1//===- AArch64ErrataFix.cpp -----------------------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8// This file implements Section Patching for the purpose of working around
9// the AArch64 Cortex-53 errata 843419 that affects r0p0, r0p1, r0p2 and r0p4
10// versions of the core.
11//
12// The general principle is that an erratum sequence of one or
13// more instructions is detected in the instruction stream, one of the
14// instructions in the sequence is replaced with a branch to a patch sequence
15// of replacement instructions. At the end of the replacement sequence the
16// patch branches back to the instruction stream.
17
18// This technique is only suitable for fixing an erratum when:
19// - There is a set of necessary conditions required to trigger the erratum that
20// can be detected at static link time.
21// - There is a set of replacement instructions that can be used to remove at
22// least one of the necessary conditions that trigger the erratum.
23// - We can overwrite an instruction in the erratum sequence with a branch to
24// the replacement sequence.
25// - We can place the replacement sequence within range of the branch.
26//===----------------------------------------------------------------------===//
27
28#include "AArch64ErrataFix.h"
29#include "InputFiles.h"
30#include "LinkerScript.h"
31#include "OutputSections.h"
32#include "Relocations.h"
33#include "Symbols.h"
34#include "SyntheticSections.h"
35#include "Target.h"
36#include "lld/Common/CommonLinkerContext.h"
37#include "lld/Common/Strings.h"
38#include "llvm/ADT/StringExtras.h"
39#include "llvm/Support/Endian.h"
40#include <algorithm>
41
42using namespace llvm;
43using namespace llvm::ELF;
44using namespace llvm::object;
45using namespace llvm::support;
46using namespace llvm::support::endian;
47using namespace lld;
48using namespace lld::elf;
49
50// Helper functions to identify instructions and conditions needed to trigger
51// the Cortex-A53-843419 erratum.
52
53// ADRP
54// | 1 | immlo (2) | 1 | 0 0 0 0 | immhi (19) | Rd (5) |
55static bool isADRP(uint32_t instr) {
56 return (instr & 0x9f000000) == 0x90000000;
57}
58
59// Load and store bit patterns from ARMv8-A.
60// Instructions appear in order of appearance starting from table in
61// C4.1.3 Loads and Stores.
62
63// All loads and stores have 1 (at bit position 27), (0 at bit position 25).
64// | op0 x op1 (2) | 1 op2 0 op3 (2) | x | op4 (5) | xxxx | op5 (2) | x (10) |
65static bool isLoadStoreClass(uint32_t instr) {
66 return (instr & 0x0a000000) == 0x08000000;
67}
68
69// LDN/STN multiple no offset
70// | 0 Q 00 | 1100 | 0 L 00 | 0000 | opcode (4) | size (2) | Rn (5) | Rt (5) |
71// LDN/STN multiple post-indexed
72// | 0 Q 00 | 1100 | 1 L 0 | Rm (5)| opcode (4) | size (2) | Rn (5) | Rt (5) |
73// L == 0 for stores.
74
75// Utility routine to decode opcode field of LDN/STN multiple structure
76// instructions to find the ST1 instructions.
77// opcode == 0010 ST1 4 registers.
78// opcode == 0110 ST1 3 registers.
79// opcode == 0111 ST1 1 register.
80// opcode == 1010 ST1 2 registers.
81static bool isST1MultipleOpcode(uint32_t instr) {
82 return (instr & 0x0000f000) == 0x00002000 ||
83 (instr & 0x0000f000) == 0x00006000 ||
84 (instr & 0x0000f000) == 0x00007000 ||
85 (instr & 0x0000f000) == 0x0000a000;
86}
87
88static bool isST1Multiple(uint32_t instr) {
89 return (instr & 0xbfff0000) == 0x0c000000 && isST1MultipleOpcode(instr);
90}
91
92// Writes to Rn (writeback).
93static bool isST1MultiplePost(uint32_t instr) {
94 return (instr & 0xbfe00000) == 0x0c800000 && isST1MultipleOpcode(instr);
95}
96
97// LDN/STN single no offset
98// | 0 Q 00 | 1101 | 0 L R 0 | 0000 | opc (3) S | size (2) | Rn (5) | Rt (5)|
99// LDN/STN single post-indexed
100// | 0 Q 00 | 1101 | 1 L R | Rm (5) | opc (3) S | size (2) | Rn (5) | Rt (5)|
101// L == 0 for stores
102
103// Utility routine to decode opcode field of LDN/STN single structure
104// instructions to find the ST1 instructions.
105// R == 0 for ST1 and ST3, R == 1 for ST2 and ST4.
106// opcode == 000 ST1 8-bit.
107// opcode == 010 ST1 16-bit.
108// opcode == 100 ST1 32 or 64-bit (Size determines which).
109static bool isST1SingleOpcode(uint32_t instr) {
110 return (instr & 0x0040e000) == 0x00000000 ||
111 (instr & 0x0040e000) == 0x00004000 ||
112 (instr & 0x0040e000) == 0x00008000;
113}
114
115static bool isST1Single(uint32_t instr) {
116 return (instr & 0xbfff0000) == 0x0d000000 && isST1SingleOpcode(instr);
117}
118
119// Writes to Rn (writeback).
120static bool isST1SinglePost(uint32_t instr) {
121 return (instr & 0xbfe00000) == 0x0d800000 && isST1SingleOpcode(instr);
122}
123
124static bool isST1(uint32_t instr) {
125 return isST1Multiple(instr) || isST1MultiplePost(instr) ||
126 isST1Single(instr) || isST1SinglePost(instr);
127}
128
129// Load/store exclusive
130// | size (2) 00 | 1000 | o2 L o1 | Rs (5) | o0 | Rt2 (5) | Rn (5) | Rt (5) |
131// L == 0 for Stores.
132static bool isLoadStoreExclusive(uint32_t instr) {
133 return (instr & 0x3f000000) == 0x08000000;
134}
135
136static bool isLoadExclusive(uint32_t instr) {
137 return (instr & 0x3f400000) == 0x08400000;
138}
139
140// Load register literal
141// | opc (2) 01 | 1 V 00 | imm19 | Rt (5) |
142static bool isLoadLiteral(uint32_t instr) {
143 return (instr & 0x3b000000) == 0x18000000;
144}
145
146// Load/store no-allocate pair
147// (offset)
148// | opc (2) 10 | 1 V 00 | 0 L | imm7 | Rt2 (5) | Rn (5) | Rt (5) |
149// L == 0 for stores.
150// Never writes to register
151static bool isSTNP(uint32_t instr) {
152 return (instr & 0x3bc00000) == 0x28000000;
153}
154
155// Load/store register pair
156// (post-indexed)
157// | opc (2) 10 | 1 V 00 | 1 L | imm7 | Rt2 (5) | Rn (5) | Rt (5) |
158// L == 0 for stores, V == 0 for Scalar, V == 1 for Simd/FP
159// Writes to Rn.
160static bool isSTPPost(uint32_t instr) {
161 return (instr & 0x3bc00000) == 0x28800000;
162}
163
164// (offset)
165// | opc (2) 10 | 1 V 01 | 0 L | imm7 | Rt2 (5) | Rn (5) | Rt (5) |
166static bool isSTPOffset(uint32_t instr) {
167 return (instr & 0x3bc00000) == 0x29000000;
168}
169
170// (pre-index)
171// | opc (2) 10 | 1 V 01 | 1 L | imm7 | Rt2 (5) | Rn (5) | Rt (5) |
172// Writes to Rn.
173static bool isSTPPre(uint32_t instr) {
174 return (instr & 0x3bc00000) == 0x29800000;
175}
176
177static bool isSTP(uint32_t instr) {
178 return isSTPPost(instr) || isSTPOffset(instr) || isSTPPre(instr);
179}
180
181// Load/store register (unscaled immediate)
182// | size (2) 11 | 1 V 00 | opc (2) 0 | imm9 | 00 | Rn (5) | Rt (5) |
183// V == 0 for Scalar, V == 1 for Simd/FP.
184static bool isLoadStoreUnscaled(uint32_t instr) {
185 return (instr & 0x3b000c00) == 0x38000000;
186}
187
188// Load/store register (immediate post-indexed)
189// | size (2) 11 | 1 V 00 | opc (2) 0 | imm9 | 01 | Rn (5) | Rt (5) |
190static bool isLoadStoreImmediatePost(uint32_t instr) {
191 return (instr & 0x3b200c00) == 0x38000400;
192}
193
194// Load/store register (unprivileged)
195// | size (2) 11 | 1 V 00 | opc (2) 0 | imm9 | 10 | Rn (5) | Rt (5) |
196static bool isLoadStoreUnpriv(uint32_t instr) {
197 return (instr & 0x3b200c00) == 0x38000800;
198}
199
200// Load/store register (immediate pre-indexed)
201// | size (2) 11 | 1 V 00 | opc (2) 0 | imm9 | 11 | Rn (5) | Rt (5) |
202static bool isLoadStoreImmediatePre(uint32_t instr) {
203 return (instr & 0x3b200c00) == 0x38000c00;
204}
205
206// Load/store register (register offset)
207// | size (2) 11 | 1 V 00 | opc (2) 1 | Rm (5) | option (3) S | 10 | Rn | Rt |
208static bool isLoadStoreRegisterOff(uint32_t instr) {
209 return (instr & 0x3b200c00) == 0x38200800;
210}
211
212// Load/store register (unsigned immediate)
213// | size (2) 11 | 1 V 01 | opc (2) | imm12 | Rn (5) | Rt (5) |
214static bool isLoadStoreRegisterUnsigned(uint32_t instr) {
215 return (instr & 0x3b000000) == 0x39000000;
216}
217
218// Rt is always in bit position 0 - 4.
219static uint32_t getRt(uint32_t instr) { return (instr & 0x1f); }
220
221// Rn is always in bit position 5 - 9.
222static uint32_t getRn(uint32_t instr) { return (instr >> 5) & 0x1f; }
223
224// C4.1.2 Branches, Exception Generating and System instructions
225// | op0 (3) 1 | 01 op1 (4) | x (22) |
226// op0 == 010 101 op1 == 0xxx Conditional Branch.
227// op0 == 110 101 op1 == 1xxx Unconditional Branch Register.
228// op0 == x00 101 op1 == xxxx Unconditional Branch immediate.
229// op0 == x01 101 op1 == 0xxx Compare and branch immediate.
230// op0 == x01 101 op1 == 1xxx Test and branch immediate.
231static bool isBranch(uint32_t instr) {
232 return ((instr & 0xfe000000) == 0xd6000000) || // Cond branch.
233 ((instr & 0xfe000000) == 0x54000000) || // Uncond branch reg.
234 ((instr & 0x7c000000) == 0x14000000) || // Uncond branch imm.
235 ((instr & 0x7c000000) == 0x34000000); // Compare and test branch.
236}
237
238static bool isV8SingleRegisterNonStructureLoadStore(uint32_t instr) {
239 return isLoadStoreUnscaled(instr) || isLoadStoreImmediatePost(instr) ||
240 isLoadStoreUnpriv(instr) || isLoadStoreImmediatePre(instr) ||
241 isLoadStoreRegisterOff(instr) || isLoadStoreRegisterUnsigned(instr);
242}
243
244// Note that this function refers to v8.0 only and does not include the
245// additional load and store instructions added for in later revisions of
246// the architecture such as the Atomic memory operations introduced
247// in v8.1.
248static bool isV8NonStructureLoad(uint32_t instr) {
249 if (isLoadExclusive(instr))
250 return true;
251 if (isLoadLiteral(instr))
252 return true;
253 else if (isV8SingleRegisterNonStructureLoadStore(instr)) {
254 // For Load and Store single register, Loads are derived from a
255 // combination of the Size, V and Opc fields.
256 uint32_t size = (instr >> 30) & 0xff;
257 uint32_t v = (instr >> 26) & 0x1;
258 uint32_t opc = (instr >> 22) & 0x3;
259 // For the load and store instructions that we are decoding.
260 // Opc == 0 are all stores.
261 // Opc == 1 with a couple of exceptions are loads. The exceptions are:
262 // Size == 00 (0), V == 1, Opc == 10 (2) which is a store and
263 // Size == 11 (3), V == 0, Opc == 10 (2) which is a prefetch.
264 return opc != 0 && !(size == 0 && v == 1 && opc == 2) &&
265 !(size == 3 && v == 0 && opc == 2);
266 }
267 return false;
268}
269
270// The following decode instructions are only complete up to the instructions
271// needed for errata 843419.
272
273// Instruction with writeback updates the index register after the load/store.
274static bool hasWriteback(uint32_t instr) {
275 return isLoadStoreImmediatePre(instr) || isLoadStoreImmediatePost(instr) ||
276 isSTPPre(instr) || isSTPPost(instr) || isST1SinglePost(instr) ||
277 isST1MultiplePost(instr);
278}
279
280// For the load and store class of instructions, a load can write to the
281// destination register, a load and a store can write to the base register when
282// the instruction has writeback.
283static bool doesLoadStoreWriteToReg(uint32_t instr, uint32_t reg) {
284 return (isV8NonStructureLoad(instr) && getRt(instr) == reg) ||
285 (hasWriteback(instr) && getRn(instr) == reg);
286}
287
288// Scanner for Cortex-A53 errata 843419
289// Full details are available in the Cortex A53 MPCore revision 0 Software
290// Developers Errata Notice (ARM-EPM-048406).
291//
292// The instruction sequence that triggers the erratum is common in compiled
293// AArch64 code, however it is sensitive to the offset of the sequence within
294// a 4k page. This means that by scanning and fixing the patch after we have
295// assigned addresses we only need to disassemble and fix instances of the
296// sequence in the range of affected offsets.
297//
298// In summary the erratum conditions are a series of 4 instructions:
299// 1.) An ADRP instruction that writes to register Rn with low 12 bits of
300// address of instruction either 0xff8 or 0xffc.
301// 2.) A load or store instruction that can be:
302// - A single register load or store, of either integer or vector registers.
303// - An STP or STNP, of either integer or vector registers.
304// - An Advanced SIMD ST1 store instruction.
305// - Must not write to Rn, but may optionally read from it.
306// 3.) An optional instruction that is not a branch and does not write to Rn.
307// 4.) A load or store from the Load/store register (unsigned immediate) class
308// that uses Rn as the base address register.
309//
310// Note that we do not attempt to scan for Sequence 2 as described in the
311// Software Developers Errata Notice as this has been assessed to be extremely
312// unlikely to occur in compiled code. This matches gold and ld.bfd behavior.
313
314// Return true if the Instruction sequence Adrp, Instr2, and Instr4 match
315// the erratum sequence. The Adrp, Instr2 and Instr4 correspond to 1.), 2.),
316// and 4.) in the Scanner for Cortex-A53 errata comment above.
317static bool is843419ErratumSequence(uint32_t instr1, uint32_t instr2,
318 uint32_t instr4) {
319 if (!isADRP(instr: instr1))
320 return false;
321
322 uint32_t rn = getRt(instr: instr1);
323 return isLoadStoreClass(instr: instr2) &&
324 (isLoadStoreExclusive(instr: instr2) || isLoadLiteral(instr: instr2) ||
325 isV8SingleRegisterNonStructureLoadStore(instr: instr2) || isSTP(instr: instr2) ||
326 isSTNP(instr: instr2) || isST1(instr: instr2)) &&
327 !doesLoadStoreWriteToReg(instr: instr2, reg: rn) &&
328 isLoadStoreRegisterUnsigned(instr: instr4) && getRn(instr: instr4) == rn;
329}
330
331// Scan the instruction sequence starting at Offset Off from the base of
332// InputSection isec. We update Off in this function rather than in the caller
333// as we can skip ahead much further into the section when we know how many
334// instructions we've scanned.
335// Return the offset of the load or store instruction in isec that we want to
336// patch or 0 if no patch required.
337static uint64_t scanCortexA53Errata843419(InputSection *isec, uint64_t &off,
338 uint64_t limit) {
339 uint64_t isecAddr = isec->getVA(offset: 0);
340
341 // Advance Off so that (isecAddr + Off) modulo 0x1000 is at least 0xff8.
342 uint64_t initialPageOff = (isecAddr + off) & 0xfff;
343 if (initialPageOff < 0xff8)
344 off += 0xff8 - initialPageOff;
345
346 bool optionalAllowed = limit - off > 12;
347 if (off >= limit || limit - off < 12) {
348 // Need at least 3 4-byte sized instructions to trigger erratum.
349 off = limit;
350 return 0;
351 }
352
353 uint64_t patchOff = 0;
354 const uint8_t *buf = isec->content().begin();
355 const ulittle32_t *instBuf = reinterpret_cast<const ulittle32_t *>(buf + off);
356 uint32_t instr1 = *instBuf++;
357 uint32_t instr2 = *instBuf++;
358 uint32_t instr3 = *instBuf++;
359 if (is843419ErratumSequence(instr1, instr2, instr4: instr3)) {
360 patchOff = off + 8;
361 } else if (optionalAllowed && !isBranch(instr: instr3)) {
362 uint32_t instr4 = *instBuf++;
363 if (is843419ErratumSequence(instr1, instr2, instr4))
364 patchOff = off + 12;
365 }
366 if (((isecAddr + off) & 0xfff) == 0xff8)
367 off += 4;
368 else
369 off += 0xffc;
370 return patchOff;
371}
372
373class elf::Patch843419Section final : public SyntheticSection {
374public:
375 Patch843419Section(InputSection *p, uint64_t off);
376
377 void writeTo(uint8_t *buf) override;
378
379 size_t getSize() const override { return 8; }
380
381 uint64_t getLDSTAddr() const;
382
383 static bool classof(const SectionBase *d) {
384 return d->kind() == InputSectionBase::Synthetic && d->name == ".text.patch";
385 }
386
387 // The Section we are patching.
388 const InputSection *patchee;
389 // The offset of the instruction in the patchee section we are patching.
390 uint64_t patcheeOffset;
391 // A label for the start of the Patch that we can use as a relocation target.
392 Symbol *patchSym;
393};
394
395Patch843419Section::Patch843419Section(InputSection *p, uint64_t off)
396 : SyntheticSection(SHF_ALLOC | SHF_EXECINSTR, SHT_PROGBITS, 4,
397 ".text.patch"),
398 patchee(p), patcheeOffset(off) {
399 this->parent = p->getParent();
400 patchSym = addSyntheticLocal(
401 name: saver().save(S: "__CortexA53843419_" + utohexstr(X: getLDSTAddr())), type: STT_FUNC,
402 value: 0, size: getSize(), section&: *this);
403 addSyntheticLocal(name: saver().save(S: "$x"), type: STT_NOTYPE, value: 0, size: 0, section&: *this);
404}
405
406uint64_t Patch843419Section::getLDSTAddr() const {
407 return patchee->getVA(offset: patcheeOffset);
408}
409
410void Patch843419Section::writeTo(uint8_t *buf) {
411 // Copy the instruction that we will be replacing with a branch in the
412 // patchee Section.
413 write32le(P: buf, V: read32le(P: patchee->content().begin() + patcheeOffset));
414
415 // Apply any relocation transferred from the original patchee section.
416 target->relocateAlloc(sec&: *this, buf);
417
418 // Return address is the next instruction after the one we have just copied.
419 uint64_t s = getLDSTAddr() + 4;
420 uint64_t p = patchSym->getVA() + 4;
421 target->relocateNoSym(loc: buf + 4, type: R_AARCH64_JUMP26, val: s - p);
422}
423
424void AArch64Err843419Patcher::init() {
425 // The AArch64 ABI permits data in executable sections. We must avoid scanning
426 // this data as if it were instructions to avoid false matches. We use the
427 // mapping symbols in the InputObjects to identify this data, caching the
428 // results in sectionMap so we don't have to recalculate it each pass.
429
430 // The ABI Section 4.5.4 Mapping symbols; defines local symbols that describe
431 // half open intervals [Symbol Value, Next Symbol Value) of code and data
432 // within sections. If there is no next symbol then the half open interval is
433 // [Symbol Value, End of section). The type, code or data, is determined by
434 // the mapping symbol name, $x for code, $d for data.
435 auto isCodeMapSymbol = [](const Symbol *b) {
436 return b->getName() == "$x" || b->getName().starts_with(Prefix: "$x.");
437 };
438 auto isDataMapSymbol = [](const Symbol *b) {
439 return b->getName() == "$d" || b->getName().starts_with(Prefix: "$d.");
440 };
441
442 // Collect mapping symbols for every executable InputSection.
443 for (ELFFileBase *file : ctx.objectFiles) {
444 for (Symbol *b : file->getLocalSymbols()) {
445 auto *def = dyn_cast<Defined>(Val: b);
446 if (!def)
447 continue;
448 if (!isCodeMapSymbol(def) && !isDataMapSymbol(def))
449 continue;
450 if (auto *sec = dyn_cast_or_null<InputSection>(Val: def->section))
451 if (sec->flags & SHF_EXECINSTR)
452 sectionMap[sec].push_back(x: def);
453 }
454 }
455 // For each InputSection make sure the mapping symbols are in sorted in
456 // ascending order and free from consecutive runs of mapping symbols with
457 // the same type. For example we must remove the redundant $d.1 from $x.0
458 // $d.0 $d.1 $x.1.
459 for (auto &kv : sectionMap) {
460 std::vector<const Defined *> &mapSyms = kv.second;
461 llvm::stable_sort(Range&: mapSyms, C: [](const Defined *a, const Defined *b) {
462 return a->value < b->value;
463 });
464 mapSyms.erase(
465 first: std::unique(first: mapSyms.begin(), last: mapSyms.end(),
466 binary_pred: [=](const Defined *a, const Defined *b) {
467 return isCodeMapSymbol(a) == isCodeMapSymbol(b);
468 }),
469 last: mapSyms.end());
470 // Always start with a Code Mapping Symbol.
471 if (!mapSyms.empty() && !isCodeMapSymbol(mapSyms.front()))
472 mapSyms.erase(position: mapSyms.begin());
473 }
474 initialized = true;
475}
476
477// Insert the PatchSections we have created back into the
478// InputSectionDescription. As inserting patches alters the addresses of
479// InputSections that follow them, we try and place the patches after all the
480// executable sections, although we may need to insert them earlier if the
481// InputSectionDescription is larger than the maximum branch range.
482void AArch64Err843419Patcher::insertPatches(
483 InputSectionDescription &isd, std::vector<Patch843419Section *> &patches) {
484 uint64_t isecLimit;
485 uint64_t prevIsecLimit = isd.sections.front()->outSecOff;
486 uint64_t patchUpperBound = prevIsecLimit + target->getThunkSectionSpacing();
487 uint64_t outSecAddr = isd.sections.front()->getParent()->addr;
488
489 // Set the outSecOff of patches to the place where we want to insert them.
490 // We use a similar strategy to Thunk placement. Place patches roughly
491 // every multiple of maximum branch range.
492 auto patchIt = patches.begin();
493 auto patchEnd = patches.end();
494 for (const InputSection *isec : isd.sections) {
495 isecLimit = isec->outSecOff + isec->getSize();
496 if (isecLimit > patchUpperBound) {
497 while (patchIt != patchEnd) {
498 if ((*patchIt)->getLDSTAddr() - outSecAddr >= prevIsecLimit)
499 break;
500 (*patchIt)->outSecOff = prevIsecLimit;
501 ++patchIt;
502 }
503 patchUpperBound = prevIsecLimit + target->getThunkSectionSpacing();
504 }
505 prevIsecLimit = isecLimit;
506 }
507 for (; patchIt != patchEnd; ++patchIt) {
508 (*patchIt)->outSecOff = isecLimit;
509 }
510
511 // Merge all patch sections. We use the outSecOff assigned above to
512 // determine the insertion point. This is ok as we only merge into an
513 // InputSectionDescription once per pass, and at the end of the pass
514 // assignAddresses() will recalculate all the outSecOff values.
515 SmallVector<InputSection *, 0> tmp;
516 tmp.reserve(N: isd.sections.size() + patches.size());
517 auto mergeCmp = [](const InputSection *a, const InputSection *b) {
518 if (a->outSecOff != b->outSecOff)
519 return a->outSecOff < b->outSecOff;
520 return isa<Patch843419Section>(Val: a) && !isa<Patch843419Section>(Val: b);
521 };
522 std::merge(first1: isd.sections.begin(), last1: isd.sections.end(), first2: patches.begin(),
523 last2: patches.end(), result: std::back_inserter(x&: tmp), comp: mergeCmp);
524 isd.sections = std::move(tmp);
525}
526
527// Given an erratum sequence that starts at address adrpAddr, with an
528// instruction that we need to patch at patcheeOffset from the start of
529// InputSection isec, create a Patch843419 Section and add it to the
530// Patches that we need to insert.
531static void implementPatch(uint64_t adrpAddr, uint64_t patcheeOffset,
532 InputSection *isec,
533 std::vector<Patch843419Section *> &patches) {
534 // There may be a relocation at the same offset that we are patching. There
535 // are four cases that we need to consider.
536 // Case 1: R_AARCH64_JUMP26 branch relocation. We have already patched this
537 // instance of the erratum on a previous patch and altered the relocation. We
538 // have nothing more to do.
539 // Case 2: A TLS Relaxation R_RELAX_TLS_IE_TO_LE. In this case the ADRP that
540 // we read will be transformed into a MOVZ later so we actually don't match
541 // the sequence and have nothing more to do.
542 // Case 3: A load/store register (unsigned immediate) class relocation. There
543 // are two of these R_AARCH_LD64_ABS_LO12_NC and R_AARCH_LD64_GOT_LO12_NC and
544 // they are both absolute. We need to add the same relocation to the patch,
545 // and replace the relocation with a R_AARCH_JUMP26 branch relocation.
546 // Case 4: No relocation. We must create a new R_AARCH64_JUMP26 branch
547 // relocation at the offset.
548 auto relIt = llvm::find_if(Range: isec->relocs(), P: [=](const Relocation &r) {
549 return r.offset == patcheeOffset;
550 });
551 if (relIt != isec->relocs().end() &&
552 (relIt->type == R_AARCH64_JUMP26 || relIt->expr == R_RELAX_TLS_IE_TO_LE))
553 return;
554
555 log(msg: "detected cortex-a53-843419 erratum sequence starting at " +
556 utohexstr(X: adrpAddr) + " in unpatched output.");
557
558 auto *ps = make<Patch843419Section>(args&: isec, args&: patcheeOffset);
559 patches.push_back(x: ps);
560
561 auto makeRelToPatch = [](uint64_t offset, Symbol *patchSym) {
562 return Relocation{.expr: R_PC, .type: R_AARCH64_JUMP26, .offset: offset, .addend: 0, .sym: patchSym};
563 };
564
565 if (relIt != isec->relocs().end()) {
566 ps->addReloc(r: {.expr: relIt->expr, .type: relIt->type, .offset: 0, .addend: relIt->addend, .sym: relIt->sym});
567 *relIt = makeRelToPatch(patcheeOffset, ps->patchSym);
568 } else
569 isec->addReloc(r: makeRelToPatch(patcheeOffset, ps->patchSym));
570}
571
572// Scan all the instructions in InputSectionDescription, for each instance of
573// the erratum sequence create a Patch843419Section. We return the list of
574// Patch843419Sections that need to be applied to the InputSectionDescription.
575std::vector<Patch843419Section *>
576AArch64Err843419Patcher::patchInputSectionDescription(
577 InputSectionDescription &isd) {
578 std::vector<Patch843419Section *> patches;
579 for (InputSection *isec : isd.sections) {
580 // LLD doesn't use the erratum sequence in SyntheticSections.
581 if (isa<SyntheticSection>(Val: isec))
582 continue;
583 // Use sectionMap to make sure we only scan code and not inline data.
584 // We have already sorted MapSyms in ascending order and removed consecutive
585 // mapping symbols of the same type. Our range of executable instructions to
586 // scan is therefore [codeSym->value, dataSym->value) or [codeSym->value,
587 // section size).
588 std::vector<const Defined *> &mapSyms = sectionMap[isec];
589
590 auto codeSym = mapSyms.begin();
591 while (codeSym != mapSyms.end()) {
592 auto dataSym = std::next(x: codeSym);
593 uint64_t off = (*codeSym)->value;
594 uint64_t limit = (dataSym == mapSyms.end()) ? isec->content().size()
595 : (*dataSym)->value;
596
597 while (off < limit) {
598 uint64_t startAddr = isec->getVA(offset: off);
599 if (uint64_t patcheeOffset =
600 scanCortexA53Errata843419(isec, off, limit))
601 implementPatch(adrpAddr: startAddr, patcheeOffset, isec, patches);
602 }
603 if (dataSym == mapSyms.end())
604 break;
605 codeSym = std::next(x: dataSym);
606 }
607 }
608 return patches;
609}
610
611// For each InputSectionDescription make one pass over the executable sections
612// looking for the erratum sequence; creating a synthetic Patch843419Section
613// for each instance found. We insert these synthetic patch sections after the
614// executable code in each InputSectionDescription.
615//
616// PreConditions:
617// The Output and Input Sections have had their final addresses assigned.
618//
619// PostConditions:
620// Returns true if at least one patch was added. The addresses of the
621// Output and Input Sections may have been changed.
622// Returns false if no patches were required and no changes were made.
623bool AArch64Err843419Patcher::createFixes() {
624 if (!initialized)
625 init();
626
627 bool addressesChanged = false;
628 for (OutputSection *os : outputSections) {
629 if (!(os->flags & SHF_ALLOC) || !(os->flags & SHF_EXECINSTR))
630 continue;
631 for (SectionCommand *cmd : os->commands)
632 if (auto *isd = dyn_cast<InputSectionDescription>(Val: cmd)) {
633 std::vector<Patch843419Section *> patches =
634 patchInputSectionDescription(isd&: *isd);
635 if (!patches.empty()) {
636 insertPatches(isd&: *isd, patches);
637 addressesChanged = true;
638 }
639 }
640 }
641 return addressesChanged;
642}
643

source code of lld/ELF/AArch64ErrataFix.cpp