xref: /freebsd/contrib/llvm-project/lld/ELF/Arch/AArch64.cpp (revision b3512b30dbec579da28028e29d8b33ec7242af68)
1 //===- AArch64.cpp --------------------------------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 
9 #include "Symbols.h"
10 #include "SyntheticSections.h"
11 #include "Target.h"
12 #include "Thunks.h"
13 #include "lld/Common/ErrorHandler.h"
14 #include "llvm/Object/ELF.h"
15 #include "llvm/Support/Endian.h"
16 
17 using namespace llvm;
18 using namespace llvm::support::endian;
19 using namespace llvm::ELF;
20 using namespace lld;
21 using namespace lld::elf;
22 
23 // Page(Expr) is the page address of the expression Expr, defined
24 // as (Expr & ~0xFFF). (This applies even if the machine page size
25 // supported by the platform has a different value.)
26 uint64_t elf::getAArch64Page(uint64_t expr) {
27   return expr & ~static_cast<uint64_t>(0xFFF);
28 }
29 
30 namespace {
31 class AArch64 : public TargetInfo {
32 public:
33   AArch64();
34   RelExpr getRelExpr(RelType type, const Symbol &s,
35                      const uint8_t *loc) const override;
36   RelType getDynRel(RelType type) const override;
37   void writeGotPlt(uint8_t *buf, const Symbol &s) const override;
38   void writePltHeader(uint8_t *buf) const override;
39   void writePlt(uint8_t *buf, const Symbol &sym,
40                 uint64_t pltEntryAddr) const override;
41   bool needsThunk(RelExpr expr, RelType type, const InputFile *file,
42                   uint64_t branchAddr, const Symbol &s,
43                   int64_t a) const override;
44   uint32_t getThunkSectionSpacing() const override;
45   bool inBranchRange(RelType type, uint64_t src, uint64_t dst) const override;
46   bool usesOnlyLowPageBits(RelType type) const override;
47   void relocate(uint8_t *loc, const Relocation &rel,
48                 uint64_t val) const override;
49   RelExpr adjustRelaxExpr(RelType type, const uint8_t *data,
50                           RelExpr expr) const override;
51   void relaxTlsGdToLe(uint8_t *loc, const Relocation &rel,
52                       uint64_t val) const override;
53   void relaxTlsGdToIe(uint8_t *loc, const Relocation &rel,
54                       uint64_t val) const override;
55   void relaxTlsIeToLe(uint8_t *loc, const Relocation &rel,
56                       uint64_t val) const override;
57 };
58 } // namespace
59 
60 AArch64::AArch64() {
61   copyRel = R_AARCH64_COPY;
62   relativeRel = R_AARCH64_RELATIVE;
63   iRelativeRel = R_AARCH64_IRELATIVE;
64   gotRel = R_AARCH64_GLOB_DAT;
65   noneRel = R_AARCH64_NONE;
66   pltRel = R_AARCH64_JUMP_SLOT;
67   symbolicRel = R_AARCH64_ABS64;
68   tlsDescRel = R_AARCH64_TLSDESC;
69   tlsGotRel = R_AARCH64_TLS_TPREL64;
70   pltHeaderSize = 32;
71   pltEntrySize = 16;
72   ipltEntrySize = 16;
73   defaultMaxPageSize = 65536;
74 
75   // Align to the 2 MiB page size (known as a superpage or huge page).
76   // FreeBSD automatically promotes 2 MiB-aligned allocations.
77   defaultImageBase = 0x200000;
78 
79   needsThunks = true;
80 }
81 
82 RelExpr AArch64::getRelExpr(RelType type, const Symbol &s,
83                             const uint8_t *loc) const {
84   switch (type) {
85   case R_AARCH64_ABS16:
86   case R_AARCH64_ABS32:
87   case R_AARCH64_ABS64:
88   case R_AARCH64_ADD_ABS_LO12_NC:
89   case R_AARCH64_LDST128_ABS_LO12_NC:
90   case R_AARCH64_LDST16_ABS_LO12_NC:
91   case R_AARCH64_LDST32_ABS_LO12_NC:
92   case R_AARCH64_LDST64_ABS_LO12_NC:
93   case R_AARCH64_LDST8_ABS_LO12_NC:
94   case R_AARCH64_MOVW_SABS_G0:
95   case R_AARCH64_MOVW_SABS_G1:
96   case R_AARCH64_MOVW_SABS_G2:
97   case R_AARCH64_MOVW_UABS_G0:
98   case R_AARCH64_MOVW_UABS_G0_NC:
99   case R_AARCH64_MOVW_UABS_G1:
100   case R_AARCH64_MOVW_UABS_G1_NC:
101   case R_AARCH64_MOVW_UABS_G2:
102   case R_AARCH64_MOVW_UABS_G2_NC:
103   case R_AARCH64_MOVW_UABS_G3:
104     return R_ABS;
105   case R_AARCH64_TLSDESC_ADR_PAGE21:
106     return R_AARCH64_TLSDESC_PAGE;
107   case R_AARCH64_TLSDESC_LD64_LO12:
108   case R_AARCH64_TLSDESC_ADD_LO12:
109     return R_TLSDESC;
110   case R_AARCH64_TLSDESC_CALL:
111     return R_TLSDESC_CALL;
112   case R_AARCH64_TLSLE_ADD_TPREL_HI12:
113   case R_AARCH64_TLSLE_ADD_TPREL_LO12_NC:
114   case R_AARCH64_TLSLE_LDST8_TPREL_LO12_NC:
115   case R_AARCH64_TLSLE_LDST16_TPREL_LO12_NC:
116   case R_AARCH64_TLSLE_LDST32_TPREL_LO12_NC:
117   case R_AARCH64_TLSLE_LDST64_TPREL_LO12_NC:
118   case R_AARCH64_TLSLE_LDST128_TPREL_LO12_NC:
119   case R_AARCH64_TLSLE_MOVW_TPREL_G0:
120   case R_AARCH64_TLSLE_MOVW_TPREL_G0_NC:
121   case R_AARCH64_TLSLE_MOVW_TPREL_G1:
122   case R_AARCH64_TLSLE_MOVW_TPREL_G1_NC:
123   case R_AARCH64_TLSLE_MOVW_TPREL_G2:
124     return R_TLS;
125   case R_AARCH64_CALL26:
126   case R_AARCH64_CONDBR19:
127   case R_AARCH64_JUMP26:
128   case R_AARCH64_TSTBR14:
129   case R_AARCH64_PLT32:
130     return R_PLT_PC;
131   case R_AARCH64_PREL16:
132   case R_AARCH64_PREL32:
133   case R_AARCH64_PREL64:
134   case R_AARCH64_ADR_PREL_LO21:
135   case R_AARCH64_LD_PREL_LO19:
136   case R_AARCH64_MOVW_PREL_G0:
137   case R_AARCH64_MOVW_PREL_G0_NC:
138   case R_AARCH64_MOVW_PREL_G1:
139   case R_AARCH64_MOVW_PREL_G1_NC:
140   case R_AARCH64_MOVW_PREL_G2:
141   case R_AARCH64_MOVW_PREL_G2_NC:
142   case R_AARCH64_MOVW_PREL_G3:
143     return R_PC;
144   case R_AARCH64_ADR_PREL_PG_HI21:
145   case R_AARCH64_ADR_PREL_PG_HI21_NC:
146     return R_AARCH64_PAGE_PC;
147   case R_AARCH64_LD64_GOT_LO12_NC:
148   case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC:
149     return R_GOT;
150   case R_AARCH64_ADR_GOT_PAGE:
151   case R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21:
152     return R_AARCH64_GOT_PAGE_PC;
153   case R_AARCH64_NONE:
154     return R_NONE;
155   default:
156     error(getErrorLocation(loc) + "unknown relocation (" + Twine(type) +
157           ") against symbol " + toString(s));
158     return R_NONE;
159   }
160 }
161 
162 RelExpr AArch64::adjustRelaxExpr(RelType type, const uint8_t *data,
163                                  RelExpr expr) const {
164   if (expr == R_RELAX_TLS_GD_TO_IE) {
165     if (type == R_AARCH64_TLSDESC_ADR_PAGE21)
166       return R_AARCH64_RELAX_TLS_GD_TO_IE_PAGE_PC;
167     return R_RELAX_TLS_GD_TO_IE_ABS;
168   }
169   return expr;
170 }
171 
172 bool AArch64::usesOnlyLowPageBits(RelType type) const {
173   switch (type) {
174   default:
175     return false;
176   case R_AARCH64_ADD_ABS_LO12_NC:
177   case R_AARCH64_LD64_GOT_LO12_NC:
178   case R_AARCH64_LDST128_ABS_LO12_NC:
179   case R_AARCH64_LDST16_ABS_LO12_NC:
180   case R_AARCH64_LDST32_ABS_LO12_NC:
181   case R_AARCH64_LDST64_ABS_LO12_NC:
182   case R_AARCH64_LDST8_ABS_LO12_NC:
183   case R_AARCH64_TLSDESC_ADD_LO12:
184   case R_AARCH64_TLSDESC_LD64_LO12:
185   case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC:
186     return true;
187   }
188 }
189 
190 RelType AArch64::getDynRel(RelType type) const {
191   if (type == R_AARCH64_ABS64)
192     return type;
193   return R_AARCH64_NONE;
194 }
195 
196 void AArch64::writeGotPlt(uint8_t *buf, const Symbol &) const {
197   write64le(buf, in.plt->getVA());
198 }
199 
200 void AArch64::writePltHeader(uint8_t *buf) const {
201   const uint8_t pltData[] = {
202       0xf0, 0x7b, 0xbf, 0xa9, // stp    x16, x30, [sp,#-16]!
203       0x10, 0x00, 0x00, 0x90, // adrp   x16, Page(&(.plt.got[2]))
204       0x11, 0x02, 0x40, 0xf9, // ldr    x17, [x16, Offset(&(.plt.got[2]))]
205       0x10, 0x02, 0x00, 0x91, // add    x16, x16, Offset(&(.plt.got[2]))
206       0x20, 0x02, 0x1f, 0xd6, // br     x17
207       0x1f, 0x20, 0x03, 0xd5, // nop
208       0x1f, 0x20, 0x03, 0xd5, // nop
209       0x1f, 0x20, 0x03, 0xd5  // nop
210   };
211   memcpy(buf, pltData, sizeof(pltData));
212 
213   uint64_t got = in.gotPlt->getVA();
214   uint64_t plt = in.plt->getVA();
215   relocateNoSym(buf + 4, R_AARCH64_ADR_PREL_PG_HI21,
216                 getAArch64Page(got + 16) - getAArch64Page(plt + 4));
217   relocateNoSym(buf + 8, R_AARCH64_LDST64_ABS_LO12_NC, got + 16);
218   relocateNoSym(buf + 12, R_AARCH64_ADD_ABS_LO12_NC, got + 16);
219 }
220 
221 void AArch64::writePlt(uint8_t *buf, const Symbol &sym,
222                        uint64_t pltEntryAddr) const {
223   const uint8_t inst[] = {
224       0x10, 0x00, 0x00, 0x90, // adrp x16, Page(&(.plt.got[n]))
225       0x11, 0x02, 0x40, 0xf9, // ldr  x17, [x16, Offset(&(.plt.got[n]))]
226       0x10, 0x02, 0x00, 0x91, // add  x16, x16, Offset(&(.plt.got[n]))
227       0x20, 0x02, 0x1f, 0xd6  // br   x17
228   };
229   memcpy(buf, inst, sizeof(inst));
230 
231   uint64_t gotPltEntryAddr = sym.getGotPltVA();
232   relocateNoSym(buf, R_AARCH64_ADR_PREL_PG_HI21,
233                 getAArch64Page(gotPltEntryAddr) - getAArch64Page(pltEntryAddr));
234   relocateNoSym(buf + 4, R_AARCH64_LDST64_ABS_LO12_NC, gotPltEntryAddr);
235   relocateNoSym(buf + 8, R_AARCH64_ADD_ABS_LO12_NC, gotPltEntryAddr);
236 }
237 
238 bool AArch64::needsThunk(RelExpr expr, RelType type, const InputFile *file,
239                          uint64_t branchAddr, const Symbol &s,
240                          int64_t a) const {
241   // If s is an undefined weak symbol and does not have a PLT entry then it
242   // will be resolved as a branch to the next instruction.
243   if (s.isUndefWeak() && !s.isInPlt())
244     return false;
245   // ELF for the ARM 64-bit architecture, section Call and Jump relocations
246   // only permits range extension thunks for R_AARCH64_CALL26 and
247   // R_AARCH64_JUMP26 relocation types.
248   if (type != R_AARCH64_CALL26 && type != R_AARCH64_JUMP26 &&
249       type != R_AARCH64_PLT32)
250     return false;
251   uint64_t dst = expr == R_PLT_PC ? s.getPltVA() : s.getVA(a);
252   return !inBranchRange(type, branchAddr, dst);
253 }
254 
255 uint32_t AArch64::getThunkSectionSpacing() const {
256   // See comment in Arch/ARM.cpp for a more detailed explanation of
257   // getThunkSectionSpacing(). For AArch64 the only branches we are permitted to
258   // Thunk have a range of +/- 128 MiB
259   return (128 * 1024 * 1024) - 0x30000;
260 }
261 
262 bool AArch64::inBranchRange(RelType type, uint64_t src, uint64_t dst) const {
263   if (type != R_AARCH64_CALL26 && type != R_AARCH64_JUMP26 &&
264       type != R_AARCH64_PLT32)
265     return true;
266   // The AArch64 call and unconditional branch instructions have a range of
267   // +/- 128 MiB. The PLT32 relocation supports a range up to +/- 2 GiB.
268   uint64_t range =
269       type == R_AARCH64_PLT32 ? (UINT64_C(1) << 31) : (128 * 1024 * 1024);
270   if (dst > src) {
271     // Immediate of branch is signed.
272     range -= 4;
273     return dst - src <= range;
274   }
275   return src - dst <= range;
276 }
277 
278 static void write32AArch64Addr(uint8_t *l, uint64_t imm) {
279   uint32_t immLo = (imm & 0x3) << 29;
280   uint32_t immHi = (imm & 0x1FFFFC) << 3;
281   uint64_t mask = (0x3 << 29) | (0x1FFFFC << 3);
282   write32le(l, (read32le(l) & ~mask) | immLo | immHi);
283 }
284 
285 // Return the bits [Start, End] from Val shifted Start bits.
286 // For instance, getBits(0xF0, 4, 8) returns 0xF.
287 static uint64_t getBits(uint64_t val, int start, int end) {
288   uint64_t mask = ((uint64_t)1 << (end + 1 - start)) - 1;
289   return (val >> start) & mask;
290 }
291 
292 static void or32le(uint8_t *p, int32_t v) { write32le(p, read32le(p) | v); }
293 
294 // Update the immediate field in a AARCH64 ldr, str, and add instruction.
295 static void or32AArch64Imm(uint8_t *l, uint64_t imm) {
296   or32le(l, (imm & 0xFFF) << 10);
297 }
298 
299 // Update the immediate field in an AArch64 movk, movn or movz instruction
300 // for a signed relocation, and update the opcode of a movn or movz instruction
301 // to match the sign of the operand.
302 static void writeSMovWImm(uint8_t *loc, uint32_t imm) {
303   uint32_t inst = read32le(loc);
304   // Opcode field is bits 30, 29, with 10 = movz, 00 = movn and 11 = movk.
305   if (!(inst & (1 << 29))) {
306     // movn or movz.
307     if (imm & 0x10000) {
308       // Change opcode to movn, which takes an inverted operand.
309       imm ^= 0xFFFF;
310       inst &= ~(1 << 30);
311     } else {
312       // Change opcode to movz.
313       inst |= 1 << 30;
314     }
315   }
316   write32le(loc, inst | ((imm & 0xFFFF) << 5));
317 }
318 
319 void AArch64::relocate(uint8_t *loc, const Relocation &rel,
320                        uint64_t val) const {
321   switch (rel.type) {
322   case R_AARCH64_ABS16:
323   case R_AARCH64_PREL16:
324     checkIntUInt(loc, val, 16, rel);
325     write16le(loc, val);
326     break;
327   case R_AARCH64_ABS32:
328   case R_AARCH64_PREL32:
329     checkIntUInt(loc, val, 32, rel);
330     write32le(loc, val);
331     break;
332   case R_AARCH64_PLT32:
333     checkInt(loc, val, 32, rel);
334     write32le(loc, val);
335     break;
336   case R_AARCH64_ABS64:
337   case R_AARCH64_PREL64:
338     write64le(loc, val);
339     break;
340   case R_AARCH64_ADD_ABS_LO12_NC:
341     or32AArch64Imm(loc, val);
342     break;
343   case R_AARCH64_ADR_GOT_PAGE:
344   case R_AARCH64_ADR_PREL_PG_HI21:
345   case R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21:
346   case R_AARCH64_TLSDESC_ADR_PAGE21:
347     checkInt(loc, val, 33, rel);
348     LLVM_FALLTHROUGH;
349   case R_AARCH64_ADR_PREL_PG_HI21_NC:
350     write32AArch64Addr(loc, val >> 12);
351     break;
352   case R_AARCH64_ADR_PREL_LO21:
353     checkInt(loc, val, 21, rel);
354     write32AArch64Addr(loc, val);
355     break;
356   case R_AARCH64_JUMP26:
357     // Normally we would just write the bits of the immediate field, however
358     // when patching instructions for the cpu errata fix -fix-cortex-a53-843419
359     // we want to replace a non-branch instruction with a branch immediate
360     // instruction. By writing all the bits of the instruction including the
361     // opcode and the immediate (0 001 | 01 imm26) we can do this
362     // transformation by placing a R_AARCH64_JUMP26 relocation at the offset of
363     // the instruction we want to patch.
364     write32le(loc, 0x14000000);
365     LLVM_FALLTHROUGH;
366   case R_AARCH64_CALL26:
367     checkInt(loc, val, 28, rel);
368     or32le(loc, (val & 0x0FFFFFFC) >> 2);
369     break;
370   case R_AARCH64_CONDBR19:
371   case R_AARCH64_LD_PREL_LO19:
372     checkAlignment(loc, val, 4, rel);
373     checkInt(loc, val, 21, rel);
374     or32le(loc, (val & 0x1FFFFC) << 3);
375     break;
376   case R_AARCH64_LDST8_ABS_LO12_NC:
377   case R_AARCH64_TLSLE_LDST8_TPREL_LO12_NC:
378     or32AArch64Imm(loc, getBits(val, 0, 11));
379     break;
380   case R_AARCH64_LDST16_ABS_LO12_NC:
381   case R_AARCH64_TLSLE_LDST16_TPREL_LO12_NC:
382     checkAlignment(loc, val, 2, rel);
383     or32AArch64Imm(loc, getBits(val, 1, 11));
384     break;
385   case R_AARCH64_LDST32_ABS_LO12_NC:
386   case R_AARCH64_TLSLE_LDST32_TPREL_LO12_NC:
387     checkAlignment(loc, val, 4, rel);
388     or32AArch64Imm(loc, getBits(val, 2, 11));
389     break;
390   case R_AARCH64_LDST64_ABS_LO12_NC:
391   case R_AARCH64_LD64_GOT_LO12_NC:
392   case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC:
393   case R_AARCH64_TLSLE_LDST64_TPREL_LO12_NC:
394   case R_AARCH64_TLSDESC_LD64_LO12:
395     checkAlignment(loc, val, 8, rel);
396     or32AArch64Imm(loc, getBits(val, 3, 11));
397     break;
398   case R_AARCH64_LDST128_ABS_LO12_NC:
399   case R_AARCH64_TLSLE_LDST128_TPREL_LO12_NC:
400     checkAlignment(loc, val, 16, rel);
401     or32AArch64Imm(loc, getBits(val, 4, 11));
402     break;
403   case R_AARCH64_MOVW_UABS_G0:
404     checkUInt(loc, val, 16, rel);
405     LLVM_FALLTHROUGH;
406   case R_AARCH64_MOVW_UABS_G0_NC:
407     or32le(loc, (val & 0xFFFF) << 5);
408     break;
409   case R_AARCH64_MOVW_UABS_G1:
410     checkUInt(loc, val, 32, rel);
411     LLVM_FALLTHROUGH;
412   case R_AARCH64_MOVW_UABS_G1_NC:
413     or32le(loc, (val & 0xFFFF0000) >> 11);
414     break;
415   case R_AARCH64_MOVW_UABS_G2:
416     checkUInt(loc, val, 48, rel);
417     LLVM_FALLTHROUGH;
418   case R_AARCH64_MOVW_UABS_G2_NC:
419     or32le(loc, (val & 0xFFFF00000000) >> 27);
420     break;
421   case R_AARCH64_MOVW_UABS_G3:
422     or32le(loc, (val & 0xFFFF000000000000) >> 43);
423     break;
424   case R_AARCH64_MOVW_PREL_G0:
425   case R_AARCH64_MOVW_SABS_G0:
426   case R_AARCH64_TLSLE_MOVW_TPREL_G0:
427     checkInt(loc, val, 17, rel);
428     LLVM_FALLTHROUGH;
429   case R_AARCH64_MOVW_PREL_G0_NC:
430   case R_AARCH64_TLSLE_MOVW_TPREL_G0_NC:
431     writeSMovWImm(loc, val);
432     break;
433   case R_AARCH64_MOVW_PREL_G1:
434   case R_AARCH64_MOVW_SABS_G1:
435   case R_AARCH64_TLSLE_MOVW_TPREL_G1:
436     checkInt(loc, val, 33, rel);
437     LLVM_FALLTHROUGH;
438   case R_AARCH64_MOVW_PREL_G1_NC:
439   case R_AARCH64_TLSLE_MOVW_TPREL_G1_NC:
440     writeSMovWImm(loc, val >> 16);
441     break;
442   case R_AARCH64_MOVW_PREL_G2:
443   case R_AARCH64_MOVW_SABS_G2:
444   case R_AARCH64_TLSLE_MOVW_TPREL_G2:
445     checkInt(loc, val, 49, rel);
446     LLVM_FALLTHROUGH;
447   case R_AARCH64_MOVW_PREL_G2_NC:
448     writeSMovWImm(loc, val >> 32);
449     break;
450   case R_AARCH64_MOVW_PREL_G3:
451     writeSMovWImm(loc, val >> 48);
452     break;
453   case R_AARCH64_TSTBR14:
454     checkInt(loc, val, 16, rel);
455     or32le(loc, (val & 0xFFFC) << 3);
456     break;
457   case R_AARCH64_TLSLE_ADD_TPREL_HI12:
458     checkUInt(loc, val, 24, rel);
459     or32AArch64Imm(loc, val >> 12);
460     break;
461   case R_AARCH64_TLSLE_ADD_TPREL_LO12_NC:
462   case R_AARCH64_TLSDESC_ADD_LO12:
463     or32AArch64Imm(loc, val);
464     break;
465   default:
466     llvm_unreachable("unknown relocation");
467   }
468 }
469 
470 void AArch64::relaxTlsGdToLe(uint8_t *loc, const Relocation &rel,
471                              uint64_t val) const {
472   // TLSDESC Global-Dynamic relocation are in the form:
473   //   adrp    x0, :tlsdesc:v             [R_AARCH64_TLSDESC_ADR_PAGE21]
474   //   ldr     x1, [x0, #:tlsdesc_lo12:v  [R_AARCH64_TLSDESC_LD64_LO12]
475   //   add     x0, x0, :tlsdesc_los:v     [R_AARCH64_TLSDESC_ADD_LO12]
476   //   .tlsdesccall                       [R_AARCH64_TLSDESC_CALL]
477   //   blr     x1
478   // And it can optimized to:
479   //   movz    x0, #0x0, lsl #16
480   //   movk    x0, #0x10
481   //   nop
482   //   nop
483   checkUInt(loc, val, 32, rel);
484 
485   switch (rel.type) {
486   case R_AARCH64_TLSDESC_ADD_LO12:
487   case R_AARCH64_TLSDESC_CALL:
488     write32le(loc, 0xd503201f); // nop
489     return;
490   case R_AARCH64_TLSDESC_ADR_PAGE21:
491     write32le(loc, 0xd2a00000 | (((val >> 16) & 0xffff) << 5)); // movz
492     return;
493   case R_AARCH64_TLSDESC_LD64_LO12:
494     write32le(loc, 0xf2800000 | ((val & 0xffff) << 5)); // movk
495     return;
496   default:
497     llvm_unreachable("unsupported relocation for TLS GD to LE relaxation");
498   }
499 }
500 
501 void AArch64::relaxTlsGdToIe(uint8_t *loc, const Relocation &rel,
502                              uint64_t val) const {
503   // TLSDESC Global-Dynamic relocation are in the form:
504   //   adrp    x0, :tlsdesc:v             [R_AARCH64_TLSDESC_ADR_PAGE21]
505   //   ldr     x1, [x0, #:tlsdesc_lo12:v  [R_AARCH64_TLSDESC_LD64_LO12]
506   //   add     x0, x0, :tlsdesc_los:v     [R_AARCH64_TLSDESC_ADD_LO12]
507   //   .tlsdesccall                       [R_AARCH64_TLSDESC_CALL]
508   //   blr     x1
509   // And it can optimized to:
510   //   adrp    x0, :gottprel:v
511   //   ldr     x0, [x0, :gottprel_lo12:v]
512   //   nop
513   //   nop
514 
515   switch (rel.type) {
516   case R_AARCH64_TLSDESC_ADD_LO12:
517   case R_AARCH64_TLSDESC_CALL:
518     write32le(loc, 0xd503201f); // nop
519     break;
520   case R_AARCH64_TLSDESC_ADR_PAGE21:
521     write32le(loc, 0x90000000); // adrp
522     relocateNoSym(loc, R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21, val);
523     break;
524   case R_AARCH64_TLSDESC_LD64_LO12:
525     write32le(loc, 0xf9400000); // ldr
526     relocateNoSym(loc, R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC, val);
527     break;
528   default:
529     llvm_unreachable("unsupported relocation for TLS GD to LE relaxation");
530   }
531 }
532 
533 void AArch64::relaxTlsIeToLe(uint8_t *loc, const Relocation &rel,
534                              uint64_t val) const {
535   checkUInt(loc, val, 32, rel);
536 
537   if (rel.type == R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21) {
538     // Generate MOVZ.
539     uint32_t regNo = read32le(loc) & 0x1f;
540     write32le(loc, (0xd2a00000 | regNo) | (((val >> 16) & 0xffff) << 5));
541     return;
542   }
543   if (rel.type == R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC) {
544     // Generate MOVK.
545     uint32_t regNo = read32le(loc) & 0x1f;
546     write32le(loc, (0xf2800000 | regNo) | ((val & 0xffff) << 5));
547     return;
548   }
549   llvm_unreachable("invalid relocation for TLS IE to LE relaxation");
550 }
551 
552 // AArch64 may use security features in variant PLT sequences. These are:
553 // Pointer Authentication (PAC), introduced in armv8.3-a and Branch Target
554 // Indicator (BTI) introduced in armv8.5-a. The additional instructions used
555 // in the variant Plt sequences are encoded in the Hint space so they can be
556 // deployed on older architectures, which treat the instructions as a nop.
557 // PAC and BTI can be combined leading to the following combinations:
558 // writePltHeader
559 // writePltHeaderBti (no PAC Header needed)
560 // writePlt
561 // writePltBti (BTI only)
562 // writePltPac (PAC only)
563 // writePltBtiPac (BTI and PAC)
564 //
565 // When PAC is enabled the dynamic loader encrypts the address that it places
566 // in the .got.plt using the pacia1716 instruction which encrypts the value in
567 // x17 using the modifier in x16. The static linker places autia1716 before the
568 // indirect branch to x17 to authenticate the address in x17 with the modifier
569 // in x16. This makes it more difficult for an attacker to modify the value in
570 // the .got.plt.
571 //
572 // When BTI is enabled all indirect branches must land on a bti instruction.
573 // The static linker must place a bti instruction at the start of any PLT entry
574 // that may be the target of an indirect branch. As the PLT entries call the
575 // lazy resolver indirectly this must have a bti instruction at start. In
576 // general a bti instruction is not needed for a PLT entry as indirect calls
577 // are resolved to the function address and not the PLT entry for the function.
578 // There are a small number of cases where the PLT address can escape, such as
579 // taking the address of a function or ifunc via a non got-generating
580 // relocation, and a shared library refers to that symbol.
581 //
582 // We use the bti c variant of the instruction which permits indirect branches
583 // (br) via x16/x17 and indirect function calls (blr) via any register. The ABI
584 // guarantees that all indirect branches from code requiring BTI protection
585 // will go via x16/x17
586 
587 namespace {
588 class AArch64BtiPac final : public AArch64 {
589 public:
590   AArch64BtiPac();
591   void writePltHeader(uint8_t *buf) const override;
592   void writePlt(uint8_t *buf, const Symbol &sym,
593                 uint64_t pltEntryAddr) const override;
594 
595 private:
596   bool btiHeader; // bti instruction needed in PLT Header
597   bool btiEntry;  // bti instruction needed in PLT Entry
598   bool pacEntry;  // autia1716 instruction needed in PLT Entry
599 };
600 } // namespace
601 
602 AArch64BtiPac::AArch64BtiPac() {
603   btiHeader = (config->andFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_BTI);
604   // A BTI (Branch Target Indicator) Plt Entry is only required if the
605   // address of the PLT entry can be taken by the program, which permits an
606   // indirect jump to the PLT entry. This can happen when the address
607   // of the PLT entry for a function is canonicalised due to the address of
608   // the function in an executable being taken by a shared library.
609   // FIXME: There is a potential optimization to omit the BTI if we detect
610   // that the address of the PLT entry isn't taken.
611   // The PAC PLT entries require dynamic loader support and this isn't known
612   // from properties in the objects, so we use the command line flag.
613   btiEntry = btiHeader && !config->shared;
614   pacEntry = config->zPacPlt;
615 
616   if (btiEntry || pacEntry) {
617     pltEntrySize = 24;
618     ipltEntrySize = 24;
619   }
620 }
621 
622 void AArch64BtiPac::writePltHeader(uint8_t *buf) const {
623   const uint8_t btiData[] = { 0x5f, 0x24, 0x03, 0xd5 }; // bti c
624   const uint8_t pltData[] = {
625       0xf0, 0x7b, 0xbf, 0xa9, // stp    x16, x30, [sp,#-16]!
626       0x10, 0x00, 0x00, 0x90, // adrp   x16, Page(&(.plt.got[2]))
627       0x11, 0x02, 0x40, 0xf9, // ldr    x17, [x16, Offset(&(.plt.got[2]))]
628       0x10, 0x02, 0x00, 0x91, // add    x16, x16, Offset(&(.plt.got[2]))
629       0x20, 0x02, 0x1f, 0xd6, // br     x17
630       0x1f, 0x20, 0x03, 0xd5, // nop
631       0x1f, 0x20, 0x03, 0xd5  // nop
632   };
633   const uint8_t nopData[] = { 0x1f, 0x20, 0x03, 0xd5 }; // nop
634 
635   uint64_t got = in.gotPlt->getVA();
636   uint64_t plt = in.plt->getVA();
637 
638   if (btiHeader) {
639     // PltHeader is called indirectly by plt[N]. Prefix pltData with a BTI C
640     // instruction.
641     memcpy(buf, btiData, sizeof(btiData));
642     buf += sizeof(btiData);
643     plt += sizeof(btiData);
644   }
645   memcpy(buf, pltData, sizeof(pltData));
646 
647   relocateNoSym(buf + 4, R_AARCH64_ADR_PREL_PG_HI21,
648                 getAArch64Page(got + 16) - getAArch64Page(plt + 8));
649   relocateNoSym(buf + 8, R_AARCH64_LDST64_ABS_LO12_NC, got + 16);
650   relocateNoSym(buf + 12, R_AARCH64_ADD_ABS_LO12_NC, got + 16);
651   if (!btiHeader)
652     // We didn't add the BTI c instruction so round out size with NOP.
653     memcpy(buf + sizeof(pltData), nopData, sizeof(nopData));
654 }
655 
656 void AArch64BtiPac::writePlt(uint8_t *buf, const Symbol &sym,
657                              uint64_t pltEntryAddr) const {
658   // The PLT entry is of the form:
659   // [btiData] addrInst (pacBr | stdBr) [nopData]
660   const uint8_t btiData[] = { 0x5f, 0x24, 0x03, 0xd5 }; // bti c
661   const uint8_t addrInst[] = {
662       0x10, 0x00, 0x00, 0x90,  // adrp x16, Page(&(.plt.got[n]))
663       0x11, 0x02, 0x40, 0xf9,  // ldr  x17, [x16, Offset(&(.plt.got[n]))]
664       0x10, 0x02, 0x00, 0x91   // add  x16, x16, Offset(&(.plt.got[n]))
665   };
666   const uint8_t pacBr[] = {
667       0x9f, 0x21, 0x03, 0xd5,  // autia1716
668       0x20, 0x02, 0x1f, 0xd6   // br   x17
669   };
670   const uint8_t stdBr[] = {
671       0x20, 0x02, 0x1f, 0xd6,  // br   x17
672       0x1f, 0x20, 0x03, 0xd5   // nop
673   };
674   const uint8_t nopData[] = { 0x1f, 0x20, 0x03, 0xd5 }; // nop
675 
676   if (btiEntry) {
677     memcpy(buf, btiData, sizeof(btiData));
678     buf += sizeof(btiData);
679     pltEntryAddr += sizeof(btiData);
680   }
681 
682   uint64_t gotPltEntryAddr = sym.getGotPltVA();
683   memcpy(buf, addrInst, sizeof(addrInst));
684   relocateNoSym(buf, R_AARCH64_ADR_PREL_PG_HI21,
685                 getAArch64Page(gotPltEntryAddr) - getAArch64Page(pltEntryAddr));
686   relocateNoSym(buf + 4, R_AARCH64_LDST64_ABS_LO12_NC, gotPltEntryAddr);
687   relocateNoSym(buf + 8, R_AARCH64_ADD_ABS_LO12_NC, gotPltEntryAddr);
688 
689   if (pacEntry)
690     memcpy(buf + sizeof(addrInst), pacBr, sizeof(pacBr));
691   else
692     memcpy(buf + sizeof(addrInst), stdBr, sizeof(stdBr));
693   if (!btiEntry)
694     // We didn't add the BTI c instruction so round out size with NOP.
695     memcpy(buf + sizeof(addrInst) + sizeof(stdBr), nopData, sizeof(nopData));
696 }
697 
698 static TargetInfo *getTargetInfo() {
699   if (config->andFeatures & (GNU_PROPERTY_AARCH64_FEATURE_1_BTI |
700                              GNU_PROPERTY_AARCH64_FEATURE_1_PAC)) {
701     static AArch64BtiPac t;
702     return &t;
703   }
704   static AArch64 t;
705   return &t;
706 }
707 
708 TargetInfo *elf::getAArch64TargetInfo() { return getTargetInfo(); }
709