1 //===- X86_64.cpp ---------------------------------------------------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 9 #include "OutputSections.h" 10 #include "Symbols.h" 11 #include "SyntheticSections.h" 12 #include "Target.h" 13 #include "lld/Common/ErrorHandler.h" 14 #include "llvm/BinaryFormat/ELF.h" 15 #include "llvm/Support/Endian.h" 16 17 using namespace llvm; 18 using namespace llvm::object; 19 using namespace llvm::support::endian; 20 using namespace llvm::ELF; 21 using namespace lld; 22 using namespace lld::elf; 23 24 namespace { 25 class X86_64 : public TargetInfo { 26 public: 27 X86_64(); 28 int getTlsGdRelaxSkip(RelType type) const override; 29 RelExpr getRelExpr(RelType type, const Symbol &s, 30 const uint8_t *loc) const override; 31 RelType getDynRel(RelType type) const override; 32 void writeGotPltHeader(uint8_t *buf) const override; 33 void writeGotPlt(uint8_t *buf, const Symbol &s) const override; 34 void writeIgotPlt(uint8_t *buf, const Symbol &s) const override; 35 void writePltHeader(uint8_t *buf) const override; 36 void writePlt(uint8_t *buf, const Symbol &sym, 37 uint64_t pltEntryAddr) const override; 38 void relocate(uint8_t *loc, const Relocation &rel, 39 uint64_t val) const override; 40 int64_t getImplicitAddend(const uint8_t *buf, RelType type) const override; 41 void applyJumpInstrMod(uint8_t *loc, JumpModType type, 42 unsigned size) const override; 43 44 RelExpr adjustGotPcExpr(RelType type, int64_t addend, 45 const uint8_t *loc) const override; 46 void relaxGot(uint8_t *loc, const Relocation &rel, 47 uint64_t val) const override; 48 void relaxTlsGdToIe(uint8_t *loc, const Relocation &rel, 49 uint64_t val) const override; 50 void relaxTlsGdToLe(uint8_t *loc, const Relocation &rel, 51 uint64_t val) const override; 52 void relaxTlsIeToLe(uint8_t *loc, const Relocation &rel, 53 uint64_t val) const override; 54 void relaxTlsLdToLe(uint8_t *loc, const Relocation &rel, 55 uint64_t val) const override; 56 bool adjustPrologueForCrossSplitStack(uint8_t *loc, uint8_t *end, 57 uint8_t stOther) const override; 58 bool deleteFallThruJmpInsn(InputSection &is, InputFile *file, 59 InputSection *nextIS) const override; 60 }; 61 } // namespace 62 63 // This is vector of NOP instructions of sizes from 1 to 8 bytes. The 64 // appropriately sized instructions are used to fill the gaps between sections 65 // which are executed during fall through. 66 static const std::vector<std::vector<uint8_t>> nopInstructions = { 67 {0x90}, 68 {0x66, 0x90}, 69 {0x0f, 0x1f, 0x00}, 70 {0x0f, 0x1f, 0x40, 0x00}, 71 {0x0f, 0x1f, 0x44, 0x00, 0x00}, 72 {0x66, 0x0f, 0x1f, 0x44, 0x00, 0x00}, 73 {0x0F, 0x1F, 0x80, 0x00, 0x00, 0x00, 0x00}, 74 {0x0F, 0x1F, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00}, 75 {0x66, 0x0F, 0x1F, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00}}; 76 77 X86_64::X86_64() { 78 copyRel = R_X86_64_COPY; 79 gotRel = R_X86_64_GLOB_DAT; 80 pltRel = R_X86_64_JUMP_SLOT; 81 relativeRel = R_X86_64_RELATIVE; 82 iRelativeRel = R_X86_64_IRELATIVE; 83 symbolicRel = R_X86_64_64; 84 tlsDescRel = R_X86_64_TLSDESC; 85 tlsGotRel = R_X86_64_TPOFF64; 86 tlsModuleIndexRel = R_X86_64_DTPMOD64; 87 tlsOffsetRel = R_X86_64_DTPOFF64; 88 gotBaseSymInGotPlt = true; 89 gotEntrySize = 8; 90 pltHeaderSize = 16; 91 pltEntrySize = 16; 92 ipltEntrySize = 16; 93 trapInstr = {0xcc, 0xcc, 0xcc, 0xcc}; // 0xcc = INT3 94 nopInstrs = nopInstructions; 95 96 // Align to the large page size (known as a superpage or huge page). 97 // FreeBSD automatically promotes large, superpage-aligned allocations. 98 defaultImageBase = 0x200000; 99 } 100 101 int X86_64::getTlsGdRelaxSkip(RelType type) const { 102 // TLSDESC relocations are processed separately. See relaxTlsGdToLe below. 103 return type == R_X86_64_GOTPC32_TLSDESC || type == R_X86_64_TLSDESC_CALL ? 1 104 : 2; 105 } 106 107 // Opcodes for the different X86_64 jmp instructions. 108 enum JmpInsnOpcode : uint32_t { 109 J_JMP_32, 110 J_JNE_32, 111 J_JE_32, 112 J_JG_32, 113 J_JGE_32, 114 J_JB_32, 115 J_JBE_32, 116 J_JL_32, 117 J_JLE_32, 118 J_JA_32, 119 J_JAE_32, 120 J_UNKNOWN, 121 }; 122 123 // Given the first (optional) and second byte of the insn's opcode, this 124 // returns the corresponding enum value. 125 static JmpInsnOpcode getJmpInsnType(const uint8_t *first, 126 const uint8_t *second) { 127 if (*second == 0xe9) 128 return J_JMP_32; 129 130 if (first == nullptr) 131 return J_UNKNOWN; 132 133 if (*first == 0x0f) { 134 switch (*second) { 135 case 0x84: 136 return J_JE_32; 137 case 0x85: 138 return J_JNE_32; 139 case 0x8f: 140 return J_JG_32; 141 case 0x8d: 142 return J_JGE_32; 143 case 0x82: 144 return J_JB_32; 145 case 0x86: 146 return J_JBE_32; 147 case 0x8c: 148 return J_JL_32; 149 case 0x8e: 150 return J_JLE_32; 151 case 0x87: 152 return J_JA_32; 153 case 0x83: 154 return J_JAE_32; 155 } 156 } 157 return J_UNKNOWN; 158 } 159 160 // Return the relocation index for input section IS with a specific Offset. 161 // Returns the maximum size of the vector if no such relocation is found. 162 static unsigned getRelocationWithOffset(const InputSection &is, 163 uint64_t offset) { 164 unsigned size = is.relocations.size(); 165 for (unsigned i = size - 1; i + 1 > 0; --i) { 166 if (is.relocations[i].offset == offset && is.relocations[i].expr != R_NONE) 167 return i; 168 } 169 return size; 170 } 171 172 // Returns true if R corresponds to a relocation used for a jump instruction. 173 // TODO: Once special relocations for relaxable jump instructions are available, 174 // this should be modified to use those relocations. 175 static bool isRelocationForJmpInsn(Relocation &R) { 176 return R.type == R_X86_64_PLT32 || R.type == R_X86_64_PC32 || 177 R.type == R_X86_64_PC8; 178 } 179 180 // Return true if Relocation R points to the first instruction in the 181 // next section. 182 // TODO: Delete this once psABI reserves a new relocation type for fall thru 183 // jumps. 184 static bool isFallThruRelocation(InputSection &is, InputFile *file, 185 InputSection *nextIS, Relocation &r) { 186 if (!isRelocationForJmpInsn(r)) 187 return false; 188 189 uint64_t addrLoc = is.getOutputSection()->addr + is.outSecOff + r.offset; 190 uint64_t targetOffset = InputSectionBase::getRelocTargetVA( 191 file, r.type, r.addend, addrLoc, *r.sym, r.expr); 192 193 // If this jmp is a fall thru, the target offset is the beginning of the 194 // next section. 195 uint64_t nextSectionOffset = 196 nextIS->getOutputSection()->addr + nextIS->outSecOff; 197 return (addrLoc + 4 + targetOffset) == nextSectionOffset; 198 } 199 200 // Return the jmp instruction opcode that is the inverse of the given 201 // opcode. For example, JE inverted is JNE. 202 static JmpInsnOpcode invertJmpOpcode(const JmpInsnOpcode opcode) { 203 switch (opcode) { 204 case J_JE_32: 205 return J_JNE_32; 206 case J_JNE_32: 207 return J_JE_32; 208 case J_JG_32: 209 return J_JLE_32; 210 case J_JGE_32: 211 return J_JL_32; 212 case J_JB_32: 213 return J_JAE_32; 214 case J_JBE_32: 215 return J_JA_32; 216 case J_JL_32: 217 return J_JGE_32; 218 case J_JLE_32: 219 return J_JG_32; 220 case J_JA_32: 221 return J_JBE_32; 222 case J_JAE_32: 223 return J_JB_32; 224 default: 225 return J_UNKNOWN; 226 } 227 } 228 229 // Deletes direct jump instruction in input sections that jumps to the 230 // following section as it is not required. If there are two consecutive jump 231 // instructions, it checks if they can be flipped and one can be deleted. 232 // For example: 233 // .section .text 234 // a.BB.foo: 235 // ... 236 // 10: jne aa.BB.foo 237 // 16: jmp bar 238 // aa.BB.foo: 239 // ... 240 // 241 // can be converted to: 242 // a.BB.foo: 243 // ... 244 // 10: je bar #jne flipped to je and the jmp is deleted. 245 // aa.BB.foo: 246 // ... 247 bool X86_64::deleteFallThruJmpInsn(InputSection &is, InputFile *file, 248 InputSection *nextIS) const { 249 const unsigned sizeOfDirectJmpInsn = 5; 250 251 if (nextIS == nullptr) 252 return false; 253 254 if (is.getSize() < sizeOfDirectJmpInsn) 255 return false; 256 257 // If this jmp insn can be removed, it is the last insn and the 258 // relocation is 4 bytes before the end. 259 unsigned rIndex = getRelocationWithOffset(is, is.getSize() - 4); 260 if (rIndex == is.relocations.size()) 261 return false; 262 263 Relocation &r = is.relocations[rIndex]; 264 265 // Check if the relocation corresponds to a direct jmp. 266 const uint8_t *secContents = is.rawData.data(); 267 // If it is not a direct jmp instruction, there is nothing to do here. 268 if (*(secContents + r.offset - 1) != 0xe9) 269 return false; 270 271 if (isFallThruRelocation(is, file, nextIS, r)) { 272 // This is a fall thru and can be deleted. 273 r.expr = R_NONE; 274 r.offset = 0; 275 is.drop_back(sizeOfDirectJmpInsn); 276 is.nopFiller = true; 277 return true; 278 } 279 280 // Now, check if flip and delete is possible. 281 const unsigned sizeOfJmpCCInsn = 6; 282 // To flip, there must be at least one JmpCC and one direct jmp. 283 if (is.getSize() < sizeOfDirectJmpInsn + sizeOfJmpCCInsn) 284 return false; 285 286 unsigned rbIndex = 287 getRelocationWithOffset(is, (is.getSize() - sizeOfDirectJmpInsn - 4)); 288 if (rbIndex == is.relocations.size()) 289 return false; 290 291 Relocation &rB = is.relocations[rbIndex]; 292 293 const uint8_t *jmpInsnB = secContents + rB.offset - 1; 294 JmpInsnOpcode jmpOpcodeB = getJmpInsnType(jmpInsnB - 1, jmpInsnB); 295 if (jmpOpcodeB == J_UNKNOWN) 296 return false; 297 298 if (!isFallThruRelocation(is, file, nextIS, rB)) 299 return false; 300 301 // jmpCC jumps to the fall thru block, the branch can be flipped and the 302 // jmp can be deleted. 303 JmpInsnOpcode jInvert = invertJmpOpcode(jmpOpcodeB); 304 if (jInvert == J_UNKNOWN) 305 return false; 306 is.jumpInstrMod = make<JumpInstrMod>(); 307 *is.jumpInstrMod = {rB.offset - 1, jInvert, 4}; 308 // Move R's values to rB except the offset. 309 rB = {r.expr, r.type, rB.offset, r.addend, r.sym}; 310 // Cancel R 311 r.expr = R_NONE; 312 r.offset = 0; 313 is.drop_back(sizeOfDirectJmpInsn); 314 is.nopFiller = true; 315 return true; 316 } 317 318 RelExpr X86_64::getRelExpr(RelType type, const Symbol &s, 319 const uint8_t *loc) const { 320 if (type == R_X86_64_GOTTPOFF) 321 config->hasTlsIe = true; 322 323 switch (type) { 324 case R_X86_64_8: 325 case R_X86_64_16: 326 case R_X86_64_32: 327 case R_X86_64_32S: 328 case R_X86_64_64: 329 return R_ABS; 330 case R_X86_64_DTPOFF32: 331 case R_X86_64_DTPOFF64: 332 return R_DTPREL; 333 case R_X86_64_TPOFF32: 334 return R_TPREL; 335 case R_X86_64_TLSDESC_CALL: 336 return R_TLSDESC_CALL; 337 case R_X86_64_TLSLD: 338 return R_TLSLD_PC; 339 case R_X86_64_TLSGD: 340 return R_TLSGD_PC; 341 case R_X86_64_SIZE32: 342 case R_X86_64_SIZE64: 343 return R_SIZE; 344 case R_X86_64_PLT32: 345 return R_PLT_PC; 346 case R_X86_64_PC8: 347 case R_X86_64_PC16: 348 case R_X86_64_PC32: 349 case R_X86_64_PC64: 350 return R_PC; 351 case R_X86_64_GOT32: 352 case R_X86_64_GOT64: 353 return R_GOTPLT; 354 case R_X86_64_GOTPC32_TLSDESC: 355 return R_TLSDESC_PC; 356 case R_X86_64_GOTPCREL: 357 case R_X86_64_GOTPCRELX: 358 case R_X86_64_REX_GOTPCRELX: 359 case R_X86_64_GOTTPOFF: 360 return R_GOT_PC; 361 case R_X86_64_GOTOFF64: 362 return R_GOTPLTREL; 363 case R_X86_64_PLTOFF64: 364 return R_PLT_GOTPLT; 365 case R_X86_64_GOTPC32: 366 case R_X86_64_GOTPC64: 367 return R_GOTPLTONLY_PC; 368 case R_X86_64_NONE: 369 return R_NONE; 370 default: 371 error(getErrorLocation(loc) + "unknown relocation (" + Twine(type) + 372 ") against symbol " + toString(s)); 373 return R_NONE; 374 } 375 } 376 377 void X86_64::writeGotPltHeader(uint8_t *buf) const { 378 // The first entry holds the value of _DYNAMIC. It is not clear why that is 379 // required, but it is documented in the psabi and the glibc dynamic linker 380 // seems to use it (note that this is relevant for linking ld.so, not any 381 // other program). 382 write64le(buf, mainPart->dynamic->getVA()); 383 } 384 385 void X86_64::writeGotPlt(uint8_t *buf, const Symbol &s) const { 386 // See comments in X86::writeGotPlt. 387 write64le(buf, s.getPltVA() + 6); 388 } 389 390 void X86_64::writeIgotPlt(uint8_t *buf, const Symbol &s) const { 391 // An x86 entry is the address of the ifunc resolver function (for -z rel). 392 if (config->writeAddends) 393 write64le(buf, s.getVA()); 394 } 395 396 void X86_64::writePltHeader(uint8_t *buf) const { 397 const uint8_t pltData[] = { 398 0xff, 0x35, 0, 0, 0, 0, // pushq GOTPLT+8(%rip) 399 0xff, 0x25, 0, 0, 0, 0, // jmp *GOTPLT+16(%rip) 400 0x0f, 0x1f, 0x40, 0x00, // nop 401 }; 402 memcpy(buf, pltData, sizeof(pltData)); 403 uint64_t gotPlt = in.gotPlt->getVA(); 404 uint64_t plt = in.ibtPlt ? in.ibtPlt->getVA() : in.plt->getVA(); 405 write32le(buf + 2, gotPlt - plt + 2); // GOTPLT+8 406 write32le(buf + 8, gotPlt - plt + 4); // GOTPLT+16 407 } 408 409 void X86_64::writePlt(uint8_t *buf, const Symbol &sym, 410 uint64_t pltEntryAddr) const { 411 const uint8_t inst[] = { 412 0xff, 0x25, 0, 0, 0, 0, // jmpq *got(%rip) 413 0x68, 0, 0, 0, 0, // pushq <relocation index> 414 0xe9, 0, 0, 0, 0, // jmpq plt[0] 415 }; 416 memcpy(buf, inst, sizeof(inst)); 417 418 write32le(buf + 2, sym.getGotPltVA() - pltEntryAddr - 6); 419 write32le(buf + 7, sym.getPltIdx()); 420 write32le(buf + 12, in.plt->getVA() - pltEntryAddr - 16); 421 } 422 423 RelType X86_64::getDynRel(RelType type) const { 424 if (type == R_X86_64_64 || type == R_X86_64_PC64 || type == R_X86_64_SIZE32 || 425 type == R_X86_64_SIZE64) 426 return type; 427 return R_X86_64_NONE; 428 } 429 430 void X86_64::relaxTlsGdToLe(uint8_t *loc, const Relocation &rel, 431 uint64_t val) const { 432 if (rel.type == R_X86_64_TLSGD) { 433 // Convert 434 // .byte 0x66 435 // leaq x@tlsgd(%rip), %rdi 436 // .word 0x6666 437 // rex64 438 // call __tls_get_addr@plt 439 // to the following two instructions. 440 const uint8_t inst[] = { 441 0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 442 0x00, 0x00, // mov %fs:0x0,%rax 443 0x48, 0x8d, 0x80, 0, 0, 0, 0, // lea x@tpoff,%rax 444 }; 445 memcpy(loc - 4, inst, sizeof(inst)); 446 447 // The original code used a pc relative relocation and so we have to 448 // compensate for the -4 in had in the addend. 449 write32le(loc + 8, val + 4); 450 } else if (rel.type == R_X86_64_GOTPC32_TLSDESC) { 451 // Convert leaq x@tlsdesc(%rip), %REG to movq $x@tpoff, %REG. 452 if ((loc[-3] & 0xfb) != 0x48 || loc[-2] != 0x8d || 453 (loc[-1] & 0xc7) != 0x05) { 454 errorOrWarn(getErrorLocation(loc - 3) + 455 "R_X86_64_GOTPC32_TLSDESC must be used " 456 "in leaq x@tlsdesc(%rip), %REG"); 457 return; 458 } 459 loc[-3] = 0x48 | ((loc[-3] >> 2) & 1); 460 loc[-2] = 0xc7; 461 loc[-1] = 0xc0 | ((loc[-1] >> 3) & 7); 462 write32le(loc, val + 4); 463 } else { 464 // Convert call *x@tlsdesc(%REG) to xchg ax, ax. 465 assert(rel.type == R_X86_64_TLSDESC_CALL); 466 loc[0] = 0x66; 467 loc[1] = 0x90; 468 } 469 } 470 471 void X86_64::relaxTlsGdToIe(uint8_t *loc, const Relocation &rel, 472 uint64_t val) const { 473 if (rel.type == R_X86_64_TLSGD) { 474 // Convert 475 // .byte 0x66 476 // leaq x@tlsgd(%rip), %rdi 477 // .word 0x6666 478 // rex64 479 // call __tls_get_addr@plt 480 // to the following two instructions. 481 const uint8_t inst[] = { 482 0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 483 0x00, 0x00, // mov %fs:0x0,%rax 484 0x48, 0x03, 0x05, 0, 0, 0, 0, // addq x@gottpoff(%rip),%rax 485 }; 486 memcpy(loc - 4, inst, sizeof(inst)); 487 488 // Both code sequences are PC relatives, but since we are moving the 489 // constant forward by 8 bytes we have to subtract the value by 8. 490 write32le(loc + 8, val - 8); 491 } else if (rel.type == R_X86_64_GOTPC32_TLSDESC) { 492 // Convert leaq x@tlsdesc(%rip), %REG to movq x@gottpoff(%rip), %REG. 493 assert(rel.type == R_X86_64_GOTPC32_TLSDESC); 494 if ((loc[-3] & 0xfb) != 0x48 || loc[-2] != 0x8d || 495 (loc[-1] & 0xc7) != 0x05) { 496 errorOrWarn(getErrorLocation(loc - 3) + 497 "R_X86_64_GOTPC32_TLSDESC must be used " 498 "in leaq x@tlsdesc(%rip), %REG"); 499 return; 500 } 501 loc[-2] = 0x8b; 502 write32le(loc, val); 503 } else { 504 // Convert call *x@tlsdesc(%rax) to xchg ax, ax. 505 assert(rel.type == R_X86_64_TLSDESC_CALL); 506 loc[0] = 0x66; 507 loc[1] = 0x90; 508 } 509 } 510 511 // In some conditions, R_X86_64_GOTTPOFF relocation can be optimized to 512 // R_X86_64_TPOFF32 so that it does not use GOT. 513 void X86_64::relaxTlsIeToLe(uint8_t *loc, const Relocation &, 514 uint64_t val) const { 515 uint8_t *inst = loc - 3; 516 uint8_t reg = loc[-1] >> 3; 517 uint8_t *regSlot = loc - 1; 518 519 // Note that ADD with RSP or R12 is converted to ADD instead of LEA 520 // because LEA with these registers needs 4 bytes to encode and thus 521 // wouldn't fit the space. 522 523 if (memcmp(inst, "\x48\x03\x25", 3) == 0) { 524 // "addq foo@gottpoff(%rip),%rsp" -> "addq $foo,%rsp" 525 memcpy(inst, "\x48\x81\xc4", 3); 526 } else if (memcmp(inst, "\x4c\x03\x25", 3) == 0) { 527 // "addq foo@gottpoff(%rip),%r12" -> "addq $foo,%r12" 528 memcpy(inst, "\x49\x81\xc4", 3); 529 } else if (memcmp(inst, "\x4c\x03", 2) == 0) { 530 // "addq foo@gottpoff(%rip),%r[8-15]" -> "leaq foo(%r[8-15]),%r[8-15]" 531 memcpy(inst, "\x4d\x8d", 2); 532 *regSlot = 0x80 | (reg << 3) | reg; 533 } else if (memcmp(inst, "\x48\x03", 2) == 0) { 534 // "addq foo@gottpoff(%rip),%reg -> "leaq foo(%reg),%reg" 535 memcpy(inst, "\x48\x8d", 2); 536 *regSlot = 0x80 | (reg << 3) | reg; 537 } else if (memcmp(inst, "\x4c\x8b", 2) == 0) { 538 // "movq foo@gottpoff(%rip),%r[8-15]" -> "movq $foo,%r[8-15]" 539 memcpy(inst, "\x49\xc7", 2); 540 *regSlot = 0xc0 | reg; 541 } else if (memcmp(inst, "\x48\x8b", 2) == 0) { 542 // "movq foo@gottpoff(%rip),%reg" -> "movq $foo,%reg" 543 memcpy(inst, "\x48\xc7", 2); 544 *regSlot = 0xc0 | reg; 545 } else { 546 error(getErrorLocation(loc - 3) + 547 "R_X86_64_GOTTPOFF must be used in MOVQ or ADDQ instructions only"); 548 } 549 550 // The original code used a PC relative relocation. 551 // Need to compensate for the -4 it had in the addend. 552 write32le(loc, val + 4); 553 } 554 555 void X86_64::relaxTlsLdToLe(uint8_t *loc, const Relocation &rel, 556 uint64_t val) const { 557 if (rel.type == R_X86_64_DTPOFF64) { 558 write64le(loc, val); 559 return; 560 } 561 if (rel.type == R_X86_64_DTPOFF32) { 562 write32le(loc, val); 563 return; 564 } 565 566 const uint8_t inst[] = { 567 0x66, 0x66, // .word 0x6666 568 0x66, // .byte 0x66 569 0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 0x00, 0x00, // mov %fs:0,%rax 570 }; 571 572 if (loc[4] == 0xe8) { 573 // Convert 574 // leaq bar@tlsld(%rip), %rdi # 48 8d 3d <Loc> 575 // callq __tls_get_addr@PLT # e8 <disp32> 576 // leaq bar@dtpoff(%rax), %rcx 577 // to 578 // .word 0x6666 579 // .byte 0x66 580 // mov %fs:0,%rax 581 // leaq bar@tpoff(%rax), %rcx 582 memcpy(loc - 3, inst, sizeof(inst)); 583 return; 584 } 585 586 if (loc[4] == 0xff && loc[5] == 0x15) { 587 // Convert 588 // leaq x@tlsld(%rip),%rdi # 48 8d 3d <Loc> 589 // call *__tls_get_addr@GOTPCREL(%rip) # ff 15 <disp32> 590 // to 591 // .long 0x66666666 592 // movq %fs:0,%rax 593 // See "Table 11.9: LD -> LE Code Transition (LP64)" in 594 // https://raw.githubusercontent.com/wiki/hjl-tools/x86-psABI/x86-64-psABI-1.0.pdf 595 loc[-3] = 0x66; 596 memcpy(loc - 2, inst, sizeof(inst)); 597 return; 598 } 599 600 error(getErrorLocation(loc - 3) + 601 "expected R_X86_64_PLT32 or R_X86_64_GOTPCRELX after R_X86_64_TLSLD"); 602 } 603 604 // A JumpInstrMod at a specific offset indicates that the jump instruction 605 // opcode at that offset must be modified. This is specifically used to relax 606 // jump instructions with basic block sections. This function looks at the 607 // JumpMod and effects the change. 608 void X86_64::applyJumpInstrMod(uint8_t *loc, JumpModType type, 609 unsigned size) const { 610 switch (type) { 611 case J_JMP_32: 612 if (size == 4) 613 *loc = 0xe9; 614 else 615 *loc = 0xeb; 616 break; 617 case J_JE_32: 618 if (size == 4) { 619 loc[-1] = 0x0f; 620 *loc = 0x84; 621 } else 622 *loc = 0x74; 623 break; 624 case J_JNE_32: 625 if (size == 4) { 626 loc[-1] = 0x0f; 627 *loc = 0x85; 628 } else 629 *loc = 0x75; 630 break; 631 case J_JG_32: 632 if (size == 4) { 633 loc[-1] = 0x0f; 634 *loc = 0x8f; 635 } else 636 *loc = 0x7f; 637 break; 638 case J_JGE_32: 639 if (size == 4) { 640 loc[-1] = 0x0f; 641 *loc = 0x8d; 642 } else 643 *loc = 0x7d; 644 break; 645 case J_JB_32: 646 if (size == 4) { 647 loc[-1] = 0x0f; 648 *loc = 0x82; 649 } else 650 *loc = 0x72; 651 break; 652 case J_JBE_32: 653 if (size == 4) { 654 loc[-1] = 0x0f; 655 *loc = 0x86; 656 } else 657 *loc = 0x76; 658 break; 659 case J_JL_32: 660 if (size == 4) { 661 loc[-1] = 0x0f; 662 *loc = 0x8c; 663 } else 664 *loc = 0x7c; 665 break; 666 case J_JLE_32: 667 if (size == 4) { 668 loc[-1] = 0x0f; 669 *loc = 0x8e; 670 } else 671 *loc = 0x7e; 672 break; 673 case J_JA_32: 674 if (size == 4) { 675 loc[-1] = 0x0f; 676 *loc = 0x87; 677 } else 678 *loc = 0x77; 679 break; 680 case J_JAE_32: 681 if (size == 4) { 682 loc[-1] = 0x0f; 683 *loc = 0x83; 684 } else 685 *loc = 0x73; 686 break; 687 case J_UNKNOWN: 688 llvm_unreachable("Unknown Jump Relocation"); 689 } 690 } 691 692 int64_t X86_64::getImplicitAddend(const uint8_t *buf, RelType type) const { 693 switch (type) { 694 case R_X86_64_8: 695 case R_X86_64_PC8: 696 return SignExtend64<8>(*buf); 697 case R_X86_64_16: 698 case R_X86_64_PC16: 699 return SignExtend64<16>(read16le(buf)); 700 case R_X86_64_32: 701 case R_X86_64_32S: 702 case R_X86_64_TPOFF32: 703 case R_X86_64_GOT32: 704 case R_X86_64_GOTPC32: 705 case R_X86_64_GOTPC32_TLSDESC: 706 case R_X86_64_GOTPCREL: 707 case R_X86_64_GOTPCRELX: 708 case R_X86_64_REX_GOTPCRELX: 709 case R_X86_64_PC32: 710 case R_X86_64_GOTTPOFF: 711 case R_X86_64_PLT32: 712 case R_X86_64_TLSGD: 713 case R_X86_64_TLSLD: 714 case R_X86_64_DTPOFF32: 715 case R_X86_64_SIZE32: 716 return SignExtend64<32>(read32le(buf)); 717 case R_X86_64_64: 718 case R_X86_64_TPOFF64: 719 case R_X86_64_DTPOFF64: 720 case R_X86_64_DTPMOD64: 721 case R_X86_64_PC64: 722 case R_X86_64_SIZE64: 723 case R_X86_64_GLOB_DAT: 724 case R_X86_64_GOT64: 725 case R_X86_64_GOTOFF64: 726 case R_X86_64_GOTPC64: 727 case R_X86_64_PLTOFF64: 728 case R_X86_64_IRELATIVE: 729 case R_X86_64_RELATIVE: 730 return read64le(buf); 731 case R_X86_64_TLSDESC: 732 return read64le(buf + 8); 733 case R_X86_64_JUMP_SLOT: 734 case R_X86_64_NONE: 735 // These relocations are defined as not having an implicit addend. 736 return 0; 737 default: 738 internalLinkerError(getErrorLocation(buf), 739 "cannot read addend for relocation " + toString(type)); 740 return 0; 741 } 742 } 743 744 void X86_64::relocate(uint8_t *loc, const Relocation &rel, uint64_t val) const { 745 switch (rel.type) { 746 case R_X86_64_8: 747 checkIntUInt(loc, val, 8, rel); 748 *loc = val; 749 break; 750 case R_X86_64_PC8: 751 checkInt(loc, val, 8, rel); 752 *loc = val; 753 break; 754 case R_X86_64_16: 755 checkIntUInt(loc, val, 16, rel); 756 write16le(loc, val); 757 break; 758 case R_X86_64_PC16: 759 checkInt(loc, val, 16, rel); 760 write16le(loc, val); 761 break; 762 case R_X86_64_32: 763 checkUInt(loc, val, 32, rel); 764 write32le(loc, val); 765 break; 766 case R_X86_64_32S: 767 case R_X86_64_TPOFF32: 768 case R_X86_64_GOT32: 769 case R_X86_64_GOTPC32: 770 case R_X86_64_GOTPC32_TLSDESC: 771 case R_X86_64_GOTPCREL: 772 case R_X86_64_GOTPCRELX: 773 case R_X86_64_REX_GOTPCRELX: 774 case R_X86_64_PC32: 775 case R_X86_64_GOTTPOFF: 776 case R_X86_64_PLT32: 777 case R_X86_64_TLSGD: 778 case R_X86_64_TLSLD: 779 case R_X86_64_DTPOFF32: 780 case R_X86_64_SIZE32: 781 checkInt(loc, val, 32, rel); 782 write32le(loc, val); 783 break; 784 case R_X86_64_64: 785 case R_X86_64_DTPOFF64: 786 case R_X86_64_PC64: 787 case R_X86_64_SIZE64: 788 case R_X86_64_GOT64: 789 case R_X86_64_GOTOFF64: 790 case R_X86_64_GOTPC64: 791 case R_X86_64_PLTOFF64: 792 write64le(loc, val); 793 break; 794 case R_X86_64_TLSDESC: 795 // The addend is stored in the second 64-bit word. 796 write64le(loc + 8, val); 797 break; 798 default: 799 llvm_unreachable("unknown relocation"); 800 } 801 } 802 803 RelExpr X86_64::adjustGotPcExpr(RelType type, int64_t addend, 804 const uint8_t *loc) const { 805 // Only R_X86_64_[REX_]GOTPCRELX can be relaxed. GNU as may emit GOTPCRELX 806 // with addend != -4. Such an instruction does not load the full GOT entry, so 807 // we cannot relax the relocation. E.g. movl x@GOTPCREL+4(%rip), %rax 808 // (addend=0) loads the high 32 bits of the GOT entry. 809 if (!config->relax || addend != -4 || 810 (type != R_X86_64_GOTPCRELX && type != R_X86_64_REX_GOTPCRELX)) 811 return R_GOT_PC; 812 const uint8_t op = loc[-2]; 813 const uint8_t modRm = loc[-1]; 814 815 // FIXME: When PIC is disabled and foo is defined locally in the 816 // lower 32 bit address space, memory operand in mov can be converted into 817 // immediate operand. Otherwise, mov must be changed to lea. We support only 818 // latter relaxation at this moment. 819 if (op == 0x8b) 820 return R_RELAX_GOT_PC; 821 822 // Relax call and jmp. 823 if (op == 0xff && (modRm == 0x15 || modRm == 0x25)) 824 return R_RELAX_GOT_PC; 825 826 // We don't support test/binop instructions without a REX prefix. 827 if (type == R_X86_64_GOTPCRELX) 828 return R_GOT_PC; 829 830 // Relaxation of test, adc, add, and, cmp, or, sbb, sub, xor. 831 // If PIC then no relaxation is available. 832 return config->isPic ? R_GOT_PC : R_RELAX_GOT_PC_NOPIC; 833 } 834 835 // A subset of relaxations can only be applied for no-PIC. This method 836 // handles such relaxations. Instructions encoding information was taken from: 837 // "Intel 64 and IA-32 Architectures Software Developer's Manual V2" 838 // (http://www.intel.com/content/dam/www/public/us/en/documents/manuals/ 839 // 64-ia-32-architectures-software-developer-instruction-set-reference-manual-325383.pdf) 840 static void relaxGotNoPic(uint8_t *loc, uint64_t val, uint8_t op, 841 uint8_t modRm) { 842 const uint8_t rex = loc[-3]; 843 // Convert "test %reg, foo@GOTPCREL(%rip)" to "test $foo, %reg". 844 if (op == 0x85) { 845 // See "TEST-Logical Compare" (4-428 Vol. 2B), 846 // TEST r/m64, r64 uses "full" ModR / M byte (no opcode extension). 847 848 // ModR/M byte has form XX YYY ZZZ, where 849 // YYY is MODRM.reg(register 2), ZZZ is MODRM.rm(register 1). 850 // XX has different meanings: 851 // 00: The operand's memory address is in reg1. 852 // 01: The operand's memory address is reg1 + a byte-sized displacement. 853 // 10: The operand's memory address is reg1 + a word-sized displacement. 854 // 11: The operand is reg1 itself. 855 // If an instruction requires only one operand, the unused reg2 field 856 // holds extra opcode bits rather than a register code 857 // 0xC0 == 11 000 000 binary. 858 // 0x38 == 00 111 000 binary. 859 // We transfer reg2 to reg1 here as operand. 860 // See "2.1.3 ModR/M and SIB Bytes" (Vol. 2A 2-3). 861 loc[-1] = 0xc0 | (modRm & 0x38) >> 3; // ModR/M byte. 862 863 // Change opcode from TEST r/m64, r64 to TEST r/m64, imm32 864 // See "TEST-Logical Compare" (4-428 Vol. 2B). 865 loc[-2] = 0xf7; 866 867 // Move R bit to the B bit in REX byte. 868 // REX byte is encoded as 0100WRXB, where 869 // 0100 is 4bit fixed pattern. 870 // REX.W When 1, a 64-bit operand size is used. Otherwise, when 0, the 871 // default operand size is used (which is 32-bit for most but not all 872 // instructions). 873 // REX.R This 1-bit value is an extension to the MODRM.reg field. 874 // REX.X This 1-bit value is an extension to the SIB.index field. 875 // REX.B This 1-bit value is an extension to the MODRM.rm field or the 876 // SIB.base field. 877 // See "2.2.1.2 More on REX Prefix Fields " (2-8 Vol. 2A). 878 loc[-3] = (rex & ~0x4) | (rex & 0x4) >> 2; 879 write32le(loc, val); 880 return; 881 } 882 883 // If we are here then we need to relax the adc, add, and, cmp, or, sbb, sub 884 // or xor operations. 885 886 // Convert "binop foo@GOTPCREL(%rip), %reg" to "binop $foo, %reg". 887 // Logic is close to one for test instruction above, but we also 888 // write opcode extension here, see below for details. 889 loc[-1] = 0xc0 | (modRm & 0x38) >> 3 | (op & 0x3c); // ModR/M byte. 890 891 // Primary opcode is 0x81, opcode extension is one of: 892 // 000b = ADD, 001b is OR, 010b is ADC, 011b is SBB, 893 // 100b is AND, 101b is SUB, 110b is XOR, 111b is CMP. 894 // This value was wrote to MODRM.reg in a line above. 895 // See "3.2 INSTRUCTIONS (A-M)" (Vol. 2A 3-15), 896 // "INSTRUCTION SET REFERENCE, N-Z" (Vol. 2B 4-1) for 897 // descriptions about each operation. 898 loc[-2] = 0x81; 899 loc[-3] = (rex & ~0x4) | (rex & 0x4) >> 2; 900 write32le(loc, val); 901 } 902 903 void X86_64::relaxGot(uint8_t *loc, const Relocation &rel, uint64_t val) const { 904 checkInt(loc, val, 32, rel); 905 const uint8_t op = loc[-2]; 906 const uint8_t modRm = loc[-1]; 907 908 // Convert "mov foo@GOTPCREL(%rip),%reg" to "lea foo(%rip),%reg". 909 if (op == 0x8b) { 910 loc[-2] = 0x8d; 911 write32le(loc, val); 912 return; 913 } 914 915 if (op != 0xff) { 916 // We are relaxing a rip relative to an absolute, so compensate 917 // for the old -4 addend. 918 assert(!config->isPic); 919 relaxGotNoPic(loc, val + 4, op, modRm); 920 return; 921 } 922 923 // Convert call/jmp instructions. 924 if (modRm == 0x15) { 925 // ABI says we can convert "call *foo@GOTPCREL(%rip)" to "nop; call foo". 926 // Instead we convert to "addr32 call foo" where addr32 is an instruction 927 // prefix. That makes result expression to be a single instruction. 928 loc[-2] = 0x67; // addr32 prefix 929 loc[-1] = 0xe8; // call 930 write32le(loc, val); 931 return; 932 } 933 934 // Convert "jmp *foo@GOTPCREL(%rip)" to "jmp foo; nop". 935 // jmp doesn't return, so it is fine to use nop here, it is just a stub. 936 assert(modRm == 0x25); 937 loc[-2] = 0xe9; // jmp 938 loc[3] = 0x90; // nop 939 write32le(loc - 1, val + 1); 940 } 941 942 // A split-stack prologue starts by checking the amount of stack remaining 943 // in one of two ways: 944 // A) Comparing of the stack pointer to a field in the tcb. 945 // B) Or a load of a stack pointer offset with an lea to r10 or r11. 946 bool X86_64::adjustPrologueForCrossSplitStack(uint8_t *loc, uint8_t *end, 947 uint8_t stOther) const { 948 if (!config->is64) { 949 error("target doesn't support split stacks"); 950 return false; 951 } 952 953 if (loc + 8 >= end) 954 return false; 955 956 // Replace "cmp %fs:0x70,%rsp" and subsequent branch 957 // with "stc, nopl 0x0(%rax,%rax,1)" 958 if (memcmp(loc, "\x64\x48\x3b\x24\x25", 5) == 0) { 959 memcpy(loc, "\xf9\x0f\x1f\x84\x00\x00\x00\x00", 8); 960 return true; 961 } 962 963 // Adjust "lea X(%rsp),%rYY" to lea "(X - 0x4000)(%rsp),%rYY" where rYY could 964 // be r10 or r11. The lea instruction feeds a subsequent compare which checks 965 // if there is X available stack space. Making X larger effectively reserves 966 // that much additional space. The stack grows downward so subtract the value. 967 if (memcmp(loc, "\x4c\x8d\x94\x24", 4) == 0 || 968 memcmp(loc, "\x4c\x8d\x9c\x24", 4) == 0) { 969 // The offset bytes are encoded four bytes after the start of the 970 // instruction. 971 write32le(loc + 4, read32le(loc + 4) - 0x4000); 972 return true; 973 } 974 return false; 975 } 976 977 // If Intel Indirect Branch Tracking is enabled, we have to emit special PLT 978 // entries containing endbr64 instructions. A PLT entry will be split into two 979 // parts, one in .plt.sec (writePlt), and the other in .plt (writeIBTPlt). 980 namespace { 981 class IntelIBT : public X86_64 { 982 public: 983 IntelIBT(); 984 void writeGotPlt(uint8_t *buf, const Symbol &s) const override; 985 void writePlt(uint8_t *buf, const Symbol &sym, 986 uint64_t pltEntryAddr) const override; 987 void writeIBTPlt(uint8_t *buf, size_t numEntries) const override; 988 989 static const unsigned IBTPltHeaderSize = 16; 990 }; 991 } // namespace 992 993 IntelIBT::IntelIBT() { pltHeaderSize = 0; } 994 995 void IntelIBT::writeGotPlt(uint8_t *buf, const Symbol &s) const { 996 uint64_t va = 997 in.ibtPlt->getVA() + IBTPltHeaderSize + s.getPltIdx() * pltEntrySize; 998 write64le(buf, va); 999 } 1000 1001 void IntelIBT::writePlt(uint8_t *buf, const Symbol &sym, 1002 uint64_t pltEntryAddr) const { 1003 const uint8_t Inst[] = { 1004 0xf3, 0x0f, 0x1e, 0xfa, // endbr64 1005 0xff, 0x25, 0, 0, 0, 0, // jmpq *got(%rip) 1006 0x66, 0x0f, 0x1f, 0x44, 0, 0, // nop 1007 }; 1008 memcpy(buf, Inst, sizeof(Inst)); 1009 write32le(buf + 6, sym.getGotPltVA() - pltEntryAddr - 10); 1010 } 1011 1012 void IntelIBT::writeIBTPlt(uint8_t *buf, size_t numEntries) const { 1013 writePltHeader(buf); 1014 buf += IBTPltHeaderSize; 1015 1016 const uint8_t inst[] = { 1017 0xf3, 0x0f, 0x1e, 0xfa, // endbr64 1018 0x68, 0, 0, 0, 0, // pushq <relocation index> 1019 0xe9, 0, 0, 0, 0, // jmpq plt[0] 1020 0x66, 0x90, // nop 1021 }; 1022 1023 for (size_t i = 0; i < numEntries; ++i) { 1024 memcpy(buf, inst, sizeof(inst)); 1025 write32le(buf + 5, i); 1026 write32le(buf + 10, -pltHeaderSize - sizeof(inst) * i - 30); 1027 buf += sizeof(inst); 1028 } 1029 } 1030 1031 // These nonstandard PLT entries are to migtigate Spectre v2 security 1032 // vulnerability. In order to mitigate Spectre v2, we want to avoid indirect 1033 // branch instructions such as `jmp *GOTPLT(%rip)`. So, in the following PLT 1034 // entries, we use a CALL followed by MOV and RET to do the same thing as an 1035 // indirect jump. That instruction sequence is so-called "retpoline". 1036 // 1037 // We have two types of retpoline PLTs as a size optimization. If `-z now` 1038 // is specified, all dynamic symbols are resolved at load-time. Thus, when 1039 // that option is given, we can omit code for symbol lazy resolution. 1040 namespace { 1041 class Retpoline : public X86_64 { 1042 public: 1043 Retpoline(); 1044 void writeGotPlt(uint8_t *buf, const Symbol &s) const override; 1045 void writePltHeader(uint8_t *buf) const override; 1046 void writePlt(uint8_t *buf, const Symbol &sym, 1047 uint64_t pltEntryAddr) const override; 1048 }; 1049 1050 class RetpolineZNow : public X86_64 { 1051 public: 1052 RetpolineZNow(); 1053 void writeGotPlt(uint8_t *buf, const Symbol &s) const override {} 1054 void writePltHeader(uint8_t *buf) const override; 1055 void writePlt(uint8_t *buf, const Symbol &sym, 1056 uint64_t pltEntryAddr) const override; 1057 }; 1058 } // namespace 1059 1060 Retpoline::Retpoline() { 1061 pltHeaderSize = 48; 1062 pltEntrySize = 32; 1063 ipltEntrySize = 32; 1064 } 1065 1066 void Retpoline::writeGotPlt(uint8_t *buf, const Symbol &s) const { 1067 write64le(buf, s.getPltVA() + 17); 1068 } 1069 1070 void Retpoline::writePltHeader(uint8_t *buf) const { 1071 const uint8_t insn[] = { 1072 0xff, 0x35, 0, 0, 0, 0, // 0: pushq GOTPLT+8(%rip) 1073 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // 6: mov GOTPLT+16(%rip), %r11 1074 0xe8, 0x0e, 0x00, 0x00, 0x00, // d: callq next 1075 0xf3, 0x90, // 12: loop: pause 1076 0x0f, 0xae, 0xe8, // 14: lfence 1077 0xeb, 0xf9, // 17: jmp loop 1078 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 19: int3; .align 16 1079 0x4c, 0x89, 0x1c, 0x24, // 20: next: mov %r11, (%rsp) 1080 0xc3, // 24: ret 1081 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 25: int3; padding 1082 0xcc, 0xcc, 0xcc, 0xcc, // 2c: int3; padding 1083 }; 1084 memcpy(buf, insn, sizeof(insn)); 1085 1086 uint64_t gotPlt = in.gotPlt->getVA(); 1087 uint64_t plt = in.plt->getVA(); 1088 write32le(buf + 2, gotPlt - plt - 6 + 8); 1089 write32le(buf + 9, gotPlt - plt - 13 + 16); 1090 } 1091 1092 void Retpoline::writePlt(uint8_t *buf, const Symbol &sym, 1093 uint64_t pltEntryAddr) const { 1094 const uint8_t insn[] = { 1095 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // 0: mov foo@GOTPLT(%rip), %r11 1096 0xe8, 0, 0, 0, 0, // 7: callq plt+0x20 1097 0xe9, 0, 0, 0, 0, // c: jmp plt+0x12 1098 0x68, 0, 0, 0, 0, // 11: pushq <relocation index> 1099 0xe9, 0, 0, 0, 0, // 16: jmp plt+0 1100 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1b: int3; padding 1101 }; 1102 memcpy(buf, insn, sizeof(insn)); 1103 1104 uint64_t off = pltEntryAddr - in.plt->getVA(); 1105 1106 write32le(buf + 3, sym.getGotPltVA() - pltEntryAddr - 7); 1107 write32le(buf + 8, -off - 12 + 32); 1108 write32le(buf + 13, -off - 17 + 18); 1109 write32le(buf + 18, sym.getPltIdx()); 1110 write32le(buf + 23, -off - 27); 1111 } 1112 1113 RetpolineZNow::RetpolineZNow() { 1114 pltHeaderSize = 32; 1115 pltEntrySize = 16; 1116 ipltEntrySize = 16; 1117 } 1118 1119 void RetpolineZNow::writePltHeader(uint8_t *buf) const { 1120 const uint8_t insn[] = { 1121 0xe8, 0x0b, 0x00, 0x00, 0x00, // 0: call next 1122 0xf3, 0x90, // 5: loop: pause 1123 0x0f, 0xae, 0xe8, // 7: lfence 1124 0xeb, 0xf9, // a: jmp loop 1125 0xcc, 0xcc, 0xcc, 0xcc, // c: int3; .align 16 1126 0x4c, 0x89, 0x1c, 0x24, // 10: next: mov %r11, (%rsp) 1127 0xc3, // 14: ret 1128 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 15: int3; padding 1129 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1a: int3; padding 1130 0xcc, // 1f: int3; padding 1131 }; 1132 memcpy(buf, insn, sizeof(insn)); 1133 } 1134 1135 void RetpolineZNow::writePlt(uint8_t *buf, const Symbol &sym, 1136 uint64_t pltEntryAddr) const { 1137 const uint8_t insn[] = { 1138 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // mov foo@GOTPLT(%rip), %r11 1139 0xe9, 0, 0, 0, 0, // jmp plt+0 1140 0xcc, 0xcc, 0xcc, 0xcc, // int3; padding 1141 }; 1142 memcpy(buf, insn, sizeof(insn)); 1143 1144 write32le(buf + 3, sym.getGotPltVA() - pltEntryAddr - 7); 1145 write32le(buf + 8, in.plt->getVA() - pltEntryAddr - 12); 1146 } 1147 1148 static TargetInfo *getTargetInfo() { 1149 if (config->zRetpolineplt) { 1150 if (config->zNow) { 1151 static RetpolineZNow t; 1152 return &t; 1153 } 1154 static Retpoline t; 1155 return &t; 1156 } 1157 1158 if (config->andFeatures & GNU_PROPERTY_X86_FEATURE_1_IBT) { 1159 static IntelIBT t; 1160 return &t; 1161 } 1162 1163 static X86_64 t; 1164 return &t; 1165 } 1166 1167 TargetInfo *elf::getX86_64TargetInfo() { return getTargetInfo(); } 1168