1 //===- X86_64.cpp ---------------------------------------------------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 9 #include "InputFiles.h" 10 #include "OutputSections.h" 11 #include "Symbols.h" 12 #include "SyntheticSections.h" 13 #include "Target.h" 14 #include "lld/Common/ErrorHandler.h" 15 #include "llvm/Object/ELF.h" 16 #include "llvm/Support/Endian.h" 17 18 using namespace llvm; 19 using namespace llvm::object; 20 using namespace llvm::support::endian; 21 using namespace llvm::ELF; 22 using namespace lld; 23 using namespace lld::elf; 24 25 namespace { 26 class X86_64 : public TargetInfo { 27 public: 28 X86_64(); 29 int getTlsGdRelaxSkip(RelType type) const override; 30 RelExpr getRelExpr(RelType type, const Symbol &s, 31 const uint8_t *loc) const override; 32 RelType getDynRel(RelType type) const override; 33 void writeGotPltHeader(uint8_t *buf) const override; 34 void writeGotPlt(uint8_t *buf, const Symbol &s) const override; 35 void writeIgotPlt(uint8_t *buf, const Symbol &s) const override; 36 void writePltHeader(uint8_t *buf) const override; 37 void writePlt(uint8_t *buf, const Symbol &sym, 38 uint64_t pltEntryAddr) const override; 39 void relocate(uint8_t *loc, const Relocation &rel, 40 uint64_t val) const override; 41 int64_t getImplicitAddend(const uint8_t *buf, RelType type) const override; 42 void applyJumpInstrMod(uint8_t *loc, JumpModType type, 43 unsigned size) const override; 44 45 RelExpr adjustGotPcExpr(RelType type, int64_t addend, 46 const uint8_t *loc) const override; 47 void relaxGot(uint8_t *loc, const Relocation &rel, 48 uint64_t val) const override; 49 void relaxTlsGdToIe(uint8_t *loc, const Relocation &rel, 50 uint64_t val) const override; 51 void relaxTlsGdToLe(uint8_t *loc, const Relocation &rel, 52 uint64_t val) const override; 53 void relaxTlsIeToLe(uint8_t *loc, const Relocation &rel, 54 uint64_t val) const override; 55 void relaxTlsLdToLe(uint8_t *loc, const Relocation &rel, 56 uint64_t val) const override; 57 bool adjustPrologueForCrossSplitStack(uint8_t *loc, uint8_t *end, 58 uint8_t stOther) const override; 59 bool deleteFallThruJmpInsn(InputSection &is, InputFile *file, 60 InputSection *nextIS) const override; 61 }; 62 } // namespace 63 64 // This is vector of NOP instructions of sizes from 1 to 8 bytes. The 65 // appropriately sized instructions are used to fill the gaps between sections 66 // which are executed during fall through. 67 static const std::vector<std::vector<uint8_t>> nopInstructions = { 68 {0x90}, 69 {0x66, 0x90}, 70 {0x0f, 0x1f, 0x00}, 71 {0x0f, 0x1f, 0x40, 0x00}, 72 {0x0f, 0x1f, 0x44, 0x00, 0x00}, 73 {0x66, 0x0f, 0x1f, 0x44, 0x00, 0x00}, 74 {0x0F, 0x1F, 0x80, 0x00, 0x00, 0x00, 0x00}, 75 {0x0F, 0x1F, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00}, 76 {0x66, 0x0F, 0x1F, 0x84, 0x00, 0x00, 0x00, 0x00, 0x00}}; 77 78 X86_64::X86_64() { 79 copyRel = R_X86_64_COPY; 80 gotRel = R_X86_64_GLOB_DAT; 81 pltRel = R_X86_64_JUMP_SLOT; 82 relativeRel = R_X86_64_RELATIVE; 83 iRelativeRel = R_X86_64_IRELATIVE; 84 symbolicRel = R_X86_64_64; 85 tlsDescRel = R_X86_64_TLSDESC; 86 tlsGotRel = R_X86_64_TPOFF64; 87 tlsModuleIndexRel = R_X86_64_DTPMOD64; 88 tlsOffsetRel = R_X86_64_DTPOFF64; 89 gotBaseSymInGotPlt = true; 90 gotEntrySize = 8; 91 pltHeaderSize = 16; 92 pltEntrySize = 16; 93 ipltEntrySize = 16; 94 trapInstr = {0xcc, 0xcc, 0xcc, 0xcc}; // 0xcc = INT3 95 nopInstrs = nopInstructions; 96 97 // Align to the large page size (known as a superpage or huge page). 98 // FreeBSD automatically promotes large, superpage-aligned allocations. 99 defaultImageBase = 0x200000; 100 } 101 102 int X86_64::getTlsGdRelaxSkip(RelType type) const { 103 // TLSDESC relocations are processed separately. See relaxTlsGdToLe below. 104 return type == R_X86_64_GOTPC32_TLSDESC || type == R_X86_64_TLSDESC_CALL ? 1 105 : 2; 106 } 107 108 // Opcodes for the different X86_64 jmp instructions. 109 enum JmpInsnOpcode : uint32_t { 110 J_JMP_32, 111 J_JNE_32, 112 J_JE_32, 113 J_JG_32, 114 J_JGE_32, 115 J_JB_32, 116 J_JBE_32, 117 J_JL_32, 118 J_JLE_32, 119 J_JA_32, 120 J_JAE_32, 121 J_UNKNOWN, 122 }; 123 124 // Given the first (optional) and second byte of the insn's opcode, this 125 // returns the corresponding enum value. 126 static JmpInsnOpcode getJmpInsnType(const uint8_t *first, 127 const uint8_t *second) { 128 if (*second == 0xe9) 129 return J_JMP_32; 130 131 if (first == nullptr) 132 return J_UNKNOWN; 133 134 if (*first == 0x0f) { 135 switch (*second) { 136 case 0x84: 137 return J_JE_32; 138 case 0x85: 139 return J_JNE_32; 140 case 0x8f: 141 return J_JG_32; 142 case 0x8d: 143 return J_JGE_32; 144 case 0x82: 145 return J_JB_32; 146 case 0x86: 147 return J_JBE_32; 148 case 0x8c: 149 return J_JL_32; 150 case 0x8e: 151 return J_JLE_32; 152 case 0x87: 153 return J_JA_32; 154 case 0x83: 155 return J_JAE_32; 156 } 157 } 158 return J_UNKNOWN; 159 } 160 161 // Return the relocation index for input section IS with a specific Offset. 162 // Returns the maximum size of the vector if no such relocation is found. 163 static unsigned getRelocationWithOffset(const InputSection &is, 164 uint64_t offset) { 165 unsigned size = is.relocations.size(); 166 for (unsigned i = size - 1; i + 1 > 0; --i) { 167 if (is.relocations[i].offset == offset && is.relocations[i].expr != R_NONE) 168 return i; 169 } 170 return size; 171 } 172 173 // Returns true if R corresponds to a relocation used for a jump instruction. 174 // TODO: Once special relocations for relaxable jump instructions are available, 175 // this should be modified to use those relocations. 176 static bool isRelocationForJmpInsn(Relocation &R) { 177 return R.type == R_X86_64_PLT32 || R.type == R_X86_64_PC32 || 178 R.type == R_X86_64_PC8; 179 } 180 181 // Return true if Relocation R points to the first instruction in the 182 // next section. 183 // TODO: Delete this once psABI reserves a new relocation type for fall thru 184 // jumps. 185 static bool isFallThruRelocation(InputSection &is, InputFile *file, 186 InputSection *nextIS, Relocation &r) { 187 if (!isRelocationForJmpInsn(r)) 188 return false; 189 190 uint64_t addrLoc = is.getOutputSection()->addr + is.outSecOff + r.offset; 191 uint64_t targetOffset = InputSectionBase::getRelocTargetVA( 192 file, r.type, r.addend, addrLoc, *r.sym, r.expr); 193 194 // If this jmp is a fall thru, the target offset is the beginning of the 195 // next section. 196 uint64_t nextSectionOffset = 197 nextIS->getOutputSection()->addr + nextIS->outSecOff; 198 return (addrLoc + 4 + targetOffset) == nextSectionOffset; 199 } 200 201 // Return the jmp instruction opcode that is the inverse of the given 202 // opcode. For example, JE inverted is JNE. 203 static JmpInsnOpcode invertJmpOpcode(const JmpInsnOpcode opcode) { 204 switch (opcode) { 205 case J_JE_32: 206 return J_JNE_32; 207 case J_JNE_32: 208 return J_JE_32; 209 case J_JG_32: 210 return J_JLE_32; 211 case J_JGE_32: 212 return J_JL_32; 213 case J_JB_32: 214 return J_JAE_32; 215 case J_JBE_32: 216 return J_JA_32; 217 case J_JL_32: 218 return J_JGE_32; 219 case J_JLE_32: 220 return J_JG_32; 221 case J_JA_32: 222 return J_JBE_32; 223 case J_JAE_32: 224 return J_JB_32; 225 default: 226 return J_UNKNOWN; 227 } 228 } 229 230 // Deletes direct jump instruction in input sections that jumps to the 231 // following section as it is not required. If there are two consecutive jump 232 // instructions, it checks if they can be flipped and one can be deleted. 233 // For example: 234 // .section .text 235 // a.BB.foo: 236 // ... 237 // 10: jne aa.BB.foo 238 // 16: jmp bar 239 // aa.BB.foo: 240 // ... 241 // 242 // can be converted to: 243 // a.BB.foo: 244 // ... 245 // 10: je bar #jne flipped to je and the jmp is deleted. 246 // aa.BB.foo: 247 // ... 248 bool X86_64::deleteFallThruJmpInsn(InputSection &is, InputFile *file, 249 InputSection *nextIS) const { 250 const unsigned sizeOfDirectJmpInsn = 5; 251 252 if (nextIS == nullptr) 253 return false; 254 255 if (is.getSize() < sizeOfDirectJmpInsn) 256 return false; 257 258 // If this jmp insn can be removed, it is the last insn and the 259 // relocation is 4 bytes before the end. 260 unsigned rIndex = getRelocationWithOffset(is, is.getSize() - 4); 261 if (rIndex == is.relocations.size()) 262 return false; 263 264 Relocation &r = is.relocations[rIndex]; 265 266 // Check if the relocation corresponds to a direct jmp. 267 const uint8_t *secContents = is.data().data(); 268 // If it is not a direct jmp instruction, there is nothing to do here. 269 if (*(secContents + r.offset - 1) != 0xe9) 270 return false; 271 272 if (isFallThruRelocation(is, file, nextIS, r)) { 273 // This is a fall thru and can be deleted. 274 r.expr = R_NONE; 275 r.offset = 0; 276 is.drop_back(sizeOfDirectJmpInsn); 277 is.nopFiller = true; 278 return true; 279 } 280 281 // Now, check if flip and delete is possible. 282 const unsigned sizeOfJmpCCInsn = 6; 283 // To flip, there must be atleast one JmpCC and one direct jmp. 284 if (is.getSize() < sizeOfDirectJmpInsn + sizeOfJmpCCInsn) 285 return false; 286 287 unsigned rbIndex = 288 getRelocationWithOffset(is, (is.getSize() - sizeOfDirectJmpInsn - 4)); 289 if (rbIndex == is.relocations.size()) 290 return false; 291 292 Relocation &rB = is.relocations[rbIndex]; 293 294 const uint8_t *jmpInsnB = secContents + rB.offset - 1; 295 JmpInsnOpcode jmpOpcodeB = getJmpInsnType(jmpInsnB - 1, jmpInsnB); 296 if (jmpOpcodeB == J_UNKNOWN) 297 return false; 298 299 if (!isFallThruRelocation(is, file, nextIS, rB)) 300 return false; 301 302 // jmpCC jumps to the fall thru block, the branch can be flipped and the 303 // jmp can be deleted. 304 JmpInsnOpcode jInvert = invertJmpOpcode(jmpOpcodeB); 305 if (jInvert == J_UNKNOWN) 306 return false; 307 is.jumpInstrMod = make<JumpInstrMod>(); 308 *is.jumpInstrMod = {rB.offset - 1, jInvert, 4}; 309 // Move R's values to rB except the offset. 310 rB = {r.expr, r.type, rB.offset, r.addend, r.sym}; 311 // Cancel R 312 r.expr = R_NONE; 313 r.offset = 0; 314 is.drop_back(sizeOfDirectJmpInsn); 315 is.nopFiller = true; 316 return true; 317 } 318 319 RelExpr X86_64::getRelExpr(RelType type, const Symbol &s, 320 const uint8_t *loc) const { 321 if (type == R_X86_64_GOTTPOFF) 322 config->hasTlsIe = true; 323 324 switch (type) { 325 case R_X86_64_8: 326 case R_X86_64_16: 327 case R_X86_64_32: 328 case R_X86_64_32S: 329 case R_X86_64_64: 330 return R_ABS; 331 case R_X86_64_DTPOFF32: 332 case R_X86_64_DTPOFF64: 333 return R_DTPREL; 334 case R_X86_64_TPOFF32: 335 return R_TPREL; 336 case R_X86_64_TLSDESC_CALL: 337 return R_TLSDESC_CALL; 338 case R_X86_64_TLSLD: 339 return R_TLSLD_PC; 340 case R_X86_64_TLSGD: 341 return R_TLSGD_PC; 342 case R_X86_64_SIZE32: 343 case R_X86_64_SIZE64: 344 return R_SIZE; 345 case R_X86_64_PLT32: 346 return R_PLT_PC; 347 case R_X86_64_PC8: 348 case R_X86_64_PC16: 349 case R_X86_64_PC32: 350 case R_X86_64_PC64: 351 return R_PC; 352 case R_X86_64_GOT32: 353 case R_X86_64_GOT64: 354 return R_GOTPLT; 355 case R_X86_64_GOTPC32_TLSDESC: 356 return R_TLSDESC_PC; 357 case R_X86_64_GOTPCREL: 358 case R_X86_64_GOTPCRELX: 359 case R_X86_64_REX_GOTPCRELX: 360 case R_X86_64_GOTTPOFF: 361 return R_GOT_PC; 362 case R_X86_64_GOTOFF64: 363 return R_GOTPLTREL; 364 case R_X86_64_PLTOFF64: 365 return R_PLT_GOTPLT; 366 case R_X86_64_GOTPC32: 367 case R_X86_64_GOTPC64: 368 return R_GOTPLTONLY_PC; 369 case R_X86_64_NONE: 370 return R_NONE; 371 default: 372 error(getErrorLocation(loc) + "unknown relocation (" + Twine(type) + 373 ") against symbol " + toString(s)); 374 return R_NONE; 375 } 376 } 377 378 void X86_64::writeGotPltHeader(uint8_t *buf) const { 379 // The first entry holds the value of _DYNAMIC. It is not clear why that is 380 // required, but it is documented in the psabi and the glibc dynamic linker 381 // seems to use it (note that this is relevant for linking ld.so, not any 382 // other program). 383 write64le(buf, mainPart->dynamic->getVA()); 384 } 385 386 void X86_64::writeGotPlt(uint8_t *buf, const Symbol &s) const { 387 // See comments in X86::writeGotPlt. 388 write64le(buf, s.getPltVA() + 6); 389 } 390 391 void X86_64::writeIgotPlt(uint8_t *buf, const Symbol &s) const { 392 // An x86 entry is the address of the ifunc resolver function (for -z rel). 393 if (config->writeAddends) 394 write64le(buf, s.getVA()); 395 } 396 397 void X86_64::writePltHeader(uint8_t *buf) const { 398 const uint8_t pltData[] = { 399 0xff, 0x35, 0, 0, 0, 0, // pushq GOTPLT+8(%rip) 400 0xff, 0x25, 0, 0, 0, 0, // jmp *GOTPLT+16(%rip) 401 0x0f, 0x1f, 0x40, 0x00, // nop 402 }; 403 memcpy(buf, pltData, sizeof(pltData)); 404 uint64_t gotPlt = in.gotPlt->getVA(); 405 uint64_t plt = in.ibtPlt ? in.ibtPlt->getVA() : in.plt->getVA(); 406 write32le(buf + 2, gotPlt - plt + 2); // GOTPLT+8 407 write32le(buf + 8, gotPlt - plt + 4); // GOTPLT+16 408 } 409 410 void X86_64::writePlt(uint8_t *buf, const Symbol &sym, 411 uint64_t pltEntryAddr) const { 412 const uint8_t inst[] = { 413 0xff, 0x25, 0, 0, 0, 0, // jmpq *got(%rip) 414 0x68, 0, 0, 0, 0, // pushq <relocation index> 415 0xe9, 0, 0, 0, 0, // jmpq plt[0] 416 }; 417 memcpy(buf, inst, sizeof(inst)); 418 419 write32le(buf + 2, sym.getGotPltVA() - pltEntryAddr - 6); 420 write32le(buf + 7, sym.getPltIdx()); 421 write32le(buf + 12, in.plt->getVA() - pltEntryAddr - 16); 422 } 423 424 RelType X86_64::getDynRel(RelType type) const { 425 if (type == R_X86_64_64 || type == R_X86_64_PC64 || type == R_X86_64_SIZE32 || 426 type == R_X86_64_SIZE64) 427 return type; 428 return R_X86_64_NONE; 429 } 430 431 void X86_64::relaxTlsGdToLe(uint8_t *loc, const Relocation &rel, 432 uint64_t val) const { 433 if (rel.type == R_X86_64_TLSGD) { 434 // Convert 435 // .byte 0x66 436 // leaq x@tlsgd(%rip), %rdi 437 // .word 0x6666 438 // rex64 439 // call __tls_get_addr@plt 440 // to the following two instructions. 441 const uint8_t inst[] = { 442 0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 443 0x00, 0x00, // mov %fs:0x0,%rax 444 0x48, 0x8d, 0x80, 0, 0, 0, 0, // lea x@tpoff,%rax 445 }; 446 memcpy(loc - 4, inst, sizeof(inst)); 447 448 // The original code used a pc relative relocation and so we have to 449 // compensate for the -4 in had in the addend. 450 write32le(loc + 8, val + 4); 451 } else if (rel.type == R_X86_64_GOTPC32_TLSDESC) { 452 // Convert leaq x@tlsdesc(%rip), %REG to movq $x@tpoff, %REG. 453 if ((loc[-3] & 0xfb) != 0x48 || loc[-2] != 0x8d || 454 (loc[-1] & 0xc7) != 0x05) { 455 errorOrWarn(getErrorLocation(loc - 3) + 456 "R_X86_64_GOTPC32_TLSDESC must be used " 457 "in leaq x@tlsdesc(%rip), %REG"); 458 return; 459 } 460 loc[-3] = 0x48 | ((loc[-3] >> 2) & 1); 461 loc[-2] = 0xc7; 462 loc[-1] = 0xc0 | ((loc[-1] >> 3) & 7); 463 write32le(loc, val + 4); 464 } else { 465 // Convert call *x@tlsdesc(%REG) to xchg ax, ax. 466 assert(rel.type == R_X86_64_TLSDESC_CALL); 467 loc[0] = 0x66; 468 loc[1] = 0x90; 469 } 470 } 471 472 void X86_64::relaxTlsGdToIe(uint8_t *loc, const Relocation &rel, 473 uint64_t val) const { 474 if (rel.type == R_X86_64_TLSGD) { 475 // Convert 476 // .byte 0x66 477 // leaq x@tlsgd(%rip), %rdi 478 // .word 0x6666 479 // rex64 480 // call __tls_get_addr@plt 481 // to the following two instructions. 482 const uint8_t inst[] = { 483 0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 484 0x00, 0x00, // mov %fs:0x0,%rax 485 0x48, 0x03, 0x05, 0, 0, 0, 0, // addq x@gottpoff(%rip),%rax 486 }; 487 memcpy(loc - 4, inst, sizeof(inst)); 488 489 // Both code sequences are PC relatives, but since we are moving the 490 // constant forward by 8 bytes we have to subtract the value by 8. 491 write32le(loc + 8, val - 8); 492 } else if (rel.type == R_X86_64_GOTPC32_TLSDESC) { 493 // Convert leaq x@tlsdesc(%rip), %REG to movq x@gottpoff(%rip), %REG. 494 assert(rel.type == R_X86_64_GOTPC32_TLSDESC); 495 if ((loc[-3] & 0xfb) != 0x48 || loc[-2] != 0x8d || 496 (loc[-1] & 0xc7) != 0x05) { 497 errorOrWarn(getErrorLocation(loc - 3) + 498 "R_X86_64_GOTPC32_TLSDESC must be used " 499 "in leaq x@tlsdesc(%rip), %REG"); 500 return; 501 } 502 loc[-2] = 0x8b; 503 write32le(loc, val); 504 } else { 505 // Convert call *x@tlsdesc(%rax) to xchg ax, ax. 506 assert(rel.type == R_X86_64_TLSDESC_CALL); 507 loc[0] = 0x66; 508 loc[1] = 0x90; 509 } 510 } 511 512 // In some conditions, R_X86_64_GOTTPOFF relocation can be optimized to 513 // R_X86_64_TPOFF32 so that it does not use GOT. 514 void X86_64::relaxTlsIeToLe(uint8_t *loc, const Relocation &, 515 uint64_t val) const { 516 uint8_t *inst = loc - 3; 517 uint8_t reg = loc[-1] >> 3; 518 uint8_t *regSlot = loc - 1; 519 520 // Note that ADD with RSP or R12 is converted to ADD instead of LEA 521 // because LEA with these registers needs 4 bytes to encode and thus 522 // wouldn't fit the space. 523 524 if (memcmp(inst, "\x48\x03\x25", 3) == 0) { 525 // "addq foo@gottpoff(%rip),%rsp" -> "addq $foo,%rsp" 526 memcpy(inst, "\x48\x81\xc4", 3); 527 } else if (memcmp(inst, "\x4c\x03\x25", 3) == 0) { 528 // "addq foo@gottpoff(%rip),%r12" -> "addq $foo,%r12" 529 memcpy(inst, "\x49\x81\xc4", 3); 530 } else if (memcmp(inst, "\x4c\x03", 2) == 0) { 531 // "addq foo@gottpoff(%rip),%r[8-15]" -> "leaq foo(%r[8-15]),%r[8-15]" 532 memcpy(inst, "\x4d\x8d", 2); 533 *regSlot = 0x80 | (reg << 3) | reg; 534 } else if (memcmp(inst, "\x48\x03", 2) == 0) { 535 // "addq foo@gottpoff(%rip),%reg -> "leaq foo(%reg),%reg" 536 memcpy(inst, "\x48\x8d", 2); 537 *regSlot = 0x80 | (reg << 3) | reg; 538 } else if (memcmp(inst, "\x4c\x8b", 2) == 0) { 539 // "movq foo@gottpoff(%rip),%r[8-15]" -> "movq $foo,%r[8-15]" 540 memcpy(inst, "\x49\xc7", 2); 541 *regSlot = 0xc0 | reg; 542 } else if (memcmp(inst, "\x48\x8b", 2) == 0) { 543 // "movq foo@gottpoff(%rip),%reg" -> "movq $foo,%reg" 544 memcpy(inst, "\x48\xc7", 2); 545 *regSlot = 0xc0 | reg; 546 } else { 547 error(getErrorLocation(loc - 3) + 548 "R_X86_64_GOTTPOFF must be used in MOVQ or ADDQ instructions only"); 549 } 550 551 // The original code used a PC relative relocation. 552 // Need to compensate for the -4 it had in the addend. 553 write32le(loc, val + 4); 554 } 555 556 void X86_64::relaxTlsLdToLe(uint8_t *loc, const Relocation &rel, 557 uint64_t val) const { 558 if (rel.type == R_X86_64_DTPOFF64) { 559 write64le(loc, val); 560 return; 561 } 562 if (rel.type == R_X86_64_DTPOFF32) { 563 write32le(loc, val); 564 return; 565 } 566 567 const uint8_t inst[] = { 568 0x66, 0x66, // .word 0x6666 569 0x66, // .byte 0x66 570 0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 0x00, 0x00, // mov %fs:0,%rax 571 }; 572 573 if (loc[4] == 0xe8) { 574 // Convert 575 // leaq bar@tlsld(%rip), %rdi # 48 8d 3d <Loc> 576 // callq __tls_get_addr@PLT # e8 <disp32> 577 // leaq bar@dtpoff(%rax), %rcx 578 // to 579 // .word 0x6666 580 // .byte 0x66 581 // mov %fs:0,%rax 582 // leaq bar@tpoff(%rax), %rcx 583 memcpy(loc - 3, inst, sizeof(inst)); 584 return; 585 } 586 587 if (loc[4] == 0xff && loc[5] == 0x15) { 588 // Convert 589 // leaq x@tlsld(%rip),%rdi # 48 8d 3d <Loc> 590 // call *__tls_get_addr@GOTPCREL(%rip) # ff 15 <disp32> 591 // to 592 // .long 0x66666666 593 // movq %fs:0,%rax 594 // See "Table 11.9: LD -> LE Code Transition (LP64)" in 595 // https://raw.githubusercontent.com/wiki/hjl-tools/x86-psABI/x86-64-psABI-1.0.pdf 596 loc[-3] = 0x66; 597 memcpy(loc - 2, inst, sizeof(inst)); 598 return; 599 } 600 601 error(getErrorLocation(loc - 3) + 602 "expected R_X86_64_PLT32 or R_X86_64_GOTPCRELX after R_X86_64_TLSLD"); 603 } 604 605 // A JumpInstrMod at a specific offset indicates that the jump instruction 606 // opcode at that offset must be modified. This is specifically used to relax 607 // jump instructions with basic block sections. This function looks at the 608 // JumpMod and effects the change. 609 void X86_64::applyJumpInstrMod(uint8_t *loc, JumpModType type, 610 unsigned size) const { 611 switch (type) { 612 case J_JMP_32: 613 if (size == 4) 614 *loc = 0xe9; 615 else 616 *loc = 0xeb; 617 break; 618 case J_JE_32: 619 if (size == 4) { 620 loc[-1] = 0x0f; 621 *loc = 0x84; 622 } else 623 *loc = 0x74; 624 break; 625 case J_JNE_32: 626 if (size == 4) { 627 loc[-1] = 0x0f; 628 *loc = 0x85; 629 } else 630 *loc = 0x75; 631 break; 632 case J_JG_32: 633 if (size == 4) { 634 loc[-1] = 0x0f; 635 *loc = 0x8f; 636 } else 637 *loc = 0x7f; 638 break; 639 case J_JGE_32: 640 if (size == 4) { 641 loc[-1] = 0x0f; 642 *loc = 0x8d; 643 } else 644 *loc = 0x7d; 645 break; 646 case J_JB_32: 647 if (size == 4) { 648 loc[-1] = 0x0f; 649 *loc = 0x82; 650 } else 651 *loc = 0x72; 652 break; 653 case J_JBE_32: 654 if (size == 4) { 655 loc[-1] = 0x0f; 656 *loc = 0x86; 657 } else 658 *loc = 0x76; 659 break; 660 case J_JL_32: 661 if (size == 4) { 662 loc[-1] = 0x0f; 663 *loc = 0x8c; 664 } else 665 *loc = 0x7c; 666 break; 667 case J_JLE_32: 668 if (size == 4) { 669 loc[-1] = 0x0f; 670 *loc = 0x8e; 671 } else 672 *loc = 0x7e; 673 break; 674 case J_JA_32: 675 if (size == 4) { 676 loc[-1] = 0x0f; 677 *loc = 0x87; 678 } else 679 *loc = 0x77; 680 break; 681 case J_JAE_32: 682 if (size == 4) { 683 loc[-1] = 0x0f; 684 *loc = 0x83; 685 } else 686 *loc = 0x73; 687 break; 688 case J_UNKNOWN: 689 llvm_unreachable("Unknown Jump Relocation"); 690 } 691 } 692 693 int64_t X86_64::getImplicitAddend(const uint8_t *buf, RelType type) const { 694 switch (type) { 695 case R_X86_64_8: 696 case R_X86_64_PC8: 697 return SignExtend64<8>(*buf); 698 case R_X86_64_16: 699 case R_X86_64_PC16: 700 return SignExtend64<16>(read16le(buf)); 701 case R_X86_64_32: 702 case R_X86_64_32S: 703 case R_X86_64_TPOFF32: 704 case R_X86_64_GOT32: 705 case R_X86_64_GOTPC32: 706 case R_X86_64_GOTPC32_TLSDESC: 707 case R_X86_64_GOTPCREL: 708 case R_X86_64_GOTPCRELX: 709 case R_X86_64_REX_GOTPCRELX: 710 case R_X86_64_PC32: 711 case R_X86_64_GOTTPOFF: 712 case R_X86_64_PLT32: 713 case R_X86_64_TLSGD: 714 case R_X86_64_TLSLD: 715 case R_X86_64_DTPOFF32: 716 case R_X86_64_SIZE32: 717 return SignExtend64<32>(read32le(buf)); 718 case R_X86_64_64: 719 case R_X86_64_TPOFF64: 720 case R_X86_64_DTPOFF64: 721 case R_X86_64_DTPMOD64: 722 case R_X86_64_PC64: 723 case R_X86_64_SIZE64: 724 case R_X86_64_GLOB_DAT: 725 case R_X86_64_GOT64: 726 case R_X86_64_GOTOFF64: 727 case R_X86_64_GOTPC64: 728 case R_X86_64_PLTOFF64: 729 case R_X86_64_IRELATIVE: 730 case R_X86_64_RELATIVE: 731 return read64le(buf); 732 case R_X86_64_TLSDESC: 733 return read64le(buf + 8); 734 case R_X86_64_JUMP_SLOT: 735 case R_X86_64_NONE: 736 // These relocations are defined as not having an implicit addend. 737 return 0; 738 default: 739 internalLinkerError(getErrorLocation(buf), 740 "cannot read addend for relocation " + toString(type)); 741 return 0; 742 } 743 } 744 745 void X86_64::relocate(uint8_t *loc, const Relocation &rel, uint64_t val) const { 746 switch (rel.type) { 747 case R_X86_64_8: 748 checkIntUInt(loc, val, 8, rel); 749 *loc = val; 750 break; 751 case R_X86_64_PC8: 752 checkInt(loc, val, 8, rel); 753 *loc = val; 754 break; 755 case R_X86_64_16: 756 checkIntUInt(loc, val, 16, rel); 757 write16le(loc, val); 758 break; 759 case R_X86_64_PC16: 760 checkInt(loc, val, 16, rel); 761 write16le(loc, val); 762 break; 763 case R_X86_64_32: 764 checkUInt(loc, val, 32, rel); 765 write32le(loc, val); 766 break; 767 case R_X86_64_32S: 768 case R_X86_64_TPOFF32: 769 case R_X86_64_GOT32: 770 case R_X86_64_GOTPC32: 771 case R_X86_64_GOTPC32_TLSDESC: 772 case R_X86_64_GOTPCREL: 773 case R_X86_64_GOTPCRELX: 774 case R_X86_64_REX_GOTPCRELX: 775 case R_X86_64_PC32: 776 case R_X86_64_GOTTPOFF: 777 case R_X86_64_PLT32: 778 case R_X86_64_TLSGD: 779 case R_X86_64_TLSLD: 780 case R_X86_64_DTPOFF32: 781 case R_X86_64_SIZE32: 782 checkInt(loc, val, 32, rel); 783 write32le(loc, val); 784 break; 785 case R_X86_64_64: 786 case R_X86_64_DTPOFF64: 787 case R_X86_64_PC64: 788 case R_X86_64_SIZE64: 789 case R_X86_64_GOT64: 790 case R_X86_64_GOTOFF64: 791 case R_X86_64_GOTPC64: 792 case R_X86_64_PLTOFF64: 793 write64le(loc, val); 794 break; 795 case R_X86_64_TLSDESC: 796 // The addend is stored in the second 64-bit word. 797 write64le(loc + 8, val); 798 break; 799 default: 800 llvm_unreachable("unknown relocation"); 801 } 802 } 803 804 RelExpr X86_64::adjustGotPcExpr(RelType type, int64_t addend, 805 const uint8_t *loc) const { 806 // Only R_X86_64_[REX_]GOTPCRELX can be relaxed. GNU as may emit GOTPCRELX 807 // with addend != -4. Such an instruction does not load the full GOT entry, so 808 // we cannot relax the relocation. E.g. movl x@GOTPCREL+4(%rip), %rax 809 // (addend=0) loads the high 32 bits of the GOT entry. 810 if (!config->relax || addend != -4 || 811 (type != R_X86_64_GOTPCRELX && type != R_X86_64_REX_GOTPCRELX)) 812 return R_GOT_PC; 813 const uint8_t op = loc[-2]; 814 const uint8_t modRm = loc[-1]; 815 816 // FIXME: When PIC is disabled and foo is defined locally in the 817 // lower 32 bit address space, memory operand in mov can be converted into 818 // immediate operand. Otherwise, mov must be changed to lea. We support only 819 // latter relaxation at this moment. 820 if (op == 0x8b) 821 return R_RELAX_GOT_PC; 822 823 // Relax call and jmp. 824 if (op == 0xff && (modRm == 0x15 || modRm == 0x25)) 825 return R_RELAX_GOT_PC; 826 827 // We don't support test/binop instructions without a REX prefix. 828 if (type == R_X86_64_GOTPCRELX) 829 return R_GOT_PC; 830 831 // Relaxation of test, adc, add, and, cmp, or, sbb, sub, xor. 832 // If PIC then no relaxation is available. 833 return config->isPic ? R_GOT_PC : R_RELAX_GOT_PC_NOPIC; 834 } 835 836 // A subset of relaxations can only be applied for no-PIC. This method 837 // handles such relaxations. Instructions encoding information was taken from: 838 // "Intel 64 and IA-32 Architectures Software Developer's Manual V2" 839 // (http://www.intel.com/content/dam/www/public/us/en/documents/manuals/ 840 // 64-ia-32-architectures-software-developer-instruction-set-reference-manual-325383.pdf) 841 static void relaxGotNoPic(uint8_t *loc, uint64_t val, uint8_t op, 842 uint8_t modRm) { 843 const uint8_t rex = loc[-3]; 844 // Convert "test %reg, foo@GOTPCREL(%rip)" to "test $foo, %reg". 845 if (op == 0x85) { 846 // See "TEST-Logical Compare" (4-428 Vol. 2B), 847 // TEST r/m64, r64 uses "full" ModR / M byte (no opcode extension). 848 849 // ModR/M byte has form XX YYY ZZZ, where 850 // YYY is MODRM.reg(register 2), ZZZ is MODRM.rm(register 1). 851 // XX has different meanings: 852 // 00: The operand's memory address is in reg1. 853 // 01: The operand's memory address is reg1 + a byte-sized displacement. 854 // 10: The operand's memory address is reg1 + a word-sized displacement. 855 // 11: The operand is reg1 itself. 856 // If an instruction requires only one operand, the unused reg2 field 857 // holds extra opcode bits rather than a register code 858 // 0xC0 == 11 000 000 binary. 859 // 0x38 == 00 111 000 binary. 860 // We transfer reg2 to reg1 here as operand. 861 // See "2.1.3 ModR/M and SIB Bytes" (Vol. 2A 2-3). 862 loc[-1] = 0xc0 | (modRm & 0x38) >> 3; // ModR/M byte. 863 864 // Change opcode from TEST r/m64, r64 to TEST r/m64, imm32 865 // See "TEST-Logical Compare" (4-428 Vol. 2B). 866 loc[-2] = 0xf7; 867 868 // Move R bit to the B bit in REX byte. 869 // REX byte is encoded as 0100WRXB, where 870 // 0100 is 4bit fixed pattern. 871 // REX.W When 1, a 64-bit operand size is used. Otherwise, when 0, the 872 // default operand size is used (which is 32-bit for most but not all 873 // instructions). 874 // REX.R This 1-bit value is an extension to the MODRM.reg field. 875 // REX.X This 1-bit value is an extension to the SIB.index field. 876 // REX.B This 1-bit value is an extension to the MODRM.rm field or the 877 // SIB.base field. 878 // See "2.2.1.2 More on REX Prefix Fields " (2-8 Vol. 2A). 879 loc[-3] = (rex & ~0x4) | (rex & 0x4) >> 2; 880 write32le(loc, val); 881 return; 882 } 883 884 // If we are here then we need to relax the adc, add, and, cmp, or, sbb, sub 885 // or xor operations. 886 887 // Convert "binop foo@GOTPCREL(%rip), %reg" to "binop $foo, %reg". 888 // Logic is close to one for test instruction above, but we also 889 // write opcode extension here, see below for details. 890 loc[-1] = 0xc0 | (modRm & 0x38) >> 3 | (op & 0x3c); // ModR/M byte. 891 892 // Primary opcode is 0x81, opcode extension is one of: 893 // 000b = ADD, 001b is OR, 010b is ADC, 011b is SBB, 894 // 100b is AND, 101b is SUB, 110b is XOR, 111b is CMP. 895 // This value was wrote to MODRM.reg in a line above. 896 // See "3.2 INSTRUCTIONS (A-M)" (Vol. 2A 3-15), 897 // "INSTRUCTION SET REFERENCE, N-Z" (Vol. 2B 4-1) for 898 // descriptions about each operation. 899 loc[-2] = 0x81; 900 loc[-3] = (rex & ~0x4) | (rex & 0x4) >> 2; 901 write32le(loc, val); 902 } 903 904 void X86_64::relaxGot(uint8_t *loc, const Relocation &rel, uint64_t val) const { 905 checkInt(loc, val, 32, rel); 906 const uint8_t op = loc[-2]; 907 const uint8_t modRm = loc[-1]; 908 909 // Convert "mov foo@GOTPCREL(%rip),%reg" to "lea foo(%rip),%reg". 910 if (op == 0x8b) { 911 loc[-2] = 0x8d; 912 write32le(loc, val); 913 return; 914 } 915 916 if (op != 0xff) { 917 // We are relaxing a rip relative to an absolute, so compensate 918 // for the old -4 addend. 919 assert(!config->isPic); 920 relaxGotNoPic(loc, val + 4, op, modRm); 921 return; 922 } 923 924 // Convert call/jmp instructions. 925 if (modRm == 0x15) { 926 // ABI says we can convert "call *foo@GOTPCREL(%rip)" to "nop; call foo". 927 // Instead we convert to "addr32 call foo" where addr32 is an instruction 928 // prefix. That makes result expression to be a single instruction. 929 loc[-2] = 0x67; // addr32 prefix 930 loc[-1] = 0xe8; // call 931 write32le(loc, val); 932 return; 933 } 934 935 // Convert "jmp *foo@GOTPCREL(%rip)" to "jmp foo; nop". 936 // jmp doesn't return, so it is fine to use nop here, it is just a stub. 937 assert(modRm == 0x25); 938 loc[-2] = 0xe9; // jmp 939 loc[3] = 0x90; // nop 940 write32le(loc - 1, val + 1); 941 } 942 943 // A split-stack prologue starts by checking the amount of stack remaining 944 // in one of two ways: 945 // A) Comparing of the stack pointer to a field in the tcb. 946 // B) Or a load of a stack pointer offset with an lea to r10 or r11. 947 bool X86_64::adjustPrologueForCrossSplitStack(uint8_t *loc, uint8_t *end, 948 uint8_t stOther) const { 949 if (!config->is64) { 950 error("target doesn't support split stacks"); 951 return false; 952 } 953 954 if (loc + 8 >= end) 955 return false; 956 957 // Replace "cmp %fs:0x70,%rsp" and subsequent branch 958 // with "stc, nopl 0x0(%rax,%rax,1)" 959 if (memcmp(loc, "\x64\x48\x3b\x24\x25", 5) == 0) { 960 memcpy(loc, "\xf9\x0f\x1f\x84\x00\x00\x00\x00", 8); 961 return true; 962 } 963 964 // Adjust "lea X(%rsp),%rYY" to lea "(X - 0x4000)(%rsp),%rYY" where rYY could 965 // be r10 or r11. The lea instruction feeds a subsequent compare which checks 966 // if there is X available stack space. Making X larger effectively reserves 967 // that much additional space. The stack grows downward so subtract the value. 968 if (memcmp(loc, "\x4c\x8d\x94\x24", 4) == 0 || 969 memcmp(loc, "\x4c\x8d\x9c\x24", 4) == 0) { 970 // The offset bytes are encoded four bytes after the start of the 971 // instruction. 972 write32le(loc + 4, read32le(loc + 4) - 0x4000); 973 return true; 974 } 975 return false; 976 } 977 978 // If Intel Indirect Branch Tracking is enabled, we have to emit special PLT 979 // entries containing endbr64 instructions. A PLT entry will be split into two 980 // parts, one in .plt.sec (writePlt), and the other in .plt (writeIBTPlt). 981 namespace { 982 class IntelIBT : public X86_64 { 983 public: 984 IntelIBT(); 985 void writeGotPlt(uint8_t *buf, const Symbol &s) const override; 986 void writePlt(uint8_t *buf, const Symbol &sym, 987 uint64_t pltEntryAddr) const override; 988 void writeIBTPlt(uint8_t *buf, size_t numEntries) const override; 989 990 static const unsigned IBTPltHeaderSize = 16; 991 }; 992 } // namespace 993 994 IntelIBT::IntelIBT() { pltHeaderSize = 0; } 995 996 void IntelIBT::writeGotPlt(uint8_t *buf, const Symbol &s) const { 997 uint64_t va = 998 in.ibtPlt->getVA() + IBTPltHeaderSize + s.getPltIdx() * pltEntrySize; 999 write64le(buf, va); 1000 } 1001 1002 void IntelIBT::writePlt(uint8_t *buf, const Symbol &sym, 1003 uint64_t pltEntryAddr) const { 1004 const uint8_t Inst[] = { 1005 0xf3, 0x0f, 0x1e, 0xfa, // endbr64 1006 0xff, 0x25, 0, 0, 0, 0, // jmpq *got(%rip) 1007 0x66, 0x0f, 0x1f, 0x44, 0, 0, // nop 1008 }; 1009 memcpy(buf, Inst, sizeof(Inst)); 1010 write32le(buf + 6, sym.getGotPltVA() - pltEntryAddr - 10); 1011 } 1012 1013 void IntelIBT::writeIBTPlt(uint8_t *buf, size_t numEntries) const { 1014 writePltHeader(buf); 1015 buf += IBTPltHeaderSize; 1016 1017 const uint8_t inst[] = { 1018 0xf3, 0x0f, 0x1e, 0xfa, // endbr64 1019 0x68, 0, 0, 0, 0, // pushq <relocation index> 1020 0xe9, 0, 0, 0, 0, // jmpq plt[0] 1021 0x66, 0x90, // nop 1022 }; 1023 1024 for (size_t i = 0; i < numEntries; ++i) { 1025 memcpy(buf, inst, sizeof(inst)); 1026 write32le(buf + 5, i); 1027 write32le(buf + 10, -pltHeaderSize - sizeof(inst) * i - 30); 1028 buf += sizeof(inst); 1029 } 1030 } 1031 1032 // These nonstandard PLT entries are to migtigate Spectre v2 security 1033 // vulnerability. In order to mitigate Spectre v2, we want to avoid indirect 1034 // branch instructions such as `jmp *GOTPLT(%rip)`. So, in the following PLT 1035 // entries, we use a CALL followed by MOV and RET to do the same thing as an 1036 // indirect jump. That instruction sequence is so-called "retpoline". 1037 // 1038 // We have two types of retpoline PLTs as a size optimization. If `-z now` 1039 // is specified, all dynamic symbols are resolved at load-time. Thus, when 1040 // that option is given, we can omit code for symbol lazy resolution. 1041 namespace { 1042 class Retpoline : public X86_64 { 1043 public: 1044 Retpoline(); 1045 void writeGotPlt(uint8_t *buf, const Symbol &s) const override; 1046 void writePltHeader(uint8_t *buf) const override; 1047 void writePlt(uint8_t *buf, const Symbol &sym, 1048 uint64_t pltEntryAddr) const override; 1049 }; 1050 1051 class RetpolineZNow : public X86_64 { 1052 public: 1053 RetpolineZNow(); 1054 void writeGotPlt(uint8_t *buf, const Symbol &s) const override {} 1055 void writePltHeader(uint8_t *buf) const override; 1056 void writePlt(uint8_t *buf, const Symbol &sym, 1057 uint64_t pltEntryAddr) const override; 1058 }; 1059 } // namespace 1060 1061 Retpoline::Retpoline() { 1062 pltHeaderSize = 48; 1063 pltEntrySize = 32; 1064 ipltEntrySize = 32; 1065 } 1066 1067 void Retpoline::writeGotPlt(uint8_t *buf, const Symbol &s) const { 1068 write64le(buf, s.getPltVA() + 17); 1069 } 1070 1071 void Retpoline::writePltHeader(uint8_t *buf) const { 1072 const uint8_t insn[] = { 1073 0xff, 0x35, 0, 0, 0, 0, // 0: pushq GOTPLT+8(%rip) 1074 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // 6: mov GOTPLT+16(%rip), %r11 1075 0xe8, 0x0e, 0x00, 0x00, 0x00, // d: callq next 1076 0xf3, 0x90, // 12: loop: pause 1077 0x0f, 0xae, 0xe8, // 14: lfence 1078 0xeb, 0xf9, // 17: jmp loop 1079 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 19: int3; .align 16 1080 0x4c, 0x89, 0x1c, 0x24, // 20: next: mov %r11, (%rsp) 1081 0xc3, // 24: ret 1082 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 25: int3; padding 1083 0xcc, 0xcc, 0xcc, 0xcc, // 2c: int3; padding 1084 }; 1085 memcpy(buf, insn, sizeof(insn)); 1086 1087 uint64_t gotPlt = in.gotPlt->getVA(); 1088 uint64_t plt = in.plt->getVA(); 1089 write32le(buf + 2, gotPlt - plt - 6 + 8); 1090 write32le(buf + 9, gotPlt - plt - 13 + 16); 1091 } 1092 1093 void Retpoline::writePlt(uint8_t *buf, const Symbol &sym, 1094 uint64_t pltEntryAddr) const { 1095 const uint8_t insn[] = { 1096 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // 0: mov foo@GOTPLT(%rip), %r11 1097 0xe8, 0, 0, 0, 0, // 7: callq plt+0x20 1098 0xe9, 0, 0, 0, 0, // c: jmp plt+0x12 1099 0x68, 0, 0, 0, 0, // 11: pushq <relocation index> 1100 0xe9, 0, 0, 0, 0, // 16: jmp plt+0 1101 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1b: int3; padding 1102 }; 1103 memcpy(buf, insn, sizeof(insn)); 1104 1105 uint64_t off = pltEntryAddr - in.plt->getVA(); 1106 1107 write32le(buf + 3, sym.getGotPltVA() - pltEntryAddr - 7); 1108 write32le(buf + 8, -off - 12 + 32); 1109 write32le(buf + 13, -off - 17 + 18); 1110 write32le(buf + 18, sym.getPltIdx()); 1111 write32le(buf + 23, -off - 27); 1112 } 1113 1114 RetpolineZNow::RetpolineZNow() { 1115 pltHeaderSize = 32; 1116 pltEntrySize = 16; 1117 ipltEntrySize = 16; 1118 } 1119 1120 void RetpolineZNow::writePltHeader(uint8_t *buf) const { 1121 const uint8_t insn[] = { 1122 0xe8, 0x0b, 0x00, 0x00, 0x00, // 0: call next 1123 0xf3, 0x90, // 5: loop: pause 1124 0x0f, 0xae, 0xe8, // 7: lfence 1125 0xeb, 0xf9, // a: jmp loop 1126 0xcc, 0xcc, 0xcc, 0xcc, // c: int3; .align 16 1127 0x4c, 0x89, 0x1c, 0x24, // 10: next: mov %r11, (%rsp) 1128 0xc3, // 14: ret 1129 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 15: int3; padding 1130 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1a: int3; padding 1131 0xcc, // 1f: int3; padding 1132 }; 1133 memcpy(buf, insn, sizeof(insn)); 1134 } 1135 1136 void RetpolineZNow::writePlt(uint8_t *buf, const Symbol &sym, 1137 uint64_t pltEntryAddr) const { 1138 const uint8_t insn[] = { 1139 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // mov foo@GOTPLT(%rip), %r11 1140 0xe9, 0, 0, 0, 0, // jmp plt+0 1141 0xcc, 0xcc, 0xcc, 0xcc, // int3; padding 1142 }; 1143 memcpy(buf, insn, sizeof(insn)); 1144 1145 write32le(buf + 3, sym.getGotPltVA() - pltEntryAddr - 7); 1146 write32le(buf + 8, in.plt->getVA() - pltEntryAddr - 12); 1147 } 1148 1149 static TargetInfo *getTargetInfo() { 1150 if (config->zRetpolineplt) { 1151 if (config->zNow) { 1152 static RetpolineZNow t; 1153 return &t; 1154 } 1155 static Retpoline t; 1156 return &t; 1157 } 1158 1159 if (config->andFeatures & GNU_PROPERTY_X86_FEATURE_1_IBT) { 1160 static IntelIBT t; 1161 return &t; 1162 } 1163 1164 static X86_64 t; 1165 return &t; 1166 } 1167 1168 TargetInfo *elf::getX86_64TargetInfo() { return getTargetInfo(); } 1169