Bug Summary

File:build/source/lld/ELF/AArch64ErrataFix.cpp
Warning:line 507, column 27
Assigned value is garbage or undefined

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name AArch64ErrataFix.cpp -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=cplusplus -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -mframe-pointer=none -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -ffunction-sections -fdata-sections -fcoverage-compilation-dir=/build/source/build-llvm/tools/clang/stage2-bins -resource-dir /usr/lib/llvm-17/lib/clang/17 -D LLD_VENDOR="Debian" -D _DEBUG -D _GLIBCXX_ASSERTIONS -D _GNU_SOURCE -D _LIBCPP_ENABLE_ASSERTIONS -D __STDC_CONSTANT_MACROS -D __STDC_FORMAT_MACROS -D __STDC_LIMIT_MACROS -I tools/lld/ELF -I /build/source/lld/ELF -I /build/source/lld/include -I tools/lld/include -I include -I /build/source/llvm/include -D _FORTIFY_SOURCE=2 -D NDEBUG -U NDEBUG -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/x86_64-linux-gnu/c++/10 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/backward -internal-isystem /usr/lib/llvm-17/lib/clang/17/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fmacro-prefix-map=/build/source/build-llvm/tools/clang/stage2-bins=build-llvm/tools/clang/stage2-bins -fmacro-prefix-map=/build/source/= -fcoverage-prefix-map=/build/source/build-llvm/tools/clang/stage2-bins=build-llvm/tools/clang/stage2-bins -fcoverage-prefix-map=/build/source/= -source-date-epoch 1683717183 -O2 -Wno-unused-command-line-argument -Wno-unused-parameter -Wwrite-strings -Wno-missing-field-initializers -Wno-long-long -Wno-maybe-uninitialized -Wno-class-memaccess -Wno-redundant-move -Wno-pessimizing-move -Wno-noexcept-type -Wno-comment -Wno-misleading-indentation -std=c++17 -fdeprecated-macro -fdebug-compilation-dir=/build/source/build-llvm/tools/clang/stage2-bins -fdebug-prefix-map=/build/source/build-llvm/tools/clang/stage2-bins=build-llvm/tools/clang/stage2-bins -fdebug-prefix-map=/build/source/= -ferror-limit 19 -fvisibility-inlines-hidden -stack-protector 2 -fgnuc-version=4.2.1 -fcolor-diagnostics -vectorize-loops -vectorize-slp -analyzer-output=html -analyzer-config stable-report-filename=true -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/scan-build-2023-05-10-133810-16478-1 -x c++ /build/source/lld/ELF/AArch64ErrataFix.cpp
1//===- AArch64ErrataFix.cpp -----------------------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8// This file implements Section Patching for the purpose of working around
9// the AArch64 Cortex-53 errata 843419 that affects r0p0, r0p1, r0p2 and r0p4
10// versions of the core.
11//
12// The general principle is that an erratum sequence of one or
13// more instructions is detected in the instruction stream, one of the
14// instructions in the sequence is replaced with a branch to a patch sequence
15// of replacement instructions. At the end of the replacement sequence the
16// patch branches back to the instruction stream.
17
18// This technique is only suitable for fixing an erratum when:
19// - There is a set of necessary conditions required to trigger the erratum that
20// can be detected at static link time.
21// - There is a set of replacement instructions that can be used to remove at
22// least one of the necessary conditions that trigger the erratum.
23// - We can overwrite an instruction in the erratum sequence with a branch to
24// the replacement sequence.
25// - We can place the replacement sequence within range of the branch.
26//===----------------------------------------------------------------------===//
27
28#include "AArch64ErrataFix.h"
29#include "InputFiles.h"
30#include "LinkerScript.h"
31#include "OutputSections.h"
32#include "Relocations.h"
33#include "Symbols.h"
34#include "SyntheticSections.h"
35#include "Target.h"
36#include "lld/Common/CommonLinkerContext.h"
37#include "lld/Common/Strings.h"
38#include "llvm/Support/Endian.h"
39#include <algorithm>
40
41using namespace llvm;
42using namespace llvm::ELF;
43using namespace llvm::object;
44using namespace llvm::support;
45using namespace llvm::support::endian;
46using namespace lld;
47using namespace lld::elf;
48
49// Helper functions to identify instructions and conditions needed to trigger
50// the Cortex-A53-843419 erratum.
51
52// ADRP
53// | 1 | immlo (2) | 1 | 0 0 0 0 | immhi (19) | Rd (5) |
54static bool isADRP(uint32_t instr) {
55 return (instr & 0x9f000000) == 0x90000000;
56}
57
58// Load and store bit patterns from ARMv8-A.
59// Instructions appear in order of appearance starting from table in
60// C4.1.3 Loads and Stores.
61
62// All loads and stores have 1 (at bit position 27), (0 at bit position 25).
63// | op0 x op1 (2) | 1 op2 0 op3 (2) | x | op4 (5) | xxxx | op5 (2) | x (10) |
64static bool isLoadStoreClass(uint32_t instr) {
65 return (instr & 0x0a000000) == 0x08000000;
66}
67
68// LDN/STN multiple no offset
69// | 0 Q 00 | 1100 | 0 L 00 | 0000 | opcode (4) | size (2) | Rn (5) | Rt (5) |
70// LDN/STN multiple post-indexed
71// | 0 Q 00 | 1100 | 1 L 0 | Rm (5)| opcode (4) | size (2) | Rn (5) | Rt (5) |
72// L == 0 for stores.
73
74// Utility routine to decode opcode field of LDN/STN multiple structure
75// instructions to find the ST1 instructions.
76// opcode == 0010 ST1 4 registers.
77// opcode == 0110 ST1 3 registers.
78// opcode == 0111 ST1 1 register.
79// opcode == 1010 ST1 2 registers.
80static bool isST1MultipleOpcode(uint32_t instr) {
81 return (instr & 0x0000f000) == 0x00002000 ||
82 (instr & 0x0000f000) == 0x00006000 ||
83 (instr & 0x0000f000) == 0x00007000 ||
84 (instr & 0x0000f000) == 0x0000a000;
85}
86
87static bool isST1Multiple(uint32_t instr) {
88 return (instr & 0xbfff0000) == 0x0c000000 && isST1MultipleOpcode(instr);
89}
90
91// Writes to Rn (writeback).
92static bool isST1MultiplePost(uint32_t instr) {
93 return (instr & 0xbfe00000) == 0x0c800000 && isST1MultipleOpcode(instr);
94}
95
96// LDN/STN single no offset
97// | 0 Q 00 | 1101 | 0 L R 0 | 0000 | opc (3) S | size (2) | Rn (5) | Rt (5)|
98// LDN/STN single post-indexed
99// | 0 Q 00 | 1101 | 1 L R | Rm (5) | opc (3) S | size (2) | Rn (5) | Rt (5)|
100// L == 0 for stores
101
102// Utility routine to decode opcode field of LDN/STN single structure
103// instructions to find the ST1 instructions.
104// R == 0 for ST1 and ST3, R == 1 for ST2 and ST4.
105// opcode == 000 ST1 8-bit.
106// opcode == 010 ST1 16-bit.
107// opcode == 100 ST1 32 or 64-bit (Size determines which).
108static bool isST1SingleOpcode(uint32_t instr) {
109 return (instr & 0x0040e000) == 0x00000000 ||
110 (instr & 0x0040e000) == 0x00004000 ||
111 (instr & 0x0040e000) == 0x00008000;
112}
113
114static bool isST1Single(uint32_t instr) {
115 return (instr & 0xbfff0000) == 0x0d000000 && isST1SingleOpcode(instr);
116}
117
118// Writes to Rn (writeback).
119static bool isST1SinglePost(uint32_t instr) {
120 return (instr & 0xbfe00000) == 0x0d800000 && isST1SingleOpcode(instr);
121}
122
123static bool isST1(uint32_t instr) {
124 return isST1Multiple(instr) || isST1MultiplePost(instr) ||
125 isST1Single(instr) || isST1SinglePost(instr);
126}
127
128// Load/store exclusive
129// | size (2) 00 | 1000 | o2 L o1 | Rs (5) | o0 | Rt2 (5) | Rn (5) | Rt (5) |
130// L == 0 for Stores.
131static bool isLoadStoreExclusive(uint32_t instr) {
132 return (instr & 0x3f000000) == 0x08000000;
133}
134
135static bool isLoadExclusive(uint32_t instr) {
136 return (instr & 0x3f400000) == 0x08400000;
137}
138
139// Load register literal
140// | opc (2) 01 | 1 V 00 | imm19 | Rt (5) |
141static bool isLoadLiteral(uint32_t instr) {
142 return (instr & 0x3b000000) == 0x18000000;
143}
144
145// Load/store no-allocate pair
146// (offset)
147// | opc (2) 10 | 1 V 00 | 0 L | imm7 | Rt2 (5) | Rn (5) | Rt (5) |
148// L == 0 for stores.
149// Never writes to register
150static bool isSTNP(uint32_t instr) {
151 return (instr & 0x3bc00000) == 0x28000000;
152}
153
154// Load/store register pair
155// (post-indexed)
156// | opc (2) 10 | 1 V 00 | 1 L | imm7 | Rt2 (5) | Rn (5) | Rt (5) |
157// L == 0 for stores, V == 0 for Scalar, V == 1 for Simd/FP
158// Writes to Rn.
159static bool isSTPPost(uint32_t instr) {
160 return (instr & 0x3bc00000) == 0x28800000;
161}
162
163// (offset)
164// | opc (2) 10 | 1 V 01 | 0 L | imm7 | Rt2 (5) | Rn (5) | Rt (5) |
165static bool isSTPOffset(uint32_t instr) {
166 return (instr & 0x3bc00000) == 0x29000000;
167}
168
169// (pre-index)
170// | opc (2) 10 | 1 V 01 | 1 L | imm7 | Rt2 (5) | Rn (5) | Rt (5) |
171// Writes to Rn.
172static bool isSTPPre(uint32_t instr) {
173 return (instr & 0x3bc00000) == 0x29800000;
174}
175
176static bool isSTP(uint32_t instr) {
177 return isSTPPost(instr) || isSTPOffset(instr) || isSTPPre(instr);
178}
179
180// Load/store register (unscaled immediate)
181// | size (2) 11 | 1 V 00 | opc (2) 0 | imm9 | 00 | Rn (5) | Rt (5) |
182// V == 0 for Scalar, V == 1 for Simd/FP.
183static bool isLoadStoreUnscaled(uint32_t instr) {
184 return (instr & 0x3b000c00) == 0x38000000;
185}
186
187// Load/store register (immediate post-indexed)
188// | size (2) 11 | 1 V 00 | opc (2) 0 | imm9 | 01 | Rn (5) | Rt (5) |
189static bool isLoadStoreImmediatePost(uint32_t instr) {
190 return (instr & 0x3b200c00) == 0x38000400;
191}
192
193// Load/store register (unprivileged)
194// | size (2) 11 | 1 V 00 | opc (2) 0 | imm9 | 10 | Rn (5) | Rt (5) |
195static bool isLoadStoreUnpriv(uint32_t instr) {
196 return (instr & 0x3b200c00) == 0x38000800;
197}
198
199// Load/store register (immediate pre-indexed)
200// | size (2) 11 | 1 V 00 | opc (2) 0 | imm9 | 11 | Rn (5) | Rt (5) |
201static bool isLoadStoreImmediatePre(uint32_t instr) {
202 return (instr & 0x3b200c00) == 0x38000c00;
203}
204
205// Load/store register (register offset)
206// | size (2) 11 | 1 V 00 | opc (2) 1 | Rm (5) | option (3) S | 10 | Rn | Rt |
207static bool isLoadStoreRegisterOff(uint32_t instr) {
208 return (instr & 0x3b200c00) == 0x38200800;
209}
210
211// Load/store register (unsigned immediate)
212// | size (2) 11 | 1 V 01 | opc (2) | imm12 | Rn (5) | Rt (5) |
213static bool isLoadStoreRegisterUnsigned(uint32_t instr) {
214 return (instr & 0x3b000000) == 0x39000000;
215}
216
217// Rt is always in bit position 0 - 4.
218static uint32_t getRt(uint32_t instr) { return (instr & 0x1f); }
219
220// Rn is always in bit position 5 - 9.
221static uint32_t getRn(uint32_t instr) { return (instr >> 5) & 0x1f; }
222
223// C4.1.2 Branches, Exception Generating and System instructions
224// | op0 (3) 1 | 01 op1 (4) | x (22) |
225// op0 == 010 101 op1 == 0xxx Conditional Branch.
226// op0 == 110 101 op1 == 1xxx Unconditional Branch Register.
227// op0 == x00 101 op1 == xxxx Unconditional Branch immediate.
228// op0 == x01 101 op1 == 0xxx Compare and branch immediate.
229// op0 == x01 101 op1 == 1xxx Test and branch immediate.
230static bool isBranch(uint32_t instr) {
231 return ((instr & 0xfe000000) == 0xd6000000) || // Cond branch.
232 ((instr & 0xfe000000) == 0x54000000) || // Uncond branch reg.
233 ((instr & 0x7c000000) == 0x14000000) || // Uncond branch imm.
234 ((instr & 0x7c000000) == 0x34000000); // Compare and test branch.
235}
236
237static bool isV8SingleRegisterNonStructureLoadStore(uint32_t instr) {
238 return isLoadStoreUnscaled(instr) || isLoadStoreImmediatePost(instr) ||
239 isLoadStoreUnpriv(instr) || isLoadStoreImmediatePre(instr) ||
240 isLoadStoreRegisterOff(instr) || isLoadStoreRegisterUnsigned(instr);
241}
242
243// Note that this function refers to v8.0 only and does not include the
244// additional load and store instructions added for in later revisions of
245// the architecture such as the Atomic memory operations introduced
246// in v8.1.
247static bool isV8NonStructureLoad(uint32_t instr) {
248 if (isLoadExclusive(instr))
249 return true;
250 if (isLoadLiteral(instr))
251 return true;
252 else if (isV8SingleRegisterNonStructureLoadStore(instr)) {
253 // For Load and Store single register, Loads are derived from a
254 // combination of the Size, V and Opc fields.
255 uint32_t size = (instr >> 30) & 0xff;
256 uint32_t v = (instr >> 26) & 0x1;
257 uint32_t opc = (instr >> 22) & 0x3;
258 // For the load and store instructions that we are decoding.
259 // Opc == 0 are all stores.
260 // Opc == 1 with a couple of exceptions are loads. The exceptions are:
261 // Size == 00 (0), V == 1, Opc == 10 (2) which is a store and
262 // Size == 11 (3), V == 0, Opc == 10 (2) which is a prefetch.
263 return opc != 0 && !(size == 0 && v == 1 && opc == 2) &&
264 !(size == 3 && v == 0 && opc == 2);
265 }
266 return false;
267}
268
269// The following decode instructions are only complete up to the instructions
270// needed for errata 843419.
271
272// Instruction with writeback updates the index register after the load/store.
273static bool hasWriteback(uint32_t instr) {
274 return isLoadStoreImmediatePre(instr) || isLoadStoreImmediatePost(instr) ||
275 isSTPPre(instr) || isSTPPost(instr) || isST1SinglePost(instr) ||
276 isST1MultiplePost(instr);
277}
278
279// For the load and store class of instructions, a load can write to the
280// destination register, a load and a store can write to the base register when
281// the instruction has writeback.
282static bool doesLoadStoreWriteToReg(uint32_t instr, uint32_t reg) {
283 return (isV8NonStructureLoad(instr) && getRt(instr) == reg) ||
284 (hasWriteback(instr) && getRn(instr) == reg);
285}
286
287// Scanner for Cortex-A53 errata 843419
288// Full details are available in the Cortex A53 MPCore revision 0 Software
289// Developers Errata Notice (ARM-EPM-048406).
290//
291// The instruction sequence that triggers the erratum is common in compiled
292// AArch64 code, however it is sensitive to the offset of the sequence within
293// a 4k page. This means that by scanning and fixing the patch after we have
294// assigned addresses we only need to disassemble and fix instances of the
295// sequence in the range of affected offsets.
296//
297// In summary the erratum conditions are a series of 4 instructions:
298// 1.) An ADRP instruction that writes to register Rn with low 12 bits of
299// address of instruction either 0xff8 or 0xffc.
300// 2.) A load or store instruction that can be:
301// - A single register load or store, of either integer or vector registers.
302// - An STP or STNP, of either integer or vector registers.
303// - An Advanced SIMD ST1 store instruction.
304// - Must not write to Rn, but may optionally read from it.
305// 3.) An optional instruction that is not a branch and does not write to Rn.
306// 4.) A load or store from the Load/store register (unsigned immediate) class
307// that uses Rn as the base address register.
308//
309// Note that we do not attempt to scan for Sequence 2 as described in the
310// Software Developers Errata Notice as this has been assessed to be extremely
311// unlikely to occur in compiled code. This matches gold and ld.bfd behavior.
312
313// Return true if the Instruction sequence Adrp, Instr2, and Instr4 match
314// the erratum sequence. The Adrp, Instr2 and Instr4 correspond to 1.), 2.),
315// and 4.) in the Scanner for Cortex-A53 errata comment above.
316static bool is843419ErratumSequence(uint32_t instr1, uint32_t instr2,
317 uint32_t instr4) {
318 if (!isADRP(instr1))
319 return false;
320
321 uint32_t rn = getRt(instr1);
322 return isLoadStoreClass(instr2) &&
323 (isLoadStoreExclusive(instr2) || isLoadLiteral(instr2) ||
324 isV8SingleRegisterNonStructureLoadStore(instr2) || isSTP(instr2) ||
325 isSTNP(instr2) || isST1(instr2)) &&
326 !doesLoadStoreWriteToReg(instr2, rn) &&
327 isLoadStoreRegisterUnsigned(instr4) && getRn(instr4) == rn;
328}
329
330// Scan the instruction sequence starting at Offset Off from the base of
331// InputSection isec. We update Off in this function rather than in the caller
332// as we can skip ahead much further into the section when we know how many
333// instructions we've scanned.
334// Return the offset of the load or store instruction in isec that we want to
335// patch or 0 if no patch required.
336static uint64_t scanCortexA53Errata843419(InputSection *isec, uint64_t &off,
337 uint64_t limit) {
338 uint64_t isecAddr = isec->getVA(0);
339
340 // Advance Off so that (isecAddr + Off) modulo 0x1000 is at least 0xff8.
341 uint64_t initialPageOff = (isecAddr + off) & 0xfff;
342 if (initialPageOff < 0xff8)
343 off += 0xff8 - initialPageOff;
344
345 bool optionalAllowed = limit - off > 12;
346 if (off >= limit || limit - off < 12) {
347 // Need at least 3 4-byte sized instructions to trigger erratum.
348 off = limit;
349 return 0;
350 }
351
352 uint64_t patchOff = 0;
353 const uint8_t *buf = isec->content().begin();
354 const ulittle32_t *instBuf = reinterpret_cast<const ulittle32_t *>(buf + off);
355 uint32_t instr1 = *instBuf++;
356 uint32_t instr2 = *instBuf++;
357 uint32_t instr3 = *instBuf++;
358 if (is843419ErratumSequence(instr1, instr2, instr3)) {
359 patchOff = off + 8;
360 } else if (optionalAllowed && !isBranch(instr3)) {
361 uint32_t instr4 = *instBuf++;
362 if (is843419ErratumSequence(instr1, instr2, instr4))
363 patchOff = off + 12;
364 }
365 if (((isecAddr + off) & 0xfff) == 0xff8)
366 off += 4;
367 else
368 off += 0xffc;
369 return patchOff;
370}
371
372class elf::Patch843419Section final : public SyntheticSection {
373public:
374 Patch843419Section(InputSection *p, uint64_t off);
375
376 void writeTo(uint8_t *buf) override;
377
378 size_t getSize() const override { return 8; }
379
380 uint64_t getLDSTAddr() const;
381
382 static bool classof(const SectionBase *d) {
383 return d->kind() == InputSectionBase::Synthetic && d->name == ".text.patch";
384 }
385
386 // The Section we are patching.
387 const InputSection *patchee;
388 // The offset of the instruction in the patchee section we are patching.
389 uint64_t patcheeOffset;
390 // A label for the start of the Patch that we can use as a relocation target.
391 Symbol *patchSym;
392};
393
394Patch843419Section::Patch843419Section(InputSection *p, uint64_t off)
395 : SyntheticSection(SHF_ALLOC | SHF_EXECINSTR, SHT_PROGBITS, 4,
396 ".text.patch"),
397 patchee(p), patcheeOffset(off) {
398 this->parent = p->getParent();
399 patchSym = addSyntheticLocal(
400 saver().save("__CortexA53843419_" + utohexstr(getLDSTAddr())), STT_FUNC,
401 0, getSize(), *this);
402 addSyntheticLocal(saver().save("$x"), STT_NOTYPE, 0, 0, *this);
403}
404
405uint64_t Patch843419Section::getLDSTAddr() const {
406 return patchee->getVA(patcheeOffset);
407}
408
409void Patch843419Section::writeTo(uint8_t *buf) {
410 // Copy the instruction that we will be replacing with a branch in the
411 // patchee Section.
412 write32le(buf, read32le(patchee->content().begin() + patcheeOffset));
413
414 // Apply any relocation transferred from the original patchee section.
415 target->relocateAlloc(*this, buf);
416
417 // Return address is the next instruction after the one we have just copied.
418 uint64_t s = getLDSTAddr() + 4;
419 uint64_t p = patchSym->getVA() + 4;
420 target->relocateNoSym(buf + 4, R_AARCH64_JUMP26, s - p);
421}
422
423void AArch64Err843419Patcher::init() {
424 // The AArch64 ABI permits data in executable sections. We must avoid scanning
425 // this data as if it were instructions to avoid false matches. We use the
426 // mapping symbols in the InputObjects to identify this data, caching the
427 // results in sectionMap so we don't have to recalculate it each pass.
428
429 // The ABI Section 4.5.4 Mapping symbols; defines local symbols that describe
430 // half open intervals [Symbol Value, Next Symbol Value) of code and data
431 // within sections. If there is no next symbol then the half open interval is
432 // [Symbol Value, End of section). The type, code or data, is determined by
433 // the mapping symbol name, $x for code, $d for data.
434 auto isCodeMapSymbol = [](const Symbol *b) {
435 return b->getName() == "$x" || b->getName().startswith("$x.");
436 };
437 auto isDataMapSymbol = [](const Symbol *b) {
438 return b->getName() == "$d" || b->getName().startswith("$d.");
439 };
440
441 // Collect mapping symbols for every executable InputSection.
442 for (ELFFileBase *file : ctx.objectFiles) {
443 for (Symbol *b : file->getLocalSymbols()) {
444 auto *def = dyn_cast<Defined>(b);
445 if (!def)
446 continue;
447 if (!isCodeMapSymbol(def) && !isDataMapSymbol(def))
448 continue;
449 if (auto *sec = dyn_cast_or_null<InputSection>(def->section))
450 if (sec->flags & SHF_EXECINSTR)
451 sectionMap[sec].push_back(def);
452 }
453 }
454 // For each InputSection make sure the mapping symbols are in sorted in
455 // ascending order and free from consecutive runs of mapping symbols with
456 // the same type. For example we must remove the redundant $d.1 from $x.0
457 // $d.0 $d.1 $x.1.
458 for (auto &kv : sectionMap) {
459 std::vector<const Defined *> &mapSyms = kv.second;
460 llvm::stable_sort(mapSyms, [](const Defined *a, const Defined *b) {
461 return a->value < b->value;
462 });
463 mapSyms.erase(
464 std::unique(mapSyms.begin(), mapSyms.end(),
465 [=](const Defined *a, const Defined *b) {
466 return isCodeMapSymbol(a) == isCodeMapSymbol(b);
467 }),
468 mapSyms.end());
469 // Always start with a Code Mapping Symbol.
470 if (!mapSyms.empty() && !isCodeMapSymbol(mapSyms.front()))
471 mapSyms.erase(mapSyms.begin());
472 }
473 initialized = true;
474}
475
476// Insert the PatchSections we have created back into the
477// InputSectionDescription. As inserting patches alters the addresses of
478// InputSections that follow them, we try and place the patches after all the
479// executable sections, although we may need to insert them earlier if the
480// InputSectionDescription is larger than the maximum branch range.
481void AArch64Err843419Patcher::insertPatches(
482 InputSectionDescription &isd, std::vector<Patch843419Section *> &patches) {
483 uint64_t isecLimit;
13
←
'isecLimit' declared without an initial value
→
484 uint64_t prevIsecLimit = isd.sections.front()->outSecOff;
485 uint64_t patchUpperBound = prevIsecLimit + target->getThunkSectionSpacing();
486 uint64_t outSecAddr = isd.sections.front()->getParent()->addr;
487
488 // Set the outSecOff of patches to the place where we want to insert them.
489 // We use a similar strategy to Thunk placement. Place patches roughly
490 // every multiple of maximum branch range.
491 auto patchIt = patches.begin();
492 auto patchEnd = patches.end();
493 for (const InputSection *isec : isd.sections) {
14
←
Assuming '__begin1' is equal to '__end1'
→
494 isecLimit = isec->outSecOff + isec->getSize();
495 if (isecLimit > patchUpperBound) {
496 while (patchIt != patchEnd) {
497 if ((*patchIt)->getLDSTAddr() - outSecAddr >= prevIsecLimit)
498 break;
499 (*patchIt)->outSecOff = prevIsecLimit;
500 ++patchIt;
501 }
502 patchUpperBound = prevIsecLimit + target->getThunkSectionSpacing();
503 }
504 prevIsecLimit = isecLimit;
505 }
506 for (; patchIt != patchEnd; ++patchIt) {
15
←
Loop condition is true. Entering loop body
→
507 (*patchIt)->outSecOff = isecLimit;
16
←
Assigned value is garbage or undefined
508 }
509
510 // Merge all patch sections. We use the outSecOff assigned above to
511 // determine the insertion point. This is ok as we only merge into an
512 // InputSectionDescription once per pass, and at the end of the pass
513 // assignAddresses() will recalculate all the outSecOff values.
514 SmallVector<InputSection *, 0> tmp;
515 tmp.reserve(isd.sections.size() + patches.size());
516 auto mergeCmp = [](const InputSection *a, const InputSection *b) {
517 if (a->outSecOff != b->outSecOff)
518 return a->outSecOff < b->outSecOff;
519 return isa<Patch843419Section>(a) && !isa<Patch843419Section>(b);
520 };
521 std::merge(isd.sections.begin(), isd.sections.end(), patches.begin(),
522 patches.end(), std::back_inserter(tmp), mergeCmp);
523 isd.sections = std::move(tmp);
524}
525
526// Given an erratum sequence that starts at address adrpAddr, with an
527// instruction that we need to patch at patcheeOffset from the start of
528// InputSection isec, create a Patch843419 Section and add it to the
529// Patches that we need to insert.
530static void implementPatch(uint64_t adrpAddr, uint64_t patcheeOffset,
531 InputSection *isec,
532 std::vector<Patch843419Section *> &patches) {
533 // There may be a relocation at the same offset that we are patching. There
534 // are four cases that we need to consider.
535 // Case 1: R_AARCH64_JUMP26 branch relocation. We have already patched this
536 // instance of the erratum on a previous patch and altered the relocation. We
537 // have nothing more to do.
538 // Case 2: A TLS Relaxation R_RELAX_TLS_IE_TO_LE. In this case the ADRP that
539 // we read will be transformed into a MOVZ later so we actually don't match
540 // the sequence and have nothing more to do.
541 // Case 3: A load/store register (unsigned immediate) class relocation. There
542 // are two of these R_AARCH_LD64_ABS_LO12_NC and R_AARCH_LD64_GOT_LO12_NC and
543 // they are both absolute. We need to add the same relocation to the patch,
544 // and replace the relocation with a R_AARCH_JUMP26 branch relocation.
545 // Case 4: No relocation. We must create a new R_AARCH64_JUMP26 branch
546 // relocation at the offset.
547 auto relIt = llvm::find_if(isec->relocs(), [=](const Relocation &r) {
548 return r.offset == patcheeOffset;
549 });
550 if (relIt != isec->relocs().end() &&
551 (relIt->type == R_AARCH64_JUMP26 || relIt->expr == R_RELAX_TLS_IE_TO_LE))
552 return;
553
554 log("detected cortex-a53-843419 erratum sequence starting at " +
555 utohexstr(adrpAddr) + " in unpatched output.");
556
557 auto *ps = make<Patch843419Section>(isec, patcheeOffset);
558 patches.push_back(ps);
559
560 auto makeRelToPatch = [](uint64_t offset, Symbol *patchSym) {
561 return Relocation{R_PC, R_AARCH64_JUMP26, offset, 0, patchSym};
562 };
563
564 if (relIt != isec->relocs().end()) {
565 ps->addReloc({relIt->expr, relIt->type, 0, relIt->addend, relIt->sym});
566 *relIt = makeRelToPatch(patcheeOffset, ps->patchSym);
567 } else
568 isec->addReloc(makeRelToPatch(patcheeOffset, ps->patchSym));
569}
570
571// Scan all the instructions in InputSectionDescription, for each instance of
572// the erratum sequence create a Patch843419Section. We return the list of
573// Patch843419Sections that need to be applied to the InputSectionDescription.
574std::vector<Patch843419Section *>
575AArch64Err843419Patcher::patchInputSectionDescription(
576 InputSectionDescription &isd) {
577 std::vector<Patch843419Section *> patches;
578 for (InputSection *isec : isd.sections) {
579 // LLD doesn't use the erratum sequence in SyntheticSections.
580 if (isa<SyntheticSection>(isec))
581 continue;
582 // Use sectionMap to make sure we only scan code and not inline data.
583 // We have already sorted MapSyms in ascending order and removed consecutive
584 // mapping symbols of the same type. Our range of executable instructions to
585 // scan is therefore [codeSym->value, dataSym->value) or [codeSym->value,
586 // section size).
587 std::vector<const Defined *> &mapSyms = sectionMap[isec];
588
589 auto codeSym = mapSyms.begin();
590 while (codeSym != mapSyms.end()) {
591 auto dataSym = std::next(codeSym);
592 uint64_t off = (*codeSym)->value;
593 uint64_t limit = (dataSym == mapSyms.end()) ? isec->content().size()
594 : (*dataSym)->value;
595
596 while (off < limit) {
597 uint64_t startAddr = isec->getVA(off);
598 if (uint64_t patcheeOffset =
599 scanCortexA53Errata843419(isec, off, limit))
600 implementPatch(startAddr, patcheeOffset, isec, patches);
601 }
602 if (dataSym == mapSyms.end())
603 break;
604 codeSym = std::next(dataSym);
605 }
606 }
607 return patches;
608}
609
610// For each InputSectionDescription make one pass over the executable sections
611// looking for the erratum sequence; creating a synthetic Patch843419Section
612// for each instance found. We insert these synthetic patch sections after the
613// executable code in each InputSectionDescription.
614//
615// PreConditions:
616// The Output and Input Sections have had their final addresses assigned.
617//
618// PostConditions:
619// Returns true if at least one patch was added. The addresses of the
620// Output and Input Sections may have been changed.
621// Returns false if no patches were required and no changes were made.
622bool AArch64Err843419Patcher::createFixes() {
623 if (!initialized)
1
Assuming field 'initialized' is true
→
2
←
Taking false branch
→
624 init();
625
626 bool addressesChanged = false;
627 for (OutputSection *os : outputSections) {
3
←
Assuming '__begin1' is not equal to '__end1'
→
628 if (!(os->flags & SHF_ALLOC) || !(os->flags & SHF_EXECINSTR))
4
←
Assuming the condition is false
→
5
←
Assuming the condition is false
→
6
←
Taking false branch
→
629 continue;
630 for (SectionCommand *cmd : os->commands)
7
←
Assuming '__begin2' is not equal to '__end2'
→
631 if (auto *isd
8.1
'isd' is non-null
 = dyn_cast<InputSectionDescription>(cmd)) {
8
←
Assuming 'cmd' is a 'CastReturnType'
→
9
←
Taking true branch
→
632 std::vector<Patch843419Section *> patches =
633 patchInputSectionDescription(*isd);
634 if (!patches.empty()) {
10
←
Assuming the condition is true
→
11
←
Taking true branch
→
635 insertPatches(*isd, patches);
12
←
Calling 'AArch64Err843419Patcher::insertPatches'
→
636 addressesChanged = true;
637 }
638 }
639 }
640 return addressesChanged;
641}