1 //===- X86.cpp ------------------------------------------------------------===//
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 #include "InputFiles.h"
12 #include "SyntheticSections.h"
14 #include "lld/Common/ErrorHandler.h"
15 #include "llvm/Support/Endian.h"
18 using namespace llvm::support::endian;
19 using namespace llvm::ELF;
21 using namespace lld::elf;
24 class X86 : public TargetInfo {
27 RelExpr getRelExpr(RelType Type, const Symbol &S,
28 const uint8_t *Loc) const override;
29 int64_t getImplicitAddend(const uint8_t *Buf, RelType Type) const override;
30 void writeGotPltHeader(uint8_t *Buf) const override;
31 RelType getDynRel(RelType Type) const override;
32 void writeGotPlt(uint8_t *Buf, const Symbol &S) const override;
33 void writeIgotPlt(uint8_t *Buf, const Symbol &S) const override;
34 void writePltHeader(uint8_t *Buf) const override;
35 void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
36 int32_t Index, unsigned RelOff) const override;
37 void relocateOne(uint8_t *Loc, RelType Type, uint64_t Val) const override;
39 RelExpr adjustRelaxExpr(RelType Type, const uint8_t *Data,
40 RelExpr Expr) const override;
41 void relaxTlsGdToIe(uint8_t *Loc, RelType Type, uint64_t Val) const override;
42 void relaxTlsGdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override;
43 void relaxTlsIeToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override;
44 void relaxTlsLdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override;
50 GotRel = R_386_GLOB_DAT;
51 PltRel = R_386_JUMP_SLOT;
52 IRelativeRel = R_386_IRELATIVE;
53 RelativeRel = R_386_RELATIVE;
54 TlsGotRel = R_386_TLS_TPOFF;
55 TlsModuleIndexRel = R_386_TLS_DTPMOD32;
56 TlsOffsetRel = R_386_TLS_DTPOFF32;
62 TrapInstr = 0xcccccccc; // 0xcc = INT3
64 // Align to the non-PAE large page size (known as a superpage or huge page).
65 // FreeBSD automatically promotes large, superpage-aligned allocations.
66 DefaultImageBase = 0x400000;
69 static bool hasBaseReg(uint8_t ModRM) { return (ModRM & 0xc7) != 0x5; }
71 RelExpr X86::getRelExpr(RelType Type, const Symbol &S,
72 const uint8_t *Loc) const {
77 case R_386_TLS_LDO_32:
80 return R_TLSGD_GOT_FROM_END;
82 return R_TLSLD_GOT_FROM_END;
90 return R_GOTONLY_PC_FROM_END;
95 // These relocations are arguably mis-designed because their calculations
96 // depend on the instructions they are applied to. This is bad because we
97 // usually don't care about whether the target section contains valid
98 // machine instructions or not. But this is part of the documented ABI, so
99 // we had to implement as the standard requires.
101 // x86 does not support PC-relative data access. Therefore, in order to
102 // access GOT contents, a GOT address needs to be known at link-time
103 // (which means non-PIC) or compilers have to emit code to get a GOT
104 // address at runtime (which means code is position-independent but
105 // compilers need to emit extra code for each GOT access.) This decision
106 // is made at compile-time. In the latter case, compilers emit code to
107 // load an GOT address to a register, which is usually %ebx.
109 // So, there are two ways to refer to symbol foo's GOT entry: foo@GOT or
112 // foo@GOT is not usable in PIC. If we are creating a PIC output and if we
113 // find such relocation, we should report an error. foo@GOT is resolved to
114 // an *absolute* address of foo's GOT entry, because both GOT address and
115 // foo's offset are known. In other words, it's G + A.
117 // foo@GOT(%reg) needs to be resolved to a *relative* offset from a GOT to
118 // foo's GOT entry in the table, because GOT address is not known but foo's
119 // offset in the table is known. It's G + A - GOT.
121 // It's unfortunate that compilers emit the same relocation for these
122 // different use cases. In order to distinguish them, we have to read a
123 // machine instruction.
125 // The following code implements it. We assume that Loc[0] is the first
126 // byte of a displacement or an immediate field of a valid machine
127 // instruction. That means a ModRM byte is at Loc[-1]. By taking a look at
128 // the byte, we can determine whether the instruction is register-relative
129 // (i.e. it was generated for foo@GOT(%reg)) or absolute (i.e. foo@GOT).
130 return hasBaseReg(Loc[-1]) ? R_GOT_FROM_END : R_GOT;
131 case R_386_TLS_GOTIE:
132 return R_GOT_FROM_END;
134 return R_GOTREL_FROM_END;
137 case R_386_TLS_LE_32:
146 RelExpr X86::adjustRelaxExpr(RelType Type, const uint8_t *Data,
147 RelExpr Expr) const {
151 case R_RELAX_TLS_GD_TO_IE:
152 return R_RELAX_TLS_GD_TO_IE_END;
153 case R_RELAX_TLS_GD_TO_LE:
154 return R_RELAX_TLS_GD_TO_LE_NEG;
158 void X86::writeGotPltHeader(uint8_t *Buf) const {
159 write32le(Buf, InX::Dynamic->getVA());
162 void X86::writeGotPlt(uint8_t *Buf, const Symbol &S) const {
163 // Entries in .got.plt initially points back to the corresponding
164 // PLT entries with a fixed offset to skip the first instruction.
165 write32le(Buf, S.getPltVA() + 6);
168 void X86::writeIgotPlt(uint8_t *Buf, const Symbol &S) const {
169 // An x86 entry is the address of the ifunc resolver function.
170 write32le(Buf, S.getVA());
173 RelType X86::getDynRel(RelType Type) const {
174 if (Type == R_386_TLS_LE)
175 return R_386_TLS_TPOFF;
176 if (Type == R_386_TLS_LE_32)
177 return R_386_TLS_TPOFF32;
181 void X86::writePltHeader(uint8_t *Buf) const {
183 const uint8_t V[] = {
184 0xff, 0xb3, 0x04, 0x00, 0x00, 0x00, // pushl GOTPLT+4(%ebx)
185 0xff, 0xa3, 0x08, 0x00, 0x00, 0x00, // jmp *GOTPLT+8(%ebx)
186 0x90, 0x90, 0x90, 0x90 // nop
188 memcpy(Buf, V, sizeof(V));
190 uint32_t Ebx = InX::Got->getVA() + InX::Got->getSize();
191 uint32_t GotPlt = InX::GotPlt->getVA() - Ebx;
192 write32le(Buf + 2, GotPlt + 4);
193 write32le(Buf + 8, GotPlt + 8);
197 const uint8_t PltData[] = {
198 0xff, 0x35, 0, 0, 0, 0, // pushl (GOTPLT+4)
199 0xff, 0x25, 0, 0, 0, 0, // jmp *(GOTPLT+8)
200 0x90, 0x90, 0x90, 0x90, // nop
202 memcpy(Buf, PltData, sizeof(PltData));
203 uint32_t GotPlt = InX::GotPlt->getVA();
204 write32le(Buf + 2, GotPlt + 4);
205 write32le(Buf + 8, GotPlt + 8);
208 void X86::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
209 uint64_t PltEntryAddr, int32_t Index,
210 unsigned RelOff) const {
211 const uint8_t Inst[] = {
212 0xff, 0x00, 0, 0, 0, 0, // jmp *foo_in_GOT or jmp *foo@GOT(%ebx)
213 0x68, 0, 0, 0, 0, // pushl $reloc_offset
214 0xe9, 0, 0, 0, 0, // jmp .PLT0@PC
216 memcpy(Buf, Inst, sizeof(Inst));
219 // jmp *foo@GOT(%ebx)
220 uint32_t Ebx = InX::Got->getVA() + InX::Got->getSize();
222 write32le(Buf + 2, GotPltEntryAddr - Ebx);
226 write32le(Buf + 2, GotPltEntryAddr);
229 write32le(Buf + 7, RelOff);
230 write32le(Buf + 12, -getPltEntryOffset(Index) - 16);
233 int64_t X86::getImplicitAddend(const uint8_t *Buf, RelType Type) const {
237 return SignExtend64<8>(*Buf);
240 return SignExtend64<16>(read16le(Buf));
248 case R_386_TLS_LDO_32:
250 return SignExtend64<32>(read32le(Buf));
256 void X86::relocateOne(uint8_t *Loc, RelType Type, uint64_t Val) const {
259 // R_386_{PC,}{8,16} are not part of the i386 psABI, but they are
260 // being used for some 16-bit programs such as boot loaders, so
261 // we want to support them.
262 checkIntUInt(Loc, Val, 8, Type);
266 checkInt(Loc, Val, 8, Type);
270 checkIntUInt(Loc, Val, 16, Type);
274 // R_386_PC16 is normally used with 16 bit code. In that situation
275 // the PC is 16 bits, just like the addend. This means that it can
276 // point from any 16 bit address to any other if the possibility
277 // of wrapping is included.
278 // The only restriction we have to check then is that the destination
279 // address fits in 16 bits. That is impossible to do here. The problem is
280 // that we are passed the final value, which already had the
281 // current location subtracted from it.
282 // We just check that Val fits in 17 bits. This misses some cases, but
283 // should have no false positives.
284 checkInt(Loc, Val, 17, Type);
296 case R_386_TLS_DTPMOD32:
297 case R_386_TLS_DTPOFF32:
299 case R_386_TLS_GOTIE:
302 case R_386_TLS_LDO_32:
304 case R_386_TLS_LE_32:
305 case R_386_TLS_TPOFF:
306 case R_386_TLS_TPOFF32:
307 checkInt(Loc, Val, 32, Type);
311 error(getErrorLocation(Loc) + "unrecognized reloc " + Twine(Type));
315 void X86::relaxTlsGdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const {
317 // leal x@tlsgd(, %ebx, 1),
318 // call __tls_get_addr@plt
321 // subl $x@ntpoff,%eax
322 const uint8_t Inst[] = {
323 0x65, 0xa1, 0x00, 0x00, 0x00, 0x00, // movl %gs:0, %eax
324 0x81, 0xe8, 0, 0, 0, 0, // subl Val(%ebx), %eax
326 memcpy(Loc - 3, Inst, sizeof(Inst));
327 write32le(Loc + 5, Val);
330 void X86::relaxTlsGdToIe(uint8_t *Loc, RelType Type, uint64_t Val) const {
332 // leal x@tlsgd(, %ebx, 1),
333 // call __tls_get_addr@plt
336 // addl x@gotntpoff(%ebx), %eax
337 const uint8_t Inst[] = {
338 0x65, 0xa1, 0x00, 0x00, 0x00, 0x00, // movl %gs:0, %eax
339 0x03, 0x83, 0, 0, 0, 0, // addl Val(%ebx), %eax
341 memcpy(Loc - 3, Inst, sizeof(Inst));
342 write32le(Loc + 5, Val);
345 // In some conditions, relocations can be optimized to avoid using GOT.
346 // This function does that for Initial Exec to Local Exec case.
347 void X86::relaxTlsIeToLe(uint8_t *Loc, RelType Type, uint64_t Val) const {
348 // Ulrich's document section 6.2 says that @gotntpoff can
349 // be used with MOVL or ADDL instructions.
350 // @indntpoff is similar to @gotntpoff, but for use in
351 // position dependent code.
352 uint8_t Reg = (Loc[-1] >> 3) & 7;
354 if (Type == R_386_TLS_IE) {
355 if (Loc[-1] == 0xa1) {
356 // "movl foo@indntpoff,%eax" -> "movl $foo,%eax"
357 // This case is different from the generic case below because
358 // this is a 5 byte instruction while below is 6 bytes.
360 } else if (Loc[-2] == 0x8b) {
361 // "movl foo@indntpoff,%reg" -> "movl $foo,%reg"
363 Loc[-1] = 0xc0 | Reg;
365 // "addl foo@indntpoff,%reg" -> "addl $foo,%reg"
367 Loc[-1] = 0xc0 | Reg;
370 assert(Type == R_386_TLS_GOTIE);
371 if (Loc[-2] == 0x8b) {
372 // "movl foo@gottpoff(%rip),%reg" -> "movl $foo,%reg"
374 Loc[-1] = 0xc0 | Reg;
376 // "addl foo@gotntpoff(%rip),%reg" -> "leal foo(%reg),%reg"
378 Loc[-1] = 0x80 | (Reg << 3) | Reg;
384 void X86::relaxTlsLdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const {
385 if (Type == R_386_TLS_LDO_32) {
391 // leal foo(%reg),%eax
392 // call ___tls_get_addr
396 // leal 0(%esi,1),%esi
397 const uint8_t Inst[] = {
398 0x65, 0xa1, 0x00, 0x00, 0x00, 0x00, // movl %gs:0,%eax
400 0x8d, 0x74, 0x26, 0x00, // leal 0(%esi,1),%esi
402 memcpy(Loc - 2, Inst, sizeof(Inst));
406 class RetpolinePic : public X86 {
409 void writeGotPlt(uint8_t *Buf, const Symbol &S) const override;
410 void writePltHeader(uint8_t *Buf) const override;
411 void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
412 int32_t Index, unsigned RelOff) const override;
415 class RetpolineNoPic : public X86 {
418 void writeGotPlt(uint8_t *Buf, const Symbol &S) const override;
419 void writePltHeader(uint8_t *Buf) const override;
420 void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
421 int32_t Index, unsigned RelOff) const override;
425 RetpolinePic::RetpolinePic() {
430 void RetpolinePic::writeGotPlt(uint8_t *Buf, const Symbol &S) const {
431 write32le(Buf, S.getPltVA() + 17);
434 void RetpolinePic::writePltHeader(uint8_t *Buf) const {
435 const uint8_t Insn[] = {
436 0xff, 0xb3, 0, 0, 0, 0, // 0: pushl GOTPLT+4(%ebx)
437 0x50, // 6: pushl %eax
438 0x8b, 0x83, 0, 0, 0, 0, // 7: mov GOTPLT+8(%ebx), %eax
439 0xe8, 0x0e, 0x00, 0x00, 0x00, // d: call next
440 0xf3, 0x90, // 12: loop: pause
441 0x0f, 0xae, 0xe8, // 14: lfence
442 0xeb, 0xf9, // 17: jmp loop
443 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 19: int3; .align 16
444 0x89, 0x0c, 0x24, // 20: next: mov %ecx, (%esp)
445 0x8b, 0x4c, 0x24, 0x04, // 23: mov 0x4(%esp), %ecx
446 0x89, 0x44, 0x24, 0x04, // 27: mov %eax ,0x4(%esp)
447 0x89, 0xc8, // 2b: mov %ecx, %eax
448 0x59, // 2d: pop %ecx
450 0xcc, // 2f: int3; padding
452 memcpy(Buf, Insn, sizeof(Insn));
454 uint32_t Ebx = InX::Got->getVA() + InX::Got->getSize();
455 uint32_t GotPlt = InX::GotPlt->getVA() - Ebx;
456 write32le(Buf + 2, GotPlt + 4);
457 write32le(Buf + 9, GotPlt + 8);
460 void RetpolinePic::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
461 uint64_t PltEntryAddr, int32_t Index,
462 unsigned RelOff) const {
463 const uint8_t Insn[] = {
465 0x8b, 0x83, 0, 0, 0, 0, // mov foo@GOT(%ebx), %eax
466 0xe8, 0, 0, 0, 0, // call plt+0x20
467 0xe9, 0, 0, 0, 0, // jmp plt+0x12
468 0x68, 0, 0, 0, 0, // pushl $reloc_offset
469 0xe9, 0, 0, 0, 0, // jmp plt+0
470 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // int3; padding
472 memcpy(Buf, Insn, sizeof(Insn));
474 uint32_t Ebx = InX::Got->getVA() + InX::Got->getSize();
475 unsigned Off = getPltEntryOffset(Index);
476 write32le(Buf + 3, GotPltEntryAddr - Ebx);
477 write32le(Buf + 8, -Off - 12 + 32);
478 write32le(Buf + 13, -Off - 17 + 18);
479 write32le(Buf + 18, RelOff);
480 write32le(Buf + 23, -Off - 27);
483 RetpolineNoPic::RetpolineNoPic() {
488 void RetpolineNoPic::writeGotPlt(uint8_t *Buf, const Symbol &S) const {
489 write32le(Buf, S.getPltVA() + 16);
492 void RetpolineNoPic::writePltHeader(uint8_t *Buf) const {
493 const uint8_t Insn[] = {
494 0xff, 0x35, 0, 0, 0, 0, // 0: pushl GOTPLT+4
495 0x50, // 6: pushl %eax
496 0xa1, 0, 0, 0, 0, // 7: mov GOTPLT+8, %eax
497 0xe8, 0x0f, 0x00, 0x00, 0x00, // c: call next
498 0xf3, 0x90, // 11: loop: pause
499 0x0f, 0xae, 0xe8, // 13: lfence
500 0xeb, 0xf9, // 16: jmp loop
501 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 18: int3
502 0xcc, 0xcc, 0xcc, // 1f: int3; .align 16
503 0x89, 0x0c, 0x24, // 20: next: mov %ecx, (%esp)
504 0x8b, 0x4c, 0x24, 0x04, // 23: mov 0x4(%esp), %ecx
505 0x89, 0x44, 0x24, 0x04, // 27: mov %eax ,0x4(%esp)
506 0x89, 0xc8, // 2b: mov %ecx, %eax
507 0x59, // 2d: pop %ecx
509 0xcc, // 2f: int3; padding
511 memcpy(Buf, Insn, sizeof(Insn));
513 uint32_t GotPlt = InX::GotPlt->getVA();
514 write32le(Buf + 2, GotPlt + 4);
515 write32le(Buf + 8, GotPlt + 8);
518 void RetpolineNoPic::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
519 uint64_t PltEntryAddr, int32_t Index,
520 unsigned RelOff) const {
521 const uint8_t Insn[] = {
522 0x50, // 0: pushl %eax
523 0xa1, 0, 0, 0, 0, // 1: mov foo_in_GOT, %eax
524 0xe8, 0, 0, 0, 0, // 6: call plt+0x20
525 0xe9, 0, 0, 0, 0, // b: jmp plt+0x11
526 0x68, 0, 0, 0, 0, // 10: pushl $reloc_offset
527 0xe9, 0, 0, 0, 0, // 15: jmp plt+0
528 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 1a: int3; padding
529 0xcc, // 1f: int3; padding
531 memcpy(Buf, Insn, sizeof(Insn));
533 unsigned Off = getPltEntryOffset(Index);
534 write32le(Buf + 2, GotPltEntryAddr);
535 write32le(Buf + 7, -Off - 11 + 32);
536 write32le(Buf + 12, -Off - 16 + 17);
537 write32le(Buf + 17, RelOff);
538 write32le(Buf + 22, -Off - 26);
541 TargetInfo *elf::getX86TargetInfo() {
542 if (Config->ZRetpolineplt) {
544 static RetpolinePic T;
547 static RetpolineNoPic T;