Skip to content

Commit 038b5f7

Browse files
yavtukyavtuk
committed
Exclude JT pattern matching under assert failure
There are several patterns to implement jump table. Need to exclude the following patterns under assert during disassemble stage: (1) nop (2) sub (3) adrp adr ldr ldr ldrh ldrh ldrh adr adr adr add add add br br br Full jump table processing for AArch64 is still disabled.
1 parent 81ae668 commit 038b5f7

File tree

3 files changed

+240
-44
lines changed

3 files changed

+240
-44
lines changed

‎bolt/lib/Target/AArch64/AArch64MCPlusBuilder.cpp‎

Lines changed: 113 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,34 @@ class AArch64MCPlusBuilder : public MCPlusBuilder {
213213
Inst.getOpcode() == AArch64::ADDXrx64);
214214
}
215215

216+
bool isSUB(const MCInst &Inst) const override {
217+
const unsigned opcode = Inst.getOpcode();
218+
switch (opcode) {
219+
case AArch64::SUBSWri:
220+
case AArch64::SUBSWrr:
221+
case AArch64::SUBSWrs:
222+
case AArch64::SUBSWrx:
223+
case AArch64::SUBSXri:
224+
case AArch64::SUBSXrr:
225+
case AArch64::SUBSXrs:
226+
case AArch64::SUBSXrx:
227+
case AArch64::SUBSXrx64:
228+
case AArch64::SUBWri:
229+
case AArch64::SUBWrr:
230+
case AArch64::SUBWrs:
231+
case AArch64::SUBWrx:
232+
case AArch64::SUBXri:
233+
case AArch64::SUBXrr:
234+
case AArch64::SUBXrs:
235+
case AArch64::SUBXrx:
236+
case AArch64::SUBXrx64:
237+
return true;
238+
default:
239+
return false;
240+
}
241+
llvm_unreachable("");
242+
}
243+
216244
bool isLDRB(const MCInst &Inst) const {
217245
return (Inst.getOpcode() == AArch64::LDRBBpost ||
218246
Inst.getOpcode() == AArch64::LDRBBpre ||
@@ -652,6 +680,34 @@ class AArch64MCPlusBuilder : public MCPlusBuilder {
652680
/// # of this BB)
653681
/// br x0 # Indirect jump instruction
654682
///
683+
/// adrp + ldr pair instructions of JT
684+
/// adrp x3, :got:jump_table
685+
/// ldr x1, [x1, #value]
686+
/// ldrh w1, [x1, w3, uxtw #1]
687+
/// adr x3, 573ae4
688+
/// add x1, x3, w1, sxth #2
689+
/// br x1
690+
///
691+
/// lld/test/ELF/aarch64-adrp-ldr-got.s
692+
/// if .rodata and .text are sufficiently (<1M)
693+
/// close to each other so that the adrp + ldr pair can be relaxed to
694+
/// nop + adr.
695+
/// nop #
696+
/// adr x0, #6d8f8 # Get JT table address
697+
/// ldrh w0, [x0, w4, uxtw #1] # Loads JT entry
698+
/// adr x2, 1479b0 # Get PC first instruction for next BB
699+
/// add x0, x2, w0, sxth #2 # Finish building branch target
700+
/// # (entries in JT are relative to the end
701+
/// # of this BB)
702+
/// br x0 # Indirect jump instruction
703+
///
704+
/// sub + ldr pair instructions of JT, JT address on the stack and other BB
705+
/// sub x1, x29, #0x4, lsl #12
706+
/// ldr x1, [x1, #14352]
707+
/// ldrh w1, [x1, w3, uxtw #1]
708+
/// adr x3, 573ae4
709+
/// add x1, x3, w1, sxth #2
710+
/// br x1
655711
bool analyzeIndirectBranchFragment(
656712
const MCInst &Inst,
657713
DenseMap<const MCInst *, SmallVector<MCInst *, 4>> &UDChain,
@@ -753,45 +809,77 @@ class AArch64MCPlusBuilder : public MCPlusBuilder {
753809

754810
// Match ADD that calculates the JumpTable Base Address (not the offset)
755811
SmallVector<MCInst *, 4> &UsesLoad = UDChain[DefLoad];
756-
const MCInst *DefJTBaseAdd = UsesLoad[1];
812+
const MCInst *DefJTPageBias = UsesLoad[1];
757813
MCPhysReg From, To;
758-
if (DefJTBaseAdd == nullptr || isLoadFromStack(*DefJTBaseAdd) ||
759-
isRegToRegMove(*DefJTBaseAdd, From, To)) {
814+
JumpTable = nullptr;
815+
if (DefJTPageBias == nullptr || isLoadFromStack(*DefJTPageBias) ||
816+
isRegToRegMove(*DefJTPageBias, From, To)) {
760817
// Sometimes base address may have been defined in another basic block
761818
// (hoisted). Return with no jump table info.
762-
JumpTable = nullptr;
763819
return true;
764820
}
765821

766-
if (DefJTBaseAdd->getOpcode() == AArch64::ADR) {
822+
if (isAddXri(*DefJTPageBias)) {
823+
if (DefJTPageBias->getOperand(2).isImm())
824+
Offset = DefJTPageBias->getOperand(2).getImm();
825+
SmallVector<MCInst *, 4> &UsesJTBaseAdd = UDChain[DefJTPageBias];
826+
const MCInst *DefJTBasePage = UsesJTBaseAdd[1];
827+
if (DefJTBasePage == nullptr || isLoadFromStack(*DefJTBasePage)) {
828+
return true;
829+
}
830+
assert(DefJTBasePage->getOpcode() == AArch64::ADRP &&
831+
"Failed to match jump table base page pattern! (2)");
832+
if (DefJTBasePage->getOperand(1).isExpr())
833+
JumpTable = DefJTBasePage->getOperand(1).getExpr();
834+
return true;
835+
} else if (isADR(*DefJTPageBias)) {
767836
// TODO: Handle the pattern where there is no adrp/add pair.
768837
// It also occurs when the binary is static.
769-
// adr x13, 0x215a18 <_nl_value_type_LC_COLLATE+0x50>
838+
// nop
839+
// *adr x13, 0x215a18 <_nl_value_type_LC_COLLATE+0x50>
770840
// ldrh w13, [x13, w12, uxtw #1]
771841
// adr x12, 0x247b30 <__gettextparse+0x5b0>
772842
// add x13, x12, w13, sxth #2
773843
// br x13
774-
errs() << "BOLT-WARNING: Failed to match indirect branch: "
775-
"nop/adr instead of adrp/add \n";
776-
return false;
777-
}
778-
779-
assert(DefJTBaseAdd->getOpcode() == AArch64::ADDXri &&
780-
"Failed to match jump table base address pattern! (1)");
844+
SmallVector<MCInst *, 4> &UsesJTNop = UDChain[DefJTPageBias];
845+
assert((UsesJTNop.size() == 1 && UsesJTNop[0] == nullptr) &&
846+
"Failed to match jump table pattern! (2)");
847+
if (DefJTPageBias->getOperand(1).isExpr()) {
848+
JumpTable = DefJTPageBias->getOperand(1).getExpr();
849+
return true;
850+
}
851+
} else if (mayLoad(*DefJTPageBias)) {
852+
if (isLoadFromStack(*DefJTPageBias))
853+
return true;
781854

782-
if (DefJTBaseAdd->getOperand(2).isImm())
783-
Offset = DefJTBaseAdd->getOperand(2).getImm();
784-
SmallVector<MCInst *, 4> &UsesJTBaseAdd = UDChain[DefJTBaseAdd];
785-
const MCInst *DefJTBasePage = UsesJTBaseAdd[1];
786-
if (DefJTBasePage == nullptr || isLoadFromStack(*DefJTBasePage)) {
787-
JumpTable = nullptr;
788-
return true;
855+
SmallVector<MCInst *, 4> &UsesJTBase = UDChain[DefJTPageBias];
856+
const MCInst *DefJTBasePage = UsesJTBase[1];
857+
if (DefJTBasePage == nullptr)
858+
return true;
859+
if (DefJTBasePage->getOpcode() == AArch64::ADRP) {
860+
// test jmp-table-pattern-matching.s (3)
861+
if (DefJTBasePage->getOperand(1).isExpr())
862+
JumpTable = DefJTBasePage->getOperand(1).getExpr();
863+
return true;
864+
} else {
865+
// Base address may have been defined in another basic block
866+
// and sub instruction can be used to get base page address
867+
// jmp-table-pattern-matching.s (2)
868+
if (isSUB(*DefJTBasePage)) {
869+
for (const MCOperand &Operand : useOperands(*DefJTBasePage)) {
870+
if (!Operand.isReg())
871+
continue;
872+
const unsigned Reg = Operand.getReg();
873+
if (Reg == AArch64::SP || Reg == AArch64::WSP ||
874+
Reg == AArch64::FP || Reg == AArch64::W29)
875+
return true;
876+
}
877+
}
878+
}
789879
}
790-
assert(DefJTBasePage->getOpcode() == AArch64::ADRP &&
791-
"Failed to match jump table base page pattern! (2)");
792-
if (DefJTBasePage->getOperand(1).isExpr())
793-
JumpTable = DefJTBasePage->getOperand(1).getExpr();
794-
return true;
880+
881+
assert("Failed to match jump table pattern! (4)");
882+
return false;
795883
}
796884

797885
DenseMap<const MCInst *, SmallVector<MCInst *, 4>>

‎bolt/test/AArch64/jmp-table-pattern-matching.s‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
## This test checks that disassemble stage works properly
2+
## JT with indirect branch
3+
## 1) nop + adr pair instructions
4+
## 2) sub + ldr pair instructions
5+
## 3) adrp + ldr pair instructions
6+
7+
# REQUIRES: system-linux
8+
9+
# RUN: rm -rf %t && split-file %s %t
10+
11+
## Prepare binary (1)
12+
# RUN: llvm-mc -filetype=obj -triple aarch64-unknown-unknown %t/jt_nop_adr.s \
13+
# RUN: -o %t/jt_nop_adr.o
14+
# RUN: %clang %cflags --target=aarch64-unknown-linux %t/jt_nop_adr.o \
15+
# RUN: -Wl,-q -Wl,-z,now, -Wl,-T,%t/within-adr-range.t -o %t/jt_nop_adr.exe
16+
# RUN: llvm-objdump --no-show-raw-insn -d %t/jt_nop_adr.exe | FileCheck \
17+
# RUN: --check-prefix=JT-RELAXED %s
18+
19+
# JT-RELAXED: <_start>:
20+
# JT-RELAXED-NEXT: nop
21+
# JT-RELAXED-NEXT: adr {{.*}}x3
22+
23+
# RUN: llvm-bolt %t/jt_nop_adr.exe -o %t/jt_nop_adr.bolt 2>&1 | FileCheck %s
24+
# CHECK-NOT: Failed to match
25+
26+
## This linker script ensures that .rodata and .text are sufficiently (<1M)
27+
## close to each other so that the adrp + ldr pair can be relaxed to nop + adr.
28+
#--- within-adr-range.t
29+
SECTIONS {
30+
.rodata 0x1000: { *(.rodata) }
31+
.text 0x2000: { *(.text) }
32+
.rela.rodata : { *(.rela.rodata) }
33+
}
34+
35+
## Prepare binary (2)
36+
# RUN: llvm-mc -filetype=obj -triple aarch64-unknown-unknown %t/jt_sub_ldr.s \
37+
# RUN: -o %t/jt_sub_ldr.o
38+
# RUN: %clang %cflags --target=aarch64-unknown-linux %t/jt_sub_ldr.o \
39+
# RUN: -Wl,-q -Wl,-z,now -o %t/jt_sub_ldr.exe
40+
# RUN: llvm-objdump --no-show-raw-insn -d %t/jt_sub_ldr.exe | FileCheck \
41+
# RUN: --check-prefix=JT-SUB-LDR %s
42+
43+
# JT-SUB-LDR: <_start>:
44+
# JT-SUB-LDR-NEXT: sub
45+
# JT-SUB-LDR-NEXT: ldr
46+
47+
# RUN: llvm-bolt %t/jt_sub_ldr.exe -o %t/jt_sub_ldr.bolt 2>&1 | FileCheck \
48+
# RUN: --check-prefix=JT-BOLT-SUBLDR %s
49+
# JT-BOLT-SUBLDR-NOT: Failed to match
50+
51+
## Prepare binary (3)
52+
# RUN: llvm-mc -filetype=obj -triple aarch64-unknown-unknown %t/jt_adrp_ldr.s \
53+
# RUN: -o %t/jt_adrp_ldr.o
54+
# RUN: %clang %cflags --target=aarch64-unknown-linux %t/jt_adrp_ldr.o \
55+
# RUN: -Wl,-q -Wl,-z,now -Wl,--no-relax -o %t/jt_adrp_ldr.exe
56+
# RUN: llvm-objdump --no-show-raw-insn -d %t/jt_adrp_ldr.exe | FileCheck \
57+
# RUN: --check-prefix=JT-ADRP-LDR %s
58+
59+
# JT-ADRP-LDR: <_start>:
60+
# JT-ADRP-LDR-NEXT: adrp
61+
# JT-ADRP-LDR-NEXT: ldr
62+
63+
# RUN: llvm-bolt %t/jt_adrp_ldr.exe -o %t/jt_adrp_ldr.bolt 2>&1 | FileCheck \
64+
# RUN: --check-prefix=JT-BOLT-ADRP-LDR %s
65+
# JT-BOLT-ADRP-LDR-NOT: Failed to match
66+
67+
#--- jt_nop_adr.s
68+
.globl _start
69+
.type _start, %function
70+
_start:
71+
adrp x3, :got:jump_table
72+
ldr x3, [x3, #:got_lo12:jump_table]
73+
ldrh w3, [x3, x1, lsl #1]
74+
adr x1, test2_0
75+
add x3, x1, w3, sxth #2
76+
br x3
77+
test2_0:
78+
ret
79+
test2_1:
80+
ret
81+
82+
.section .rodata,"a",@progbits
83+
jump_table:
84+
.hword (test2_0-test2_0)>>2
85+
.hword (test2_1-test2_0)>>2
86+
87+
88+
#--- jt_sub_ldr.s
89+
.globl _start
90+
.type _start, %function
91+
_start:
92+
sub x1, x29, #0x4, lsl #12
93+
ldr x1, [x1, #14352]
94+
ldrh w1, [x1, w3, uxtw #1]
95+
adr x3, test2_0
96+
add x1, x3, w1, sxth #2
97+
br x1
98+
test2_0:
99+
ret
100+
test2_1:
101+
ret
102+
103+
.section .rodata,"a",@progbits
104+
jump_table:
105+
.hword (test2_0-test2_0)>>2
106+
.hword (test2_1-test2_0)>>2
107+
108+
109+
#--- jt_adrp_ldr.s
110+
.globl _start
111+
.type _start, %function
112+
_start:
113+
adrp x3, :got:jump_table
114+
ldr x3, [x3, #:got_lo12:jump_table]
115+
ldrh w3, [x3, x1, lsl #1]
116+
adr x1, test2_0
117+
add x3, x1, w3, sxth #2
118+
br x3
119+
test2_0:
120+
ret
121+
test2_1:
122+
ret
123+
124+
.section .rodata,"a",@progbits
125+
jump_table:
126+
.hword (test2_0-test2_0)>>2
127+
.hword (test2_1-test2_0)>>2

‎bolt/test/AArch64/test-indirect-branch.s‎

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -56,28 +56,9 @@ test1_1:
5656
test1_2:
5757
ret
5858

59-
// Pattern 2
60-
// CHECK: BOLT-WARNING: Failed to match indirect branch: nop/adr instead of adrp/add
61-
.globl test2
62-
.type test2, %function
63-
test2:
64-
nop
65-
adr x3, jump_table
66-
ldrh w3, [x3, x1, lsl #1]
67-
adr x1, test2_0
68-
add x3, x1, w3, sxth #2
69-
br x3
70-
test2_0:
71-
ret
72-
test2_1:
73-
ret
74-
7559
.section .rodata,"a",@progbits
7660
datatable:
7761
.word test1_0-datatable
7862
.word test1_1-datatable
7963
.word test1_2-datatable
8064

81-
jump_table:
82-
.hword (test2_0-test2_0)>>2
83-
.hword (test2_1-test2_0)>>2

0 commit comments

Comments
 (0)