(%rip),%rax
2110b57cec5SDimitry Andric     loc[-2] = 0xc7;
2120b57cec5SDimitry Andric     loc[-1] = 0xc0;
2130b57cec5SDimitry Andric     write32le(loc, val + 4);
2140b57cec5SDimitry Andric     // xchg ax,ax
2150b57cec5SDimitry Andric     loc[4] = 0x66;
2160b57cec5SDimitry Andric     loc[5] = 0x90;
2170b57cec5SDimitry Andric   }
2180b57cec5SDimitry Andric }
2190b57cec5SDimitry Andric 
2200b57cec5SDimitry Andric void X86_64::relaxTlsGdToIe(uint8_t *loc, RelType type, uint64_t val) const {
2210b57cec5SDimitry Andric   if (type == R_X86_64_TLSGD) {
2220b57cec5SDimitry Andric     // Convert
2230b57cec5SDimitry Andric     //   .byte 0x66
2240b57cec5SDimitry Andric     //   leaq x@tlsgd(%rip), %rdi
2250b57cec5SDimitry Andric     //   .word 0x6666
2260b57cec5SDimitry Andric     //   rex64
2270b57cec5SDimitry Andric     //   call __tls_get_addr@plt
2280b57cec5SDimitry Andric     // to the following two instructions.
2290b57cec5SDimitry Andric     const uint8_t inst[] = {
2300b57cec5SDimitry Andric         0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00,
2310b57cec5SDimitry Andric         0x00, 0x00,                            // mov %fs:0x0,%rax
2320b57cec5SDimitry Andric         0x48, 0x03, 0x05, 0,    0,    0,    0, // addq x@gottpoff(%rip),%rax
2330b57cec5SDimitry Andric     };
2340b57cec5SDimitry Andric     memcpy(loc - 4, inst, sizeof(inst));
2350b57cec5SDimitry Andric 
2360b57cec5SDimitry Andric     // Both code sequences are PC relatives, but since we are moving the
2370b57cec5SDimitry Andric     // constant forward by 8 bytes we have to subtract the value by 8.
2380b57cec5SDimitry Andric     write32le(loc + 8, val - 8);
2390b57cec5SDimitry Andric   } else {
2400b57cec5SDimitry Andric     // Convert
2410b57cec5SDimitry Andric     //   lea x@tlsgd(%rip), %rax
2420b57cec5SDimitry Andric     //   call *(%rax)
2430b57cec5SDimitry Andric     // to the following two instructions.
2440b57cec5SDimitry Andric     assert(type == R_X86_64_GOTPC32_TLSDESC);
2450b57cec5SDimitry Andric     if (memcmp(loc - 3, "\x48\x8d\x05", 3)) {
2460b57cec5SDimitry Andric       error(getErrorLocation(loc - 3) + "R_X86_64_GOTPC32_TLSDESC must be used "
2470b57cec5SDimitry Andric                                         "in callq *x@tlsdesc(%rip), %rax");
2480b57cec5SDimitry Andric       return;
2490b57cec5SDimitry Andric     }
2500b57cec5SDimitry Andric     // movq x@gottpoff(%rip),%rax
2510b57cec5SDimitry Andric     loc[-2] = 0x8b;
2520b57cec5SDimitry Andric     write32le(loc, val);
2530b57cec5SDimitry Andric     // xchg ax,ax
2540b57cec5SDimitry Andric     loc[4] = 0x66;
2550b57cec5SDimitry Andric     loc[5] = 0x90;
2560b57cec5SDimitry Andric   }
2570b57cec5SDimitry Andric }
2580b57cec5SDimitry Andric 
2590b57cec5SDimitry Andric // In some conditions, R_X86_64_GOTTPOFF relocation can be optimized to
2600b57cec5SDimitry Andric // R_X86_64_TPOFF32 so that it does not use GOT.
2610b57cec5SDimitry Andric void X86_64::relaxTlsIeToLe(uint8_t *loc, RelType type, uint64_t val) const {
2620b57cec5SDimitry Andric   uint8_t *inst = loc - 3;
2630b57cec5SDimitry Andric   uint8_t reg = loc[-1] >> 3;
2640b57cec5SDimitry Andric   uint8_t *regSlot = loc - 1;
2650b57cec5SDimitry Andric 
2660b57cec5SDimitry Andric   // Note that ADD with RSP or R12 is converted to ADD instead of LEA
2670b57cec5SDimitry Andric   // because LEA with these registers needs 4 bytes to encode and thus
2680b57cec5SDimitry Andric   // wouldn't fit the space.
2690b57cec5SDimitry Andric 
2700b57cec5SDimitry Andric   if (memcmp(inst, "\x48\x03\x25", 3) == 0) {
2710b57cec5SDimitry Andric     // "addq foo@gottpoff(%rip),%rsp" -> "addq $foo,%rsp"
2720b57cec5SDimitry Andric     memcpy(inst, "\x48\x81\xc4", 3);
2730b57cec5SDimitry Andric   } else if (memcmp(inst, "\x4c\x03\x25", 3) == 0) {
2740b57cec5SDimitry Andric     // "addq foo@gottpoff(%rip),%r12" -> "addq $foo,%r12"
2750b57cec5SDimitry Andric     memcpy(inst, "\x49\x81\xc4", 3);
2760b57cec5SDimitry Andric   } else if (memcmp(inst, "\x4c\x03", 2) == 0) {
2770b57cec5SDimitry Andric     // "addq foo@gottpoff(%rip),%r[8-15]" -> "leaq foo(%r[8-15]),%r[8-15]"
2780b57cec5SDimitry Andric     memcpy(inst, "\x4d\x8d", 2);
2790b57cec5SDimitry Andric     *regSlot = 0x80 | (reg << 3) | reg;
2800b57cec5SDimitry Andric   } else if (memcmp(inst, "\x48\x03", 2) == 0) {
2810b57cec5SDimitry Andric     // "addq foo@gottpoff(%rip),%reg -> "leaq foo(%reg),%reg"
2820b57cec5SDimitry Andric     memcpy(inst, "\x48\x8d", 2);
2830b57cec5SDimitry Andric     *regSlot = 0x80 | (reg << 3) | reg;
2840b57cec5SDimitry Andric   } else if (memcmp(inst, "\x4c\x8b", 2) == 0) {
2850b57cec5SDimitry Andric     // "movq foo@gottpoff(%rip),%r[8-15]" -> "movq $foo,%r[8-15]"
2860b57cec5SDimitry Andric     memcpy(inst, "\x49\xc7", 2);
2870b57cec5SDimitry Andric     *regSlot = 0xc0 | reg;
2880b57cec5SDimitry Andric   } else if (memcmp(inst, "\x48\x8b", 2) == 0) {
2890b57cec5SDimitry Andric     // "movq foo@gottpoff(%rip),%reg" -> "movq $foo,%reg"
2900b57cec5SDimitry Andric     memcpy(inst, "\x48\xc7", 2);
2910b57cec5SDimitry Andric     *regSlot = 0xc0 | reg;
2920b57cec5SDimitry Andric   } else {
2930b57cec5SDimitry Andric     error(getErrorLocation(loc - 3) +
2940b57cec5SDimitry Andric           "R_X86_64_GOTTPOFF must be used in MOVQ or ADDQ instructions only");
2950b57cec5SDimitry Andric   }
2960b57cec5SDimitry Andric 
2970b57cec5SDimitry Andric   // The original code used a PC relative relocation.
2980b57cec5SDimitry Andric   // Need to compensate for the -4 it had in the addend.
2990b57cec5SDimitry Andric   write32le(loc, val + 4);
3000b57cec5SDimitry Andric }
3010b57cec5SDimitry Andric 
3020b57cec5SDimitry Andric void X86_64::relaxTlsLdToLe(uint8_t *loc, RelType type, uint64_t val) const {
3030b57cec5SDimitry Andric   if (type == R_X86_64_DTPOFF64) {
3040b57cec5SDimitry Andric     write64le(loc, val);
3050b57cec5SDimitry Andric     return;
3060b57cec5SDimitry Andric   }
3070b57cec5SDimitry Andric   if (type == R_X86_64_DTPOFF32) {
3080b57cec5SDimitry Andric     write32le(loc, val);
3090b57cec5SDimitry Andric     return;
3100b57cec5SDimitry Andric   }
3110b57cec5SDimitry Andric 
3120b57cec5SDimitry Andric   const uint8_t inst[] = {
3130b57cec5SDimitry Andric       0x66, 0x66,                                           // .word 0x6666
3140b57cec5SDimitry Andric       0x66,                                                 // .byte 0x66
3150b57cec5SDimitry Andric       0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 0x00, 0x00, // mov %fs:0,%rax
3160b57cec5SDimitry Andric   };
3170b57cec5SDimitry Andric 
3180b57cec5SDimitry Andric   if (loc[4] == 0xe8) {
3190b57cec5SDimitry Andric     // Convert
3200b57cec5SDimitry Andric     //   leaq bar@tlsld(%rip), %rdi           # 48 8d 3d <Loc>
3210b57cec5SDimitry Andric     //   callq __tls_get_addr@PLT             # e8 <disp32>
3220b57cec5SDimitry Andric     //   leaq bar@dtpoff(%rax), %rcx
3230b57cec5SDimitry Andric     // to
3240b57cec5SDimitry Andric     //   .word 0x6666
3250b57cec5SDimitry Andric     //   .byte 0x66
3260b57cec5SDimitry Andric     //   mov %fs:0,%rax
3270b57cec5SDimitry Andric     //   leaq bar@tpoff(%rax), %rcx
3280b57cec5SDimitry Andric     memcpy(loc - 3, inst, sizeof(inst));
3290b57cec5SDimitry Andric     return;
3300b57cec5SDimitry Andric   }
3310b57cec5SDimitry Andric 
3320b57cec5SDimitry Andric   if (loc[4] == 0xff && loc[5] == 0x15) {
3330b57cec5SDimitry Andric     // Convert
3340b57cec5SDimitry Andric     //   leaq  x@tlsld(%rip),%rdi               # 48 8d 3d <Loc>
3350b57cec5SDimitry Andric     //   call *__tls_get_addr@GOTPCREL(%rip)    # ff 15 <disp32>
3360b57cec5SDimitry Andric     // to
3370b57cec5SDimitry Andric     //   .long  0x66666666
3380b57cec5SDimitry Andric     //   movq   %fs:0,%rax
3390b57cec5SDimitry Andric     // See "Table 11.9: LD -> LE Code Transition (LP64)" in
3400b57cec5SDimitry Andric     // https://raw.githubusercontent.com/wiki/hjl-tools/x86-psABI/x86-64-psABI-1.0.pdf
3410b57cec5SDimitry Andric     loc[-3] = 0x66;
3420b57cec5SDimitry Andric     memcpy(loc - 2, inst, sizeof(inst));
3430b57cec5SDimitry Andric     return;
3440b57cec5SDimitry Andric   }
3450b57cec5SDimitry Andric 
3460b57cec5SDimitry Andric   error(getErrorLocation(loc - 3) +
3470b57cec5SDimitry Andric         "expected R_X86_64_PLT32 or R_X86_64_GOTPCRELX after R_X86_64_TLSLD");
3480b57cec5SDimitry Andric }
3490b57cec5SDimitry Andric 
3500b57cec5SDimitry Andric void X86_64::relocateOne(uint8_t *loc, RelType type, uint64_t val) const {
3510b57cec5SDimitry Andric   switch (type) {
3520b57cec5SDimitry Andric   case R_X86_64_8:
3530b57cec5SDimitry Andric     checkIntUInt(loc, val, 8, type);
3540b57cec5SDimitry Andric     *loc = val;
3550b57cec5SDimitry Andric     break;
3560b57cec5SDimitry Andric   case R_X86_64_PC8:
3570b57cec5SDimitry Andric     checkInt(loc, val, 8, type);
3580b57cec5SDimitry Andric     *loc = val;
3590b57cec5SDimitry Andric     break;
3600b57cec5SDimitry Andric   case R_X86_64_16:
3610b57cec5SDimitry Andric     checkIntUInt(loc, val, 16, type);
3620b57cec5SDimitry Andric     write16le(loc, val);
3630b57cec5SDimitry Andric     break;
3640b57cec5SDimitry Andric   case R_X86_64_PC16:
3650b57cec5SDimitry Andric     checkInt(loc, val, 16, type);
3660b57cec5SDimitry Andric     write16le(loc, val);
3670b57cec5SDimitry Andric     break;
3680b57cec5SDimitry Andric   case R_X86_64_32:
3690b57cec5SDimitry Andric     checkUInt(loc, val, 32, type);
3700b57cec5SDimitry Andric     write32le(loc, val);
3710b57cec5SDimitry Andric     break;
3720b57cec5SDimitry Andric   case R_X86_64_32S:
3730b57cec5SDimitry Andric   case R_X86_64_TPOFF32:
3740b57cec5SDimitry Andric   case R_X86_64_GOT32:
3750b57cec5SDimitry Andric   case R_X86_64_GOTPC32:
3760b57cec5SDimitry Andric   case R_X86_64_GOTPC32_TLSDESC:
3770b57cec5SDimitry Andric   case R_X86_64_GOTPCREL:
3780b57cec5SDimitry Andric   case R_X86_64_GOTPCRELX:
3790b57cec5SDimitry Andric   case R_X86_64_REX_GOTPCRELX:
3800b57cec5SDimitry Andric   case R_X86_64_PC32:
3810b57cec5SDimitry Andric   case R_X86_64_GOTTPOFF:
3820b57cec5SDimitry Andric   case R_X86_64_PLT32:
3830b57cec5SDimitry Andric   case R_X86_64_TLSGD:
3840b57cec5SDimitry Andric   case R_X86_64_TLSLD:
3850b57cec5SDimitry Andric   case R_X86_64_DTPOFF32:
3860b57cec5SDimitry Andric   case R_X86_64_SIZE32:
3870b57cec5SDimitry Andric     checkInt(loc, val, 32, type);
3880b57cec5SDimitry Andric     write32le(loc, val);
3890b57cec5SDimitry Andric     break;
3900b57cec5SDimitry Andric   case R_X86_64_64:
3910b57cec5SDimitry Andric   case R_X86_64_DTPOFF64:
3920b57cec5SDimitry Andric   case R_X86_64_PC64:
3930b57cec5SDimitry Andric   case R_X86_64_SIZE64:
3940b57cec5SDimitry Andric   case R_X86_64_GOT64:
3950b57cec5SDimitry Andric   case R_X86_64_GOTOFF64:
3960b57cec5SDimitry Andric   case R_X86_64_GOTPC64:
3970b57cec5SDimitry Andric     write64le(loc, val);
3980b57cec5SDimitry Andric     break;
3990b57cec5SDimitry Andric   default:
4000b57cec5SDimitry Andric     llvm_unreachable("unknown relocation");
4010b57cec5SDimitry Andric   }
4020b57cec5SDimitry Andric }
4030b57cec5SDimitry Andric 
4040b57cec5SDimitry Andric RelExpr X86_64::adjustRelaxExpr(RelType type, const uint8_t *data,
4050b57cec5SDimitry Andric                                 RelExpr relExpr) const {
4060b57cec5SDimitry Andric   if (type != R_X86_64_GOTPCRELX && type != R_X86_64_REX_GOTPCRELX)
4070b57cec5SDimitry Andric     return relExpr;
4080b57cec5SDimitry Andric   const uint8_t op = data[-2];
4090b57cec5SDimitry Andric   const uint8_t modRm = data[-1];
4100b57cec5SDimitry Andric 
4110b57cec5SDimitry Andric   // FIXME: When PIC is disabled and foo is defined locally in the
4120b57cec5SDimitry Andric   // lower 32 bit address space, memory operand in mov can be converted into
4130b57cec5SDimitry Andric   // immediate operand. Otherwise, mov must be changed to lea. We support only
4140b57cec5SDimitry Andric   // latter relaxation at this moment.
4150b57cec5SDimitry Andric   if (op == 0x8b)
4160b57cec5SDimitry Andric     return R_RELAX_GOT_PC;
4170b57cec5SDimitry Andric 
4180b57cec5SDimitry Andric   // Relax call and jmp.
4190b57cec5SDimitry Andric   if (op == 0xff && (modRm == 0x15 || modRm == 0x25))
4200b57cec5SDimitry Andric     return R_RELAX_GOT_PC;
4210b57cec5SDimitry Andric 
4220b57cec5SDimitry Andric   // Relaxation of test, adc, add, and, cmp, or, sbb, sub, xor.
4230b57cec5SDimitry Andric   // If PIC then no relaxation is available.
4240b57cec5SDimitry Andric   // We also don't relax test/binop instructions without REX byte,
4250b57cec5SDimitry Andric   // they are 32bit operations and not common to have.
4260b57cec5SDimitry Andric   assert(type == R_X86_64_REX_GOTPCRELX);
4270b57cec5SDimitry Andric   return config->isPic ? relExpr : R_RELAX_GOT_PC_NOPIC;
4280b57cec5SDimitry Andric }
4290b57cec5SDimitry Andric 
4300b57cec5SDimitry Andric // A subset of relaxations can only be applied for no-PIC. This method
4310b57cec5SDimitry Andric // handles such relaxations. Instructions encoding information was taken from:
4320b57cec5SDimitry Andric // "Intel 64 and IA-32 Architectures Software Developer's Manual V2"
4330b57cec5SDimitry Andric // (http://www.intel.com/content/dam/www/public/us/en/documents/manuals/
4340b57cec5SDimitry Andric //    64-ia-32-architectures-software-developer-instruction-set-reference-manual-325383.pdf)
4350b57cec5SDimitry Andric static void relaxGotNoPic(uint8_t *loc, uint64_t val, uint8_t op,
4360b57cec5SDimitry Andric                           uint8_t modRm) {
4370b57cec5SDimitry Andric   const uint8_t rex = loc[-3];
4380b57cec5SDimitry Andric   // Convert "test %reg, foo@GOTPCREL(%rip)" to "test $foo, %reg".
4390b57cec5SDimitry Andric   if (op == 0x85) {
4400b57cec5SDimitry Andric     // See "TEST-Logical Compare" (4-428 Vol. 2B),
4410b57cec5SDimitry Andric     // TEST r/m64, r64 uses "full" ModR / M byte (no opcode extension).
4420b57cec5SDimitry Andric 
4430b57cec5SDimitry Andric     // ModR/M byte has form XX YYY ZZZ, where
4440b57cec5SDimitry Andric     // YYY is MODRM.reg(register 2), ZZZ is MODRM.rm(register 1).
4450b57cec5SDimitry Andric     // XX has different meanings:
4460b57cec5SDimitry Andric     // 00: The operand's memory address is in reg1.
4470b57cec5SDimitry Andric     // 01: The operand's memory address is reg1 + a byte-sized displacement.
4480b57cec5SDimitry Andric     // 10: The operand's memory address is reg1 + a word-sized displacement.
4490b57cec5SDimitry Andric     // 11: The operand is reg1 itself.
4500b57cec5SDimitry Andric     // If an instruction requires only one operand, the unused reg2 field
4510b57cec5SDimitry Andric     // holds extra opcode bits rather than a register code
4520b57cec5SDimitry Andric     // 0xC0 == 11 000 000 binary.
4530b57cec5SDimitry Andric     // 0x38 == 00 111 000 binary.
4540b57cec5SDimitry Andric     // We transfer reg2 to reg1 here as operand.
4550b57cec5SDimitry Andric     // See "2.1.3 ModR/M and SIB Bytes" (Vol. 2A 2-3).
4560b57cec5SDimitry Andric     loc[-1] = 0xc0 | (modRm & 0x38) >> 3; // ModR/M byte.
4570b57cec5SDimitry Andric 
4580b57cec5SDimitry Andric     // Change opcode from TEST r/m64, r64 to TEST r/m64, imm32
4590b57cec5SDimitry Andric     // See "TEST-Logical Compare" (4-428 Vol. 2B).
4600b57cec5SDimitry Andric     loc[-2] = 0xf7;
4610b57cec5SDimitry Andric 
4620b57cec5SDimitry Andric     // Move R bit to the B bit in REX byte.
4630b57cec5SDimitry Andric     // REX byte is encoded as 0100WRXB, where
4640b57cec5SDimitry Andric     // 0100 is 4bit fixed pattern.
4650b57cec5SDimitry Andric     // REX.W When 1, a 64-bit operand size is used. Otherwise, when 0, the
4660b57cec5SDimitry Andric     //   default operand size is used (which is 32-bit for most but not all
4670b57cec5SDimitry Andric     //   instructions).
4680b57cec5SDimitry Andric     // REX.R This 1-bit value is an extension to the MODRM.reg field.
4690b57cec5SDimitry Andric     // REX.X This 1-bit value is an extension to the SIB.index field.
4700b57cec5SDimitry Andric     // REX.B This 1-bit value is an extension to the MODRM.rm field or the
4710b57cec5SDimitry Andric     // SIB.base field.
4720b57cec5SDimitry Andric     // See "2.2.1.2 More on REX Prefix Fields " (2-8 Vol. 2A).
4730b57cec5SDimitry Andric     loc[-3] = (rex & ~0x4) | (rex & 0x4) >> 2;
4740b57cec5SDimitry Andric     write32le(loc, val);
4750b57cec5SDimitry Andric     return;
4760b57cec5SDimitry Andric   }
4770b57cec5SDimitry Andric 
4780b57cec5SDimitry Andric   // If we are here then we need to relax the adc, add, and, cmp, or, sbb, sub
4790b57cec5SDimitry Andric   // or xor operations.
4800b57cec5SDimitry Andric 
4810b57cec5SDimitry Andric   // Convert "binop foo@GOTPCREL(%rip), %reg" to "binop $foo, %reg".
4820b57cec5SDimitry Andric   // Logic is close to one for test instruction above, but we also
4830b57cec5SDimitry Andric   // write opcode extension here, see below for details.
4840b57cec5SDimitry Andric   loc[-1] = 0xc0 | (modRm & 0x38) >> 3 | (op & 0x3c); // ModR/M byte.
4850b57cec5SDimitry Andric 
4860b57cec5SDimitry Andric   // Primary opcode is 0x81, opcode extension is one of:
4870b57cec5SDimitry Andric   // 000b = ADD, 001b is OR, 010b is ADC, 011b is SBB,
4880b57cec5SDimitry Andric   // 100b is AND, 101b is SUB, 110b is XOR, 111b is CMP.
4890b57cec5SDimitry Andric   // This value was wrote to MODRM.reg in a line above.
4900b57cec5SDimitry Andric   // See "3.2 INSTRUCTIONS (A-M)" (Vol. 2A 3-15),
4910b57cec5SDimitry Andric   // "INSTRUCTION SET REFERENCE, N-Z" (Vol. 2B 4-1) for
4920b57cec5SDimitry Andric   // descriptions about each operation.
4930b57cec5SDimitry Andric   loc[-2] = 0x81;
4940b57cec5SDimitry Andric   loc[-3] = (rex & ~0x4) | (rex & 0x4) >> 2;
4950b57cec5SDimitry Andric   write32le(loc, val);
4960b57cec5SDimitry Andric }
4970b57cec5SDimitry Andric 
4980b57cec5SDimitry Andric void X86_64::relaxGot(uint8_t *loc, RelType type, uint64_t val) const {
4990b57cec5SDimitry Andric   const uint8_t op = loc[-2];
5000b57cec5SDimitry Andric   const uint8_t modRm = loc[-1];
5010b57cec5SDimitry Andric 
5020b57cec5SDimitry Andric   // Convert "mov foo@GOTPCREL(%rip),%reg" to "lea foo(%rip),%reg".
5030b57cec5SDimitry Andric   if (op == 0x8b) {
5040b57cec5SDimitry Andric     loc[-2] = 0x8d;
5050b57cec5SDimitry Andric     write32le(loc, val);
5060b57cec5SDimitry Andric     return;
5070b57cec5SDimitry Andric   }
5080b57cec5SDimitry Andric 
5090b57cec5SDimitry Andric   if (op != 0xff) {
5100b57cec5SDimitry Andric     // We are relaxing a rip relative to an absolute, so compensate
5110b57cec5SDimitry Andric     // for the old -4 addend.
5120b57cec5SDimitry Andric     assert(!config->isPic);
5130b57cec5SDimitry Andric     relaxGotNoPic(loc, val + 4, op, modRm);
5140b57cec5SDimitry Andric     return;
5150b57cec5SDimitry Andric   }
5160b57cec5SDimitry Andric 
5170b57cec5SDimitry Andric   // Convert call/jmp instructions.
5180b57cec5SDimitry Andric   if (modRm == 0x15) {
5190b57cec5SDimitry Andric     // ABI says we can convert "call *foo@GOTPCREL(%rip)" to "nop; call foo".
5200b57cec5SDimitry Andric     // Instead we convert to "addr32 call foo" where addr32 is an instruction
5210b57cec5SDimitry Andric     // prefix. That makes result expression to be a single instruction.
5220b57cec5SDimitry Andric     loc[-2] = 0x67; // addr32 prefix
5230b57cec5SDimitry Andric     loc[-1] = 0xe8; // call
5240b57cec5SDimitry Andric     write32le(loc, val);
5250b57cec5SDimitry Andric     return;
5260b57cec5SDimitry Andric   }
5270b57cec5SDimitry Andric 
5280b57cec5SDimitry Andric   // Convert "jmp *foo@GOTPCREL(%rip)" to "jmp foo; nop".
5290b57cec5SDimitry Andric   // jmp doesn't return, so it is fine to use nop here, it is just a stub.
5300b57cec5SDimitry Andric   assert(modRm == 0x25);
5310b57cec5SDimitry Andric   loc[-2] = 0xe9; // jmp
5320b57cec5SDimitry Andric   loc[3] = 0x90;  // nop
5330b57cec5SDimitry Andric   write32le(loc - 1, val + 1);
5340b57cec5SDimitry Andric }
5350b57cec5SDimitry Andric 
5360b57cec5SDimitry Andric // A split-stack prologue starts by checking the amount of stack remaining
5370b57cec5SDimitry Andric // in one of two ways:
5380b57cec5SDimitry Andric // A) Comparing of the stack pointer to a field in the tcb.
5390b57cec5SDimitry Andric // B) Or a load of a stack pointer offset with an lea to r10 or r11.
5400b57cec5SDimitry Andric bool X86_64::adjustPrologueForCrossSplitStack(uint8_t *loc, uint8_t *end,
5410b57cec5SDimitry Andric                                               uint8_t stOther) const {
5420b57cec5SDimitry Andric   if (!config->is64) {
5430b57cec5SDimitry Andric     error("Target doesn't support split stacks.");
5440b57cec5SDimitry Andric     return false;
5450b57cec5SDimitry Andric   }
5460b57cec5SDimitry Andric 
5470b57cec5SDimitry Andric   if (loc + 8 >= end)
5480b57cec5SDimitry Andric     return false;
5490b57cec5SDimitry Andric 
5500b57cec5SDimitry Andric   // Replace "cmp %fs:0x70,%rsp" and subsequent branch
5510b57cec5SDimitry Andric   // with "stc, nopl 0x0(%rax,%rax,1)"
5520b57cec5SDimitry Andric   if (memcmp(loc, "\x64\x48\x3b\x24\x25", 5) == 0) {
5530b57cec5SDimitry Andric     memcpy(loc, "\xf9\x0f\x1f\x84\x00\x00\x00\x00", 8);
5540b57cec5SDimitry Andric     return true;
5550b57cec5SDimitry Andric   }
5560b57cec5SDimitry Andric 
5570b57cec5SDimitry Andric   // Adjust "lea X(%rsp),%rYY" to lea "(X - 0x4000)(%rsp),%rYY" where rYY could
5580b57cec5SDimitry Andric   // be r10 or r11. The lea instruction feeds a subsequent compare which checks
5590b57cec5SDimitry Andric   // if there is X available stack space. Making X larger effectively reserves
5600b57cec5SDimitry Andric   // that much additional space. The stack grows downward so subtract the value.
5610b57cec5SDimitry Andric   if (memcmp(loc, "\x4c\x8d\x94\x24", 4) == 0 ||
5620b57cec5SDimitry Andric       memcmp(loc, "\x4c\x8d\x9c\x24", 4) == 0) {
5630b57cec5SDimitry Andric     // The offset bytes are encoded four bytes after the start of the
5640b57cec5SDimitry Andric     // instruction.
5650b57cec5SDimitry Andric     write32le(loc + 4, read32le(loc + 4) - 0x4000);
5660b57cec5SDimitry Andric     return true;
5670b57cec5SDimitry Andric   }
5680b57cec5SDimitry Andric   return false;
5690b57cec5SDimitry Andric }
5700b57cec5SDimitry Andric 
571*480093f4SDimitry Andric // If Intel Indirect Branch Tracking is enabled, we have to emit special PLT
572*480093f4SDimitry Andric // entries containing endbr64 instructions. A PLT entry will be split into two
573*480093f4SDimitry Andric // parts, one in .plt.sec (writePlt), and the other in .plt (writeIBTPlt).
574*480093f4SDimitry Andric namespace {
575*480093f4SDimitry Andric class IntelIBT : public X86_64 {
576*480093f4SDimitry Andric public:
577*480093f4SDimitry Andric   IntelIBT();
578*480093f4SDimitry Andric   void writeGotPlt(uint8_t *buf, const Symbol &s) const override;
579*480093f4SDimitry Andric   void writePlt(uint8_t *buf, const Symbol &sym,
580*480093f4SDimitry Andric                 uint64_t pltEntryAddr) const override;
581*480093f4SDimitry Andric   void writeIBTPlt(uint8_t *buf, size_t numEntries) const override;
582*480093f4SDimitry Andric 
583*480093f4SDimitry Andric   static const unsigned IBTPltHeaderSize = 16;
584*480093f4SDimitry Andric };
585*480093f4SDimitry Andric } // namespace
586*480093f4SDimitry Andric 
587*480093f4SDimitry Andric IntelIBT::IntelIBT() { pltHeaderSize = 0; }
588*480093f4SDimitry Andric 
589*480093f4SDimitry Andric void IntelIBT::writeGotPlt(uint8_t *buf, const Symbol &s) const {
590*480093f4SDimitry Andric   uint64_t va =
591*480093f4SDimitry Andric       in.ibtPlt->getVA() + IBTPltHeaderSize + s.pltIndex * pltEntrySize;
592*480093f4SDimitry Andric   write64le(buf, va);
593*480093f4SDimitry Andric }
594*480093f4SDimitry Andric 
595*480093f4SDimitry Andric void IntelIBT::writePlt(uint8_t *buf, const Symbol &sym,
596*480093f4SDimitry Andric                         uint64_t pltEntryAddr) const {
597*480093f4SDimitry Andric   const uint8_t Inst[] = {
598*480093f4SDimitry Andric       0xf3, 0x0f, 0x1e, 0xfa,       // endbr64
599*480093f4SDimitry Andric       0xff, 0x25, 0,    0,    0, 0, // jmpq *got(%rip)
600*480093f4SDimitry Andric       0x66, 0x0f, 0x1f, 0x44, 0, 0, // nop
601*480093f4SDimitry Andric   };
602*480093f4SDimitry Andric   memcpy(buf, Inst, sizeof(Inst));
603*480093f4SDimitry Andric   write32le(buf + 6, sym.getGotPltVA() - pltEntryAddr - 10);
604*480093f4SDimitry Andric }
605*480093f4SDimitry Andric 
606*480093f4SDimitry Andric void IntelIBT::writeIBTPlt(uint8_t *buf, size_t numEntries) const {
607*480093f4SDimitry Andric   writePltHeader(buf);
608*480093f4SDimitry Andric   buf += IBTPltHeaderSize;
609*480093f4SDimitry Andric 
610*480093f4SDimitry Andric   const uint8_t inst[] = {
611*480093f4SDimitry Andric       0xf3, 0x0f, 0x1e, 0xfa,    // endbr64
612*480093f4SDimitry Andric       0x68, 0,    0,    0,    0, // pushq <relocation index>
613*480093f4SDimitry Andric       0xe9, 0,    0,    0,    0, // jmpq plt[0]
614*480093f4SDimitry Andric       0x66, 0x90,                // nop
615*480093f4SDimitry Andric   };
616*480093f4SDimitry Andric 
617*480093f4SDimitry Andric   for (size_t i = 0; i < numEntries; ++i) {
618*480093f4SDimitry Andric     memcpy(buf, inst, sizeof(inst));
619*480093f4SDimitry Andric     write32le(buf + 5, i);
620*480093f4SDimitry Andric     write32le(buf + 10, -pltHeaderSize - sizeof(inst) * i - 30);
621*480093f4SDimitry Andric     buf += sizeof(inst);
622*480093f4SDimitry Andric   }
623*480093f4SDimitry Andric }
624*480093f4SDimitry Andric 
6250b57cec5SDimitry Andric // These nonstandard PLT entries are to migtigate Spectre v2 security
6260b57cec5SDimitry Andric // vulnerability. In order to mitigate Spectre v2, we want to avoid indirect
6270b57cec5SDimitry Andric // branch instructions such as `jmp *GOTPLT(%rip)`. So, in the following PLT
6280b57cec5SDimitry Andric // entries, we use a CALL followed by MOV and RET to do the same thing as an
6290b57cec5SDimitry Andric // indirect jump. That instruction sequence is so-called "retpoline".
6300b57cec5SDimitry Andric //
6310b57cec5SDimitry Andric // We have two types of retpoline PLTs as a size optimization. If `-z now`
6320b57cec5SDimitry Andric // is specified, all dynamic symbols are resolved at load-time. Thus, when
6330b57cec5SDimitry Andric // that option is given, we can omit code for symbol lazy resolution.
6340b57cec5SDimitry Andric namespace {
6350b57cec5SDimitry Andric class Retpoline : public X86_64 {
6360b57cec5SDimitry Andric public:
6370b57cec5SDimitry Andric   Retpoline();
6380b57cec5SDimitry Andric   void writeGotPlt(uint8_t *buf, const Symbol &s) const override;
6390b57cec5SDimitry Andric   void writePltHeader(uint8_t *buf) const override;
640*480093f4SDimitry Andric   void writePlt(uint8_t *buf, const Symbol &sym,
641*480093f4SDimitry Andric                 uint64_t pltEntryAddr) const override;
6420b57cec5SDimitry Andric };
6430b57cec5SDimitry Andric 
6440b57cec5SDimitry Andric class RetpolineZNow : public X86_64 {
6450b57cec5SDimitry Andric public:
6460b57cec5SDimitry Andric   RetpolineZNow();
6470b57cec5SDimitry Andric   void writeGotPlt(uint8_t *buf, const Symbol &s) const override {}
6480b57cec5SDimitry Andric   void writePltHeader(uint8_t *buf) const override;
649*480093f4SDimitry Andric   void writePlt(uint8_t *buf, const Symbol &sym,
650*480093f4SDimitry Andric                 uint64_t pltEntryAddr) const override;
6510b57cec5SDimitry Andric };
6520b57cec5SDimitry Andric } // namespace
6530b57cec5SDimitry Andric 
6540b57cec5SDimitry Andric Retpoline::Retpoline() {
6550b57cec5SDimitry Andric   pltHeaderSize = 48;
6560b57cec5SDimitry Andric   pltEntrySize = 32;
657*480093f4SDimitry Andric   ipltEntrySize = 32;
6580b57cec5SDimitry Andric }
6590b57cec5SDimitry Andric 
6600b57cec5SDimitry Andric void Retpoline::writeGotPlt(uint8_t *buf, const Symbol &s) const {
6610b57cec5SDimitry Andric   write64le(buf, s.getPltVA() + 17);
6620b57cec5SDimitry Andric }
6630b57cec5SDimitry Andric 
6640b57cec5SDimitry Andric void Retpoline::writePltHeader(uint8_t *buf) const {
6650b57cec5SDimitry Andric   const uint8_t insn[] = {
6660b57cec5SDimitry Andric       0xff, 0x35, 0,    0,    0,    0,          // 0:    pushq GOTPLT+8(%rip)
6670b57cec5SDimitry Andric       0x4c, 0x8b, 0x1d, 0,    0,    0,    0,    // 6:    mov GOTPLT+16(%rip), %r11
6680b57cec5SDimitry Andric       0xe8, 0x0e, 0x00, 0x00, 0x00,             // d:    callq next
6690b57cec5SDimitry Andric       0xf3, 0x90,                               // 12: loop: pause
6700b57cec5SDimitry Andric       0x0f, 0xae, 0xe8,                         // 14:   lfence
6710b57cec5SDimitry Andric       0xeb, 0xf9,                               // 17:   jmp loop
6720b57cec5SDimitry Andric       0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 19:   int3; .align 16
6730b57cec5SDimitry Andric       0x4c, 0x89, 0x1c, 0x24,                   // 20: next: mov %r11, (%rsp)
6740b57cec5SDimitry Andric       0xc3,                                     // 24:   ret
6750b57cec5SDimitry Andric       0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 25:   int3; padding
6760b57cec5SDimitry Andric       0xcc, 0xcc, 0xcc, 0xcc,                   // 2c:   int3; padding
6770b57cec5SDimitry Andric   };
6780b57cec5SDimitry Andric   memcpy(buf, insn, sizeof(insn));
6790b57cec5SDimitry Andric 
6800b57cec5SDimitry Andric   uint64_t gotPlt = in.gotPlt->getVA();
6810b57cec5SDimitry Andric   uint64_t plt = in.plt->getVA();
6820b57cec5SDimitry Andric   write32le(buf + 2, gotPlt - plt - 6 + 8);
6830b57cec5SDimitry Andric   write32le(buf + 9, gotPlt - plt - 13 + 16);
6840b57cec5SDimitry Andric }
6850b57cec5SDimitry Andric 
686*480093f4SDimitry Andric void Retpoline::writePlt(uint8_t *buf, const Symbol &sym,
687*480093f4SDimitry Andric                          uint64_t pltEntryAddr) const {
6880b57cec5SDimitry Andric   const uint8_t insn[] = {
6890b57cec5SDimitry Andric       0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // 0:  mov foo@GOTPLT(%rip), %r11
6900b57cec5SDimitry Andric       0xe8, 0,    0,    0,    0,    // 7:  callq plt+0x20
6910b57cec5SDimitry Andric       0xe9, 0,    0,    0,    0,    // c:  jmp plt+0x12
6920b57cec5SDimitry Andric       0x68, 0,    0,    0,    0,    // 11: pushq <relocation index>
6930b57cec5SDimitry Andric       0xe9, 0,    0,    0,    0,    // 16: jmp plt+0
6940b57cec5SDimitry Andric       0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1b: int3; padding
6950b57cec5SDimitry Andric   };
6960b57cec5SDimitry Andric   memcpy(buf, insn, sizeof(insn));
6970b57cec5SDimitry Andric 
698*480093f4SDimitry Andric   uint64_t off = pltEntryAddr - in.plt->getVA();
6990b57cec5SDimitry Andric 
700*480093f4SDimitry Andric   write32le(buf + 3, sym.getGotPltVA() - pltEntryAddr - 7);
7010b57cec5SDimitry Andric   write32le(buf + 8, -off - 12 + 32);
7020b57cec5SDimitry Andric   write32le(buf + 13, -off - 17 + 18);
703*480093f4SDimitry Andric   write32le(buf + 18, sym.pltIndex);
7040b57cec5SDimitry Andric   write32le(buf + 23, -off - 27);
7050b57cec5SDimitry Andric }
7060b57cec5SDimitry Andric 
7070b57cec5SDimitry Andric RetpolineZNow::RetpolineZNow() {
7080b57cec5SDimitry Andric   pltHeaderSize = 32;
7090b57cec5SDimitry Andric   pltEntrySize = 16;
710*480093f4SDimitry Andric   ipltEntrySize = 16;
7110b57cec5SDimitry Andric }
7120b57cec5SDimitry Andric 
7130b57cec5SDimitry Andric void RetpolineZNow::writePltHeader(uint8_t *buf) const {
7140b57cec5SDimitry Andric   const uint8_t insn[] = {
7150b57cec5SDimitry Andric       0xe8, 0x0b, 0x00, 0x00, 0x00, // 0:    call next
7160b57cec5SDimitry Andric       0xf3, 0x90,                   // 5:  loop: pause
7170b57cec5SDimitry Andric       0x0f, 0xae, 0xe8,             // 7:    lfence
7180b57cec5SDimitry Andric       0xeb, 0xf9,                   // a:    jmp loop
7190b57cec5SDimitry Andric       0xcc, 0xcc, 0xcc, 0xcc,       // c:    int3; .align 16
7200b57cec5SDimitry Andric       0x4c, 0x89, 0x1c, 0x24,       // 10: next: mov %r11, (%rsp)
7210b57cec5SDimitry Andric       0xc3,                         // 14:   ret
7220b57cec5SDimitry Andric       0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 15:   int3; padding
7230b57cec5SDimitry Andric       0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1a:   int3; padding
7240b57cec5SDimitry Andric       0xcc,                         // 1f:   int3; padding
7250b57cec5SDimitry Andric   };
7260b57cec5SDimitry Andric   memcpy(buf, insn, sizeof(insn));
7270b57cec5SDimitry Andric }
7280b57cec5SDimitry Andric 
729*480093f4SDimitry Andric void RetpolineZNow::writePlt(uint8_t *buf, const Symbol &sym,
730*480093f4SDimitry Andric                              uint64_t pltEntryAddr) const {
7310b57cec5SDimitry Andric   const uint8_t insn[] = {
7320b57cec5SDimitry Andric       0x4c, 0x8b, 0x1d, 0,    0, 0, 0, // mov foo@GOTPLT(%rip), %r11
7330b57cec5SDimitry Andric       0xe9, 0,    0,    0,    0,       // jmp plt+0
7340b57cec5SDimitry Andric       0xcc, 0xcc, 0xcc, 0xcc,          // int3; padding
7350b57cec5SDimitry Andric   };
7360b57cec5SDimitry Andric   memcpy(buf, insn, sizeof(insn));
7370b57cec5SDimitry Andric 
738*480093f4SDimitry Andric   write32le(buf + 3, sym.getGotPltVA() - pltEntryAddr - 7);
739*480093f4SDimitry Andric   write32le(buf + 8, in.plt->getVA() - pltEntryAddr - 12);
7400b57cec5SDimitry Andric }
7410b57cec5SDimitry Andric 
7420b57cec5SDimitry Andric static TargetInfo *getTargetInfo() {
7430b57cec5SDimitry Andric   if (config->zRetpolineplt) {
7440b57cec5SDimitry Andric     if (config->zNow) {
7450b57cec5SDimitry Andric       static RetpolineZNow t;
7460b57cec5SDimitry Andric       return &t;
7470b57cec5SDimitry Andric     }
7480b57cec5SDimitry Andric     static Retpoline t;
7490b57cec5SDimitry Andric     return &t;
7500b57cec5SDimitry Andric   }
7510b57cec5SDimitry Andric 
752*480093f4SDimitry Andric   if (config->andFeatures & GNU_PROPERTY_X86_FEATURE_1_IBT) {
753*480093f4SDimitry Andric     static IntelIBT t;
754*480093f4SDimitry Andric     return &t;
755*480093f4SDimitry Andric   }
756*480093f4SDimitry Andric 
7570b57cec5SDimitry Andric   static X86_64 t;
7580b57cec5SDimitry Andric   return &t;
7590b57cec5SDimitry Andric }
7600b57cec5SDimitry Andric 
76185868e8aSDimitry Andric TargetInfo *getX86_64TargetInfo() { return getTargetInfo(); }
76285868e8aSDimitry Andric 
76385868e8aSDimitry Andric } // namespace elf
76485868e8aSDimitry Andric } // namespace lld
765