Coverage Report

Created: 2019-07-24 05:18

/Users/buildslave/jenkins/workspace/clang-stage2-coverage-R/llvm/tools/lld/ELF/Arch/AArch64.cpp
Line
Count
Source (jump to first uncovered line)
1
//===- AArch64.cpp --------------------------------------------------------===//
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
9
#include "Symbols.h"
10
#include "SyntheticSections.h"
11
#include "Target.h"
12
#include "Thunks.h"
13
#include "lld/Common/ErrorHandler.h"
14
#include "llvm/Object/ELF.h"
15
#include "llvm/Support/Endian.h"
16
17
using namespace llvm;
18
using namespace llvm::support::endian;
19
using namespace llvm::ELF;
20
using namespace lld;
21
using namespace lld::elf;
22
23
// Page(Expr) is the page address of the expression Expr, defined
24
// as (Expr & ~0xFFF). (This applies even if the machine page size
25
// supported by the platform has a different value.)
26
341
uint64_t elf::getAArch64Page(uint64_t expr) {
27
341
  return expr & ~static_cast<uint64_t>(0xFFF);
28
341
}
29
30
namespace {
31
class AArch64 : public TargetInfo {
32
public:
33
  AArch64();
34
  RelExpr getRelExpr(RelType type, const Symbol &s,
35
                     const uint8_t *loc) const override;
36
  RelType getDynRel(RelType type) const override;
37
  void writeGotPlt(uint8_t *buf, const Symbol &s) const override;
38
  void writePltHeader(uint8_t *buf) const override;
39
  void writePlt(uint8_t *buf, uint64_t gotPltEntryAddr, uint64_t pltEntryAddr,
40
                int32_t index, unsigned relOff) const override;
41
  bool needsThunk(RelExpr expr, RelType type, const InputFile *file,
42
                  uint64_t branchAddr, const Symbol &s) const override;
43
  uint32_t getThunkSectionSpacing() const override;
44
  bool inBranchRange(RelType type, uint64_t src, uint64_t dst) const override;
45
  bool usesOnlyLowPageBits(RelType type) const override;
46
  void relocateOne(uint8_t *loc, RelType type, uint64_t val) const override;
47
  RelExpr adjustRelaxExpr(RelType type, const uint8_t *data,
48
                          RelExpr expr) const override;
49
  void relaxTlsGdToLe(uint8_t *loc, RelType type, uint64_t val) const override;
50
  void relaxTlsGdToIe(uint8_t *loc, RelType type, uint64_t val) const override;
51
  void relaxTlsIeToLe(uint8_t *loc, RelType type, uint64_t val) const override;
52
};
53
} // namespace
54
55
135
AArch64::AArch64() {
56
135
  copyRel = R_AARCH64_COPY;
57
135
  relativeRel = R_AARCH64_RELATIVE;
58
135
  iRelativeRel = R_AARCH64_IRELATIVE;
59
135
  gotRel = R_AARCH64_GLOB_DAT;
60
135
  noneRel = R_AARCH64_NONE;
61
135
  pltRel = R_AARCH64_JUMP_SLOT;
62
135
  symbolicRel = R_AARCH64_ABS64;
63
135
  tlsDescRel = R_AARCH64_TLSDESC;
64
135
  tlsGotRel = R_AARCH64_TLS_TPREL64;
65
135
  pltEntrySize = 16;
66
135
  pltHeaderSize = 32;
67
135
  defaultMaxPageSize = 65536;
68
135
69
135
  // Align to the 2 MiB page size (known as a superpage or huge page).
70
135
  // FreeBSD automatically promotes 2 MiB-aligned allocations.
71
135
  defaultImageBase = 0x200000;
72
135
73
135
  needsThunks = true;
74
135
}
75
76
RelExpr AArch64::getRelExpr(RelType type, const Symbol &s,
77
511
                            const uint8_t *loc) const {
78
511
  switch (type) {
79
511
  case R_AARCH64_TLSDESC_ADR_PAGE21:
80
6
    return R_AARCH64_TLSDESC_PAGE;
81
511
  case R_AARCH64_TLSDESC_LD64_LO12:
82
12
  case R_AARCH64_TLSDESC_ADD_LO12:
83
12
    return R_TLSDESC;
84
12
  case R_AARCH64_TLSDESC_CALL:
85
6
    return R_TLSDESC_CALL;
86
14
  case R_AARCH64_TLSLE_ADD_TPREL_HI12:
87
14
  case R_AARCH64_TLSLE_ADD_TPREL_LO12_NC:
88
14
  case R_AARCH64_TLSLE_LDST8_TPREL_LO12_NC:
89
14
  case R_AARCH64_TLSLE_LDST16_TPREL_LO12_NC:
90
14
  case R_AARCH64_TLSLE_LDST32_TPREL_LO12_NC:
91
14
  case R_AARCH64_TLSLE_LDST64_TPREL_LO12_NC:
92
14
  case R_AARCH64_TLSLE_LDST128_TPREL_LO12_NC:
93
14
    return R_TLS;
94
65
  case R_AARCH64_CALL26:
95
65
  case R_AARCH64_CONDBR19:
96
65
  case R_AARCH64_JUMP26:
97
65
  case R_AARCH64_TSTBR14:
98
65
    return R_PLT_PC;
99
65
  case R_AARCH64_PREL16:
100
54
  case R_AARCH64_PREL32:
101
54
  case R_AARCH64_PREL64:
102
54
  case R_AARCH64_ADR_PREL_LO21:
103
54
  case R_AARCH64_LD_PREL_LO19:
104
54
  case R_AARCH64_MOVW_PREL_G0:
105
54
  case R_AARCH64_MOVW_PREL_G0_NC:
106
54
  case R_AARCH64_MOVW_PREL_G1:
107
54
  case R_AARCH64_MOVW_PREL_G1_NC:
108
54
  case R_AARCH64_MOVW_PREL_G2:
109
54
  case R_AARCH64_MOVW_PREL_G2_NC:
110
54
  case R_AARCH64_MOVW_PREL_G3:
111
54
    return R_PC;
112
94
  case R_AARCH64_ADR_PREL_PG_HI21:
113
94
  case R_AARCH64_ADR_PREL_PG_HI21_NC:
114
94
    return R_AARCH64_PAGE_PC;
115
94
  case R_AARCH64_LD64_GOT_LO12_NC:
116
67
  case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC:
117
67
    return R_GOT;
118
67
  case R_AARCH64_ADR_GOT_PAGE:
119
16
  case R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21:
120
16
    return R_AARCH64_GOT_PAGE_PC;
121
16
  case R_AARCH64_NONE:
122
1
    return R_NONE;
123
176
  default:
124
176
    return R_ABS;
125
511
  }
126
511
}
127
128
RelExpr AArch64::adjustRelaxExpr(RelType type, const uint8_t *data,
129
8
                                 RelExpr expr) const {
130
8
  if (expr == R_RELAX_TLS_GD_TO_IE) {
131
4
    if (type == R_AARCH64_TLSDESC_ADR_PAGE21)
132
1
      return R_AARCH64_RELAX_TLS_GD_TO_IE_PAGE_PC;
133
3
    return R_RELAX_TLS_GD_TO_IE_ABS;
134
3
  }
135
4
  return expr;
136
4
}
137
138
149
bool AArch64::usesOnlyLowPageBits(RelType type) const {
139
149
  switch (type) {
140
149
  default:
141
80
    return false;
142
149
  case R_AARCH64_ADD_ABS_LO12_NC:
143
69
  case R_AARCH64_LD64_GOT_LO12_NC:
144
69
  case R_AARCH64_LDST128_ABS_LO12_NC:
145
69
  case R_AARCH64_LDST16_ABS_LO12_NC:
146
69
  case R_AARCH64_LDST32_ABS_LO12_NC:
147
69
  case R_AARCH64_LDST64_ABS_LO12_NC:
148
69
  case R_AARCH64_LDST8_ABS_LO12_NC:
149
69
  case R_AARCH64_TLSDESC_ADD_LO12:
150
69
  case R_AARCH64_TLSDESC_LD64_LO12:
151
69
  case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC:
152
69
    return true;
153
149
  }
154
149
}
155
156
91
RelType AArch64::getDynRel(RelType type) const {
157
91
  if (type == R_AARCH64_ABS64)
158
86
    return type;
159
5
  return R_AARCH64_NONE;
160
5
}
161
162
40
void AArch64::writeGotPlt(uint8_t *buf, const Symbol &) const {
163
40
  write64le(buf, in.plt->getVA());
164
40
}
165
166
11
void AArch64::writePltHeader(uint8_t *buf) const {
167
11
  const uint8_t pltData[] = {
168
11
      0xf0, 0x7b, 0xbf, 0xa9, // stp    x16, x30, [sp,#-16]!
169
11
      0x10, 0x00, 0x00, 0x90, // adrp   x16, Page(&(.plt.got[2]))
170
11
      0x11, 0x02, 0x40, 0xf9, // ldr    x17, [x16, Offset(&(.plt.got[2]))]
171
11
      0x10, 0x02, 0x00, 0x91, // add    x16, x16, Offset(&(.plt.got[2]))
172
11
      0x20, 0x02, 0x1f, 0xd6, // br     x17
173
11
      0x1f, 0x20, 0x03, 0xd5, // nop
174
11
      0x1f, 0x20, 0x03, 0xd5, // nop
175
11
      0x1f, 0x20, 0x03, 0xd5  // nop
176
11
  };
177
11
  memcpy(buf, pltData, sizeof(pltData));
178
11
179
11
  uint64_t got = in.gotPlt->getVA();
180
11
  uint64_t plt = in.plt->getVA();
181
11
  relocateOne(buf + 4, R_AARCH64_ADR_PREL_PG_HI21,
182
11
              getAArch64Page(got + 16) - getAArch64Page(plt + 4));
183
11
  relocateOne(buf + 8, R_AARCH64_LDST64_ABS_LO12_NC, got + 16);
184
11
  relocateOne(buf + 12, R_AARCH64_ADD_ABS_LO12_NC, got + 16);
185
11
}
186
187
void AArch64::writePlt(uint8_t *buf, uint64_t gotPltEntryAddr,
188
                       uint64_t pltEntryAddr, int32_t index,
189
29
                       unsigned relOff) const {
190
29
  const uint8_t inst[] = {
191
29
      0x10, 0x00, 0x00, 0x90, // adrp x16, Page(&(.plt.got[n]))
192
29
      0x11, 0x02, 0x40, 0xf9, // ldr  x17, [x16, Offset(&(.plt.got[n]))]
193
29
      0x10, 0x02, 0x00, 0x91, // add  x16, x16, Offset(&(.plt.got[n]))
194
29
      0x20, 0x02, 0x1f, 0xd6  // br   x17
195
29
  };
196
29
  memcpy(buf, inst, sizeof(inst));
197
29
198
29
  relocateOne(buf, R_AARCH64_ADR_PREL_PG_HI21,
199
29
              getAArch64Page(gotPltEntryAddr) - getAArch64Page(pltEntryAddr));
200
29
  relocateOne(buf + 4, R_AARCH64_LDST64_ABS_LO12_NC, gotPltEntryAddr);
201
29
  relocateOne(buf + 8, R_AARCH64_ADD_ABS_LO12_NC, gotPltEntryAddr);
202
29
}
203
204
bool AArch64::needsThunk(RelExpr expr, RelType type, const InputFile *file,
205
525
                         uint64_t branchAddr, const Symbol &s) const {
206
525
  // ELF for the ARM 64-bit architecture, section Call and Jump relocations
207
525
  // only permits range extension thunks for R_AARCH64_CALL26 and
208
525
  // R_AARCH64_JUMP26 relocation types.
209
525
  if (type != R_AARCH64_CALL26 && 
type != R_AARCH64_JUMP26486
)
210
429
    return false;
211
96
  uint64_t dst = (expr == R_PLT_PC) ? 
s.getPltVA()31
:
s.getVA()65
;
212
96
  return !inBranchRange(type, branchAddr, dst);
213
96
}
214
215
235
uint32_t AArch64::getThunkSectionSpacing() const {
216
235
  // See comment in Arch/ARM.cpp for a more detailed explanation of
217
235
  // getThunkSectionSpacing(). For AArch64 the only branches we are permitted to
218
235
  // Thunk have a range of +/- 128 MiB
219
235
  return (128 * 1024 * 1024) - 0x30000;
220
235
}
221
222
114
bool AArch64::inBranchRange(RelType type, uint64_t src, uint64_t dst) const {
223
114
  if (type != R_AARCH64_CALL26 && 
type != R_AARCH64_JUMP2659
)
224
0
    return true;
225
114
  // The AArch64 call and unconditional branch instructions have a range of
226
114
  // +/- 128 MiB.
227
114
  uint64_t range = 128 * 1024 * 1024;
228
114
  if (dst > src) {
229
104
    // Immediate of branch is signed.
230
104
    range -= 4;
231
104
    return dst - src <= range;
232
104
  }
233
10
  return src - dst <= range;
234
10
}
235
236
173
static void write32AArch64Addr(uint8_t *l, uint64_t imm) {
237
173
  uint32_t immLo = (imm & 0x3) << 29;
238
173
  uint32_t immHi = (imm & 0x1FFFFC) << 3;
239
173
  uint64_t mask = (0x3 << 29) | (0x1FFFFC << 3);
240
173
  write32le(l, (read32le(l) & ~mask) | immLo | immHi);
241
173
}
242
243
// Return the bits [Start, End] from Val shifted Start bits.
244
// For instance, getBits(0xF0, 4, 8) returns 0xF.
245
170
static uint64_t getBits(uint64_t val, int start, int end) {
246
170
  uint64_t mask = ((uint64_t)1 << (end + 1 - start)) - 1;
247
170
  return (val >> start) & mask;
248
170
}
249
250
408
static void or32le(uint8_t *p, int32_t v) { write32le(p, read32le(p) | v); }
251
252
// Update the immediate field in a AARCH64 ldr, str, and add instruction.
253
256
static void or32AArch64Imm(uint8_t *l, uint64_t imm) {
254
256
  or32le(l, (imm & 0xFFF) << 10);
255
256
}
256
257
// Update the immediate field in an AArch64 movk, movn or movz instruction
258
// for a signed relocation, and update the opcode of a movn or movz instruction
259
// to match the sign of the operand.
260
35
static void writeSMovWImm(uint8_t *loc, uint32_t imm) {
261
35
  uint32_t inst = read32le(loc);
262
35
  // Opcode field is bits 30, 29, with 10 = movz, 00 = movn and 11 = movk.
263
35
  if (!(inst & (1 << 29))) {
264
27
    // movn or movz.
265
27
    if (imm & 0x10000) {
266
12
      // Change opcode to movn, which takes an inverted operand.
267
12
      imm ^= 0xFFFF;
268
12
      inst &= ~(1 << 30);
269
15
    } else {
270
15
      // Change opcode to movz.
271
15
      inst |= 1 << 30;
272
15
    }
273
27
  }
274
35
  write32le(loc, inst | ((imm & 0xFFFF) << 5));
275
35
}
276
277
692
void AArch64::relocateOne(uint8_t *loc, RelType type, uint64_t val) const {
278
692
  switch (type) {
279
692
  case R_AARCH64_ABS16:
280
13
  case R_AARCH64_PREL16:
281
13
    checkIntUInt(loc, val, 16, type);
282
13
    write16le(loc, val);
283
13
    break;
284
16
  case R_AARCH64_ABS32:
285
16
  case R_AARCH64_PREL32:
286
16
    checkIntUInt(loc, val, 32, type);
287
16
    write32le(loc, val);
288
16
    break;
289
46
  case R_AARCH64_ABS64:
290
46
  case R_AARCH64_PREL64:
291
46
    write64le(loc, val);
292
46
    break;
293
72
  case R_AARCH64_ADD_ABS_LO12_NC:
294
72
    or32AArch64Imm(loc, val);
295
72
    break;
296
167
  case R_AARCH64_ADR_GOT_PAGE:
297
167
  case R_AARCH64_ADR_PREL_PG_HI21:
298
167
  case R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21:
299
167
  case R_AARCH64_TLSDESC_ADR_PAGE21:
300
167
    checkInt(loc, val, 33, type);
301
167
    LLVM_FALLTHROUGH;
302
168
  case R_AARCH64_ADR_PREL_PG_HI21_NC:
303
168
    write32AArch64Addr(loc, val >> 12);
304
168
    break;
305
167
  case R_AARCH64_ADR_PREL_LO21:
306
4
    checkInt(loc, val, 21, type);
307
4
    write32AArch64Addr(loc, val);
308
4
    break;
309
167
  case R_AARCH64_JUMP26:
310
83
    // Normally we would just write the bits of the immediate field, however
311
83
    // when patching instructions for the cpu errata fix -fix-cortex-a53-843419
312
83
    // we want to replace a non-branch instruction with a branch immediate
313
83
    // instruction. By writing all the bits of the instruction including the
314
83
    // opcode and the immediate (0 001 | 01 imm26) we can do this
315
83
    // transformation by placing a R_AARCH64_JUMP26 relocation at the offset of
316
83
    // the instruction we want to patch.
317
83
    write32le(loc, 0x14000000);
318
83
    LLVM_FALLTHROUGH;
319
119
  case R_AARCH64_CALL26:
320
119
    checkInt(loc, val, 28, type);
321
119
    or32le(loc, (val & 0x0FFFFFFC) >> 2);
322
119
    break;
323
83
  case R_AARCH64_CONDBR19:
324
13
  case R_AARCH64_LD_PREL_LO19:
325
13
    checkAlignment(loc, val, 4, type);
326
13
    checkInt(loc, val, 21, type);
327
13
    or32le(loc, (val & 0x1FFFFC) << 3);
328
13
    break;
329
13
  case R_AARCH64_LDST8_ABS_LO12_NC:
330
4
  case R_AARCH64_TLSLE_LDST8_TPREL_LO12_NC:
331
4
    or32AArch64Imm(loc, getBits(val, 0, 11));
332
4
    break;
333
7
  case R_AARCH64_LDST16_ABS_LO12_NC:
334
7
  case R_AARCH64_TLSLE_LDST16_TPREL_LO12_NC:
335
7
    checkAlignment(loc, val, 2, type);
336
7
    or32AArch64Imm(loc, getBits(val, 1, 11));
337
7
    break;
338
7
  case R_AARCH64_LDST32_ABS_LO12_NC:
339
5
  case R_AARCH64_TLSLE_LDST32_TPREL_LO12_NC:
340
5
    checkAlignment(loc, val, 4, type);
341
5
    or32AArch64Imm(loc, getBits(val, 2, 11));
342
5
    break;
343
149
  case R_AARCH64_LDST64_ABS_LO12_NC:
344
149
  case R_AARCH64_LD64_GOT_LO12_NC:
345
149
  case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC:
346
149
  case R_AARCH64_TLSLE_LDST64_TPREL_LO12_NC:
347
149
  case R_AARCH64_TLSDESC_LD64_LO12:
348
149
    checkAlignment(loc, val, 8, type);
349
149
    or32AArch64Imm(loc, getBits(val, 3, 11));
350
149
    break;
351
149
  case R_AARCH64_LDST128_ABS_LO12_NC:
352
5
  case R_AARCH64_TLSLE_LDST128_TPREL_LO12_NC:
353
5
    checkAlignment(loc, val, 16, type);
354
5
    or32AArch64Imm(loc, getBits(val, 4, 11));
355
5
    break;
356
5
  case R_AARCH64_MOVW_UABS_G0:
357
2
    checkUInt(loc, val, 16, type);
358
2
    LLVM_FALLTHROUGH;
359
3
  case R_AARCH64_MOVW_UABS_G0_NC:
360
3
    or32le(loc, (val & 0xFFFF) << 5);
361
3
    break;
362
2
  case R_AARCH64_MOVW_UABS_G1:
363
2
    checkUInt(loc, val, 32, type);
364
2
    LLVM_FALLTHROUGH;
365
3
  case R_AARCH64_MOVW_UABS_G1_NC:
366
3
    or32le(loc, (val & 0xFFFF0000) >> 11);
367
3
    break;
368
2
  case R_AARCH64_MOVW_UABS_G2:
369
2
    checkUInt(loc, val, 48, type);
370
2
    LLVM_FALLTHROUGH;
371
3
  case R_AARCH64_MOVW_UABS_G2_NC:
372
3
    or32le(loc, (val & 0xFFFF00000000) >> 27);
373
3
    break;
374
2
  case R_AARCH64_MOVW_UABS_G3:
375
2
    or32le(loc, (val & 0xFFFF000000000000) >> 43);
376
2
    break;
377
8
  case R_AARCH64_MOVW_PREL_G0:
378
8
  case R_AARCH64_MOVW_SABS_G0:
379
8
    checkInt(loc, val, 17, type);
380
8
    LLVM_FALLTHROUGH;
381
10
  case R_AARCH64_MOVW_PREL_G0_NC:
382
10
    writeSMovWImm(loc, val);
383
10
    break;
384
8
  case R_AARCH64_MOVW_PREL_G1:
385
8
  case R_AARCH64_MOVW_SABS_G1:
386
8
    checkInt(loc, val, 33, type);
387
8
    LLVM_FALLTHROUGH;
388
10
  case R_AARCH64_MOVW_PREL_G1_NC:
389
10
    writeSMovWImm(loc, val >> 16);
390
10
    break;
391
9
  case R_AARCH64_MOVW_PREL_G2:
392
9
  case R_AARCH64_MOVW_SABS_G2:
393
9
    checkInt(loc, val, 49, type);
394
9
    LLVM_FALLTHROUGH;
395
11
  case R_AARCH64_MOVW_PREL_G2_NC:
396
11
    writeSMovWImm(loc, val >> 32);
397
11
    break;
398
9
  case R_AARCH64_MOVW_PREL_G3:
399
4
    writeSMovWImm(loc, val >> 48);
400
4
    break;
401
9
  case R_AARCH64_TSTBR14:
402
8
    checkInt(loc, val, 16, type);
403
8
    or32le(loc, (val & 0xFFFC) << 3);
404
8
    break;
405
9
  case R_AARCH64_TLSLE_ADD_TPREL_HI12:
406
7
    checkUInt(loc, val, 24, type);
407
7
    or32AArch64Imm(loc, val >> 12);
408
7
    break;
409
9
  case R_AARCH64_TLSLE_ADD_TPREL_LO12_NC:
410
6
  case R_AARCH64_TLSDESC_ADD_LO12:
411
6
    or32AArch64Imm(loc, val);
412
6
    break;
413
6
  default:
414
0
    error(getErrorLocation(loc) + "unrecognized relocation " + toString(type));
415
692
  }
416
692
}
417
418
4
void AArch64::relaxTlsGdToLe(uint8_t *loc, RelType type, uint64_t val) const {
419
4
  // TLSDESC Global-Dynamic relocation are in the form:
420
4
  //   adrp    x0, :tlsdesc:v             [R_AARCH64_TLSDESC_ADR_PAGE21]
421
4
  //   ldr     x1, [x0, #:tlsdesc_lo12:v  [R_AARCH64_TLSDESC_LD64_LO12]
422
4
  //   add     x0, x0, :tlsdesc_los:v     [R_AARCH64_TLSDESC_ADD_LO12]
423
4
  //   .tlsdesccall                       [R_AARCH64_TLSDESC_CALL]
424
4
  //   blr     x1
425
4
  // And it can optimized to:
426
4
  //   movz    x0, #0x0, lsl #16
427
4
  //   movk    x0, #0x10
428
4
  //   nop
429
4
  //   nop
430
4
  checkUInt(loc, val, 32, type);
431
4
432
4
  switch (type) {
433
4
  case R_AARCH64_TLSDESC_ADD_LO12:
434
2
  case R_AARCH64_TLSDESC_CALL:
435
2
    write32le(loc, 0xd503201f); // nop
436
2
    return;
437
2
  case R_AARCH64_TLSDESC_ADR_PAGE21:
438
1
    write32le(loc, 0xd2a00000 | (((val >> 16) & 0xffff) << 5)); // movz
439
1
    return;
440
2
  case R_AARCH64_TLSDESC_LD64_LO12:
441
1
    write32le(loc, 0xf2800000 | ((val & 0xffff) << 5)); // movk
442
1
    return;
443
2
  default:
444
0
    llvm_unreachable("unsupported relocation for TLS GD to LE relaxation");
445
4
  }
446
4
}
447
448
4
void AArch64::relaxTlsGdToIe(uint8_t *loc, RelType type, uint64_t val) const {
449
4
  // TLSDESC Global-Dynamic relocation are in the form:
450
4
  //   adrp    x0, :tlsdesc:v             [R_AARCH64_TLSDESC_ADR_PAGE21]
451
4
  //   ldr     x1, [x0, #:tlsdesc_lo12:v  [R_AARCH64_TLSDESC_LD64_LO12]
452
4
  //   add     x0, x0, :tlsdesc_los:v     [R_AARCH64_TLSDESC_ADD_LO12]
453
4
  //   .tlsdesccall                       [R_AARCH64_TLSDESC_CALL]
454
4
  //   blr     x1
455
4
  // And it can optimized to:
456
4
  //   adrp    x0, :gottprel:v
457
4
  //   ldr     x0, [x0, :gottprel_lo12:v]
458
4
  //   nop
459
4
  //   nop
460
4
461
4
  switch (type) {
462
4
  case R_AARCH64_TLSDESC_ADD_LO12:
463
2
  case R_AARCH64_TLSDESC_CALL:
464
2
    write32le(loc, 0xd503201f); // nop
465
2
    break;
466
2
  case R_AARCH64_TLSDESC_ADR_PAGE21:
467
1
    write32le(loc, 0x90000000); // adrp
468
1
    relocateOne(loc, R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21, val);
469
1
    break;
470
2
  case R_AARCH64_TLSDESC_LD64_LO12:
471
1
    write32le(loc, 0xf9400000); // ldr
472
1
    relocateOne(loc, R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC, val);
473
1
    break;
474
2
  default:
475
0
    llvm_unreachable("unsupported relocation for TLS GD to LE relaxation");
476
4
  }
477
4
}
478
479
12
void AArch64::relaxTlsIeToLe(uint8_t *loc, RelType type, uint64_t val) const {
480
12
  checkUInt(loc, val, 32, type);
481
12
482
12
  if (type == R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21) {
483
6
    // Generate MOVZ.
484
6
    uint32_t regNo = read32le(loc) & 0x1f;
485
6
    write32le(loc, (0xd2a00000 | regNo) | (((val >> 16) & 0xffff) << 5));
486
6
    return;
487
6
  }
488
6
  if (type == R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC) {
489
6
    // Generate MOVK.
490
6
    uint32_t regNo = read32le(loc) & 0x1f;
491
6
    write32le(loc, (0xf2800000 | regNo) | ((val & 0xffff) << 5));
492
6
    return;
493
6
  }
494
0
  llvm_unreachable("invalid relocation for TLS IE to LE relaxation");
495
0
}
496
497
// AArch64 may use security features in variant PLT sequences. These are:
498
// Pointer Authentication (PAC), introduced in armv8.3-a and Branch Target
499
// Indicator (BTI) introduced in armv8.5-a. The additional instructions used
500
// in the variant Plt sequences are encoded in the Hint space so they can be
501
// deployed on older architectures, which treat the instructions as a nop.
502
// PAC and BTI can be combined leading to the following combinations:
503
// writePltHeader
504
// writePltHeaderBti (no PAC Header needed)
505
// writePlt
506
// writePltBti (BTI only)
507
// writePltPac (PAC only)
508
// writePltBtiPac (BTI and PAC)
509
//
510
// When PAC is enabled the dynamic loader encrypts the address that it places
511
// in the .got.plt using the pacia1716 instruction which encrypts the value in
512
// x17 using the modifier in x16. The static linker places autia1716 before the
513
// indirect branch to x17 to authenticate the address in x17 with the modifier
514
// in x16. This makes it more difficult for an attacker to modify the value in
515
// the .got.plt.
516
//
517
// When BTI is enabled all indirect branches must land on a bti instruction.
518
// The static linker must place a bti instruction at the start of any PLT entry
519
// that may be the target of an indirect branch. As the PLT entries call the
520
// lazy resolver indirectly this must have a bti instruction at start. In
521
// general a bti instruction is not needed for a PLT entry as indirect calls
522
// are resolved to the function address and not the PLT entry for the function.
523
// There are a small number of cases where the PLT address can escape, such as
524
// taking the address of a function or ifunc via a non got-generating
525
// relocation, and a shared library refers to that symbol.
526
//
527
// We use the bti c variant of the instruction which permits indirect branches
528
// (br) via x16/x17 and indirect function calls (blr) via any register. The ABI
529
// guarantees that all indirect branches from code requiring BTI protection
530
// will go via x16/x17
531
532
namespace {
533
class AArch64BtiPac final : public AArch64 {
534
public:
535
  AArch64BtiPac();
536
  void writePltHeader(uint8_t *buf) const override;
537
  void writePlt(uint8_t *buf, uint64_t gotPltEntryAddr, uint64_t pltEntryAddr,
538
                int32_t index, unsigned relOff) const override;
539
540
private:
541
  bool btiHeader; // bti instruction needed in PLT Header
542
  bool btiEntry;  // bti instruction needed in PLT Entry
543
  bool pacEntry;  // autia1716 instruction needed in PLT Entry
544
};
545
} // namespace
546
547
11
AArch64BtiPac::AArch64BtiPac() {
548
11
  btiHeader = (config->andFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_BTI);
549
11
  // A BTI (Branch Target Indicator) Plt Entry is only required if the
550
11
  // address of the PLT entry can be taken by the program, which permits an
551
11
  // indirect jump to the PLT entry. This can happen when the address
552
11
  // of the PLT entry for a function is canonicalised due to the address of
553
11
  // the function in an executable being taken by a shared library.
554
11
  // FIXME: There is a potential optimization to omit the BTI if we detect
555
11
  // that the address of the PLT entry isn't taken.
556
11
  btiEntry = btiHeader && 
!config->shared9
;
557
11
  pacEntry = (config->andFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_PAC);
558
11
559
11
  if (btiEntry || 
pacEntry4
)
560
10
    pltEntrySize = 24;
561
11
}
562
563
10
void AArch64BtiPac::writePltHeader(uint8_t *buf) const {
564
10
  const uint8_t btiData[] = { 0x5f, 0x24, 0x03, 0xd5 }; // bti c
565
10
  const uint8_t pltData[] = {
566
10
      0xf0, 0x7b, 0xbf, 0xa9, // stp    x16, x30, [sp,#-16]!
567
10
      0x10, 0x00, 0x00, 0x90, // adrp   x16, Page(&(.plt.got[2]))
568
10
      0x11, 0x02, 0x40, 0xf9, // ldr    x17, [x16, Offset(&(.plt.got[2]))]
569
10
      0x10, 0x02, 0x00, 0x91, // add    x16, x16, Offset(&(.plt.got[2]))
570
10
      0x20, 0x02, 0x1f, 0xd6, // br     x17
571
10
      0x1f, 0x20, 0x03, 0xd5, // nop
572
10
      0x1f, 0x20, 0x03, 0xd5  // nop
573
10
  };
574
10
  const uint8_t nopData[] = { 0x1f, 0x20, 0x03, 0xd5 }; // nop
575
10
576
10
  uint64_t got = in.gotPlt->getVA();
577
10
  uint64_t plt = in.plt->getVA();
578
10
579
10
  if (btiHeader) {
580
8
    // PltHeader is called indirectly by plt[N]. Prefix pltData with a BTI C
581
8
    // instruction.
582
8
    memcpy(buf, btiData, sizeof(btiData));
583
8
    buf += sizeof(btiData);
584
8
    plt += sizeof(btiData);
585
8
  }
586
10
  memcpy(buf, pltData, sizeof(pltData));
587
10
588
10
  relocateOne(buf + 4, R_AARCH64_ADR_PREL_PG_HI21,
589
10
              getAArch64Page(got + 16) - getAArch64Page(plt + 8));
590
10
  relocateOne(buf + 8, R_AARCH64_LDST64_ABS_LO12_NC, got + 16);
591
10
  relocateOne(buf + 12, R_AARCH64_ADD_ABS_LO12_NC, got + 16);
592
10
  if (!btiHeader)
593
2
    // We didn't add the BTI c instruction so round out size with NOP.
594
2
    memcpy(buf + sizeof(pltData), nopData, sizeof(nopData));
595
10
}
596
597
void AArch64BtiPac::writePlt(uint8_t *buf, uint64_t gotPltEntryAddr,
598
                             uint64_t pltEntryAddr, int32_t index,
599
11
                             unsigned relOff) const {
600
11
  // The PLT entry is of the form:
601
11
  // [btiData] addrInst (pacBr | stdBr) [nopData]
602
11
  const uint8_t btiData[] = { 0x5f, 0x24, 0x03, 0xd5 }; // bti c
603
11
  const uint8_t addrInst[] = {
604
11
      0x10, 0x00, 0x00, 0x90,  // adrp x16, Page(&(.plt.got[n]))
605
11
      0x11, 0x02, 0x40, 0xf9,  // ldr  x17, [x16, Offset(&(.plt.got[n]))]
606
11
      0x10, 0x02, 0x00, 0x91   // add  x16, x16, Offset(&(.plt.got[n]))
607
11
  };
608
11
  const uint8_t pacBr[] = {
609
11
      0x9f, 0x21, 0x03, 0xd5,  // autia1716
610
11
      0x20, 0x02, 0x1f, 0xd6   // br   x17
611
11
  };
612
11
  const uint8_t stdBr[] = {
613
11
      0x20, 0x02, 0x1f, 0xd6,  // br   x17
614
11
      0x1f, 0x20, 0x03, 0xd5   // nop
615
11
  };
616
11
  const uint8_t nopData[] = { 0x1f, 0x20, 0x03, 0xd5 }; // nop
617
11
618
11
  if (btiEntry) {
619
7
    memcpy(buf, btiData, sizeof(btiData));
620
7
    buf += sizeof(btiData);
621
7
    pltEntryAddr += sizeof(btiData);
622
7
  }
623
11
624
11
  memcpy(buf, addrInst, sizeof(addrInst));
625
11
  relocateOne(buf, R_AARCH64_ADR_PREL_PG_HI21,
626
11
              getAArch64Page(gotPltEntryAddr) -
627
11
                  getAArch64Page(pltEntryAddr));
628
11
  relocateOne(buf + 4, R_AARCH64_LDST64_ABS_LO12_NC, gotPltEntryAddr);
629
11
  relocateOne(buf + 8, R_AARCH64_ADD_ABS_LO12_NC, gotPltEntryAddr);
630
11
631
11
  if (pacEntry)
632
5
    memcpy(buf + sizeof(addrInst), pacBr, sizeof(pacBr));
633
6
  else
634
6
    memcpy(buf + sizeof(addrInst), stdBr, sizeof(stdBr));
635
11
  if (!btiEntry)
636
4
    // We didn't add the BTI c instruction so round out size with NOP.
637
4
    memcpy(buf + sizeof(addrInst) + sizeof(stdBr), nopData, sizeof(nopData));
638
11
}
639
640
247
static TargetInfo *getTargetInfo() {
641
247
  if (config->andFeatures & (GNU_PROPERTY_AARCH64_FEATURE_1_BTI |
642
247
                             GNU_PROPERTY_AARCH64_FEATURE_1_PAC)) {
643
11
    static AArch64BtiPac t;
644
11
    return &t;
645
11
  }
646
236
  static AArch64 t;
647
236
  return &t;
648
236
}
649
650
247
TargetInfo *elf::getAArch64TargetInfo() { return getTargetInfo(); }