1 //===- AArch64.cpp --------------------------------------------------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 9 #include "Symbols.h" 10 #include "SyntheticSections.h" 11 #include "Target.h" 12 #include "Thunks.h" 13 #include "lld/Common/ErrorHandler.h" 14 #include "llvm/Object/ELF.h" 15 #include "llvm/Support/Endian.h" 16 17 using namespace llvm; 18 using namespace llvm::support::endian; 19 using namespace llvm::ELF; 20 21 namespace lld { 22 namespace elf { 23 24 // Page(Expr) is the page address of the expression Expr, defined 25 // as (Expr & ~0xFFF). (This applies even if the machine page size 26 // supported by the platform has a different value.) 27 uint64_t getAArch64Page(uint64_t expr) { 28 return expr & ~static_cast<uint64_t>(0xFFF); 29 } 30 31 namespace { 32 class AArch64 : public TargetInfo { 33 public: 34 AArch64(); 35 RelExpr getRelExpr(RelType type, const Symbol &s, 36 const uint8_t *loc) const override; 37 RelType getDynRel(RelType type) const override; 38 void writeGotPlt(uint8_t *buf, const Symbol &s) const override; 39 void writePltHeader(uint8_t *buf) const override; 40 void writePlt(uint8_t *buf, const Symbol &sym, 41 uint64_t pltEntryAddr) const override; 42 bool needsThunk(RelExpr expr, RelType type, const InputFile *file, 43 uint64_t branchAddr, const Symbol &s, 44 int64_t a) const override; 45 uint32_t getThunkSectionSpacing() const override; 46 bool inBranchRange(RelType type, uint64_t src, uint64_t dst) const override; 47 bool usesOnlyLowPageBits(RelType type) const override; 48 void relocate(uint8_t *loc, const Relocation &rel, 49 uint64_t val) const override; 50 RelExpr adjustRelaxExpr(RelType type, const uint8_t *data, 51 RelExpr expr) const override; 52 void relaxTlsGdToLe(uint8_t *loc, const Relocation &rel, 53 uint64_t val) const override; 54 void relaxTlsGdToIe(uint8_t *loc, const Relocation &rel, 55 uint64_t val) const override; 56 void relaxTlsIeToLe(uint8_t *loc, const Relocation &rel, 57 uint64_t val) const override; 58 }; 59 } // namespace 60 61 AArch64::AArch64() { 62 copyRel = R_AARCH64_COPY; 63 relativeRel = R_AARCH64_RELATIVE; 64 iRelativeRel = R_AARCH64_IRELATIVE; 65 gotRel = R_AARCH64_GLOB_DAT; 66 noneRel = R_AARCH64_NONE; 67 pltRel = R_AARCH64_JUMP_SLOT; 68 symbolicRel = R_AARCH64_ABS64; 69 tlsDescRel = R_AARCH64_TLSDESC; 70 tlsGotRel = R_AARCH64_TLS_TPREL64; 71 pltHeaderSize = 32; 72 pltEntrySize = 16; 73 ipltEntrySize = 16; 74 defaultMaxPageSize = 65536; 75 76 // Align to the 2 MiB page size (known as a superpage or huge page). 77 // FreeBSD automatically promotes 2 MiB-aligned allocations. 78 defaultImageBase = 0x200000; 79 80 needsThunks = true; 81 } 82 83 RelExpr AArch64::getRelExpr(RelType type, const Symbol &s, 84 const uint8_t *loc) const { 85 switch (type) { 86 case R_AARCH64_ABS16: 87 case R_AARCH64_ABS32: 88 case R_AARCH64_ABS64: 89 case R_AARCH64_ADD_ABS_LO12_NC: 90 case R_AARCH64_LDST128_ABS_LO12_NC: 91 case R_AARCH64_LDST16_ABS_LO12_NC: 92 case R_AARCH64_LDST32_ABS_LO12_NC: 93 case R_AARCH64_LDST64_ABS_LO12_NC: 94 case R_AARCH64_LDST8_ABS_LO12_NC: 95 case R_AARCH64_MOVW_SABS_G0: 96 case R_AARCH64_MOVW_SABS_G1: 97 case R_AARCH64_MOVW_SABS_G2: 98 case R_AARCH64_MOVW_UABS_G0: 99 case R_AARCH64_MOVW_UABS_G0_NC: 100 case R_AARCH64_MOVW_UABS_G1: 101 case R_AARCH64_MOVW_UABS_G1_NC: 102 case R_AARCH64_MOVW_UABS_G2: 103 case R_AARCH64_MOVW_UABS_G2_NC: 104 case R_AARCH64_MOVW_UABS_G3: 105 return R_ABS; 106 case R_AARCH64_TLSDESC_ADR_PAGE21: 107 return R_AARCH64_TLSDESC_PAGE; 108 case R_AARCH64_TLSDESC_LD64_LO12: 109 case R_AARCH64_TLSDESC_ADD_LO12: 110 return R_TLSDESC; 111 case R_AARCH64_TLSDESC_CALL: 112 return R_TLSDESC_CALL; 113 case R_AARCH64_TLSLE_ADD_TPREL_HI12: 114 case R_AARCH64_TLSLE_ADD_TPREL_LO12_NC: 115 case R_AARCH64_TLSLE_LDST8_TPREL_LO12_NC: 116 case R_AARCH64_TLSLE_LDST16_TPREL_LO12_NC: 117 case R_AARCH64_TLSLE_LDST32_TPREL_LO12_NC: 118 case R_AARCH64_TLSLE_LDST64_TPREL_LO12_NC: 119 case R_AARCH64_TLSLE_LDST128_TPREL_LO12_NC: 120 case R_AARCH64_TLSLE_MOVW_TPREL_G0: 121 case R_AARCH64_TLSLE_MOVW_TPREL_G0_NC: 122 case R_AARCH64_TLSLE_MOVW_TPREL_G1: 123 case R_AARCH64_TLSLE_MOVW_TPREL_G1_NC: 124 case R_AARCH64_TLSLE_MOVW_TPREL_G2: 125 return R_TLS; 126 case R_AARCH64_CALL26: 127 case R_AARCH64_CONDBR19: 128 case R_AARCH64_JUMP26: 129 case R_AARCH64_TSTBR14: 130 return R_PLT_PC; 131 case R_AARCH64_PREL16: 132 case R_AARCH64_PREL32: 133 case R_AARCH64_PREL64: 134 case R_AARCH64_ADR_PREL_LO21: 135 case R_AARCH64_LD_PREL_LO19: 136 case R_AARCH64_MOVW_PREL_G0: 137 case R_AARCH64_MOVW_PREL_G0_NC: 138 case R_AARCH64_MOVW_PREL_G1: 139 case R_AARCH64_MOVW_PREL_G1_NC: 140 case R_AARCH64_MOVW_PREL_G2: 141 case R_AARCH64_MOVW_PREL_G2_NC: 142 case R_AARCH64_MOVW_PREL_G3: 143 return R_PC; 144 case R_AARCH64_ADR_PREL_PG_HI21: 145 case R_AARCH64_ADR_PREL_PG_HI21_NC: 146 return R_AARCH64_PAGE_PC; 147 case R_AARCH64_LD64_GOT_LO12_NC: 148 case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC: 149 return R_GOT; 150 case R_AARCH64_ADR_GOT_PAGE: 151 case R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21: 152 return R_AARCH64_GOT_PAGE_PC; 153 case R_AARCH64_NONE: 154 return R_NONE; 155 default: 156 error(getErrorLocation(loc) + "unknown relocation (" + Twine(type) + 157 ") against symbol " + toString(s)); 158 return R_NONE; 159 } 160 } 161 162 RelExpr AArch64::adjustRelaxExpr(RelType type, const uint8_t *data, 163 RelExpr expr) const { 164 if (expr == R_RELAX_TLS_GD_TO_IE) { 165 if (type == R_AARCH64_TLSDESC_ADR_PAGE21) 166 return R_AARCH64_RELAX_TLS_GD_TO_IE_PAGE_PC; 167 return R_RELAX_TLS_GD_TO_IE_ABS; 168 } 169 return expr; 170 } 171 172 bool AArch64::usesOnlyLowPageBits(RelType type) const { 173 switch (type) { 174 default: 175 return false; 176 case R_AARCH64_ADD_ABS_LO12_NC: 177 case R_AARCH64_LD64_GOT_LO12_NC: 178 case R_AARCH64_LDST128_ABS_LO12_NC: 179 case R_AARCH64_LDST16_ABS_LO12_NC: 180 case R_AARCH64_LDST32_ABS_LO12_NC: 181 case R_AARCH64_LDST64_ABS_LO12_NC: 182 case R_AARCH64_LDST8_ABS_LO12_NC: 183 case R_AARCH64_TLSDESC_ADD_LO12: 184 case R_AARCH64_TLSDESC_LD64_LO12: 185 case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC: 186 return true; 187 } 188 } 189 190 RelType AArch64::getDynRel(RelType type) const { 191 if (type == R_AARCH64_ABS64) 192 return type; 193 return R_AARCH64_NONE; 194 } 195 196 void AArch64::writeGotPlt(uint8_t *buf, const Symbol &) const { 197 write64le(buf, in.plt->getVA()); 198 } 199 200 void AArch64::writePltHeader(uint8_t *buf) const { 201 const uint8_t pltData[] = { 202 0xf0, 0x7b, 0xbf, 0xa9, // stp x16, x30, [sp,#-16]! 203 0x10, 0x00, 0x00, 0x90, // adrp x16, Page(&(.plt.got[2])) 204 0x11, 0x02, 0x40, 0xf9, // ldr x17, [x16, Offset(&(.plt.got[2]))] 205 0x10, 0x02, 0x00, 0x91, // add x16, x16, Offset(&(.plt.got[2])) 206 0x20, 0x02, 0x1f, 0xd6, // br x17 207 0x1f, 0x20, 0x03, 0xd5, // nop 208 0x1f, 0x20, 0x03, 0xd5, // nop 209 0x1f, 0x20, 0x03, 0xd5 // nop 210 }; 211 memcpy(buf, pltData, sizeof(pltData)); 212 213 uint64_t got = in.gotPlt->getVA(); 214 uint64_t plt = in.plt->getVA(); 215 relocateNoSym(buf + 4, R_AARCH64_ADR_PREL_PG_HI21, 216 getAArch64Page(got + 16) - getAArch64Page(plt + 4)); 217 relocateNoSym(buf + 8, R_AARCH64_LDST64_ABS_LO12_NC, got + 16); 218 relocateNoSym(buf + 12, R_AARCH64_ADD_ABS_LO12_NC, got + 16); 219 } 220 221 void AArch64::writePlt(uint8_t *buf, const Symbol &sym, 222 uint64_t pltEntryAddr) const { 223 const uint8_t inst[] = { 224 0x10, 0x00, 0x00, 0x90, // adrp x16, Page(&(.plt.got[n])) 225 0x11, 0x02, 0x40, 0xf9, // ldr x17, [x16, Offset(&(.plt.got[n]))] 226 0x10, 0x02, 0x00, 0x91, // add x16, x16, Offset(&(.plt.got[n])) 227 0x20, 0x02, 0x1f, 0xd6 // br x17 228 }; 229 memcpy(buf, inst, sizeof(inst)); 230 231 uint64_t gotPltEntryAddr = sym.getGotPltVA(); 232 relocateNoSym(buf, R_AARCH64_ADR_PREL_PG_HI21, 233 getAArch64Page(gotPltEntryAddr) - getAArch64Page(pltEntryAddr)); 234 relocateNoSym(buf + 4, R_AARCH64_LDST64_ABS_LO12_NC, gotPltEntryAddr); 235 relocateNoSym(buf + 8, R_AARCH64_ADD_ABS_LO12_NC, gotPltEntryAddr); 236 } 237 238 bool AArch64::needsThunk(RelExpr expr, RelType type, const InputFile *file, 239 uint64_t branchAddr, const Symbol &s, 240 int64_t a) const { 241 // If s is an undefined weak symbol and does not have a PLT entry then it 242 // will be resolved as a branch to the next instruction. 243 if (s.isUndefWeak() && !s.isInPlt()) 244 return false; 245 // ELF for the ARM 64-bit architecture, section Call and Jump relocations 246 // only permits range extension thunks for R_AARCH64_CALL26 and 247 // R_AARCH64_JUMP26 relocation types. 248 if (type != R_AARCH64_CALL26 && type != R_AARCH64_JUMP26) 249 return false; 250 uint64_t dst = expr == R_PLT_PC ? s.getPltVA() : s.getVA(a); 251 return !inBranchRange(type, branchAddr, dst); 252 } 253 254 uint32_t AArch64::getThunkSectionSpacing() const { 255 // See comment in Arch/ARM.cpp for a more detailed explanation of 256 // getThunkSectionSpacing(). For AArch64 the only branches we are permitted to 257 // Thunk have a range of +/- 128 MiB 258 return (128 * 1024 * 1024) - 0x30000; 259 } 260 261 bool AArch64::inBranchRange(RelType type, uint64_t src, uint64_t dst) const { 262 if (type != R_AARCH64_CALL26 && type != R_AARCH64_JUMP26) 263 return true; 264 // The AArch64 call and unconditional branch instructions have a range of 265 // +/- 128 MiB. 266 uint64_t range = 128 * 1024 * 1024; 267 if (dst > src) { 268 // Immediate of branch is signed. 269 range -= 4; 270 return dst - src <= range; 271 } 272 return src - dst <= range; 273 } 274 275 static void write32AArch64Addr(uint8_t *l, uint64_t imm) { 276 uint32_t immLo = (imm & 0x3) << 29; 277 uint32_t immHi = (imm & 0x1FFFFC) << 3; 278 uint64_t mask = (0x3 << 29) | (0x1FFFFC << 3); 279 write32le(l, (read32le(l) & ~mask) | immLo | immHi); 280 } 281 282 // Return the bits [Start, End] from Val shifted Start bits. 283 // For instance, getBits(0xF0, 4, 8) returns 0xF. 284 static uint64_t getBits(uint64_t val, int start, int end) { 285 uint64_t mask = ((uint64_t)1 << (end + 1 - start)) - 1; 286 return (val >> start) & mask; 287 } 288 289 static void or32le(uint8_t *p, int32_t v) { write32le(p, read32le(p) | v); } 290 291 // Update the immediate field in a AARCH64 ldr, str, and add instruction. 292 static void or32AArch64Imm(uint8_t *l, uint64_t imm) { 293 or32le(l, (imm & 0xFFF) << 10); 294 } 295 296 // Update the immediate field in an AArch64 movk, movn or movz instruction 297 // for a signed relocation, and update the opcode of a movn or movz instruction 298 // to match the sign of the operand. 299 static void writeSMovWImm(uint8_t *loc, uint32_t imm) { 300 uint32_t inst = read32le(loc); 301 // Opcode field is bits 30, 29, with 10 = movz, 00 = movn and 11 = movk. 302 if (!(inst & (1 << 29))) { 303 // movn or movz. 304 if (imm & 0x10000) { 305 // Change opcode to movn, which takes an inverted operand. 306 imm ^= 0xFFFF; 307 inst &= ~(1 << 30); 308 } else { 309 // Change opcode to movz. 310 inst |= 1 << 30; 311 } 312 } 313 write32le(loc, inst | ((imm & 0xFFFF) << 5)); 314 } 315 316 void AArch64::relocate(uint8_t *loc, const Relocation &rel, 317 uint64_t val) const { 318 switch (rel.type) { 319 case R_AARCH64_ABS16: 320 case R_AARCH64_PREL16: 321 checkIntUInt(loc, val, 16, rel); 322 write16le(loc, val); 323 break; 324 case R_AARCH64_ABS32: 325 case R_AARCH64_PREL32: 326 checkIntUInt(loc, val, 32, rel); 327 write32le(loc, val); 328 break; 329 case R_AARCH64_ABS64: 330 case R_AARCH64_PREL64: 331 write64le(loc, val); 332 break; 333 case R_AARCH64_ADD_ABS_LO12_NC: 334 or32AArch64Imm(loc, val); 335 break; 336 case R_AARCH64_ADR_GOT_PAGE: 337 case R_AARCH64_ADR_PREL_PG_HI21: 338 case R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21: 339 case R_AARCH64_TLSDESC_ADR_PAGE21: 340 checkInt(loc, val, 33, rel); 341 LLVM_FALLTHROUGH; 342 case R_AARCH64_ADR_PREL_PG_HI21_NC: 343 write32AArch64Addr(loc, val >> 12); 344 break; 345 case R_AARCH64_ADR_PREL_LO21: 346 checkInt(loc, val, 21, rel); 347 write32AArch64Addr(loc, val); 348 break; 349 case R_AARCH64_JUMP26: 350 // Normally we would just write the bits of the immediate field, however 351 // when patching instructions for the cpu errata fix -fix-cortex-a53-843419 352 // we want to replace a non-branch instruction with a branch immediate 353 // instruction. By writing all the bits of the instruction including the 354 // opcode and the immediate (0 001 | 01 imm26) we can do this 355 // transformation by placing a R_AARCH64_JUMP26 relocation at the offset of 356 // the instruction we want to patch. 357 write32le(loc, 0x14000000); 358 LLVM_FALLTHROUGH; 359 case R_AARCH64_CALL26: 360 checkInt(loc, val, 28, rel); 361 or32le(loc, (val & 0x0FFFFFFC) >> 2); 362 break; 363 case R_AARCH64_CONDBR19: 364 case R_AARCH64_LD_PREL_LO19: 365 checkAlignment(loc, val, 4, rel); 366 checkInt(loc, val, 21, rel); 367 or32le(loc, (val & 0x1FFFFC) << 3); 368 break; 369 case R_AARCH64_LDST8_ABS_LO12_NC: 370 case R_AARCH64_TLSLE_LDST8_TPREL_LO12_NC: 371 or32AArch64Imm(loc, getBits(val, 0, 11)); 372 break; 373 case R_AARCH64_LDST16_ABS_LO12_NC: 374 case R_AARCH64_TLSLE_LDST16_TPREL_LO12_NC: 375 checkAlignment(loc, val, 2, rel); 376 or32AArch64Imm(loc, getBits(val, 1, 11)); 377 break; 378 case R_AARCH64_LDST32_ABS_LO12_NC: 379 case R_AARCH64_TLSLE_LDST32_TPREL_LO12_NC: 380 checkAlignment(loc, val, 4, rel); 381 or32AArch64Imm(loc, getBits(val, 2, 11)); 382 break; 383 case R_AARCH64_LDST64_ABS_LO12_NC: 384 case R_AARCH64_LD64_GOT_LO12_NC: 385 case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC: 386 case R_AARCH64_TLSLE_LDST64_TPREL_LO12_NC: 387 case R_AARCH64_TLSDESC_LD64_LO12: 388 checkAlignment(loc, val, 8, rel); 389 or32AArch64Imm(loc, getBits(val, 3, 11)); 390 break; 391 case R_AARCH64_LDST128_ABS_LO12_NC: 392 case R_AARCH64_TLSLE_LDST128_TPREL_LO12_NC: 393 checkAlignment(loc, val, 16, rel); 394 or32AArch64Imm(loc, getBits(val, 4, 11)); 395 break; 396 case R_AARCH64_MOVW_UABS_G0: 397 checkUInt(loc, val, 16, rel); 398 LLVM_FALLTHROUGH; 399 case R_AARCH64_MOVW_UABS_G0_NC: 400 or32le(loc, (val & 0xFFFF) << 5); 401 break; 402 case R_AARCH64_MOVW_UABS_G1: 403 checkUInt(loc, val, 32, rel); 404 LLVM_FALLTHROUGH; 405 case R_AARCH64_MOVW_UABS_G1_NC: 406 or32le(loc, (val & 0xFFFF0000) >> 11); 407 break; 408 case R_AARCH64_MOVW_UABS_G2: 409 checkUInt(loc, val, 48, rel); 410 LLVM_FALLTHROUGH; 411 case R_AARCH64_MOVW_UABS_G2_NC: 412 or32le(loc, (val & 0xFFFF00000000) >> 27); 413 break; 414 case R_AARCH64_MOVW_UABS_G3: 415 or32le(loc, (val & 0xFFFF000000000000) >> 43); 416 break; 417 case R_AARCH64_MOVW_PREL_G0: 418 case R_AARCH64_MOVW_SABS_G0: 419 case R_AARCH64_TLSLE_MOVW_TPREL_G0: 420 checkInt(loc, val, 17, rel); 421 LLVM_FALLTHROUGH; 422 case R_AARCH64_MOVW_PREL_G0_NC: 423 case R_AARCH64_TLSLE_MOVW_TPREL_G0_NC: 424 writeSMovWImm(loc, val); 425 break; 426 case R_AARCH64_MOVW_PREL_G1: 427 case R_AARCH64_MOVW_SABS_G1: 428 case R_AARCH64_TLSLE_MOVW_TPREL_G1: 429 checkInt(loc, val, 33, rel); 430 LLVM_FALLTHROUGH; 431 case R_AARCH64_MOVW_PREL_G1_NC: 432 case R_AARCH64_TLSLE_MOVW_TPREL_G1_NC: 433 writeSMovWImm(loc, val >> 16); 434 break; 435 case R_AARCH64_MOVW_PREL_G2: 436 case R_AARCH64_MOVW_SABS_G2: 437 case R_AARCH64_TLSLE_MOVW_TPREL_G2: 438 checkInt(loc, val, 49, rel); 439 LLVM_FALLTHROUGH; 440 case R_AARCH64_MOVW_PREL_G2_NC: 441 writeSMovWImm(loc, val >> 32); 442 break; 443 case R_AARCH64_MOVW_PREL_G3: 444 writeSMovWImm(loc, val >> 48); 445 break; 446 case R_AARCH64_TSTBR14: 447 checkInt(loc, val, 16, rel); 448 or32le(loc, (val & 0xFFFC) << 3); 449 break; 450 case R_AARCH64_TLSLE_ADD_TPREL_HI12: 451 checkUInt(loc, val, 24, rel); 452 or32AArch64Imm(loc, val >> 12); 453 break; 454 case R_AARCH64_TLSLE_ADD_TPREL_LO12_NC: 455 case R_AARCH64_TLSDESC_ADD_LO12: 456 or32AArch64Imm(loc, val); 457 break; 458 default: 459 llvm_unreachable("unknown relocation"); 460 } 461 } 462 463 void AArch64::relaxTlsGdToLe(uint8_t *loc, const Relocation &rel, 464 uint64_t val) const { 465 // TLSDESC Global-Dynamic relocation are in the form: 466 // adrp x0, :tlsdesc:v [R_AARCH64_TLSDESC_ADR_PAGE21] 467 // ldr x1, [x0, #:tlsdesc_lo12:v [R_AARCH64_TLSDESC_LD64_LO12] 468 // add x0, x0, :tlsdesc_los:v [R_AARCH64_TLSDESC_ADD_LO12] 469 // .tlsdesccall [R_AARCH64_TLSDESC_CALL] 470 // blr x1 471 // And it can optimized to: 472 // movz x0, #0x0, lsl #16 473 // movk x0, #0x10 474 // nop 475 // nop 476 checkUInt(loc, val, 32, rel); 477 478 switch (rel.type) { 479 case R_AARCH64_TLSDESC_ADD_LO12: 480 case R_AARCH64_TLSDESC_CALL: 481 write32le(loc, 0xd503201f); // nop 482 return; 483 case R_AARCH64_TLSDESC_ADR_PAGE21: 484 write32le(loc, 0xd2a00000 | (((val >> 16) & 0xffff) << 5)); // movz 485 return; 486 case R_AARCH64_TLSDESC_LD64_LO12: 487 write32le(loc, 0xf2800000 | ((val & 0xffff) << 5)); // movk 488 return; 489 default: 490 llvm_unreachable("unsupported relocation for TLS GD to LE relaxation"); 491 } 492 } 493 494 void AArch64::relaxTlsGdToIe(uint8_t *loc, const Relocation &rel, 495 uint64_t val) const { 496 // TLSDESC Global-Dynamic relocation are in the form: 497 // adrp x0, :tlsdesc:v [R_AARCH64_TLSDESC_ADR_PAGE21] 498 // ldr x1, [x0, #:tlsdesc_lo12:v [R_AARCH64_TLSDESC_LD64_LO12] 499 // add x0, x0, :tlsdesc_los:v [R_AARCH64_TLSDESC_ADD_LO12] 500 // .tlsdesccall [R_AARCH64_TLSDESC_CALL] 501 // blr x1 502 // And it can optimized to: 503 // adrp x0, :gottprel:v 504 // ldr x0, [x0, :gottprel_lo12:v] 505 // nop 506 // nop 507 508 switch (rel.type) { 509 case R_AARCH64_TLSDESC_ADD_LO12: 510 case R_AARCH64_TLSDESC_CALL: 511 write32le(loc, 0xd503201f); // nop 512 break; 513 case R_AARCH64_TLSDESC_ADR_PAGE21: 514 write32le(loc, 0x90000000); // adrp 515 relocateNoSym(loc, R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21, val); 516 break; 517 case R_AARCH64_TLSDESC_LD64_LO12: 518 write32le(loc, 0xf9400000); // ldr 519 relocateNoSym(loc, R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC, val); 520 break; 521 default: 522 llvm_unreachable("unsupported relocation for TLS GD to LE relaxation"); 523 } 524 } 525 526 void AArch64::relaxTlsIeToLe(uint8_t *loc, const Relocation &rel, 527 uint64_t val) const { 528 checkUInt(loc, val, 32, rel); 529 530 if (rel.type == R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21) { 531 // Generate MOVZ. 532 uint32_t regNo = read32le(loc) & 0x1f; 533 write32le(loc, (0xd2a00000 | regNo) | (((val >> 16) & 0xffff) << 5)); 534 return; 535 } 536 if (rel.type == R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC) { 537 // Generate MOVK. 538 uint32_t regNo = read32le(loc) & 0x1f; 539 write32le(loc, (0xf2800000 | regNo) | ((val & 0xffff) << 5)); 540 return; 541 } 542 llvm_unreachable("invalid relocation for TLS IE to LE relaxation"); 543 } 544 545 // AArch64 may use security features in variant PLT sequences. These are: 546 // Pointer Authentication (PAC), introduced in armv8.3-a and Branch Target 547 // Indicator (BTI) introduced in armv8.5-a. The additional instructions used 548 // in the variant Plt sequences are encoded in the Hint space so they can be 549 // deployed on older architectures, which treat the instructions as a nop. 550 // PAC and BTI can be combined leading to the following combinations: 551 // writePltHeader 552 // writePltHeaderBti (no PAC Header needed) 553 // writePlt 554 // writePltBti (BTI only) 555 // writePltPac (PAC only) 556 // writePltBtiPac (BTI and PAC) 557 // 558 // When PAC is enabled the dynamic loader encrypts the address that it places 559 // in the .got.plt using the pacia1716 instruction which encrypts the value in 560 // x17 using the modifier in x16. The static linker places autia1716 before the 561 // indirect branch to x17 to authenticate the address in x17 with the modifier 562 // in x16. This makes it more difficult for an attacker to modify the value in 563 // the .got.plt. 564 // 565 // When BTI is enabled all indirect branches must land on a bti instruction. 566 // The static linker must place a bti instruction at the start of any PLT entry 567 // that may be the target of an indirect branch. As the PLT entries call the 568 // lazy resolver indirectly this must have a bti instruction at start. In 569 // general a bti instruction is not needed for a PLT entry as indirect calls 570 // are resolved to the function address and not the PLT entry for the function. 571 // There are a small number of cases where the PLT address can escape, such as 572 // taking the address of a function or ifunc via a non got-generating 573 // relocation, and a shared library refers to that symbol. 574 // 575 // We use the bti c variant of the instruction which permits indirect branches 576 // (br) via x16/x17 and indirect function calls (blr) via any register. The ABI 577 // guarantees that all indirect branches from code requiring BTI protection 578 // will go via x16/x17 579 580 namespace { 581 class AArch64BtiPac final : public AArch64 { 582 public: 583 AArch64BtiPac(); 584 void writePltHeader(uint8_t *buf) const override; 585 void writePlt(uint8_t *buf, const Symbol &sym, 586 uint64_t pltEntryAddr) const override; 587 588 private: 589 bool btiHeader; // bti instruction needed in PLT Header 590 bool btiEntry; // bti instruction needed in PLT Entry 591 bool pacEntry; // autia1716 instruction needed in PLT Entry 592 }; 593 } // namespace 594 595 AArch64BtiPac::AArch64BtiPac() { 596 btiHeader = (config->andFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_BTI); 597 // A BTI (Branch Target Indicator) Plt Entry is only required if the 598 // address of the PLT entry can be taken by the program, which permits an 599 // indirect jump to the PLT entry. This can happen when the address 600 // of the PLT entry for a function is canonicalised due to the address of 601 // the function in an executable being taken by a shared library. 602 // FIXME: There is a potential optimization to omit the BTI if we detect 603 // that the address of the PLT entry isn't taken. 604 btiEntry = btiHeader && !config->shared; 605 pacEntry = (config->andFeatures & GNU_PROPERTY_AARCH64_FEATURE_1_PAC); 606 607 if (btiEntry || pacEntry) { 608 pltEntrySize = 24; 609 ipltEntrySize = 24; 610 } 611 } 612 613 void AArch64BtiPac::writePltHeader(uint8_t *buf) const { 614 const uint8_t btiData[] = { 0x5f, 0x24, 0x03, 0xd5 }; // bti c 615 const uint8_t pltData[] = { 616 0xf0, 0x7b, 0xbf, 0xa9, // stp x16, x30, [sp,#-16]! 617 0x10, 0x00, 0x00, 0x90, // adrp x16, Page(&(.plt.got[2])) 618 0x11, 0x02, 0x40, 0xf9, // ldr x17, [x16, Offset(&(.plt.got[2]))] 619 0x10, 0x02, 0x00, 0x91, // add x16, x16, Offset(&(.plt.got[2])) 620 0x20, 0x02, 0x1f, 0xd6, // br x17 621 0x1f, 0x20, 0x03, 0xd5, // nop 622 0x1f, 0x20, 0x03, 0xd5 // nop 623 }; 624 const uint8_t nopData[] = { 0x1f, 0x20, 0x03, 0xd5 }; // nop 625 626 uint64_t got = in.gotPlt->getVA(); 627 uint64_t plt = in.plt->getVA(); 628 629 if (btiHeader) { 630 // PltHeader is called indirectly by plt[N]. Prefix pltData with a BTI C 631 // instruction. 632 memcpy(buf, btiData, sizeof(btiData)); 633 buf += sizeof(btiData); 634 plt += sizeof(btiData); 635 } 636 memcpy(buf, pltData, sizeof(pltData)); 637 638 relocateNoSym(buf + 4, R_AARCH64_ADR_PREL_PG_HI21, 639 getAArch64Page(got + 16) - getAArch64Page(plt + 8)); 640 relocateNoSym(buf + 8, R_AARCH64_LDST64_ABS_LO12_NC, got + 16); 641 relocateNoSym(buf + 12, R_AARCH64_ADD_ABS_LO12_NC, got + 16); 642 if (!btiHeader) 643 // We didn't add the BTI c instruction so round out size with NOP. 644 memcpy(buf + sizeof(pltData), nopData, sizeof(nopData)); 645 } 646 647 void AArch64BtiPac::writePlt(uint8_t *buf, const Symbol &sym, 648 uint64_t pltEntryAddr) const { 649 // The PLT entry is of the form: 650 // [btiData] addrInst (pacBr | stdBr) [nopData] 651 const uint8_t btiData[] = { 0x5f, 0x24, 0x03, 0xd5 }; // bti c 652 const uint8_t addrInst[] = { 653 0x10, 0x00, 0x00, 0x90, // adrp x16, Page(&(.plt.got[n])) 654 0x11, 0x02, 0x40, 0xf9, // ldr x17, [x16, Offset(&(.plt.got[n]))] 655 0x10, 0x02, 0x00, 0x91 // add x16, x16, Offset(&(.plt.got[n])) 656 }; 657 const uint8_t pacBr[] = { 658 0x9f, 0x21, 0x03, 0xd5, // autia1716 659 0x20, 0x02, 0x1f, 0xd6 // br x17 660 }; 661 const uint8_t stdBr[] = { 662 0x20, 0x02, 0x1f, 0xd6, // br x17 663 0x1f, 0x20, 0x03, 0xd5 // nop 664 }; 665 const uint8_t nopData[] = { 0x1f, 0x20, 0x03, 0xd5 }; // nop 666 667 if (btiEntry) { 668 memcpy(buf, btiData, sizeof(btiData)); 669 buf += sizeof(btiData); 670 pltEntryAddr += sizeof(btiData); 671 } 672 673 uint64_t gotPltEntryAddr = sym.getGotPltVA(); 674 memcpy(buf, addrInst, sizeof(addrInst)); 675 relocateNoSym(buf, R_AARCH64_ADR_PREL_PG_HI21, 676 getAArch64Page(gotPltEntryAddr) - getAArch64Page(pltEntryAddr)); 677 relocateNoSym(buf + 4, R_AARCH64_LDST64_ABS_LO12_NC, gotPltEntryAddr); 678 relocateNoSym(buf + 8, R_AARCH64_ADD_ABS_LO12_NC, gotPltEntryAddr); 679 680 if (pacEntry) 681 memcpy(buf + sizeof(addrInst), pacBr, sizeof(pacBr)); 682 else 683 memcpy(buf + sizeof(addrInst), stdBr, sizeof(stdBr)); 684 if (!btiEntry) 685 // We didn't add the BTI c instruction so round out size with NOP. 686 memcpy(buf + sizeof(addrInst) + sizeof(stdBr), nopData, sizeof(nopData)); 687 } 688 689 static TargetInfo *getTargetInfo() { 690 if (config->andFeatures & (GNU_PROPERTY_AARCH64_FEATURE_1_BTI | 691 GNU_PROPERTY_AARCH64_FEATURE_1_PAC)) { 692 static AArch64BtiPac t; 693 return &t; 694 } 695 static AArch64 t; 696 return &t; 697 } 698 699 TargetInfo *getAArch64TargetInfo() { return getTargetInfo(); } 700 701 } // namespace elf 702 } // namespace lld 703