Intel MPX introduces 4 bound registers, which will be used for parameter
passing in x86-64. Bound registers are cleared by branch instructions.
Branch instructions with BND prefix will keep bound register contents.
This leads to 2 requirements to 64-bit MPX run-time:
1. Dynamic linker (ld.so) should save and restore bound registers during
symbol lookup.
2. Change the current 16-byte PLT0:
ff 35 08 00 00 00 pushq GOT+8(%rip)
ff 25 00 10 00 jmpq *GOT+16(%rip)
0f 1f 40 00 nopl 0x0(%rax)
and 16-byte PLT1:
ff 25 00 00 00 00 jmpq *name@GOTPCREL(%rip)
68 00 00 00 00 pushq $index
e9 00 00 00 00 jmpq PLT0
which clear bound registers, to preserve bound registers.
We use 2 new relocations:
to mark branch instructions with BND prefix.
When linker sees any R_X86_64_PC32_BND or R_X86_64_PLT32_BND relocations,
it switches to a different PLT0:
ff 35 08 00 00 00 pushq GOT+8(%rip)
f2 ff 25 00 10 00 bnd jmpq *GOT+16(%rip)
0f 1f 00 nopl (%rax)
to preserve bound registers for symbol lookup and it also creates an
external PLT section, .pl.bnd. Linker will create a BND PLT1 entry
in .plt:
68 00 00 00 00 pushq $index
f2 e9 00 00 00 00 bnd jmpq PLT0
0f 1f 44 00 00 nopl 0(%rax,%rax,1)
and a 8-byte BND PLT entry in .plt.bnd:
f2 ff 25 00 00 00 00 bnd jmpq *name@GOTPCREL(%rip)
90 nop
Otherwise, linker will create a legacy PLT1 entry in .plt:
68 00 00 00 00 pushq $index
e9 00 00 00 00 jmpq PLT0
66 0f 1f 44 00 00 nopw 0(%rax,%rax,1)
and a 8-byte legacy PLT in .plt.bnd:
ff 25 00 00 00 00 jmpq *name@GOTPCREL(%rip)
66 90 xchg %ax,%ax
The initial value of the GOT entry for "name" will be set to the the
"pushq" instruction in the corresponding entry in .plt. Linker will
resolve reference of symbol "name" to the entry in the second PLT,
.plt.bnd.
Prelink stores the offset of pushq of PLT1 (plt_base + 0x10) in GOT[1]
and GOT[1] is stored in GOT[3]. We can undo prelink in GOT by computing
the corresponding the pushq offset with
GOT[1] + (GOT offset - &GOT[3]) * 2
Since for each entry in .plt except for PLT0 we create a 8-byte entry in
.plt.bnd, there is extra 8-byte per PLT symbol.
We also investigated the 16-byte entry for .plt.bnd. We compared the
8-byte entry vs the the 16-byte entry for .plt.bnd on Sandy Bridge.
There are no performance differences in SPEC CPU 2000/2006 as well as
micro benchmarks.
Pros:
No change to undo prelink in dynamic linker.
Only 8-byte memory overhead for each PLT symbol.
Cons:
Extra .plt.bnd section is needed.
Extra 8 byte for legacy branches to PLT.
GDB is unware of the new layout of .plt and .plt.bnd.
bfd/
* elf64-x86-64.c (elf_x86_64_bnd_plt0_entry): New.
(elf_x86_64_legacy_plt_entry): Likewise.
(elf_x86_64_bnd_plt_entry): Likewise.
(elf_x86_64_legacy_plt2_entry): Likewise.
(elf_x86_64_bnd_plt2_entry): Likewise.
(elf_x86_64_bnd_arch_bed): Likewise.
(elf_x86_64_link_hash_entry): Add has_bnd_reloc and plt_bnd.
(elf_x86_64_link_hash_table): Add plt_bnd.
(elf_x86_64_link_hash_newfunc): Initialize has_bnd_reloc and
plt_bnd.
(elf_x86_64_copy_indirect_symbol): Also copy has_bnd_reloc.
(elf_x86_64_check_relocs): Create the second PLT for Intel MPX
in 64-bit mode.
(elf_x86_64_allocate_dynrelocs): Handle the second PLT for IFUNC
symbols. Resolve call to the second PLT if it is created.
(elf_x86_64_size_dynamic_sections): Keep the second PLT section.
(elf_x86_64_relocate_section): Resolve PLT references to the
second PLT if it is created.
(elf_x86_64_finish_dynamic_symbol): Use BND PLT0 and fill the
second PLT entry for BND relocation.
(elf_x86_64_finish_dynamic_sections): Use MPX backend data if
the second PLT is created.
(elf_x86_64_get_synthetic_symtab): New.
(bfd_elf64_get_synthetic_symtab): Likewise. Undefine for NaCl.
ld/
* emulparams/elf_x86_64.sh (TINY_READONLY_SECTION): New.
ld/testsuite/
* ld-x86-64/mpx.exp: Run bnd-ifunc-1 and bnd-plt-1.
* ld-x86-64/bnd-ifunc-1.d: New file.
* ld-x86-64/bnd-ifunc-1.s: Likewise.
* ld-x86-64/bnd-plt-1.d: Likewise.
This patch allows the user to override powerpc64-ld's default for
providing linker generated register save and restore functions as used
by gcc -Os code. Normally these are not provided by ld -r, so Linux
kernel modules have needed to include their own copies.
bfd/
* elf64-ppc.h (struct ppc64_elf_params): Add save_restore_funcs.
* elf64-ppc.c (ppc64_elf_func_desc_adjust): Use it to control
provision of out-of-line register save/restore routines.
ld/
* emultempl/ppc64elf.em (params): Init new field.
(ppc_create_output_section_statements): Set params.save_restore_funcs
default.
(PARSE_AND_LIST_*): Add support for --save-restore-funcs and
--no-save-restore-funcs.
execute permission regardless of the underlying PT_LOAD segment permissions.
Deleting this code allows the default linker behavior which is to set the
dynamic segment to the same permissions as the sections that make it up.
This change alters one existing test case to check the segment flags for
PT_DYNAMIC.
bfd/ChangeLog
* elfxx-mips.c(_bfd_mips_elf_modify_segment_map): Deleted hard coding of
PT_DYNAMIC segment flags.
ld/testsuite/ChangeLog
* ld-mips-elf/pic-and-nonpic-3a.sd: Check DYNAMIC segment flags.
abfd->section_count unexpectedly changes between 218 and 248 in:
150 bfd_simple_get_relocated_section_contents (bfd *abfd,
[...]
218 saved_offsets = malloc (sizeof (struct saved_output_info)
219 * abfd->section_count);
[...]
230 _bfd_generic_link_add_symbols (abfd, &link_info);
[...]
248 bfd_map_over_sections (abfd, simple_restore_output_info, saved_offsets);
_bfd_generic_link_add_symbols increases section_count
and simple_restore_output_info later reads unallocated part of saved_offsets.
READ of size 8 at 0x601c0000c5c0 thread T0
#0 0x1124770 in simple_restore_output_info (.../gdb/gdb+0x1124770)
#1 0x10ecd51 in bfd_map_over_sections (.../gdb/gdb+0x10ecd51)
#2 0x1125150 in bfd_simple_get_relocated_section_contents (.../gdb/gdb+0x1125150)
bfd/
2014-02-17 Jan Kratochvil <jan.kratochvil@redhat.com>
PR binutils/16595
* simple.c (struct saved_offsets): New.
(simple_save_output_info): Use it for ptr.
(simple_restore_output_info): Use it for ptr. Check section_count.
(bfd_simple_get_relocated_section_contents): Use it for saved_offsets.
Moves assorted variables used to communicate between ld and bfd into
a struct, hooks it into the bfd link_hash_table early, and removes
all other places where such variables were passed piecemeal.
bfd/
* elf64-ppc.h (struct ppc64_elf_params): Define.
(ppc64_elf_init_stub_bfd, ppc64_elf_edit_opd, ppc64_elf_tls_setup,
ppc64_elf_setup_section_lists, ppc64_elf_size_stubs,
ppc64_elf_build_stubs): Update prototype.
* elf64-ppp.c (struct ppc_link_hash_table): Add params, delete other
fields now in params. Adjust code throughout file.
(ppc64_elf_init_stub_bfd): Delete "abfd" parameter, add "params".
Save params pointer in htab.
(ppc64_elf_edit_opd, ppc64_elf_tls_setup,
ppc64_elf_setup_section_lists, ppc64_elf_size_stubs,
ppc64_elf_build_stubs): Remove parameters now in "params".
ld/
* emultemps/ppc64elf.em (params): New static struct replacing
various other static vars. Adjust code throughout file.
This fixes the glaring error that the ppc476 workaround wasn't
actually enabled for ld -r, and adjusts relocations to match moved
code.
bfd/
* elf32-ppc.c (ppc_elf_relocate_section): Move relocs on insns
patched for ppc476 workaround. Reapply branch taken/not taken
relocs.
ld/
* emultempl/ppc32elf.em (ppc_after_open_output): Really enable
ppc476 workaround for ld -r.
Adding long-branch stubs for __tls_get_addr calls that are optimised
away is silly. It also causes assertion failures on newer object files
that use R_PPC_TLSGD and R_PPC_TLSLD marker relocs, and half-optimised
(ie. broken) code for older object files.
PR 16546
* elf32-ppc.c (ppc_elf_relax_section): Don't build long-branch
stubs for calls to __tls_get_addr that we know will later be
optimised away.
The Linux kernel builds modules using ld -r. These might need the
ppc476 workaround, so enable it for ld -r if sections have sufficient
alignment to tell location within a page.
bfd/
* elf32-ppc.c (ppc_elf_relax_section): Enable ppc476 workaround
for ld -r, when code sections are sufficiently aligned.
* elf32-ppc.h (struct ppc_elf_params): Delete pagesize. Add
pagesize_p2.
ld/
* emultempl/ppc32elf.em (pagesize): New static var.
(ppc_after_open_output): Set params.pagesize_p2 from pagesize.
(PARSE_AND_LIST_ARGS_CASES): Adjust to use pagesize.
For powerpc64 as HJ did earlier for other ELF targets, and a tidy.
PR gold/15530
* elf64-ppc.c (ppc64_elf_gc_mark_dynamic_ref): Support
--export-dynamic and --dynamic-list marking of symbols.
* elflink.c (bfd_elf_gc_mark_dynamic_ref_symbol): Reorder
cheap tests first.
This patch provides a means for backend relax_section support to
increase the size of a section without needing to reallocate
section contents. This helps reduce memory usage when the added space
does not need to be written in relax_section, as is the case for
powerpc. Writing the stubs later means a few tweaks are needed in the
powerpc relocate_section function, but also removes some code
duplication since the extra ld -r relocs can be written there too.
* elf-bfd.h (struct elf_backend_data): Add caches_rawsize.
* elfxx-target.h (elf_backend_caches_rawsize): Define.
(elfNN_bed): Init new field.
* elflink.c (elf_link_input_bfd): Handle caches_rawsize.
* elf32-ppc.c (shared_stub_entry): Zero addi offset.
(ppc_elf_relax_section): Don't reallocate section here, write
stubs, or write out relocs for ld -r here..
(ppc_elf_relocate_section): ..instead write stubs here, and use
existing code to write out relocs for ld -r. Fix offset
adjustment on reloc for little-endian.
(elf_backend_caches_rawsize): Define.
bfd/
2014-02-04 Jan Kratochvil <jan.kratochvil@redhat.com>
* coff-rs6000.c (xcoff_write_archive_contents_big): Free OFFSETS in
return paths. Three times.
* elf64-ppc.c (ppc64_elf_link_hash_table_create): Free HTAB in all
return paths.
(ppc64_elf_tls_optimize): Free TOC_REF in return path.
(ppc64_elf_edit_toc): Free USED in return path.
This implements a work-around for an icache bug on 476 that can cause
execution of stale instructions when control falls through from one
page to the next. The idea is to prevent such fall-through by
replacing the last instruction on a page with a branch to a patch
area containing the instruction, then branch to the next page.
The patch also fixes a number of bugs in the existing support for long
branch trampolines.
bfd/
* elf32-ppc.c (struct ppc_elf_link_hash_table): Add params.
Delete emit_stub_syms, no_tls_get_addr_opt. Update all uses.
(ppc_elf_link_params): New function.
(ppc_elf_create_glink): Align .glink to 64 bytes for ppc476
workaround.
(ppc_elf_select_plt_layout): Remove plt_style and emit_stub_syms
parameters. Use htab->params instead.
(ppc_elf_tls_setup): Remove no_tls_get_addr_opt parameter.
(ppc_elf_size_dynamic_sections): Align __glink_PLTresolve to
64 bytes for ppc476 workaround.
(struct ppc_elf_relax_info): New.
(ppc_elf_relax_section): Exclude linker created sections and
those too small to hold one instruction. Don't add another
branch around trampolines on later relax passes. Don't
generate trampolines for undefined symbols when !relocatable,
nor for plugin symbols. Allocate space for ppc476 workaround
patch area. Free fixups on error return path.
(ppc_elf_relocate_section): Handle ppc476 workaround patching.
* elf32-ppc.h (struct ppc_elf_params): New.
(ppc_elf_select_plt_layout, ppc_elf_tls_setup): Update prototype.
(ppc_elf_link_params): Declare.
* section.c (SEC_INFO_TYPE_TARGET): Define.
* bfd-in2.h: Regenerate.
ld/
* emultempl/ppc32elf.em (no_tls_get_addr_opt, emit_stub_syms)
plt_style): Delete. Adjust all refs to instead use..
(params): ..this. New variable.
(ppc_after_open_output): New function. Tweak params and pass to
ppc_elf_link_params.
(ppc_after_open): Adjust ppc_elf_select_plt_layout call.
(ppc_before_allocation): Adjust ppc_elf_tls_setup call. Enable
relaxation for ppc476 workaround.
(PARSE_AND_LIST_*): Add --{no-,}ppc476-workaround support.
(LDEMUL_CREATE_OUTPUT_SECTION_STATEMENTS): Define.
ELFOSABI_GNU for binaries containing unique symbols. So I am reverting that patch and
instead applying the patch below to fix up the targets that were triggering the test failure.
bfd/ChangeLog
2014-01-29 Nick Clifton <nickc@redhat.com>
* elf32-metag.c (elf_metag_post_process_headers): Call
_bfd_elf_post_process_headers.
* elf32-sh64.c (sh64_elf_copy_private_data): Call
_bfd_elf_copy_private_data.
* elf64-sh64.c (sh_elf64_copy_private_data_internal): Likewise.
binutils/testsuite/ChangeLog
2014-01-29 Nick Clifton <nickc@redhat.com>
* binutils-all/strip-10.d: Revert previous delta.
Alan Modra
Chung-Lin Tang
H.J. Lu
Jack Carter
Jan Kratochvil
Rainer Orth
Sandra Loosemore
Nick Clifton