1 //===- ARMErrataFix.cpp ---------------------------------------------------===//
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
7 //===----------------------------------------------------------------------===//
9 // Cortex-a8 erratum 657417 "A 32bit branch instruction that spans 2 4K regions
12 // Cortex-A8. A high level description of the patching technique is given in
14 //===----------------------------------------------------------------------===//
38 // "A 32bit branch instruction that spans two 4K regions can result in an
40 // 32-bit B.w instruction encoded as a pair of halfwords 0xf7fe 0xbfff
44 // xxxxxxffe f7fe // First halfword of branch to target:
46 // xxxxxx002 bfff // Second halfword of branch to target:
49 // - There is a 32-bit Thumb-2 branch instruction with an address of the form
52 // - The branch instruction is one of BLX, BL, B.w BCC.w
53 // - The instruction preceding the branch is a 32-bit non-branch instruction.
54 // - The target of the branch is in region 1.
56 // The linker mitigation for the fix is to redirect any branch that meets the
57 // erratum conditions to a patch section containing a branch to the target.
63 // 00000FFA func: NOP.w      // 32-bit Thumb function
64 // 00000FFE       B.W func   // 32-bit branch spanning 2 regions, dest in 1st.
66 // 00000FFA func: NOP.w      // 32-bit Thumb function
68 // 00001002       2 - bytes padding
79   // Get the virtual address of the branch instruction at patcheeOffset.
83     return d->kind() == InputSectionBase::Synthetic && d->name ==".text.patch";  in classof()
92   // A decoding of the branch instruction at patcheeOffset.
99 // Return true if the half-word, when taken as the first of a pair of halfwords
100 // is the first half of a 32-bit instruction.
101 // Reference from ARM Architecture Reference Manual ARMv7-A and ARMv7-R edition
102 // section A6.3: 32-bit Thumb instruction encoding
105 // With op1 == 0b00, a 16-bit instruction is encoded.
112 // Reference from ARM Architecture Reference Manual ARMv7-A and ARMv7-R edition
116 // op1 == 0x0 op != x111xxx | Conditional branch (Bcc.W)
117 // op1 == 0x1               | Branch (B.W)
118 // op1 == 1x0               | Branch with Link and Exchange (BLX.w)
119 // op1 == 1x1               | Branch with Link (BL.W)
141   parent = p->getParent();  in Patch657417Section()
149   return patchee->getVA(patcheeOffset);  in getBranchAddr()
152 // Given a branch instruction instr at sourceAddr work out its destination
153 // address. This is only used when the branch instruction has no relocation.
160     offset = target->getImplicitAddend(buf, R_ARM_THM_JUMP19);  in getThumbDestAddr()
162     offset = target->getImplicitAddend(buf, R_ARM_THM_JUMP24);  in getThumbDestAddr()
164     offset = target->getImplicitAddend(buf, R_ARM_THM_CALL);  in getThumbDestAddr()
166   // not 4-byte aligned. As Arm instructions are always 4-byte aligned  in getThumbDestAddr()
178   // The base instruction of the patch is always a 32-bit unconditional branch.  in writeTo()
185     target->relocateAlloc(*this, buf);  in writeTo()
191   // Get the destination offset from the addend in the branch instruction.  in writeTo()
195   // A BLX changes the state of the branch in the patch to Arm state, which  in writeTo()
196   // has a PC Bias of 8, whereas in all other cases the branch is in Thumb  in writeTo()
200   target->relocateNoSym(buf, isARM ? R_ARM_JUMP24 : R_ARM_THM_JUMP24, s - p);  in writeTo()
203 // Given a branch instruction spanning two 4KiB regions, at offset off from the
204 // start of isec, return true if the destination of the branch is within the
208   uint64_t sourceAddr = isec->getVA(0) + off;  in branchDestInFirstRegion()
211   // If there is a branch relocation at the same offset we must use this to  in branchDestInFirstRegion()
212   // find the destination address as the branch could be indirected via a thunk  in branchDestInFirstRegion()
215     uint64_t dst = (r->expr == R_PLT_PC) ? r->sym->getPltVA() : r->sym->getVA();  in branchDestInFirstRegion()
216     // Account for Thumb PC bias, usually cancelled to 0 by addend of -4.  in branchDestInFirstRegion()
217     destAddr = dst + r->addend + 4;  in branchDestInFirstRegion()
219     // If there is no relocation, we must have an intra-section branch  in branchDestInFirstRegion()
227 // Return true if a branch can reach a patch section placed after isec.
232   // We need the branch at source to reach a patch section placed immediately  in patchInRange()
234   // add 0x100 as contingency to account for worst case of 1 branch every 4KiB  in patchInRange()
236   return target->inBranchRange(  in patchInRange()
237       isBcc(instr) ? R_ARM_THM_JUMP19 : R_ARM_THM_JUMP24, isec->getVA(off),  in patchInRange()
238       isec->getVA() + isec->getSize() + 0x100);  in patchInRange()
242   // Offset of branch within its InputSection.
244   // Cached decoding of the branch instruction.
246   // Branch relocation at off. Will be nullptr if no relocation exists.
250 // Detect the erratum sequence, returning the offset of the branch instruction
251 // and a decoding of the branch. If the erratum sequence is not found then
252 // return an offset of 0 for the branch. 0 is a safe value to use for no patch
253 // as there must be at least one 32-bit non-branch instruction before the
254 // branch so the minimum offset for a patch is 4.
257   uint64_t isecAddr = isec->getVA(0);  in scanCortexA8Errata657417()
259   // need to check for a 32-bit instruction immediately before a 32-bit branch  in scanCortexA8Errata657417()
261   off = alignTo(isecAddr + off, 0x1000, 0xffa) - isecAddr;  in scanCortexA8Errata657417()
262   if (off >= limit || limit - off < 8) {  in scanCortexA8Errata657417()
263     // Need at least 2 4-byte sized instructions to trigger erratum.  in scanCortexA8Errata657417()
269   const uint8_t *buf = isec->content().begin();  in scanCortexA8Errata657417()
270   // ARMv7-A Thumb 32-bit instructions are encoded 2 consecutive  in scanCortexA8Errata657417()
271   // little-endian halfwords.  in scanCortexA8Errata657417()
281       // Find a relocation for the branch if it exists. This will be used  in scanCortexA8Errata657417()
284       auto relIt = llvm::find_if(isec->relocs(), [=](const Relocation &r) {  in scanCortexA8Errata657417()
289       if (relIt != isec->relocs().end())  in scanCortexA8Errata657417()
296           warn(toString(isec->file) +  in scanCortexA8Errata657417()
297                ": skipping cortex-a8 657417 erratum sequence, section " +  in scanCortexA8Errata657417()
298                isec->name + " is too large to patch");  in scanCortexA8Errata657417()
320     return s->getName() == "$a" || s->getName().starts_with("$a.");  in init()
323     return s->getName() == "$t" || s->getName().starts_with("$t.");  in init()
326     return s->getName() == "$d" || s->getName().starts_with("$d.");  in init()
331     for (Symbol *s : file->getLocalSymbols()) {  in init()
338       if (auto *sec = dyn_cast_or_null<InputSection>(def->section))  in init()
339         if (sec->flags & SHF_EXECINSTR)  in init()
344   // ascending order and are in alternating Thumb, non-Thumb order.  in init()
348       return a->value < b->value;  in init()
365   uint64_t spacing = 0x100000 - 0x7500;  in insertPatches()
367   uint64_t prevIsecLimit = isd.sections.front()->outSecOff;  in insertPatches()
369   uint64_t outSecAddr = isd.sections.front()->getParent()->addr;  in insertPatches()
373   // range of the Thumb-2 conditional branch with a contingency accounting for  in insertPatches()
378     isecLimit = isec->outSecOff + isec->getSize();  in insertPatches()
381         if ((*patchIt)->getBranchAddr() - outSecAddr >= prevIsecLimit)  in insertPatches()
383         (*patchIt)->outSecOff = prevIsecLimit;  in insertPatches()
390     (*patchIt)->outSecOff = isecLimit;  in insertPatches()
399     if (a->outSecOff != b->outSecOff)  in insertPatches()
400       return a->outSecOff < b->outSecOff;  in insertPatches()
408 // Given a branch instruction described by ScanRes redirect it to a patch
409 // section containing an unconditional branch instruction to the target.
410 // Ensure that this patch section is 4-byte aligned so that the branch cannot
412 // isec so the branch we are patching always goes forwards.
416   log("detected cortex-a8-657419 erratum sequence starting at " +  in implementPatch()
417       utohexstr(isec->getVA(sr.off)) + " in unpatched output.");  in implementPatch()
421   // unconditional branch in the patch must have a relocation so that any  in implementPatch()
434     // Create a branch relocation for the unconditional branch in the patch.  in implementPatch()
437     int64_t patchRelAddend = sr.rel->addend;  in implementPatch()
440       // The final target of the branch may be ARM or Thumb, if the target  in implementPatch()
443       uint64_t dstSymAddr = (sr.rel->expr == R_PLT_PC) ? sr.rel->sym->getPltVA()  in implementPatch()
444                                                        : sr.rel->sym->getVA();  in implementPatch()
450       // the larger ARM PC-bias of 8 rather than Thumb's 4.  in implementPatch()
452       patchRelAddend -= 4;  in implementPatch()
454     psec->addReloc(  in implementPatch()
455         Relocation{sr.rel->expr, patchRelType, 0, patchRelAddend, sr.rel->sym});  in implementPatch()
456     // Redirect the existing branch relocation to the patch.  in implementPatch()
457     sr.rel->expr = R_PC;  in implementPatch()
458     sr.rel->addend = -4;  in implementPatch()
459     sr.rel->sym = psec->patchSym;  in implementPatch()
473     isec->addReloc(Relocation{R_PC, type, sr.off, -4, psec->patchSym});  in implementPatch()
492     // instructions to scan is therefore [thumbSym->value, nonThumbSym->value)  in patchInputSectionDescription()
493     // or [thumbSym->value, section size).  in patchInputSectionDescription()
499       uint64_t off = (*thumbSym)->value;  in patchInputSectionDescription()
500       uint64_t limit = nonThumbSym == mapSyms.end() ? isec->content().size()  in patchInputSectionDescription()
501                                                     : (*nonThumbSym)->value;  in patchInputSectionDescription()
522     if (!(os->flags & SHF_ALLOC) || !(os->flags & SHF_EXECINSTR))  in createFixes()
524     for (SectionCommand *cmd : os->commands)  in createFixes()