Find PLT entries for x86, x86_64, and AArch64

[jgalenson]

Summary

This adds a new method to ELFObjectFileBase that returns the symbols and addresses of PLT entries.

This design was suggested by pcc and eugenis in https://reviews.llvm.org/D49383.

[jgalenson]

I'm not at all familiar with ELF or parsing x86 and ARM, so I'd appreciate feedback on how this works and if there's a way to do it more cleanly (especially the parsing).

I'm also not sure how to test this. The two child patches both use the new APIs and have tests for themselves, so perhaps that's good enough?

[paulsemel]

lib/Object/ELFObjectFile.cpp

357–360

As explained here, this is in my opinion not the right way to get the plt/got etc..

[jgalenson]

lib/Object/ELFObjectFile.cpp

357–360

It seems like we decided over there to keep it this way.

[jgalenson]

Friendly ping.

[pcc]

lib/Object/ELFObjectFile.cpp

340

Maybe this should be named JumpSlotReloc?

lib/Target/AArch64/MCTargetDesc/AArch64MCTargetDesc.cpp

166

You could use the support::endian::read32le function here (and elsewhere in the patch).

171

To avoid excessive indentation I'd write this with an early continue.

if (Insn >> 31 != 1 || ((Insn >> 24) & 0x1f) != 0x10)
  continue;
uint64_t Imm = ...;

I might also simplify the condition like this:

if ((Insn & 0x9f000000) != 0x90000000)
  continue;

177

I'd write out the instruction: ldr Xt, [Xn, #pimm] so that it's clear which ldr variant you're matching for.

lib/Target/X86/MCTargetDesc/X86MCTargetDesc.cpp

449

I wouldn't try to match the push here (and in the 64-bit version) since it's not essential for decoding the plt entry. It's also theoretically possible for it to be missing, e.g. a linker would be able to avoid emitting it when passed -z now.

450

I think you also need to be able to decode the 0xff 0x25 form here, it's used in non-PIC executables.

[jgalenson]

lib/Target/AArch64/MCTargetDesc/AArch64MCTargetDesc.cpp

166

Ooh, I didn't know about that. Thanks!

171

Good ideas. Thanks.

lib/Target/X86/MCTargetDesc/X86MCTargetDesc.cpp

449

I didn't know that. Thanks.

450

I extended the condition to handle that case. But does anything else change with that form, or just these bits of the opcode?

[pcc]

lib/Object/ELFObjectFile.cpp

357–368

I don't think these find_if calls will do what you expect if the section is not found. In that case find_if will return the end iterator, and dereferencing it is UB.

I'd rewrite this as a single loop over sections().

lib/Target/AArch64/MCTargetDesc/AArch64MCTargetDesc.cpp

171

Move the declaration of Imm onto this line.

lib/Target/X86/MCTargetDesc/X86MCTargetDesc.cpp

450

0xff 0x25 is similar to the equivalent 64-bit instruction, except that in 32-bit mode the immediate is not PC-relative. So I think you will need a separate block of code to handle it.

[pcc]

LGTM

include/llvm/MC/MCInstrAnalysis.h

 #include "llvm/MC/MCInst.h"
 #include "llvm/MC/MCInstrDesc.h"
 #include "llvm/MC/MCInstrInfo.h"
 #include <cstdint>
 
 namespace llvm {
 
 class MCRegisterInfo;
+class Triple;
 
 class MCInstrAnalysis {
 protected:
   friend class Target;
 
   const MCInstrInfo *Info;
 
 public:
public:
   virtual bool isDependencyBreaking(const MCSubtargetInfo &STI,
                                     const MCInst &Inst) const;
 
   /// Given a branch instruction try to get the address the branch
   /// targets. Return true on success, and the address in Target.
   virtual bool
   evaluateBranch(const MCInst &Inst, uint64_t Addr, uint64_t Size,
                  uint64_t &Target) const;
+
+  /// Returns (PLT virtual address, GOT virtual address) pairs for PLT entries.
+  virtual std::vector<std::pair<uint64_t, uint64_t>>
+  findPltEntries(uint64_t PltSectionVA, ArrayRef<uint8_t> PltContents,
+                 uint64_t GotPltSectionVA, const Triple &TargetTriple) const {
+    return {};
+  }
 };
 
 } // end namespace llvm
 
 #endif // LLVM_MC_MCINSTRANALYSIS_H

include/llvm/Object/ELFObjectFile.h

public:
 
   SubtargetFeatures getARMFeatures() const;
 
   SubtargetFeatures getRISCVFeatures() const;
 
   void setARMSubArch(Triple &TheTriple) const override;
 
   virtual uint16_t getEType() const = 0;
+
+  std::vector<std::pair<DataRefImpl, uint64_t>> getPltAddresses() const;
 };
 
 class ELFSectionRef : public SectionRef {
 public:
   ELFSectionRef(const SectionRef &B) : SectionRef(B) {
     assert(isa<ELFObjectFileBase>(SectionRef::getObject()));
   }
 

lib/Object/ELFObjectFile.cpp

 //===- ELFObjectFile.cpp - ELF object file implementation -----------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 // Part of the ELFObjectFile class implementation.
 //
 //===----------------------------------------------------------------------===//
 
 #include "llvm/Object/ELFObjectFile.h"
 #include "llvm/ADT/Triple.h"
 #include "llvm/BinaryFormat/ELF.h"
+#include "llvm/MC/MCInstrAnalysis.h"
 #include "llvm/MC/SubtargetFeature.h"
 #include "llvm/Object/ELF.h"
 #include "llvm/Object/ELFTypes.h"
 #include "llvm/Object/Error.h"
 #include "llvm/Support/ARMAttributeParser.h"
 #include "llvm/Support/ARMBuildAttributes.h"
 #include "llvm/Support/Endian.h"
 #include "llvm/Support/ErrorHandling.h"
 #include "llvm/Support/MathExtras.h"
+#include "llvm/Support/TargetRegistry.h"
 #include <algorithm>
 #include <cstddef>
 #include <cstdint>
 #include <memory>
 #include <string>
 #include <system_error>
 #include <utility>
 
case ARMBuildAttrs::v7E_M:
       break;
     }
   }
   if (!isLittleEndian())
     Triple += "eb";
 
   TheTriple.setArchName(Triple);
 }
+
+std::vector<std::pair<DataRefImpl, uint64_t>>
+ELFObjectFileBase::getPltAddresses() const {
+  std::string Err;
+  const auto Triple = makeTriple();
+  const auto *T = TargetRegistry::lookupTarget(Triple.str(), Err);
+  if (!T)
+    return {};
+  uint64_t JumpSlotReloc = 0;
+  switch (Triple.getArch()) {
+    case Triple::x86:
+      JumpSlotReloc = ELF::R_386_JUMP_SLOT;
+      break;
+    case Triple::x86_64:
+      JumpSlotReloc = ELF::R_X86_64_JUMP_SLOT;
+      break;
+    case Triple::aarch64:
+      JumpSlotReloc = ELF::R_AARCH64_JUMP_SLOT;
+      break;
+    default:
+      return {};
+  }
+  const auto *MIA = T->createMCInstrAnalysis(T->createMCInstrInfo());
+  if (!MIA)
+    return {};
+  const SectionRef *Plt = &*find_if(sections(), [&](const SectionRef &Sec) {
+    StringRef Name;
+    return !Sec.getName(Name) && Name == ".plt";
+  });
+  const SectionRef *RelaPlt = &*find_if(sections(), [&](const SectionRef &Sec) {
+    StringRef Name;
+    return !Sec.getName(Name) && (Name == ".rela.plt" || Name == ".rel.plt");
+  });
+  const SectionRef *GotPlt = &*find_if(sections(), [&](const SectionRef &Sec) {
+    StringRef Name;
+    return !Sec.getName(Name) && (Name == ".got.plt");
+  });
+  if (!Plt || !RelaPlt || !GotPlt)
+    return {};
+  StringRef PltContents;
+  if (Plt->getContents(PltContents))
+    return {};
+  ArrayRef<uint8_t> PltBytes((const uint8_t *)PltContents.data(),
+                             Plt->getSize());
+  auto PltEntries = MIA->findPltEntries(Plt->getAddress(), PltBytes,
+                                        GotPlt->getAddress(), Triple);
+  // Build a map from GOT entry virtual address to PLT entry virtual address.
+  DenseMap<uint64_t, uint64_t> GotToPlt;
+  for (const auto &Entry : PltEntries)
+    GotToPlt.insert(std::make_pair(Entry.second, Entry.first));
+  // Find the relocations in the dynamic relocation table that point to
+  // locations in the GOT for which we know the corresponding PLT entry.
+  std::vector<std::pair<DataRefImpl, uint64_t>> Result;
+  for (const auto &Relocation : RelaPlt->relocations()) {
+    if (Relocation.getType() != JumpSlotReloc)
+      continue;
+    auto PltEntryIter = GotToPlt.find(Relocation.getOffset());
+    if (PltEntryIter != GotToPlt.end())
+      Result.push_back(std::make_pair(
+          Relocation.getSymbol()->getRawDataRefImpl(), PltEntryIter->second));
+  }
+  return Result;
+}

lib/Target/AArch64/MCTargetDesc/AArch64MCTargetDesc.cpp

 #include "llvm/MC/MCAsmBackend.h"
 #include "llvm/MC/MCCodeEmitter.h"
 #include "llvm/MC/MCInstrAnalysis.h"
 #include "llvm/MC/MCInstrInfo.h"
 #include "llvm/MC/MCObjectWriter.h"
 #include "llvm/MC/MCRegisterInfo.h"
 #include "llvm/MC/MCStreamer.h"
 #include "llvm/MC/MCSubtargetInfo.h"
+#include "llvm/Support/Endian.h"
 #include "llvm/Support/ErrorHandling.h"
 #include "llvm/Support/TargetRegistry.h"
 
 using namespace llvm;
 
 #define GET_INSTRINFO_MC_DESC
 #include "AArch64GenInstrInfo.inc"
 
for (unsigned i = 0, e = Inst.getNumOperands(); i != e; i++) {
       if (Desc.OpInfo[i].OperandType == MCOI::OPERAND_PCREL) {
         int64_t Imm = Inst.getOperand(i).getImm() * 4;
         Target = Addr + Imm;
         return true;
       }
     }
     return false;
   }
+
+  std::vector<std::pair<uint64_t, uint64_t>>
+  findPltEntries(uint64_t PltSectionVA, ArrayRef<uint8_t> PltContents,
+                 uint64_t GotPltSectionVA,
+                 const Triple &TargetTriple) const override {
+    // Do a lightweight parsing of PLT entries.
+    std::vector<std::pair<uint64_t, uint64_t>> Result;
+    for (uint64_t Byte = 0, End = PltContents.size(); Byte + 7 < End;
+         Byte += 4) {
+      uint32_t Insn = support::endian::read32le(PltContents.data() + Byte);
+      uint64_t Imm = 0;
+      // Check for adrp.
+      if ((Insn & 0x9f000000) != 0x90000000)
+        continue;
+      Imm = (((PltSectionVA + Byte) >> 12) << 12) +
+            (((Insn >> 29) & 3) << 12) + (((Insn >> 5) & 0x3ffff) << 14);
+      uint32_t Insn2 = support::endian::read32le(PltContents.data() + Byte + 4);
+      // Check for: ldr Xt, [Xn, #pimm].
+      if (Insn2 >> 22 == 0x3e5) {
+        Imm += ((Insn2 >> 10) & 0xfff) << 3;
+        Result.push_back(std::make_pair(PltSectionVA + Byte, Imm));
+        Byte += 4;
+      }
+    }
+    return Result;
+  }
 };
 
 } // end anonymous namespace
 
 static MCInstrAnalysis *createAArch64InstrAnalysis(const MCInstrInfo *Info) {
   return new AArch64MCInstrAnalysis(Info);
 }
 

lib/Target/X86/MCTargetDesc/X86MCTargetDesc.cpp

 
 public:
   X86MCInstrAnalysis(const MCInstrInfo *MCII) : MCInstrAnalysis(MCII) {}
 
   bool isDependencyBreaking(const MCSubtargetInfo &STI,
                             const MCInst &Inst) const override;
   bool clearsSuperRegisters(const MCRegisterInfo &MRI, const MCInst &Inst,
                             APInt &Mask) const override;
+  std::vector<std::pair<uint64_t, uint64_t>>
+  findPltEntries(uint64_t PltSectionVA, ArrayRef<uint8_t> PltContents,
+                 uint64_t GotSectionVA, const Triple &TargetTriple) const;
 };
 
 bool X86MCInstrAnalysis::isDependencyBreaking(const MCSubtargetInfo &STI,
                                               const MCInst &Inst) const {
   if (STI.getCPU() == "btver2") {
     // Reference: Agner Fog's microarchitecture.pdf - Section 20 "AMD Bobcat and
     // Jaguar pipeline", subsection 8 "Dependency-breaking instructions".
     switch (Inst.getOpcode()) {
for (unsigned I = 0, E = NumImplicitDefs; I < E; ++I) {
     const MCPhysReg Reg = Desc.getImplicitDefs()[I];
     if (ClearsSuperReg(Reg))
       Mask.setBit(NumDefs + I);
   }
 
   return Mask.getBoolValue();
 }
 
+static std::vector<std::pair<uint64_t, uint64_t>>
+findX86PltEntries(uint64_t PltSectionVA, ArrayRef<uint8_t> PltContents,
+                  uint64_t GotPltSectionVA) {
+  // Do a lightweight parsing of PLT entries.
+  std::vector<std::pair<uint64_t, uint64_t>> Result;
+  for (uint64_t Byte = 0, End = PltContents.size(); Byte + 6 < End; ) {
+    // Recognize a jmp.
+    if (PltContents[Byte] == 0xff &&
+        (PltContents[Byte + 1] == 0xa3 || PltContents[Byte + 1] == 0x25)) {
+      // The jmp instruction at the beginning of each PLT entry jumps to the
+      // address of the base of the .got.plt section plus the immediate.
+      uint32_t Imm = support::endian::read32le(PltContents.data() + Byte + 2);
+      Result.push_back(
+          std::make_pair(PltSectionVA + Byte, GotPltSectionVA + Imm));
+      Byte += 6;
+    } else
+      Byte++;
+  }
+  return Result;
+}
+
+static std::vector<std::pair<uint64_t, uint64_t>>
+findX86_64PltEntries(uint64_t PltSectionVA, ArrayRef<uint8_t> PltContents) {
+  // Do a lightweight parsing of PLT entries.
+  std::vector<std::pair<uint64_t, uint64_t>> Result;
+  for (uint64_t Byte = 0, End = PltContents.size(); Byte + 6 < End; ) {
+    // Recognize a jmp.
+    if (PltContents[Byte] == 0xff && PltContents[Byte + 1] == 0x25) {
+      // The jmp instruction at the beginning of each PLT entry jumps to the
+      // address of the next instruction plus the immediate.
+      uint32_t Imm = support::endian::read32le(PltContents.data() + Byte + 2);
+      Result.push_back(
+          std::make_pair(PltSectionVA + Byte, PltSectionVA + Byte + 6 + Imm));
+      Byte += 6;
+    } else
+      Byte++;
+  }
+  return Result;
+}
+
+std::vector<std::pair<uint64_t, uint64_t>> X86MCInstrAnalysis::findPltEntries(
+    uint64_t PltSectionVA, ArrayRef<uint8_t> PltContents,
+    uint64_t GotPltSectionVA, const Triple &TargetTriple) const {
+  switch (TargetTriple.getArch()) {
+    case Triple::x86:
+      return findX86PltEntries(PltSectionVA, PltContents, GotPltSectionVA);
+    case Triple::x86_64:
+      return findX86_64PltEntries(PltSectionVA, PltContents);
+    default:
+      return {};
+  }
+}
+
 } // end of namespace X86_MC
 
 } // end of namespace llvm
 
 static MCInstrAnalysis *createX86MCInstrAnalysis(const MCInstrInfo *Info) {
   return new X86_MC::X86MCInstrAnalysis(Info);
 }