1167465Smp /* Force .data aligned to 4K, so that .got very likely gets at 259243Sobrien 0x5021a0 (0x60 bytes .tdata and 0x140 bytes .dynamic) */ 359243Sobrien .data 459243Sobrien .balign 4096 559243Sobrien .section ".tdata", "awT", @progbits 659243Sobrien .globl sg1, sg2, sg3, sg4, sg5, sg6, sg7, sg8 759243Sobrien .globl sh1, sh2, sh3, sh4, sh5, sh6, sh7, sh8 859243Sobrien .hidden sh1, sh2, sh3, sh4, sh5, sh6, sh7, sh8 959243Sobriensg1: .long 17 1059243Sobriensg2: .long 18 1159243Sobriensg3: .long 19 1259243Sobriensg4: .long 20 1359243Sobriensg5: .long 21 1459243Sobriensg6: .long 22 1559243Sobriensg7: .long 23 1659243Sobriensg8: .long 24 1759243Sobriensl1: .long 65 1859243Sobriensl2: .long 66 1959243Sobriensl3: .long 67 2059243Sobriensl4: .long 68 2159243Sobriensl5: .long 69 2259243Sobriensl6: .long 70 2359243Sobriensl7: .long 71 2459243Sobriensl8: .long 72 2559243Sobriensh1: .long 257 2659243Sobriensh2: .long 258 2759243Sobriensh3: .long 259 2859243Sobriensh4: .long 260 2959243Sobriensh5: .long 261 3059243Sobriensh6: .long 262 3159243Sobriensh7: .long 263 3259243Sobriensh8: .long 264 3359243Sobrien /* Force .text aligned to 4K, so it very likely gets at 0x401000. */ 3459243Sobrien .text 3559243Sobrien .balign 4096 3659243Sobrien .globl fn2 3759243Sobrien .type fn2,@function 3859243Sobrienfn2: 3959243Sobrien pushq %rbp 4059243Sobrien movq %rsp, %rbp 4159243Sobrien 4259243Sobrien /* GD -> IE because variable is not defined in executable */ 4359243Sobrien leaq sG1@tlsdesc(%rip), %rax 4459243Sobrien call *sG1@tlscall(%rax) 4559243Sobrien nop;nop;nop;nop 4659243Sobrien 4759243Sobrien /* GD -> IE because variable is not defined in executable where 4859243Sobrien the variable is referenced through IE too */ 4959243Sobrien leaq sG2@tlsdesc(%rip), %rax 5059243Sobrien call *sG2@tlscall(%rax) 5159243Sobrien nop;nop;nop;nop 5259243Sobrien 5359243Sobrien /* GD -> LE with global variable defined in executable */ 5459243Sobrien leaq sg1@tlsdesc(%rip), %rax 5559243Sobrien call *sg1@tlscall(%rax) 5659243Sobrien nop;nop;nop;nop 5759243Sobrien 5859243Sobrien /* GD -> LE with local variable defined in executable */ 5959243Sobrien leaq sl1@tlsdesc(%rip), %rax 6059243Sobrien call *sl1@tlscall(%rax) 6159243Sobrien nop;nop;nop;nop 6259243Sobrien 6359243Sobrien /* GD -> LE with hidden variable defined in executable */ 6459243Sobrien leaq sh1@tlsdesc(%rip), %rax 6559243Sobrien call *sh1@tlscall(%rax) 6659243Sobrien nop;nop;nop;nop 6759243Sobrien 6859243Sobrien /* LD -> LE */ 6959243Sobrien leaq _TLS_MODULE_BASE_@tlsdesc(%rip), %rax 7059243Sobrien call *_TLS_MODULE_BASE_@tlscall(%rax) 7159243Sobrien nop;nop 7259243Sobrien leaq 1+sl1@dtpoff(%rax), %rdx 7359243Sobrien nop;nop 7459243Sobrien leaq sl2@dtpoff+2(%rax), %r9 7559243Sobrien nop;nop;nop;nop 7659243Sobrien 7759243Sobrien /* LD -> LE against hidden variables */ 7859243Sobrien leaq sh1@dtpoff(%rax), %rdx 7959243Sobrien nop;nop 8059243Sobrien leaq 3+sh2@dtpoff(%rax), %rcx 8159243Sobrien nop;nop;nop;nop 8259243Sobrien 8359243Sobrien /* IE against global var */ 8459243Sobrien movq %fs:0, %r9 8559243Sobrien nop;nop 8659243Sobrien addq sG2@gottpoff(%rip), %r9 8759243Sobrien nop;nop;nop;nop 8859243Sobrien 8959243Sobrien /* IE -> LE against global var defined in exec */ 9059243Sobrien movq %fs:0, %r10 9159243Sobrien nop;nop 9259243Sobrien addq sg1@gottpoff(%rip), %r10 9359243Sobrien nop;nop;nop;nop 9459243Sobrien 9559243Sobrien /* IE -> LE against local var */ 9659243Sobrien movq %fs:0, %rax 9759243Sobrien nop;nop 9859243Sobrien addq sl1@gottpoff(%rip), %rax 9959243Sobrien nop;nop;nop;nop 10059243Sobrien 10159243Sobrien /* IE -> LE against hidden var */ 10259243Sobrien movq %fs:0, %rcx 10359243Sobrien nop;nop 10459243Sobrien addq sh1@gottpoff(%rip), %rcx 10559243Sobrien nop;nop;nop;nop 10659243Sobrien 10759243Sobrien /* Direct access through %fs */ 10859243Sobrien 10959243Sobrien /* IE against global var */ 11059243Sobrien movq sG5@gottpoff(%rip), %rcx 11159243Sobrien nop;nop 11259243Sobrien movq %fs:(%rcx), %rdx 11359243Sobrien nop;nop;nop;nop 11459243Sobrien 11559243Sobrien /* IE->LE against local var */ 11659243Sobrien movq sl5@gottpoff(%rip), %r11 11759243Sobrien nop;nop 11883098Smp movq %fs:(%r11), %r12 11983098Smp nop;nop;nop;nop 12083098Smp 12183098Smp /* IE->LE against hidden var */ 12283098Smp movq sh5@gottpoff(%rip), %rdx 12383098Smp nop;nop 12483098Smp movq %fs:(%rdx), %rdx 125167465Smp nop;nop;nop;nop 126167465Smp 127 leave 128 ret 129