[LLD][ELF] Cortex-M Security Extensions (CMSE) Support

[amilendra]

Summary

This commit provides linker support for Cortex-M Security Extensions (CMSE).
The specification for this feature can be found in ARM v8-M Security Extensions:
Requirements on Development Tools.

The linker synthesizes a security gateway veneer in a special section;
.gnu.sgstubs, when it finds non-local symbols __acle_se_<entry> and <entry>,
defined relative to the same text section and having the same address. The
address of <entry> is retargeted to the starting address of the
linker-synthesized security gateway veneer in section .gnu.sgstubs.

In summary, the linker translates input:

  .text
entry:
__acle_se_entry:
  [entry_code]

into:

  .section .gnu.sgstubs
entry:
  SG
  B.W __acle_se_entry

  .text
__acle_se_entry:
  [entry_code]

If addresses of __acle_se_<entry> and <entry> are not equal, the linker
considers that <entry> already defines a secure gateway veneer so does not
synthesize one.

If --out-implib=<out.lib> is specified, the linker writes the list of secure
gateway veneers into a CMSE import library <out.lib>. The CMSE import library
will have 3 sections: .symtab, .strtab, .shstrtab. For every secure gateway
veneer <entry> at address <addr>, .symtab contains a SHN_ABS symbol <entry> with
value <addr>.

If --in-implib=<in.lib> is specified, the linker reads the existing CMSE import
library <in.lib> and preserves the entry function addresses in the resulting
executable and new import library.

[MaskRay]

lld/ELF/Arch/ARM.cpp

947

The two conditions can be combined as done in checkCmseSymAttributes. The message can be unified as well.

993

The 3 checks can be made a local lambda to be shared by acleSeSym and sym. The lambda can have a parameter to differentiate special and entry.

995

is not defined.

Again, Not a Defined does not imply Undefined.

1024

Printing an error for every symbol is verbose. I think armCMSESupport should be removed.

In updateSupportedARMFeatures, report a single error if not v8-M and perhaps config->cmseImplib = false; to disable processArmCmseSymbol.

1046

1093

wrong section name

1108

inline this used-once variable and delete braces

lld/ELF/Driver.cpp

2807

lld/ELF/InputFiles.cpp

336

Place the if (file) check in the caller and use InputFile &file instead of std::optional.

1164

revert

lld/ELF/LinkerScript.cpp

906

910

lld/ELF/SyntheticSections.cpp

3847

Move this before ppc64 to match the order in the declaration.

lld/ELF/SyntheticSections.h

1180

The inline doesn't seem useful. It's only called once anyway.

lld/ELF/Writer.cpp

457

Do this only if EM_ARM

600

Move the condition config->cmseOutputLib.empty() and then you can remove the EM_ARM condition.

lld/test/ELF/arm-cmse-check-startaddress.s

3 ↗

(On Diff #502635)

9 ↗

(On Diff #502635)

Use FileCheck /dev/null --implicit-check-not=error: in stead of NOERROR

lld/test/ELF/arm-cmse-check-sym-attrs.s

2 ↗

(On Diff #502635)

lld/test/ELF/arm-cmse-cmdline-options.s

1 ↗

(On Diff #502635)

There are still too many test files. Consider grouping this negative test with others together.

2 ↗

(On Diff #502635)

[amilendra]

Address further review comments.
Consolidate diagnostic tests to a single test file.

[amilendra]

lld/ELF/Arch/ARM.cpp

1024

Moving the error to updateSupportedARMFeatures will cause the link to silently continue when build attributes are not found. I've changed in a way that processArmCmseSymbol reports the error once and then resetting config->cmseImplib so that further processing in processArmCmseSymbol is not done. Is this okay?

lld/test/ELF/arm-cmse-cmdline-options.s

1 ↗

(On Diff #502635)

I've consolidated all diagnostics for the arm architecture to a single test file.

[MaskRay]

lld/ELF/Arch/ARM.cpp

972

Merge isNotDefined/isNotThumbFunc/isAbsolute into one lambda.

1006

1097

Use emplace_back

1100

Move the comment before if (acleSeSym->file != sym->file || and delete braces

1129

1135

this-> can be removed. Applies elsewhere.

1140

Use .has_value() if you want to emphasize it is a std::optional.

1141

Delete blank line

1185

It's unclear what the +4 for p is and what the 4 in s - p - 4 is.

Perhaps just combine them into s - getVA() - 8 below.

1233

Why not merge the two osIsPairs loops?

1245

Remove used-once variable or add const if the use site(s) are far away.

1250

unsigned flags = config->mmapOutputFile ? 0 : (unsigned)FileOutputBuffer::F_no_mmap;

[amilendra]

Address another round of review comments.

[amilendra]

Address some review comments I missed.

[amilendra]

Use emplace_back() and remove explicit make_pair().

[MaskRay]

Thanks! LGTM from my review. It'd be good to have a review from a domain expert.

I am going to be out for the next 4 weeks, and will likely have little time reading patches. The patch looks good to land when a domain expert thinks it's fine.

lld/ELF/Arch/ARM.cpp

1007

lld/ELF/InputFiles.cpp

336

My comment may be unclear.

if (armCmseImpLib) parseArmCMSEImportLib(*armCmseImpLib);, then this function will not need a std::optional argument.

lld/ELF/InputFiles.h

51

Did you mean: Parse symbols in an Arm CMSE import library?

Or perhaps just remove the comment since the function name is self-explanatory.

lld/ELF/Options.td

92

to the location specified => to <file>.

The metasyntactic name <file> can be used to simplify and clarify the help message.

Perhaps @peter.smith has some specific suggestions here.

[MaskRay]

lld/ELF/Arch/ARM.cpp

994

__acle_se_<sym>

[amilendra]

Address review comments.

[amilendra]

In D139092#4182991, @MaskRay wrote:

Thanks! LGTM from my review. It'd be good to have a review from a domain expert.

I am going to be out for the next 4 weeks, and will likely have little time reading patches. The patch looks good to land when a domain expert thinks it's fine.

Thanks for the reviews. I'll wait till @peter.smith or someone else who knows the domain has a look before landing.

[amilendra]

Add missing full stop.

[peter.smith]

I've not finished checking yet, but thought it worth sending the comments that I have so far. Only thing that I can spot that looks wrong is that CMSE is M-profile only so the attributes check looks like it needs adjusting. The remainder are nit level comments.

lld/ELF/Arch/ARM.cpp

918

I know the language is taken from InputFiles.cpp, but I think it would be worth correcting here. I suggest
symbols is a parall array to the corresponding Elf symbol table.

997

The function is called process, but it is not clear without reading the code what processing is done. I think it is doing two things:

• Record the [__acle_se_<sym>, <sym>] pair for later processing.
• Resolve any undefined symbols against the definitions in the CMSE Import Lib.

Would be good to make that explicit in the comment.

998

Should be plural processArmCmseSymbols() as this processes more than one symbol.

lld/ELF/Driver.cpp

2808

Should be plural processArmCmseSymbols()

lld/ELF/InputFiles.cpp

181

The check below is a bit too loose as it will also include the A profile CPU arch > v8_M_Base as they are in the same tag. I think you'll need (pseudo code) && CPU_arch_profile = M

lld/ELF/SyntheticSections.h

1183

Is impLibMinAddr used? I can see it being assigned to, but can't see it being used for anything.

lld/test/ELF/arm-cmse-diagnostics.s

37

Thumbv9a doesn't have CMSE, only M-profile has CMSE.

[peter.smith]

A few more comments on some things that don't look right compared to the GNU ld interface.

lld/ELF/Arch/ARM.cpp

1036

I don't think this is needed. The non-secure app doesn't use --cmse-implib or --in-implib it just uses the raw object file produced by --out-implib.

If we do end up matching an undefined in the importlib from the secure application then something has gone badly wrong.

lld/test/ELF/arm-cmse-secure.s

13

The non-secure app doesn't use --in-implib and --cmse-implib it just uses implib.lib which is just a standard relocatable object. It doesn't actually need to know whether the definitions in the implib are CMSE related or not.

26

What is the destination of this bl? it should be bl __acle_se_entry the secure state should not use the import library. The import library is for the use of non-secure state.

Will be useful to add a test case where we take the address of _entry which should be crystallised as __acle_entry.

[peter.smith]

I think that's all the comments I have for this round.

lld/ELF/Arch/ARM.cpp

940

What about the binding? IIUC it is possible to have a weak definition.

Do we need to record the type? Or are these implicitly STT_FUNC so it doesn't matter?

1006

One thing that I don't think this will work for is wrapped secure entry functions. For example in secure state if I have a secure entry function foo, __acle_foo and I make another secure entry function __wrap_foo, acle_wrap_foo` then we'll only want to create one SG veneer for foo which calls __acle_foo where __acle_foo is the renamed __acle___wrap_foo. The original foo, __acle_foo are renamed to foo, __acle_foo are renamed to __real_foo and __acle___real_foo (in theory __acle___real_foo is useless is the wrapped entry function is no longer an entry function.

I think this will need quite a bit of faff to work properly. My suggestion is to search for __acle___wrap and error that wrapping secure entry functions is not supported. Could be worth adding support in a follow up patch.

Another thing we could check for is an attempt to wrap a secure entry function with a function that isn't a secure entry point. I.e. we have foo, __acle_foo but we only have __wrap_foo and no __acle__wrap_foo.

1062

I don't understand why we are sorting cmseSymVector by name of the non acle prefixed symbol. We partitions and sort the sgSections later on so I don't think the order of cmseSymVector matters? I could be missing something though.

1070

In the GNU ld implementation it is a warning when:

• The in_implib contains an entry for foo but there is no __acle_foo defined.
• When there is an in_implib but no out_implib when there is a new entry.

In both case this is an interface change so I do think it is worth warning about.

[amilendra]

Address some of Peter's comments.
Expect how relocation against entry symbols are handled will be particularly contentious.
Couple of diagnostics suggested needs implementation and how the binding is handled needs investigation.

[peter.smith]

Thanks for the updates. I think we're getting close now. I've made an alternative suggestion to how we can redirect symbols which might be more easily localised to the ARM.cpp file.

lld/ELF/Arch/ARM.cpp

1057

Recommend something like:

"entry function '" + sym->getName() +"' from CMSE import library is not present in secure application"

lld/ELF/Relocations.cpp

1346 ↗

(On Diff #506604)

While I think this will work. I'm thinking that there could be a less intrusive way of achieving this. As I understand it when we create SG veneers we have input sections with sym, and __acle_sym defined to the same address. All relocations and references are to sym.

In the current implementation, we redirect relocations from sym to __acle_sym and then it looks like we overwrite sym in finalize with the value of the SG Veneer.

Could we use a similar mechanism to SymbolTable::wrap() and essentially exchange __acle_sym with sym so that all references to sym go to __acle_sym we are then free to overwrite sym?

lld/ELF/SymbolTable.h

70

Can we use a struct with named values here rather than a pair for example:

struct EntryFunction {
  Symbol *acleSeSym;
  Symbol *sym;
};

I find nested pairs such as second.first and second.second hard to read.

[amilendra]

Change warning message.

After rebasing, the inCMSEOutImpLib flag now results in a "SymbolUnion too large" assert,
so use a hash table to keep track of symbols in the output import library.

[amilendra]

• Change implementation for redirecting references to secure gateways in secure apps to the corresponding entry functions.
• Add diagnostic when a new entry function is added to the specified input import library, but there is no output import library specified.

[amilendra]

lld/ELF/Arch/ARM.cpp

940

From construction, only weak or global symbols will endup in the symbol table, and the linker errors for non STT_FUNC types so it should not matter, but I've added code to record binding and type just in case it will be useful later.

[amilendra]

Test change only. NFC.
Remove --cmse-implib when linking the non-secure app.

[amilendra]

lld/ELF/Relocations.cpp

1346 ↗

(On Diff #506604)

Exchanging __acle_sym with sym in SymbolTable->symVector doesn't seem to work because InputFiles->symbols[] will continue to point to sym which is what the Relocations are using. So I had to change InputFiles->symbols[] to point to __acle_sym. However this implementation seems better than my previous attemp because it could be localized to only the Arm backend.

[amilendra]

lld/ELF/Arch/ARM.cpp

1006

I'll add support for this in a subsequent patch.

[peter.smith]

Just a couple of suggestions. I think there is a way of implementing the symbol changes without needing an ObjFile member function. I've also recommended adding a comment to describe the implementation as a whole.

lld/ELF/Arch/ARM.cpp

917

For the benefit of our future selves I think it would be useful to put a summary comment about how the LLD CMSE code fits together.

The Arm Cortex-M Security Extensions (CMSE) splits a system into two parts, the non-secure and secure states with the secure state inaccessible from the non-secure state, apart from an area of memory in secure state called the secure gateway which is accessible from non-secure state. The secure gateway contains one or more entry points which must start with a landing pad instruction SG. Arm recommends that the secure gateway consists only of secure gateway veneers, which are made up of a SG instruction followed by a branch to the destination in secure state. Full details can be found in Arm v8-M Security Extensions Requirements on Development Tools.

The CMSE model of software development requires the non-secure and secure states to be developed as two separate programs. The non-secure developer is provided with an import library defining symbols describing the entry points in the secure gateway. No additional linker support is required for the non-secure state.

Development of the secure state requires linker support to manage the secure gateway veneers. The management consists of:

• Creation of new secure gateway veneers based on symbol conventions.
• Checking the address of existing secure gateway veneers.
• Warning when existing secure gateway veneers removed.

The secure gateway veneers are created in an import library, which is just an ELF object with a symbol table. The import library is controlled by two command line options:
--in-implib (specify an input import library from a previous revision of the program).
--out-implib (specify an output import library to be created by the linker).

The input import library is used to manage consistency of the secure entry points. The output import library is for new and updated secure entry points.

The symbol convention that identifies secure entry functions is the prefix acle_se_ for a symbol called name the linker is expected to create a secure gateway veneer if symbols acles_se_name and name have the same address. After creating a secure gateway veneer the symbol name labels the secure gateway veneer and the __acle_se_name labels the function definition.

The LLD implementation:

• Reads an existing import library with importCmseSymbols().
• Determines which new secure gateway veneers to create and redirects calls within the secure state to the __acle_se_ prefixed symbol with processCmseSymbols().
• Models the SG veneers as a synthetic section.

975

wrapSymbols does something similar but uses file->getMutableSymbols() are we able to use this instead as it will mean that we don't need redirectCmseSymbols() in ObjFile.

The code in wrapSymbols is:

parallelForEach(symtab->objectFiles, [&](InputFile *file) {
   MutableArrayRef<Symbol *> syms = file->getMutableSymbols();
   for (size_t i = 0, e = syms.size(); i != e; ++i)
     if (Symbol *s = map.lookup(syms[i]))
       syms[i] = s;
 });

[amilendra]

Address Peter's review comments.

[amilendra]

• Fix an issue where the sections containing entry functions got garbage collected.
• Write the secure gateways using halfwords and write16 to make it big-endian compatible.

[peter.smith]

I was able to successfully link a trusted-firmware secure application example with this patch. I've only got one minor observation about symbol order. Hopefully easy to sort out. From there I should be able to approve.

lld/ELF/Arch/ARM.cpp

1237

I noticed that for an example CMSE application that I tried, the symbols in the LLD import library were in reverse order of address. While there is no requirement for the symbols to be in ascending order it did look a bit strange.

The code here looks like it will be determined by the order that the StringMap iterator gives. Maps often have no defined order.

I recommend putting into a vector and sorting by address so we get a known address order.

[MaskRay]

lld/ELF/Arch/ARM.cpp

1237

Seems that we can use a SmallMapVector<Key, Value, 0>

lld/ELF/MarkLive.cpp

233 ↗

(On Diff #528773)

for (auto [symName, _] : symtab.cmseSymMap)

lld/test/ELF/arm-cmse-diagnostics.s

97

Just needs one pattern

[amilendra]

• Use SmallMapVector for cmseSymMap
• Sort symbols in the import library in ascending order of address

[amilendra]

Test refactoring.

[peter.smith]

LGTM. Thanks for the patience with all the comments. Will be worth waiting a day or so to offer MaskRay a chance for any final comments.

[MaskRay]

lld/ELF/Arch/ARM.cpp

1082

Misuse of ;?

1109

auto [_, sym] avoids Defined *sym = p.second;

ditto below

1129

1139

Use count instead of find(...) ==/!= end()

1141

++newEntries

1151

1188

ArmCmseSGVeneer *. ditto everywhere

lld/test/ELF/arm-cmse-diagnostics.s

143

These comments are indented while the majority of comments don't. Consider removing indentation.

[amilendra]

Apply the suggested refactoring.

[amilendra]

@MaskRay Do you have any further comments? Or is it okay to land this?

[amilendra]

rebase.

[amilendra]

Because @MaskRay and @peter.smith have approved this patch previously, I will land it in a bit.
Hopefully, any further issues can be addressed incrementally as follow-up patches.
Thanks for the reviews/suggestions.

[amilendra]

rebase.

[amilendra]

I am getting reports of build bot failures due to

/buildbot/llvm-project/lld/ELF/Arch/ARM.cpp:1300:29: error: expected primary-expression before ‘>’ token
 1300 |     osec->writeHeaderTo<ELFT>(++sHdrs);
      |                             ^
/buildbot/llvm-project/lld/ELF/Arch/ARM.cpp:1306:25: error: expected primary-expression before ‘>’ token
 1306 |       osec->writeTo<ELFT>(buf + osec->offset, tg);
      |                         ^

and warnings.

/home/buildbot/as-builder-4/llvm-clang-x86_64-expensive-checks-ubuntu/llvm-project/lld/ELF/Arch/ARM.cpp:1306:31: warning: left operand of comma operator has no effect [-Wunused-value]
/home/buildbot/as-builder-4/llvm-clang-x86_64-expensive-checks-ubuntu/llvm-project/lld/ELF/Arch/ARM.cpp:1306:31: warning: left operand of comma operator has no effect [-Wunused-value]
/home/buildbot/as-builder-4/llvm-clang-x86_64-expensive-checks-ubuntu/llvm-project/lld/ELF/Arch/ARM.cpp:1306:31: warning: left operand of comma operator has no effect [-Wunused-value]
/home/buildbot/as-builder-4/llvm-clang-x86_64-expensive-checks-ubuntu/llvm-project/lld/ELF/Arch/ARM.cpp:1306:31: warning: left operand of comma operator has no effect [-Wunused-value]

I am investigating a quick fix, but feel free to revert this if it blocks your work.

[hctim]

Hi folks,

Looks like this broke the UBSan bulidbot. Unfortunately this patch was included in a set with a build-break, so it only showed up the build after and all the builds since.

The problem reproduces with a simple UBSan build, *as long as you use libcxx*. Using libstdc++ doesn't repro the problem.

You can reproduce the full buildbot using https://github.com/google/sanitizers/wiki/SanitizerBotReproduceBuild, either buildbot_fast.sh or buildbot_bootstrap_ubsan.sh should repro it. Or, my faster variant for local repro was:

$ cmake \
-DLLVM_ENABLE_ASSERTIONS=ON \
-DCMAKE_C_COMPILER=$HOME/llvm-build/opt/bin/clang \
-DCMAKE_CXX_COMPILER=$HOME/llvm-build/opt/bin/clang++ \
-DLLVM_USE_LINKER=lld \
-GNinja \
-DCMAKE_BUILD_TYPE=Release \
-DCMAKE_C_FLAGS="-fsanitize=undefined" \
-DCMAKE_CXX_FLAGS="-fsanitize=undefined" \
-DLLVM_ENABLE_PROJECTS="'clang;lld;libc'" \
-DLLVM_ENABLE_RUNTIMES="libcxx;libcxxabi" \
-DLLVM_LIBC_ENABLE_LINTING=OFF \
-DLLVM_USE_SANITIZER=Undefined \
-DLLVM_ENABLE_LIBCXX=ON `# NOTE: Super important!` \
/usr/local/google/home/mitchp/llvm/llvm
$ ninja check-lld

Not sure whether you need a modern libcxx. The buildbot does all the steps for you, but you can also have success doing a ninja install from a regular opt build, then adding libcxx to your linkerconfig. Something like sudo ldconfig /usr/local/lib/x86_64-unknown-linux-gnu/, you can find libcxx by find /usr/local/lib -name *libc++*.

[amilendra]

In D139092#4440833, @hctim wrote:

Hi folks,

Looks like this broke the UBSan bulidbot. Unfortunately this patch was included in a set with a build-break, so it only showed up the build after and all the builds since.

The problem reproduces with a simple UBSan build, *as long as you use libcxx*. Using libstdc++ doesn't repro the problem.

You can reproduce the full buildbot using https://github.com/google/sanitizers/wiki/SanitizerBotReproduceBuild, either buildbot_fast.sh or buildbot_bootstrap_ubsan.sh should repro it. Or, my faster variant for local repro was:

$ cmake \
-DLLVM_ENABLE_ASSERTIONS=ON \
-DCMAKE_C_COMPILER=$HOME/llvm-build/opt/bin/clang \
-DCMAKE_CXX_COMPILER=$HOME/llvm-build/opt/bin/clang++ \
-DLLVM_USE_LINKER=lld \
-GNinja \
-DCMAKE_BUILD_TYPE=Release \
-DCMAKE_C_FLAGS="-fsanitize=undefined" \
-DCMAKE_CXX_FLAGS="-fsanitize=undefined" \
-DLLVM_ENABLE_PROJECTS="'clang;lld;libc'" \
-DLLVM_ENABLE_RUNTIMES="libcxx;libcxxabi" \
-DLLVM_LIBC_ENABLE_LINTING=OFF \
-DLLVM_USE_SANITIZER=Undefined \
-DLLVM_ENABLE_LIBCXX=ON `# NOTE: Super important!` \
/usr/local/google/home/mitchp/llvm/llvm
$ ninja check-lld

Not sure whether you need a modern libcxx. The buildbot does all the steps for you, but you can also have success doing a ninja install from a regular opt build, then adding libcxx to your linkerconfig. Something like sudo ldconfig /usr/local/lib/x86_64-unknown-linux-gnu/, you can find libcxx by find /usr/local/lib -name *libc++*.

Sorry for the inconvenience and thanks for the revert. I will investigate.

[amilendra]

Reopening to fix the ASAN/UBSAN failures.

[amilendra]

Address Sanitizer Failure Fix

ArmCmseSGVeneer being a synthetic section resulted in SectionBase::getOutputSection() falling through to return cast<OutputSection>(this) and returning an unaligned pointer value when called by SectionBase::getVA(unsigned long) in ArmCmseSGVeneer::writeTo().

Fix this by modelling ArmCmseSGVeneer as an independent class with an offset within the ArmCmseSGSection (similar to Thunks), eliminating the need of the getVA() call.

[amilendra]

FYI @MaskRay, @peter.smith or anyone else interested in this,
I've made some slight changes to fix the asan/ubsan errors.
Please let me know if there are objections in landing it like this.
(I think MaskRay is away till 5th of July, so I will wait till then)

[peter.smith]

Some suggestions for simplification.

lld/ELF/Arch/ARM.cpp

1192

IIUC at this point we have two partions:
P1
ordered by address existing implib veneers
P2
reverse ordered new veneers

I think you could simplify the code by using std::reverse(it, sgSections.end()); on the second partition rather than traversing it via llvm::reverse()

Then I think you would only need one much simpler loop.

for (size_t i; i < sgSections.size() ++i) {
  ArmCmseSGVeneer* s = sgSections[i];
  s->offset = i * s->size();
  Defined(file, StringRef(), s->sym->binding, s->sym->stOther, s->sym->type,
            s->offset | 1, s->size(), this)
        .overwrite(*s->sym);
}

lld/ELF/SyntheticSections.h

1151

Can the definition be moved into ARM.cpp? In ArmCMSESGVeneerSection the type is only used by name so we should be able to forward declare it here?

1156

If this is no longer a SyntheticSection you can make it a static const size_t as all SG veneers are the same size.

1181

As these are no longer sections perhaps worth calling them sgVeneers?

[amilendra]

lld/ELF/SyntheticSections.h

1151

I did try this, but it gave me an incomplete type error. It works for Thunk so can't see why it doesn't here. I'll give it another go.

[amilendra]

Refactor using Peter's suggestions.

[amilendra]

lld/ELF/Arch/ARM.cpp

1192

Actually the reverse is also no longer needed. Thanks for the suggestion.

[peter.smith]

Thanks for the updates, LGTM.

[amilendra]

Because Peter has approved, and I don't think there has been significant changes since MaskRay previously approved, I will land this in a bit.
Please let me know if there are any objections.

[amilendra]

Rebase

lld/ELF/Arch/ARM.cpp

 //===- ARM.cpp ------------------------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
+#include "InputFiles.h"
+#include "OutputSections.h"
+#include "SymbolTable.h"
 #include "Symbols.h"
 #include "SyntheticSections.h"
 #include "Target.h"
 #include "lld/Common/ErrorHandler.h"
+#include "lld/Common/Filesystem.h"
 #include "llvm/BinaryFormat/ELF.h"
 #include "llvm/Support/Endian.h"
 
 using namespace llvm;
 using namespace llvm::support::endian;
 using namespace llvm::support;
 using namespace llvm::ELF;
 using namespace lld;
 using namespace lld::elf;
+using namespace llvm::object;
 
 namespace {
 class ARM final : public TargetInfo {
 public:
   ARM();
   uint32_t calcEFlags() const override;
   RelExpr getRelExpr(RelType type, const Symbol &s,
                      const uint8_t *loc) const override;
int64_t ARM::getImplicitAddend(const uint8_t *buf, RelType type) const {
   }
   case R_ARM_NONE:
   case R_ARM_V4BX:
   case R_ARM_JUMP_SLOT:
     // These relocations are defined as not having an implicit addend.
     return 0;
   }
 }
 
+// Initialize symbols. symbols is a parallel array to the corresponding ELF
+// symbol table.
+template <class ELFT> void ObjFile<ELFT>::importCmseSymbols() {
+  ArrayRef<Elf_Sym> eSyms = getELFSyms<ELFT>();
+  // Error for local symbols. The symbol at index 0 is LOCAL. So skip it.
+  for (size_t i = 1, end = firstGlobal; i != end; ++i) {
+    errorOrWarn("CMSE symbol '" + CHECK(eSyms[i].getName(stringTable), this) +
+                "' in import library '" + toString(this) + "' is not global");
+  }
+
+  for (size_t i = firstGlobal, end = eSyms.size(); i != end; ++i) {
+    const Elf_Sym &eSym = eSyms[i];
+    Defined *sym = reinterpret_cast<Defined *>(make<SymbolUnion>());
+
+    // Initialize symbol fields.
+    memset(sym, 0, sizeof(Symbol));
+    sym->setName(CHECK(eSyms[i].getName(stringTable), this));
+    sym->value = eSym.st_value;
+    sym->size = eSym.st_size;
+    sym->type = eSym.getType();
+    sym->binding = eSym.getBinding();
+    sym->stOther = eSym.st_other;
+
+    if (eSym.st_shndx != SHN_ABS) {
+      error("CMSE symbol '" + sym->getName() + "' in import library '" +
+            toString(this) + "' is not absolute");
+      continue;
+    }
+
+    if (!(eSym.st_value & 1) || (eSym.getType() != STT_FUNC)) {
+      error("CMSE symbol '" + sym->getName() + "' in import library '" +
+            toString(this) + "' is not a Thumb function definition");
+      continue;
+    }
+
+    if (symtab.cmseImportLib.count(sym->getName())) {
+      error("CMSE symbol '" + sym->getName() +
+            "' is multiply defined in import library '" + toString(this) + "'");
+      continue;
+    }
+
+    if (eSym.st_size != ACLESESYM_SIZE) {
+      warn("CMSE symbol '" + sym->getName() + "' in import library '" +
+           toString(this) + "' does not have correct size of " +
+           Twine(ACLESESYM_SIZE) + " bytes");
+    }
+
+    symtab.cmseImportLib[sym->getName()] = sym;
+  }
+}
+
+// If this is an Arm CMSE secure app, replace references to entry symbol <sym>
+// with its corresponding special symbol ; __acle_se_<sym>.
+static void redirectCmseSymbols() {
+  for (ELFFileBase *f : ctx.objectFiles) {
+    switch (f->ekind) {
+    case ELF32LEKind:
+      cast<ObjFile<ELF32LE>>(f)->redirectCmseSymbols();
+      break;
+    case ELF32BEKind:
+      cast<ObjFile<ELF32BE>>(f)->redirectCmseSymbols();
+      break;
+    default:
+      llvm_unreachable("");
+    }
+  }
+}
+
+template <class ELFT> void ObjFile<ELFT>::redirectCmseSymbols() {
+  for (uint32_t i = 0; i < numSymbols; ++i) {
+    StringRef symName = symbols[i]->getName();
+    if (symtab.cmseSymMap.count(symName))
+      symbols[i] = symtab.cmseSymMap[symName].acleSeSym;
+  }
+}
+
+// Check symbol attributes of the acleSeSym, sym pair.
+// Both symbols should be global/weak Thumb code symbol definitions.
+static std::string checkCmseSymAttributes(Symbol *acleSeSym, Symbol *sym) {
+  auto check = [](Symbol *s, StringRef type) -> std::optional<std::string> {
+    auto d = dyn_cast_or_null<Defined>(s);
+    if (!(d && d->isFunc() && (d->value & 1)))
+      return (Twine(toString(s->file)) + ": cmse " + type + " symbol '" +
+              s->getName() + "' is not a Thumb function definition")
+          .str();
+    if (!d->section)
+      return (Twine(toString(s->file)) + ": cmse " + type + " symbol '" +
+              s->getName() + "' cannot be an absolute symbol")
+          .str();
+    return std::nullopt;
+  };
+  for (auto [sym, type] :
+       {std::make_pair(acleSeSym, "special"), std::make_pair(sym, "entry")})
+    if (auto err = check(sym, type))
+      return *err;
+  return "";
+}
+
+// Look for [__acle_se_<sym>, <sym>] pairs, as specified in the Cortex-M
+// Security Extensions specification.
+// 1) <sym> : A standard function name.
+// 2) __acle_se_<sym> : A special symbol that prefixes the standard function
+// name with __acle_se_.
+// Both these symbols are Thumb function symbols with external linkage.
+// <sym> may be redefined in .gnu.sgstubs.
+void elf::processArmCmseSymbols() {
+  if (!config->cmseImplib)
+    return;
+  // Only symbols with external linkage end up in symtab, so no need to do
+  // linkage checks. Only check symbol type.
+  for (Symbol *acleSeSym : symtab.getSymbols()) {
+    if (!acleSeSym->getName().startswith(ACLESESYM_PREFIX))
+      continue;
+    // If input object build attributes do not support CMSE, error and disable
+    // further scanning for <sym>, __acle_se_<sym> pairs.
+    if (!config->armCMSESupport) {
+      error("CMSE is only supported by ARMv8-M architecture or later");
+      config->cmseImplib = false;
+      break;
+    }
+
+    // Try to find the associated symbol definition.
+    // Symbol must have external linkage.
+    StringRef name = acleSeSym->getName().substr(std::strlen(ACLESESYM_PREFIX));
+    Symbol *sym = symtab.find(name);
+    if (!sym) {
+      error(toString(acleSeSym->file) + ": cmse special symbol '" +
+            acleSeSym->getName() +
+            "' detected, but no associated entry function definition '" + name +
+            "' with external linkage found");
+      continue;
+    }
+
+    std::string errMsg = checkCmseSymAttributes(acleSeSym, sym);
+    if (!errMsg.empty()) {
+      error(errMsg);
+      continue;
+    }
+
+    // <sym> may be redefined later in the link in .gnu.sgstubs
+    symtab.cmseSymMap[name] = {acleSeSym, sym};
+  }
+
+  redirectCmseSymbols();
+}
+
+ArmCmseSGSection::ArmCmseSGSection()
+    : SyntheticSection(llvm::ELF::SHF_ALLOC | llvm::ELF::SHF_EXECINSTR,
+                       llvm::ELF::SHT_PROGBITS,
+                       /*alignment=*/32, ".gnu.sgstubs") {
+  entsize = ACLESESYM_SIZE;
+  // The range of addresses used in the CMSE import library should be fixed.
+  for (auto &p : symtab.cmseImportLib) {
+    Defined *sym = p.second;
+    if (impLibMaxAddr <= sym->value)
+      impLibMaxAddr = sym->value + sym->size;
+  }
+  if (symtab.cmseSymMap.empty())
+    return;
+  addMappingSymbol();
+  for (auto &p : symtab.cmseSymMap)
+    addSGVeneer(cast<Defined>(p.second.acleSeSym), cast<Defined>(p.second.sym));
+  for (auto &p : symtab.cmseImportLib) {
+    Defined *sym = p.second;
+    if (symtab.inCMSEOutImpLib.find(sym->getName()) ==
+        symtab.inCMSEOutImpLib.end())
+      warn("entry function '" + sym->getName() +
+           "' from CMSE import library is not present in secure application");
+  }
+
+  if (!symtab.cmseImportLib.empty() && config->cmseOutputLib.empty()) {
+    for (auto &p : symtab.cmseSymMap) {
+      Symbol *sym = p.second.sym;
+      if (symtab.cmseImportLib.find(sym->getName()) ==
+          symtab.cmseImportLib.end())
+        warn("new entry function '" + sym->getName() +
+             "' introduced but no output import library specified");
+    }
+  }
+}
+
+void ArmCmseSGSection::addSGVeneer(Symbol *acleSeSym, Symbol *sym) {
+  entries.emplace_back(std::make_pair(acleSeSym, sym));
+  if (symtab.cmseImportLib.count(sym->getName()))
+    symtab.inCMSEOutImpLib[sym->getName()] = true;
+  // Symbol addresses different, nothing to do.
+  if (acleSeSym->file != sym->file ||
+      cast<Defined>(*acleSeSym).value != cast<Defined>(*sym).value)
+    return;
+  // Only secure symbols with values equal to that of it's non-secure
+  // counterpart needs to be in the .gnu.sgstubs section.
+  ArmCmseSGVeneer *ss = nullptr;
+  if (symtab.cmseImportLib.find(sym->getName()) == symtab.cmseImportLib.end()) {
+    ss = make<ArmCmseSGVeneer>(sym, acleSeSym);
+    newEntries += 1;
+  } else {
+    Defined *impSym = symtab.cmseImportLib[sym->getName()];
+    ss = make<ArmCmseSGVeneer>(sym, acleSeSym, impSym->value);
+  }
+  ss->parent = this;
+  sgSections.emplace_back(ss);
+}
+
+void ArmCmseSGSection::writeTo(uint8_t *buf) {
+  for (auto *s : sgSections)
+    s->writeTo(buf + s->outSecOff - getVA());
+}
+
+void ArmCmseSGSection::addMappingSymbol() {
+  addSyntheticLocal("$t", STT_NOTYPE, /*off=*/0, /*size=*/0, *this);
+}
+
+size_t ArmCmseSGSection::getSize() const {
+  if (sgSections.empty())
+    return (impLibMaxAddr ? impLibMaxAddr - getVA() : 0) + newEntries * entsize;
+
+  return entries.size() * entsize;
+}
+
+void ArmCmseSGSection::finalizeContents() {
+  if (sgSections.empty())
+    return;
+
+  auto it =
+      std::stable_partition(sgSections.begin(), sgSections.end(),
+                            [](auto *i) { return i->getAddr().has_value(); });
+  std::sort(sgSections.begin(), it, [](auto *a, auto *b) {
+    return a->getAddr().value() < b->getAddr().value();
+  });
+
+  // This is the partition of the veneers with fixed addresses.
+  uint64_t addr = (*sgSections.begin())->getAddr().has_value()
+                      ? (*sgSections.begin())->getAddr().value()
+                      : getVA();
+  // Check if the start address of '.gnu.sgstubs' correspond to the
+  // linker-synthesized veneer with the lowest address.
+  if ((getVA() & ~1) != (addr & ~1)) {
+    error("start address of '.gnu.sgstubs' is different from previous link");
+    return;
+  }
+
+  for (auto *s : sgSections) {
+    if (!s->getAddr().has_value())
+      break;
+    s->outSecOff = s->getAddr().value() & ~1;
+    Defined(s->file, StringRef(), s->sym->binding, s->sym->stOther,
+            s->sym->type, (s->outSecOff - getVA()) | 1, entsize, this)
+        .overwrite(*s->sym);
+  }
+  // This is the partition of veneers newly synthesized by the linker.
+  size_t off = std::max(getVA(), impLibMaxAddr);
+  for (auto *s : llvm::reverse(sgSections)) {
+    if (s->getAddr().has_value())
+      break;
+    s->outSecOff = off & ~1;
+    Defined(s->file, StringRef(), s->sym->binding, s->sym->stOther,
+            s->sym->type, (s->outSecOff - getVA()) | 1, entsize, this)
+        .overwrite(*s->sym);
+    off += s->entsize;
+  }
+}
+
+void ArmCmseSGVeneer::writeTo(uint8_t *buf) {
+  const uint8_t data[] = {
+      0x7f, 0xe9, 0x7f, 0xe9, // SG
+      0x00, 0xf0, 0x00, 0xb0, // B.W S
+  };
+  memcpy(buf, data, sizeof(data));
+  target->relocateNoSym(buf + 4, R_ARM_THM_JUMP24,
+                        acleSeSym->getVA() - getVA() - 8);
+}
+
+// Write the CMSE import library to disk.
+// The CMSE import library is a relocatable object with only a symbol table.
+// The symbols are copies of the (absolute) symbols of the secure gateways
+// in the executable output by this link.
+// See Arm® v8-M Security Extensions: Requirements on Development Tools
+// https://developer.arm.com/documentation/ecm0359818/latest
+template <typename ELFT> void elf::writeARMCmseImportLib() {
+  StringTableSection *shstrtab =
+      make<StringTableSection>(".shstrtab", /*dynamic=*/false);
+  StringTableSection *strtab =
+      make<StringTableSection>(".strtab", /*dynamic=*/false);
+  SymbolTableBaseSection *impSymTab = make<SymbolTableSection<ELFT>>(*strtab);
+
+  SmallVector<std::pair<OutputSection *, SyntheticSection *>, 0> osIsPairs;
+  osIsPairs.emplace_back(make<OutputSection>(strtab->name, 0, 0), strtab);
+  osIsPairs.emplace_back(make<OutputSection>(impSymTab->name, 0, 0), impSymTab);
+  osIsPairs.emplace_back(make<OutputSection>(shstrtab->name, 0, 0), shstrtab);
+
+  // Copy the secure gateway entry symbols to the import library symbol table.
+  for (auto &p : symtab.cmseSymMap) {
+    Defined *d = cast<Defined>(p.second.sym);
+    impSymTab->addSymbol(makeDefined(nullptr, d->getName(), d->computeBinding(),
+                                     /*stOther=*/0, STT_FUNC, d->getVA(),
+                                     d->getSize(), nullptr));
+  }
+
+  size_t idx = 0;
+  uint64_t off = sizeof(typename ELFT::Ehdr);
+  for (auto &[osec, isec] : osIsPairs) {
+    osec->sectionIndex = ++idx;
+    osec->recordSection(isec);
+    osec->finalizeInputSections();
+    osec->shName = shstrtab->addString(osec->name);
+    osec->size = isec->getSize();
+    isec->finalizeContents();
+    osec->offset = alignToPowerOf2(off, osec->addralign);
+    off = osec->offset + osec->size;
+  }
+
+  const uint64_t sectionHeaderOff = alignToPowerOf2(off, config->wordsize);
+  const auto shnum = osIsPairs.size() + 1;
+  const uint64_t fileSize =
+      sectionHeaderOff + shnum * sizeof(typename ELFT::Shdr);
+  const unsigned flags =
+      config->mmapOutputFile ? 0 : (unsigned)FileOutputBuffer::F_no_mmap;
+  unlinkAsync(config->cmseOutputLib);
+  Expected<std::unique_ptr<FileOutputBuffer>> bufferOrErr =
+      FileOutputBuffer::create(config->cmseOutputLib, fileSize, flags);
+  if (!bufferOrErr) {
+    error("failed to open " + config->cmseOutputLib + ": " +
+          llvm::toString(bufferOrErr.takeError()));
+    return;
+  }
+
+  // Write the ELF Header
+  std::unique_ptr<FileOutputBuffer> &buffer = *bufferOrErr;
+  uint8_t *const buf = buffer->getBufferStart();
+  memcpy(buf, "\177ELF", 4);
+  auto *eHdr = reinterpret_cast<typename ELFT::Ehdr *>(buf);
+  eHdr->e_type = ET_REL;
+  eHdr->e_entry = 0;
+  eHdr->e_shoff = sectionHeaderOff;
+  eHdr->e_ident[EI_CLASS] = ELFCLASS32;
+  eHdr->e_ident[EI_DATA] = config->isLE ? ELFDATA2LSB : ELFDATA2MSB;
+  eHdr->e_ident[EI_VERSION] = EV_CURRENT;
+  eHdr->e_ident[EI_OSABI] = config->osabi;
+  eHdr->e_ident[EI_ABIVERSION] = 0;
+  eHdr->e_machine = EM_ARM;
+  eHdr->e_version = EV_CURRENT;
+  eHdr->e_flags = config->eflags;
+  eHdr->e_ehsize = sizeof(typename ELFT::Ehdr);
+  eHdr->e_phnum = 0;
+  eHdr->e_shentsize = sizeof(typename ELFT::Shdr);
+  eHdr->e_phoff = 0;
+  eHdr->e_phentsize = 0;
+  eHdr->e_shnum = shnum;
+  eHdr->e_shstrndx = shstrtab->getParent()->sectionIndex;
+
+  // Write the section header table.
+  auto *sHdrs = reinterpret_cast<typename ELFT::Shdr *>(buf + eHdr->e_shoff);
+  for (auto &[osec, _] : osIsPairs)
+    osec->writeHeaderTo<ELFT>(++sHdrs);
+
+  // Write section contents to a mmap'ed file.
+  {
+    parallel::TaskGroup tg;
+    for (auto &[osec, _] : osIsPairs)
+      osec->writeTo<ELFT>(buf + osec->offset, tg);
+  }
+
+  if (auto e = buffer->commit())
+    fatal("failed to write output '" + buffer->getPath() +
+          "': " + toString(std::move(e)));
+}
+
 TargetInfo *elf::getARMTargetInfo() {
   static ARM target;
   return &target;
 }
 
+template void elf::writeARMCmseImportLib<ELF32LE>();
+template void elf::writeARMCmseImportLib<ELF32BE>();
+template void elf::writeARMCmseImportLib<ELF64LE>();
+template void elf::writeARMCmseImportLib<ELF64BE>();
+
+template void ObjFile<ELF32LE>::importCmseSymbols();
+template void ObjFile<ELF32BE>::importCmseSymbols();
+template void ObjFile<ELF64LE>::importCmseSymbols();
+template void ObjFile<ELF64BE>::importCmseSymbols();
+
+template void ObjFile<ELF32LE>::redirectCmseSymbols();
+template void ObjFile<ELF32BE>::redirectCmseSymbols();

lld/ELF/Config.h

private:
   // True if we are in --whole-archive and --no-whole-archive.
   bool inWholeArchive = false;
 
   // True if we are in --start-lib and --end-lib.
   bool inLib = false;
 
   std::unique_ptr<BitcodeCompiler> lto;
   std::vector<InputFile *> files;
+  std::optional<InputFile *> armCmseImpLib;
 
 public:
   SmallVector<std::pair<StringRef, unsigned>, 0> archiveFiles;
 };
 
 // This struct contains the global configuration for the linker.
 // Most fields are direct mapping from the command line options
 // and such fields have the same name as the corresponding options.
struct Config {
   llvm::StringRef progName;
   llvm::StringRef printArchiveStats;
   llvm::StringRef printSymbolOrder;
   llvm::StringRef soName;
   llvm::StringRef sysroot;
   llvm::StringRef thinLTOCacheDir;
   llvm::StringRef thinLTOIndexOnlyArg;
   llvm::StringRef whyExtract;
+  llvm::StringRef cmseInputLib;
+  llvm::StringRef cmseOutputLib;
   StringRef zBtiReport = "none";
   StringRef zCetReport = "none";
   llvm::StringRef ltoBasicBlockSections;
   std::pair<llvm::StringRef, llvm::StringRef> thinLTOObjectSuffixReplace;
   llvm::StringRef thinLTOPrefixReplaceOld;
   llvm::StringRef thinLTOPrefixReplaceNew;
   llvm::StringRef thinLTOPrefixReplaceNativeObject;
   std::string rpath;
   llvm::SmallVector<VersionDefinition, 0> versionDefinitions;
   llvm::SmallVector<llvm::StringRef, 0> auxiliaryList;
   llvm::SmallVector<llvm::StringRef, 0> filterList;
   llvm::SmallVector<llvm::StringRef, 0> passPlugins;
   llvm::SmallVector<llvm::StringRef, 0> searchPaths;
   llvm::SmallVector<llvm::StringRef, 0> symbolOrderingFile;
   llvm::SmallVector<llvm::StringRef, 0> thinLTOModulesToCompile;
   llvm::SmallVector<llvm::StringRef, 0> undefined;
   llvm::SmallVector<SymbolVersion, 0> dynamicList;
   llvm::SmallVector<uint8_t, 0> buildIdVector;
   llvm::SmallVector<llvm::StringRef, 0> mllvmOpts;
   llvm::MapVector<std::pair<const InputSectionBase *, const InputSectionBase *>,
                   uint64_t>
       callGraphProfile;
+  bool cmseImplib = false;
   bool allowMultipleDefinition;
   bool androidPackDynRelocs = false;
   bool armHasBlx = false;
   bool armHasMovtMovw = false;
   bool armJ1J2BranchEncoding = false;
+  bool armCMSESupport = false;
   bool asNeeded = false;
   BsymbolicKind bsymbolic = BsymbolicKind::None;
   bool callGraphProfileSort;
   bool checkSections;
   bool checkDynamicRelocs;
   llvm::DebugCompressionType compressDebugSections;
   bool cref;
   llvm::SmallVector<std::pair<llvm::GlobPattern, uint64_t>, 0>

lld/ELF/Driver.cpp

 
 // Some command line options or some combinations of them are not allowed.
 // This function checks for such errors.
 static void checkOptions() {
   // The MIPS ABI as of 2016 does not support the GNU-style symbol lookup
   // table which is a relatively new feature.
   if (config->emachine == EM_MIPS && config->gnuHash)
     error("the .gnu.hash section is not compatible with the MIPS target");
 
+  if (config->emachine == EM_ARM) {
+    if (!config->cmseImplib) {
+      if (!config->cmseInputLib.empty())
+        error("--in-implib may not be used without --cmse-implib");
+      if (!config->cmseOutputLib.empty())
+        error("--out-implib may not be used without --cmse-implib");
+    }
+  } else {
+    if (config->cmseImplib)
+      error("--cmse-implib is only supported on ARM targets");
+    if (!config->cmseInputLib.empty())
+      error("--in-implib is only supported on ARM targets");
+    if (!config->cmseOutputLib.empty())
+      error("--out-implib is only supported on ARM targets");
+  }
+
   if (config->fixCortexA53Errata843419 && config->emachine != EM_AARCH64)
     error("--fix-cortex-a53-843419 is only supported on AArch64 targets");
 
   if (config->fixCortexA8 && config->emachine != EM_ARM)
     error("--fix-cortex-a8 is only supported on ARM targets");
 
   if (config->fixCortexA8 && !config->isLE)
     error("--fix-cortex-a8 is not supported on big endian targets");
   
config->executeOnly =
       args.hasFlag(OPT_execute_only, OPT_no_execute_only, false);
   config->exportDynamic =
       args.hasFlag(OPT_export_dynamic, OPT_no_export_dynamic, false) ||
       args.hasArg(OPT_shared);
   config->filterList = args::getStrings(args, OPT_filter);
   config->fini = args.getLastArgValue(OPT_fini, "_fini");
   config->fixCortexA53Errata843419 = args.hasArg(OPT_fix_cortex_a53_843419) &&
                                      !args.hasArg(OPT_relocatable);
+  config->cmseImplib = args.hasArg(OPT_cmse_implib);
+  config->cmseInputLib = args.getLastArgValue(OPT_in_implib);
+  config->cmseOutputLib = args.getLastArgValue(OPT_out_implib);
   config->fixCortexA8 =
       args.hasArg(OPT_fix_cortex_a8) && !args.hasArg(OPT_relocatable);
   config->fortranCommon =
       args.hasFlag(OPT_fortran_common, OPT_no_fortran_common, false);
   config->gcSections = args.hasFlag(OPT_gc_sections, OPT_no_gc_sections, false);
   config->gnuUnique = args.hasFlag(OPT_gnu_unique, OPT_no_gnu_unique, true);
   config->gdbIndex = args.hasFlag(OPT_gdb_index, OPT_no_gdb_index, false);
   config->icf = getICF(args);
case OPT_no_whole_archive:
       inWholeArchive = false;
       break;
     case OPT_just_symbols:
       if (std::optional<MemoryBufferRef> mb = readFile(arg->getValue())) {
         files.push_back(createObjFile(*mb));
         files.back()->justSymbols = true;
       }
       break;
+    case OPT_in_implib:
+      if (armCmseImpLib)
+        error("multiple CMSE import libraries not supported");
+      else if (std::optional<MemoryBufferRef> mb = readFile(arg->getValue()))
+        armCmseImpLib = createObjFile(*mb);
+      break;
     case OPT_start_group:
       if (InputFile::isInGroup)
         error("nested --start-group");
       InputFile::isInGroup = true;
       break;
     case OPT_end_group:
       if (!InputFile::isInGroup)
         error("stray --end-group");
if (sym2->versionId > VER_NDX_GLOBAL
       sym2->symbolKind = Symbol::PlaceholderKind;
       sym2->isUsedInRegularObj = false;
     }
   }
 }
 
 // Do renaming for --wrap and foo@v1 by updating pointers to symbols.
 //
 // When this function is executed, only InputFiles and symbol table
 // contain pointers to symbol objects. We visit them to replace pointers,
 // so that wrapped symbols are swapped as instructed by the command line.
 static void redirectSymbols(ArrayRef<WrappedSymbol> wrapped) {
   llvm::TimeTraceScope timeScope("Redirect symbols");
   DenseMap<Symbol *, Symbol *> map;
   for (const WrappedSymbol &w : wrapped) {
     map[w.sym] = w.wrap;
     map[w.real] = w.sym;
   }
 
   // If there are version definitions (versionDefinitions.size() > 2), enumerate
   // symbols with a non-default version (foo@v1) and check whether it should be
static void checkAndReportMissingFeature(StringRef config, uint32_t features,
   if (!(features & mask)) {
     if (config == "error")
       error(report);
     else if (config == "warning")
       warn(report);
   }
 }
 
 // To enable CET (x86's hardware-assisted control flow enforcement), each
 // source file must be compiled with -fcf-protection. Object files compiled
 // with the flag contain feature flags indicating that they are compatible
 // with CET. We enable the feature only when all object files are compatible
 // with CET.
 //
 // This is also the case with AARCH64's BTI and PAC which use the similar
 // GNU_PROPERTY_AARCH64_FEATURE_1_AND mechanism.
 static uint32_t getAndFeatures() {
for (ELFFileBase *f : ctx.objectFiles) {
     } else if (config->zForceIbt &&
                !(features & GNU_PROPERTY_X86_FEATURE_1_IBT)) {
       if (config->zCetReport == "none")
         warn(toString(f) + ": -z force-ibt: file does not have "
                            "GNU_PROPERTY_X86_FEATURE_1_IBT property");
       features |= GNU_PROPERTY_X86_FEATURE_1_IBT;
     }
     if (config->zPacPlt && !(features & GNU_PROPERTY_AARCH64_FEATURE_1_PAC)) {
       warn(toString(f) + ": -z pac-plt: file does not have "
                          "GNU_PROPERTY_AARCH64_FEATURE_1_PAC property");
       features |= GNU_PROPERTY_AARCH64_FEATURE_1_PAC;
     }
     ret &= features;
   }
 
   // Force enable Shadow Stack.
   if (config->zShstk)
void LinkerDriver::link(opt::InputArgList &args) {
   // add files to the link, via autolinking, these files are always
   // appended to the Files vector.
   {
     llvm::TimeTraceScope timeScope("Parse input files");
     for (size_t i = 0; i < files.size(); ++i) {
       llvm::TimeTraceScope timeScope("Parse input files", files[i]->getName());
       parseFile(files[i]);
     }
+    if (armCmseImpLib)
+      parseArmCMSEImportLib(*armCmseImpLib);
   }
 
   // Now that we have every file, we can decide if we will need a
   // dynamic symbol table.
   // We need one if we were asked to export dynamic symbols or if we are
   // producing a shared library.
   // We also need one if any shared libraries are used and for pie executables
   // (probably because the dynamic linker needs it).
for (const DuplicateSymbol &d : ctx.duplicates)
     reportDuplicate(*d.sym, d.file, d.section, d.value);
 
   // Handle --exclude-libs again because lto.tmp may reference additional
   // libcalls symbols defined in an excluded archive. This may override
   // versionId set by scanVersionScript().
   if (args.hasArg(OPT_exclude_libs))
     excludeLibs(args);
 
+  // Record [__acle_se_<sym>, <sym>] pairs for later processing.
+  processArmCmseSymbols();
+
   // Apply symbol renames for --wrap and combine foo@v1 and foo@@v1.
   redirectSymbols(wrapped);
 
   // Replace common symbols with regular symbols.
   replaceCommonSymbols();
 
   {
     llvm::TimeTraceScope timeScope("Aggregate sections");

lld/ELF/InputFiles.h

 extern std::unique_ptr<llvm::TarWriter> tar;
 
 // Opens a given file.
 std::optional<MemoryBufferRef> readFile(StringRef path);
 
 // Add symbols in File to the symbol table.
 void parseFile(InputFile *file);
 
+void parseArmCMSEImportLib(InputFile *file);
+
 // The root class of input files.
 class InputFile {
 protected:
   std::unique_ptr<Symbol *[]> symbols;
   uint32_t numSymbols = 0;
   SmallVector<InputSectionBase *, 0> sections;
 
 public:
public:
   // but had one or more functions with the no_split_stack attribute.
   bool someNoSplitStack = false;
 
   // Get cached DWARF information.
   DWARFCache *getDwarf();
 
   void initSectionsAndLocalSyms(bool ignoreComdats);
   void postParse();
+  void importCmseSymbols();
+  void redirectCmseSymbols();
 
 private:
   void initializeSections(bool ignoreComdats,
                           const llvm::object::ELFFile<ELFT> &obj);
   void initializeSymbols(const llvm::object::ELFFile<ELFT> &obj);
   void initializeJustSymbols();
 
   InputSectionBase *getRelocTarget(uint32_t idx, const Elf_Shdr &sec,

lld/ELF/InputFiles.cpp

default:
     config->armHasBlx = true;
     config->armJ1J2BranchEncoding = true;
     if (arch != ARMBuildAttrs::v6_M && arch != ARMBuildAttrs::v6S_M)
       // All Architectures used in Cortex processors with the exception
       // of v6-M and v6S-M have the MOVT and MOVW instructions.
       config->armHasMovtMovw = true;
     break;
   }
+
+  // Only ARMv8-M or later architectures have CMSE support.
+  std::optional<unsigned> profile =
+      attributes.getAttributeValue(ARMBuildAttrs::CPU_arch_profile);
+  if (!profile)
+    return;
+  if (arch >= ARMBuildAttrs::CPUArch::v8_M_Base &&
+      profile == ARMBuildAttrs::MicroControllerProfile)
+    config->armCMSESupport = true;
 }
 
 InputFile::InputFile(Kind k, MemoryBufferRef m)
     : mb(m), groupId(nextGroupId), fileKind(k) {
   // All files within the same --{start,end}-group get the same group ID.
   // Otherwise, a new file will get a new group ID.
   if (!isInGroup)
     ++nextGroupId;
template <class ELFT> static void doParseFile(InputFile *file) {
   // Regular object file
   ctx.objectFiles.push_back(cast<ELFFileBase>(file));
   cast<ObjFile<ELFT>>(file)->parse();
 }
 
 // Add symbols in File to the symbol table.
 void elf::parseFile(InputFile *file) { invokeELFT(doParseFile, file); }
 
+template <class ELFT> static void doParseArmCMSEImportLib(InputFile *file) {
+  cast<ObjFile<ELFT>>(file)->importCmseSymbols();
+}
+
+void elf::parseArmCMSEImportLib(InputFile *file) {
+  invokeELFT(doParseArmCMSEImportLib, file);
+}
+
 // Concatenates arguments to construct a string representing an error location.
 static std::string createFileLineMsg(StringRef path, unsigned line) {
   std::string filename = std::string(path::filename(path));
   std::string lineno = ":" + std::to_string(line);
   if (filename == path)
     return filename + lineno;
   return filename + lineno + " (" + path.str() + lineno + ")";
 }

 template <class ELFT> void ObjFile<ELFT>::parse(bool ignoreComdats) {
   object::ELFFile<ELFT> obj = this->getObj();
   // Read a section table. justSymbols is usually false.
   if (this->justSymbols) {
     initializeJustSymbols();
     initializeSymbols(obj);
     return;
   }
 
   // Handle dependent libraries and selection of section groups as these are not
   // done in parallel.
   ArrayRef<Elf_Shdr> objSections = getELFShdrs<ELFT>();
   StringRef shstrtab = CHECK(obj.getSectionStringTable(objSections), this);
   uint64_t size = objSections.size();
   sections.resize(size);
   for (size_t i = 0; i != size; ++i) {
     const Elf_Shdr &sec = objSections[i];
     if (sec.sh_type == SHT_LLVM_DEPENDENT_LIBRARIES && !config->relocatable) {
InputSectionBase *ObjFile<ELFT>::createInputSection(uint32_t idx,
   if (name == ".eh_frame" && !config->relocatable)
     return makeThreadLocal<EhInputSection>(*this, sec, name);
 
   if ((sec.sh_flags & SHF_MERGE) && shouldMerge(sec, name))
     return makeThreadLocal<MergeInputSection>(*this, sec, name);
   return makeThreadLocal<InputSection>(*this, sec, name);
 }
 
-// Initialize this->Symbols. this->Symbols is a parallel array as
-// its corresponding ELF symbol table.
+// Initialize symbols. symbols is a parallel array to the corresponding ELF
+// symbol table.
 template <class ELFT>
 void ObjFile<ELFT>::initializeSymbols(const object::ELFFile<ELFT> &obj) {
   ArrayRef<Elf_Sym> eSyms = this->getELFSyms<ELFT>();
   if (numSymbols == 0) {
     numSymbols = eSyms.size();
     symbols = std::make_unique<Symbol *[]>(numSymbols);
   }
 
   // Some entries have been filled by LazyObjFile.
   for (size_t i = firstGlobal, end = eSyms.size(); i != end; ++i)
     if (!symbols[i])
for (unsigned i : undefineds) {
     Symbol *sym = symbols[i];
     sym->resolve(Undefined{this, StringRef(), eSym.getBinding(), eSym.st_other,
                            eSym.getType()});
     sym->isUsedInRegularObj = true;
     sym->referenced = true;
   }
 }
 
 template <class ELFT>
 void ObjFile<ELFT>::initSectionsAndLocalSyms(bool ignoreComdats) {
   if (!justSymbols)
     initializeSections(ignoreComdats, getObj());
 
   if (!firstGlobal)
     return;
   SymbolUnion *locals = makeThreadLocalN<SymbolUnion>(firstGlobal);
   memset(locals, 0, sizeof(SymbolUnion) * firstGlobal);
 
   ArrayRef<Elf_Sym> eSyms = this->getELFSyms<ELFT>();
   for (size_t i = 0, end = firstGlobal; i != end; ++i) {
     const Elf_Sym &eSym = eSyms[i];
     uint32_t secIdx = eSym.st_shndx;
     if (LLVM_UNLIKELY(secIdx == SHN_XINDEX))
       secIdx = check(getExtendedSymbolTableIndex<ELFT>(eSym, i, shndxTable));
     else if (secIdx >= SHN_LORESERVE)
       secIdx = 0;
     if (LLVM_UNLIKELY(secIdx >= sections.size()))
       fatal(toString(this) + ": invalid section index: " + Twine(secIdx));
     if (LLVM_UNLIKELY(eSym.getBinding() != STB_LOCAL))
       error(toString(this) + ": non-local symbol (" + Twine(i) +
             ") found at index < .symtab's sh_info (" + Twine(end) + ")");
 
for (size_t i = 0, end = firstGlobal; i != end; ++i) {
     else
       new (symbols[i]) Defined(this, name, STB_LOCAL, eSym.st_other, type,
                                eSym.st_value, eSym.st_size, sec);
     symbols[i]->partition = 1;
     symbols[i]->isUsedInRegularObj = true;
   }
 }
 
 // Called after all ObjFile::parse is called for all ObjFiles. This checks
 // duplicate symbols and may do symbol property merge in the future.
 template <class ELFT> void ObjFile<ELFT>::postParse() {
   static std::mutex mu;
   ArrayRef<Elf_Sym> eSyms = this->getELFSyms<ELFT>();
   for (size_t i = firstGlobal, end = eSyms.size(); i != end; ++i) {
     const Elf_Sym &eSym = eSyms[i];
     Symbol &sym = *symbols[i];
     uint32_t secIdx = eSym.st_shndx;
     uint8_t binding = eSym.getBinding();
     if (LLVM_UNLIKELY(binding != STB_GLOBAL && binding != STB_WEAK &&
                       binding != STB_GNU_UNIQUE))
       errorOrWarn(toString(this) + ": symbol (" + Twine(i) +
                   ") has invalid binding: " + Twine((int)binding));
 
     // st_value of STT_TLS represents the assigned offset, not the actual
     // address which is used by STT_FUNC and STT_OBJECT. STT_TLS symbols can
     // only be referenced by special TLS relocations. It is usually an error if
     // a STT_TLS symbol is replaced by a non-STT_TLS symbol, vice versa.
     if (LLVM_UNLIKELY(sym.isTls()) && eSym.getType() != STT_TLS &&
         eSym.getType() != STT_NOTYPE)
       errorOrWarn("TLS attribute mismatch: " + toString(sym) + "\n>>> in " +
                   toString(sym.file) + "\n>>> in " + toString(this));
 
     // Handle non-COMMON defined symbol below. !sym.file allows a symbol
     // assignment to redefine a symbol without an error.
     if (!sym.file || !sym.isDefined() || secIdx == SHN_UNDEF ||
         secIdx == SHN_COMMON)
       continue;
 
     if (LLVM_UNLIKELY(secIdx == SHN_XINDEX))
       secIdx = check(getExtendedSymbolTableIndex<ELFT>(eSym, i, shndxTable));
     else if (secIdx >= SHN_LORESERVE)
       secIdx = 0;
     if (LLVM_UNLIKELY(secIdx >= sections.size()))
       fatal(toString(this) + ": invalid section index: " + Twine(secIdx));
     InputSectionBase *sec = sections[secIdx];
     if (sec == &InputSection::discarded) {
       if (sym.traced) {
         printTraceSymbol(Undefined{this, sym.getName(), sym.binding,
                                    sym.stOther, sym.type, secIdx},
                          sym.getName());
       }

lld/ELF/LinkerScript.h

public:
   bool hasPhdrsCommands() { return !phdrsCommands.empty(); }
   uint64_t getDot() { return dot; }
   void discard(InputSectionBase &s);
 
   ExprValue getSymbolValue(StringRef name, const Twine &loc);
 
   void addOrphanSections();
   void diagnoseOrphanHandling() const;
+  void diagnoseMissingSGSectionAddress() const;
   void adjustOutputSections();
   void adjustSectionsAfterSorting();
 
   SmallVector<PhdrEntry *, 0> createPhdrs();
   bool needsInterpSection();
 
   bool shouldKeep(InputSectionBase *s);
   const Defined *assignAddresses();

lld/ELF/LinkerScript.cpp

for (const InputSectionBase *sec : orphanSections) {
     StringRef name = getOutputSectionName(sec);
     if (config->orphanHandling == OrphanHandlingPolicy::Error)
       error(toString(sec) + " is being placed in '" + name + "'");
     else
       warn(toString(sec) + " is being placed in '" + name + "'");
   }
 }
 
+void LinkerScript::diagnoseMissingSGSectionAddress() const {
+  if (!config->cmseImplib || !in.armCmseSGSection->isNeeded())
+    return;
+
+  OutputSection *sec = findByName(sectionCommands, ".gnu.sgstubs");
+  if (sec && !sec->addrExpr && !config->sectionStartMap.count(".gnu.sgstubs"))
+    error("no address assigned to the veneers output section " + sec->name);
+}
+
 // This function searches for a memory region to place the given output
 // section in. If found, a pointer to the appropriate memory region is
 // returned in the first member of the pair. Otherwise, a nullptr is returned.
 // The second member of the pair is a hint that should be passed to the
 // subsequent call of this method.
 std::pair<MemoryRegion *, MemoryRegion *>
 LinkerScript::findMemoryRegion(OutputSection *sec, MemoryRegion *hint) {
   // Non-allocatable sections are not part of the process image.
   if (!(sec->flags & SHF_ALLOC)) {
     if (!sec->memoryRegionName.empty())
       warn("ignoring memory region assignment for non-allocatable section '" +
            sec->name + "'");
     return {nullptr, nullptr};
   }
 
   // If a memory region name was specified in the output section command,
   // then try to find that region first.
   if (!sec->memoryRegionName.empty()) {
     if (MemoryRegion *m = memoryRegions.lookup(sec->memoryRegionName))
       return {m, m};
     error("memory region '" + sec->memoryRegionName + "' not declared");
     return {nullptr, nullptr};
   }
 
   // If at least one memory region is defined, all sections must
   // belong to some memory region. Otherwise, we don't need to do
   // anything for memory regions.
   if (memoryRegions.empty())
     return {nullptr, nullptr};

lld/ELF/Options.td

 defm split_stack_adjust_size
     : Eq<"split-stack-adjust-size",
          "Specify adjustment to stack size when a split-stack function calls a "
          "non-split-stack function">,
       MetaVarName<"<value>">;
 
 def O: JoinedOrSeparate<["-"], "O">, HelpText<"Optimize output file size">;
 
+def cmse_implib: FF<"cmse-implib">,
+  HelpText<"Make the output library to be a CMSE secure code import library">;
+
+defm in_implib: EEq<"in-implib",
+    "Read an existing CMSE secure code import library and preserve entry function addresses in the "
+    "resulting new CMSE secure code import library (optional when creating a CMSE secure image)">,
+  MetaVarName<"<file>">;
+
+defm out_implib: EEq<"out-implib",
+    "Output the CMSE secure code import library to <file> (required when creating a CMSE secure image)">,
+  MetaVarName<"<file>">;
+
 defm Tbss: Eq<"Tbss", "Same as --section-start with .bss as the sectionname">;
 
 defm Tdata: Eq<"Tdata", "Same as --section-start with .data as the sectionname">;
 
 defm Ttext: Eq<"Ttext", "Same as --section-start with .text as the sectionname">;
 
 def Ttext_segment: Separate<["-", "--"], "Ttext-segment">;
 

lld/ELF/SymbolTable.h

 #include "llvm/ADT/DenseMap.h"
 #include "llvm/Support/Compiler.h"
 
 namespace lld::elf {
 
 class InputFile;
 class SharedFile;
 
+struct ArmCmseEntryFunction {
+  Symbol *acleSeSym;
+  Symbol *sym;
+};
+
 // SymbolTable is a bucket of all known symbols, including defined,
 // undefined, or lazy symbols (the last one is symbols in archive
 // files whose archive members are not yet loaded).
 //
 // We put all symbols of all files to a SymbolTable, and the
 // SymbolTable selects the "best" symbols if there are name
 // conflicts. For example, obviously, a defined symbol is better than
 // an undefined symbol. Or, if there's a conflict between a lazy and a
public:
   // Set of .so files to not link the same shared object file more than once.
   llvm::DenseMap<llvm::CachedHashStringRef, SharedFile *> soNames;
 
   // Comdat groups define "link once" sections. If two comdat groups have the
   // same name, only one of them is linked, and the other is ignored. This map
   // is used to uniquify them.
   llvm::DenseMap<llvm::CachedHashStringRef, const InputFile *> comdatGroups;
 
+  // The Map of __acle_se_<sym>, <sym> pairs found in the input objects.
+  // Key is the <sym> name.
+  llvm::StringMap<ArmCmseEntryFunction> cmseSymMap;
+
+  // Map of symbols defined in the Arm CMSE import library. The linker must
+  // preserve the addresses in the output objects.
+  llvm::StringMap<Defined *> cmseImportLib;
+
+  // True if <sym> from the input Arm CMSE import library is written to the
+  // output Arm CMSE import library.
+  llvm::StringMap<bool> inCMSEOutImpLib;
+
 private:
   SmallVector<Symbol *, 0> findByVersion(SymbolVersion ver);
   SmallVector<Symbol *, 0> findAllByVersion(SymbolVersion ver,
                                             bool includeNonDefault);
 
   llvm::StringMap<SmallVector<Symbol *, 0>> &getDemangledSyms();
   bool assignExactVersion(SymbolVersion ver, uint16_t versionId,
                           StringRef versionName, bool includeNonDefault);

lld/ELF/SyntheticSections.h

public:
   // in addThunkSection() for more details.
   bool roundUpSizeForErrata = false;
 
 private:
   SmallVector<Thunk *, 0> thunks;
   size_t size = 0;
 };
 
+// Cortex-M Security Extensions. Prefix for functions that should be exported
+// for the non-secure world.
+const char ACLESESYM_PREFIX[] = "__acle_se_";
+const int ACLESESYM_SIZE = 8;
+
+class ArmCmseSGVeneer : public SyntheticSection {
+public:
+  ArmCmseSGVeneer(Symbol *sym, Symbol *acleSeSym,
+                  std::optional<uint64_t> addr = std::nullopt)
+      : SyntheticSection(llvm::ELF::SHF_ALLOC | llvm::ELF::SHF_EXECINSTR,
+                         llvm::ELF::SHT_PROGBITS,
+                         /*alignment=*/32, ".gnu.sgstubs"),
+        sym(sym), acleSeSym(acleSeSym), entAddr{addr} {
+    entsize = ACLESESYM_SIZE;
+  }
+
+  void writeTo(uint8_t *buf) override;
+  size_t getSize() const override { return entsize; };
+  const std::optional<uint64_t> getAddr() const { return entAddr; };
+
+  Symbol *sym;
+  Symbol *acleSeSym;
+
+private:
+  const std::optional<uint64_t> entAddr;
+};
+
+class ArmCmseSGSection : public SyntheticSection {
+public:
+  ArmCmseSGSection();
+  bool isNeeded() const override { return !entries.empty(); }
+  size_t getSize() const override;
+  void writeTo(uint8_t *buf) override;
+  void addSGVeneer(Symbol *sym, Symbol *ext_sym);
+  void addMappingSymbol();
+  void finalizeContents() override;
+  void exportEntries(SymbolTableBaseSection *symTab);
+  uint64_t impLibMaxAddr = 0;
+
+private:
+  SmallVector<std::pair<Symbol *, Symbol *>, 0> entries;
+  SmallVector<ArmCmseSGVeneer *, 0> sgSections;
+  uint64_t newEntries = 0;
+};
+
 // Used to compute outSecOff of .got2 in each object file. This is needed to
 // synthesize PLT entries for PPC32 Secure PLT ABI.
 class PPC32Got2Section final : public SyntheticSection {
 public:
   PPC32Got2Section();
   size_t getSize() const override { return 0; }
   bool isNeeded() const override;
   void finalizeContents() override;

 class PackageMetadataNote final : public SyntheticSection {
 public:
   PackageMetadataNote()
       : SyntheticSection(llvm::ELF::SHF_ALLOC, llvm::ELF::SHT_NOTE,
                          /*alignment=*/4, ".note.package") {}
   void writeTo(uint8_t *buf) override;
   size_t getSize() const override;
 };
 
 InputSection *createInterpSection();
 MergeInputSection *createCommentSection();
 template <class ELFT> void splitSections();
 void combineEhSections();
 
 template <typename ELFT> void writeEhdr(uint8_t *buf, Partition &part);
 template <typename ELFT> void writePhdrs(uint8_t *buf, Partition &part);
 
 Defined *addSyntheticLocal(StringRef name, uint8_t type, uint64_t value,
                            uint64_t size, InputSectionBase &section);
 
 void addVerneed(Symbol *ss);
 
 // Linker generated per-partition sections.
 struct Partition {
   StringRef name;
   uint64_t nameStrTab;
 
   std::unique_ptr<SyntheticSection> elfHeader;
   std::unique_ptr<SyntheticSection> programHeaders;
   SmallVector<PhdrEntry *, 0> phdrs;
 
   std::unique_ptr<ARMExidxSyntheticSection> armExidx;
   std::unique_ptr<BuildIdSection> buildId;
   std::unique_ptr<SyntheticSection> dynamic;
   std::unique_ptr<StringTableSection> dynStrTab;
   std::unique_ptr<SymbolTableBaseSection> dynSymTab;
   std::unique_ptr<EhFrameHeader> ehFrameHdr;
   std::unique_ptr<EhFrameSection> ehFrame;
   std::unique_ptr<GnuHashTableSection> gnuHashTab;
   std::unique_ptr<HashTableSection> hashTab;
   std::unique_ptr<MemtagAndroidNote> memtagAndroidNote;
   std::unique_ptr<PackageMetadataNote> packageMetadataNote;

 struct InStruct {
   std::unique_ptr<InputSection> attributes;
   std::unique_ptr<SyntheticSection> riscvAttributes;
   std::unique_ptr<BssSection> bss;
   std::unique_ptr<BssSection> bssRelRo;
   std::unique_ptr<GotSection> got;
   std::unique_ptr<GotPltSection> gotPlt;
   std::unique_ptr<IgotPltSection> igotPlt;
+  std::unique_ptr<SyntheticSection> armCmseSGSection;
   std::unique_ptr<PPC64LongBranchTargetSection> ppc64LongBranchTarget;
   std::unique_ptr<SyntheticSection> mipsAbiFlags;
   std::unique_ptr<MipsGotSection> mipsGot;
   std::unique_ptr<SyntheticSection> mipsOptions;
   std::unique_ptr<SyntheticSection> mipsReginfo;
   std::unique_ptr<MipsRldMapSection> mipsRldMap;
   std::unique_ptr<SyntheticSection> partEnd;
   std::unique_ptr<SyntheticSection> partIndex;
   std::unique_ptr<PltSection> plt;
   std::unique_ptr<IpltSection> iplt;
   std::unique_ptr<PPC32Got2Section> ppc32Got2;
   std::unique_ptr<IBTPltSection> ibtPlt;
   std::unique_ptr<RelocationBaseSection> relaPlt;
   std::unique_ptr<RelocationBaseSection> relaIplt;
   std::unique_ptr<StringTableSection> shStrTab;
   std::unique_ptr<StringTableSection> strTab;
   std::unique_ptr<SymbolTableBaseSection> symTab;
   std::unique_ptr<SymtabShndxSection> symTabShndx;
 
   void reset();
 };
 
 LLVM_LIBRARY_VISIBILITY extern InStruct in;
 
 } // namespace lld::elf
 
 #endif

lld/ELF/SyntheticSections.cpp

 // Write the internal symbol table contents to the output symbol table.
 template <class ELFT> void SymbolTableSection<ELFT>::writeTo(uint8_t *buf) {
   // The first entry is a null entry as per the ELF spec.
   buf += sizeof(Elf_Sym);
 
   auto *eSym = reinterpret_cast<Elf_Sym *>(buf);
 
   for (SymbolTableEntry &ent : symbols) {
     Symbol *sym = ent.sym;
     bool isDefinedHere = type == SHT_SYMTAB || sym->partition == partition;
 
     // Set st_name, st_info and st_other.
     eSym->st_name = ent.strTabOffset;
     eSym->setBindingAndType(sym->binding, sym->type);
     eSym->st_other = sym->stOther;
 
     if (BssSection *commonSec = getCommonSec(sym)) {
       // When -r is specified, a COMMON symbol is not allocated. Its st_shndx
       // holds SHN_COMMON and st_value holds the alignment.
       eSym->st_shndx = SHN_COMMON;
       eSym->st_value = commonSec->addralign;
       eSym->st_size = cast<Defined>(sym)->size;
     } else {
       const uint32_t shndx = getSymSectionIndex(sym);
       if (isDefinedHere) {
         eSym->st_shndx = shndx;
         eSym->st_value = sym->getVA();
         // Copy symbol size if it is a defined symbol. st_size is not
         // significant for undefined symbols, so whether copying it or not is up
         // to us if that's the case. We'll leave it as zero because by not
         // setting a value, we can get the exact same outputs for two sets of
         // input files that differ only in undefined symbol size in DSOs.
         eSym->st_size = shndx != SHN_UNDEF ? cast<Defined>(sym)->size : 0;
       } else {
         eSym->st_shndx = 0;
         eSym->st_value = 0;
         eSym->st_size = 0;
       }
     }
 
     ++eSym;
   }
 
   // On MIPS we need to mark symbol which has a PLT entry and requires
   // pointer equality by STO_MIPS_PLT flag. That is necessary to help
   // dynamic linker distinguish such symbols and MIPS lazy-binding stubs.
for (SymbolTableEntry &ent : symbols) {
         // records. That allows us to distinguish such symbols in
         // the `MIPS<ELFT>::relocate()` routine. Now we should
         // clear that bit for non-dynamic symbol table, so tools
         // like `objdump` will be able to deal with a correct
         // symbol position.
         if (sym->isDefined() &&
             ((sym->stOther & STO_MIPS_MICROMIPS) || sym->hasFlag(NEEDS_COPY))) {
           if (!strTabSec.isDynamic())
             eSym->st_value &= ~1;
           eSym->st_other |= STO_MIPS_MICROMIPS;
         }
       }
       if (config->relocatable)
         if (auto *d = dyn_cast<Defined>(sym))
           if (isMipsPIC<ELFT>(d))
             eSym->st_other |= STO_MIPS_PIC;
       ++eSym;
     }
   }
 }
 
 SymtabShndxSection::SymtabShndxSection()
     : SyntheticSection(0, SHT_SYMTAB_SHNDX, 4, ".symtab_shndx") {
   this->entsize = 4;
 }
 
 void SymtabShndxSection::writeTo(uint8_t *buf) {
   // We write an array of 32 bit values, where each value has 1:1 association
   // with an entry in .symtab. If the corresponding entry contains SHN_XINDEX,
   // we need to write actual index, otherwise, we must write SHN_UNDEF(0).
   buf += 4; // Ignore .symtab[0] entry.
   for (const SymbolTableEntry &entry : in.symTab->getSymbols()) {
     if (!getCommonSec(entry.sym) && getSymSectionIndex(entry.sym) == SHN_XINDEX)
       write32(buf, entry.sym->getOutputSection()->sectionIndex);
     buf += 4;
   }
 }
 
 bool SymtabShndxSection::isNeeded() const {
   // SHT_SYMTAB can hold symbols with section indices values up to
   // SHN_LORESERVE. If we need more, we want to use extension SHT_SYMTAB_SHNDX
   // section. Problem is that we reveal the final section indices a bit too
   // late, and we do not know them here. For simplicity, we just always create
   // a .symtab_shndx section when the amount of output sections is huge.
   size_t size = 0;
   for (SectionCommand *cmd : script->sectionCommands)
     if (isa<OutputDesc>(cmd))
       ++size;
   return size >= SHN_LORESERVE;
 }
 
 void SymtabShndxSection::finalizeContents() {
   getParent()->link = in.symTab->getParent()->sectionIndex;
 }
 
 size_t SymtabShndxSection::getSize() const {

 void InStruct::reset() {
   attributes.reset();
   riscvAttributes.reset();
   bss.reset();
   bssRelRo.reset();
   got.reset();
   gotPlt.reset();
   igotPlt.reset();
+  armCmseSGSection.reset();
   ppc64LongBranchTarget.reset();
   mipsAbiFlags.reset();
   mipsGot.reset();
   mipsOptions.reset();
   mipsReginfo.reset();
   mipsRldMap.reset();
   partEnd.reset();
   partIndex.reset();
   plt.reset();
   iplt.reset();
   ppc32Got2.reset();
   ibtPlt.reset();
   relaPlt.reset();
   relaIplt.reset();
   shStrTab.reset();
   strTab.reset();
   symTab.reset();
   symTabShndx.reset();
 }
 
 constexpr char kMemtagAndroidNoteName[] = "Android";
 void MemtagAndroidNote::writeTo(uint8_t *buf) {
   static_assert(
       sizeof(kMemtagAndroidNoteName) == 8,
       "Android 11 & 12 have an ABI that the note name is 8 bytes long. Keep it "
       "that way for backwards compatibility.");
 

lld/ELF/Target.h

 
 // Returns input section and corresponding source string for the given location.
 ErrorPlace getErrorPlace(const uint8_t *loc);
 
 static inline std::string getErrorLocation(const uint8_t *loc) {
   return getErrorPlace(loc).loc;
 }
 
+void processArmCmseSymbols();
+
 void writePPC32GlinkSection(uint8_t *buf, size_t numEntries);
 
 unsigned getPPCDFormOp(unsigned secondaryOp);
 
 // In the PowerPC64 Elf V2 abi a function can have 2 entry points.  The first
 // is a global entry point (GEP) which typically is used to initialize the TOC
 // pointer in general purpose register 2.  The second is a local entry
 // point (LEP) which bypasses the TOC pointer initialization code. The
 // offset between GEP and LEP is encoded in a function's st_other flags.
 // This function will return the offset (in bytes) from the global entry-point
 // to the local entry-point.
 unsigned getPPC64GlobalEntryToLocalEntryOffset(uint8_t stOther);
 
 // Write a prefixed instruction, which is a 4-byte prefix followed by a 4-byte
 // instruction (regardless of endianness). Therefore, the prefix is always in
 // lower memory than the instruction.
 void writePrefixedInstruction(uint8_t *loc, uint64_t insn);
 
 void addPPC64SaveRestore();
 uint64_t getPPC64TocBase();
 uint64_t getAArch64Page(uint64_t expr);
+template <typename ELFT> void writeARMCmseImportLib();
 void riscvFinalizeRelax(int passes);
 void mergeRISCVAttributesSections();
 
 LLVM_LIBRARY_VISIBILITY extern const TargetInfo *target;
 TargetInfo *getTarget();
 
 template <class ELFT> bool isMipsPIC(const Defined *sym);
 

lld/ELF/Writer.cpp

if (config->emachine == EM_PPC64) {
     add(*in.ppc64LongBranchTarget);
   }
 
   in.gotPlt = std::make_unique<GotPltSection>();
   add(*in.gotPlt);
   in.igotPlt = std::make_unique<IgotPltSection>();
   add(*in.igotPlt);
 
+  if (config->emachine == EM_ARM) {
+    in.armCmseSGSection = std::make_unique<ArmCmseSGSection>();
+    add(*in.armCmseSGSection);
+  }
+
   // _GLOBAL_OFFSET_TABLE_ is defined relative to either .got.plt or .got. Treat
   // it as a relocation and ensure the referenced section is created.
   if (ElfSym::globalOffsetTable && config->emachine != EM_MIPS) {
     if (target->gotBaseSymInGotPlt)
       in.gotPlt->hasGotPltOffRel = true;
     else
       in.got->hasGotOffRel = true;
   }
if (errorCount())
     // because the content is usually a hash value of the entire output file.
     writeBuildId();
     if (errorCount())
       return;
 
     if (auto e = buffer->commit())
       fatal("failed to write output '" + buffer->getPath() +
             "': " + toString(std::move(e)));
+
+    if (!config->cmseOutputLib.empty())
+      writeARMCmseImportLib<ELFT>();
   }
 }
 
 template <class ELFT, class RelTy>
 static void markUsedLocalSymbolsImpl(ObjFile<ELFT> *file,
                                      llvm::ArrayRef<RelTy> rels) {
   for (const RelTy &rel : rels) {
     Symbol &sym = file->getRelocTargetSym(rel);
if (!config->relocatable) {
     }
   }
 
   if (in.mipsGot)
     in.mipsGot->build();
 
   removeUnusedSyntheticSections();
   script->diagnoseOrphanHandling();
+  script->diagnoseMissingSGSectionAddress();
 
   sortSections();
 
   // Create a list of OutputSections, assign sectionIndex, and populate
   // in.shStrTab.
   for (SectionCommand *cmd : script->sectionCommands)
     if (auto *osd = dyn_cast<OutputDesc>(cmd)) {
       OutputSection *osec = &osd->osec;
if (errorCount())
     return;
 
   {
     llvm::TimeTraceScope timeScope("Finalize synthetic sections");
     // finalizeAddressDependentContent may have added local symbols to the
     // static symbol table.
     finalizeSynthetic(in.symTab.get());
     finalizeSynthetic(in.ppc64LongBranchTarget.get());
+    finalizeSynthetic(in.armCmseSGSection.get());
   }
 
   // Relaxation to delete inter-basic block jumps created by basic block
   // sections. Run after in.symTab is finalized as optimizeBasicBlockJumps
   // can relax jump instructions based on symbol offset.
   if (config->optimizeBBJumps)
     optimizeBasicBlockJumps();
 

lld/test/ELF/Inputs/arm-cmse-macros.s

+/// Because the addresses of __acle_se_\sym_name and \sym_name are equal,
+/// the linker creates a secure gateway in ".gnu.sgstubs".
+.macro cmse_veneer sym_name, sym_type, sym_binding, acle_sym_type, acle_sym_binding
+.align  2
+.\sym_binding  \sym_name
+.\acle_sym_binding  __acle_se_\sym_name
+.type  \sym_name, %\sym_type
+.type  __acle_se_\sym_name, %\acle_sym_type
+\sym_name:
+__acle_se_\sym_name:
+  nop
+.size  \sym_name, .-\sym_name
+.size  __acle_se_\sym_name, .-__acle_se_\sym_name
+.endm
+
+/// Because the addresses of __acle_se_\sym_name and \sym_name are not equal,
+/// the linker considers that an inline secure gateway exists and does not
+/// create one.
+.macro cmse_no_veneer sym_name, sym_type, sym_binding, acle_sym_type, acle_sym_binding
+.align  2
+.\sym_binding  \sym_name
+.\acle_sym_binding  __acle_se_\sym_name
+.type  \sym_name, %\sym_type
+.type  __acle_se_\sym_name, %\acle_sym_type
+\sym_name:
+  sg
+  nop
+__acle_se_\sym_name:
+  nop
+.size  \sym_name, .-\sym_name
+.size  __acle_se_\sym_name, .-__acle_se_\sym_name
+.endm

lld/test/ELF/aarch64-cmse.s

+# REQUIRES: aarch64
+# RUN: yaml2obj %s -o %t.o
+# RUN: not ld.lld --cmse-implib %t.o -o /dev/null 2>&1 | FileCheck %s --check-prefix=ERR_CMSE_IMPLIB
+# RUN: not ld.lld --in-implib=%t.o %t.o -o /dev/null 2>&1 | FileCheck %s --check-prefix=ERR_IN_IMPLIB
+# RUN: not ld.lld --out-implib=out.lib %t.o -o /dev/null 2>&1 | FileCheck %s --check-prefix=ERR_OUT_IMPLIB
+
+# ERR_CMSE_IMPLIB: error: --cmse-implib is only supported on ARM targets
+# ERR_IN_IMPLIB: error: --in-implib is only supported on ARM targets
+# ERR_OUT_IMPLIB: error: --out-implib is only supported on ARM targets
+
+!ELF
+FileHeader:
+  Class:           ELFCLASS64
+  Data:            ELFDATA2LSB
+  Type:            ET_REL
+  Machine:         EM_AARCH64

lld/test/ELF/arm-cmse-diagnostics.s

+// REQUIRES: arm
+/// Test CMSE diagnostics.
+
+// RUN: rm -rf %t && split-file %s %t && cd %t
+
+/// Test diagnostics emitted during checks of the CMSE import library
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj --triple=thumbv8m.base lib -o lib.o
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj --triple=thumbv8m.base app -I %S/Inputs -o app.o
+// RUN: llvm-objcopy --redefine-sym=entry7_duplicate=entry6_duplicate lib.o
+// RUN: not ld.lld --cmse-implib --in-implib=lib.o app.o -o /dev/null 2>&1 | FileCheck %s --check-prefixes=ERR_IMPLIB
+// RUN: not ld.lld --cmse-implib --in-implib=lib.o --in-implib=lib.o app.o -o /dev/null 2>&1 | FileCheck %s --check-prefixes=ERR_MULT_INIMPLIB
+// RUN: not ld.lld --in-implib=lib.o app.o -o /dev/null 2>&1 | FileCheck %s --check-prefixes=ERR_IN_IMPLIB
+// RUN: not ld.lld --out-implib=out.lib app.o -o /dev/null 2>&1 | FileCheck %s --check-prefixes=ERR_OUT_IMPLIB
+// RUN: not ld.lld --out-implib=out.lib --in-implib=lib.o app.o -o /dev/null 2>&1 | FileCheck %s --check-prefixes=ERR_IN_IMPLIB,ERR_OUT_IMPLIB
+
+// ERR_IMPLIB: error: CMSE symbol 'entry_not_external' in import library '{{.*}}' is not global
+// ERR_IMPLIB: error: CMSE symbol 'entry_not_absolute' in import library '{{.*}}' is not absolute
+// ERR_IMPLIB: error: CMSE symbol 'entry_not_function' in import library '{{.*}}' is not a Thumb function definition
+// ERR_IMPLIB: error: CMSE symbol 'entry_not_thumb' in import library '{{.*}}' is not a Thumb function definition
+// ERR_IMPLIB: warning: CMSE symbol 'entry5_incorrect_size' in import library '{{.*}}' does not have correct size of 8 bytes
+// ERR_IMPLIB: error: CMSE symbol 'entry6_duplicate' is multiply defined in import library '{{.*}}'
+// ERR_MULT_INIMPLIB: error: multiple CMSE import libraries not supported
+// ERR_IN_IMPLIB: error: --in-implib may not be used without --cmse-implib
+// ERR_OUT_IMPLIB: error: --out-implib may not be used without --cmse-implib
+
+/// CMSE Only supported by ARMv8-M architecture or later.
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj -triple=thumbv8m.base app -I %S/Inputs -o app1.o
+// RUN: ld.lld --cmse-implib -Ttext=0x8000 --section-start .gnu.sgstubs=0x20000 -o app1 app1.o 2>&1 | FileCheck /dev/null --implicit-check-not=error:
+
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj -triple=thumbv8m.main app -I %S/Inputs -o app2.o
+// RUN: ld.lld --cmse-implib -Ttext=0x8000 --section-start .gnu.sgstubs=0x20000 -o app2 app2.o 2>&1 | FileCheck /dev/null --implicit-check-not=error:
+
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj -triple=thumbv8.1m.main app -I %S/Inputs -o app3.o
+// RUN: ld.lld --cmse-implib -Ttext=0x8000 --section-start .gnu.sgstubs=0x20000 -o app3 app3.o 2>&1 | FileCheck /dev/null --implicit-check-not=error:
+
+/// Expect errors for other architectures.
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj -triple=thumbv9a app -I %S/Inputs -o app4.o
+// RUN: not ld.lld --cmse-implib -Ttext=0x8000 --section-start .gnu.sgstubs=0x20000 -o app4 app4.o 2>&1 | FileCheck %s --check-prefixes=ERR_ARCH
+
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj -triple=armv7-m app -I %S/Inputs -o app5.o
+// RUN: not ld.lld --cmse-implib -Ttext=0x8000 --section-start .gnu.sgstubs=0x20000 -o app5 app5.o 2>&1 | FileCheck %s --check-prefixes=ERR_ARCH
+
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj -triple=armv8-m app -I %S/Inputs -o app6.o
+// RUN: not ld.lld --cmse-implib -Ttext=0x8000 --section-start .gnu.sgstubs=0x20000 -o app6 app6.o 2>&1 | FileCheck %s --check-prefixes=ERR_ARCH
+
+/// Invalid triple defaults to v4T. Error.
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj -triple=thumb app -I %S/Inputs -o app7.o
+// RUN: not ld.lld --cmse-implib -Ttext=0x8000 --section-start .gnu.sgstubs=0x20000 -o app7 app7.o  2>&1 | FileCheck %s --check-prefixes=ERR_ARCH
+
+/// No build attributes. Error.
+// RUN: llvm-mc -filetype=obj -triple=thumb app -I %S/Inputs -o app8.o
+// RUN: not ld.lld --cmse-implib -Ttext=0x8000 --section-start .gnu.sgstubs=0x20000 -o app8 app8.o  2>&1 | FileCheck %s --check-prefixes=ERR_ARCH
+
+// ERR_ARCH: CMSE is only supported by ARMv8-M architecture or later
+
+/// Test that the linker diagnoses cases where the linker synthesized veneer addresses
+/// specified by the CMSE input library cannot be placed at the .gnu.sgstubs section address.
+
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj --triple=thumbv8m.main app -I %S/Inputs -o 1.o
+/// Create a CMSE import library with a secure gateway veneer at 0x10000
+// RUN: ld.lld --cmse-implib --section-start .gnu.sgstubs=0x10000 1.o -o 1 --out-implib=1.lib 2>&1 | FileCheck /dev/null --implicit-check-not=error:
+/// Create a new import library with the secure gateway veneer and .gnu.sgstubs specified at the same address
+// RUN: ld.lld --cmse-implib --section-start .gnu.sgstubs=0x10000 1.o -o 2 --out-implib=2.lib --in-implib=1.lib 2>&1 | FileCheck /dev/null --implicit-check-not=error:
+/// Create a new import library with the secure gateway veneer specified at a same address but .gnu.sgstubs at a higher address.
+// RUN: not ld.lld --cmse-implib --section-start .gnu.sgstubs=0x11000 1.o -o 3 --out-implib=3.lib --in-implib=1.lib 2>&1 | FileCheck %s --check-prefixes=ERR_ADDR
+/// Create a new import library with the secure gateway veneer specified at a same address but .gnu.sgstubs at a lower address.
+// RUN: not ld.lld --cmse-implib --section-start .gnu.sgstubs=0x9000 1.o -o 4 --out-implib=4.lib --in-implib=1.lib 2>&1 | FileCheck %s --check-prefixes=ERR_ADDR
+
+// ERR_ADDR: error: start address of '.gnu.sgstubs' is different from previous link
+
+/// Test that the address of .gnu.sgstubs can be specified via command line or linker script.
+/// Test that the linker errors when the address of .gnu.sgstubs is not specified using either method.
+
+// RUN: ld.lld --cmse-implib -Ttext=0x8000 --section-start .gnu.sgstubs=0x20000 --script with_sgstubs.script 1.o -o 1 2>&1 | FileCheck /dev/null --implicit-check-not=error:
+// RUN: ld.lld --cmse-implib -Ttext=0x8000 --section-start .gnu.sgstubs=0x20000 --script wout_sgstubs.script 1.o -o 2 2>&1 | FileCheck /dev/null --implicit-check-not=error:
+// RUN: ld.lld --cmse-implib -Ttext=0x8000 --section-start .gnu.sgstubs=0x20000 1.o -o 3 2>&1 | FileCheck /dev/null --implicit-check-not=error:
+// RUN: ld.lld --cmse-implib -Ttext=0x8000 --script with_sgstubs.script 1.o -o 4 2>&1 | FileCheck /dev/null --implicit-check-not=error:
+// RUN: not ld.lld --cmse-implib -Ttext=0x8000 --script wout_sgstubs.script 1.o -o 5 2>&1 | FileCheck %s --check-prefixes=ERR_NOADDR
+
+// RUN: llvm-readelf -S 1 | FileCheck %s --check-prefixes=ADDRCMDLINE
+// RUN: llvm-readelf -S 2 | FileCheck %s --check-prefixes=ADDRCMDLINE
+// RUN: llvm-readelf -S 3 | FileCheck %s --check-prefixes=ADDRCMDLINE
+// RUN: llvm-readelf -S 4 | FileCheck %s --check-prefixes=ADDRLNKSCRIPT
+
+// ERR_NOADDR: error: no address assigned to the veneers output section .gnu.sgstubs
+
+///                       Name          Type         Address    Off   Size ES Flg Lk Inf Al
+// ADDRCMDLINE:   .gnu.sgstubs      PROGBITS        00020000 020000 000008 08  AX  0   0 32
+// ADDRLNKSCRIPT: .gnu.sgstubs      PROGBITS        00040000 040000 000008 08  AX  0   0 32
+
+/// Test diagnostics emitted during symbol attribute checks.
+
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj -I %S/Inputs --triple=thumbv8m.base symattr -o symattr.o
+// RUN: not ld.lld --cmse-implib symattr.o -o /dev/null 2>&1 | FileCheck %s --check-prefixes=ERR_SYMATTR
+
+// ERR_SYMATTR-NOT: __acle_se_valid_1
+// ERR_SYMATTR-NOT: __acle_se_valid_2
+// ERR_SYMATTR-NOT: __acle_se_valid_3
+// ERR_SYMATTR-NOT: __acle_se_valid_4
+// ERR_SYMATTR: error: {{.*}}: cmse special symbol '__acle_se_invalid_1' is not a Thumb function definition
+// ERR_SYMATTR: error: {{.*}}: cmse special symbol '__acle_se_invalid_2' is not a Thumb function definition
+// ERR_SYMATTR: error: {{.*}}: cmse entry symbol 'invalid_3' is not a Thumb function definition
+// ERR_SYMATTR: error: {{.*}}: cmse entry symbol 'invalid_4' is not a Thumb function definition
+// ERR_SYMATTR: error: {{.*}}: cmse special symbol '__acle_se_invalid_5' detected, but no associated entry function definition 'invalid_5' with external linkage found
+// ERR_SYMATTR: error: {{.*}}: cmse special symbol '__acle_se_invalid_6' detected, but no associated entry function definition 'invalid_6' with external linkage found
+// ERR_SYMATTR: error: {{.*}}: cmse special symbol '__acle_se_invalid_7' is not a Thumb function definition
+// ERR_SYMATTR: error: {{.*}}: cmse special symbol '__acle_se_invalid_8' detected, but no associated entry function definition 'invalid_8' with external linkage found
+// ERR_SYMATTR: error: {{.*}}: cmse special symbol '__acle_se_invalid_9' cannot be an absolute symbol
+// ERR_SYMATTR: error: {{.*}}: cmse special symbol '__acle_se_invalid_10' cannot be an absolute symbol
+// ERR_SYMATTR: error: {{.*}}: cmse special symbol '__acle_se_invalid_11' is not a Thumb function definition
+// ERR_SYMATTR: error: {{.*}}: cmse entry symbol 'invalid_12' is not a Thumb function definition
+
+/// Test diagnostics emitted when a symbol is removed from a later version of the import library.
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj -I %S/Inputs --triple=thumbv8m.base libv1 -o libv1.o
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj -I %S/Inputs --triple=thumbv8m.base libv2 -o libv2.o
+// RUN: ld.lld -Ttext=0x8000 --section-start .gnu.sgstubs=0x20000 --cmse-implib libv1.o --out-implib=libv1.lib -o /dev/null
+// RUN: ld.lld -Ttext=0x8000 --section-start .gnu.sgstubs=0x20000 --cmse-implib libv2.o --in-implib=libv1.lib --out-implib=libv2.lib -o /dev/null 2>&1 | FileCheck %s --check-prefixes=WARN_MISSING
+// RUN: ld.lld -Ttext=0x8000 --section-start .gnu.sgstubs=0x20000 --cmse-implib libv1.o --in-implib=libv2.lib -o /dev/null 2>&1 | FileCheck %s --check-prefixes=WARN_NEWENTRY
+
+// WARN_MISSING: warning: entry function 'bar' from CMSE import library is not present in secure application
+// WARN_NEWENTRY: warning: new entry function 'bar' introduced but no output import library specified
+
+//--- with_sgstubs.script
+SECTIONS {
+  .text : { *(.text) }
+  .gnu.sgstubs 0x40000 : { *(.gnu.sgstubs*) }
+}
+
+//--- wout_sgstubs.script
+SECTIONS {
+  .text : { *(.text) }
+}
+
+//--- app
+  .include "arm-cmse-macros.s"
+  .text
+  .thumb
+
+cmse_veneer entry, function, global, function, global
+
+//--- lib
+    .text
+    .thumb
+
+    /// Symbol not absolute.
+    .global entry_not_absolute
+    .type entry_not_absolute, STT_FUNC
+    .thumb_func
+entry_not_absolute:
+    .size entry_not_absolute, 8
+
+    /// Symbol not global or weak.
+    .local entry_not_external
+    .type entry_not_external, STT_FUNC
+entry_not_external=0x1001
+    .size entry_not_external, 8
+
+    /// Symbol not the function type.
+    .global entry_not_function
+    .type entry_not_function, STT_NOTYPE
+entry_not_function=0x1001
+    .size entry_not_function, 8
+
+    /// Symbol not a Thumb code symbol.
+    .global entry_not_thumb
+    .type entry_not_thumb, STT_FUNC
+entry_not_thumb=0x1000
+    .size entry_not_thumb, 8
+
+    /// Symbol with incorrect size.
+    .global entry5_incorrect_size
+    .type entry5_incorrect_size, STT_FUNC
+entry5_incorrect_size=0x1009
+    .size entry5_incorrect_size, 6
+
+    /// Duplicate symbols.
+    .global entry6_duplicate
+    .type entry6_duplicate, STT_FUNC
+entry6_duplicate=0x1001
+    .size entry6_duplicate, 8
+
+    /// entry7_duplicate gets renamed to entry6_duplicate by llvm-objcopy.
+    .global entry7_duplicate
+    .type entry7_duplicate, STT_FUNC
+entry7_duplicate=0x1009
+    .size entry7_duplicate, 8
+
+//--- symattr
+.include "arm-cmse-macros.s"
+
+  .text
+  .thumb
+
+/// Valid sequences
+/// both sym and __acle_se_sym should be global or weak Thumb code symbols.
+  cmse_veneer valid_1, function, global, function, global
+  cmse_veneer valid_2, function,   weak, function,   weak
+  cmse_veneer valid_3, function,   weak, function, global
+  cmse_veneer valid_4, function, global, function,   weak
+
+/// Invalid sequences
+/// __acle_se_sym is an object
+  cmse_veneer invalid_1, function, global,   object, global
+  cmse_veneer invalid_2, function, global,   object,   weak
+/// sym is an object
+  cmse_veneer invalid_3,   object, global, function, global
+  cmse_veneer invalid_4,   object, global, function,   weak
+/// sym is local
+  cmse_veneer invalid_5, function,  local, function, global
+  cmse_veneer invalid_6, function,  local, function,   weak
+
+/// __acle_se_invalid_7 not defined.
+  .global invalid_7
+  .type invalid_7, %function
+  .global __acle_se_invalid_7
+  .thumb_func
+invalid_7:
+
+/// invalid_8 not defined.
+  .global __acle_se_invalid_8
+  .thumb_func
+__acle_se_invalid_8:
+
+// Absolute symbols with same values
+  .global invalid_9
+  .global __acle_se_invalid_9
+  .type __acle_se_invalid_9, %function
+  .type invalid_9, %function
+__acle_se_invalid_9=0x1001
+invalid_9=0x1001
+  .size invalid_9, 0
+  .size __acle_se_invalid_9, 0
+
+// Absolute symbols with different values
+  .align 2
+  .global __acle_se_invalid_10
+  .global invalid_10
+  .type __acle_se_invalid_10, %function
+  .type invalid_10, %function
+__acle_se_invalid_10 = 0x10001
+invalid_10 = 0x10005
+  .size invalid_10, 0
+  .size __acle_se_invalid_10, 0
+
+  .section nonthumb
+  .thumb
+  .align  2
+  .global  invalid_11
+  .global  __acle_se_invalid_11
+  .type  invalid_11, %function
+  .type  __acle_se_invalid_11, %function
+invalid_11:
+  .size  invalid_11, .-invalid_11
+/// Invalid non-thumb function symbol __acle_se_invalid_11
+__acle_se_invalid_11=0x1000
+
+  .global  invalid_12
+  .global  __acle_se_invalid_12
+  .type  invalid_12, %function
+  .type  __acle_se_invalid_12, %function
+/// Invalid non-thumb function symbol invalid_12
+invalid_12=0x1000
+  .thumb
+__acle_se_invalid_12:
+  .size  __acle_se_invalid_12, .-__acle_se_invalid_12
+
+//--- libv1
+.include "arm-cmse-macros.s"
+
+  .text
+  .thumb
+
+/// Import library version 1 with foo and bar
+  cmse_veneer foo, function, global, function, global
+  cmse_veneer bar, function,   weak, function,   weak
+
+//--- libv2
+.include "arm-cmse-macros.s"
+
+  .text
+  .thumb
+
+/// Import library version 2 with bar missing.
+  cmse_veneer foo, function, global, function, global

lld/test/ELF/arm-cmse-implib.s

+// REQUIRES: arm
+/// Test that addresses of secure gateways in an old import library are maintained in new import libraries.
+
+// RUN: rm -rf %t && split-file %s %t && cd %t
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj --triple=thumbv8m.base app -o app.o
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj --triple=thumbv8m.base implib-v1 -I %S/Inputs -o 1.o
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj --triple=thumbv8m.base implib-v2 -I %S/Inputs -o 2.o
+
+// RUN: ld.lld -Ttext=0x8000 --section-start .gnu.sgstubs=0x20000 -o 1 app.o --out-implib=1.lib --cmse-implib 1.o
+// RUN: llvm-readelf -s 1 1.lib | FileCheck %s --check-prefixes=CHECK1
+
+// RUN: ld.lld -Ttext=0x8000 --section-start .gnu.sgstubs=0x20000 -o 2 app.o --out-implib=2.lib --in-implib=1.lib --cmse-implib 2.o
+// RUN: llvm-readelf -s 2 2.lib | FileCheck %s --check-prefixes=CHECK2
+
+//--- app
+
+  .align  2
+  .global secure_entry
+  .type secure_entry, %function
+secure_entry:
+  nop
+  .size secure_entry, .-secure_entry
+
+//--- implib-v1
+
+    .include "arm-cmse-macros.s"
+
+    .syntax unified
+    .text
+
+  cmse_veneer foo, function, global, function, global
+  cmse_veneer bar, function, weak, function, global
+  cmse_no_veneer no_veneer1, function, weak, function, global
+  cmse_no_veneer no_veneer2, function, weak, function, weak
+
+//--- implib-v2
+
+    .include "arm-cmse-macros.s"
+
+    .syntax unified
+    .text
+
+  cmse_veneer baz, function, weak, function, global
+  cmse_veneer foo, function, global, function, global
+  cmse_veneer bar, function, weak, function, global
+  cmse_veneer qux, function, global, function, global
+  cmse_no_veneer no_veneer1, function, weak, function, global
+  cmse_no_veneer no_veneer2, function, weak, function, weak
+
+/// Executable 1
+// CHECK1:      File:
+// CHECK1:      Symbol table '.symtab' contains 13 entries:
+// CHECK1-NEXT:    Num:    Value  Size Type    Bind   Vis       Ndx Name
+// CHECK1-NEXT:      0: 00000000     0 NOTYPE  LOCAL  DEFAULT   UND
+// CHECK1-NEXT:      1: 00020000     0 NOTYPE  LOCAL  DEFAULT     2 $t
+// CHECK1-NEXT:      2: 00008000     0 NOTYPE  LOCAL  DEFAULT     1 $t.0
+// CHECK1-NEXT:      3: 00008004     0 NOTYPE  LOCAL  DEFAULT     1 $t.0
+// CHECK1-NEXT:      4: 00008001     2 FUNC    GLOBAL DEFAULT     1 secure_entry
+// CHECK1-NEXT:      5: 00020001     8 FUNC    GLOBAL DEFAULT     2 foo
+// CHECK1-NEXT:      6: 00008005     2 FUNC    GLOBAL DEFAULT     1 __acle_se_foo
+// CHECK1-NEXT:      7: 00020009     8 FUNC    WEAK   DEFAULT     2 bar
+// CHECK1-NEXT:      8: 00008009     2 FUNC    GLOBAL DEFAULT     1 __acle_se_bar
+// CHECK1-NEXT:      9: 0000800d     8 FUNC    WEAK   DEFAULT     1 no_veneer1
+// CHECK1-NEXT:     10: 00008013     2 FUNC    GLOBAL DEFAULT     1 __acle_se_no_veneer1
+// CHECK1-NEXT:     11: 00008015     8 FUNC    WEAK   DEFAULT     1 no_veneer2
+// CHECK1-NEXT:     12: 0000801b     2 FUNC    WEAK   DEFAULT     1 __acle_se_no_veneer2
+
+
+/// Import library 1
+// CHECK1:      File:
+// CHECK1:      Symbol table '.symtab' contains 5 entries:
+// CHECK1-NEXT:    Num:    Value  Size Type    Bind   Vis       Ndx Name
+// CHECK1-NEXT:      0: 00000000     0 NOTYPE  LOCAL  DEFAULT   UND
+// CHECK1-NEXT:      1: 00008015     8 FUNC    WEAK   DEFAULT   ABS no_veneer2
+// CHECK1-NEXT:      2: 0000800d     8 FUNC    WEAK   DEFAULT   ABS no_veneer1
+// CHECK1-NEXT:      3: 00020009     8 FUNC    WEAK   DEFAULT   ABS bar
+// CHECK1-NEXT:      4: 00020001     8 FUNC    GLOBAL DEFAULT   ABS foo
+
+/// Executable 2
+// CHECK2:      File:
+// CHECK2:      Symbol table '.symtab' contains 17 entries:
+// CHECK2-NEXT:    Num:    Value  Size Type    Bind   Vis       Ndx Name
+// CHECK2-NEXT:      0: 00000000     0 NOTYPE  LOCAL  DEFAULT   UND
+// CHECK2-NEXT:      1: 00020000     0 NOTYPE  LOCAL  DEFAULT     2 $t
+// CHECK2-NEXT:      2: 00008000     0 NOTYPE  LOCAL  DEFAULT     1 $t.0
+// CHECK2-NEXT:      3: 00008004     0 NOTYPE  LOCAL  DEFAULT     1 $t.0
+// CHECK2-NEXT:      4: 00008001     2 FUNC    GLOBAL DEFAULT     1 secure_entry
+// CHECK2-NEXT:      5: 00020019     8 FUNC    WEAK   DEFAULT     2 baz
+// CHECK2-NEXT:      6: 00008005     2 FUNC    GLOBAL DEFAULT     1 __acle_se_baz
+// CHECK2-NEXT:      7: 00020001     8 FUNC    GLOBAL DEFAULT     2 foo
+// CHECK2-NEXT:      8: 00008009     2 FUNC    GLOBAL DEFAULT     1 __acle_se_foo
+// CHECK2-NEXT:      9: 00020009     8 FUNC    WEAK   DEFAULT     2 bar
+// CHECK2-NEXT:     10: 0000800d     2 FUNC    GLOBAL DEFAULT     1 __acle_se_bar
+// CHECK2-NEXT:     11: 00020011     8 FUNC    GLOBAL DEFAULT     2 qux
+// CHECK2-NEXT:     12: 00008011     2 FUNC    GLOBAL DEFAULT     1 __acle_se_qux
+// CHECK2-NEXT:     13: 00008015     8 FUNC    WEAK   DEFAULT     1 no_veneer1
+// CHECK2-NEXT:     14: 0000801b     2 FUNC    GLOBAL DEFAULT     1 __acle_se_no_veneer1
+// CHECK2-NEXT:     15: 0000801d     8 FUNC    WEAK   DEFAULT     1 no_veneer2
+// CHECK2-NEXT:     16: 00008023     2 FUNC    WEAK   DEFAULT     1 __acle_se_no_veneer2
+
+
+/// Note that foo retains its address from Import library 1 (0x000020009)
+/// New entry functions, baz and qux, use addresses not used by Import library 1.
+/// Import library 2
+// CHECK2:      File:
+// CHECK2:      Symbol table '.symtab' contains 7 entries:
+// CHECK2-NEXT:    Num:    Value  Size Type    Bind   Vis       Ndx Name
+// CHECK2-NEXT:      0: 00000000     0 NOTYPE  LOCAL  DEFAULT   UND
+// CHECK2-NEXT:      1: 0000801d     8 FUNC    WEAK   DEFAULT   ABS no_veneer2
+// CHECK2-NEXT:      2: 00020019     8 FUNC    WEAK   DEFAULT   ABS baz
+// CHECK2-NEXT:      3: 00008015     8 FUNC    WEAK   DEFAULT   ABS no_veneer1
+// CHECK2-NEXT:      4: 00020011     8 FUNC    GLOBAL DEFAULT   ABS qux
+// CHECK2-NEXT:      5: 00020009     8 FUNC    WEAK   DEFAULT   ABS bar
+// CHECK2-NEXT:      6: 00020001     8 FUNC    GLOBAL DEFAULT   ABS foo

lld/test/ELF/arm-cmse-noveneers.s

+// REQUIRES: arm
+/// Test that addresses of existing secure gateway veneers are output in the CMSE import library.
+/// Test that .gnu.sgstubs is size 0 when no linker synthesized secure gateway veneers are created.
+
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj --triple=thumbv8m.main %s -I %S/Inputs -o %t.o
+// RUN: ld.lld --cmse-implib -Ttext=0x8000 --section-start .gnu.sgstubs=0x20000 %t.o -o %t --out-implib=%t.lib
+// RUN: llvm-objdump -d --no-show-raw-insn %t | FileCheck %s
+// RUN: llvm-readelf -S %t | FileCheck %s --check-prefixes=SGSTUBSSIZE
+// RUN: llvm-readelf -s %t.lib | FileCheck %s --check-prefixes=IMPLIBSYMS
+
+// CHECK: Disassembly of section .text:
+
+// CHECK-LABEL: <existing_veneer>:
+// CHECK-NEXT:     8000: sg
+// CHECK-NEXT:     8004: nop
+
+// CHECK-LABEL: <__acle_se_existing_veneer>:
+// CHECK-NEXT:     8006: nop
+
+ .include "arm-cmse-macros.s"
+
+  cmse_no_veneer existing_veneer, function, global, function, global
+
+///                      Name          Type         Address    Off   Size ES Flg Lk Inf Al
+// SGSTUBSSIZE: .gnu.sgstubs      PROGBITS        00020000 020000 000000 08  AX  0   0 32
+
+// IMPLIBSYMS:      Symbol table '.symtab' contains 2 entries:
+// IMPLIBSYMS-NEXT:    Num:    Value  Size Type    Bind   Vis       Ndx Name
+// IMPLIBSYMS-NEXT:      0: 00000000     0 NOTYPE  LOCAL  DEFAULT   UND
+// IMPLIBSYMS-NEXT:      1: 00008001     8 FUNC    GLOBAL DEFAULT   ABS existing_veneer

lld/test/ELF/arm-cmse-secure.s

+// REQUIRES: arm
+/// Create a secure app and import library using CMSE.
+/// Create a non-secure app that refers symbols in the import library.
+
+// RUN: rm -rf %t && split-file %s %t && cd %t
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj --triple=thumbv8m.main cmse-implib.s -o implib.o -I%S/Inputs/
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj --triple=thumbv8m.main cmse-secure-app.s -o secureapp.o
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj --triple=thumbv8m.main cmse-non-secure-app.s -o nonsecureapp.o
+/// Create the secure app and import library.
+// RUN: ld.lld -e secure_entry --section-start .gnu.sgstubs=0x20000 --cmse-implib implib.o secureapp.o --out-implib=implib.lib -o secureapp
+/// Link the non-secure app against the import library.
+// RUN: ld.lld -e nonsecure_entry -Ttext=0x8000 implib.lib nonsecureapp.o -o nonsecureapp
+// RUN: llvm-readelf -s implib.lib | FileCheck %s
+// RUN: llvm-objdump -d --no-show-raw-insn secureapp | FileCheck %s --check-prefixes=SECUREDISS
+// RUN: llvm-objdump -d --no-show-raw-insn nonsecureapp | FileCheck %s --check-prefixes=NONSECUREDISS
+
+// SECUREDISS-LABEL: <entry>:
+// SECUREDISS-NEXT:    20000: sg
+// SECUREDISS-NEXT:           b.w {{.*}} <__acle_se_entry>
+
+// SECUREDISS-LABEL: <__acle_se_entry>:
+// SECUREDISS-NEXT:    20008: nop
+
+// SECUREDISS-LABEL: <secure_entry>:
+// SECUREDISS-NEXT:    2000c: bl {{.*}} <__acle_se_entry>
+// SECUREDISS-NEXT:           bx lr
+
+// NONSECUREDISS-LABEL: <nonsecure_entry>:
+// NONSECUREDISS-NEXT:  8000: push {r0, lr}
+// NONSECUREDISS-NEXT:  bl 0x20000
+// NONSECUREDISS-NEXT:  pop.w {r0, lr}
+// NONSECUREDISS-NEXT:  bx lr
+
+// CHECK:      Symbol table '.symtab' contains 2 entries:
+// CHECK-NEXT:    Num:    Value  Size Type    Bind   Vis       Ndx Name
+// CHECK-NEXT:      0: 00000000     0 NOTYPE  LOCAL  DEFAULT   UND
+// CHECK-NEXT:      1: 00020001     8 FUNC    GLOBAL DEFAULT   ABS entry
+
+//--- cmse-implib.s
+  .include "arm-cmse-macros.s"
+
+  .syntax unified
+  .text
+
+  cmse_veneer entry, function, global, function, global
+
+//--- cmse-secure-app.s
+  .align  2
+    // Main entry point.
+    .global secure_entry
+    .thumb_func
+secure_entry:
+    bl entry
+    bx lr
+  .size  secure_entry, .-secure_entry
+
+//--- cmse-non-secure-app.s
+  .align  2
+  .global nonsecure_entry
+  .thumb
+  .thumb_func
+  .type  nonsecure_entry, %function
+nonsecure_entry:
+  push {r0,lr}
+  bl entry
+  pop {r0,lr}
+  bx lr
+  .size  nonsecure_entry, .-nonsecure_entry

lld/test/ELF/arm-cmse-veneers.s

+// REQUIRES: arm
+/// Test that symbol visibilities of <sym, __acle_se_sym> pairs in the objects
+/// are preserved in the executable.
+
+// RUN: llvm-mc -arm-add-build-attributes -filetype=obj --triple=thumbv8m.main %s -I %S/Inputs -o %t.o
+// RUN: ld.lld --cmse-implib -Ttext=0x8000 --section-start .gnu.sgstubs=0x20000 %t.o -o %t
+// RUN: llvm-objdump -d --no-show-raw-insn %t | FileCheck %s
+// RUN: llvm-readelf -s %t | FileCheck %s --check-prefixes=SYM
+
+// CHECK: Disassembly of section .gnu.sgstubs:
+
+// CHECK-LABEL: <weak_qux>:
+// CHECK-NEXT:    20000: sg
+// CHECK-NEXT:           b.w {{.*}} <__acle_se_weak_qux>
+// CHECK-EMPTY:
+// CHECK-LABEL: <global_foo>:
+// CHECK-NEXT:    20008: sg
+// CHECK-NEXT:           b.w {{.*}} <__acle_se_global_foo>
+// CHECK-EMPTY:
+// CHECK-LABEL: <global_baz>:
+// CHECK-NEXT:    20010: sg
+// CHECK-NEXT:           b.w {{.*}} <__acle_se_global_baz>
+// CHECK-EMPTY:
+// CHECK-LABEL: <weak_bar>:
+// CHECK-NEXT:    20018: sg
+// CHECK-NEXT:           b.w {{.*}} <__acle_se_weak_bar>
+
+// SYM: 00020009 {{.*}} GLOBAL {{.*}}           global_foo
+// SYM: 00008001 {{.*}} GLOBAL {{.*}} __acle_se_global_foo
+// SYM: 00020019 {{.*}} WEAK   {{.*}}           weak_bar
+// SYM: 00008005 {{.*}} WEAK   {{.*}} __acle_se_weak_bar
+// SYM: 00020011 {{.*}} GLOBAL {{.*}}           global_baz
+// SYM: 00008009 {{.*}} WEAK   {{.*}} __acle_se_global_baz
+// SYM: 00020001 {{.*}} WEAK   {{.*}}           weak_qux
+// SYM: 0000800d {{.*}} GLOBAL {{.*}} __acle_se_weak_qux
+
+  .include "arm-cmse-macros.s"
+
+  cmse_veneer global_foo, function, global, function, global
+  cmse_veneer weak_bar, function, weak, function, weak
+  cmse_veneer global_baz, function, global, function, weak
+  cmse_veneer weak_qux, function, weak, function, global