aboutsummaryrefslogtreecommitdiff
path: root/lld/ELF
diff options
context:
space:
mode:
Diffstat (limited to 'lld/ELF')
-rw-r--r--lld/ELF/Arch/AArch64.cpp4
-rw-r--r--lld/ELF/Config.h3
-rw-r--r--lld/ELF/Driver.cpp87
-rw-r--r--lld/ELF/InputFiles.cpp41
-rw-r--r--lld/ELF/InputFiles.h1
-rw-r--r--lld/ELF/InputSection.cpp1
-rw-r--r--lld/ELF/Relocations.cpp28
-rw-r--r--lld/ELF/Relocations.h1
-rw-r--r--lld/ELF/SyntheticSections.cpp40
-rw-r--r--lld/ELF/Writer.cpp3
10 files changed, 151 insertions, 58 deletions
diff --git a/lld/ELF/Arch/AArch64.cpp b/lld/ELF/Arch/AArch64.cpp
index 30ccd68..017c17c 100644
--- a/lld/ELF/Arch/AArch64.cpp
+++ b/lld/ELF/Arch/AArch64.cpp
@@ -113,6 +113,8 @@ RelExpr AArch64::getRelExpr(RelType type, const Symbol &s,
case R_AARCH64_MOVW_UABS_G2_NC:
case R_AARCH64_MOVW_UABS_G3:
return R_ABS;
+ case R_AARCH64_AUTH_ABS64:
+ return R_AARCH64_AUTH;
case R_AARCH64_TLSDESC_ADR_PAGE21:
return R_AARCH64_TLSDESC_PAGE;
case R_AARCH64_TLSDESC_LD64_LO12:
@@ -204,7 +206,7 @@ bool AArch64::usesOnlyLowPageBits(RelType type) const {
}
RelType AArch64::getDynRel(RelType type) const {
- if (type == R_AARCH64_ABS64)
+ if (type == R_AARCH64_ABS64 || type == R_AARCH64_AUTH_ABS64)
return type;
return R_AARCH64_NONE;
}
diff --git a/lld/ELF/Config.h b/lld/ELF/Config.h
index 27274d6..83f293a 100644
--- a/lld/ELF/Config.h
+++ b/lld/ELF/Config.h
@@ -187,6 +187,7 @@ struct Config {
llvm::StringRef cmseOutputLib;
StringRef zBtiReport = "none";
StringRef zCetReport = "none";
+ StringRef zPauthReport = "none";
bool ltoBBAddrMap;
llvm::StringRef ltoBasicBlockSections;
std::pair<llvm::StringRef, llvm::StringRef> thinLTOObjectSuffixReplace;
@@ -499,6 +500,8 @@ struct Ctx {
void reset();
llvm::raw_fd_ostream openAuxiliaryFile(llvm::StringRef, std::error_code &);
+
+ ArrayRef<uint8_t> aarch64PauthAbiCoreInfo;
};
LLVM_LIBRARY_VISIBILITY extern Ctx ctx;
diff --git a/lld/ELF/Driver.cpp b/lld/ELF/Driver.cpp
index b43da77..86cc096 100644
--- a/lld/ELF/Driver.cpp
+++ b/lld/ELF/Driver.cpp
@@ -46,6 +46,7 @@
#include "lld/Common/Strings.h"
#include "lld/Common/TargetOptionsCommandFlags.h"
#include "lld/Common/Version.h"
+#include "llvm/ADT/STLExtras.h"
#include "llvm/ADT/SetVector.h"
#include "llvm/ADT/StringExtras.h"
#include "llvm/ADT/StringSwitch.h"
@@ -461,6 +462,8 @@ static void checkOptions() {
error("-z force-bti only supported on AArch64");
if (config->zBtiReport != "none")
error("-z bti-report only supported on AArch64");
+ if (config->zPauthReport != "none")
+ error("-z pauth-report only supported on AArch64");
}
if (config->emachine != EM_386 && config->emachine != EM_X86_64 &&
@@ -1501,7 +1504,8 @@ static void readConfigs(opt::InputArgList &args) {
}
auto reports = {std::make_pair("bti-report", &config->zBtiReport),
- std::make_pair("cet-report", &config->zCetReport)};
+ std::make_pair("cet-report", &config->zCetReport),
+ std::make_pair("pauth-report", &config->zPauthReport)};
for (opt::Arg *arg : args.filtered(OPT_z)) {
std::pair<StringRef, StringRef> option =
StringRef(arg->getValue()).split('=');
@@ -2599,14 +2603,17 @@ static void redirectSymbols(ArrayRef<WrappedSymbol> wrapped) {
symtab.wrap(w.sym, w.real, w.wrap);
}
+static void reportMissingFeature(StringRef config, const Twine &report) {
+ if (config == "error")
+ error(report);
+ else if (config == "warning")
+ warn(report);
+}
+
static void checkAndReportMissingFeature(StringRef config, uint32_t features,
uint32_t mask, const Twine &report) {
- if (!(features & mask)) {
- if (config == "error")
- error(report);
- else if (config == "warning")
- warn(report);
- }
+ if (!(features & mask))
+ reportMissingFeature(config, report);
}
// To enable CET (x86's hardware-assisted control flow enforcement), each
@@ -2617,12 +2624,28 @@ static void checkAndReportMissingFeature(StringRef config, uint32_t features,
//
// This is also the case with AARCH64's BTI and PAC which use the similar
// GNU_PROPERTY_AARCH64_FEATURE_1_AND mechanism.
-static uint32_t getAndFeatures() {
+//
+// For AArch64 PAuth-enabled object files, the core info of all of them must
+// match. Missing info for some object files with matching info for remaining
+// ones can be allowed (see -z pauth-report).
+static void readSecurityNotes() {
if (config->emachine != EM_386 && config->emachine != EM_X86_64 &&
config->emachine != EM_AARCH64)
- return 0;
+ return;
+
+ config->andFeatures = -1;
+
+ StringRef referenceFileName;
+ if (config->emachine == EM_AARCH64) {
+ auto it = llvm::find_if(ctx.objectFiles, [](const ELFFileBase *f) {
+ return !f->aarch64PauthAbiCoreInfo.empty();
+ });
+ if (it != ctx.objectFiles.end()) {
+ ctx.aarch64PauthAbiCoreInfo = (*it)->aarch64PauthAbiCoreInfo;
+ referenceFileName = (*it)->getName();
+ }
+ }
- uint32_t ret = -1;
for (ELFFileBase *f : ctx.objectFiles) {
uint32_t features = f->andFeatures;
@@ -2658,14 +2681,31 @@ static uint32_t getAndFeatures() {
"GNU_PROPERTY_AARCH64_FEATURE_1_PAC property");
features |= GNU_PROPERTY_AARCH64_FEATURE_1_PAC;
}
- ret &= features;
+ config->andFeatures &= features;
+
+ if (ctx.aarch64PauthAbiCoreInfo.empty())
+ continue;
+
+ if (f->aarch64PauthAbiCoreInfo.empty()) {
+ reportMissingFeature(config->zPauthReport,
+ toString(f) +
+ ": -z pauth-report: file does not have AArch64 "
+ "PAuth core info while '" +
+ referenceFileName + "' has one");
+ continue;
+ }
+
+ if (ctx.aarch64PauthAbiCoreInfo != f->aarch64PauthAbiCoreInfo)
+ errorOrWarn("incompatible values of AArch64 PAuth core info found\n>>> " +
+ referenceFileName + ": 0x" +
+ toHex(ctx.aarch64PauthAbiCoreInfo, /*LowerCase=*/true) +
+ "\n>>> " + toString(f) + ": 0x" +
+ toHex(f->aarch64PauthAbiCoreInfo, /*LowerCase=*/true));
}
// Force enable Shadow Stack.
if (config->zShstk)
- ret |= GNU_PROPERTY_X86_FEATURE_1_SHSTK;
-
- return ret;
+ config->andFeatures |= GNU_PROPERTY_X86_FEATURE_1_SHSTK;
}
static void initSectionsAndLocalSyms(ELFFileBase *file, bool ignoreComdats) {
@@ -2727,13 +2767,6 @@ template <class ELFT> void LinkerDriver::link(opt::InputArgList &args) {
// Create dynamic sections for dynamic linking and static PIE.
config->hasDynSymTab = !ctx.sharedFiles.empty() || config->isPic;
- script->addScriptReferencedSymbolsToSymTable();
-
- // Prevent LTO from removing any definition referenced by -u.
- for (StringRef name : config->undefined)
- if (Defined *sym = dyn_cast_or_null<Defined>(symtab.find(name)))
- sym->isUsedInRegularObj = true;
-
// If an entry symbol is in a static archive, pull out that file now.
if (Symbol *sym = symtab.find(config->entry))
handleUndefined(sym, "--entry");
@@ -2742,6 +2775,16 @@ template <class ELFT> void LinkerDriver::link(opt::InputArgList &args) {
for (StringRef pat : args::getStrings(args, OPT_undefined_glob))
handleUndefinedGlob(pat);
+ // After potential archive member extraction involving ENTRY and
+ // -u/--undefined-glob, check whether PROVIDE symbols should be defined (the
+ // RHS may refer to definitions in just extracted object files).
+ script->addScriptReferencedSymbolsToSymTable();
+
+ // Prevent LTO from removing any definition referenced by -u.
+ for (StringRef name : config->undefined)
+ if (Defined *sym = dyn_cast_or_null<Defined>(symtab.find(name)))
+ sym->isUsedInRegularObj = true;
+
// Mark -init and -fini symbols so that the LTO doesn't eliminate them.
if (Symbol *sym = dyn_cast_or_null<Defined>(symtab.find(config->init)))
sym->isUsedInRegularObj = true;
@@ -2944,7 +2987,7 @@ template <class ELFT> void LinkerDriver::link(opt::InputArgList &args) {
// Read .note.gnu.property sections from input object files which
// contain a hint to tweak linker's and loader's behaviors.
- config->andFeatures = getAndFeatures();
+ readSecurityNotes();
// The Target instance handles target-specific stuff, such as applying
// relocations or writing a PLT section. It also contains target-dependent
diff --git a/lld/ELF/InputFiles.cpp b/lld/ELF/InputFiles.cpp
index 6529ea0..1f49602 100644
--- a/lld/ELF/InputFiles.cpp
+++ b/lld/ELF/InputFiles.cpp
@@ -926,25 +926,18 @@ void ObjFile<ELFT>::initializeSections(bool ignoreComdats,
handleSectionGroup<ELFT>(this->sections, entries);
}
-// If a source file is compiled with x86 hardware-assisted call flow control
-// enabled, the generated object file contains feature flags indicating that
-// fact. This function reads the feature flags and returns it.
-//
-// Essentially we want to read a single 32-bit value in this function, but this
-// function is rather complicated because the value is buried deep inside a
-// .note.gnu.property section.
-//
-// The section consists of one or more NOTE records. Each NOTE record consists
-// of zero or more type-length-value fields. We want to find a field of a
-// certain type. It seems a bit too much to just store a 32-bit value, perhaps
-// the ABI is unnecessarily complicated.
-template <class ELFT> static uint32_t readAndFeatures(const InputSection &sec) {
+// Read the following info from the .note.gnu.property section and write it to
+// the corresponding fields in `ObjFile`:
+// - Feature flags (32 bits) representing x86 or AArch64 features for
+// hardware-assisted call flow control;
+// - AArch64 PAuth ABI core info (16 bytes).
+template <class ELFT>
+void readGnuProperty(const InputSection &sec, ObjFile<ELFT> &f) {
using Elf_Nhdr = typename ELFT::Nhdr;
using Elf_Note = typename ELFT::Note;
- uint32_t featuresSet = 0;
ArrayRef<uint8_t> data = sec.content();
- auto reportFatal = [&](const uint8_t *place, const char *msg) {
+ auto reportFatal = [&](const uint8_t *place, const Twine &msg) {
fatal(toString(sec.file) + ":(" + sec.name + "+0x" +
Twine::utohexstr(place - sec.content().data()) + "): " + msg);
};
@@ -983,7 +976,19 @@ template <class ELFT> static uint32_t readAndFeatures(const InputSection &sec) {
// accumulate the bits set.
if (size < 4)
reportFatal(place, "FEATURE_1_AND entry is too short");
- featuresSet |= read32<ELFT::Endianness>(desc.data());
+ f.andFeatures |= read32<ELFT::Endianness>(desc.data());
+ } else if (config->emachine == EM_AARCH64 &&
+ type == GNU_PROPERTY_AARCH64_FEATURE_PAUTH) {
+ if (!f.aarch64PauthAbiCoreInfo.empty()) {
+ reportFatal(data.data(),
+ "multiple GNU_PROPERTY_AARCH64_FEATURE_PAUTH entries are "
+ "not supported");
+ } else if (size != 16) {
+ reportFatal(data.data(), "GNU_PROPERTY_AARCH64_FEATURE_PAUTH entry "
+ "is invalid: expected 16 bytes, but got " +
+ Twine(size));
+ }
+ f.aarch64PauthAbiCoreInfo = desc;
}
// Padding is present in the note descriptor, if necessary.
@@ -993,8 +998,6 @@ template <class ELFT> static uint32_t readAndFeatures(const InputSection &sec) {
// Go to next NOTE record to look for more FEATURE_1_AND descriptions.
data = data.slice(nhdr->getSize(sec.addralign));
}
-
- return featuresSet;
}
template <class ELFT>
@@ -1051,7 +1054,7 @@ InputSectionBase *ObjFile<ELFT>::createInputSection(uint32_t idx,
// .note.gnu.property containing a single AND'ed bitmap, we discard an input
// file's .note.gnu.property section.
if (name == ".note.gnu.property") {
- this->andFeatures = readAndFeatures<ELFT>(InputSection(*this, sec, name));
+ readGnuProperty<ELFT>(InputSection(*this, sec, name), *this);
return &InputSection::discarded;
}
diff --git a/lld/ELF/InputFiles.h b/lld/ELF/InputFiles.h
index 9519759..834b3b6 100644
--- a/lld/ELF/InputFiles.h
+++ b/lld/ELF/InputFiles.h
@@ -230,6 +230,7 @@ protected:
public:
uint32_t andFeatures = 0;
bool hasCommonSyms = false;
+ ArrayRef<uint8_t> aarch64PauthAbiCoreInfo;
};
// .o file.
diff --git a/lld/ELF/InputSection.cpp b/lld/ELF/InputSection.cpp
index 4f88313..c06816b 100644
--- a/lld/ELF/InputSection.cpp
+++ b/lld/ELF/InputSection.cpp
@@ -676,6 +676,7 @@ uint64_t InputSectionBase::getRelocTargetVA(const InputFile *file, RelType type,
case R_DTPREL:
case R_RELAX_TLS_LD_TO_LE_ABS:
case R_RELAX_GOT_PC_NOPIC:
+ case R_AARCH64_AUTH:
case R_RISCV_ADD:
case R_RISCV_LEB128:
return sym.getVA(a);
diff --git a/lld/ELF/Relocations.cpp b/lld/ELF/Relocations.cpp
index 92f2e20..5527434 100644
--- a/lld/ELF/Relocations.cpp
+++ b/lld/ELF/Relocations.cpp
@@ -995,7 +995,8 @@ bool RelocationScanner::isStaticLinkTimeConstant(RelExpr e, RelType type,
if (e == R_GOT || e == R_PLT)
return target->usesOnlyLowPageBits(type) || !config->isPic;
- if (sym.isPreemptible)
+ // R_AARCH64_AUTH_ABS64 requires a dynamic relocation.
+ if (sym.isPreemptible || e == R_AARCH64_AUTH)
return false;
if (!config->isPic)
return true;
@@ -1141,12 +1142,26 @@ void RelocationScanner::processAux(RelExpr expr, RelType type, uint64_t offset,
(rel == target->symbolicRel && !sym.isPreemptible)) {
addRelativeReloc<true>(*sec, offset, sym, addend, expr, type);
return;
- } else if (rel != 0) {
+ }
+ if (rel != 0) {
if (config->emachine == EM_MIPS && rel == target->symbolicRel)
rel = target->relativeRel;
std::lock_guard<std::mutex> lock(relocMutex);
- sec->getPartition().relaDyn->addSymbolReloc(rel, *sec, offset, sym,
- addend, type);
+ Partition &part = sec->getPartition();
+ if (config->emachine == EM_AARCH64 && type == R_AARCH64_AUTH_ABS64) {
+ // For a preemptible symbol, we can't use a relative relocation. For an
+ // undefined symbol, we can't compute offset at link-time and use a
+ // relative relocation. Use a symbolic relocation instead.
+ if (sym.isPreemptible) {
+ part.relaDyn->addSymbolReloc(type, *sec, offset, sym, addend, type);
+ } else {
+ part.relaDyn->addReloc({R_AARCH64_AUTH_RELATIVE, sec, offset,
+ DynamicReloc::AddendOnlyWithTargetVA, sym,
+ addend, R_ABS});
+ }
+ return;
+ }
+ part.relaDyn->addSymbolReloc(rel, *sec, offset, sym, addend, type);
// MIPS ABI turns using of GOT and dynamic relocations inside out.
// While regular ABI uses dynamic relocations to fill up GOT entries
@@ -1171,7 +1186,10 @@ void RelocationScanner::processAux(RelExpr expr, RelType type, uint64_t offset,
// When producing an executable, we can perform copy relocations (for
// STT_OBJECT) and canonical PLT (for STT_FUNC) if sym is defined by a DSO.
- if (!config->shared && sym.isShared()) {
+ // Copy relocations/canonical PLT entries are unsupported for
+ // R_AARCH64_AUTH_ABS64.
+ if (!config->shared && sym.isShared() &&
+ !(config->emachine == EM_AARCH64 && type == R_AARCH64_AUTH_ABS64)) {
if (!canDefineSymbolInExecutable(sym)) {
errorOrWarn("cannot preempt symbol: " + toString(sym) +
getLocation(*sec, sym, offset));
diff --git a/lld/ELF/Relocations.h b/lld/ELF/Relocations.h
index 7eb8a811..b7b9c09 100644
--- a/lld/ELF/Relocations.h
+++ b/lld/ELF/Relocations.h
@@ -87,6 +87,7 @@ enum RelExpr {
R_AARCH64_PAGE_PC,
R_AARCH64_RELAX_TLS_GD_TO_IE_PAGE_PC,
R_AARCH64_TLSDESC_PAGE,
+ R_AARCH64_AUTH,
R_ARM_PCA,
R_ARM_SBREL,
R_MIPS_GOTREL,
diff --git a/lld/ELF/SyntheticSections.cpp b/lld/ELF/SyntheticSections.cpp
index d4dc713..4427a12 100644
--- a/lld/ELF/SyntheticSections.cpp
+++ b/lld/ELF/SyntheticSections.cpp
@@ -314,22 +314,42 @@ GnuPropertySection::GnuPropertySection()
config->wordsize, ".note.gnu.property") {}
void GnuPropertySection::writeTo(uint8_t *buf) {
+ write32(buf, 4); // Name size
+ write32(buf + 4, getSize() - 16); // Content size
+ write32(buf + 8, NT_GNU_PROPERTY_TYPE_0); // Type
+ memcpy(buf + 12, "GNU", 4); // Name string
+
uint32_t featureAndType = config->emachine == EM_AARCH64
? GNU_PROPERTY_AARCH64_FEATURE_1_AND
: GNU_PROPERTY_X86_FEATURE_1_AND;
- write32(buf, 4); // Name size
- write32(buf + 4, config->is64 ? 16 : 12); // Content size
- write32(buf + 8, NT_GNU_PROPERTY_TYPE_0); // Type
- memcpy(buf + 12, "GNU", 4); // Name string
- write32(buf + 16, featureAndType); // Feature type
- write32(buf + 20, 4); // Feature size
- write32(buf + 24, config->andFeatures); // Feature flags
- if (config->is64)
- write32(buf + 28, 0); // Padding
+ unsigned offset = 16;
+ if (config->andFeatures != 0) {
+ write32(buf + offset + 0, featureAndType); // Feature type
+ write32(buf + offset + 4, 4); // Feature size
+ write32(buf + offset + 8, config->andFeatures); // Feature flags
+ if (config->is64)
+ write32(buf + offset + 12, 0); // Padding
+ offset += 16;
+ }
+
+ if (!ctx.aarch64PauthAbiCoreInfo.empty()) {
+ write32(buf + offset + 0, GNU_PROPERTY_AARCH64_FEATURE_PAUTH);
+ write32(buf + offset + 4, ctx.aarch64PauthAbiCoreInfo.size());
+ memcpy(buf + offset + 8, ctx.aarch64PauthAbiCoreInfo.data(),
+ ctx.aarch64PauthAbiCoreInfo.size());
+ }
}
-size_t GnuPropertySection::getSize() const { return config->is64 ? 32 : 28; }
+size_t GnuPropertySection::getSize() const {
+ uint32_t contentSize = 0;
+ if (config->andFeatures != 0)
+ contentSize += config->is64 ? 16 : 12;
+ if (!ctx.aarch64PauthAbiCoreInfo.empty())
+ contentSize += 4 + 4 + ctx.aarch64PauthAbiCoreInfo.size();
+ assert(contentSize != 0);
+ return contentSize + 16;
+}
BuildIdSection::BuildIdSection()
: SyntheticSection(SHF_ALLOC, SHT_NOTE, 4, ".note.gnu.build-id"),
diff --git a/lld/ELF/Writer.cpp b/lld/ELF/Writer.cpp
index 40d617b..fc9084f 100644
--- a/lld/ELF/Writer.cpp
+++ b/lld/ELF/Writer.cpp
@@ -24,6 +24,7 @@
#include "lld/Common/CommonLinkerContext.h"
#include "lld/Common/Filesystem.h"
#include "lld/Common/Strings.h"
+#include "llvm/ADT/STLExtras.h"
#include "llvm/ADT/StringMap.h"
#include "llvm/Support/BLAKE3.h"
#include "llvm/Support/Parallel.h"
@@ -564,7 +565,7 @@ template <class ELFT> void elf::createSyntheticSections() {
in.iplt = std::make_unique<IpltSection>();
add(*in.iplt);
- if (config->andFeatures)
+ if (config->andFeatures || !ctx.aarch64PauthAbiCoreInfo.empty())
add(*make<GnuPropertySection>());
// .note.GNU-stack is always added when we are creating a re-linkable
generated by cgit v1.1 at 2024-09-07 07:09:28 +0000