| File: | build/llvm-toolchain-snapshot-15~++20220214111405+a87d3ba61c64/lld/ELF/ARMErrataFix.cpp |
| Warning: | line 209, column 12 Value stored to 'destAddr' during its initialization is never read |
Press '?' to see keyboard shortcuts
Keyboard shortcuts:
| 1 | //===- ARMErrataFix.cpp ---------------------------------------------------===// |
| 2 | // |
| 3 | // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. |
| 4 | // See https://llvm.org/LICENSE.txt for license information. |
| 5 | // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception |
| 6 | // |
| 7 | //===----------------------------------------------------------------------===// |
| 8 | // This file implements Section Patching for the purpose of working around the |
| 9 | // Cortex-a8 erratum 657417 "A 32bit branch instruction that spans 2 4K regions |
| 10 | // can result in an incorrect instruction fetch or processor deadlock." The |
| 11 | // erratum affects all but r1p7, r2p5, r2p6, r3p1 and r3p2 revisions of the |
| 12 | // Cortex-A8. A high level description of the patching technique is given in |
| 13 | // the opening comment of AArch64ErrataFix.cpp. |
| 14 | //===----------------------------------------------------------------------===// |
| 15 | |
| 16 | #include "ARMErrataFix.h" |
| 17 | #include "LinkerScript.h" |
| 18 | #include "OutputSections.h" |
| 19 | #include "Relocations.h" |
| 20 | #include "Symbols.h" |
| 21 | #include "SyntheticSections.h" |
| 22 | #include "Target.h" |
| 23 | #include "lld/Common/CommonLinkerContext.h" |
| 24 | #include "lld/Common/Strings.h" |
| 25 | #include "llvm/Support/Endian.h" |
| 26 | #include <algorithm> |
| 27 | |
| 28 | using namespace llvm; |
| 29 | using namespace llvm::ELF; |
| 30 | using namespace llvm::object; |
| 31 | using namespace llvm::support; |
| 32 | using namespace llvm::support::endian; |
| 33 | using namespace lld; |
| 34 | using namespace lld::elf; |
| 35 | |
| 36 | // The documented title for Erratum 657417 is: |
| 37 | // "A 32bit branch instruction that spans two 4K regions can result in an |
| 38 | // incorrect instruction fetch or processor deadlock". Graphically using a |
| 39 | // 32-bit B.w instruction encoded as a pair of halfwords 0xf7fe 0xbfff |
| 40 | // xxxxxx000 // Memory region 1 start |
| 41 | // target: |
| 42 | // ... |
| 43 | // xxxxxxffe f7fe // First halfword of branch to target: |
| 44 | // xxxxxx000 // Memory region 2 start |
| 45 | // xxxxxx002 bfff // Second halfword of branch to target: |
| 46 | // |
| 47 | // The specific trigger conditions that can be detected at link time are: |
| 48 | // - There is a 32-bit Thumb-2 branch instruction with an address of the form |
| 49 | // xxxxxxFFE. The first 2 bytes of the instruction are in 4KiB region 1, the |
| 50 | // second 2 bytes are in region 2. |
| 51 | // - The branch instruction is one of BLX, BL, B.w BCC.w |
| 52 | // - The instruction preceding the branch is a 32-bit non-branch instruction. |
| 53 | // - The target of the branch is in region 1. |
| 54 | // |
| 55 | // The linker mitigation for the fix is to redirect any branch that meets the |
| 56 | // erratum conditions to a patch section containing a branch to the target. |
| 57 | // |
| 58 | // As adding patch sections may move branches onto region boundaries the patch |
| 59 | // must iterate until no more patches are added. |
| 60 | // |
| 61 | // Example, before: |
| 62 | // 00000FFA func: NOP.w // 32-bit Thumb function |
| 63 | // 00000FFE B.W func // 32-bit branch spanning 2 regions, dest in 1st. |
| 64 | // Example, after: |
| 65 | // 00000FFA func: NOP.w // 32-bit Thumb function |
| 66 | // 00000FFE B.w __CortexA8657417_00000FFE |
| 67 | // 00001002 2 - bytes padding |
| 68 | // 00001004 __CortexA8657417_00000FFE: B.w func |
| 69 | |
| 70 | class elf::Patch657417Section : public SyntheticSection { |
| 71 | public: |
| 72 | Patch657417Section(InputSection *p, uint64_t off, uint32_t instr, bool isARM); |
| 73 | |
| 74 | void writeTo(uint8_t *buf) override; |
| 75 | |
| 76 | size_t getSize() const override { return 4; } |
| 77 | |
| 78 | // Get the virtual address of the branch instruction at patcheeOffset. |
| 79 | uint64_t getBranchAddr() const; |
| 80 | |
| 81 | static bool classof(const SectionBase *d) { |
| 82 | return d->kind() == InputSectionBase::Synthetic && d->name ==".text.patch"; |
| 83 | } |
| 84 | |
| 85 | // The Section we are patching. |
| 86 | const InputSection *patchee; |
| 87 | // The offset of the instruction in the Patchee section we are patching. |
| 88 | uint64_t patcheeOffset; |
| 89 | // A label for the start of the Patch that we can use as a relocation target. |
| 90 | Symbol *patchSym; |
| 91 | // A decoding of the branch instruction at patcheeOffset. |
| 92 | uint32_t instr; |
| 93 | // True If the patch is to be written in ARM state, otherwise the patch will |
| 94 | // be written in Thumb state. |
| 95 | bool isARM; |
| 96 | }; |
| 97 | |
| 98 | // Return true if the half-word, when taken as the first of a pair of halfwords |
| 99 | // is the first half of a 32-bit instruction. |
| 100 | // Reference from ARM Architecture Reference Manual ARMv7-A and ARMv7-R edition |
| 101 | // section A6.3: 32-bit Thumb instruction encoding |
| 102 | // | HW1 | HW2 | |
| 103 | // | 1 1 1 | op1 (2) | op2 (7) | x (4) |op| x (15) | |
| 104 | // With op1 == 0b00, a 16-bit instruction is encoded. |
| 105 | // |
| 106 | // We test only the first halfword, looking for op != 0b00. |
| 107 | static bool is32bitInstruction(uint16_t hw) { |
| 108 | return (hw & 0xe000) == 0xe000 && (hw & 0x1800) != 0x0000; |
| 109 | } |
| 110 | |
| 111 | // Reference from ARM Architecture Reference Manual ARMv7-A and ARMv7-R edition |
| 112 | // section A6.3.4 Branches and miscellaneous control. |
| 113 | // | HW1 | HW2 | |
| 114 | // | 1 1 1 | 1 0 | op (7) | x (4) | 1 | op1 (3) | op2 (4) | imm8 (8) | |
| 115 | // op1 == 0x0 op != x111xxx | Conditional branch (Bcc.W) |
| 116 | // op1 == 0x1 | Branch (B.W) |
| 117 | // op1 == 1x0 | Branch with Link and Exchange (BLX.w) |
| 118 | // op1 == 1x1 | Branch with Link (BL.W) |
| 119 | |
| 120 | static bool isBcc(uint32_t instr) { |
| 121 | return (instr & 0xf800d000) == 0xf0008000 && |
| 122 | (instr & 0x03800000) != 0x03800000; |
| 123 | } |
| 124 | |
| 125 | static bool isB(uint32_t instr) { return (instr & 0xf800d000) == 0xf0009000; } |
| 126 | |
| 127 | static bool isBLX(uint32_t instr) { return (instr & 0xf800d000) == 0xf000c000; } |
| 128 | |
| 129 | static bool isBL(uint32_t instr) { return (instr & 0xf800d000) == 0xf000d000; } |
| 130 | |
| 131 | static bool is32bitBranch(uint32_t instr) { |
| 132 | return isBcc(instr) || isB(instr) || isBL(instr) || isBLX(instr); |
| 133 | } |
| 134 | |
| 135 | Patch657417Section::Patch657417Section(InputSection *p, uint64_t off, |
| 136 | uint32_t instr, bool isARM) |
| 137 | : SyntheticSection(SHF_ALLOC | SHF_EXECINSTR, SHT_PROGBITS, 4, |
| 138 | ".text.patch"), |
| 139 | patchee(p), patcheeOffset(off), instr(instr), isARM(isARM) { |
| 140 | parent = p->getParent(); |
| 141 | patchSym = addSyntheticLocal( |
| 142 | saver().save("__CortexA8657417_" + utohexstr(getBranchAddr())), STT_FUNC, |
| 143 | isARM ? 0 : 1, getSize(), *this); |
| 144 | addSyntheticLocal(saver().save(isARM ? "$a" : "$t"), STT_NOTYPE, 0, 0, *this); |
| 145 | } |
| 146 | |
| 147 | uint64_t Patch657417Section::getBranchAddr() const { |
| 148 | return patchee->getVA(patcheeOffset); |
| 149 | } |
| 150 | |
| 151 | // Given a branch instruction instr at sourceAddr work out its destination |
| 152 | // address. This is only used when the branch instruction has no relocation. |
| 153 | static uint64_t getThumbDestAddr(uint64_t sourceAddr, uint32_t instr) { |
| 154 | uint8_t buf[4]; |
| 155 | write16le(buf, instr >> 16); |
| 156 | write16le(buf + 2, instr & 0x0000ffff); |
| 157 | int64_t offset; |
| 158 | if (isBcc(instr)) |
| 159 | offset = target->getImplicitAddend(buf, R_ARM_THM_JUMP19); |
| 160 | else if (isB(instr)) |
| 161 | offset = target->getImplicitAddend(buf, R_ARM_THM_JUMP24); |
| 162 | else |
| 163 | offset = target->getImplicitAddend(buf, R_ARM_THM_CALL); |
| 164 | // A BLX instruction from Thumb to Arm may have an address that is |
| 165 | // not 4-byte aligned. As Arm instructions are always 4-byte aligned |
| 166 | // the instruction is calculated (from Arm ARM): |
| 167 | // targetAddress = Align(PC, 4) + imm32 |
| 168 | // where |
| 169 | // Align(x, y) = y * (x Div y) |
| 170 | // which corresponds to alignDown. |
| 171 | if (isBLX(instr)) |
| 172 | sourceAddr = alignDown(sourceAddr, 4); |
| 173 | return sourceAddr + offset + 4; |
| 174 | } |
| 175 | |
| 176 | void Patch657417Section::writeTo(uint8_t *buf) { |
| 177 | // The base instruction of the patch is always a 32-bit unconditional branch. |
| 178 | if (isARM) |
| 179 | write32le(buf, 0xea000000); |
| 180 | else |
| 181 | write32le(buf, 0x9000f000); |
| 182 | // If we have a relocation then apply it. |
| 183 | if (!relocations.empty()) { |
| 184 | relocateAlloc(buf, buf + getSize()); |
| 185 | return; |
| 186 | } |
| 187 | |
| 188 | // If we don't have a relocation then we must calculate and write the offset |
| 189 | // ourselves. |
| 190 | // Get the destination offset from the addend in the branch instruction. |
| 191 | // We cannot use the instruction in the patchee section as this will have |
| 192 | // been altered to point to us! |
| 193 | uint64_t s = getThumbDestAddr(getBranchAddr(), instr); |
| 194 | // A BLX changes the state of the branch in the patch to Arm state, which |
| 195 | // has a PC Bias of 8, whereas in all other cases the branch is in Thumb |
| 196 | // state with a PC Bias of 4. |
| 197 | uint64_t pcBias = isBLX(instr) ? 8 : 4; |
| 198 | uint64_t p = getVA(pcBias); |
| 199 | target->relocateNoSym(buf, isARM ? R_ARM_JUMP24 : R_ARM_THM_JUMP24, s - p); |
| 200 | } |
| 201 | |
| 202 | // Given a branch instruction spanning two 4KiB regions, at offset off from the |
| 203 | // start of isec, return true if the destination of the branch is within the |
| 204 | // first of the two 4Kib regions. |
| 205 | static bool branchDestInFirstRegion(const InputSection *isec, uint64_t off, |
| 206 | uint32_t instr, const Relocation *r) { |
| 207 | uint64_t sourceAddr = isec->getVA(0) + off; |
| 208 | assert((sourceAddr & 0xfff) == 0xffe)(static_cast <bool> ((sourceAddr & 0xfff) == 0xffe) ? void (0) : __assert_fail ("(sourceAddr & 0xfff) == 0xffe" , "lld/ELF/ARMErrataFix.cpp", 208, __extension__ __PRETTY_FUNCTION__ )); |
| 209 | uint64_t destAddr = sourceAddr; |
Value stored to 'destAddr' during its initialization is never read | |
| 210 | // If there is a branch relocation at the same offset we must use this to |
| 211 | // find the destination address as the branch could be indirected via a thunk |
| 212 | // or the PLT. |
| 213 | if (r) { |
| 214 | uint64_t dst = (r->expr == R_PLT_PC) ? r->sym->getPltVA() : r->sym->getVA(); |
| 215 | // Account for Thumb PC bias, usually cancelled to 0 by addend of -4. |
| 216 | destAddr = dst + r->addend + 4; |
| 217 | } else { |
| 218 | // If there is no relocation, we must have an intra-section branch |
| 219 | // We must extract the offset from the addend manually. |
| 220 | destAddr = getThumbDestAddr(sourceAddr, instr); |
| 221 | } |
| 222 | |
| 223 | return (destAddr & 0xfffff000) == (sourceAddr & 0xfffff000); |
| 224 | } |
| 225 | |
| 226 | // Return true if a branch can reach a patch section placed after isec. |
| 227 | // The Bcc.w instruction has a range of 1 MiB, all others have 16 MiB. |
| 228 | static bool patchInRange(const InputSection *isec, uint64_t off, |
| 229 | uint32_t instr) { |
| 230 | |
| 231 | // We need the branch at source to reach a patch section placed immediately |
| 232 | // after isec. As there can be more than one patch in the patch section we |
| 233 | // add 0x100 as contingency to account for worst case of 1 branch every 4KiB |
| 234 | // for a 1 MiB range. |
| 235 | return target->inBranchRange( |
| 236 | isBcc(instr) ? R_ARM_THM_JUMP19 : R_ARM_THM_JUMP24, isec->getVA(off), |
| 237 | isec->getVA() + isec->getSize() + 0x100); |
| 238 | } |
| 239 | |
| 240 | struct ScanResult { |
| 241 | // Offset of branch within its InputSection. |
| 242 | uint64_t off; |
| 243 | // Cached decoding of the branch instruction. |
| 244 | uint32_t instr; |
| 245 | // Branch relocation at off. Will be nullptr if no relocation exists. |
| 246 | Relocation *rel; |
| 247 | }; |
| 248 | |
| 249 | // Detect the erratum sequence, returning the offset of the branch instruction |
| 250 | // and a decoding of the branch. If the erratum sequence is not found then |
| 251 | // return an offset of 0 for the branch. 0 is a safe value to use for no patch |
| 252 | // as there must be at least one 32-bit non-branch instruction before the |
| 253 | // branch so the minimum offset for a patch is 4. |
| 254 | static ScanResult scanCortexA8Errata657417(InputSection *isec, uint64_t &off, |
| 255 | uint64_t limit) { |
| 256 | uint64_t isecAddr = isec->getVA(0); |
| 257 | // Advance Off so that (isecAddr + off) modulo 0x1000 is at least 0xffa. We |
| 258 | // need to check for a 32-bit instruction immediately before a 32-bit branch |
| 259 | // at 0xffe modulo 0x1000. |
| 260 | off = alignTo(isecAddr + off, 0x1000, 0xffa) - isecAddr; |
| 261 | if (off >= limit || limit - off < 8) { |
| 262 | // Need at least 2 4-byte sized instructions to trigger erratum. |
| 263 | off = limit; |
| 264 | return {0, 0, nullptr}; |
| 265 | } |
| 266 | |
| 267 | ScanResult scanRes = {0, 0, nullptr}; |
| 268 | const uint8_t *buf = isec->data().begin(); |
| 269 | // ARMv7-A Thumb 32-bit instructions are encoded 2 consecutive |
| 270 | // little-endian halfwords. |
| 271 | const ulittle16_t *instBuf = reinterpret_cast<const ulittle16_t *>(buf + off); |
| 272 | uint16_t hw11 = *instBuf++; |
| 273 | uint16_t hw12 = *instBuf++; |
| 274 | uint16_t hw21 = *instBuf++; |
| 275 | uint16_t hw22 = *instBuf++; |
| 276 | if (is32bitInstruction(hw11) && is32bitInstruction(hw21)) { |
| 277 | uint32_t instr1 = (hw11 << 16) | hw12; |
| 278 | uint32_t instr2 = (hw21 << 16) | hw22; |
| 279 | if (!is32bitBranch(instr1) && is32bitBranch(instr2)) { |
| 280 | // Find a relocation for the branch if it exists. This will be used |
| 281 | // to determine the target. |
| 282 | uint64_t branchOff = off + 4; |
| 283 | auto relIt = llvm::find_if(isec->relocations, [=](const Relocation &r) { |
| 284 | return r.offset == branchOff && |
| 285 | (r.type == R_ARM_THM_JUMP19 || r.type == R_ARM_THM_JUMP24 || |
| 286 | r.type == R_ARM_THM_CALL); |
| 287 | }); |
| 288 | if (relIt != isec->relocations.end()) |
| 289 | scanRes.rel = &(*relIt); |
| 290 | if (branchDestInFirstRegion(isec, branchOff, instr2, scanRes.rel)) { |
| 291 | if (patchInRange(isec, branchOff, instr2)) { |
| 292 | scanRes.off = branchOff; |
| 293 | scanRes.instr = instr2; |
| 294 | } else { |
| 295 | warn(toString(isec->file) + |
| 296 | ": skipping cortex-a8 657417 erratum sequence, section " + |
| 297 | isec->name + " is too large to patch"); |
| 298 | } |
| 299 | } |
| 300 | } |
| 301 | } |
| 302 | off += 0x1000; |
| 303 | return scanRes; |
| 304 | } |
| 305 | |
| 306 | void ARMErr657417Patcher::init() { |
| 307 | // The Arm ABI permits a mix of ARM, Thumb and Data in the same |
| 308 | // InputSection. We must only scan Thumb instructions to avoid false |
| 309 | // matches. We use the mapping symbols in the InputObjects to identify this |
| 310 | // data, caching the results in sectionMap so we don't have to recalculate |
| 311 | // it each pass. |
| 312 | |
| 313 | // The ABI Section 4.5.5 Mapping symbols; defines local symbols that describe |
| 314 | // half open intervals [Symbol Value, Next Symbol Value) of code and data |
| 315 | // within sections. If there is no next symbol then the half open interval is |
| 316 | // [Symbol Value, End of section). The type, code or data, is determined by |
| 317 | // the mapping symbol name, $a for Arm code, $t for Thumb code, $d for data. |
| 318 | auto isArmMapSymbol = [](const Symbol *s) { |
| 319 | return s->getName() == "$a" || s->getName().startswith("$a."); |
| 320 | }; |
| 321 | auto isThumbMapSymbol = [](const Symbol *s) { |
| 322 | return s->getName() == "$t" || s->getName().startswith("$t."); |
| 323 | }; |
| 324 | auto isDataMapSymbol = [](const Symbol *s) { |
| 325 | return s->getName() == "$d" || s->getName().startswith("$d."); |
| 326 | }; |
| 327 | |
| 328 | // Collect mapping symbols for every executable InputSection. |
| 329 | for (ELFFileBase *file : objectFiles) { |
| 330 | for (Symbol *s : file->getLocalSymbols()) { |
| 331 | auto *def = dyn_cast<Defined>(s); |
| 332 | if (!def) |
| 333 | continue; |
| 334 | if (!isArmMapSymbol(def) && !isThumbMapSymbol(def) && |
| 335 | !isDataMapSymbol(def)) |
| 336 | continue; |
| 337 | if (auto *sec = dyn_cast_or_null<InputSection>(def->section)) |
| 338 | if (sec->flags & SHF_EXECINSTR) |
| 339 | sectionMap[sec].push_back(def); |
| 340 | } |
| 341 | } |
| 342 | // For each InputSection make sure the mapping symbols are in sorted in |
| 343 | // ascending order and are in alternating Thumb, non-Thumb order. |
| 344 | for (auto &kv : sectionMap) { |
| 345 | std::vector<const Defined *> &mapSyms = kv.second; |
| 346 | llvm::stable_sort(mapSyms, [](const Defined *a, const Defined *b) { |
| 347 | return a->value < b->value; |
| 348 | }); |
| 349 | mapSyms.erase(std::unique(mapSyms.begin(), mapSyms.end(), |
| 350 | [=](const Defined *a, const Defined *b) { |
| 351 | return (isThumbMapSymbol(a) == |
| 352 | isThumbMapSymbol(b)); |
| 353 | }), |
| 354 | mapSyms.end()); |
| 355 | // Always start with a Thumb Mapping Symbol |
| 356 | if (!mapSyms.empty() && !isThumbMapSymbol(mapSyms.front())) |
| 357 | mapSyms.erase(mapSyms.begin()); |
| 358 | } |
| 359 | initialized = true; |
| 360 | } |
| 361 | |
| 362 | void ARMErr657417Patcher::insertPatches( |
| 363 | InputSectionDescription &isd, std::vector<Patch657417Section *> &patches) { |
| 364 | uint64_t spacing = 0x100000 - 0x7500; |
| 365 | uint64_t isecLimit; |
| 366 | uint64_t prevIsecLimit = isd.sections.front()->outSecOff; |
| 367 | uint64_t patchUpperBound = prevIsecLimit + spacing; |
| 368 | uint64_t outSecAddr = isd.sections.front()->getParent()->addr; |
| 369 | |
| 370 | // Set the outSecOff of patches to the place where we want to insert them. |
| 371 | // We use a similar strategy to initial thunk placement, using 1 MiB as the |
| 372 | // range of the Thumb-2 conditional branch with a contingency accounting for |
| 373 | // thunk generation. |
| 374 | auto patchIt = patches.begin(); |
| 375 | auto patchEnd = patches.end(); |
| 376 | for (const InputSection *isec : isd.sections) { |
| 377 | isecLimit = isec->outSecOff + isec->getSize(); |
| 378 | if (isecLimit > patchUpperBound) { |
| 379 | for (; patchIt != patchEnd; ++patchIt) { |
| 380 | if ((*patchIt)->getBranchAddr() - outSecAddr >= prevIsecLimit) |
| 381 | break; |
| 382 | (*patchIt)->outSecOff = prevIsecLimit; |
| 383 | } |
| 384 | patchUpperBound = prevIsecLimit + spacing; |
| 385 | } |
| 386 | prevIsecLimit = isecLimit; |
| 387 | } |
| 388 | for (; patchIt != patchEnd; ++patchIt) |
| 389 | (*patchIt)->outSecOff = isecLimit; |
| 390 | |
| 391 | // Merge all patch sections. We use the outSecOff assigned above to |
| 392 | // determine the insertion point. This is ok as we only merge into an |
| 393 | // InputSectionDescription once per pass, and at the end of the pass |
| 394 | // assignAddresses() will recalculate all the outSecOff values. |
| 395 | SmallVector<InputSection *, 0> tmp; |
| 396 | tmp.reserve(isd.sections.size() + patches.size()); |
| 397 | auto mergeCmp = [](const InputSection *a, const InputSection *b) { |
| 398 | if (a->outSecOff != b->outSecOff) |
| 399 | return a->outSecOff < b->outSecOff; |
| 400 | return isa<Patch657417Section>(a) && !isa<Patch657417Section>(b); |
| 401 | }; |
| 402 | std::merge(isd.sections.begin(), isd.sections.end(), patches.begin(), |
| 403 | patches.end(), std::back_inserter(tmp), mergeCmp); |
| 404 | isd.sections = std::move(tmp); |
| 405 | } |
| 406 | |
| 407 | // Given a branch instruction described by ScanRes redirect it to a patch |
| 408 | // section containing an unconditional branch instruction to the target. |
| 409 | // Ensure that this patch section is 4-byte aligned so that the branch cannot |
| 410 | // span two 4 KiB regions. Place the patch section so that it is always after |
| 411 | // isec so the branch we are patching always goes forwards. |
| 412 | static void implementPatch(ScanResult sr, InputSection *isec, |
| 413 | std::vector<Patch657417Section *> &patches) { |
| 414 | |
| 415 | log("detected cortex-a8-657419 erratum sequence starting at " + |
| 416 | utohexstr(isec->getVA(sr.off)) + " in unpatched output."); |
| 417 | Patch657417Section *psec; |
| 418 | // We have two cases to deal with. |
| 419 | // Case 1. There is a relocation at patcheeOffset to a symbol. The |
| 420 | // unconditional branch in the patch must have a relocation so that any |
| 421 | // further redirection via the PLT or a Thunk happens as normal. At |
| 422 | // patcheeOffset we redirect the existing relocation to a Symbol defined at |
| 423 | // the start of the patch section. |
| 424 | // |
| 425 | // Case 2. There is no relocation at patcheeOffset. We are unlikely to have |
| 426 | // a symbol that we can use as a target for a relocation in the patch section. |
| 427 | // Luckily we know that the destination cannot be indirected via the PLT or |
| 428 | // a Thunk so we can just write the destination directly. |
| 429 | if (sr.rel) { |
| 430 | // Case 1. We have an existing relocation to redirect to patch and a |
| 431 | // Symbol target. |
| 432 | |
| 433 | // Create a branch relocation for the unconditional branch in the patch. |
| 434 | // This can be redirected via the PLT or Thunks. |
| 435 | RelType patchRelType = R_ARM_THM_JUMP24; |
| 436 | int64_t patchRelAddend = sr.rel->addend; |
| 437 | bool destIsARM = false; |
| 438 | if (isBL(sr.instr) || isBLX(sr.instr)) { |
| 439 | // The final target of the branch may be ARM or Thumb, if the target |
| 440 | // is ARM then we write the patch in ARM state to avoid a state change |
| 441 | // Thunk from the patch to the target. |
| 442 | uint64_t dstSymAddr = (sr.rel->expr == R_PLT_PC) ? sr.rel->sym->getPltVA() |
| 443 | : sr.rel->sym->getVA(); |
| 444 | destIsARM = (dstSymAddr & 1) == 0; |
| 445 | } |
| 446 | psec = make<Patch657417Section>(isec, sr.off, sr.instr, destIsARM); |
| 447 | if (destIsARM) { |
| 448 | // The patch will be in ARM state. Use an ARM relocation and account for |
| 449 | // the larger ARM PC-bias of 8 rather than Thumb's 4. |
| 450 | patchRelType = R_ARM_JUMP24; |
| 451 | patchRelAddend -= 4; |
| 452 | } |
| 453 | psec->relocations.push_back( |
| 454 | Relocation{sr.rel->expr, patchRelType, 0, patchRelAddend, sr.rel->sym}); |
| 455 | // Redirect the existing branch relocation to the patch. |
| 456 | sr.rel->expr = R_PC; |
| 457 | sr.rel->addend = -4; |
| 458 | sr.rel->sym = psec->patchSym; |
| 459 | } else { |
| 460 | // Case 2. We do not have a relocation to the patch. Add a relocation of the |
| 461 | // appropriate type to the patch at patcheeOffset. |
| 462 | |
| 463 | // The destination is ARM if we have a BLX. |
| 464 | psec = make<Patch657417Section>(isec, sr.off, sr.instr, isBLX(sr.instr)); |
| 465 | RelType type; |
| 466 | if (isBcc(sr.instr)) |
| 467 | type = R_ARM_THM_JUMP19; |
| 468 | else if (isB(sr.instr)) |
| 469 | type = R_ARM_THM_JUMP24; |
| 470 | else |
| 471 | type = R_ARM_THM_CALL; |
| 472 | isec->relocations.push_back( |
| 473 | Relocation{R_PC, type, sr.off, -4, psec->patchSym}); |
| 474 | } |
| 475 | patches.push_back(psec); |
| 476 | } |
| 477 | |
| 478 | // Scan all the instructions in InputSectionDescription, for each instance of |
| 479 | // the erratum sequence create a Patch657417Section. We return the list of |
| 480 | // Patch657417Sections that need to be applied to the InputSectionDescription. |
| 481 | std::vector<Patch657417Section *> |
| 482 | ARMErr657417Patcher::patchInputSectionDescription( |
| 483 | InputSectionDescription &isd) { |
| 484 | std::vector<Patch657417Section *> patches; |
| 485 | for (InputSection *isec : isd.sections) { |
| 486 | // LLD doesn't use the erratum sequence in SyntheticSections. |
| 487 | if (isa<SyntheticSection>(isec)) |
| 488 | continue; |
| 489 | // Use sectionMap to make sure we only scan Thumb code and not Arm or inline |
| 490 | // data. We have already sorted mapSyms in ascending order and removed |
| 491 | // consecutive mapping symbols of the same type. Our range of executable |
| 492 | // instructions to scan is therefore [thumbSym->value, nonThumbSym->value) |
| 493 | // or [thumbSym->value, section size). |
| 494 | std::vector<const Defined *> &mapSyms = sectionMap[isec]; |
| 495 | |
| 496 | auto thumbSym = mapSyms.begin(); |
| 497 | while (thumbSym != mapSyms.end()) { |
| 498 | auto nonThumbSym = std::next(thumbSym); |
| 499 | uint64_t off = (*thumbSym)->value; |
| 500 | uint64_t limit = (nonThumbSym == mapSyms.end()) ? isec->data().size() |
| 501 | : (*nonThumbSym)->value; |
| 502 | |
| 503 | while (off < limit) { |
| 504 | ScanResult sr = scanCortexA8Errata657417(isec, off, limit); |
| 505 | if (sr.off) |
| 506 | implementPatch(sr, isec, patches); |
| 507 | } |
| 508 | if (nonThumbSym == mapSyms.end()) |
| 509 | break; |
| 510 | thumbSym = std::next(nonThumbSym); |
| 511 | } |
| 512 | } |
| 513 | return patches; |
| 514 | } |
| 515 | |
| 516 | bool ARMErr657417Patcher::createFixes() { |
| 517 | if (!initialized) |
| 518 | init(); |
| 519 | |
| 520 | bool addressesChanged = false; |
| 521 | for (OutputSection *os : outputSections) { |
| 522 | if (!(os->flags & SHF_ALLOC) || !(os->flags & SHF_EXECINSTR)) |
| 523 | continue; |
| 524 | for (SectionCommand *cmd : os->commands) |
| 525 | if (auto *isd = dyn_cast<InputSectionDescription>(cmd)) { |
| 526 | std::vector<Patch657417Section *> patches = |
| 527 | patchInputSectionDescription(*isd); |
| 528 | if (!patches.empty()) { |
| 529 | insertPatches(*isd, patches); |
| 530 | addressesChanged = true; |
| 531 | } |
| 532 | } |
| 533 | } |
| 534 | return addressesChanged; |
| 535 | } |