Coverage Report

Created: 2019-07-24 05:18

/Users/buildslave/jenkins/workspace/clang-stage2-coverage-R/llvm/tools/lld/ELF/Arch/X86_64.cpp
Line
Count
Source (jump to first uncovered line)
1
//===- X86_64.cpp ---------------------------------------------------------===//
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
9
#include "InputFiles.h"
10
#include "Symbols.h"
11
#include "SyntheticSections.h"
12
#include "Target.h"
13
#include "lld/Common/ErrorHandler.h"
14
#include "llvm/Object/ELF.h"
15
#include "llvm/Support/Endian.h"
16
17
using namespace llvm;
18
using namespace llvm::object;
19
using namespace llvm::support::endian;
20
using namespace llvm::ELF;
21
using namespace lld;
22
using namespace lld::elf;
23
24
namespace {
25
class X86_64 : public TargetInfo {
26
public:
27
  X86_64();
28
  int getTlsGdRelaxSkip(RelType type) const override;
29
  RelExpr getRelExpr(RelType type, const Symbol &s,
30
                     const uint8_t *loc) const override;
31
  RelType getDynRel(RelType type) const override;
32
  void writeGotPltHeader(uint8_t *buf) const override;
33
  void writeGotPlt(uint8_t *buf, const Symbol &s) const override;
34
  void writePltHeader(uint8_t *buf) const override;
35
  void writePlt(uint8_t *buf, uint64_t gotPltEntryAddr, uint64_t pltEntryAddr,
36
                int32_t index, unsigned relOff) const override;
37
  void relocateOne(uint8_t *loc, RelType type, uint64_t val) const override;
38
39
  RelExpr adjustRelaxExpr(RelType type, const uint8_t *data,
40
                          RelExpr expr) const override;
41
  void relaxGot(uint8_t *loc, RelType type, uint64_t val) const override;
42
  void relaxTlsGdToIe(uint8_t *loc, RelType type, uint64_t val) const override;
43
  void relaxTlsGdToLe(uint8_t *loc, RelType type, uint64_t val) const override;
44
  void relaxTlsIeToLe(uint8_t *loc, RelType type, uint64_t val) const override;
45
  void relaxTlsLdToLe(uint8_t *loc, RelType type, uint64_t val) const override;
46
  bool adjustPrologueForCrossSplitStack(uint8_t *loc, uint8_t *end,
47
                                        uint8_t stOther) const override;
48
};
49
} // namespace
50
51
1.92k
X86_64::X86_64() {
52
1.92k
  copyRel = R_X86_64_COPY;
53
1.92k
  gotRel = R_X86_64_GLOB_DAT;
54
1.92k
  noneRel = R_X86_64_NONE;
55
1.92k
  pltRel = R_X86_64_JUMP_SLOT;
56
1.92k
  relativeRel = R_X86_64_RELATIVE;
57
1.92k
  iRelativeRel = R_X86_64_IRELATIVE;
58
1.92k
  symbolicRel = R_X86_64_64;
59
1.92k
  tlsDescRel = R_X86_64_TLSDESC;
60
1.92k
  tlsGotRel = R_X86_64_TPOFF64;
61
1.92k
  tlsModuleIndexRel = R_X86_64_DTPMOD64;
62
1.92k
  tlsOffsetRel = R_X86_64_DTPOFF64;
63
1.92k
  pltEntrySize = 16;
64
1.92k
  pltHeaderSize = 16;
65
1.92k
  trapInstr = {0xcc, 0xcc, 0xcc, 0xcc}; // 0xcc = INT3
66
1.92k
67
1.92k
  // Align to the large page size (known as a superpage or huge page).
68
1.92k
  // FreeBSD automatically promotes large, superpage-aligned allocations.
69
1.92k
  defaultImageBase = 0x200000;
70
1.92k
}
71
72
26
int X86_64::getTlsGdRelaxSkip(RelType type) const { return 2; }
73
74
RelExpr X86_64::getRelExpr(RelType type, const Symbol &s,
75
1.54k
                           const uint8_t *loc) const {
76
1.54k
  if (type == R_X86_64_GOTTPOFF)
77
39
    config->hasStaticTlsModel = true;
78
1.54k
79
1.54k
  switch (type) {
80
1.54k
  case R_X86_64_8:
81
589
  case R_X86_64_16:
82
589
  case R_X86_64_32:
83
589
  case R_X86_64_32S:
84
589
  case R_X86_64_64:
85
589
    return R_ABS;
86
589
  case R_X86_64_DTPOFF32:
87
20
  case R_X86_64_DTPOFF64:
88
20
    return R_DTPREL;
89
20
  case R_X86_64_TPOFF32:
90
10
    return R_TLS;
91
20
  case R_X86_64_TLSDESC_CALL:
92
3
    return R_TLSDESC_CALL;
93
20
  case R_X86_64_TLSLD:
94
9
    return R_TLSLD_PC;
95
20
  case R_X86_64_TLSGD:
96
20
    return R_TLSGD_PC;
97
37
  case R_X86_64_SIZE32:
98
37
  case R_X86_64_SIZE64:
99
37
    return R_SIZE;
100
463
  case R_X86_64_PLT32:
101
463
    return R_PLT_PC;
102
216
  case R_X86_64_PC8:
103
216
  case R_X86_64_PC16:
104
216
  case R_X86_64_PC32:
105
216
  case R_X86_64_PC64:
106
216
    return R_PC;
107
216
  case R_X86_64_GOT32:
108
4
  case R_X86_64_GOT64:
109
4
    return R_GOTPLT;
110
10
  case R_X86_64_GOTPC32_TLSDESC:
111
10
    return R_TLSDESC_PC;
112
156
  case R_X86_64_GOTPCREL:
113
156
  case R_X86_64_GOTPCRELX:
114
156
  case R_X86_64_REX_GOTPCRELX:
115
156
  case R_X86_64_GOTTPOFF:
116
156
    return R_GOT_PC;
117
156
  case R_X86_64_GOTOFF64:
118
1
    return R_GOTPLTREL;
119
156
  case R_X86_64_GOTPC32:
120
2
  case R_X86_64_GOTPC64:
121
2
    return R_GOTPLTONLY_PC;
122
5
  case R_X86_64_NONE:
123
5
    return R_NONE;
124
2
  default:
125
2
    error(getErrorLocation(loc) + "unknown relocation (" + Twine(type) +
126
2
          ") against symbol " + toString(s));
127
2
    return R_NONE;
128
1.54k
  }
129
1.54k
}
130
131
172
void X86_64::writeGotPltHeader(uint8_t *buf) const {
132
172
  // The first entry holds the value of _DYNAMIC. It is not clear why that is
133
172
  // required, but it is documented in the psabi and the glibc dynamic linker
134
172
  // seems to use it (note that this is relevant for linking ld.so, not any
135
172
  // other program).
136
172
  write64le(buf, mainPart->dynamic->getVA());
137
172
}
138
139
217
void X86_64::writeGotPlt(uint8_t *buf, const Symbol &s) const {
140
217
  // See comments in X86::writeGotPlt.
141
217
  write64le(buf, s.getPltVA() + 6);
142
217
}
143
144
148
void X86_64::writePltHeader(uint8_t *buf) const {
145
148
  const uint8_t pltData[] = {
146
148
      0xff, 0x35, 0, 0, 0, 0, // pushq GOTPLT+8(%rip)
147
148
      0xff, 0x25, 0, 0, 0, 0, // jmp *GOTPLT+16(%rip)
148
148
      0x0f, 0x1f, 0x40, 0x00, // nop
149
148
  };
150
148
  memcpy(buf, pltData, sizeof(pltData));
151
148
  uint64_t gotPlt = in.gotPlt->getVA();
152
148
  uint64_t plt = in.plt->getVA();
153
148
  write32le(buf + 2, gotPlt - plt + 2); // GOTPLT+8
154
148
  write32le(buf + 8, gotPlt - plt + 4); // GOTPLT+16
155
148
}
156
157
void X86_64::writePlt(uint8_t *buf, uint64_t gotPltEntryAddr,
158
                      uint64_t pltEntryAddr, int32_t index,
159
217
                      unsigned relOff) const {
160
217
  const uint8_t inst[] = {
161
217
      0xff, 0x25, 0, 0, 0, 0, // jmpq *got(%rip)
162
217
      0x68, 0, 0, 0, 0,       // pushq <relocation index>
163
217
      0xe9, 0, 0, 0, 0,       // jmpq plt[0]
164
217
  };
165
217
  memcpy(buf, inst, sizeof(inst));
166
217
167
217
  write32le(buf + 2, gotPltEntryAddr - pltEntryAddr - 6);
168
217
  write32le(buf + 7, index);
169
217
  write32le(buf + 12, -pltHeaderSize - pltEntrySize * index - 16);
170
217
}
171
172
168
RelType X86_64::getDynRel(RelType type) const {
173
168
  if (type == R_X86_64_64 || 
type == R_X86_64_PC6438
||
type == R_X86_64_SIZE3235
||
174
168
      
type == R_X86_64_SIZE6429
)
175
145
    return type;
176
23
  return R_X86_64_NONE;
177
23
}
178
179
13
void X86_64::relaxTlsGdToLe(uint8_t *loc, RelType type, uint64_t val) const {
180
13
  if (type == R_X86_64_TLSGD) {
181
8
    // Convert
182
8
    //   .byte 0x66
183
8
    //   leaq x@tlsgd(%rip), %rdi
184
8
    //   .word 0x6666
185
8
    //   rex64
186
8
    //   call __tls_get_addr@plt
187
8
    // to the following two instructions.
188
8
    const uint8_t inst[] = {
189
8
        0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00,
190
8
        0x00, 0x00,                            // mov %fs:0x0,%rax
191
8
        0x48, 0x8d, 0x80, 0,    0,    0,    0, // lea x@tpoff,%rax
192
8
    };
193
8
    memcpy(loc - 4, inst, sizeof(inst));
194
8
195
8
    // The original code used a pc relative relocation and so we have to
196
8
    // compensate for the -4 in had in the addend.
197
8
    write32le(loc + 8, val + 4);
198
8
  } else {
199
5
    // Convert
200
5
    //   lea x@tlsgd(%rip), %rax
201
5
    //   call *(%rax)
202
5
    // to the following two instructions.
203
5
    assert(type == R_X86_64_GOTPC32_TLSDESC);
204
5
    if (memcmp(loc - 3, "\x48\x8d\x05", 3)) {
205
1
      error(getErrorLocation(loc - 3) + "R_X86_64_GOTPC32_TLSDESC must be used "
206
1
                                        "in callq *x@tlsdesc(%rip), %rax");
207
1
      return;
208
1
    }
209
4
    // movq $x@tpoff(%rip),%rax
210
4
    loc[-2] = 0xc7;
211
4
    loc[-1] = 0xc0;
212
4
    write32le(loc, val + 4);
213
4
    // xchg ax,ax
214
4
    loc[4] = 0x66;
215
4
    loc[5] = 0x90;
216
4
  }
217
13
}
218
219
8
void X86_64::relaxTlsGdToIe(uint8_t *loc, RelType type, uint64_t val) const {
220
8
  if (type == R_X86_64_TLSGD) {
221
6
    // Convert
222
6
    //   .byte 0x66
223
6
    //   leaq x@tlsgd(%rip), %rdi
224
6
    //   .word 0x6666
225
6
    //   rex64
226
6
    //   call __tls_get_addr@plt
227
6
    // to the following two instructions.
228
6
    const uint8_t inst[] = {
229
6
        0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00,
230
6
        0x00, 0x00,                            // mov %fs:0x0,%rax
231
6
        0x48, 0x03, 0x05, 0,    0,    0,    0, // addq x@gottpoff(%rip),%rax
232
6
    };
233
6
    memcpy(loc - 4, inst, sizeof(inst));
234
6
235
6
    // Both code sequences are PC relatives, but since we are moving the
236
6
    // constant forward by 8 bytes we have to subtract the value by 8.
237
6
    write32le(loc + 8, val - 8);
238
6
  } else {
239
2
    // Convert
240
2
    //   lea x@tlsgd(%rip), %rax
241
2
    //   call *(%rax)
242
2
    // to the following two instructions.
243
2
    assert(type == R_X86_64_GOTPC32_TLSDESC);
244
2
    if (memcmp(loc - 3, "\x48\x8d\x05", 3)) {
245
1
      error(getErrorLocation(loc - 3) + "R_X86_64_GOTPC32_TLSDESC must be used "
246
1
                                        "in callq *x@tlsdesc(%rip), %rax");
247
1
      return;
248
1
    }
249
1
    // movq x@gottpoff(%rip),%rax
250
1
    loc[-2] = 0x8b;
251
1
    write32le(loc, val);
252
1
    // xchg ax,ax
253
1
    loc[4] = 0x66;
254
1
    loc[5] = 0x90;
255
1
  }
256
8
}
257
258
// In some conditions, R_X86_64_GOTTPOFF relocation can be optimized to
259
// R_X86_64_TPOFF32 so that it does not use GOT.
260
31
void X86_64::relaxTlsIeToLe(uint8_t *loc, RelType type, uint64_t val) const {
261
31
  uint8_t *inst = loc - 3;
262
31
  uint8_t reg = loc[-1] >> 3;
263
31
  uint8_t *regSlot = loc - 1;
264
31
265
31
  // Note that ADD with RSP or R12 is converted to ADD instead of LEA
266
31
  // because LEA with these registers needs 4 bytes to encode and thus
267
31
  // wouldn't fit the space.
268
31
269
31
  if (memcmp(inst, "\x48\x03\x25", 3) == 0) {
270
4
    // "addq foo@gottpoff(%rip),%rsp" -> "addq $foo,%rsp"
271
4
    memcpy(inst, "\x48\x81\xc4", 3);
272
27
  } else if (memcmp(inst, "\x4c\x03\x25", 3) == 0) {
273
4
    // "addq foo@gottpoff(%rip),%r12" -> "addq $foo,%r12"
274
4
    memcpy(inst, "\x49\x81\xc4", 3);
275
23
  } else if (memcmp(inst, "\x4c\x03", 2) == 0) {
276
4
    // "addq foo@gottpoff(%rip),%r[8-15]" -> "leaq foo(%r[8-15]),%r[8-15]"
277
4
    memcpy(inst, "\x4d\x8d", 2);
278
4
    *regSlot = 0x80 | (reg << 3) | reg;
279
19
  } else if (memcmp(inst, "\x48\x03", 2) == 0) {
280
4
    // "addq foo@gottpoff(%rip),%reg -> "leaq foo(%reg),%reg"
281
4
    memcpy(inst, "\x48\x8d", 2);
282
4
    *regSlot = 0x80 | (reg << 3) | reg;
283
15
  } else if (memcmp(inst, "\x4c\x8b", 2) == 0) {
284
4
    // "movq foo@gottpoff(%rip),%r[8-15]" -> "movq $foo,%r[8-15]"
285
4
    memcpy(inst, "\x49\xc7", 2);
286
4
    *regSlot = 0xc0 | reg;
287
11
  } else if (memcmp(inst, "\x48\x8b", 2) == 0) {
288
9
    // "movq foo@gottpoff(%rip),%reg" -> "movq $foo,%reg"
289
9
    memcpy(inst, "\x48\xc7", 2);
290
9
    *regSlot = 0xc0 | reg;
291
9
  } else {
292
2
    error(getErrorLocation(loc - 3) +
293
2
          "R_X86_64_GOTTPOFF must be used in MOVQ or ADDQ instructions only");
294
2
  }
295
31
296
31
  // The original code used a PC relative relocation.
297
31
  // Need to compensate for the -4 it had in the addend.
298
31
  write32le(loc, val + 4);
299
31
}
300
301
12
void X86_64::relaxTlsLdToLe(uint8_t *loc, RelType type, uint64_t val) const {
302
12
  if (type == R_X86_64_DTPOFF64) {
303
2
    write64le(loc, val);
304
2
    return;
305
2
  }
306
10
  if (type == R_X86_64_DTPOFF32) {
307
5
    write32le(loc, val);
308
5
    return;
309
5
  }
310
5
311
5
  const uint8_t inst[] = {
312
5
      0x66, 0x66,                                           // .word 0x6666
313
5
      0x66,                                                 // .byte 0x66
314
5
      0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 0x00, 0x00, // mov %fs:0,%rax
315
5
  };
316
5
317
5
  if (loc[4] == 0xe8) {
318
3
    // Convert
319
3
    //   leaq bar@tlsld(%rip), %rdi           # 48 8d 3d <Loc>
320
3
    //   callq __tls_get_addr@PLT             # e8 <disp32>
321
3
    //   leaq bar@dtpoff(%rax), %rcx
322
3
    // to
323
3
    //   .word 0x6666
324
3
    //   .byte 0x66
325
3
    //   mov %fs:0,%rax
326
3
    //   leaq bar@tpoff(%rax), %rcx
327
3
    memcpy(loc - 3, inst, sizeof(inst));
328
3
    return;
329
3
  }
330
2
331
2
  if (loc[4] == 0xff && loc[5] == 0x15) {
332
2
    // Convert
333
2
    //   leaq  x@tlsld(%rip),%rdi               # 48 8d 3d <Loc>
334
2
    //   call *__tls_get_addr@GOTPCREL(%rip)    # ff 15 <disp32>
335
2
    // to
336
2
    //   .long  0x66666666
337
2
    //   movq   %fs:0,%rax
338
2
    // See "Table 11.9: LD -> LE Code Transition (LP64)" in
339
2
    // https://raw.githubusercontent.com/wiki/hjl-tools/x86-psABI/x86-64-psABI-1.0.pdf
340
2
    loc[-3] = 0x66;
341
2
    memcpy(loc - 2, inst, sizeof(inst));
342
2
    return;
343
2
  }
344
0
345
0
  error(getErrorLocation(loc - 3) +
346
0
        "expected R_X86_64_PLT32 or R_X86_64_GOTPCRELX after R_X86_64_TLSLD");
347
0
}
348
349
1.24k
void X86_64::relocateOne(uint8_t *loc, RelType type, uint64_t val) const {
350
1.24k
  switch (type) {
351
1.24k
  case R_X86_64_8:
352
9
    checkIntUInt(loc, val, 8, type);
353
9
    *loc = val;
354
9
    break;
355
1.24k
  case R_X86_64_PC8:
356
2
    checkInt(loc, val, 8, type);
357
2
    *loc = val;
358
2
    break;
359
1.24k
  case R_X86_64_16:
360
7
    checkIntUInt(loc, val, 16, type);
361
7
    write16le(loc, val);
362
7
    break;
363
1.24k
  case R_X86_64_PC16:
364
2
    checkInt(loc, val, 16, type);
365
2
    write16le(loc, val);
366
2
    break;
367
1.24k
  case R_X86_64_32:
368
137
    checkUInt(loc, val, 32, type);
369
137
    write32le(loc, val);
370
137
    break;
371
1.24k
  case R_X86_64_32S:
372
829
  case R_X86_64_TPOFF32:
373
829
  case R_X86_64_GOT32:
374
829
  case R_X86_64_GOTPC32:
375
829
  case R_X86_64_GOTPC32_TLSDESC:
376
829
  case R_X86_64_GOTPCREL:
377
829
  case R_X86_64_GOTPCRELX:
378
829
  case R_X86_64_REX_GOTPCRELX:
379
829
  case R_X86_64_PC32:
380
829
  case R_X86_64_GOTTPOFF:
381
829
  case R_X86_64_PLT32:
382
829
  case R_X86_64_TLSGD:
383
829
  case R_X86_64_TLSLD:
384
829
  case R_X86_64_DTPOFF32:
385
829
  case R_X86_64_SIZE32:
386
829
    checkInt(loc, val, 32, type);
387
829
    write32le(loc, val);
388
829
    break;
389
829
  case R_X86_64_64:
390
256
  case R_X86_64_DTPOFF64:
391
256
  case R_X86_64_PC64:
392
256
  case R_X86_64_SIZE64:
393
256
  case R_X86_64_GOT64:
394
256
  case R_X86_64_GOTOFF64:
395
256
  case R_X86_64_GOTPC64:
396
256
    write64le(loc, val);
397
256
    break;
398
256
  default:
399
0
    llvm_unreachable("unknown relocation");
400
1.24k
  }
401
1.24k
}
402
403
RelExpr X86_64::adjustRelaxExpr(RelType type, const uint8_t *data,
404
85
                                RelExpr relExpr) const {
405
85
  if (type != R_X86_64_GOTPCRELX && 
type != R_X86_64_REX_GOTPCRELX77
)
406
44
    return relExpr;
407
41
  const uint8_t op = data[-2];
408
41
  const uint8_t modRm = data[-1];
409
41
410
41
  // FIXME: When PIC is disabled and foo is defined locally in the
411
41
  // lower 32 bit address space, memory operand in mov can be converted into
412
41
  // immediate operand. Otherwise, mov must be changed to lea. We support only
413
41
  // latter relaxation at this moment.
414
41
  if (op == 0x8b)
415
15
    return R_RELAX_GOT_PC;
416
26
417
26
  // Relax call and jmp.
418
26
  if (op == 0xff && 
(8
modRm == 0x158
||
modRm == 0x254
))
419
8
    return R_RELAX_GOT_PC;
420
18
421
18
  // Relaxation of test, adc, add, and, cmp, or, sbb, sub, xor.
422
18
  // If PIC then no relaxation is available.
423
18
  // We also don't relax test/binop instructions without REX byte,
424
18
  // they are 32bit operations and not common to have.
425
18
  assert(type == R_X86_64_REX_GOTPCRELX);
426
18
  return config->isPic ? 
relExpr9
:
R_RELAX_GOT_PC_NOPIC9
;
427
18
}
428
429
// A subset of relaxations can only be applied for no-PIC. This method
430
// handles such relaxations. Instructions encoding information was taken from:
431
// "Intel 64 and IA-32 Architectures Software Developer's Manual V2"
432
// (http://www.intel.com/content/dam/www/public/us/en/documents/manuals/
433
//    64-ia-32-architectures-software-developer-instruction-set-reference-manual-325383.pdf)
434
static void relaxGotNoPic(uint8_t *loc, uint64_t val, uint8_t op,
435
9
                          uint8_t modRm) {
436
9
  const uint8_t rex = loc[-3];
437
9
  // Convert "test %reg, foo@GOTPCREL(%rip)" to "test $foo, %reg".
438
9
  if (op == 0x85) {
439
1
    // See "TEST-Logical Compare" (4-428 Vol. 2B),
440
1
    // TEST r/m64, r64 uses "full" ModR / M byte (no opcode extension).
441
1
442
1
    // ModR/M byte has form XX YYY ZZZ, where
443
1
    // YYY is MODRM.reg(register 2), ZZZ is MODRM.rm(register 1).
444
1
    // XX has different meanings:
445
1
    // 00: The operand's memory address is in reg1.
446
1
    // 01: The operand's memory address is reg1 + a byte-sized displacement.
447
1
    // 10: The operand's memory address is reg1 + a word-sized displacement.
448
1
    // 11: The operand is reg1 itself.
449
1
    // If an instruction requires only one operand, the unused reg2 field
450
1
    // holds extra opcode bits rather than a register code
451
1
    // 0xC0 == 11 000 000 binary.
452
1
    // 0x38 == 00 111 000 binary.
453
1
    // We transfer reg2 to reg1 here as operand.
454
1
    // See "2.1.3 ModR/M and SIB Bytes" (Vol. 2A 2-3).
455
1
    loc[-1] = 0xc0 | (modRm & 0x38) >> 3; // ModR/M byte.
456
1
457
1
    // Change opcode from TEST r/m64, r64 to TEST r/m64, imm32
458
1
    // See "TEST-Logical Compare" (4-428 Vol. 2B).
459
1
    loc[-2] = 0xf7;
460
1
461
1
    // Move R bit to the B bit in REX byte.
462
1
    // REX byte is encoded as 0100WRXB, where
463
1
    // 0100 is 4bit fixed pattern.
464
1
    // REX.W When 1, a 64-bit operand size is used. Otherwise, when 0, the
465
1
    //   default operand size is used (which is 32-bit for most but not all
466
1
    //   instructions).
467
1
    // REX.R This 1-bit value is an extension to the MODRM.reg field.
468
1
    // REX.X This 1-bit value is an extension to the SIB.index field.
469
1
    // REX.B This 1-bit value is an extension to the MODRM.rm field or the
470
1
    // SIB.base field.
471
1
    // See "2.2.1.2 More on REX Prefix Fields " (2-8 Vol. 2A).
472
1
    loc[-3] = (rex & ~0x4) | (rex & 0x4) >> 2;
473
1
    write32le(loc, val);
474
1
    return;
475
1
  }
476
8
477
8
  // If we are here then we need to relax the adc, add, and, cmp, or, sbb, sub
478
8
  // or xor operations.
479
8
480
8
  // Convert "binop foo@GOTPCREL(%rip), %reg" to "binop $foo, %reg".
481
8
  // Logic is close to one for test instruction above, but we also
482
8
  // write opcode extension here, see below for details.
483
8
  loc[-1] = 0xc0 | (modRm & 0x38) >> 3 | (op & 0x3c); // ModR/M byte.
484
8
485
8
  // Primary opcode is 0x81, opcode extension is one of:
486
8
  // 000b = ADD, 001b is OR, 010b is ADC, 011b is SBB,
487
8
  // 100b is AND, 101b is SUB, 110b is XOR, 111b is CMP.
488
8
  // This value was wrote to MODRM.reg in a line above.
489
8
  // See "3.2 INSTRUCTIONS (A-M)" (Vol. 2A 3-15),
490
8
  // "INSTRUCTION SET REFERENCE, N-Z" (Vol. 2B 4-1) for
491
8
  // descriptions about each operation.
492
8
  loc[-2] = 0x81;
493
8
  loc[-3] = (rex & ~0x4) | (rex & 0x4) >> 2;
494
8
  write32le(loc, val);
495
8
}
496
497
32
void X86_64::relaxGot(uint8_t *loc, RelType type, uint64_t val) const {
498
32
  const uint8_t op = loc[-2];
499
32
  const uint8_t modRm = loc[-1];
500
32
501
32
  // Convert "mov foo@GOTPCREL(%rip),%reg" to "lea foo(%rip),%reg".
502
32
  if (op == 0x8b) {
503
15
    loc[-2] = 0x8d;
504
15
    write32le(loc, val);
505
15
    return;
506
15
  }
507
17
508
17
  if (op != 0xff) {
509
9
    // We are relaxing a rip relative to an absolute, so compensate
510
9
    // for the old -4 addend.
511
9
    assert(!config->isPic);
512
9
    relaxGotNoPic(loc, val + 4, op, modRm);
513
9
    return;
514
9
  }
515
8
516
8
  // Convert call/jmp instructions.
517
8
  if (modRm == 0x15) {
518
4
    // ABI says we can convert "call *foo@GOTPCREL(%rip)" to "nop; call foo".
519
4
    // Instead we convert to "addr32 call foo" where addr32 is an instruction
520
4
    // prefix. That makes result expression to be a single instruction.
521
4
    loc[-2] = 0x67; // addr32 prefix
522
4
    loc[-1] = 0xe8; // call
523
4
    write32le(loc, val);
524
4
    return;
525
4
  }
526
4
527
4
  // Convert "jmp *foo@GOTPCREL(%rip)" to "jmp foo; nop".
528
4
  // jmp doesn't return, so it is fine to use nop here, it is just a stub.
529
4
  assert(modRm == 0x25);
530
4
  loc[-2] = 0xe9; // jmp
531
4
  loc[3] = 0x90;  // nop
532
4
  write32le(loc - 1, val + 1);
533
4
}
534
535
// A split-stack prologue starts by checking the amount of stack remaining
536
// in one of two ways:
537
// A) Comparing of the stack pointer to a field in the tcb.
538
// B) Or a load of a stack pointer offset with an lea to r10 or r11.
539
bool X86_64::adjustPrologueForCrossSplitStack(uint8_t *loc, uint8_t *end,
540
7
                                              uint8_t stOther) const {
541
7
  if (!config->is64) {
542
0
    error("Target doesn't support split stacks.");
543
0
    return false;
544
0
  }
545
7
546
7
  if (loc + 8 >= end)
547
0
    return false;
548
7
549
7
  // Replace "cmp %fs:0x70,%rsp" and subsequent branch
550
7
  // with "stc, nopl 0x0(%rax,%rax,1)"
551
7
  if (memcmp(loc, "\x64\x48\x3b\x24\x25", 5) == 0) {
552
2
    memcpy(loc, "\xf9\x0f\x1f\x84\x00\x00\x00\x00", 8);
553
2
    return true;
554
2
  }
555
5
556
5
  // Adjust "lea X(%rsp),%rYY" to lea "(X - 0x4000)(%rsp),%rYY" where rYY could
557
5
  // be r10 or r11. The lea instruction feeds a subsequent compare which checks
558
5
  // if there is X available stack space. Making X larger effectively reserves
559
5
  // that much additional space. The stack grows downward so subtract the value.
560
5
  if (memcmp(loc, "\x4c\x8d\x94\x24", 4) == 0 ||
561
5
      
memcmp(loc, "\x4c\x8d\x9c\x24", 4) == 04
) {
562
2
    // The offset bytes are encoded four bytes after the start of the
563
2
    // instruction.
564
2
    write32le(loc + 4, read32le(loc + 4) - 0x4000);
565
2
    return true;
566
2
  }
567
3
  return false;
568
3
}
569
570
// These nonstandard PLT entries are to migtigate Spectre v2 security
571
// vulnerability. In order to mitigate Spectre v2, we want to avoid indirect
572
// branch instructions such as `jmp *GOTPLT(%rip)`. So, in the following PLT
573
// entries, we use a CALL followed by MOV and RET to do the same thing as an
574
// indirect jump. That instruction sequence is so-called "retpoline".
575
//
576
// We have two types of retpoline PLTs as a size optimization. If `-z now`
577
// is specified, all dynamic symbols are resolved at load-time. Thus, when
578
// that option is given, we can omit code for symbol lazy resolution.
579
namespace {
580
class Retpoline : public X86_64 {
581
public:
582
  Retpoline();
583
  void writeGotPlt(uint8_t *buf, const Symbol &s) const override;
584
  void writePltHeader(uint8_t *buf) const override;
585
  void writePlt(uint8_t *buf, uint64_t gotPltEntryAddr, uint64_t pltEntryAddr,
586
                int32_t index, unsigned relOff) const override;
587
};
588
589
class RetpolineZNow : public X86_64 {
590
public:
591
  RetpolineZNow();
592
5
  void writeGotPlt(uint8_t *buf, const Symbol &s) const override {}
593
  void writePltHeader(uint8_t *buf) const override;
594
  void writePlt(uint8_t *buf, uint64_t gotPltEntryAddr, uint64_t pltEntryAddr,
595
                int32_t index, unsigned relOff) const override;
596
};
597
} // namespace
598
599
4
Retpoline::Retpoline() {
600
4
  pltHeaderSize = 48;
601
4
  pltEntrySize = 32;
602
4
}
603
604
6
void Retpoline::writeGotPlt(uint8_t *buf, const Symbol &s) const {
605
6
  write64le(buf, s.getPltVA() + 17);
606
6
}
607
608
4
void Retpoline::writePltHeader(uint8_t *buf) const {
609
4
  const uint8_t insn[] = {
610
4
      0xff, 0x35, 0,    0,    0,    0,          // 0:    pushq GOTPLT+8(%rip)
611
4
      0x4c, 0x8b, 0x1d, 0,    0,    0,    0,    // 6:    mov GOTPLT+16(%rip), %r11
612
4
      0xe8, 0x0e, 0x00, 0x00, 0x00,             // d:    callq next
613
4
      0xf3, 0x90,                               // 12: loop: pause
614
4
      0x0f, 0xae, 0xe8,                         // 14:   lfence
615
4
      0xeb, 0xf9,                               // 17:   jmp loop
616
4
      0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 19:   int3; .align 16
617
4
      0x4c, 0x89, 0x1c, 0x24,                   // 20: next: mov %r11, (%rsp)
618
4
      0xc3,                                     // 24:   ret
619
4
      0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 25:   int3; padding
620
4
      0xcc, 0xcc, 0xcc, 0xcc,                   // 2c:   int3; padding
621
4
  };
622
4
  memcpy(buf, insn, sizeof(insn));
623
4
624
4
  uint64_t gotPlt = in.gotPlt->getVA();
625
4
  uint64_t plt = in.plt->getVA();
626
4
  write32le(buf + 2, gotPlt - plt - 6 + 8);
627
4
  write32le(buf + 9, gotPlt - plt - 13 + 16);
628
4
}
629
630
void Retpoline::writePlt(uint8_t *buf, uint64_t gotPltEntryAddr,
631
                         uint64_t pltEntryAddr, int32_t index,
632
6
                         unsigned relOff) const {
633
6
  const uint8_t insn[] = {
634
6
      0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // 0:  mov foo@GOTPLT(%rip), %r11
635
6
      0xe8, 0,    0,    0,    0,    // 7:  callq plt+0x20
636
6
      0xe9, 0,    0,    0,    0,    // c:  jmp plt+0x12
637
6
      0x68, 0,    0,    0,    0,    // 11: pushq <relocation index>
638
6
      0xe9, 0,    0,    0,    0,    // 16: jmp plt+0
639
6
      0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1b: int3; padding
640
6
  };
641
6
  memcpy(buf, insn, sizeof(insn));
642
6
643
6
  uint64_t off = pltHeaderSize + pltEntrySize * index;
644
6
645
6
  write32le(buf + 3, gotPltEntryAddr - pltEntryAddr - 7);
646
6
  write32le(buf + 8, -off - 12 + 32);
647
6
  write32le(buf + 13, -off - 17 + 18);
648
6
  write32le(buf + 18, index);
649
6
  write32le(buf + 23, -off - 27);
650
6
}
651
652
3
RetpolineZNow::RetpolineZNow() {
653
3
  pltHeaderSize = 32;
654
3
  pltEntrySize = 16;
655
3
}
656
657
3
void RetpolineZNow::writePltHeader(uint8_t *buf) const {
658
3
  const uint8_t insn[] = {
659
3
      0xe8, 0x0b, 0x00, 0x00, 0x00, // 0:    call next
660
3
      0xf3, 0x90,                   // 5:  loop: pause
661
3
      0x0f, 0xae, 0xe8,             // 7:    lfence
662
3
      0xeb, 0xf9,                   // a:    jmp loop
663
3
      0xcc, 0xcc, 0xcc, 0xcc,       // c:    int3; .align 16
664
3
      0x4c, 0x89, 0x1c, 0x24,       // 10: next: mov %r11, (%rsp)
665
3
      0xc3,                         // 14:   ret
666
3
      0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 15:   int3; padding
667
3
      0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1a:   int3; padding
668
3
      0xcc,                         // 1f:   int3; padding
669
3
  };
670
3
  memcpy(buf, insn, sizeof(insn));
671
3
}
672
673
void RetpolineZNow::writePlt(uint8_t *buf, uint64_t gotPltEntryAddr,
674
                             uint64_t pltEntryAddr, int32_t index,
675
5
                             unsigned relOff) const {
676
5
  const uint8_t insn[] = {
677
5
      0x4c, 0x8b, 0x1d, 0,    0, 0, 0, // mov foo@GOTPLT(%rip), %r11
678
5
      0xe9, 0,    0,    0,    0,       // jmp plt+0
679
5
      0xcc, 0xcc, 0xcc, 0xcc,          // int3; padding
680
5
  };
681
5
  memcpy(buf, insn, sizeof(insn));
682
5
683
5
  write32le(buf + 3, gotPltEntryAddr - pltEntryAddr - 7);
684
5
  write32le(buf + 8, -pltHeaderSize - pltEntrySize * index - 12);
685
5
}
686
687
3.76k
static TargetInfo *getTargetInfo() {
688
3.76k
  if (config->zRetpolineplt) {
689
14
    if (config->zNow) {
690
6
      static RetpolineZNow t;
691
6
      return &t;
692
6
    }
693
8
    static Retpoline t;
694
8
    return &t;
695
8
  }
696
3.75k
697
3.75k
  static X86_64 t;
698
3.75k
  return &t;
699
3.75k
}
700
701
3.76k
TargetInfo *elf::getX86_64TargetInfo() { return getTargetInfo(); }