xref: /freebsd/contrib/llvm-project/lld/ELF/Arch/AArch64.cpp (revision 85868e8a1daeaae7a0e48effb2ea2310ae3b02c6)
1 //===- AArch64.cpp --------------------------------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 
9 #include "Symbols.h"
10 #include "SyntheticSections.h"
11 #include "Target.h"
12 #include "Thunks.h"
13 #include "lld/Common/ErrorHandler.h"
14 #include "llvm/Object/ELF.h"
15 #include "llvm/Support/Endian.h"
16 
17 using namespace llvm;
18 using namespace llvm::support::endian;
19 using namespace llvm::ELF;
20 
21 namespace lld {
22 namespace elf {
23 
24 // Page(Expr) is the page address of the expression Expr, defined
25 // as (Expr & ~0xFFF). (This applies even if the machine page size
26 // supported by the platform has a different value.)
27 uint64_t getAArch64Page(uint64_t expr) {
28   return expr & ~static_cast<uint64_t>(0xFFF);
29 }
30 
31 namespace {
32 class AArch64 : public TargetInfo {
33 public:
34   AArch64();
35   RelExpr getRelExpr(RelType type, const Symbol &s,
36                      const uint8_t *loc) const override;
37   RelType getDynRel(RelType type) const override;
38   void writeGotPlt(uint8_t *buf, const Symbol &s) const override;
39   void writePltHeader(uint8_t *buf) const override;
40   void writePlt(uint8_t *buf, uint64_t gotPltEntryAddr, uint64_t pltEntryAddr,
41                 int32_t index, unsigned relOff) const override;
42   bool needsThunk(RelExpr expr, RelType type, const InputFile *file,
43                   uint64_t branchAddr, const Symbol &s) const override;
44   uint32_t getThunkSectionSpacing() const override;
45   bool inBranchRange(RelType type, uint64_t src, uint64_t dst) const override;
46   bool usesOnlyLowPageBits(RelType type) const override;
47   void relocateOne(uint8_t *loc, RelType type, uint64_t val) const override;
48   RelExpr adjustRelaxExpr(RelType type, const uint8_t *data,
49                           RelExpr expr) const override;
50   void relaxTlsGdToLe(uint8_t *loc, RelType type, uint64_t val) const override;
51   void relaxTlsGdToIe(uint8_t *loc, RelType type, uint64_t val) const override;
52   void relaxTlsIeToLe(uint8_t *loc, RelType type, uint64_t val) const override;
53 };
54 } // namespace
55 
56 AArch64::AArch64() {
57   copyRel = R_AARCH64_COPY;
58   relativeRel = R_AARCH64_RELATIVE;
59   iRelativeRel = R_AARCH64_IRELATIVE;
60   gotRel = R_AARCH64_GLOB_DAT;
61   noneRel = R_AARCH64_NONE;
62   pltRel = R_AARCH64_JUMP_SLOT;
63   symbolicRel = R_AARCH64_ABS64;
64   tlsDescRel = R_AARCH64_TLSDESC;
65   tlsGotRel = R_AARCH64_TLS_TPREL64;
66   pltEntrySize = 16;
67   pltHeaderSize = 32;
68   defaultMaxPageSize = 65536;
69 
70   // Align to the 2 MiB page size (known as a superpage or huge page).
71   // FreeBSD automatically promotes 2 MiB-aligned allocations.
72   defaultImageBase = 0x200000;
73 
74   needsThunks = true;
75 }
76 
77 RelExpr AArch64::getRelExpr(RelType type, const Symbol &s,
78                             const uint8_t *loc) const {
79   switch (type) {
80   case R_AARCH64_ABS16:
81   case R_AARCH64_ABS32:
82   case R_AARCH64_ABS64:
83   case R_AARCH64_ADD_ABS_LO12_NC:
84   case R_AARCH64_LDST128_ABS_LO12_NC:
85   case R_AARCH64_LDST16_ABS_LO12_NC:
86   case R_AARCH64_LDST32_ABS_LO12_NC:
87   case R_AARCH64_LDST64_ABS_LO12_NC:
88   case R_AARCH64_LDST8_ABS_LO12_NC:
89   case R_AARCH64_MOVW_SABS_G0:
90   case R_AARCH64_MOVW_SABS_G1:
91   case R_AARCH64_MOVW_SABS_G2:
92   case R_AARCH64_MOVW_UABS_G0:
93   case R_AARCH64_MOVW_UABS_G0_NC:
94   case R_AARCH64_MOVW_UABS_G1:
95   case R_AARCH64_MOVW_UABS_G1_NC:
96   case R_AARCH64_MOVW_UABS_G2:
97   case R_AARCH64_MOVW_UABS_G2_NC:
98   case R_AARCH64_MOVW_UABS_G3:
99     return R_ABS;
100   case R_AARCH64_TLSDESC_ADR_PAGE21:
101     return R_AARCH64_TLSDESC_PAGE;
102   case R_AARCH64_TLSDESC_LD64_LO12:
103   case R_AARCH64_TLSDESC_ADD_LO12:
104     return R_TLSDESC;
105   case R_AARCH64_TLSDESC_CALL:
106     return R_TLSDESC_CALL;
107   case R_AARCH64_TLSLE_ADD_TPREL_HI12:
108   case R_AARCH64_TLSLE_ADD_TPREL_LO12_NC:
109   case R_AARCH64_TLSLE_LDST8_TPREL_LO12_NC:
110   case R_AARCH64_TLSLE_LDST16_TPREL_LO12_NC:
111   case R_AARCH64_TLSLE_LDST32_TPREL_LO12_NC:
112   case R_AARCH64_TLSLE_LDST64_TPREL_LO12_NC:
113   case R_AARCH64_TLSLE_LDST128_TPREL_LO12_NC:
114   case R_AARCH64_TLSLE_MOVW_TPREL_G0:
115   case R_AARCH64_TLSLE_MOVW_TPREL_G0_NC:
116   case R_AARCH64_TLSLE_MOVW_TPREL_G1:
117   case R_AARCH64_TLSLE_MOVW_TPREL_G1_NC:
118   case R_AARCH64_TLSLE_MOVW_TPREL_G2:
119     return R_TLS;
120   case R_AARCH64_CALL26:
121   case R_AARCH64_CONDBR19:
122   case R_AARCH64_JUMP26:
123   case R_AARCH64_TSTBR14:
124     return R_PLT_PC;
125   case R_AARCH64_PREL16:
126   case R_AARCH64_PREL32:
127   case R_AARCH64_PREL64:
128   case R_AARCH64_ADR_PREL_LO21:
129   case R_AARCH64_LD_PREL_LO19:
130   case R_AARCH64_MOVW_PREL_G0:
131   case R_AARCH64_MOVW_PREL_G0_NC:
132   case R_AARCH64_MOVW_PREL_G1:
133   case R_AARCH64_MOVW_PREL_G1_NC:
134   case R_AARCH64_MOVW_PREL_G2:
135   case R_AARCH64_MOVW_PREL_G2_NC:
136   case R_AARCH64_MOVW_PREL_G3:
137     return R_PC;
138   case R_AARCH64_ADR_PREL_PG_HI21:
139   case R_AARCH64_ADR_PREL_PG_HI21_NC:
140     return R_AARCH64_PAGE_PC;
141   case R_AARCH64_LD64_GOT_LO12_NC:
142   case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC:
143     return R_GOT;
144   case R_AARCH64_ADR_GOT_PAGE:
145   case R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21:
146     return R_AARCH64_GOT_PAGE_PC;
147   case R_AARCH64_NONE:
148     return R_NONE;
149   default:
150     error(getErrorLocation(loc) + "unknown relocation (" + Twine(type) +
151           ") against symbol " + toString(s));
152     return R_NONE;
153   }
154 }
155 
156 RelExpr AArch64::adjustRelaxExpr(RelType type, const uint8_t *data,
157                                  RelExpr expr) const {
158   if (expr == R_RELAX_TLS_GD_TO_IE) {
159     if (type == R_AARCH64_TLSDESC_ADR_PAGE21)
160       return R_AARCH64_RELAX_TLS_GD_TO_IE_PAGE_PC;
161     return R_RELAX_TLS_GD_TO_IE_ABS;
162   }
163   return expr;
164 }
165 
166 bool AArch64::usesOnlyLowPageBits(RelType type) const {
167   switch (type) {
168   default:
169     return false;
170   case R_AARCH64_ADD_ABS_LO12_NC:
171   case R_AARCH64_LD64_GOT_LO12_NC:
172   case R_AARCH64_LDST128_ABS_LO12_NC:
173   case R_AARCH64_LDST16_ABS_LO12_NC:
174   case R_AARCH64_LDST32_ABS_LO12_NC:
175   case R_AARCH64_LDST64_ABS_LO12_NC:
176   case R_AARCH64_LDST8_ABS_LO12_NC:
177   case R_AARCH64_TLSDESC_ADD_LO12:
178   case R_AARCH64_TLSDESC_LD64_LO12:
179   case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC:
180     return true;
181   }
182 }
183 
184 RelType AArch64::getDynRel(RelType type) const {
185   if (type == R_AARCH64_ABS64)
186     return type;
187   return R_AARCH64_NONE;
188 }
189 
190 void AArch64::writeGotPlt(uint8_t *buf, const Symbol &) const {
191   write64le(buf, in.plt->getVA());
192 }
193 
194 void AArch64::writePltHeader(uint8_t *buf) const {
195   const uint8_t pltData[] = {
196       0xf0, 0x7b, 0xbf, 0xa9, // stp    x16, x30, [sp,#-16]!
197       0x10, 0x00, 0x00, 0x90, // adrp   x16, Page(&(.plt.got[2]))
198       0x11, 0x02, 0x40, 0xf9, // ldr    x17, [x16, Offset(&(.plt.got[2]))]
199       0x10, 0x02, 0x00, 0x91, // add    x16, x16, Offset(&(.plt.got[2]))
200       0x20, 0x02, 0x1f, 0xd6, // br     x17
201       0x1f, 0x20, 0x03, 0xd5, // nop
202       0x1f, 0x20, 0x03, 0xd5, // nop
203       0x1f, 0x20, 0x03, 0xd5  // nop
204   };
205   memcpy(buf, pltData, sizeof(pltData));
206 
207   uint64_t got = in.gotPlt->getVA();
208   uint64_t plt = in.plt->getVA();
209   relocateOne(buf + 4, R_AARCH64_ADR_PREL_PG_HI21,
210               getAArch64Page(got + 16) - getAArch64Page(plt + 4));
211   relocateOne(buf + 8, R_AARCH64_LDST64_ABS_LO12_NC, got + 16);
212   relocateOne(buf + 12, R_AARCH64_ADD_ABS_LO12_NC, got + 16);
213 }
214 
215 void AArch64::writePlt(uint8_t *buf, uint64_t gotPltEntryAddr,
216                        uint64_t pltEntryAddr, int32_t index,
217                        unsigned relOff) const {
218   const uint8_t inst[] = {
219       0x10, 0x00, 0x00, 0x90, // adrp x16, Page(&(.plt.got[n]))
220       0x11, 0x02, 0x40, 0xf9, // ldr  x17, [x16, Offset(&(.plt.got[n]))]
221       0x10, 0x02, 0x00, 0x91, // add  x16, x16, Offset(&(.plt.got[n]))
222       0x20, 0x02, 0x1f, 0xd6  // br   x17
223   };
224   memcpy(buf, inst, sizeof(inst));
225 
226   relocateOne(buf, R_AARCH64_ADR_PREL_PG_HI21,
227               getAArch64Page(gotPltEntryAddr) - getAArch64Page(pltEntryAddr));
228   relocateOne(buf + 4, R_AARCH64_LDST64_ABS_LO12_NC, gotPltEntryAddr);
229   relocateOne(buf + 8, R_AARCH64_ADD_ABS_LO12_NC, gotPltEntryAddr);
230 }
231 
232 bool AArch64::needsThunk(RelExpr expr, RelType type, const InputFile *file,
233                          uint64_t branchAddr, const Symbol &s) const {
234   // ELF for the ARM 64-bit architecture, section Call and Jump relocations
235   // only permits range extension thunks for R_AARCH64_CALL26 and
236   // R_AARCH64_JUMP26 relocation types.
237   if (type != R_AARCH64_CALL26 && type != R_AARCH64_JUMP26)
238     return false;
239   uint64_t dst = (expr == R_PLT_PC) ? s.getPltVA() : s.getVA();
240   return !inBranchRange(type, branchAddr, dst);
241 }
242 
243 uint32_t AArch64::getThunkSectionSpacing() const {
244   // See comment in Arch/ARM.cpp for a more detailed explanation of
245   // getThunkSectionSpacing(). For AArch64 the only branches we are permitted to
246   // Thunk have a range of +/- 128 MiB
247   return (128 * 1024 * 1024) - 0x30000;
248 }
249 
250 bool AArch64::inBranchRange(RelType type, uint64_t src, uint64_t dst) const {
251   if (type != R_AARCH64_CALL26 && type != R_AARCH64_JUMP26)
252     return true;
253   // The AArch64 call and unconditional branch instructions have a range of
254   // +/- 128 MiB.
255   uint64_t range = 128 * 1024 * 1024;
256   if (dst > src) {
257     // Immediate of branch is signed.
258     range -= 4;
259     return dst - src <= range;
260   }
261   return src - dst <= range;
262 }
263 
264 static void write32AArch64Addr(uint8_t *l, uint64_t imm) {
265   uint32_t immLo = (imm & 0x3) << 29;
266   uint32_t immHi = (imm & 0x1FFFFC) << 3;
267   uint64_t mask = (0x3 << 29) | (0x1FFFFC << 3);
268   write32le(l, (read32le(l) & ~mask) | immLo | immHi);
269 }
270 
271 // Return the bits [Start, End] from Val shifted Start bits.
272 // For instance, getBits(0xF0, 4, 8) returns 0xF.
273 static uint64_t getBits(uint64_t val, int start, int end) {
274   uint64_t mask = ((uint64_t)1 << (end + 1 - start)) - 1;
275   return (val >> start) & mask;
276 }
277 
278 static void or32le(uint8_t *p, int32_t v) { write32le(p, read32le(p) | v); }
279 
280 // Update the immediate field in a AARCH64 ldr, str, and add instruction.
281 static void or32AArch64Imm(uint8_t *l, uint64_t imm) {
282   or32le(l, (imm & 0xFFF) << 10);
283 }
284 
285 // Update the immediate field in an AArch64 movk, movn or movz instruction
286 // for a signed relocation, and update the opcode of a movn or movz instruction
287 // to match the sign of the operand.
288 static void writeSMovWImm(uint8_t *loc, uint32_t imm) {
289   uint32_t inst = read32le(loc);
290   // Opcode field is bits 30, 29, with 10 = movz, 00 = movn and 11 = movk.
291   if (!(inst & (1 << 29))) {
292     // movn or movz.
293     if (imm & 0x10000) {
294       // Change opcode to movn, which takes an inverted operand.
295       imm ^= 0xFFFF;
296       inst &= ~(1 << 30);
297     } else {
298       // Change opcode to movz.
299       inst |= 1 << 30;
300     }
301   }
302   write32le(loc, inst | ((imm & 0xFFFF) << 5));
303 }
304 
305 void AArch64::relocateOne(uint8_t *loc, RelType type, uint64_t val) const {
306   switch (type) {
307   case R_AARCH64_ABS16:
308   case R_AARCH64_PREL16:
309     checkIntUInt(loc, val, 16, type);
310     write16le(loc, val);
311     break;
312   case R_AARCH64_ABS32:
313   case R_AARCH64_PREL32:
314     checkIntUInt(loc, val, 32, type);
315     write32le(loc, val);
316     break;
317   case R_AARCH64_ABS64:
318   case R_AARCH64_PREL64:
319     write64le(loc, val);
320     break;
321   case R_AARCH64_ADD_ABS_LO12_NC:
322     or32AArch64Imm(loc, val);
323     break;
324   case R_AARCH64_ADR_GOT_PAGE:
325   case R_AARCH64_ADR_PREL_PG_HI21:
326   case R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21:
327   case R_AARCH64_TLSDESC_ADR_PAGE21:
328     checkInt(loc, val, 33, type);
329     LLVM_FALLTHROUGH;
330   case R_AARCH64_ADR_PREL_PG_HI21_NC:
331     write32AArch64Addr(loc, val >> 12);
332     break;
333   case R_AARCH64_ADR_PREL_LO21:
334     checkInt(loc, val, 21, type);
335     write32AArch64Addr(loc, val);
336     break;
337   case R_AARCH64_JUMP26:
338     // Normally we would just write the bits of the immediate field, however
339     // when patching instructions for the cpu errata fix -fix-cortex-a53-843419
340     // we want to replace a non-branch instruction with a branch immediate
341     // instruction. By writing all the bits of the instruction including the
342     // opcode and the immediate (0 001 | 01 imm26) we can do this
343     // transformation by placing a R_AARCH64_JUMP26 relocation at the offset of
344     // the instruction we want to patch.
345     write32le(loc, 0x14000000);
346     LLVM_FALLTHROUGH;
347   case R_AARCH64_CALL26:
348     checkInt(loc, val, 28, type);
349     or32le(loc, (val & 0x0FFFFFFC) >> 2);
350     break;
351   case R_AARCH64_CONDBR19:
352   case R_AARCH64_LD_PREL_LO19:
353     checkAlignment(loc, val, 4, type);
354     checkInt(loc, val, 21, type);
355     or32le(loc, (val & 0x1FFFFC) << 3);
356     break;
357   case R_AARCH64_LDST8_ABS_LO12_NC:
358   case R_AARCH64_TLSLE_LDST8_TPREL_LO12_NC:
359     or32AArch64Imm(loc, getBits(val, 0, 11));
360     break;
361   case R_AARCH64_LDST16_ABS_LO12_NC:
362   case R_AARCH64_TLSLE_LDST16_TPREL_LO12_NC:
363     checkAlignment(loc, val, 2, type);
364     or32AArch64Imm(loc, getBits(val, 1, 11));
365     break;
366   case R_AARCH64_LDST32_ABS_LO12_NC:
367   case R_AARCH64_TLSLE_LDST32_TPREL_LO12_NC:
368     checkAlignment(loc, val, 4, type);
369     or32AArch64Imm(loc, getBits(val, 2, 11));
370     break;
371   case R_AARCH64_LDST64_ABS_LO12_NC:
372   case R_AARCH64_LD64_GOT_LO12_NC:
373   case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC:
374   case R_AARCH64_TLSLE_LDST64_TPREL_LO12_NC:
375   case R_AARCH64_TLSDESC_LD64_LO12:
376     checkAlignment(loc, val, 8, type);
377     or32AArch64Imm(loc, getBits(val, 3, 11));
378     break;
379   case R_AARCH64_LDST128_ABS_LO12_NC:
380   case R_AARCH64_TLSLE_LDST128_TPREL_LO12_NC:
381     checkAlignment(loc, val, 16, type);
382     or32AArch64Imm(loc, getBits(val, 4, 11));
383     break;
384   case R_AARCH64_MOVW_UABS_G0:
385     checkUInt(loc, val, 16, type);
386     LLVM_FALLTHROUGH;
387   case R_AARCH64_MOVW_UABS_G0_NC:
388     or32le(loc, (val & 0xFFFF) << 5);
389     break;
390   case R_AARCH64_MOVW_UABS_G1:
391     checkUInt(loc, val, 32, type);
392     LLVM_FALLTHROUGH;
393   case R_AARCH64_MOVW_UABS_G1_NC:
394     or32le(loc, (val & 0xFFFF0000) >> 11);
395     break;
396   case R_AARCH64_MOVW_UABS_G2:
397     checkUInt(loc, val, 48, type);
398     LLVM_FALLTHROUGH;
399   case R_AARCH64_MOVW_UABS_G2_NC:
400     or32le(loc, (val & 0xFFFF00000000) >> 27);
401     break;
402   case R_AARCH64_MOVW_UABS_G3:
403     or32le(loc, (val & 0xFFFF000000000000) >> 43);
404     break;
405   case R_AARCH64_MOVW_PREL_G0:
406   case R_AARCH64_MOVW_SABS_G0:
407   case R_AARCH64_TLSLE_MOVW_TPREL_G0:
408     checkInt(loc, val, 17, type);
409     LLVM_FALLTHROUGH;
410   case R_AARCH64_MOVW_PREL_G0_NC:
411   case R_AARCH64_TLSLE_MOVW_TPREL_G0_NC:
412     writeSMovWImm(loc, val);
413     break;
414   case R_AARCH64_MOVW_PREL_G1:
415   case R_AARCH64_MOVW_SABS_G1:
416   case R_AARCH64_TLSLE_MOVW_TPREL_G1:
417     checkInt(loc, val, 33, type);
418     LLVM_FALLTHROUGH;
419   case R_AARCH64_MOVW_PREL_G1_NC:
420   case R_AARCH64_TLSLE_MOVW_TPREL_G1_NC:
421     writeSMovWImm(loc, val >> 16);
422     break;
423   case R_AARCH64_MOVW_PREL_G2:
424   case R_AARCH64_MOVW_SABS_G2:
425   case R_AARCH64_TLSLE_MOVW_TPREL_G2:
426     checkInt(loc, val, 49, type);
427     LLVM_FALLTHROUGH;
428   case R_AARCH64_MOVW_PREL_G2_NC:
429     writeSMovWImm(loc, val >> 32);
430     break;
431   case R_AARCH64_MOVW_PREL_G3:
432     writeSMovWImm(loc, val >> 48);
433     break;
434   case R_AARCH64_TSTBR14:
435     checkInt(loc, val, 16, type);
436     or32le(loc, (val & 0xFFFC) << 3);
437     break;
438   case R_AARCH64_TLSLE_ADD_TPREL_HI12:
439     checkUInt(loc, val, 24, type);
440     or32AArch64Imm(loc, val >> 12);
441     break;
442   case R_AARCH64_TLSLE_ADD_TPREL_LO12_NC:
443   case R_AARCH64_TLSDESC_ADD_LO12:
444     or32AArch64Imm(loc, val);
445     break;
446   default:
447     llvm_unreachable("unknown relocation");
448   }
449 }
450 
451 void AArch64::relaxTlsGdToLe(uint8_t *loc, RelType type, uint64_t val) const {
452   // TLSDESC Global-Dynamic relocation are in the form:
453   //   adrp    x0, :tlsdesc:v             [R_AARCH64_TLSDESC_ADR_PAGE21]
454   //   ldr     x1, [x0, #:tlsdesc_lo12:v  [R_AARCH64_TLSDESC_LD64_LO12]
455   //   add     x0, x0, :tlsdesc_los:v     [R_AARCH64_TLSDESC_ADD_LO12]
456   //   .tlsdesccall                       [R_AARCH64_TLSDESC_CALL]
457   //   blr     x1
458   // And it can optimized to:
459   //   movz    x0, #0x0, lsl #16
460   //   movk    x0, #0x10
461   //   nop
462   //   nop
463   checkUInt(loc, val, 32, type);
464 
465   switch (type) {
466   case R_AARCH64_TLSDESC_ADD_LO12:
467   case R_AARCH64_TLSDESC_CALL:
468     write32le(loc, 0xd503201f); // nop
469     return;
470   case R_AARCH64_TLSDESC_ADR_PAGE21:
471     write32le(loc, 0xd2a00000 | (((val >> 16) & 0xffff) << 5)); // movz
472     return;
473   case R_AARCH64_TLSDESC_LD64_LO12:
474     write32le(loc, 0xf2800000 | ((val & 0xffff) << 5)); // movk
475     return;
476   default:
477     llvm_unreachable("unsupported relocation for TLS GD to LE relaxation");
478   }
479 }
480 
481 void AArch64::relaxTlsGdToIe(uint8_t *loc, RelType type, uint64_t val) const {
482   // TLSDESC Global-Dynamic relocation are in the form:
483   //   adrp    x0, :tlsdesc:v             [R_AARCH64_TLSDESC_ADR_PAGE21]
484   //   ldr     x1, [x0, #:tlsdesc_lo12:v  [R_AARCH64_TLSDESC_LD64_LO12]
485   //   add     x0, x0, :tlsdesc_los:v     [R_AARCH64_TLSDESC_ADD_LO12]
486   //   .tlsdesccall                       [R_AARCH64_TLSDESC_CALL]
487   //   blr     x1
488   // And it can optimized to:
489   //   adrp    x0, :gottprel:v
490   //   ldr     x0, [x0, :gottprel_lo12:v]
491   //   nop
492   //   nop
493 
494   switch (type) {
495   case R_AARCH64_TLSDESC_ADD_LO12:
496   case R_AARCH64_TLSDESC_CALL:
497     write32le(loc, 0xd503201f); // nop
498     break;
499   case R_AARCH64_TLSDESC_ADR_PAGE21:
500     write32le(loc, 0x90000000); // adrp
501     relocateOne(loc, R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21, val);
502     break;
503   case R_AARCH64_TLSDESC_LD64_LO12:
504     write32le(loc, 0xf9400000); // ldr
505     relocateOne(loc, R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC, val);
506     break;
507   default:
508     llvm_unreachable("unsupported relocation for TLS GD to LE relaxation");
509   }
510 }
511 
512 void AArch64::relaxTlsIeToLe(uint8_t *loc, RelType type, uint64_t val) const {
513   checkUInt(loc, val, 32, type);
514 
515   if (type == R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21) {
516     // Generate MOVZ.
517     uint32_t regNo = read32le(loc) & 0x1f;
518     write32le(loc, (0xd2a00000 | regNo) | (((val >> 16) & 0xffff) << 5));
519     return;
520   }
521   if (type == R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC) {
522     // Generate MOVK.
523     uint32_t regNo = read32le(loc) & 0x1f;
524     write32le(loc, (0xf2800000 | regNo) | ((val & 0xffff) << 5));
525     return;
526   }
527   llvm_unreachable("invalid relocation for TLS IE to LE relaxation");
528 }
529 
530 // AArch64 may use security features in variant PLT sequences. These are:
531 // Pointer Authentication (PAC), introduced in armv8.3-a and Branch Target
532 // Indicator (BTI) introduced in armv8.5-a. The additional instructions used
533 // in the variant Plt sequences are encoded in the Hint space so they can be
534 // deployed on older architectures, which treat the instructions as a nop.
535 // PAC and BTI can be combined leading to the following combinations:
536 // writePltHeader
537 // writePltHeaderBti (no PAC Header needed)
538 // writePlt
539 // writePltBti (BTI only)
540 // writePltPac (PAC only)
541 // writePltBtiPac (BTI and PAC)
542 //
543 // When PAC is enabled the dynamic loader encrypts the address that it places
544 // in the .got.plt using the pacia1716 instruction which encrypts the value in
545 // x17 using the modifier in x16. The static linker places autia1716 before the
546 // indirect branch to x17 to authenticate the address in x17 with the modifier
547 // in x16. This makes it more difficult for an attacker to modify the value in
548 // the .got.plt.
549 //
550 // When BTI is enabled all indirect branches must land on a bti instruction.
551 // The static linker must place a bti instruction at the start of any PLT entry
552 // that may be the target of an indirect branch. As the PLT entries call the
553 // lazy resolver indirectly this must have a bti instruction at start. In
554 // general a bti instruction is not needed for a PLT entry as indirect calls
555 // are resolved to the function address and not the PLT entry for the function.
556 // There are a small number of cases where the PLT address can escape, such as
557 // taking the address of a function or ifunc via a non got-generating
558 // relocation, and a shared library refers to that symbol.
559 //
560 // We use the bti c variant of the instruction which permits indirect branches
561 // (br) via x16/x17 and indirect function calls (blr) via any register. The ABI
562 // guarantees that all indirect branches from code requiring BTI protection
563 // will go via x16/x17
564 
565 namespace {
566 class AArch64BtiPac final : public AArch64 {
567 public:
568   AArch64BtiPac();
569   void writePltHeader(uint8_t *buf) const override;
570   void writePlt(uint8_t *buf, uint64_t gotPltEntryAddr, uint64_t pltEntryAddr,
571                 int32_t index, unsigned relOff) const override;
572 
573 private:
574   bool btiHeader; // bti instruction needed in PLT Header
575   bool btiEntry;  // bti instruction needed in PLT Entry
576   bool pacEntry;  // autia1716 instruction needed in PLT Entry
577 };
578 } // namespace
579 
580 AArch64BtiPac::AArch64BtiPac() {
581   btiHeader = (config->andFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_BTI);
582   // A BTI (Branch Target Indicator) Plt Entry is only required if the
583   // address of the PLT entry can be taken by the program, which permits an
584   // indirect jump to the PLT entry. This can happen when the address
585   // of the PLT entry for a function is canonicalised due to the address of
586   // the function in an executable being taken by a shared library.
587   // FIXME: There is a potential optimization to omit the BTI if we detect
588   // that the address of the PLT entry isn't taken.
589   btiEntry = btiHeader && !config->shared;
590   pacEntry = (config->andFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_PAC);
591 
592   if (btiEntry || pacEntry)
593     pltEntrySize = 24;
594 }
595 
596 void AArch64BtiPac::writePltHeader(uint8_t *buf) const {
597   const uint8_t btiData[] = { 0x5f, 0x24, 0x03, 0xd5 }; // bti c
598   const uint8_t pltData[] = {
599       0xf0, 0x7b, 0xbf, 0xa9, // stp    x16, x30, [sp,#-16]!
600       0x10, 0x00, 0x00, 0x90, // adrp   x16, Page(&(.plt.got[2]))
601       0x11, 0x02, 0x40, 0xf9, // ldr    x17, [x16, Offset(&(.plt.got[2]))]
602       0x10, 0x02, 0x00, 0x91, // add    x16, x16, Offset(&(.plt.got[2]))
603       0x20, 0x02, 0x1f, 0xd6, // br     x17
604       0x1f, 0x20, 0x03, 0xd5, // nop
605       0x1f, 0x20, 0x03, 0xd5  // nop
606   };
607   const uint8_t nopData[] = { 0x1f, 0x20, 0x03, 0xd5 }; // nop
608 
609   uint64_t got = in.gotPlt->getVA();
610   uint64_t plt = in.plt->getVA();
611 
612   if (btiHeader) {
613     // PltHeader is called indirectly by plt[N]. Prefix pltData with a BTI C
614     // instruction.
615     memcpy(buf, btiData, sizeof(btiData));
616     buf += sizeof(btiData);
617     plt += sizeof(btiData);
618   }
619   memcpy(buf, pltData, sizeof(pltData));
620 
621   relocateOne(buf + 4, R_AARCH64_ADR_PREL_PG_HI21,
622               getAArch64Page(got + 16) - getAArch64Page(plt + 8));
623   relocateOne(buf + 8, R_AARCH64_LDST64_ABS_LO12_NC, got + 16);
624   relocateOne(buf + 12, R_AARCH64_ADD_ABS_LO12_NC, got + 16);
625   if (!btiHeader)
626     // We didn't add the BTI c instruction so round out size with NOP.
627     memcpy(buf + sizeof(pltData), nopData, sizeof(nopData));
628 }
629 
630 void AArch64BtiPac::writePlt(uint8_t *buf, uint64_t gotPltEntryAddr,
631                              uint64_t pltEntryAddr, int32_t index,
632                              unsigned relOff) const {
633   // The PLT entry is of the form:
634   // [btiData] addrInst (pacBr | stdBr) [nopData]
635   const uint8_t btiData[] = { 0x5f, 0x24, 0x03, 0xd5 }; // bti c
636   const uint8_t addrInst[] = {
637       0x10, 0x00, 0x00, 0x90,  // adrp x16, Page(&(.plt.got[n]))
638       0x11, 0x02, 0x40, 0xf9,  // ldr  x17, [x16, Offset(&(.plt.got[n]))]
639       0x10, 0x02, 0x00, 0x91   // add  x16, x16, Offset(&(.plt.got[n]))
640   };
641   const uint8_t pacBr[] = {
642       0x9f, 0x21, 0x03, 0xd5,  // autia1716
643       0x20, 0x02, 0x1f, 0xd6   // br   x17
644   };
645   const uint8_t stdBr[] = {
646       0x20, 0x02, 0x1f, 0xd6,  // br   x17
647       0x1f, 0x20, 0x03, 0xd5   // nop
648   };
649   const uint8_t nopData[] = { 0x1f, 0x20, 0x03, 0xd5 }; // nop
650 
651   if (btiEntry) {
652     memcpy(buf, btiData, sizeof(btiData));
653     buf += sizeof(btiData);
654     pltEntryAddr += sizeof(btiData);
655   }
656 
657   memcpy(buf, addrInst, sizeof(addrInst));
658   relocateOne(buf, R_AARCH64_ADR_PREL_PG_HI21,
659               getAArch64Page(gotPltEntryAddr) -
660                   getAArch64Page(pltEntryAddr));
661   relocateOne(buf + 4, R_AARCH64_LDST64_ABS_LO12_NC, gotPltEntryAddr);
662   relocateOne(buf + 8, R_AARCH64_ADD_ABS_LO12_NC, gotPltEntryAddr);
663 
664   if (pacEntry)
665     memcpy(buf + sizeof(addrInst), pacBr, sizeof(pacBr));
666   else
667     memcpy(buf + sizeof(addrInst), stdBr, sizeof(stdBr));
668   if (!btiEntry)
669     // We didn't add the BTI c instruction so round out size with NOP.
670     memcpy(buf + sizeof(addrInst) + sizeof(stdBr), nopData, sizeof(nopData));
671 }
672 
673 static TargetInfo *getTargetInfo() {
674   if (config->andFeatures & (GNU_PROPERTY_AARCH64_FEATURE_1_BTI |
675                              GNU_PROPERTY_AARCH64_FEATURE_1_PAC)) {
676     static AArch64BtiPac t;
677     return &t;
678   }
679   static AArch64 t;
680   return &t;
681 }
682 
683 TargetInfo *getAArch64TargetInfo() { return getTargetInfo(); }
684 
685 } // namespace elf
686 } // namespace lld
687