1 //===- AArch64.cpp --------------------------------------------------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 9 #include "Symbols.h" 10 #include "SyntheticSections.h" 11 #include "Target.h" 12 #include "Thunks.h" 13 #include "lld/Common/ErrorHandler.h" 14 #include "llvm/Object/ELF.h" 15 #include "llvm/Support/Endian.h" 16 17 using namespace llvm; 18 using namespace llvm::support::endian; 19 using namespace llvm::ELF; 20 21 namespace lld { 22 namespace elf { 23 24 // Page(Expr) is the page address of the expression Expr, defined 25 // as (Expr & ~0xFFF). (This applies even if the machine page size 26 // supported by the platform has a different value.) 27 uint64_t getAArch64Page(uint64_t expr) { 28 return expr & ~static_cast<uint64_t>(0xFFF); 29 } 30 31 namespace { 32 class AArch64 : public TargetInfo { 33 public: 34 AArch64(); 35 RelExpr getRelExpr(RelType type, const Symbol &s, 36 const uint8_t *loc) const override; 37 RelType getDynRel(RelType type) const override; 38 void writeGotPlt(uint8_t *buf, const Symbol &s) const override; 39 void writePltHeader(uint8_t *buf) const override; 40 void writePlt(uint8_t *buf, uint64_t gotPltEntryAddr, uint64_t pltEntryAddr, 41 int32_t index, unsigned relOff) const override; 42 bool needsThunk(RelExpr expr, RelType type, const InputFile *file, 43 uint64_t branchAddr, const Symbol &s) const override; 44 uint32_t getThunkSectionSpacing() const override; 45 bool inBranchRange(RelType type, uint64_t src, uint64_t dst) const override; 46 bool usesOnlyLowPageBits(RelType type) const override; 47 void relocateOne(uint8_t *loc, RelType type, uint64_t val) const override; 48 RelExpr adjustRelaxExpr(RelType type, const uint8_t *data, 49 RelExpr expr) const override; 50 void relaxTlsGdToLe(uint8_t *loc, RelType type, uint64_t val) const override; 51 void relaxTlsGdToIe(uint8_t *loc, RelType type, uint64_t val) const override; 52 void relaxTlsIeToLe(uint8_t *loc, RelType type, uint64_t val) const override; 53 }; 54 } // namespace 55 56 AArch64::AArch64() { 57 copyRel = R_AARCH64_COPY; 58 relativeRel = R_AARCH64_RELATIVE; 59 iRelativeRel = R_AARCH64_IRELATIVE; 60 gotRel = R_AARCH64_GLOB_DAT; 61 noneRel = R_AARCH64_NONE; 62 pltRel = R_AARCH64_JUMP_SLOT; 63 symbolicRel = R_AARCH64_ABS64; 64 tlsDescRel = R_AARCH64_TLSDESC; 65 tlsGotRel = R_AARCH64_TLS_TPREL64; 66 pltEntrySize = 16; 67 pltHeaderSize = 32; 68 defaultMaxPageSize = 65536; 69 70 // Align to the 2 MiB page size (known as a superpage or huge page). 71 // FreeBSD automatically promotes 2 MiB-aligned allocations. 72 defaultImageBase = 0x200000; 73 74 needsThunks = true; 75 } 76 77 RelExpr AArch64::getRelExpr(RelType type, const Symbol &s, 78 const uint8_t *loc) const { 79 switch (type) { 80 case R_AARCH64_ABS16: 81 case R_AARCH64_ABS32: 82 case R_AARCH64_ABS64: 83 case R_AARCH64_ADD_ABS_LO12_NC: 84 case R_AARCH64_LDST128_ABS_LO12_NC: 85 case R_AARCH64_LDST16_ABS_LO12_NC: 86 case R_AARCH64_LDST32_ABS_LO12_NC: 87 case R_AARCH64_LDST64_ABS_LO12_NC: 88 case R_AARCH64_LDST8_ABS_LO12_NC: 89 case R_AARCH64_MOVW_SABS_G0: 90 case R_AARCH64_MOVW_SABS_G1: 91 case R_AARCH64_MOVW_SABS_G2: 92 case R_AARCH64_MOVW_UABS_G0: 93 case R_AARCH64_MOVW_UABS_G0_NC: 94 case R_AARCH64_MOVW_UABS_G1: 95 case R_AARCH64_MOVW_UABS_G1_NC: 96 case R_AARCH64_MOVW_UABS_G2: 97 case R_AARCH64_MOVW_UABS_G2_NC: 98 case R_AARCH64_MOVW_UABS_G3: 99 return R_ABS; 100 case R_AARCH64_TLSDESC_ADR_PAGE21: 101 return R_AARCH64_TLSDESC_PAGE; 102 case R_AARCH64_TLSDESC_LD64_LO12: 103 case R_AARCH64_TLSDESC_ADD_LO12: 104 return R_TLSDESC; 105 case R_AARCH64_TLSDESC_CALL: 106 return R_TLSDESC_CALL; 107 case R_AARCH64_TLSLE_ADD_TPREL_HI12: 108 case R_AARCH64_TLSLE_ADD_TPREL_LO12_NC: 109 case R_AARCH64_TLSLE_LDST8_TPREL_LO12_NC: 110 case R_AARCH64_TLSLE_LDST16_TPREL_LO12_NC: 111 case R_AARCH64_TLSLE_LDST32_TPREL_LO12_NC: 112 case R_AARCH64_TLSLE_LDST64_TPREL_LO12_NC: 113 case R_AARCH64_TLSLE_LDST128_TPREL_LO12_NC: 114 case R_AARCH64_TLSLE_MOVW_TPREL_G0: 115 case R_AARCH64_TLSLE_MOVW_TPREL_G0_NC: 116 case R_AARCH64_TLSLE_MOVW_TPREL_G1: 117 case R_AARCH64_TLSLE_MOVW_TPREL_G1_NC: 118 case R_AARCH64_TLSLE_MOVW_TPREL_G2: 119 return R_TLS; 120 case R_AARCH64_CALL26: 121 case R_AARCH64_CONDBR19: 122 case R_AARCH64_JUMP26: 123 case R_AARCH64_TSTBR14: 124 return R_PLT_PC; 125 case R_AARCH64_PREL16: 126 case R_AARCH64_PREL32: 127 case R_AARCH64_PREL64: 128 case R_AARCH64_ADR_PREL_LO21: 129 case R_AARCH64_LD_PREL_LO19: 130 case R_AARCH64_MOVW_PREL_G0: 131 case R_AARCH64_MOVW_PREL_G0_NC: 132 case R_AARCH64_MOVW_PREL_G1: 133 case R_AARCH64_MOVW_PREL_G1_NC: 134 case R_AARCH64_MOVW_PREL_G2: 135 case R_AARCH64_MOVW_PREL_G2_NC: 136 case R_AARCH64_MOVW_PREL_G3: 137 return R_PC; 138 case R_AARCH64_ADR_PREL_PG_HI21: 139 case R_AARCH64_ADR_PREL_PG_HI21_NC: 140 return R_AARCH64_PAGE_PC; 141 case R_AARCH64_LD64_GOT_LO12_NC: 142 case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC: 143 return R_GOT; 144 case R_AARCH64_ADR_GOT_PAGE: 145 case R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21: 146 return R_AARCH64_GOT_PAGE_PC; 147 case R_AARCH64_NONE: 148 return R_NONE; 149 default: 150 error(getErrorLocation(loc) + "unknown relocation (" + Twine(type) + 151 ") against symbol " + toString(s)); 152 return R_NONE; 153 } 154 } 155 156 RelExpr AArch64::adjustRelaxExpr(RelType type, const uint8_t *data, 157 RelExpr expr) const { 158 if (expr == R_RELAX_TLS_GD_TO_IE) { 159 if (type == R_AARCH64_TLSDESC_ADR_PAGE21) 160 return R_AARCH64_RELAX_TLS_GD_TO_IE_PAGE_PC; 161 return R_RELAX_TLS_GD_TO_IE_ABS; 162 } 163 return expr; 164 } 165 166 bool AArch64::usesOnlyLowPageBits(RelType type) const { 167 switch (type) { 168 default: 169 return false; 170 case R_AARCH64_ADD_ABS_LO12_NC: 171 case R_AARCH64_LD64_GOT_LO12_NC: 172 case R_AARCH64_LDST128_ABS_LO12_NC: 173 case R_AARCH64_LDST16_ABS_LO12_NC: 174 case R_AARCH64_LDST32_ABS_LO12_NC: 175 case R_AARCH64_LDST64_ABS_LO12_NC: 176 case R_AARCH64_LDST8_ABS_LO12_NC: 177 case R_AARCH64_TLSDESC_ADD_LO12: 178 case R_AARCH64_TLSDESC_LD64_LO12: 179 case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC: 180 return true; 181 } 182 } 183 184 RelType AArch64::getDynRel(RelType type) const { 185 if (type == R_AARCH64_ABS64) 186 return type; 187 return R_AARCH64_NONE; 188 } 189 190 void AArch64::writeGotPlt(uint8_t *buf, const Symbol &) const { 191 write64le(buf, in.plt->getVA()); 192 } 193 194 void AArch64::writePltHeader(uint8_t *buf) const { 195 const uint8_t pltData[] = { 196 0xf0, 0x7b, 0xbf, 0xa9, // stp x16, x30, [sp,#-16]! 197 0x10, 0x00, 0x00, 0x90, // adrp x16, Page(&(.plt.got[2])) 198 0x11, 0x02, 0x40, 0xf9, // ldr x17, [x16, Offset(&(.plt.got[2]))] 199 0x10, 0x02, 0x00, 0x91, // add x16, x16, Offset(&(.plt.got[2])) 200 0x20, 0x02, 0x1f, 0xd6, // br x17 201 0x1f, 0x20, 0x03, 0xd5, // nop 202 0x1f, 0x20, 0x03, 0xd5, // nop 203 0x1f, 0x20, 0x03, 0xd5 // nop 204 }; 205 memcpy(buf, pltData, sizeof(pltData)); 206 207 uint64_t got = in.gotPlt->getVA(); 208 uint64_t plt = in.plt->getVA(); 209 relocateOne(buf + 4, R_AARCH64_ADR_PREL_PG_HI21, 210 getAArch64Page(got + 16) - getAArch64Page(plt + 4)); 211 relocateOne(buf + 8, R_AARCH64_LDST64_ABS_LO12_NC, got + 16); 212 relocateOne(buf + 12, R_AARCH64_ADD_ABS_LO12_NC, got + 16); 213 } 214 215 void AArch64::writePlt(uint8_t *buf, uint64_t gotPltEntryAddr, 216 uint64_t pltEntryAddr, int32_t index, 217 unsigned relOff) const { 218 const uint8_t inst[] = { 219 0x10, 0x00, 0x00, 0x90, // adrp x16, Page(&(.plt.got[n])) 220 0x11, 0x02, 0x40, 0xf9, // ldr x17, [x16, Offset(&(.plt.got[n]))] 221 0x10, 0x02, 0x00, 0x91, // add x16, x16, Offset(&(.plt.got[n])) 222 0x20, 0x02, 0x1f, 0xd6 // br x17 223 }; 224 memcpy(buf, inst, sizeof(inst)); 225 226 relocateOne(buf, R_AARCH64_ADR_PREL_PG_HI21, 227 getAArch64Page(gotPltEntryAddr) - getAArch64Page(pltEntryAddr)); 228 relocateOne(buf + 4, R_AARCH64_LDST64_ABS_LO12_NC, gotPltEntryAddr); 229 relocateOne(buf + 8, R_AARCH64_ADD_ABS_LO12_NC, gotPltEntryAddr); 230 } 231 232 bool AArch64::needsThunk(RelExpr expr, RelType type, const InputFile *file, 233 uint64_t branchAddr, const Symbol &s) const { 234 // ELF for the ARM 64-bit architecture, section Call and Jump relocations 235 // only permits range extension thunks for R_AARCH64_CALL26 and 236 // R_AARCH64_JUMP26 relocation types. 237 if (type != R_AARCH64_CALL26 && type != R_AARCH64_JUMP26) 238 return false; 239 uint64_t dst = (expr == R_PLT_PC) ? s.getPltVA() : s.getVA(); 240 return !inBranchRange(type, branchAddr, dst); 241 } 242 243 uint32_t AArch64::getThunkSectionSpacing() const { 244 // See comment in Arch/ARM.cpp for a more detailed explanation of 245 // getThunkSectionSpacing(). For AArch64 the only branches we are permitted to 246 // Thunk have a range of +/- 128 MiB 247 return (128 * 1024 * 1024) - 0x30000; 248 } 249 250 bool AArch64::inBranchRange(RelType type, uint64_t src, uint64_t dst) const { 251 if (type != R_AARCH64_CALL26 && type != R_AARCH64_JUMP26) 252 return true; 253 // The AArch64 call and unconditional branch instructions have a range of 254 // +/- 128 MiB. 255 uint64_t range = 128 * 1024 * 1024; 256 if (dst > src) { 257 // Immediate of branch is signed. 258 range -= 4; 259 return dst - src <= range; 260 } 261 return src - dst <= range; 262 } 263 264 static void write32AArch64Addr(uint8_t *l, uint64_t imm) { 265 uint32_t immLo = (imm & 0x3) << 29; 266 uint32_t immHi = (imm & 0x1FFFFC) << 3; 267 uint64_t mask = (0x3 << 29) | (0x1FFFFC << 3); 268 write32le(l, (read32le(l) & ~mask) | immLo | immHi); 269 } 270 271 // Return the bits [Start, End] from Val shifted Start bits. 272 // For instance, getBits(0xF0, 4, 8) returns 0xF. 273 static uint64_t getBits(uint64_t val, int start, int end) { 274 uint64_t mask = ((uint64_t)1 << (end + 1 - start)) - 1; 275 return (val >> start) & mask; 276 } 277 278 static void or32le(uint8_t *p, int32_t v) { write32le(p, read32le(p) | v); } 279 280 // Update the immediate field in a AARCH64 ldr, str, and add instruction. 281 static void or32AArch64Imm(uint8_t *l, uint64_t imm) { 282 or32le(l, (imm & 0xFFF) << 10); 283 } 284 285 // Update the immediate field in an AArch64 movk, movn or movz instruction 286 // for a signed relocation, and update the opcode of a movn or movz instruction 287 // to match the sign of the operand. 288 static void writeSMovWImm(uint8_t *loc, uint32_t imm) { 289 uint32_t inst = read32le(loc); 290 // Opcode field is bits 30, 29, with 10 = movz, 00 = movn and 11 = movk. 291 if (!(inst & (1 << 29))) { 292 // movn or movz. 293 if (imm & 0x10000) { 294 // Change opcode to movn, which takes an inverted operand. 295 imm ^= 0xFFFF; 296 inst &= ~(1 << 30); 297 } else { 298 // Change opcode to movz. 299 inst |= 1 << 30; 300 } 301 } 302 write32le(loc, inst | ((imm & 0xFFFF) << 5)); 303 } 304 305 void AArch64::relocateOne(uint8_t *loc, RelType type, uint64_t val) const { 306 switch (type) { 307 case R_AARCH64_ABS16: 308 case R_AARCH64_PREL16: 309 checkIntUInt(loc, val, 16, type); 310 write16le(loc, val); 311 break; 312 case R_AARCH64_ABS32: 313 case R_AARCH64_PREL32: 314 checkIntUInt(loc, val, 32, type); 315 write32le(loc, val); 316 break; 317 case R_AARCH64_ABS64: 318 case R_AARCH64_PREL64: 319 write64le(loc, val); 320 break; 321 case R_AARCH64_ADD_ABS_LO12_NC: 322 or32AArch64Imm(loc, val); 323 break; 324 case R_AARCH64_ADR_GOT_PAGE: 325 case R_AARCH64_ADR_PREL_PG_HI21: 326 case R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21: 327 case R_AARCH64_TLSDESC_ADR_PAGE21: 328 checkInt(loc, val, 33, type); 329 LLVM_FALLTHROUGH; 330 case R_AARCH64_ADR_PREL_PG_HI21_NC: 331 write32AArch64Addr(loc, val >> 12); 332 break; 333 case R_AARCH64_ADR_PREL_LO21: 334 checkInt(loc, val, 21, type); 335 write32AArch64Addr(loc, val); 336 break; 337 case R_AARCH64_JUMP26: 338 // Normally we would just write the bits of the immediate field, however 339 // when patching instructions for the cpu errata fix -fix-cortex-a53-843419 340 // we want to replace a non-branch instruction with a branch immediate 341 // instruction. By writing all the bits of the instruction including the 342 // opcode and the immediate (0 001 | 01 imm26) we can do this 343 // transformation by placing a R_AARCH64_JUMP26 relocation at the offset of 344 // the instruction we want to patch. 345 write32le(loc, 0x14000000); 346 LLVM_FALLTHROUGH; 347 case R_AARCH64_CALL26: 348 checkInt(loc, val, 28, type); 349 or32le(loc, (val & 0x0FFFFFFC) >> 2); 350 break; 351 case R_AARCH64_CONDBR19: 352 case R_AARCH64_LD_PREL_LO19: 353 checkAlignment(loc, val, 4, type); 354 checkInt(loc, val, 21, type); 355 or32le(loc, (val & 0x1FFFFC) << 3); 356 break; 357 case R_AARCH64_LDST8_ABS_LO12_NC: 358 case R_AARCH64_TLSLE_LDST8_TPREL_LO12_NC: 359 or32AArch64Imm(loc, getBits(val, 0, 11)); 360 break; 361 case R_AARCH64_LDST16_ABS_LO12_NC: 362 case R_AARCH64_TLSLE_LDST16_TPREL_LO12_NC: 363 checkAlignment(loc, val, 2, type); 364 or32AArch64Imm(loc, getBits(val, 1, 11)); 365 break; 366 case R_AARCH64_LDST32_ABS_LO12_NC: 367 case R_AARCH64_TLSLE_LDST32_TPREL_LO12_NC: 368 checkAlignment(loc, val, 4, type); 369 or32AArch64Imm(loc, getBits(val, 2, 11)); 370 break; 371 case R_AARCH64_LDST64_ABS_LO12_NC: 372 case R_AARCH64_LD64_GOT_LO12_NC: 373 case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC: 374 case R_AARCH64_TLSLE_LDST64_TPREL_LO12_NC: 375 case R_AARCH64_TLSDESC_LD64_LO12: 376 checkAlignment(loc, val, 8, type); 377 or32AArch64Imm(loc, getBits(val, 3, 11)); 378 break; 379 case R_AARCH64_LDST128_ABS_LO12_NC: 380 case R_AARCH64_TLSLE_LDST128_TPREL_LO12_NC: 381 checkAlignment(loc, val, 16, type); 382 or32AArch64Imm(loc, getBits(val, 4, 11)); 383 break; 384 case R_AARCH64_MOVW_UABS_G0: 385 checkUInt(loc, val, 16, type); 386 LLVM_FALLTHROUGH; 387 case R_AARCH64_MOVW_UABS_G0_NC: 388 or32le(loc, (val & 0xFFFF) << 5); 389 break; 390 case R_AARCH64_MOVW_UABS_G1: 391 checkUInt(loc, val, 32, type); 392 LLVM_FALLTHROUGH; 393 case R_AARCH64_MOVW_UABS_G1_NC: 394 or32le(loc, (val & 0xFFFF0000) >> 11); 395 break; 396 case R_AARCH64_MOVW_UABS_G2: 397 checkUInt(loc, val, 48, type); 398 LLVM_FALLTHROUGH; 399 case R_AARCH64_MOVW_UABS_G2_NC: 400 or32le(loc, (val & 0xFFFF00000000) >> 27); 401 break; 402 case R_AARCH64_MOVW_UABS_G3: 403 or32le(loc, (val & 0xFFFF000000000000) >> 43); 404 break; 405 case R_AARCH64_MOVW_PREL_G0: 406 case R_AARCH64_MOVW_SABS_G0: 407 case R_AARCH64_TLSLE_MOVW_TPREL_G0: 408 checkInt(loc, val, 17, type); 409 LLVM_FALLTHROUGH; 410 case R_AARCH64_MOVW_PREL_G0_NC: 411 case R_AARCH64_TLSLE_MOVW_TPREL_G0_NC: 412 writeSMovWImm(loc, val); 413 break; 414 case R_AARCH64_MOVW_PREL_G1: 415 case R_AARCH64_MOVW_SABS_G1: 416 case R_AARCH64_TLSLE_MOVW_TPREL_G1: 417 checkInt(loc, val, 33, type); 418 LLVM_FALLTHROUGH; 419 case R_AARCH64_MOVW_PREL_G1_NC: 420 case R_AARCH64_TLSLE_MOVW_TPREL_G1_NC: 421 writeSMovWImm(loc, val >> 16); 422 break; 423 case R_AARCH64_MOVW_PREL_G2: 424 case R_AARCH64_MOVW_SABS_G2: 425 case R_AARCH64_TLSLE_MOVW_TPREL_G2: 426 checkInt(loc, val, 49, type); 427 LLVM_FALLTHROUGH; 428 case R_AARCH64_MOVW_PREL_G2_NC: 429 writeSMovWImm(loc, val >> 32); 430 break; 431 case R_AARCH64_MOVW_PREL_G3: 432 writeSMovWImm(loc, val >> 48); 433 break; 434 case R_AARCH64_TSTBR14: 435 checkInt(loc, val, 16, type); 436 or32le(loc, (val & 0xFFFC) << 3); 437 break; 438 case R_AARCH64_TLSLE_ADD_TPREL_HI12: 439 checkUInt(loc, val, 24, type); 440 or32AArch64Imm(loc, val >> 12); 441 break; 442 case R_AARCH64_TLSLE_ADD_TPREL_LO12_NC: 443 case R_AARCH64_TLSDESC_ADD_LO12: 444 or32AArch64Imm(loc, val); 445 break; 446 default: 447 llvm_unreachable("unknown relocation"); 448 } 449 } 450 451 void AArch64::relaxTlsGdToLe(uint8_t *loc, RelType type, uint64_t val) const { 452 // TLSDESC Global-Dynamic relocation are in the form: 453 // adrp x0, :tlsdesc:v [R_AARCH64_TLSDESC_ADR_PAGE21] 454 // ldr x1, [x0, #:tlsdesc_lo12:v [R_AARCH64_TLSDESC_LD64_LO12] 455 // add x0, x0, :tlsdesc_los:v [R_AARCH64_TLSDESC_ADD_LO12] 456 // .tlsdesccall [R_AARCH64_TLSDESC_CALL] 457 // blr x1 458 // And it can optimized to: 459 // movz x0, #0x0, lsl #16 460 // movk x0, #0x10 461 // nop 462 // nop 463 checkUInt(loc, val, 32, type); 464 465 switch (type) { 466 case R_AARCH64_TLSDESC_ADD_LO12: 467 case R_AARCH64_TLSDESC_CALL: 468 write32le(loc, 0xd503201f); // nop 469 return; 470 case R_AARCH64_TLSDESC_ADR_PAGE21: 471 write32le(loc, 0xd2a00000 | (((val >> 16) & 0xffff) << 5)); // movz 472 return; 473 case R_AARCH64_TLSDESC_LD64_LO12: 474 write32le(loc, 0xf2800000 | ((val & 0xffff) << 5)); // movk 475 return; 476 default: 477 llvm_unreachable("unsupported relocation for TLS GD to LE relaxation"); 478 } 479 } 480 481 void AArch64::relaxTlsGdToIe(uint8_t *loc, RelType type, uint64_t val) const { 482 // TLSDESC Global-Dynamic relocation are in the form: 483 // adrp x0, :tlsdesc:v [R_AARCH64_TLSDESC_ADR_PAGE21] 484 // ldr x1, [x0, #:tlsdesc_lo12:v [R_AARCH64_TLSDESC_LD64_LO12] 485 // add x0, x0, :tlsdesc_los:v [R_AARCH64_TLSDESC_ADD_LO12] 486 // .tlsdesccall [R_AARCH64_TLSDESC_CALL] 487 // blr x1 488 // And it can optimized to: 489 // adrp x0, :gottprel:v 490 // ldr x0, [x0, :gottprel_lo12:v] 491 // nop 492 // nop 493 494 switch (type) { 495 case R_AARCH64_TLSDESC_ADD_LO12: 496 case R_AARCH64_TLSDESC_CALL: 497 write32le(loc, 0xd503201f); // nop 498 break; 499 case R_AARCH64_TLSDESC_ADR_PAGE21: 500 write32le(loc, 0x90000000); // adrp 501 relocateOne(loc, R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21, val); 502 break; 503 case R_AARCH64_TLSDESC_LD64_LO12: 504 write32le(loc, 0xf9400000); // ldr 505 relocateOne(loc, R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC, val); 506 break; 507 default: 508 llvm_unreachable("unsupported relocation for TLS GD to LE relaxation"); 509 } 510 } 511 512 void AArch64::relaxTlsIeToLe(uint8_t *loc, RelType type, uint64_t val) const { 513 checkUInt(loc, val, 32, type); 514 515 if (type == R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21) { 516 // Generate MOVZ. 517 uint32_t regNo = read32le(loc) & 0x1f; 518 write32le(loc, (0xd2a00000 | regNo) | (((val >> 16) & 0xffff) << 5)); 519 return; 520 } 521 if (type == R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC) { 522 // Generate MOVK. 523 uint32_t regNo = read32le(loc) & 0x1f; 524 write32le(loc, (0xf2800000 | regNo) | ((val & 0xffff) << 5)); 525 return; 526 } 527 llvm_unreachable("invalid relocation for TLS IE to LE relaxation"); 528 } 529 530 // AArch64 may use security features in variant PLT sequences. These are: 531 // Pointer Authentication (PAC), introduced in armv8.3-a and Branch Target 532 // Indicator (BTI) introduced in armv8.5-a. The additional instructions used 533 // in the variant Plt sequences are encoded in the Hint space so they can be 534 // deployed on older architectures, which treat the instructions as a nop. 535 // PAC and BTI can be combined leading to the following combinations: 536 // writePltHeader 537 // writePltHeaderBti (no PAC Header needed) 538 // writePlt 539 // writePltBti (BTI only) 540 // writePltPac (PAC only) 541 // writePltBtiPac (BTI and PAC) 542 // 543 // When PAC is enabled the dynamic loader encrypts the address that it places 544 // in the .got.plt using the pacia1716 instruction which encrypts the value in 545 // x17 using the modifier in x16. The static linker places autia1716 before the 546 // indirect branch to x17 to authenticate the address in x17 with the modifier 547 // in x16. This makes it more difficult for an attacker to modify the value in 548 // the .got.plt. 549 // 550 // When BTI is enabled all indirect branches must land on a bti instruction. 551 // The static linker must place a bti instruction at the start of any PLT entry 552 // that may be the target of an indirect branch. As the PLT entries call the 553 // lazy resolver indirectly this must have a bti instruction at start. In 554 // general a bti instruction is not needed for a PLT entry as indirect calls 555 // are resolved to the function address and not the PLT entry for the function. 556 // There are a small number of cases where the PLT address can escape, such as 557 // taking the address of a function or ifunc via a non got-generating 558 // relocation, and a shared library refers to that symbol. 559 // 560 // We use the bti c variant of the instruction which permits indirect branches 561 // (br) via x16/x17 and indirect function calls (blr) via any register. The ABI 562 // guarantees that all indirect branches from code requiring BTI protection 563 // will go via x16/x17 564 565 namespace { 566 class AArch64BtiPac final : public AArch64 { 567 public: 568 AArch64BtiPac(); 569 void writePltHeader(uint8_t *buf) const override; 570 void writePlt(uint8_t *buf, uint64_t gotPltEntryAddr, uint64_t pltEntryAddr, 571 int32_t index, unsigned relOff) const override; 572 573 private: 574 bool btiHeader; // bti instruction needed in PLT Header 575 bool btiEntry; // bti instruction needed in PLT Entry 576 bool pacEntry; // autia1716 instruction needed in PLT Entry 577 }; 578 } // namespace 579 580 AArch64BtiPac::AArch64BtiPac() { 581 btiHeader = (config->andFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_BTI); 582 // A BTI (Branch Target Indicator) Plt Entry is only required if the 583 // address of the PLT entry can be taken by the program, which permits an 584 // indirect jump to the PLT entry. This can happen when the address 585 // of the PLT entry for a function is canonicalised due to the address of 586 // the function in an executable being taken by a shared library. 587 // FIXME: There is a potential optimization to omit the BTI if we detect 588 // that the address of the PLT entry isn't taken. 589 btiEntry = btiHeader && !config->shared; 590 pacEntry = (config->andFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_PAC); 591 592 if (btiEntry || pacEntry) 593 pltEntrySize = 24; 594 } 595 596 void AArch64BtiPac::writePltHeader(uint8_t *buf) const { 597 const uint8_t btiData[] = { 0x5f, 0x24, 0x03, 0xd5 }; // bti c 598 const uint8_t pltData[] = { 599 0xf0, 0x7b, 0xbf, 0xa9, // stp x16, x30, [sp,#-16]! 600 0x10, 0x00, 0x00, 0x90, // adrp x16, Page(&(.plt.got[2])) 601 0x11, 0x02, 0x40, 0xf9, // ldr x17, [x16, Offset(&(.plt.got[2]))] 602 0x10, 0x02, 0x00, 0x91, // add x16, x16, Offset(&(.plt.got[2])) 603 0x20, 0x02, 0x1f, 0xd6, // br x17 604 0x1f, 0x20, 0x03, 0xd5, // nop 605 0x1f, 0x20, 0x03, 0xd5 // nop 606 }; 607 const uint8_t nopData[] = { 0x1f, 0x20, 0x03, 0xd5 }; // nop 608 609 uint64_t got = in.gotPlt->getVA(); 610 uint64_t plt = in.plt->getVA(); 611 612 if (btiHeader) { 613 // PltHeader is called indirectly by plt[N]. Prefix pltData with a BTI C 614 // instruction. 615 memcpy(buf, btiData, sizeof(btiData)); 616 buf += sizeof(btiData); 617 plt += sizeof(btiData); 618 } 619 memcpy(buf, pltData, sizeof(pltData)); 620 621 relocateOne(buf + 4, R_AARCH64_ADR_PREL_PG_HI21, 622 getAArch64Page(got + 16) - getAArch64Page(plt + 8)); 623 relocateOne(buf + 8, R_AARCH64_LDST64_ABS_LO12_NC, got + 16); 624 relocateOne(buf + 12, R_AARCH64_ADD_ABS_LO12_NC, got + 16); 625 if (!btiHeader) 626 // We didn't add the BTI c instruction so round out size with NOP. 627 memcpy(buf + sizeof(pltData), nopData, sizeof(nopData)); 628 } 629 630 void AArch64BtiPac::writePlt(uint8_t *buf, uint64_t gotPltEntryAddr, 631 uint64_t pltEntryAddr, int32_t index, 632 unsigned relOff) const { 633 // The PLT entry is of the form: 634 // [btiData] addrInst (pacBr | stdBr) [nopData] 635 const uint8_t btiData[] = { 0x5f, 0x24, 0x03, 0xd5 }; // bti c 636 const uint8_t addrInst[] = { 637 0x10, 0x00, 0x00, 0x90, // adrp x16, Page(&(.plt.got[n])) 638 0x11, 0x02, 0x40, 0xf9, // ldr x17, [x16, Offset(&(.plt.got[n]))] 639 0x10, 0x02, 0x00, 0x91 // add x16, x16, Offset(&(.plt.got[n])) 640 }; 641 const uint8_t pacBr[] = { 642 0x9f, 0x21, 0x03, 0xd5, // autia1716 643 0x20, 0x02, 0x1f, 0xd6 // br x17 644 }; 645 const uint8_t stdBr[] = { 646 0x20, 0x02, 0x1f, 0xd6, // br x17 647 0x1f, 0x20, 0x03, 0xd5 // nop 648 }; 649 const uint8_t nopData[] = { 0x1f, 0x20, 0x03, 0xd5 }; // nop 650 651 if (btiEntry) { 652 memcpy(buf, btiData, sizeof(btiData)); 653 buf += sizeof(btiData); 654 pltEntryAddr += sizeof(btiData); 655 } 656 657 memcpy(buf, addrInst, sizeof(addrInst)); 658 relocateOne(buf, R_AARCH64_ADR_PREL_PG_HI21, 659 getAArch64Page(gotPltEntryAddr) - 660 getAArch64Page(pltEntryAddr)); 661 relocateOne(buf + 4, R_AARCH64_LDST64_ABS_LO12_NC, gotPltEntryAddr); 662 relocateOne(buf + 8, R_AARCH64_ADD_ABS_LO12_NC, gotPltEntryAddr); 663 664 if (pacEntry) 665 memcpy(buf + sizeof(addrInst), pacBr, sizeof(pacBr)); 666 else 667 memcpy(buf + sizeof(addrInst), stdBr, sizeof(stdBr)); 668 if (!btiEntry) 669 // We didn't add the BTI c instruction so round out size with NOP. 670 memcpy(buf + sizeof(addrInst) + sizeof(stdBr), nopData, sizeof(nopData)); 671 } 672 673 static TargetInfo *getTargetInfo() { 674 if (config->andFeatures & (GNU_PROPERTY_AARCH64_FEATURE_1_BTI | 675 GNU_PROPERTY_AARCH64_FEATURE_1_PAC)) { 676 static AArch64BtiPac t; 677 return &t; 678 } 679 static AArch64 t; 680 return &t; 681 } 682 683 TargetInfo *getAArch64TargetInfo() { return getTargetInfo(); } 684 685 } // namespace elf 686 } // namespace lld 687