forked from OSchip/llvm-project
585 lines
20 KiB
C++
585 lines
20 KiB
C++
//===- X86_64.cpp ---------------------------------------------------------===//
|
|
//
|
|
// The LLVM Linker
|
|
//
|
|
// This file is distributed under the University of Illinois Open Source
|
|
// License. See LICENSE.TXT for details.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "InputFiles.h"
|
|
#include "Symbols.h"
|
|
#include "SyntheticSections.h"
|
|
#include "Target.h"
|
|
#include "lld/Common/ErrorHandler.h"
|
|
#include "llvm/Object/ELF.h"
|
|
#include "llvm/Support/Endian.h"
|
|
|
|
using namespace llvm;
|
|
using namespace llvm::object;
|
|
using namespace llvm::support::endian;
|
|
using namespace llvm::ELF;
|
|
using namespace lld;
|
|
using namespace lld::elf;
|
|
|
|
namespace {
|
|
template <class ELFT> class X86_64 : public TargetInfo {
|
|
public:
|
|
X86_64();
|
|
RelExpr getRelExpr(RelType Type, const Symbol &S,
|
|
const uint8_t *Loc) const override;
|
|
bool isPicRel(RelType Type) const override;
|
|
void writeGotPltHeader(uint8_t *Buf) const override;
|
|
void writeGotPlt(uint8_t *Buf, const Symbol &S) const override;
|
|
void writePltHeader(uint8_t *Buf) const override;
|
|
void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
|
|
int32_t Index, unsigned RelOff) const override;
|
|
void relocateOne(uint8_t *Loc, RelType Type, uint64_t Val) const override;
|
|
|
|
RelExpr adjustRelaxExpr(RelType Type, const uint8_t *Data,
|
|
RelExpr Expr) const override;
|
|
void relaxGot(uint8_t *Loc, uint64_t Val) const override;
|
|
void relaxTlsGdToIe(uint8_t *Loc, RelType Type, uint64_t Val) const override;
|
|
void relaxTlsGdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override;
|
|
void relaxTlsIeToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override;
|
|
void relaxTlsLdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override;
|
|
|
|
private:
|
|
void relaxGotNoPic(uint8_t *Loc, uint64_t Val, uint8_t Op,
|
|
uint8_t ModRm) const;
|
|
};
|
|
} // namespace
|
|
|
|
template <class ELFT> X86_64<ELFT>::X86_64() {
|
|
GotBaseSymOff = -1;
|
|
CopyRel = R_X86_64_COPY;
|
|
GotRel = R_X86_64_GLOB_DAT;
|
|
PltRel = R_X86_64_JUMP_SLOT;
|
|
RelativeRel = R_X86_64_RELATIVE;
|
|
IRelativeRel = R_X86_64_IRELATIVE;
|
|
TlsGotRel = R_X86_64_TPOFF64;
|
|
TlsModuleIndexRel = R_X86_64_DTPMOD64;
|
|
TlsOffsetRel = R_X86_64_DTPOFF64;
|
|
GotEntrySize = 8;
|
|
GotPltEntrySize = 8;
|
|
PltEntrySize = 16;
|
|
PltHeaderSize = 16;
|
|
TlsGdRelaxSkip = 2;
|
|
TrapInstr = 0xcccccccc; // 0xcc = INT3
|
|
|
|
// Align to the large page size (known as a superpage or huge page).
|
|
// FreeBSD automatically promotes large, superpage-aligned allocations.
|
|
DefaultImageBase = 0x200000;
|
|
}
|
|
|
|
template <class ELFT>
|
|
RelExpr X86_64<ELFT>::getRelExpr(RelType Type, const Symbol &S,
|
|
const uint8_t *Loc) const {
|
|
switch (Type) {
|
|
case R_X86_64_8:
|
|
case R_X86_64_16:
|
|
case R_X86_64_32:
|
|
case R_X86_64_32S:
|
|
case R_X86_64_64:
|
|
case R_X86_64_DTPOFF32:
|
|
case R_X86_64_DTPOFF64:
|
|
return R_ABS;
|
|
case R_X86_64_TPOFF32:
|
|
return R_TLS;
|
|
case R_X86_64_TLSLD:
|
|
return R_TLSLD_PC;
|
|
case R_X86_64_TLSGD:
|
|
return R_TLSGD_PC;
|
|
case R_X86_64_SIZE32:
|
|
case R_X86_64_SIZE64:
|
|
return R_SIZE;
|
|
case R_X86_64_PLT32:
|
|
return R_PLT_PC;
|
|
case R_X86_64_PC32:
|
|
case R_X86_64_PC64:
|
|
return R_PC;
|
|
case R_X86_64_GOT32:
|
|
case R_X86_64_GOT64:
|
|
return R_GOT_FROM_END;
|
|
case R_X86_64_GOTPCREL:
|
|
case R_X86_64_GOTPCRELX:
|
|
case R_X86_64_REX_GOTPCRELX:
|
|
case R_X86_64_GOTTPOFF:
|
|
return R_GOT_PC;
|
|
case R_X86_64_NONE:
|
|
return R_NONE;
|
|
default:
|
|
return R_INVALID;
|
|
}
|
|
}
|
|
|
|
template <class ELFT> void X86_64<ELFT>::writeGotPltHeader(uint8_t *Buf) const {
|
|
// The first entry holds the value of _DYNAMIC. It is not clear why that is
|
|
// required, but it is documented in the psabi and the glibc dynamic linker
|
|
// seems to use it (note that this is relevant for linking ld.so, not any
|
|
// other program).
|
|
write64le(Buf, InX::Dynamic->getVA());
|
|
}
|
|
|
|
template <class ELFT>
|
|
void X86_64<ELFT>::writeGotPlt(uint8_t *Buf, const Symbol &S) const {
|
|
// See comments in X86::writeGotPlt.
|
|
write32le(Buf, S.getPltVA() + 6);
|
|
}
|
|
|
|
template <class ELFT> void X86_64<ELFT>::writePltHeader(uint8_t *Buf) const {
|
|
const uint8_t PltData[] = {
|
|
0xff, 0x35, 0, 0, 0, 0, // pushq GOTPLT+8(%rip)
|
|
0xff, 0x25, 0, 0, 0, 0, // jmp *GOTPLT+16(%rip)
|
|
0x0f, 0x1f, 0x40, 0x00, // nop
|
|
};
|
|
memcpy(Buf, PltData, sizeof(PltData));
|
|
uint64_t GotPlt = InX::GotPlt->getVA();
|
|
uint64_t Plt = InX::Plt->getVA();
|
|
write32le(Buf + 2, GotPlt - Plt + 2); // GOTPLT+8
|
|
write32le(Buf + 8, GotPlt - Plt + 4); // GOTPLT+16
|
|
}
|
|
|
|
template <class ELFT>
|
|
void X86_64<ELFT>::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
|
|
uint64_t PltEntryAddr, int32_t Index,
|
|
unsigned RelOff) const {
|
|
const uint8_t Inst[] = {
|
|
0xff, 0x25, 0, 0, 0, 0, // jmpq *got(%rip)
|
|
0x68, 0, 0, 0, 0, // pushq <relocation index>
|
|
0xe9, 0, 0, 0, 0, // jmpq plt[0]
|
|
};
|
|
memcpy(Buf, Inst, sizeof(Inst));
|
|
|
|
write32le(Buf + 2, GotPltEntryAddr - PltEntryAddr - 6);
|
|
write32le(Buf + 7, Index);
|
|
write32le(Buf + 12, -Index * PltEntrySize - PltHeaderSize - 16);
|
|
}
|
|
|
|
template <class ELFT> bool X86_64<ELFT>::isPicRel(RelType Type) const {
|
|
return Type != R_X86_64_PC32 && Type != R_X86_64_32 &&
|
|
Type != R_X86_64_TPOFF32;
|
|
}
|
|
|
|
template <class ELFT>
|
|
void X86_64<ELFT>::relaxTlsGdToLe(uint8_t *Loc, RelType Type,
|
|
uint64_t Val) const {
|
|
// Convert
|
|
// .byte 0x66
|
|
// leaq x@tlsgd(%rip), %rdi
|
|
// .word 0x6666
|
|
// rex64
|
|
// call __tls_get_addr@plt
|
|
// to
|
|
// mov %fs:0x0,%rax
|
|
// lea x@tpoff,%rax
|
|
const uint8_t Inst[] = {
|
|
0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 0x00, 0x00, // mov %fs:0x0,%rax
|
|
0x48, 0x8d, 0x80, 0, 0, 0, 0, // lea x@tpoff,%rax
|
|
};
|
|
memcpy(Loc - 4, Inst, sizeof(Inst));
|
|
|
|
// The original code used a pc relative relocation and so we have to
|
|
// compensate for the -4 in had in the addend.
|
|
write32le(Loc + 8, Val + 4);
|
|
}
|
|
|
|
template <class ELFT>
|
|
void X86_64<ELFT>::relaxTlsGdToIe(uint8_t *Loc, RelType Type,
|
|
uint64_t Val) const {
|
|
// Convert
|
|
// .byte 0x66
|
|
// leaq x@tlsgd(%rip), %rdi
|
|
// .word 0x6666
|
|
// rex64
|
|
// call __tls_get_addr@plt
|
|
// to
|
|
// mov %fs:0x0,%rax
|
|
// addq x@tpoff,%rax
|
|
const uint8_t Inst[] = {
|
|
0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 0x00, 0x00, // mov %fs:0x0,%rax
|
|
0x48, 0x03, 0x05, 0, 0, 0, 0, // addq x@tpoff,%rax
|
|
};
|
|
memcpy(Loc - 4, Inst, sizeof(Inst));
|
|
|
|
// Both code sequences are PC relatives, but since we are moving the constant
|
|
// forward by 8 bytes we have to subtract the value by 8.
|
|
write32le(Loc + 8, Val - 8);
|
|
}
|
|
|
|
// In some conditions, R_X86_64_GOTTPOFF relocation can be optimized to
|
|
// R_X86_64_TPOFF32 so that it does not use GOT.
|
|
template <class ELFT>
|
|
void X86_64<ELFT>::relaxTlsIeToLe(uint8_t *Loc, RelType Type,
|
|
uint64_t Val) const {
|
|
uint8_t *Inst = Loc - 3;
|
|
uint8_t Reg = Loc[-1] >> 3;
|
|
uint8_t *RegSlot = Loc - 1;
|
|
|
|
// Note that ADD with RSP or R12 is converted to ADD instead of LEA
|
|
// because LEA with these registers needs 4 bytes to encode and thus
|
|
// wouldn't fit the space.
|
|
|
|
if (memcmp(Inst, "\x48\x03\x25", 3) == 0) {
|
|
// "addq foo@gottpoff(%rip),%rsp" -> "addq $foo,%rsp"
|
|
memcpy(Inst, "\x48\x81\xc4", 3);
|
|
} else if (memcmp(Inst, "\x4c\x03\x25", 3) == 0) {
|
|
// "addq foo@gottpoff(%rip),%r12" -> "addq $foo,%r12"
|
|
memcpy(Inst, "\x49\x81\xc4", 3);
|
|
} else if (memcmp(Inst, "\x4c\x03", 2) == 0) {
|
|
// "addq foo@gottpoff(%rip),%r[8-15]" -> "leaq foo(%r[8-15]),%r[8-15]"
|
|
memcpy(Inst, "\x4d\x8d", 2);
|
|
*RegSlot = 0x80 | (Reg << 3) | Reg;
|
|
} else if (memcmp(Inst, "\x48\x03", 2) == 0) {
|
|
// "addq foo@gottpoff(%rip),%reg -> "leaq foo(%reg),%reg"
|
|
memcpy(Inst, "\x48\x8d", 2);
|
|
*RegSlot = 0x80 | (Reg << 3) | Reg;
|
|
} else if (memcmp(Inst, "\x4c\x8b", 2) == 0) {
|
|
// "movq foo@gottpoff(%rip),%r[8-15]" -> "movq $foo,%r[8-15]"
|
|
memcpy(Inst, "\x49\xc7", 2);
|
|
*RegSlot = 0xc0 | Reg;
|
|
} else if (memcmp(Inst, "\x48\x8b", 2) == 0) {
|
|
// "movq foo@gottpoff(%rip),%reg" -> "movq $foo,%reg"
|
|
memcpy(Inst, "\x48\xc7", 2);
|
|
*RegSlot = 0xc0 | Reg;
|
|
} else {
|
|
error(getErrorLocation(Loc - 3) +
|
|
"R_X86_64_GOTTPOFF must be used in MOVQ or ADDQ instructions only");
|
|
}
|
|
|
|
// The original code used a PC relative relocation.
|
|
// Need to compensate for the -4 it had in the addend.
|
|
write32le(Loc, Val + 4);
|
|
}
|
|
|
|
template <class ELFT>
|
|
void X86_64<ELFT>::relaxTlsLdToLe(uint8_t *Loc, RelType Type,
|
|
uint64_t Val) const {
|
|
// Convert
|
|
// leaq bar@tlsld(%rip), %rdi
|
|
// callq __tls_get_addr@PLT
|
|
// leaq bar@dtpoff(%rax), %rcx
|
|
// to
|
|
// .word 0x6666
|
|
// .byte 0x66
|
|
// mov %fs:0,%rax
|
|
// leaq bar@tpoff(%rax), %rcx
|
|
if (Type == R_X86_64_DTPOFF64) {
|
|
write64le(Loc, Val);
|
|
return;
|
|
}
|
|
if (Type == R_X86_64_DTPOFF32) {
|
|
write32le(Loc, Val);
|
|
return;
|
|
}
|
|
|
|
const uint8_t Inst[] = {
|
|
0x66, 0x66, // .word 0x6666
|
|
0x66, // .byte 0x66
|
|
0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 0x00, 0x00, // mov %fs:0,%rax
|
|
};
|
|
memcpy(Loc - 3, Inst, sizeof(Inst));
|
|
}
|
|
|
|
template <class ELFT>
|
|
void X86_64<ELFT>::relocateOne(uint8_t *Loc, RelType Type, uint64_t Val) const {
|
|
switch (Type) {
|
|
case R_X86_64_8:
|
|
checkUInt<8>(Loc, Val, Type);
|
|
*Loc = Val;
|
|
break;
|
|
case R_X86_64_16:
|
|
checkUInt<16>(Loc, Val, Type);
|
|
write16le(Loc, Val);
|
|
break;
|
|
case R_X86_64_32:
|
|
checkUInt<32>(Loc, Val, Type);
|
|
write32le(Loc, Val);
|
|
break;
|
|
case R_X86_64_32S:
|
|
case R_X86_64_TPOFF32:
|
|
case R_X86_64_GOT32:
|
|
case R_X86_64_GOTPCREL:
|
|
case R_X86_64_GOTPCRELX:
|
|
case R_X86_64_REX_GOTPCRELX:
|
|
case R_X86_64_PC32:
|
|
case R_X86_64_GOTTPOFF:
|
|
case R_X86_64_PLT32:
|
|
case R_X86_64_TLSGD:
|
|
case R_X86_64_TLSLD:
|
|
case R_X86_64_DTPOFF32:
|
|
case R_X86_64_SIZE32:
|
|
checkInt<32>(Loc, Val, Type);
|
|
write32le(Loc, Val);
|
|
break;
|
|
case R_X86_64_64:
|
|
case R_X86_64_DTPOFF64:
|
|
case R_X86_64_GLOB_DAT:
|
|
case R_X86_64_PC64:
|
|
case R_X86_64_SIZE64:
|
|
case R_X86_64_GOT64:
|
|
write64le(Loc, Val);
|
|
break;
|
|
default:
|
|
error(getErrorLocation(Loc) + "unrecognized reloc " + Twine(Type));
|
|
}
|
|
}
|
|
|
|
template <class ELFT>
|
|
RelExpr X86_64<ELFT>::adjustRelaxExpr(RelType Type, const uint8_t *Data,
|
|
RelExpr RelExpr) const {
|
|
if (Type != R_X86_64_GOTPCRELX && Type != R_X86_64_REX_GOTPCRELX)
|
|
return RelExpr;
|
|
const uint8_t Op = Data[-2];
|
|
const uint8_t ModRm = Data[-1];
|
|
|
|
// FIXME: When PIC is disabled and foo is defined locally in the
|
|
// lower 32 bit address space, memory operand in mov can be converted into
|
|
// immediate operand. Otherwise, mov must be changed to lea. We support only
|
|
// latter relaxation at this moment.
|
|
if (Op == 0x8b)
|
|
return R_RELAX_GOT_PC;
|
|
|
|
// Relax call and jmp.
|
|
if (Op == 0xff && (ModRm == 0x15 || ModRm == 0x25))
|
|
return R_RELAX_GOT_PC;
|
|
|
|
// Relaxation of test, adc, add, and, cmp, or, sbb, sub, xor.
|
|
// If PIC then no relaxation is available.
|
|
// We also don't relax test/binop instructions without REX byte,
|
|
// they are 32bit operations and not common to have.
|
|
assert(Type == R_X86_64_REX_GOTPCRELX);
|
|
return Config->Pic ? RelExpr : R_RELAX_GOT_PC_NOPIC;
|
|
}
|
|
|
|
// A subset of relaxations can only be applied for no-PIC. This method
|
|
// handles such relaxations. Instructions encoding information was taken from:
|
|
// "Intel 64 and IA-32 Architectures Software Developer's Manual V2"
|
|
// (http://www.intel.com/content/dam/www/public/us/en/documents/manuals/
|
|
// 64-ia-32-architectures-software-developer-instruction-set-reference-manual-325383.pdf)
|
|
template <class ELFT>
|
|
void X86_64<ELFT>::relaxGotNoPic(uint8_t *Loc, uint64_t Val, uint8_t Op,
|
|
uint8_t ModRm) const {
|
|
const uint8_t Rex = Loc[-3];
|
|
// Convert "test %reg, foo@GOTPCREL(%rip)" to "test $foo, %reg".
|
|
if (Op == 0x85) {
|
|
// See "TEST-Logical Compare" (4-428 Vol. 2B),
|
|
// TEST r/m64, r64 uses "full" ModR / M byte (no opcode extension).
|
|
|
|
// ModR/M byte has form XX YYY ZZZ, where
|
|
// YYY is MODRM.reg(register 2), ZZZ is MODRM.rm(register 1).
|
|
// XX has different meanings:
|
|
// 00: The operand's memory address is in reg1.
|
|
// 01: The operand's memory address is reg1 + a byte-sized displacement.
|
|
// 10: The operand's memory address is reg1 + a word-sized displacement.
|
|
// 11: The operand is reg1 itself.
|
|
// If an instruction requires only one operand, the unused reg2 field
|
|
// holds extra opcode bits rather than a register code
|
|
// 0xC0 == 11 000 000 binary.
|
|
// 0x38 == 00 111 000 binary.
|
|
// We transfer reg2 to reg1 here as operand.
|
|
// See "2.1.3 ModR/M and SIB Bytes" (Vol. 2A 2-3).
|
|
Loc[-1] = 0xc0 | (ModRm & 0x38) >> 3; // ModR/M byte.
|
|
|
|
// Change opcode from TEST r/m64, r64 to TEST r/m64, imm32
|
|
// See "TEST-Logical Compare" (4-428 Vol. 2B).
|
|
Loc[-2] = 0xf7;
|
|
|
|
// Move R bit to the B bit in REX byte.
|
|
// REX byte is encoded as 0100WRXB, where
|
|
// 0100 is 4bit fixed pattern.
|
|
// REX.W When 1, a 64-bit operand size is used. Otherwise, when 0, the
|
|
// default operand size is used (which is 32-bit for most but not all
|
|
// instructions).
|
|
// REX.R This 1-bit value is an extension to the MODRM.reg field.
|
|
// REX.X This 1-bit value is an extension to the SIB.index field.
|
|
// REX.B This 1-bit value is an extension to the MODRM.rm field or the
|
|
// SIB.base field.
|
|
// See "2.2.1.2 More on REX Prefix Fields " (2-8 Vol. 2A).
|
|
Loc[-3] = (Rex & ~0x4) | (Rex & 0x4) >> 2;
|
|
write32le(Loc, Val);
|
|
return;
|
|
}
|
|
|
|
// If we are here then we need to relax the adc, add, and, cmp, or, sbb, sub
|
|
// or xor operations.
|
|
|
|
// Convert "binop foo@GOTPCREL(%rip), %reg" to "binop $foo, %reg".
|
|
// Logic is close to one for test instruction above, but we also
|
|
// write opcode extension here, see below for details.
|
|
Loc[-1] = 0xc0 | (ModRm & 0x38) >> 3 | (Op & 0x3c); // ModR/M byte.
|
|
|
|
// Primary opcode is 0x81, opcode extension is one of:
|
|
// 000b = ADD, 001b is OR, 010b is ADC, 011b is SBB,
|
|
// 100b is AND, 101b is SUB, 110b is XOR, 111b is CMP.
|
|
// This value was wrote to MODRM.reg in a line above.
|
|
// See "3.2 INSTRUCTIONS (A-M)" (Vol. 2A 3-15),
|
|
// "INSTRUCTION SET REFERENCE, N-Z" (Vol. 2B 4-1) for
|
|
// descriptions about each operation.
|
|
Loc[-2] = 0x81;
|
|
Loc[-3] = (Rex & ~0x4) | (Rex & 0x4) >> 2;
|
|
write32le(Loc, Val);
|
|
}
|
|
|
|
template <class ELFT>
|
|
void X86_64<ELFT>::relaxGot(uint8_t *Loc, uint64_t Val) const {
|
|
const uint8_t Op = Loc[-2];
|
|
const uint8_t ModRm = Loc[-1];
|
|
|
|
// Convert "mov foo@GOTPCREL(%rip),%reg" to "lea foo(%rip),%reg".
|
|
if (Op == 0x8b) {
|
|
Loc[-2] = 0x8d;
|
|
write32le(Loc, Val);
|
|
return;
|
|
}
|
|
|
|
if (Op != 0xff) {
|
|
// We are relaxing a rip relative to an absolute, so compensate
|
|
// for the old -4 addend.
|
|
assert(!Config->Pic);
|
|
relaxGotNoPic(Loc, Val + 4, Op, ModRm);
|
|
return;
|
|
}
|
|
|
|
// Convert call/jmp instructions.
|
|
if (ModRm == 0x15) {
|
|
// ABI says we can convert "call *foo@GOTPCREL(%rip)" to "nop; call foo".
|
|
// Instead we convert to "addr32 call foo" where addr32 is an instruction
|
|
// prefix. That makes result expression to be a single instruction.
|
|
Loc[-2] = 0x67; // addr32 prefix
|
|
Loc[-1] = 0xe8; // call
|
|
write32le(Loc, Val);
|
|
return;
|
|
}
|
|
|
|
// Convert "jmp *foo@GOTPCREL(%rip)" to "jmp foo; nop".
|
|
// jmp doesn't return, so it is fine to use nop here, it is just a stub.
|
|
assert(ModRm == 0x25);
|
|
Loc[-2] = 0xe9; // jmp
|
|
Loc[3] = 0x90; // nop
|
|
write32le(Loc - 1, Val + 1);
|
|
}
|
|
|
|
namespace {
|
|
template <class ELFT> class Retpoline : public X86_64<ELFT> {
|
|
public:
|
|
Retpoline();
|
|
void writeGotPlt(uint8_t *Buf, const Symbol &S) const override;
|
|
void writePltHeader(uint8_t *Buf) const override;
|
|
void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
|
|
int32_t Index, unsigned RelOff) const override;
|
|
};
|
|
|
|
template <class ELFT> class RetpolineZNow : public X86_64<ELFT> {
|
|
public:
|
|
RetpolineZNow();
|
|
void writeGotPlt(uint8_t *Buf, const Symbol &S) const override {}
|
|
void writePltHeader(uint8_t *Buf) const override;
|
|
void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
|
|
int32_t Index, unsigned RelOff) const override;
|
|
};
|
|
} // namespace
|
|
|
|
template <class ELFT> Retpoline<ELFT>::Retpoline() {
|
|
TargetInfo::PltHeaderSize = 48;
|
|
TargetInfo::PltEntrySize = 32;
|
|
}
|
|
|
|
template <class ELFT>
|
|
void Retpoline<ELFT>::writeGotPlt(uint8_t *Buf, const Symbol &S) const {
|
|
write32le(Buf, S.getPltVA() + 17);
|
|
}
|
|
|
|
template <class ELFT> void Retpoline<ELFT>::writePltHeader(uint8_t *Buf) const {
|
|
const uint8_t Insn[] = {
|
|
0xff, 0x35, 0, 0, 0, 0, // 0: pushq GOTPLT+8(%rip)
|
|
0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // 6: mov GOTPLT+16(%rip), %r11
|
|
0xe8, 0x0e, 0x00, 0x00, 0x00, // d: callq next
|
|
0xf3, 0x90, // 12: loop: pause
|
|
0x0f, 0xae, 0xe8, // 14: lfence
|
|
0xeb, 0xf9, // 17: jmp loop
|
|
0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 19: int3; .align 16
|
|
0x4c, 0x89, 0x1c, 0x24, // 20: next: mov %r11, (%rsp)
|
|
0xc3, // 24: ret
|
|
};
|
|
memcpy(Buf, Insn, sizeof(Insn));
|
|
|
|
uint64_t GotPlt = InX::GotPlt->getVA();
|
|
uint64_t Plt = InX::Plt->getVA();
|
|
write32le(Buf + 2, GotPlt - Plt - 6 + 8);
|
|
write32le(Buf + 9, GotPlt - Plt - 13 + 16);
|
|
}
|
|
|
|
template <class ELFT>
|
|
void Retpoline<ELFT>::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
|
|
uint64_t PltEntryAddr, int32_t Index,
|
|
unsigned RelOff) const {
|
|
const uint8_t Insn[] = {
|
|
0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // 0: mov foo@GOTPLT(%rip), %r11
|
|
0xe8, 0, 0, 0, 0, // 7: callq plt+0x20
|
|
0xe9, 0, 0, 0, 0, // c: jmp plt+0x12
|
|
0x68, 0, 0, 0, 0, // 11: pushq <relocation index>
|
|
0xe9, 0, 0, 0, 0, // 16: jmp plt+0
|
|
};
|
|
memcpy(Buf, Insn, sizeof(Insn));
|
|
|
|
uint64_t Off = TargetInfo::PltHeaderSize + TargetInfo::PltEntrySize * Index;
|
|
|
|
write32le(Buf + 3, GotPltEntryAddr - PltEntryAddr - 7);
|
|
write32le(Buf + 8, -Off - 12 + 32);
|
|
write32le(Buf + 13, -Off - 17 + 18);
|
|
write32le(Buf + 18, Index);
|
|
write32le(Buf + 23, -Off - 27);
|
|
}
|
|
|
|
template <class ELFT> RetpolineZNow<ELFT>::RetpolineZNow() {
|
|
TargetInfo::PltHeaderSize = 32;
|
|
TargetInfo::PltEntrySize = 16;
|
|
}
|
|
|
|
template <class ELFT>
|
|
void RetpolineZNow<ELFT>::writePltHeader(uint8_t *Buf) const {
|
|
const uint8_t Insn[] = {
|
|
0xe8, 0x0b, 0x00, 0x00, 0x00, // 0: call next
|
|
0xf3, 0x90, // 5: loop: pause
|
|
0x0f, 0xae, 0xe8, // 7: lfence
|
|
0xeb, 0xf9, // a: jmp loop
|
|
0xcc, 0xcc, 0xcc, 0xcc, // c: int3; .align 16
|
|
0x4c, 0x89, 0x1c, 0x24, // 10: next: mov %r11, (%rsp)
|
|
0xc3, // 14: ret
|
|
};
|
|
memcpy(Buf, Insn, sizeof(Insn));
|
|
}
|
|
|
|
template <class ELFT>
|
|
void RetpolineZNow<ELFT>::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
|
|
uint64_t PltEntryAddr, int32_t Index,
|
|
unsigned RelOff) const {
|
|
const uint8_t Insn[] = {
|
|
0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // mov foo@GOTPLT(%rip), %r11
|
|
0xe9, 0, 0, 0, 0, // jmp plt+0
|
|
};
|
|
memcpy(Buf, Insn, sizeof(Insn));
|
|
|
|
write32le(Buf + 3, GotPltEntryAddr - PltEntryAddr - 7);
|
|
write32le(Buf + 8,
|
|
-Index * TargetInfo::PltEntrySize - TargetInfo::PltHeaderSize - 12);
|
|
}
|
|
|
|
template <class ELFT> TargetInfo *getTargetInfo() {
|
|
if (Config->ZRetpolineplt) {
|
|
if (Config->ZNow) {
|
|
static RetpolineZNow<ELFT> T;
|
|
return &T;
|
|
}
|
|
static Retpoline<ELFT> T;
|
|
return &T;
|
|
}
|
|
|
|
static X86_64<ELFT> T;
|
|
return &T;
|
|
}
|
|
|
|
TargetInfo *elf::getX32TargetInfo() { return getTargetInfo<ELF32LE>(); }
|
|
TargetInfo *elf::getX86_64TargetInfo() { return getTargetInfo<ELF64LE>(); }
|