1 //===- ARM.cpp ------------------------------------------------------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 9 #include "Symbols.h" 10 #include "SyntheticSections.h" 11 #include "Target.h" 12 #include "lld/Common/ErrorHandler.h" 13 #include "llvm/BinaryFormat/ELF.h" 14 #include "llvm/Support/Endian.h" 15 16 using namespace llvm; 17 using namespace llvm::support::endian; 18 using namespace llvm::ELF; 19 using namespace lld; 20 using namespace lld::elf; 21 22 namespace { 23 class ARM final : public TargetInfo { 24 public: 25 ARM(); 26 uint32_t calcEFlags() const override; 27 RelExpr getRelExpr(RelType type, const Symbol &s, 28 const uint8_t *loc) const override; 29 RelType getDynRel(RelType type) const override; 30 int64_t getImplicitAddend(const uint8_t *buf, RelType type) const override; 31 void writeGotPlt(uint8_t *buf, const Symbol &s) const override; 32 void writeIgotPlt(uint8_t *buf, const Symbol &s) const override; 33 void writePltHeader(uint8_t *buf) const override; 34 void writePlt(uint8_t *buf, const Symbol &sym, 35 uint64_t pltEntryAddr) const override; 36 void addPltSymbols(InputSection &isec, uint64_t off) const override; 37 void addPltHeaderSymbols(InputSection &isd) const override; 38 bool needsThunk(RelExpr expr, RelType type, const InputFile *file, 39 uint64_t branchAddr, const Symbol &s, 40 int64_t a) const override; 41 uint32_t getThunkSectionSpacing() const override; 42 bool inBranchRange(RelType type, uint64_t src, uint64_t dst) const override; 43 void relocate(uint8_t *loc, const Relocation &rel, 44 uint64_t val) const override; 45 }; 46 } // namespace 47 48 ARM::ARM() { 49 copyRel = R_ARM_COPY; 50 relativeRel = R_ARM_RELATIVE; 51 iRelativeRel = R_ARM_IRELATIVE; 52 gotRel = R_ARM_GLOB_DAT; 53 pltRel = R_ARM_JUMP_SLOT; 54 symbolicRel = R_ARM_ABS32; 55 tlsGotRel = R_ARM_TLS_TPOFF32; 56 tlsModuleIndexRel = R_ARM_TLS_DTPMOD32; 57 tlsOffsetRel = R_ARM_TLS_DTPOFF32; 58 pltHeaderSize = 32; 59 pltEntrySize = 16; 60 ipltEntrySize = 16; 61 trapInstr = {0xd4, 0xd4, 0xd4, 0xd4}; 62 needsThunks = true; 63 defaultMaxPageSize = 65536; 64 } 65 66 uint32_t ARM::calcEFlags() const { 67 // The ABIFloatType is used by loaders to detect the floating point calling 68 // convention. 69 uint32_t abiFloatType = 0; 70 if (config->armVFPArgs == ARMVFPArgKind::Base || 71 config->armVFPArgs == ARMVFPArgKind::Default) 72 abiFloatType = EF_ARM_ABI_FLOAT_SOFT; 73 else if (config->armVFPArgs == ARMVFPArgKind::VFP) 74 abiFloatType = EF_ARM_ABI_FLOAT_HARD; 75 76 // We don't currently use any features incompatible with EF_ARM_EABI_VER5, 77 // but we don't have any firm guarantees of conformance. Linux AArch64 78 // kernels (as of 2016) require an EABI version to be set. 79 return EF_ARM_EABI_VER5 | abiFloatType; 80 } 81 82 RelExpr ARM::getRelExpr(RelType type, const Symbol &s, 83 const uint8_t *loc) const { 84 switch (type) { 85 case R_ARM_ABS32: 86 case R_ARM_MOVW_ABS_NC: 87 case R_ARM_MOVT_ABS: 88 case R_ARM_THM_MOVW_ABS_NC: 89 case R_ARM_THM_MOVT_ABS: 90 return R_ABS; 91 case R_ARM_THM_JUMP8: 92 case R_ARM_THM_JUMP11: 93 return R_PC; 94 case R_ARM_CALL: 95 case R_ARM_JUMP24: 96 case R_ARM_PC24: 97 case R_ARM_PLT32: 98 case R_ARM_PREL31: 99 case R_ARM_THM_JUMP19: 100 case R_ARM_THM_JUMP24: 101 case R_ARM_THM_CALL: 102 return R_PLT_PC; 103 case R_ARM_GOTOFF32: 104 // (S + A) - GOT_ORG 105 return R_GOTREL; 106 case R_ARM_GOT_BREL: 107 // GOT(S) + A - GOT_ORG 108 return R_GOT_OFF; 109 case R_ARM_GOT_PREL: 110 case R_ARM_TLS_IE32: 111 // GOT(S) + A - P 112 return R_GOT_PC; 113 case R_ARM_SBREL32: 114 return R_ARM_SBREL; 115 case R_ARM_TARGET1: 116 return config->target1Rel ? R_PC : R_ABS; 117 case R_ARM_TARGET2: 118 if (config->target2 == Target2Policy::Rel) 119 return R_PC; 120 if (config->target2 == Target2Policy::Abs) 121 return R_ABS; 122 return R_GOT_PC; 123 case R_ARM_TLS_GD32: 124 return R_TLSGD_PC; 125 case R_ARM_TLS_LDM32: 126 return R_TLSLD_PC; 127 case R_ARM_TLS_LDO32: 128 return R_DTPREL; 129 case R_ARM_BASE_PREL: 130 // B(S) + A - P 131 // FIXME: currently B(S) assumed to be .got, this may not hold for all 132 // platforms. 133 return R_GOTONLY_PC; 134 case R_ARM_MOVW_PREL_NC: 135 case R_ARM_MOVT_PREL: 136 case R_ARM_REL32: 137 case R_ARM_THM_MOVW_PREL_NC: 138 case R_ARM_THM_MOVT_PREL: 139 return R_PC; 140 case R_ARM_ALU_PC_G0: 141 case R_ARM_ALU_PC_G0_NC: 142 case R_ARM_ALU_PC_G1: 143 case R_ARM_ALU_PC_G1_NC: 144 case R_ARM_ALU_PC_G2: 145 case R_ARM_LDR_PC_G0: 146 case R_ARM_LDR_PC_G1: 147 case R_ARM_LDR_PC_G2: 148 case R_ARM_LDRS_PC_G0: 149 case R_ARM_LDRS_PC_G1: 150 case R_ARM_LDRS_PC_G2: 151 case R_ARM_THM_ALU_PREL_11_0: 152 case R_ARM_THM_PC8: 153 case R_ARM_THM_PC12: 154 return R_ARM_PCA; 155 case R_ARM_MOVW_BREL_NC: 156 case R_ARM_MOVW_BREL: 157 case R_ARM_MOVT_BREL: 158 case R_ARM_THM_MOVW_BREL_NC: 159 case R_ARM_THM_MOVW_BREL: 160 case R_ARM_THM_MOVT_BREL: 161 return R_ARM_SBREL; 162 case R_ARM_NONE: 163 return R_NONE; 164 case R_ARM_TLS_LE32: 165 return R_TPREL; 166 case R_ARM_V4BX: 167 // V4BX is just a marker to indicate there's a "bx rN" instruction at the 168 // given address. It can be used to implement a special linker mode which 169 // rewrites ARMv4T inputs to ARMv4. Since we support only ARMv4 input and 170 // not ARMv4 output, we can just ignore it. 171 return R_NONE; 172 default: 173 error(getErrorLocation(loc) + "unknown relocation (" + Twine(type) + 174 ") against symbol " + toString(s)); 175 return R_NONE; 176 } 177 } 178 179 RelType ARM::getDynRel(RelType type) const { 180 if ((type == R_ARM_ABS32) || (type == R_ARM_TARGET1 && !config->target1Rel)) 181 return R_ARM_ABS32; 182 return R_ARM_NONE; 183 } 184 185 void ARM::writeGotPlt(uint8_t *buf, const Symbol &) const { 186 write32le(buf, in.plt->getVA()); 187 } 188 189 void ARM::writeIgotPlt(uint8_t *buf, const Symbol &s) const { 190 // An ARM entry is the address of the ifunc resolver function. 191 write32le(buf, s.getVA()); 192 } 193 194 // Long form PLT Header that does not have any restrictions on the displacement 195 // of the .plt from the .plt.got. 196 static void writePltHeaderLong(uint8_t *buf) { 197 const uint8_t pltData[] = { 198 0x04, 0xe0, 0x2d, 0xe5, // str lr, [sp,#-4]! 199 0x04, 0xe0, 0x9f, 0xe5, // ldr lr, L2 200 0x0e, 0xe0, 0x8f, 0xe0, // L1: add lr, pc, lr 201 0x08, 0xf0, 0xbe, 0xe5, // ldr pc, [lr, #8] 202 0x00, 0x00, 0x00, 0x00, // L2: .word &(.got.plt) - L1 - 8 203 0xd4, 0xd4, 0xd4, 0xd4, // Pad to 32-byte boundary 204 0xd4, 0xd4, 0xd4, 0xd4, // Pad to 32-byte boundary 205 0xd4, 0xd4, 0xd4, 0xd4}; 206 memcpy(buf, pltData, sizeof(pltData)); 207 uint64_t gotPlt = in.gotPlt->getVA(); 208 uint64_t l1 = in.plt->getVA() + 8; 209 write32le(buf + 16, gotPlt - l1 - 8); 210 } 211 212 // The default PLT header requires the .plt.got to be within 128 Mb of the 213 // .plt in the positive direction. 214 void ARM::writePltHeader(uint8_t *buf) const { 215 // Use a similar sequence to that in writePlt(), the difference is the calling 216 // conventions mean we use lr instead of ip. The PLT entry is responsible for 217 // saving lr on the stack, the dynamic loader is responsible for reloading 218 // it. 219 const uint32_t pltData[] = { 220 0xe52de004, // L1: str lr, [sp,#-4]! 221 0xe28fe600, // add lr, pc, #0x0NN00000 &(.got.plt - L1 - 4) 222 0xe28eea00, // add lr, lr, #0x000NN000 &(.got.plt - L1 - 4) 223 0xe5bef000, // ldr pc, [lr, #0x00000NNN] &(.got.plt -L1 - 4) 224 }; 225 226 uint64_t offset = in.gotPlt->getVA() - in.plt->getVA() - 4; 227 if (!llvm::isUInt<27>(offset)) { 228 // We cannot encode the Offset, use the long form. 229 writePltHeaderLong(buf); 230 return; 231 } 232 write32le(buf + 0, pltData[0]); 233 write32le(buf + 4, pltData[1] | ((offset >> 20) & 0xff)); 234 write32le(buf + 8, pltData[2] | ((offset >> 12) & 0xff)); 235 write32le(buf + 12, pltData[3] | (offset & 0xfff)); 236 memcpy(buf + 16, trapInstr.data(), 4); // Pad to 32-byte boundary 237 memcpy(buf + 20, trapInstr.data(), 4); 238 memcpy(buf + 24, trapInstr.data(), 4); 239 memcpy(buf + 28, trapInstr.data(), 4); 240 } 241 242 void ARM::addPltHeaderSymbols(InputSection &isec) const { 243 addSyntheticLocal("$a", STT_NOTYPE, 0, 0, isec); 244 addSyntheticLocal("$d", STT_NOTYPE, 16, 0, isec); 245 } 246 247 // Long form PLT entries that do not have any restrictions on the displacement 248 // of the .plt from the .plt.got. 249 static void writePltLong(uint8_t *buf, uint64_t gotPltEntryAddr, 250 uint64_t pltEntryAddr) { 251 const uint8_t pltData[] = { 252 0x04, 0xc0, 0x9f, 0xe5, // ldr ip, L2 253 0x0f, 0xc0, 0x8c, 0xe0, // L1: add ip, ip, pc 254 0x00, 0xf0, 0x9c, 0xe5, // ldr pc, [ip] 255 0x00, 0x00, 0x00, 0x00, // L2: .word Offset(&(.plt.got) - L1 - 8 256 }; 257 memcpy(buf, pltData, sizeof(pltData)); 258 uint64_t l1 = pltEntryAddr + 4; 259 write32le(buf + 12, gotPltEntryAddr - l1 - 8); 260 } 261 262 // The default PLT entries require the .plt.got to be within 128 Mb of the 263 // .plt in the positive direction. 264 void ARM::writePlt(uint8_t *buf, const Symbol &sym, 265 uint64_t pltEntryAddr) const { 266 // The PLT entry is similar to the example given in Appendix A of ELF for 267 // the Arm Architecture. Instead of using the Group Relocations to find the 268 // optimal rotation for the 8-bit immediate used in the add instructions we 269 // hard code the most compact rotations for simplicity. This saves a load 270 // instruction over the long plt sequences. 271 const uint32_t pltData[] = { 272 0xe28fc600, // L1: add ip, pc, #0x0NN00000 Offset(&(.plt.got) - L1 - 8 273 0xe28cca00, // add ip, ip, #0x000NN000 Offset(&(.plt.got) - L1 - 8 274 0xe5bcf000, // ldr pc, [ip, #0x00000NNN] Offset(&(.plt.got) - L1 - 8 275 }; 276 277 uint64_t offset = sym.getGotPltVA() - pltEntryAddr - 8; 278 if (!llvm::isUInt<27>(offset)) { 279 // We cannot encode the Offset, use the long form. 280 writePltLong(buf, sym.getGotPltVA(), pltEntryAddr); 281 return; 282 } 283 write32le(buf + 0, pltData[0] | ((offset >> 20) & 0xff)); 284 write32le(buf + 4, pltData[1] | ((offset >> 12) & 0xff)); 285 write32le(buf + 8, pltData[2] | (offset & 0xfff)); 286 memcpy(buf + 12, trapInstr.data(), 4); // Pad to 16-byte boundary 287 } 288 289 void ARM::addPltSymbols(InputSection &isec, uint64_t off) const { 290 addSyntheticLocal("$a", STT_NOTYPE, off, 0, isec); 291 addSyntheticLocal("$d", STT_NOTYPE, off + 12, 0, isec); 292 } 293 294 bool ARM::needsThunk(RelExpr expr, RelType type, const InputFile *file, 295 uint64_t branchAddr, const Symbol &s, 296 int64_t a) const { 297 // If S is an undefined weak symbol and does not have a PLT entry then it 298 // will be resolved as a branch to the next instruction. 299 if (s.isUndefWeak() && !s.isInPlt()) 300 return false; 301 // A state change from ARM to Thumb and vice versa must go through an 302 // interworking thunk if the relocation type is not R_ARM_CALL or 303 // R_ARM_THM_CALL. 304 switch (type) { 305 case R_ARM_PC24: 306 case R_ARM_PLT32: 307 case R_ARM_JUMP24: 308 // Source is ARM, all PLT entries are ARM so no interworking required. 309 // Otherwise we need to interwork if STT_FUNC Symbol has bit 0 set (Thumb). 310 if (s.isFunc() && expr == R_PC && (s.getVA() & 1)) 311 return true; 312 LLVM_FALLTHROUGH; 313 case R_ARM_CALL: { 314 uint64_t dst = (expr == R_PLT_PC) ? s.getPltVA() : s.getVA(); 315 return !inBranchRange(type, branchAddr, dst + a); 316 } 317 case R_ARM_THM_JUMP19: 318 case R_ARM_THM_JUMP24: 319 // Source is Thumb, all PLT entries are ARM so interworking is required. 320 // Otherwise we need to interwork if STT_FUNC Symbol has bit 0 clear (ARM). 321 if (expr == R_PLT_PC || (s.isFunc() && (s.getVA() & 1) == 0)) 322 return true; 323 LLVM_FALLTHROUGH; 324 case R_ARM_THM_CALL: { 325 uint64_t dst = (expr == R_PLT_PC) ? s.getPltVA() : s.getVA(); 326 return !inBranchRange(type, branchAddr, dst + a); 327 } 328 } 329 return false; 330 } 331 332 uint32_t ARM::getThunkSectionSpacing() const { 333 // The placing of pre-created ThunkSections is controlled by the value 334 // thunkSectionSpacing returned by getThunkSectionSpacing(). The aim is to 335 // place the ThunkSection such that all branches from the InputSections 336 // prior to the ThunkSection can reach a Thunk placed at the end of the 337 // ThunkSection. Graphically: 338 // | up to thunkSectionSpacing .text input sections | 339 // | ThunkSection | 340 // | up to thunkSectionSpacing .text input sections | 341 // | ThunkSection | 342 343 // Pre-created ThunkSections are spaced roughly 16MiB apart on ARMv7. This 344 // is to match the most common expected case of a Thumb 2 encoded BL, BLX or 345 // B.W: 346 // ARM B, BL, BLX range +/- 32MiB 347 // Thumb B.W, BL, BLX range +/- 16MiB 348 // Thumb B<cc>.W range +/- 1MiB 349 // If a branch cannot reach a pre-created ThunkSection a new one will be 350 // created so we can handle the rare cases of a Thumb 2 conditional branch. 351 // We intentionally use a lower size for thunkSectionSpacing than the maximum 352 // branch range so the end of the ThunkSection is more likely to be within 353 // range of the branch instruction that is furthest away. The value we shorten 354 // thunkSectionSpacing by is set conservatively to allow us to create 16,384 355 // 12 byte Thunks at any offset in a ThunkSection without risk of a branch to 356 // one of the Thunks going out of range. 357 358 // On Arm the thunkSectionSpacing depends on the range of the Thumb Branch 359 // range. On earlier Architectures such as ARMv4, ARMv5 and ARMv6 (except 360 // ARMv6T2) the range is +/- 4MiB. 361 362 return (config->armJ1J2BranchEncoding) ? 0x1000000 - 0x30000 363 : 0x400000 - 0x7500; 364 } 365 366 bool ARM::inBranchRange(RelType type, uint64_t src, uint64_t dst) const { 367 if ((dst & 0x1) == 0) 368 // Destination is ARM, if ARM caller then Src is already 4-byte aligned. 369 // If Thumb Caller (BLX) the Src address has bottom 2 bits cleared to ensure 370 // destination will be 4 byte aligned. 371 src &= ~0x3; 372 else 373 // Bit 0 == 1 denotes Thumb state, it is not part of the range. 374 dst &= ~0x1; 375 376 int64_t offset = dst - src; 377 switch (type) { 378 case R_ARM_PC24: 379 case R_ARM_PLT32: 380 case R_ARM_JUMP24: 381 case R_ARM_CALL: 382 return llvm::isInt<26>(offset); 383 case R_ARM_THM_JUMP19: 384 return llvm::isInt<21>(offset); 385 case R_ARM_THM_JUMP24: 386 case R_ARM_THM_CALL: 387 return config->armJ1J2BranchEncoding ? llvm::isInt<25>(offset) 388 : llvm::isInt<23>(offset); 389 default: 390 return true; 391 } 392 } 393 394 // Helper to produce message text when LLD detects that a CALL relocation to 395 // a non STT_FUNC symbol that may result in incorrect interworking between ARM 396 // or Thumb. 397 static void stateChangeWarning(uint8_t *loc, RelType relt, const Symbol &s) { 398 assert(!s.isFunc()); 399 const ErrorPlace place = getErrorPlace(loc); 400 std::string hint; 401 if (!place.srcLoc.empty()) 402 hint = "; " + place.srcLoc; 403 if (s.isSection()) { 404 // Section symbols must be defined and in a section. Users cannot change 405 // the type. Use the section name as getName() returns an empty string. 406 warn(place.loc + "branch and link relocation: " + toString(relt) + 407 " to STT_SECTION symbol " + cast<Defined>(s).section->name + 408 " ; interworking not performed" + hint); 409 } else { 410 // Warn with hint on how to alter the symbol type. 411 warn(getErrorLocation(loc) + "branch and link relocation: " + 412 toString(relt) + " to non STT_FUNC symbol: " + s.getName() + 413 " interworking not performed; consider using directive '.type " + 414 s.getName() + 415 ", %function' to give symbol type STT_FUNC if interworking between " 416 "ARM and Thumb is required" + 417 hint); 418 } 419 } 420 421 // Rotate a 32-bit unsigned value right by a specified amt of bits. 422 static uint32_t rotr32(uint32_t val, uint32_t amt) { 423 assert(amt < 32 && "Invalid rotate amount"); 424 return (val >> amt) | (val << ((32 - amt) & 31)); 425 } 426 427 static std::pair<uint32_t, uint32_t> getRemAndLZForGroup(unsigned group, 428 uint32_t val) { 429 uint32_t rem, lz; 430 do { 431 lz = llvm::countLeadingZeros(val) & ~1; 432 rem = val; 433 if (lz == 32) // implies rem == 0 434 break; 435 val &= 0xffffff >> lz; 436 } while (group--); 437 return {rem, lz}; 438 } 439 440 static void encodeAluGroup(uint8_t *loc, const Relocation &rel, uint64_t val, 441 int group, bool check) { 442 // ADD/SUB (immediate) add = bit23, sub = bit22 443 // immediate field carries is a 12-bit modified immediate, made up of a 4-bit 444 // even rotate right and an 8-bit immediate. 445 uint32_t opcode = 0x00800000; 446 if (val >> 63) { 447 opcode = 0x00400000; 448 val = -val; 449 } 450 uint32_t imm, lz; 451 std::tie(imm, lz) = getRemAndLZForGroup(group, val); 452 uint32_t rot = 0; 453 if (lz < 24) { 454 imm = rotr32(imm, 24 - lz); 455 rot = (lz + 8) << 7; 456 } 457 if (check && imm > 0xff) 458 error(getErrorLocation(loc) + "unencodeable immediate " + Twine(val).str() + 459 " for relocation " + toString(rel.type)); 460 write32le(loc, (read32le(loc) & 0xff3ff000) | opcode | rot | (imm & 0xff)); 461 } 462 463 static void encodeLdrGroup(uint8_t *loc, const Relocation &rel, uint64_t val, 464 int group) { 465 // R_ARM_LDR_PC_Gn is S + A - P, we have ((S + A) | T) - P, if S is a 466 // function then addr is 0 (modulo 2) and Pa is 0 (modulo 4) so we can clear 467 // bottom bit to recover S + A - P. 468 if (rel.sym->isFunc()) 469 val &= ~0x1; 470 // LDR (literal) u = bit23 471 uint32_t opcode = 0x00800000; 472 if (val >> 63) { 473 opcode = 0x0; 474 val = -val; 475 } 476 uint32_t imm = getRemAndLZForGroup(group, val).first; 477 checkUInt(loc, imm, 12, rel); 478 write32le(loc, (read32le(loc) & 0xff7ff000) | opcode | imm); 479 } 480 481 static void encodeLdrsGroup(uint8_t *loc, const Relocation &rel, uint64_t val, 482 int group) { 483 // R_ARM_LDRS_PC_Gn is S + A - P, we have ((S + A) | T) - P, if S is a 484 // function then addr is 0 (modulo 2) and Pa is 0 (modulo 4) so we can clear 485 // bottom bit to recover S + A - P. 486 if (rel.sym->isFunc()) 487 val &= ~0x1; 488 // LDRD/LDRH/LDRSB/LDRSH (literal) u = bit23 489 uint32_t opcode = 0x00800000; 490 if (val >> 63) { 491 opcode = 0x0; 492 val = -val; 493 } 494 uint32_t imm = getRemAndLZForGroup(group, val).first; 495 checkUInt(loc, imm, 8, rel); 496 write32le(loc, (read32le(loc) & 0xff7ff0f0) | opcode | ((imm & 0xf0) << 4) | 497 (imm & 0xf)); 498 } 499 500 void ARM::relocate(uint8_t *loc, const Relocation &rel, uint64_t val) const { 501 switch (rel.type) { 502 case R_ARM_ABS32: 503 case R_ARM_BASE_PREL: 504 case R_ARM_GOTOFF32: 505 case R_ARM_GOT_BREL: 506 case R_ARM_GOT_PREL: 507 case R_ARM_REL32: 508 case R_ARM_RELATIVE: 509 case R_ARM_SBREL32: 510 case R_ARM_TARGET1: 511 case R_ARM_TARGET2: 512 case R_ARM_TLS_GD32: 513 case R_ARM_TLS_IE32: 514 case R_ARM_TLS_LDM32: 515 case R_ARM_TLS_LDO32: 516 case R_ARM_TLS_LE32: 517 case R_ARM_TLS_TPOFF32: 518 case R_ARM_TLS_DTPOFF32: 519 write32le(loc, val); 520 break; 521 case R_ARM_PREL31: 522 checkInt(loc, val, 31, rel); 523 write32le(loc, (read32le(loc) & 0x80000000) | (val & ~0x80000000)); 524 break; 525 case R_ARM_CALL: { 526 // R_ARM_CALL is used for BL and BLX instructions, for symbols of type 527 // STT_FUNC we choose whether to write a BL or BLX depending on the 528 // value of bit 0 of Val. With bit 0 == 1 denoting Thumb. If the symbol is 529 // not of type STT_FUNC then we must preserve the original instruction. 530 // PLT entries are always ARM state so we know we don't need to interwork. 531 assert(rel.sym); // R_ARM_CALL is always reached via relocate(). 532 bool bit0Thumb = val & 1; 533 bool isBlx = (read32le(loc) & 0xfe000000) == 0xfa000000; 534 // lld 10.0 and before always used bit0Thumb when deciding to write a BLX 535 // even when type not STT_FUNC. 536 if (!rel.sym->isFunc() && isBlx != bit0Thumb) 537 stateChangeWarning(loc, rel.type, *rel.sym); 538 if (rel.sym->isFunc() ? bit0Thumb : isBlx) { 539 // The BLX encoding is 0xfa:H:imm24 where Val = imm24:H:'1' 540 checkInt(loc, val, 26, rel); 541 write32le(loc, 0xfa000000 | // opcode 542 ((val & 2) << 23) | // H 543 ((val >> 2) & 0x00ffffff)); // imm24 544 break; 545 } 546 // BLX (always unconditional) instruction to an ARM Target, select an 547 // unconditional BL. 548 write32le(loc, 0xeb000000 | (read32le(loc) & 0x00ffffff)); 549 // fall through as BL encoding is shared with B 550 } 551 LLVM_FALLTHROUGH; 552 case R_ARM_JUMP24: 553 case R_ARM_PC24: 554 case R_ARM_PLT32: 555 checkInt(loc, val, 26, rel); 556 write32le(loc, (read32le(loc) & ~0x00ffffff) | ((val >> 2) & 0x00ffffff)); 557 break; 558 case R_ARM_THM_JUMP8: 559 // We do a 9 bit check because val is right-shifted by 1 bit. 560 checkInt(loc, val, 9, rel); 561 write16le(loc, (read32le(loc) & 0xff00) | ((val >> 1) & 0x00ff)); 562 break; 563 case R_ARM_THM_JUMP11: 564 // We do a 12 bit check because val is right-shifted by 1 bit. 565 checkInt(loc, val, 12, rel); 566 write16le(loc, (read32le(loc) & 0xf800) | ((val >> 1) & 0x07ff)); 567 break; 568 case R_ARM_THM_JUMP19: 569 // Encoding T3: Val = S:J2:J1:imm6:imm11:0 570 checkInt(loc, val, 21, rel); 571 write16le(loc, 572 (read16le(loc) & 0xfbc0) | // opcode cond 573 ((val >> 10) & 0x0400) | // S 574 ((val >> 12) & 0x003f)); // imm6 575 write16le(loc + 2, 576 0x8000 | // opcode 577 ((val >> 8) & 0x0800) | // J2 578 ((val >> 5) & 0x2000) | // J1 579 ((val >> 1) & 0x07ff)); // imm11 580 break; 581 case R_ARM_THM_CALL: { 582 // R_ARM_THM_CALL is used for BL and BLX instructions, for symbols of type 583 // STT_FUNC we choose whether to write a BL or BLX depending on the 584 // value of bit 0 of Val. With bit 0 == 0 denoting ARM, if the symbol is 585 // not of type STT_FUNC then we must preserve the original instruction. 586 // PLT entries are always ARM state so we know we need to interwork. 587 assert(rel.sym); // R_ARM_THM_CALL is always reached via relocate(). 588 bool bit0Thumb = val & 1; 589 bool isBlx = (read16le(loc + 2) & 0x1000) == 0; 590 // lld 10.0 and before always used bit0Thumb when deciding to write a BLX 591 // even when type not STT_FUNC. PLT entries generated by LLD are always ARM. 592 if (!rel.sym->isFunc() && !rel.sym->isInPlt() && isBlx == bit0Thumb) 593 stateChangeWarning(loc, rel.type, *rel.sym); 594 if (rel.sym->isFunc() || rel.sym->isInPlt() ? !bit0Thumb : isBlx) { 595 // We are writing a BLX. Ensure BLX destination is 4-byte aligned. As 596 // the BLX instruction may only be two byte aligned. This must be done 597 // before overflow check. 598 val = alignTo(val, 4); 599 write16le(loc + 2, read16le(loc + 2) & ~0x1000); 600 } else { 601 write16le(loc + 2, (read16le(loc + 2) & ~0x1000) | 1 << 12); 602 } 603 if (!config->armJ1J2BranchEncoding) { 604 // Older Arm architectures do not support R_ARM_THM_JUMP24 and have 605 // different encoding rules and range due to J1 and J2 always being 1. 606 checkInt(loc, val, 23, rel); 607 write16le(loc, 608 0xf000 | // opcode 609 ((val >> 12) & 0x07ff)); // imm11 610 write16le(loc + 2, 611 (read16le(loc + 2) & 0xd000) | // opcode 612 0x2800 | // J1 == J2 == 1 613 ((val >> 1) & 0x07ff)); // imm11 614 break; 615 } 616 } 617 // Fall through as rest of encoding is the same as B.W 618 LLVM_FALLTHROUGH; 619 case R_ARM_THM_JUMP24: 620 // Encoding B T4, BL T1, BLX T2: Val = S:I1:I2:imm10:imm11:0 621 checkInt(loc, val, 25, rel); 622 write16le(loc, 623 0xf000 | // opcode 624 ((val >> 14) & 0x0400) | // S 625 ((val >> 12) & 0x03ff)); // imm10 626 write16le(loc + 2, 627 (read16le(loc + 2) & 0xd000) | // opcode 628 (((~(val >> 10)) ^ (val >> 11)) & 0x2000) | // J1 629 (((~(val >> 11)) ^ (val >> 13)) & 0x0800) | // J2 630 ((val >> 1) & 0x07ff)); // imm11 631 break; 632 case R_ARM_MOVW_ABS_NC: 633 case R_ARM_MOVW_PREL_NC: 634 case R_ARM_MOVW_BREL_NC: 635 write32le(loc, (read32le(loc) & ~0x000f0fff) | ((val & 0xf000) << 4) | 636 (val & 0x0fff)); 637 break; 638 case R_ARM_MOVT_ABS: 639 case R_ARM_MOVT_PREL: 640 case R_ARM_MOVT_BREL: 641 write32le(loc, (read32le(loc) & ~0x000f0fff) | 642 (((val >> 16) & 0xf000) << 4) | ((val >> 16) & 0xfff)); 643 break; 644 case R_ARM_THM_MOVT_ABS: 645 case R_ARM_THM_MOVT_PREL: 646 case R_ARM_THM_MOVT_BREL: 647 // Encoding T1: A = imm4:i:imm3:imm8 648 write16le(loc, 649 0xf2c0 | // opcode 650 ((val >> 17) & 0x0400) | // i 651 ((val >> 28) & 0x000f)); // imm4 652 write16le(loc + 2, 653 (read16le(loc + 2) & 0x8f00) | // opcode 654 ((val >> 12) & 0x7000) | // imm3 655 ((val >> 16) & 0x00ff)); // imm8 656 break; 657 case R_ARM_THM_MOVW_ABS_NC: 658 case R_ARM_THM_MOVW_PREL_NC: 659 case R_ARM_THM_MOVW_BREL_NC: 660 // Encoding T3: A = imm4:i:imm3:imm8 661 write16le(loc, 662 0xf240 | // opcode 663 ((val >> 1) & 0x0400) | // i 664 ((val >> 12) & 0x000f)); // imm4 665 write16le(loc + 2, 666 (read16le(loc + 2) & 0x8f00) | // opcode 667 ((val << 4) & 0x7000) | // imm3 668 (val & 0x00ff)); // imm8 669 break; 670 case R_ARM_ALU_PC_G0: 671 encodeAluGroup(loc, rel, val, 0, true); 672 break; 673 case R_ARM_ALU_PC_G0_NC: 674 encodeAluGroup(loc, rel, val, 0, false); 675 break; 676 case R_ARM_ALU_PC_G1: 677 encodeAluGroup(loc, rel, val, 1, true); 678 break; 679 case R_ARM_ALU_PC_G1_NC: 680 encodeAluGroup(loc, rel, val, 1, false); 681 break; 682 case R_ARM_ALU_PC_G2: 683 encodeAluGroup(loc, rel, val, 2, true); 684 break; 685 case R_ARM_LDR_PC_G0: 686 encodeLdrGroup(loc, rel, val, 0); 687 break; 688 case R_ARM_LDR_PC_G1: 689 encodeLdrGroup(loc, rel, val, 1); 690 break; 691 case R_ARM_LDR_PC_G2: 692 encodeLdrGroup(loc, rel, val, 2); 693 break; 694 case R_ARM_LDRS_PC_G0: 695 encodeLdrsGroup(loc, rel, val, 0); 696 break; 697 case R_ARM_LDRS_PC_G1: 698 encodeLdrsGroup(loc, rel, val, 1); 699 break; 700 case R_ARM_LDRS_PC_G2: 701 encodeLdrsGroup(loc, rel, val, 2); 702 break; 703 case R_ARM_THM_ALU_PREL_11_0: { 704 // ADR encoding T2 (sub), T3 (add) i:imm3:imm8 705 int64_t imm = val; 706 uint16_t sub = 0; 707 if (imm < 0) { 708 imm = -imm; 709 sub = 0x00a0; 710 } 711 checkUInt(loc, imm, 12, rel); 712 write16le(loc, (read16le(loc) & 0xfb0f) | sub | (imm & 0x800) >> 1); 713 write16le(loc + 2, 714 (read16le(loc + 2) & 0x8f00) | (imm & 0x700) << 4 | (imm & 0xff)); 715 break; 716 } 717 case R_ARM_THM_PC8: 718 // ADR and LDR literal encoding T1 positive offset only imm8:00 719 // R_ARM_THM_PC8 is S + A - Pa, we have ((S + A) | T) - Pa, if S is a 720 // function then addr is 0 (modulo 2) and Pa is 0 (modulo 4) so we can clear 721 // bottom bit to recover S + A - Pa. 722 if (rel.sym->isFunc()) 723 val &= ~0x1; 724 checkUInt(loc, val, 10, rel); 725 checkAlignment(loc, val, 4, rel); 726 write16le(loc, (read16le(loc) & 0xff00) | (val & 0x3fc) >> 2); 727 break; 728 case R_ARM_THM_PC12: { 729 // LDR (literal) encoding T2, add = (U == '1') imm12 730 // imm12 is unsigned 731 // R_ARM_THM_PC12 is S + A - Pa, we have ((S + A) | T) - Pa, if S is a 732 // function then addr is 0 (modulo 2) and Pa is 0 (modulo 4) so we can clear 733 // bottom bit to recover S + A - Pa. 734 if (rel.sym->isFunc()) 735 val &= ~0x1; 736 int64_t imm12 = val; 737 uint16_t u = 0x0080; 738 if (imm12 < 0) { 739 imm12 = -imm12; 740 u = 0; 741 } 742 checkUInt(loc, imm12, 12, rel); 743 write16le(loc, read16le(loc) | u); 744 write16le(loc + 2, (read16le(loc + 2) & 0xf000) | imm12); 745 break; 746 } 747 default: 748 llvm_unreachable("unknown relocation"); 749 } 750 } 751 752 int64_t ARM::getImplicitAddend(const uint8_t *buf, RelType type) const { 753 switch (type) { 754 default: 755 internalLinkerError(getErrorLocation(buf), 756 "cannot read addend for relocation " + toString(type)); 757 return 0; 758 case R_ARM_ABS32: 759 case R_ARM_BASE_PREL: 760 case R_ARM_GLOB_DAT: 761 case R_ARM_GOTOFF32: 762 case R_ARM_GOT_BREL: 763 case R_ARM_GOT_PREL: 764 case R_ARM_IRELATIVE: 765 case R_ARM_REL32: 766 case R_ARM_RELATIVE: 767 case R_ARM_SBREL32: 768 case R_ARM_TARGET1: 769 case R_ARM_TARGET2: 770 case R_ARM_TLS_DTPMOD32: 771 case R_ARM_TLS_DTPOFF32: 772 case R_ARM_TLS_GD32: 773 case R_ARM_TLS_IE32: 774 case R_ARM_TLS_LDM32: 775 case R_ARM_TLS_LE32: 776 case R_ARM_TLS_LDO32: 777 case R_ARM_TLS_TPOFF32: 778 return SignExtend64<32>(read32le(buf)); 779 case R_ARM_PREL31: 780 return SignExtend64<31>(read32le(buf)); 781 case R_ARM_CALL: 782 case R_ARM_JUMP24: 783 case R_ARM_PC24: 784 case R_ARM_PLT32: 785 return SignExtend64<26>(read32le(buf) << 2); 786 case R_ARM_THM_JUMP8: 787 return SignExtend64<9>(read16le(buf) << 1); 788 case R_ARM_THM_JUMP11: 789 return SignExtend64<12>(read16le(buf) << 1); 790 case R_ARM_THM_JUMP19: { 791 // Encoding T3: A = S:J2:J1:imm10:imm6:0 792 uint16_t hi = read16le(buf); 793 uint16_t lo = read16le(buf + 2); 794 return SignExtend64<20>(((hi & 0x0400) << 10) | // S 795 ((lo & 0x0800) << 8) | // J2 796 ((lo & 0x2000) << 5) | // J1 797 ((hi & 0x003f) << 12) | // imm6 798 ((lo & 0x07ff) << 1)); // imm11:0 799 } 800 case R_ARM_THM_CALL: 801 if (!config->armJ1J2BranchEncoding) { 802 // Older Arm architectures do not support R_ARM_THM_JUMP24 and have 803 // different encoding rules and range due to J1 and J2 always being 1. 804 uint16_t hi = read16le(buf); 805 uint16_t lo = read16le(buf + 2); 806 return SignExtend64<22>(((hi & 0x7ff) << 12) | // imm11 807 ((lo & 0x7ff) << 1)); // imm11:0 808 break; 809 } 810 LLVM_FALLTHROUGH; 811 case R_ARM_THM_JUMP24: { 812 // Encoding B T4, BL T1, BLX T2: A = S:I1:I2:imm10:imm11:0 813 // I1 = NOT(J1 EOR S), I2 = NOT(J2 EOR S) 814 uint16_t hi = read16le(buf); 815 uint16_t lo = read16le(buf + 2); 816 return SignExtend64<24>(((hi & 0x0400) << 14) | // S 817 (~((lo ^ (hi << 3)) << 10) & 0x00800000) | // I1 818 (~((lo ^ (hi << 1)) << 11) & 0x00400000) | // I2 819 ((hi & 0x003ff) << 12) | // imm0 820 ((lo & 0x007ff) << 1)); // imm11:0 821 } 822 // ELF for the ARM Architecture 4.6.1.1 the implicit addend for MOVW and 823 // MOVT is in the range -32768 <= A < 32768 824 case R_ARM_MOVW_ABS_NC: 825 case R_ARM_MOVT_ABS: 826 case R_ARM_MOVW_PREL_NC: 827 case R_ARM_MOVT_PREL: 828 case R_ARM_MOVW_BREL_NC: 829 case R_ARM_MOVT_BREL: { 830 uint64_t val = read32le(buf) & 0x000f0fff; 831 return SignExtend64<16>(((val & 0x000f0000) >> 4) | (val & 0x00fff)); 832 } 833 case R_ARM_THM_MOVW_ABS_NC: 834 case R_ARM_THM_MOVT_ABS: 835 case R_ARM_THM_MOVW_PREL_NC: 836 case R_ARM_THM_MOVT_PREL: 837 case R_ARM_THM_MOVW_BREL_NC: 838 case R_ARM_THM_MOVT_BREL: { 839 // Encoding T3: A = imm4:i:imm3:imm8 840 uint16_t hi = read16le(buf); 841 uint16_t lo = read16le(buf + 2); 842 return SignExtend64<16>(((hi & 0x000f) << 12) | // imm4 843 ((hi & 0x0400) << 1) | // i 844 ((lo & 0x7000) >> 4) | // imm3 845 (lo & 0x00ff)); // imm8 846 } 847 case R_ARM_ALU_PC_G0: 848 case R_ARM_ALU_PC_G0_NC: 849 case R_ARM_ALU_PC_G1: 850 case R_ARM_ALU_PC_G1_NC: 851 case R_ARM_ALU_PC_G2: { 852 // 12-bit immediate is a modified immediate made up of a 4-bit even 853 // right rotation and 8-bit constant. After the rotation the value 854 // is zero-extended. When bit 23 is set the instruction is an add, when 855 // bit 22 is set it is a sub. 856 uint32_t instr = read32le(buf); 857 uint32_t val = rotr32(instr & 0xff, ((instr & 0xf00) >> 8) * 2); 858 return (instr & 0x00400000) ? -val : val; 859 } 860 case R_ARM_LDR_PC_G0: 861 case R_ARM_LDR_PC_G1: 862 case R_ARM_LDR_PC_G2: { 863 // ADR (literal) add = bit23, sub = bit22 864 // LDR (literal) u = bit23 unsigned imm12 865 bool u = read32le(buf) & 0x00800000; 866 uint32_t imm12 = read32le(buf) & 0xfff; 867 return u ? imm12 : -imm12; 868 } 869 case R_ARM_LDRS_PC_G0: 870 case R_ARM_LDRS_PC_G1: 871 case R_ARM_LDRS_PC_G2: { 872 // LDRD/LDRH/LDRSB/LDRSH (literal) u = bit23 unsigned imm8 873 uint32_t opcode = read32le(buf); 874 bool u = opcode & 0x00800000; 875 uint32_t imm4l = opcode & 0xf; 876 uint32_t imm4h = (opcode & 0xf00) >> 4; 877 return u ? (imm4h | imm4l) : -(imm4h | imm4l); 878 } 879 case R_ARM_THM_ALU_PREL_11_0: { 880 // Thumb2 ADR, which is an alias for a sub or add instruction with an 881 // unsigned immediate. 882 // ADR encoding T2 (sub), T3 (add) i:imm3:imm8 883 uint16_t hi = read16le(buf); 884 uint16_t lo = read16le(buf + 2); 885 uint64_t imm = (hi & 0x0400) << 1 | // i 886 (lo & 0x7000) >> 4 | // imm3 887 (lo & 0x00ff); // imm8 888 // For sub, addend is negative, add is positive. 889 return (hi & 0x00f0) ? -imm : imm; 890 } 891 case R_ARM_THM_PC8: 892 // ADR and LDR (literal) encoding T1 893 // From ELF for the ARM Architecture the initial signed addend is formed 894 // from an unsigned field using expression (((imm8:00 + 4) & 0x3ff) – 4) 895 // this trick permits the PC bias of -4 to be encoded using imm8 = 0xff 896 return ((((read16le(buf) & 0xff) << 2) + 4) & 0x3ff) - 4; 897 case R_ARM_THM_PC12: { 898 // LDR (literal) encoding T2, add = (U == '1') imm12 899 bool u = read16le(buf) & 0x0080; 900 uint64_t imm12 = read16le(buf + 2) & 0x0fff; 901 return u ? imm12 : -imm12; 902 } 903 case R_ARM_NONE: 904 case R_ARM_V4BX: 905 case R_ARM_JUMP_SLOT: 906 // These relocations are defined as not having an implicit addend. 907 return 0; 908 } 909 } 910 911 TargetInfo *elf::getARMTargetInfo() { 912 static ARM target; 913 return ⌖ 914 } 915