Coverage Report

Created: 2019-05-19 14:56

/Users/buildslave/jenkins/workspace/clang-stage2-coverage-R/llvm/tools/lld/ELF/Arch/X86_64.cpp
Line
Count
Source (jump to first uncovered line)
1
//===- X86_64.cpp ---------------------------------------------------------===//
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
9
#include "InputFiles.h"
10
#include "Symbols.h"
11
#include "SyntheticSections.h"
12
#include "Target.h"
13
#include "lld/Common/ErrorHandler.h"
14
#include "llvm/Object/ELF.h"
15
#include "llvm/Support/Endian.h"
16
17
using namespace llvm;
18
using namespace llvm::object;
19
using namespace llvm::support::endian;
20
using namespace llvm::ELF;
21
using namespace lld;
22
using namespace lld::elf;
23
24
namespace {
25
class X86_64 : public TargetInfo {
26
public:
27
  X86_64();
28
  int getTlsGdRelaxSkip(RelType Type) const override;
29
  RelExpr getRelExpr(RelType Type, const Symbol &S,
30
                     const uint8_t *Loc) const override;
31
  RelType getDynRel(RelType Type) const override;
32
  void writeGotPltHeader(uint8_t *Buf) const override;
33
  void writeGotPlt(uint8_t *Buf, const Symbol &S) const override;
34
  void writePltHeader(uint8_t *Buf) const override;
35
  void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
36
                int32_t Index, unsigned RelOff) const override;
37
  void relocateOne(uint8_t *Loc, RelType Type, uint64_t Val) const override;
38
39
  RelExpr adjustRelaxExpr(RelType Type, const uint8_t *Data,
40
                          RelExpr Expr) const override;
41
  void relaxGot(uint8_t *Loc, RelType Type, uint64_t Val) const override;
42
  void relaxTlsGdToIe(uint8_t *Loc, RelType Type, uint64_t Val) const override;
43
  void relaxTlsGdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override;
44
  void relaxTlsIeToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override;
45
  void relaxTlsLdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override;
46
  bool adjustPrologueForCrossSplitStack(uint8_t *Loc, uint8_t *End,
47
                                        uint8_t StOther) const override;
48
};
49
} // namespace
50
51
1.83k
X86_64::X86_64() {
52
1.83k
  CopyRel = R_X86_64_COPY;
53
1.83k
  GotRel = R_X86_64_GLOB_DAT;
54
1.83k
  NoneRel = R_X86_64_NONE;
55
1.83k
  PltRel = R_X86_64_JUMP_SLOT;
56
1.83k
  RelativeRel = R_X86_64_RELATIVE;
57
1.83k
  IRelativeRel = R_X86_64_IRELATIVE;
58
1.83k
  TlsGotRel = R_X86_64_TPOFF64;
59
1.83k
  TlsModuleIndexRel = R_X86_64_DTPMOD64;
60
1.83k
  TlsOffsetRel = R_X86_64_DTPOFF64;
61
1.83k
  GotEntrySize = 8;
62
1.83k
  GotPltEntrySize = 8;
63
1.83k
  PltEntrySize = 16;
64
1.83k
  PltHeaderSize = 16;
65
1.83k
  TrapInstr = {0xcc, 0xcc, 0xcc, 0xcc}; // 0xcc = INT3
66
1.83k
67
1.83k
  // Align to the large page size (known as a superpage or huge page).
68
1.83k
  // FreeBSD automatically promotes large, superpage-aligned allocations.
69
1.83k
  DefaultImageBase = 0x200000;
70
1.83k
}
71
72
19
int X86_64::getTlsGdRelaxSkip(RelType Type) const { return 2; }
73
74
RelExpr X86_64::getRelExpr(RelType Type, const Symbol &S,
75
1.43k
                           const uint8_t *Loc) const {
76
1.43k
  if (Type == R_X86_64_GOTTPOFF)
77
39
    Config->HasStaticTlsModel = true;
78
1.43k
79
1.43k
  switch (Type) {
80
1.43k
  case R_X86_64_8:
81
537
  case R_X86_64_16:
82
537
  case R_X86_64_32:
83
537
  case R_X86_64_32S:
84
537
  case R_X86_64_64:
85
537
    return R_ABS;
86
537
  case R_X86_64_DTPOFF32:
87
16
  case R_X86_64_DTPOFF64:
88
16
    return R_DTPREL;
89
16
  case R_X86_64_TPOFF32:
90
8
    return R_TLS;
91
16
  case R_X86_64_TLSLD:
92
9
    return R_TLSLD_PC;
93
20
  case R_X86_64_TLSGD:
94
20
    return R_TLSGD_PC;
95
37
  case R_X86_64_SIZE32:
96
37
  case R_X86_64_SIZE64:
97
37
    return R_SIZE;
98
434
  case R_X86_64_PLT32:
99
434
    return R_PLT_PC;
100
210
  case R_X86_64_PC8:
101
210
  case R_X86_64_PC16:
102
210
  case R_X86_64_PC32:
103
210
  case R_X86_64_PC64:
104
210
    return R_PC;
105
210
  case R_X86_64_GOT32:
106
4
  case R_X86_64_GOT64:
107
4
    return R_GOTPLT;
108
152
  case R_X86_64_GOTPCREL:
109
152
  case R_X86_64_GOTPCRELX:
110
152
  case R_X86_64_REX_GOTPCRELX:
111
152
  case R_X86_64_GOTTPOFF:
112
152
    return R_GOT_PC;
113
152
  case R_X86_64_GOTOFF64:
114
1
    return R_GOTPLTREL;
115
152
  case R_X86_64_GOTPC32:
116
2
  case R_X86_64_GOTPC64:
117
2
    return R_GOTPLTONLY_PC;
118
5
  case R_X86_64_NONE:
119
5
    return R_NONE;
120
2
  default:
121
2
    error(getErrorLocation(Loc) + "unknown relocation (" + Twine(Type) +
122
2
          ") against symbol " + toString(S));
123
2
    return R_NONE;
124
1.43k
  }
125
1.43k
}
126
127
169
void X86_64::writeGotPltHeader(uint8_t *Buf) const {
128
169
  // The first entry holds the value of _DYNAMIC. It is not clear why that is
129
169
  // required, but it is documented in the psabi and the glibc dynamic linker
130
169
  // seems to use it (note that this is relevant for linking ld.so, not any
131
169
  // other program).
132
169
  write64le(Buf, In.Dynamic->getVA());
133
169
}
134
135
210
void X86_64::writeGotPlt(uint8_t *Buf, const Symbol &S) const {
136
210
  // See comments in X86::writeGotPlt.
137
210
  write64le(Buf, S.getPltVA() + 6);
138
210
}
139
140
145
void X86_64::writePltHeader(uint8_t *Buf) const {
141
145
  const uint8_t PltData[] = {
142
145
      0xff, 0x35, 0, 0, 0, 0, // pushq GOTPLT+8(%rip)
143
145
      0xff, 0x25, 0, 0, 0, 0, // jmp *GOTPLT+16(%rip)
144
145
      0x0f, 0x1f, 0x40, 0x00, // nop
145
145
  };
146
145
  memcpy(Buf, PltData, sizeof(PltData));
147
145
  uint64_t GotPlt = In.GotPlt->getVA();
148
145
  uint64_t Plt = In.Plt->getVA();
149
145
  write32le(Buf + 2, GotPlt - Plt + 2); // GOTPLT+8
150
145
  write32le(Buf + 8, GotPlt - Plt + 4); // GOTPLT+16
151
145
}
152
153
void X86_64::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
154
                      uint64_t PltEntryAddr, int32_t Index,
155
210
                      unsigned RelOff) const {
156
210
  const uint8_t Inst[] = {
157
210
      0xff, 0x25, 0, 0, 0, 0, // jmpq *got(%rip)
158
210
      0x68, 0, 0, 0, 0,       // pushq <relocation index>
159
210
      0xe9, 0, 0, 0, 0,       // jmpq plt[0]
160
210
  };
161
210
  memcpy(Buf, Inst, sizeof(Inst));
162
210
163
210
  write32le(Buf + 2, GotPltEntryAddr - PltEntryAddr - 6);
164
210
  write32le(Buf + 7, Index);
165
210
  write32le(Buf + 12, -PltHeaderSize - PltEntrySize * Index - 16);
166
210
}
167
168
104
RelType X86_64::getDynRel(RelType Type) const {
169
104
  if (Type == R_X86_64_64 || 
Type == R_X86_64_PC6429
||
Type == R_X86_64_SIZE3226
||
170
104
      
Type == R_X86_64_SIZE6420
)
171
90
    return Type;
172
14
  return R_X86_64_NONE;
173
14
}
174
175
8
void X86_64::relaxTlsGdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const {
176
8
  // Convert
177
8
  //   .byte 0x66
178
8
  //   leaq x@tlsgd(%rip), %rdi
179
8
  //   .word 0x6666
180
8
  //   rex64
181
8
  //   call __tls_get_addr@plt
182
8
  // to
183
8
  //   mov %fs:0x0,%rax
184
8
  //   lea x@tpoff,%rax
185
8
  const uint8_t Inst[] = {
186
8
      0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 0x00, 0x00, // mov %fs:0x0,%rax
187
8
      0x48, 0x8d, 0x80, 0, 0, 0, 0,                         // lea x@tpoff,%rax
188
8
  };
189
8
  memcpy(Loc - 4, Inst, sizeof(Inst));
190
8
191
8
  // The original code used a pc relative relocation and so we have to
192
8
  // compensate for the -4 in had in the addend.
193
8
  write32le(Loc + 8, Val + 4);
194
8
}
195
196
6
void X86_64::relaxTlsGdToIe(uint8_t *Loc, RelType Type, uint64_t Val) const {
197
6
  // Convert
198
6
  //   .byte 0x66
199
6
  //   leaq x@tlsgd(%rip), %rdi
200
6
  //   .word 0x6666
201
6
  //   rex64
202
6
  //   call __tls_get_addr@plt
203
6
  // to
204
6
  //   mov %fs:0x0,%rax
205
6
  //   addq x@tpoff,%rax
206
6
  const uint8_t Inst[] = {
207
6
      0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 0x00, 0x00, // mov %fs:0x0,%rax
208
6
      0x48, 0x03, 0x05, 0, 0, 0, 0,                         // addq x@tpoff,%rax
209
6
  };
210
6
  memcpy(Loc - 4, Inst, sizeof(Inst));
211
6
212
6
  // Both code sequences are PC relatives, but since we are moving the constant
213
6
  // forward by 8 bytes we have to subtract the value by 8.
214
6
  write32le(Loc + 8, Val - 8);
215
6
}
216
217
// In some conditions, R_X86_64_GOTTPOFF relocation can be optimized to
218
// R_X86_64_TPOFF32 so that it does not use GOT.
219
31
void X86_64::relaxTlsIeToLe(uint8_t *Loc, RelType Type, uint64_t Val) const {
220
31
  uint8_t *Inst = Loc - 3;
221
31
  uint8_t Reg = Loc[-1] >> 3;
222
31
  uint8_t *RegSlot = Loc - 1;
223
31
224
31
  // Note that ADD with RSP or R12 is converted to ADD instead of LEA
225
31
  // because LEA with these registers needs 4 bytes to encode and thus
226
31
  // wouldn't fit the space.
227
31
228
31
  if (memcmp(Inst, "\x48\x03\x25", 3) == 0) {
229
4
    // "addq foo@gottpoff(%rip),%rsp" -> "addq $foo,%rsp"
230
4
    memcpy(Inst, "\x48\x81\xc4", 3);
231
27
  } else if (memcmp(Inst, "\x4c\x03\x25", 3) == 0) {
232
4
    // "addq foo@gottpoff(%rip),%r12" -> "addq $foo,%r12"
233
4
    memcpy(Inst, "\x49\x81\xc4", 3);
234
23
  } else if (memcmp(Inst, "\x4c\x03", 2) == 0) {
235
4
    // "addq foo@gottpoff(%rip),%r[8-15]" -> "leaq foo(%r[8-15]),%r[8-15]"
236
4
    memcpy(Inst, "\x4d\x8d", 2);
237
4
    *RegSlot = 0x80 | (Reg << 3) | Reg;
238
19
  } else if (memcmp(Inst, "\x48\x03", 2) == 0) {
239
4
    // "addq foo@gottpoff(%rip),%reg -> "leaq foo(%reg),%reg"
240
4
    memcpy(Inst, "\x48\x8d", 2);
241
4
    *RegSlot = 0x80 | (Reg << 3) | Reg;
242
15
  } else if (memcmp(Inst, "\x4c\x8b", 2) == 0) {
243
4
    // "movq foo@gottpoff(%rip),%r[8-15]" -> "movq $foo,%r[8-15]"
244
4
    memcpy(Inst, "\x49\xc7", 2);
245
4
    *RegSlot = 0xc0 | Reg;
246
11
  } else if (memcmp(Inst, "\x48\x8b", 2) == 0) {
247
9
    // "movq foo@gottpoff(%rip),%reg" -> "movq $foo,%reg"
248
9
    memcpy(Inst, "\x48\xc7", 2);
249
9
    *RegSlot = 0xc0 | Reg;
250
9
  } else {
251
2
    error(getErrorLocation(Loc - 3) +
252
2
          "R_X86_64_GOTTPOFF must be used in MOVQ or ADDQ instructions only");
253
2
  }
254
31
255
31
  // The original code used a PC relative relocation.
256
31
  // Need to compensate for the -4 it had in the addend.
257
31
  write32le(Loc, Val + 4);
258
31
}
259
260
10
void X86_64::relaxTlsLdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const {
261
10
  if (Type == R_X86_64_DTPOFF64) {
262
2
    write64le(Loc, Val);
263
2
    return;
264
2
  }
265
8
  if (Type == R_X86_64_DTPOFF32) {
266
3
    write32le(Loc, Val);
267
3
    return;
268
3
  }
269
5
270
5
  const uint8_t Inst[] = {
271
5
      0x66, 0x66,                                           // .word 0x6666
272
5
      0x66,                                                 // .byte 0x66
273
5
      0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 0x00, 0x00, // mov %fs:0,%rax
274
5
  };
275
5
276
5
  if (Loc[4] == 0xe8) {
277
3
    // Convert
278
3
    //   leaq bar@tlsld(%rip), %rdi           # 48 8d 3d <Loc>
279
3
    //   callq __tls_get_addr@PLT             # e8 <disp32>
280
3
    //   leaq bar@dtpoff(%rax), %rcx
281
3
    // to
282
3
    //   .word 0x6666
283
3
    //   .byte 0x66
284
3
    //   mov %fs:0,%rax
285
3
    //   leaq bar@tpoff(%rax), %rcx
286
3
    memcpy(Loc - 3, Inst, sizeof(Inst));
287
3
    return;
288
3
  }
289
2
290
2
  if (Loc[4] == 0xff && Loc[5] == 0x15) {
291
2
    // Convert
292
2
    //   leaq  x@tlsld(%rip),%rdi               # 48 8d 3d <Loc>
293
2
    //   call *__tls_get_addr@GOTPCREL(%rip)    # ff 15 <disp32>
294
2
    // to
295
2
    //   .long  0x66666666
296
2
    //   movq   %fs:0,%rax
297
2
    // See "Table 11.9: LD -> LE Code Transition (LP64)" in
298
2
    // https://raw.githubusercontent.com/wiki/hjl-tools/x86-psABI/x86-64-psABI-1.0.pdf
299
2
    Loc[-3] = 0x66;
300
2
    memcpy(Loc - 2, Inst, sizeof(Inst));
301
2
    return;
302
2
  }
303
0
304
0
  error(getErrorLocation(Loc - 3) +
305
0
        "expected R_X86_64_PLT32 or R_X86_64_GOTPCRELX after R_X86_64_TLSLD");
306
0
}
307
308
1.17k
void X86_64::relocateOne(uint8_t *Loc, RelType Type, uint64_t Val) const {
309
1.17k
  switch (Type) {
310
1.17k
  case R_X86_64_8:
311
5
    checkUInt(Loc, Val, 8, Type);
312
5
    *Loc = Val;
313
5
    break;
314
1.17k
  case R_X86_64_PC8:
315
2
    checkInt(Loc, Val, 8, Type);
316
2
    *Loc = Val;
317
2
    break;
318
1.17k
  case R_X86_64_16:
319
3
    checkUInt(Loc, Val, 16, Type);
320
3
    write16le(Loc, Val);
321
3
    break;
322
1.17k
  case R_X86_64_PC16:
323
2
    checkInt(Loc, Val, 16, Type);
324
2
    write16le(Loc, Val);
325
2
    break;
326
1.17k
  case R_X86_64_32:
327
136
    checkUInt(Loc, Val, 32, Type);
328
136
    write32le(Loc, Val);
329
136
    break;
330
1.17k
  case R_X86_64_32S:
331
785
  case R_X86_64_TPOFF32:
332
785
  case R_X86_64_GOT32:
333
785
  case R_X86_64_GOTPC32:
334
785
  case R_X86_64_GOTPCREL:
335
785
  case R_X86_64_GOTPCRELX:
336
785
  case R_X86_64_REX_GOTPCRELX:
337
785
  case R_X86_64_PC32:
338
785
  case R_X86_64_GOTTPOFF:
339
785
  case R_X86_64_PLT32:
340
785
  case R_X86_64_TLSGD:
341
785
  case R_X86_64_TLSLD:
342
785
  case R_X86_64_DTPOFF32:
343
785
  case R_X86_64_SIZE32:
344
785
    checkInt(Loc, Val, 32, Type);
345
785
    write32le(Loc, Val);
346
785
    break;
347
785
  case R_X86_64_64:
348
243
  case R_X86_64_DTPOFF64:
349
243
  case R_X86_64_GLOB_DAT:
350
243
  case R_X86_64_PC64:
351
243
  case R_X86_64_SIZE64:
352
243
  case R_X86_64_GOT64:
353
243
  case R_X86_64_GOTOFF64:
354
243
  case R_X86_64_GOTPC64:
355
243
    write64le(Loc, Val);
356
243
    break;
357
243
  default:
358
0
    llvm_unreachable("unknown relocation");
359
1.17k
  }
360
1.17k
}
361
362
RelExpr X86_64::adjustRelaxExpr(RelType Type, const uint8_t *Data,
363
76
                                RelExpr RelExpr) const {
364
76
  if (Type != R_X86_64_GOTPCRELX && 
Type != R_X86_64_REX_GOTPCRELX68
)
365
35
    return RelExpr;
366
41
  const uint8_t Op = Data[-2];
367
41
  const uint8_t ModRm = Data[-1];
368
41
369
41
  // FIXME: When PIC is disabled and foo is defined locally in the
370
41
  // lower 32 bit address space, memory operand in mov can be converted into
371
41
  // immediate operand. Otherwise, mov must be changed to lea. We support only
372
41
  // latter relaxation at this moment.
373
41
  if (Op == 0x8b)
374
15
    return R_RELAX_GOT_PC;
375
26
376
26
  // Relax call and jmp.
377
26
  if (Op == 0xff && 
(8
ModRm == 0x158
||
ModRm == 0x254
))
378
8
    return R_RELAX_GOT_PC;
379
18
380
18
  // Relaxation of test, adc, add, and, cmp, or, sbb, sub, xor.
381
18
  // If PIC then no relaxation is available.
382
18
  // We also don't relax test/binop instructions without REX byte,
383
18
  // they are 32bit operations and not common to have.
384
18
  assert(Type == R_X86_64_REX_GOTPCRELX);
385
18
  return Config->Pic ? 
RelExpr9
:
R_RELAX_GOT_PC_NOPIC9
;
386
18
}
387
388
// A subset of relaxations can only be applied for no-PIC. This method
389
// handles such relaxations. Instructions encoding information was taken from:
390
// "Intel 64 and IA-32 Architectures Software Developer's Manual V2"
391
// (http://www.intel.com/content/dam/www/public/us/en/documents/manuals/
392
//    64-ia-32-architectures-software-developer-instruction-set-reference-manual-325383.pdf)
393
static void relaxGotNoPic(uint8_t *Loc, uint64_t Val, uint8_t Op,
394
9
                          uint8_t ModRm) {
395
9
  const uint8_t Rex = Loc[-3];
396
9
  // Convert "test %reg, foo@GOTPCREL(%rip)" to "test $foo, %reg".
397
9
  if (Op == 0x85) {
398
1
    // See "TEST-Logical Compare" (4-428 Vol. 2B),
399
1
    // TEST r/m64, r64 uses "full" ModR / M byte (no opcode extension).
400
1
401
1
    // ModR/M byte has form XX YYY ZZZ, where
402
1
    // YYY is MODRM.reg(register 2), ZZZ is MODRM.rm(register 1).
403
1
    // XX has different meanings:
404
1
    // 00: The operand's memory address is in reg1.
405
1
    // 01: The operand's memory address is reg1 + a byte-sized displacement.
406
1
    // 10: The operand's memory address is reg1 + a word-sized displacement.
407
1
    // 11: The operand is reg1 itself.
408
1
    // If an instruction requires only one operand, the unused reg2 field
409
1
    // holds extra opcode bits rather than a register code
410
1
    // 0xC0 == 11 000 000 binary.
411
1
    // 0x38 == 00 111 000 binary.
412
1
    // We transfer reg2 to reg1 here as operand.
413
1
    // See "2.1.3 ModR/M and SIB Bytes" (Vol. 2A 2-3).
414
1
    Loc[-1] = 0xc0 | (ModRm & 0x38) >> 3; // ModR/M byte.
415
1
416
1
    // Change opcode from TEST r/m64, r64 to TEST r/m64, imm32
417
1
    // See "TEST-Logical Compare" (4-428 Vol. 2B).
418
1
    Loc[-2] = 0xf7;
419
1
420
1
    // Move R bit to the B bit in REX byte.
421
1
    // REX byte is encoded as 0100WRXB, where
422
1
    // 0100 is 4bit fixed pattern.
423
1
    // REX.W When 1, a 64-bit operand size is used. Otherwise, when 0, the
424
1
    //   default operand size is used (which is 32-bit for most but not all
425
1
    //   instructions).
426
1
    // REX.R This 1-bit value is an extension to the MODRM.reg field.
427
1
    // REX.X This 1-bit value is an extension to the SIB.index field.
428
1
    // REX.B This 1-bit value is an extension to the MODRM.rm field or the
429
1
    // SIB.base field.
430
1
    // See "2.2.1.2 More on REX Prefix Fields " (2-8 Vol. 2A).
431
1
    Loc[-3] = (Rex & ~0x4) | (Rex & 0x4) >> 2;
432
1
    write32le(Loc, Val);
433
1
    return;
434
1
  }
435
8
436
8
  // If we are here then we need to relax the adc, add, and, cmp, or, sbb, sub
437
8
  // or xor operations.
438
8
439
8
  // Convert "binop foo@GOTPCREL(%rip), %reg" to "binop $foo, %reg".
440
8
  // Logic is close to one for test instruction above, but we also
441
8
  // write opcode extension here, see below for details.
442
8
  Loc[-1] = 0xc0 | (ModRm & 0x38) >> 3 | (Op & 0x3c); // ModR/M byte.
443
8
444
8
  // Primary opcode is 0x81, opcode extension is one of:
445
8
  // 000b = ADD, 001b is OR, 010b is ADC, 011b is SBB,
446
8
  // 100b is AND, 101b is SUB, 110b is XOR, 111b is CMP.
447
8
  // This value was wrote to MODRM.reg in a line above.
448
8
  // See "3.2 INSTRUCTIONS (A-M)" (Vol. 2A 3-15),
449
8
  // "INSTRUCTION SET REFERENCE, N-Z" (Vol. 2B 4-1) for
450
8
  // descriptions about each operation.
451
8
  Loc[-2] = 0x81;
452
8
  Loc[-3] = (Rex & ~0x4) | (Rex & 0x4) >> 2;
453
8
  write32le(Loc, Val);
454
8
}
455
456
32
void X86_64::relaxGot(uint8_t *Loc, RelType Type, uint64_t Val) const {
457
32
  const uint8_t Op = Loc[-2];
458
32
  const uint8_t ModRm = Loc[-1];
459
32
460
32
  // Convert "mov foo@GOTPCREL(%rip),%reg" to "lea foo(%rip),%reg".
461
32
  if (Op == 0x8b) {
462
15
    Loc[-2] = 0x8d;
463
15
    write32le(Loc, Val);
464
15
    return;
465
15
  }
466
17
467
17
  if (Op != 0xff) {
468
9
    // We are relaxing a rip relative to an absolute, so compensate
469
9
    // for the old -4 addend.
470
9
    assert(!Config->Pic);
471
9
    relaxGotNoPic(Loc, Val + 4, Op, ModRm);
472
9
    return;
473
9
  }
474
8
475
8
  // Convert call/jmp instructions.
476
8
  if (ModRm == 0x15) {
477
4
    // ABI says we can convert "call *foo@GOTPCREL(%rip)" to "nop; call foo".
478
4
    // Instead we convert to "addr32 call foo" where addr32 is an instruction
479
4
    // prefix. That makes result expression to be a single instruction.
480
4
    Loc[-2] = 0x67; // addr32 prefix
481
4
    Loc[-1] = 0xe8; // call
482
4
    write32le(Loc, Val);
483
4
    return;
484
4
  }
485
4
486
4
  // Convert "jmp *foo@GOTPCREL(%rip)" to "jmp foo; nop".
487
4
  // jmp doesn't return, so it is fine to use nop here, it is just a stub.
488
4
  assert(ModRm == 0x25);
489
4
  Loc[-2] = 0xe9; // jmp
490
4
  Loc[3] = 0x90;  // nop
491
4
  write32le(Loc - 1, Val + 1);
492
4
}
493
494
// A split-stack prologue starts by checking the amount of stack remaining
495
// in one of two ways:
496
// A) Comparing of the stack pointer to a field in the tcb.
497
// B) Or a load of a stack pointer offset with an lea to r10 or r11.
498
bool X86_64::adjustPrologueForCrossSplitStack(uint8_t *Loc, uint8_t *End,
499
7
                                              uint8_t StOther) const {
500
7
  if (!Config->Is64) {
501
0
    error("Target doesn't support split stacks.");
502
0
    return false;
503
0
  }
504
7
505
7
  if (Loc + 8 >= End)
506
0
    return false;
507
7
508
7
  // Replace "cmp %fs:0x70,%rsp" and subsequent branch
509
7
  // with "stc, nopl 0x0(%rax,%rax,1)"
510
7
  if (memcmp(Loc, "\x64\x48\x3b\x24\x25", 5) == 0) {
511
2
    memcpy(Loc, "\xf9\x0f\x1f\x84\x00\x00\x00\x00", 8);
512
2
    return true;
513
2
  }
514
5
515
5
  // Adjust "lea X(%rsp),%rYY" to lea "(X - 0x4000)(%rsp),%rYY" where rYY could
516
5
  // be r10 or r11. The lea instruction feeds a subsequent compare which checks
517
5
  // if there is X available stack space. Making X larger effectively reserves
518
5
  // that much additional space. The stack grows downward so subtract the value.
519
5
  if (memcmp(Loc, "\x4c\x8d\x94\x24", 4) == 0 ||
520
5
      
memcmp(Loc, "\x4c\x8d\x9c\x24", 4) == 04
) {
521
2
    // The offset bytes are encoded four bytes after the start of the
522
2
    // instruction.
523
2
    write32le(Loc + 4, read32le(Loc + 4) - 0x4000);
524
2
    return true;
525
2
  }
526
3
  return false;
527
3
}
528
529
// These nonstandard PLT entries are to migtigate Spectre v2 security
530
// vulnerability. In order to mitigate Spectre v2, we want to avoid indirect
531
// branch instructions such as `jmp *GOTPLT(%rip)`. So, in the following PLT
532
// entries, we use a CALL followed by MOV and RET to do the same thing as an
533
// indirect jump. That instruction sequence is so-called "retpoline".
534
//
535
// We have two types of retpoline PLTs as a size optimization. If `-z now`
536
// is specified, all dynamic symbols are resolved at load-time. Thus, when
537
// that option is given, we can omit code for symbol lazy resolution.
538
namespace {
539
class Retpoline : public X86_64 {
540
public:
541
  Retpoline();
542
  void writeGotPlt(uint8_t *Buf, const Symbol &S) const override;
543
  void writePltHeader(uint8_t *Buf) const override;
544
  void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
545
                int32_t Index, unsigned RelOff) const override;
546
};
547
548
class RetpolineZNow : public X86_64 {
549
public:
550
  RetpolineZNow();
551
5
  void writeGotPlt(uint8_t *Buf, const Symbol &S) const override {}
552
  void writePltHeader(uint8_t *Buf) const override;
553
  void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
554
                int32_t Index, unsigned RelOff) const override;
555
};
556
} // namespace
557
558
4
Retpoline::Retpoline() {
559
4
  PltHeaderSize = 48;
560
4
  PltEntrySize = 32;
561
4
}
562
563
6
void Retpoline::writeGotPlt(uint8_t *Buf, const Symbol &S) const {
564
6
  write64le(Buf, S.getPltVA() + 17);
565
6
}
566
567
4
void Retpoline::writePltHeader(uint8_t *Buf) const {
568
4
  const uint8_t Insn[] = {
569
4
      0xff, 0x35, 0,    0,    0,    0,          // 0:    pushq GOTPLT+8(%rip)
570
4
      0x4c, 0x8b, 0x1d, 0,    0,    0,    0,    // 6:    mov GOTPLT+16(%rip), %r11
571
4
      0xe8, 0x0e, 0x00, 0x00, 0x00,             // d:    callq next
572
4
      0xf3, 0x90,                               // 12: loop: pause
573
4
      0x0f, 0xae, 0xe8,                         // 14:   lfence
574
4
      0xeb, 0xf9,                               // 17:   jmp loop
575
4
      0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 19:   int3; .align 16
576
4
      0x4c, 0x89, 0x1c, 0x24,                   // 20: next: mov %r11, (%rsp)
577
4
      0xc3,                                     // 24:   ret
578
4
      0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 25:   int3; padding
579
4
      0xcc, 0xcc, 0xcc, 0xcc,                   // 2c:   int3; padding
580
4
  };
581
4
  memcpy(Buf, Insn, sizeof(Insn));
582
4
583
4
  uint64_t GotPlt = In.GotPlt->getVA();
584
4
  uint64_t Plt = In.Plt->getVA();
585
4
  write32le(Buf + 2, GotPlt - Plt - 6 + 8);
586
4
  write32le(Buf + 9, GotPlt - Plt - 13 + 16);
587
4
}
588
589
void Retpoline::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
590
                         uint64_t PltEntryAddr, int32_t Index,
591
6
                         unsigned RelOff) const {
592
6
  const uint8_t Insn[] = {
593
6
      0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // 0:  mov foo@GOTPLT(%rip), %r11
594
6
      0xe8, 0,    0,    0,    0,    // 7:  callq plt+0x20
595
6
      0xe9, 0,    0,    0,    0,    // c:  jmp plt+0x12
596
6
      0x68, 0,    0,    0,    0,    // 11: pushq <relocation index>
597
6
      0xe9, 0,    0,    0,    0,    // 16: jmp plt+0
598
6
      0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1b: int3; padding
599
6
  };
600
6
  memcpy(Buf, Insn, sizeof(Insn));
601
6
602
6
  uint64_t Off = PltHeaderSize + PltEntrySize * Index;
603
6
604
6
  write32le(Buf + 3, GotPltEntryAddr - PltEntryAddr - 7);
605
6
  write32le(Buf + 8, -Off - 12 + 32);
606
6
  write32le(Buf + 13, -Off - 17 + 18);
607
6
  write32le(Buf + 18, Index);
608
6
  write32le(Buf + 23, -Off - 27);
609
6
}
610
611
3
RetpolineZNow::RetpolineZNow() {
612
3
  PltHeaderSize = 32;
613
3
  PltEntrySize = 16;
614
3
}
615
616
3
void RetpolineZNow::writePltHeader(uint8_t *Buf) const {
617
3
  const uint8_t Insn[] = {
618
3
      0xe8, 0x0b, 0x00, 0x00, 0x00, // 0:    call next
619
3
      0xf3, 0x90,                   // 5:  loop: pause
620
3
      0x0f, 0xae, 0xe8,             // 7:    lfence
621
3
      0xeb, 0xf9,                   // a:    jmp loop
622
3
      0xcc, 0xcc, 0xcc, 0xcc,       // c:    int3; .align 16
623
3
      0x4c, 0x89, 0x1c, 0x24,       // 10: next: mov %r11, (%rsp)
624
3
      0xc3,                         // 14:   ret
625
3
      0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 15:   int3; padding
626
3
      0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1a:   int3; padding
627
3
      0xcc,                         // 1f:   int3; padding
628
3
  };
629
3
  memcpy(Buf, Insn, sizeof(Insn));
630
3
}
631
632
void RetpolineZNow::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
633
                             uint64_t PltEntryAddr, int32_t Index,
634
5
                             unsigned RelOff) const {
635
5
  const uint8_t Insn[] = {
636
5
      0x4c, 0x8b, 0x1d, 0,    0, 0, 0, // mov foo@GOTPLT(%rip), %r11
637
5
      0xe9, 0,    0,    0,    0,       // jmp plt+0
638
5
      0xcc, 0xcc, 0xcc, 0xcc,          // int3; padding
639
5
  };
640
5
  memcpy(Buf, Insn, sizeof(Insn));
641
5
642
5
  write32le(Buf + 3, GotPltEntryAddr - PltEntryAddr - 7);
643
5
  write32le(Buf + 8, -PltHeaderSize - PltEntrySize * Index - 12);
644
5
}
645
646
1.83k
static TargetInfo *getTargetInfo() {
647
1.83k
  if (Config->ZRetpolineplt) {
648
7
    if (Config->ZNow) {
649
3
      static RetpolineZNow T;
650
3
      return &T;
651
3
    }
652
4
    static Retpoline T;
653
4
    return &T;
654
4
  }
655
1.82k
656
1.82k
  static X86_64 T;
657
1.82k
  return &T;
658
1.82k
}
659
660
1.83k
TargetInfo *elf::getX86_64TargetInfo() { return getTargetInfo(); }