[LLD][ELF][AArch64] Implement scanner for Cortex-A53 Erratum 843419

[peter.smith]

Summary

Add a new file SectionPatcher.cpp that implements the logic to scan for the Cortex-A53 Erratum 843419. This involves finding all the executable code, disassembling the instructions that might trigger the erratum and reporting a message if the sequence is detected.

This is patch 1 of 3 to fix pr33463 https://bugs.llvm.org/show_bug.cgi?id=33463 . This patch adds two new options -fix-cortex-a53-843419 (taken from gold and ld.bfd) and -print-fixes (lld specific). contains logic to find all the executable code in an AArch64 link and scan it for the erratum sequence. If we find it we can print out a message if -print-fixes is selected. The tests just check that the recognizer can detect the patch sequence, and also avoid detecting sequences that are very similar, or embedded in literal data. The code to actually fix the erratum will follow shortly in a later patch. Regardless of the method of fixing the erratum this should be independent of the code to detect it.

Details of the erratum: http://infocenter.arm.com/help/topic/com.arm.doc.epm048406/Cortex_A53_MPCore_Software_Developers_Errata_Notice.pdf
Arm Architecture Reference Manual: https://developer.arm.com/products/architecture/a-profile/docs/ddi0487/latest/arm-architecture-reference-manual-armv8-for-armv8-a-architecture-profile

There are a number of design decisions that I've made that are somewhat arbitrary and could easily be changed:

• I've not tried to make the implementation target independent, as we only support one patch this would make the initial patch harder to understand. I'm quite happy to extract the target independent and target specific parts if people prefer.
• Mapping symbols are to the best of my knowledge specific to ARM and AArch64, I've followed gold and ld.bfd by only disassembling code that is marked as code by the $x mapping symbol. This avoids fake matches of bit-patterns in inline literal data.
• There is a lot of logic to decode the AArch64 instructions that are part of the erratum sequence, I've followed how these are written in the Arm Architecture Reference Manual, but this is still quite difficult to follow. I'm not sure how this can be avoided.
• I've made a new file SectionPatcher.cpp as much of the code is not reusable elsewhere. There is a lot of target specific AArch64 code in there, I thought it better to leave it there rather than try to somehow hide it behind the Target interface.

This patch is dependent on D36739 to get the correct addresses in the report message.

[grimar]

ELF/Driver.cpp

667 ↗

(On Diff #111165)

Since this option is LLD specific, I wonder do we need it ? Can we just always report fixes
if -fix-cortex-a53-843419 is specified ?
Or may be always report them if -versbose is given.

ELF/Writer.cpp

1326 ↗

(On Diff #111165)

Should we just fail in driver.cpp if -fix-cortex-a53-843419 used for non AARCH64 targets ?

[peter.smith]

Thanks very much for the comments. I've got rid of the -print-fixes option in favour of -verbose, and I've also added a check (with test) to error if the -fix-cortex-a53-843419 option is used when the machine is not AArch64.

[peter.smith]

Rebased to account for D35987. I've also taken the opportunity to go re-read and update all the comments and do some minor refactoring in preparation for some larger changes in D36749.

[peter.smith]

Rebase, change lld/Core to lld/Common in include file. No further changes.

[peter.smith]

Update diff in light of recent refactoring, no other changes.

[peter.smith]

Rebased to account for recent refactorings. No other changes.

[ruiu]

ELF/SectionPatcher.cpp

1 ↗

(On Diff #121713)

This is pretty much AArch64-specific, so SectionPatcher is not a good name.

60 ↗

(On Diff #121713)

It looks like you can define member functions as non-member, file-scope functions.

371–373 ↗

(On Diff #121713)

I feel it is easier to read without this helper.

377 ↗

(On Diff #121713)

GetInst() is basically free, so you don't need to avoid calling it, do you? It is not clear to me why you had to check if Inst1 satisfies the condition. You'll always pass it to is843419ErratumSequence(), so you could check if it is ADRP in that function.

412–426 ↗

(On Diff #121713)

Can you assume that symbol tables are sorted?

462–497 ↗

(On Diff #121713)

Nesting seems too deep. Could you simplify?

ELF/SectionPatcher.h

1 ↗

(On Diff #121713)

Will we have something like this for non-ARM targets? If not, this class name and file name sound too generic. I'd name AArch64ErrataPatcher or something like that.

[peter.smith]

Thanks very much for the comments. I've made the following changes:

• Changed the name of the files from SectionPatcher to AArch64ErrataFix. The technique for fixing errata isn't unique to AArch64, it has been applied to Arm before in other linkers, but I guess we can rename the file later if it becomes more generic.
• Removed the A64 struct.
• Got rid of GetInstr and simplified a bit.
• Created a function to remove some of the indentation.

Unfortunately mapping symbols aren't guaranteed to be ordered. It was thought too target specific to mandate in the ABI.

[peter.smith]

Fix header guard to use the new filename. My apologies for missing the first time.

[grimar]

Few comments/suggestions below.

ELF/AArch64ErrataFix.cpp

32 ↗

(On Diff #121893)

I think this description should be in the header of this file, see ICF.cpp for example.

288 ↗

(On Diff #121893)

Function names should start from lowercase.
I would suggest to change name to something strarting from "is*" or "should*" or alike,
which looks more appropriate naming for helper returning bool.

352 ↗

(On Diff #121893)

I would move this below declaration of PatchOff and declare as something like:

uint32_t *InstBuf = reinterpret_cast<uint32_t *>(Buf + Off);

That way you can get rid of multiple reinterpret_casts.

370 ↗

(On Diff #121893)

I think you missing curly brackets here to conform code style:

if (is843419ErratumSequence(Instr1, Instr2, Instr3)) {
...
} else if

410 ↗

(On Diff #121893)

You don't need brackets:

if (auto *Sec = dyn_cast<InputSection>(Def->Section))
  if (Sec->Flags & SHF_EXECINSTR)
    SectionMap[Sec].push_back(Def);

422 ↗

(On Diff #121893)

May be early continue ?

if (MapSyms.size() <= 1)
  continue;

471 ↗

(On Diff #121893)

Do you need argument ? It looks you could iterate over global OutputSections array.
(if suggestion below does not work for some reason).

476 ↗

(On Diff #121893)

Seems you can just iterate global InputSections vector here ?

ELF/Config.h

119 ↗

(On Diff #121893)

Do you need 'FatalWarnings' ? Looks unused.

[peter.smith]

Thanks very much for the review comments. I've updated the diff to address them.

ELF/AArch64ErrataFix.cpp

352 ↗

(On Diff #121893)

Good suggestion, thanks.

370 ↗

(On Diff #121893)

I've made the change. Just for my curiosity do you have a reference? I couldn't find anything in https://llvm.org/docs/CodingStandards.html . I guess it could be local lld convention.

471 ↗

(On Diff #121893)

Yes I can use the global. I seem to remember that OutputSections used to be a member of the Writer class, I guess this must have changed since I first wrote the patch.

476 ↗

(On Diff #121893)

Maybe, however I think it is worth keeping it the way it is for the moment for a couple of reasons:

• In the follow up patch that adds the patching we need to pass in the InputSectionDescription to insert the synthetic sections containing patches into.
• I'm more confident that I'm not finding patches in InputSections that aren't in the image.

ELF/Config.h

119 ↗

(On Diff #121893)

I've removed it, it looks like a mistake made when rebasing.

ELF/SectionPatcher.cpp

412–426 ↗

(On Diff #121713)

Unfortunately not. The original Arm proprietary toolchain used to guarantee that mapping symbols were sorted before all other symbols with the first element a special mapping symbol giving the number of mapping symbols. This was considered to much of a target specific requirement for the other toolchains so the requirement didn't go into the ABI.

[grimar]

ELF/AArch64ErrataFix.cpp

370 ↗

(On Diff #121893)

Hmm, I also did not find anything, that is probably local convention, I think we always write in that style (use brackets even for single line if else branch uses them), not sure where it came from initially :)

476 ↗

(On Diff #121893)

I am fine with it.
(regarding the second part I believe all Live InputSections anyways should be in the image, otherwise it would be bug, also it may make sence to rename 'createA53Errata843419Fixes' to 'reportA53Errata843419Fixes' for this iteration as it is exactly what it do now as far I understand).

ELF/AArch64ErrataFix.h

20 ↗

(On Diff #122665)

I meant this probably should be at the top of the .cpp file, in its header part,
just like we have in ICF.cpp, MapFile.cpp, ScriptLexer.cpp and others.

[peter.smith]

Thanks for the clarification about the header. I've renamed the create... to report... and have moved the comment to below the header in the .cpp file.

[peter.smith]

Many thanks for taking the time to review this and some of the other Arm/AArch64 specific stuff, it is much appreciated.

Posting into Phabricator to keep comments together.

+ if (Config->EMachine == EM_AARCH64 && Config->FixCortexA53Errata843419) {
+ Script->assignAddresses();
+ reportA53Errata843419Fixes();
+ }

Why do you need assignAddresses()? This is just after a loop that stops
when address don't change.

At the moment, until D37944 Add support for AArch64 Range Thunks lands the assignAddresses won't be entered. Some merge work will be needed here as Thunks and Errata fixes can impact each other.

+ This file implements Section Patching for the purpose of working around
+ errata in CPUs. The general principle is that an erratum sequence of one or
+ more instructions is detected in the instruction stream, one of the
+ instructions in the sequence is replaced with a branch to a patch sequence
+ of replacement instructions. At the end of the replacement sequence the
+ patch branches back to the instruction stream.
+
+ This technique is only suitable for fixing an erratum when:
+ - There is a set of necessary conditions required to trigger the erratum that
+ can be detected at static link time.
+ - There is a set of replacement instructions that can be used to remove at
+ least one of the necessary conditions that trigger the erratum.
+ - We can overwrite an instruction in the erratum sequence with a branch to
+ the replacement sequence.
+ - We can place the replacement sequence within range of the branch.

Given where this is called you also need to be able to place the
replacement sequence after all other sections or you will need to
reevaluate addresses for thunks, no?

Yes. At time of writing AArch64 doesn't support thunks, my preference would be to land the range thunks support for AArch64 first (D37944) and then merge this in with some test cases involving range extension thunks.

+ - The implementation here only supports one patch, the AArch64 Cortex-53
+ errata 843419 that affects r0p0, r0p1, r0p2 and r0p4 versions of the core.
+ To keep the initial version simple there is no support for multiple
+ architectures or selection of different patches.

BTW, is it public knowledge what uses these versions? I am not sure if
that is something that is present in a few early dev boards or in most
of the phones on the planet.

Unfortunately I don't have concrete information, we'd need to know for each phone what SoC it was using, and for each SoC which rev of the Cortex-A53 it was using. What I do know is that it was reproduced in real Android software on enough phones to make the NDK enable the gold/bfd equivalent option by default. My understanding is that Ubuntu for AArch64 and the Linaro aarch64-linux-gnu toolchains also enable it by default. My guess, given the low shelf life of mobiles, is the overall percentage of phones is low, but there are so many phones out there that it could still run into hundreds of thousands of phones still in use.

+ Load/store register (unsigned immediate)
+ | size (2) 11 | 1 V 01 | opc (2) | imm12 | Rn (5) | Rt (5) |
+static bool isLoadStoreRegisterUnsigned(uint32_t Instr) {
+ return (Instr & 0x3b000000) == 0x39000000;
+}

A crazy idea for another day: can all these functions be auto generated
from the td files that llvm-mc uses?

I did think a bit about that. In theory some of it, but in general the information in mc doesn't give you the information in the right form or in a stable enough form that you could interrogate for details such as does this instruction read or write this register? I suspect that quite a bit more information that wouldn't be needed for compilation/disassembly would need to be added to the .td files to make it work.

+ Note that this function refers to v8.0 only and does not include the
+ additional load and store instructions added for in later revisions of
+ the architecture such as the Atomic memory operations introduced
+ in v8.1.

Because the errata is fixed on all implementations of v8.1?

In effect yes. The errata is specific to the cortex-a53 CPU, and all cortex-a53s are v8.0.

+static void report843419Fix(uint64_t AdrpAddr) {
+ if (!Config->Verbose)
+ return;
+ message("detected cortex-a53-843419 erratum sequence starting at " +
+ utohexstr(AdrpAddr) + " in unpatched output.");
+}

This one is actually simpler without the early return.

Ok I'll fix.

+ bool OptionalAllowed = Limit - Off > 12;

Move bool after the if since it is not used in it.

Ok I'll fix.

LGTM with the above nits fixed (mostly comment updates).

Cheers,
Rafael

I think it will be best if I get the range-extension thunks in first, and then merge this one in so that the interactions can be tested.

[peter.smith]

Updated and rebased after addition of range-extension thunks for aarch64.

• The erratum scanning is now done within the same loop as range extension thunks.
• Added a new test case of an erratum sequence that will only be detected on the second pass. As the scanner only detects patches and doesn't try and fix them we cannot test the case where a new thunk is required due to a patch being added.

[peter.smith]

peter.smith updated this revision to Diff 125355.
peter.smith added a comment.

Updated and rebased after addition of range-extension thunks for aarch64.

• The erratum scanning is now done within the same loop as range extension thunks.
• Added a new test case of an erratum sequence that will only be detected on the second pass. As the scanner only detects patches and doesn't try and fix them we cannot test the case where a new thunk is required due to a patch being added.

What is the plan for when we detect sequences to patch on mulitple
iterations? Given that the address of the instructions are important, we
can end up patching sequences that in the end are in addresses that
don't actually need patching, no?

That is probably fine as avoiding it would probably require a fancier
optimization algorithm.

LGTM.

Cheers,
Rafael

The plan is to leave them in. This can result in a small amount of wasted code size (each patch instance is 8-bytes) but it isn't significant compared to the overall size of the program. There is a clever way of mitigating the problem by padding out the size of a patch such that it doesn't disturb the base address modulo 0x1000 of following sections. Although this wastes quite a lot of bytes for small programs.

Thanks very much for the review.

[grimar]

Looks you forgot to add AArch64ErrataFix.cpp.

[grimar]

ELF/AArch64ErrataFix.cpp

256 ↗

(On Diff #125355)

Hi from 2018, Peter :)

I am sorry for the delay, but this line of the code seems uncovered by any test cases we have.
Do you think you can fix it? (If not - I'll try to do something by myself probably).

(We are somewhere in the middle of the doing the bot to check the LLD code coverage.
I am currently trying to find out and resolve the most problematic places)

[peter.smith]

I'll come up with something. Will aim to do it on Monday. The load/store exclusive instructions are architecture v8.1 only so aren't supported by the v8.0 cortex-a53; it is unlikely that anyone will run the erratum fix that only affects cortex-a53 with the option but it should be possible to come up with test case.

[grimar]

In D36742#1147698, @peter.smith wrote:

I'll come up with something. Will aim to do it on Monday. The load/store exclusive instructions are architecture v8.1 only so aren't supported by the v8.0 cortex-a53; it is unlikely that anyone will run the erratum fix that only affects cortex-a53 with the option but it should be possible to come up with test case.

Cool, thanks!

lld/trunk/ELF/CMakeLists.txt

 set(LLVM_TARGET_DEFINITIONS Options.td)
 tablegen(LLVM Options.inc -gen-opt-parser-defs)
 add_public_tablegen_target(ELFOptionsTableGen)
 
 if(NOT LLD_BUILT_STANDALONE)
   set(tablegen_deps intrinsics_gen)
 endif()
 
 add_lld_library(lldELF
+  AArch64ErrataFix.cpp
   Arch/AArch64.cpp
   Arch/AMDGPU.cpp
   Arch/ARM.cpp
   Arch/AVR.cpp
   Arch/Mips.cpp
   Arch/MipsArchTree.cpp
   Arch/PPC.cpp
   Arch/PPC64.cpp

lld/trunk/ELF/Config.h

struct Configuration {
   bool CompressDebugSections;
   bool DefineCommon;
   bool Demangle = true;
   bool DisableVerify;
   bool EhFrameHdr;
   bool EmitRelocs;
   bool EnableNewDtags;
   bool ExportDynamic;
+  bool FixCortexA53Errata843419;
   bool GcSections;
   bool GdbIndex;
   bool GnuHash = false;
   bool HasDynamicList = false;
   bool HasDynSymTab;
   bool ICF;
   bool MipsN32Abi = false;
   bool NoGnuUnique;

lld/trunk/ELF/Driver.cpp

 // Some command line options or some combinations of them are not allowed.
 // This function checks for such errors.
 static void checkOptions(opt::InputArgList &Args) {
   // The MIPS ABI as of 2016 does not support the GNU-style symbol lookup
   // table which is a relatively new feature.
   if (Config->EMachine == EM_MIPS && Config->GnuHash)
     error("the .gnu.hash section is not compatible with the MIPS target.");
 
+  if (Config->FixCortexA53Errata843419 && Config->EMachine != EM_AARCH64)
+    error("--fix-cortex-a53-843419 is only supported on AArch64 targets.");
+
   if (Config->Pie && Config->Shared)
     error("-shared and -pie may not be used together");
 
   if (!Config->Shared && !Config->FilterList.empty())
     error("-F may not be used without -shared");
 
   if (!Config->Shared && !Config->AuxiliaryList.empty())
     error("-f may not be used without -shared");
void LinkerDriver::readConfigs(opt::InputArgList &Args) {
   Config->EnableNewDtags = !Args.hasArg(OPT_disable_new_dtags);
   Config->Entry = Args.getLastArgValue(OPT_entry);
   Config->ExportDynamic =
       Args.hasFlag(OPT_export_dynamic, OPT_no_export_dynamic, false);
   errorHandler().FatalWarnings =
       Args.hasFlag(OPT_fatal_warnings, OPT_no_fatal_warnings, false);
   Config->FilterList = args::getStrings(Args, OPT_filter);
   Config->Fini = Args.getLastArgValue(OPT_fini, "_fini");
+  Config->FixCortexA53Errata843419 = Args.hasArg(OPT_fix_cortex_a53_843419);
   Config->GcSections = Args.hasFlag(OPT_gc_sections, OPT_no_gc_sections, false);
   Config->GdbIndex = Args.hasFlag(OPT_gdb_index, OPT_no_gdb_index, false);
   Config->ICF = Args.hasFlag(OPT_icf_all, OPT_icf_none, false);
   Config->Init = Args.getLastArgValue(OPT_init, "_init");
   Config->LTOAAPipeline = Args.getLastArgValue(OPT_lto_aa_pipeline);
   Config->LTONewPmPasses = Args.getLastArgValue(OPT_lto_newpm_passes);
   Config->LTOO = args::getInteger(Args, OPT_lto_O, 2);
   Config->LTOPartitions = args::getInteger(Args, OPT_lto_partitions, 1);

lld/trunk/ELF/Options.td

def fatal_warnings: F<"fatal-warnings">,
   HelpText<"Treat warnings as errors">;
 
 defm filter: Eq<"filter">,
   HelpText<"Set DT_FILTER field to the specified name">;
 
 defm fini: Eq<"fini">,
   HelpText<"Specify a finalizer function">, MetaVarName<"<symbol>">;
 
+def fix_cortex_a53_843419: F<"fix-cortex-a53-843419">,
+  HelpText<"Apply fixes for AArch64 Cortex-A53 erratum 843419">;
+
 def full_shutdown : F<"full-shutdown">,
   HelpText<"Perform a full shutdown instead of calling _exit">;
 
 defm format: Eq<"format">,
   HelpText<"Change the input format of the inputs following this option">,
   MetaVarName<"<input-format>">;
 
 def gc_sections: F<"gc-sections">,

lld/trunk/ELF/Writer.cpp

 //===- Writer.cpp ---------------------------------------------------------===//
 //
 //                             The LLVM Linker
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 
 #include "Writer.h"
+#include "AArch64ErrataFix.h"
 #include "Config.h"
 #include "Filesystem.h"
 #include "LinkerScript.h"
 #include "MapFile.h"
 #include "OutputSections.h"
 #include "Relocations.h"
 #include "Strings.h"
 #include "SymbolTable.h"
applySynthetic({InX::DynSymTab,     InX::Bss,          InX::BssRelRo,
                   In<ELFT>::RelaIplt, In<ELFT>::RelaPlt, InX::Plt,
                   InX::Iplt,          InX::EhFrameHdr,   In<ELFT>::VerSym,
                   In<ELFT>::VerNeed,  InX::Dynamic},
                  [](SyntheticSection *SS) { SS->finalizeContents(); });
 
   if (!Script->HasSectionsCommand && !Config->Relocatable)
     fixSectionAlignments();
 
-  // Some architectures use small displacements for jump instructions.
-  // It is linker's responsibility to create thunks containing long
-  // jump instructions if jump targets are too far. Create thunks.
+  // Some architectures need to generate content that depends on the address
+  // of InputSections. For example some architectures use small displacements
+  // for jump instructions that is is the linker's responsibility for creating
+  // range extension thunks for. As the generation of the content may also
+  // alter InputSection addresses we must converge to a fixed point.
   if (Target->NeedsThunks || Config->AndroidPackDynRelocs) {
     ThunkCreator TC;
     bool Changed;
     do {
       Script->assignAddresses();
       Changed = false;
       if (Target->NeedsThunks)
         Changed |= TC.createThunks(OutputSections);
+      if (Config->FixCortexA53Errata843419) {
+        if (Changed)
+          Script->assignAddresses();
+        reportA53Errata843419Fixes();
+      }
       if (InX::MipsGot)
         InX::MipsGot->updateAllocSize();
       Changed |= In<ELFT>::RelaDyn->updateAllocSize();
     } while (Changed);
   }
 
   // Fill other section headers. The dynamic table is finalized
   // at the end because some tags like RELSZ depend on result

lld/trunk/test/ELF/aarch64-cortex-a53-843419-address.s

+// REQUIRES: aarch64
+// RUN: llvm-mc -filetype=obj -triple=aarch64-none-linux %s -o %t.o
+// RUN: echo "SECTIONS { \
+// RUN:          .text : { *(.text) *(.text.*) *(.newisd) } \
+// RUN:          .text2 : { *.(newos) } \
+// RUN:          .data : { *(.data) } }" > %t.script
+// RUN: ld.lld --script %t.script -fix-cortex-a53-843419 -verbose %t.o -o %t2 | FileCheck %s
+
+// Test cases for Cortex-A53 Erratum 843419 that involve interactions
+// between the generated patches and the address of sections
+
+// See ARM-EPM-048406 Cortex_A53_MPCore_Software_Developers_Errata_Notice.pdf
+// for full erratum details.
+// In Summary
+// 1.)
+// ADRP (0xff8 or 0xffc)
+// 2.)
+// - load or store single register or either integer or vector registers
+// - STP or STNP of either vector or vector registers
+// - Advanced SIMD ST1 store instruction
+// Must not write Rn
+// 3.) optional instruction, can't be a branch, must not write Rn, may read Rn
+// 4.) A load or store instruction from the Load/Store register unsigned
+// immediate class using Rn as the base register
+
+// An aarch64 section can contain ranges of literal data embedded within the
+// code, these ranges are encoded with mapping symbols. This tests that we
+// can match the erratum sequence in code, but not data
+// - We can handle more than one patch per code range (denoted by mapping
+//   symbols)
+// - We can handle a patch in more than range of code, with literal data
+//   inbetween
+// - We can handle redundant mapping symbols (two or more consecutive mapping
+//   symbols with the same type)
+// - We can ignore erratum sequences in multiple literal data ranges.
+
+// CHECK: detected cortex-a53-843419 erratum sequence starting at FF8 in unpatched output.
+
+        .section .text.01, "ax", %progbits
+        .balign 4096
+        .space 4096 - 8
+        .globl t3_ff8_ldr
+        .type t3_ff8_ldr, %function
+t3_ff8_ldr:
+        adrp x0, dat
+        ldr x1, [x1, #0]
+        ldr x0, [x0, :got_lo12:dat]
+        ret
+
+
+        // create a redundant mapping symbol as we are already in a $x range
+        // some object producers unconditionally generate a mapping symbol on
+        // every symbol so we need to handle the case of $x $x
+        .local $x.999
+$x.999:
+// CHECK-NEXT: detected cortex-a53-843419 erratum sequence starting at 1FFC in unpatched output.
+        .globl t3_ffc_ldrsimd
+        .type t3_ffc_ldrsimd, %function
+        .space 4096 - 12
+t3_ffc_ldrsimd:
+        adrp x0, dat
+        ldr s1, [x1, #0]
+        ldr x2, [x0, :got_lo12:dat]
+        ret
+
+// Inline data containing bit pattern of erratum sequence, expect no patch
+        .globl t3_ffc_ldralldata
+        .type t3_ff8_ldralldata, %function
+        .space 4096 - 20
+t3_ff8_ldralldata:
+        // 0x90000000 = adrp x0, #0
+        .byte 0x00
+        .byte 0x00
+        .byte 0x00
+        .byte 0x90
+        // 0xf9400021 = ldr x1, [x1]
+        .byte 0x21
+        .byte 0x00
+        .byte 0x40
+        .byte 0xf9
+        // 0xf9400000 = ldr x0, [x0]
+        .byte 0x00
+        .byte 0x00
+        .byte 0x40
+        .byte 0xf9
+        // Check that we can recognise the erratum sequence post literal data
+
+// CHECK-NEXT: detected cortex-a53-843419 erratum sequence starting at 3FF8 in unpatched output.
+
+        .space 4096 - 12
+        .globl t3_ffc_ldr
+        .type t3_ffc_ldr, %function
+ t3_ffc_ldr:
+        adrp x0, dat
+        ldr x1, [x1, #0]
+        ldr x0, [x0, :got_lo12:dat]
+        ret
+
+        .section .text.02, "ax", %progbits
+        .space 4096 - 12
+
+        // Start a new InputSectionDescription (see Linker Script) so the
+        // start address will be
+        // affected by any patches added to previous InputSectionDescription
+
+// CHECK: detected cortex-a53-843419 erratum sequence starting at 4FFC in unpatched output.
+
+        .section .newisd, "ax", %progbits
+        .globl t3_ffc_str
+        .type t3_ffc_str, %function
+t3_ffc_str:
+        adrp x0, dat
+        str x1, [x1, #0]
+        ldr x0, [x0, :got_lo12:dat]
+        ret
+        .space 4096 - 20
+
+// CHECK:  detected cortex-a53-843419 erratum sequence starting at 5FF8 in unpatched output.
+
+        // Start a new OutputSection (see Linker Script) so the
+        // start address will be
+        // affected by any patches added to previous InputSectionDescription
+        .section .newos, "ax", %progbits
+        .globl t3_ff8_str
+        .type t3_ff8_str, %function
+t3_ff8_str:
+        adrp x0, dat
+        str x1, [x1, #0]
+        ldr x0, [x0, :got_lo12:dat]
+        ret
+        .globl _start
+        .type _start, %function
+_start:
+        ret
+
+        .data
+        .globl dat
+dat:    .word 0

lld/trunk/test/ELF/aarch64-cortex-a53-843419-cli.s

+// REQUIRES: x86
+// RUN: llvm-mc -filetype=obj -triple=x86_64-unknown-linux %s -o %t
+// RUN: not ld.lld %t -fix-cortex-a53-843419 -o %t2 2>&1 | FileCheck %s
+
+// CHECK: --fix-cortex-a53-843419 is only supported on AArch64 targets.
+.globl entry
+.text
+        .quad 0
+entry:
+        ret

lld/trunk/test/ELF/aarch64-cortex-a53-843419-nopatch.s

+// REQUIRES: aarch64
+// RUN: llvm-mc -filetype=obj -triple=aarch64-none-linux %s -o %t.o
+// RUN: ld.lld -fix-cortex-a53-843419 -verbose -t %t.o -o %t2 | FileCheck %s
+// Test cases for Cortex-A53 Erratum 843419 that we don't expect to recognize
+// as needing a patch as one or more of the conditions isn't satisfied.
+// See ARM-EPM-048406 Cortex_A53_MPCore_Software_Developers_Errata_Notice.pdf
+// for full erratum details.
+// In Summary
+// 1.)
+// ADRP (0xff8 or 0xffc)
+// 2.)
+// - load or store single register or either integer or vector registers
+// - STP or STNP of either vector or vector registers
+// - Advanced SIMD ST1 store instruction
+// Must not write Rn
+// 3.) optional instruction, can't be a branch, must not write Rn, may read Rn
+// 4.) A load or store instruction from the Load/Store register unsigned
+// immediate class using Rn as the base register
+
+// Expect no patches detected.
+// CHECK-NOT: detected cortex-a53-843419 erratum sequence
+
+// erratum sequence but adrp (address & 0xfff) is not 0xff8 or 0xffc
+        .section .text.01, "ax", %progbits
+        .balign 4096
+        .globl t3_0_ldr
+        .type t3_ff8_ldr, %function
+t3_0_ldr:
+        adrp x0, dat
+        ldr x1, [x1, #0]
+        ldr x0, [x0, :got_lo12:dat]
+        ret
+
+        .section .text.02, "ax", %progbits
+        .balign 4096
+        .globl t3_ff4_ldr
+        .space 4096 - 12
+        .type t3_ff4_ldr, %function
+t3_ff4_ldr:
+        adrp x0, dat
+        ldr x1, [x1, #0]
+        ldr x0, [x0, :got_lo12:dat]
+        ret
+
+// Close matches for erratum sequence, with adrp at correct address but
+// instruction 2 is a load or store but not one that matches the erratum
+// conditions, but with a similar encoding to an instruction that does.
+
+        // ldp is not part of sequence, although stp is.
+        .section .text.03, "ax", %progbits
+        .balign 4096
+        .globl t3_ff8_ldp
+        .type t3_ff8_ldp, %function
+        .space 4096 - 8
+t3_ff8_ldp:
+        adrp x16, dat
+        ldp x1,x2, [x3, #0]
+        ldr x13, [x16, :got_lo12:dat]
+        ret
+
+        // st2 is not part of sequence although st1 is.
+        .section .text.04, "ax", %progbits
+        .balign 4096
+        .globl t3_ffc_st2
+        .type t3_ffc_st2, %function
+        .space 4096 - 4
+t3_ffc_st2:
+        adrp x16, dat
+        st2 { v0.16b, v1.16b }, [x1]
+        ldr x13, [x16, :got_lo12:dat]
+        ret
+
+        // st3 is not part of sequence although st1 is.
+        .section .text.05, "ax", %progbits
+        .balign 4096
+        .globl t3_ffc_st3
+        .type t3_ffc_st3, %function
+        .space 4096 - 4
+t3_ffc_st3:
+        adrp x16, dat
+        st3 { v0.16b, v1.16b, v2.16b }, [x1], x2
+        ldr x13, [x16, :got_lo12:dat]
+        ret
+
+        // ld1 is not part of sequence although st1 is.
+        .section .text.06, "ax", %progbits
+        .balign 4096
+        .globl t3_ffc_ld2
+        .type t3_ffc_st3, %function
+        .space 4096 - 4
+t3_ffc_ld1:
+        adrp x16, dat
+        ld1 { v0.16b }, [x2], x3
+        ldr x13, [x16, :got_lo12:dat]
+        ret
+
+        // ldnp is not part of sequence although stnp is.
+        .section .text.07, "ax", %progbits
+        .balign 4096
+        .globl t4_ff8_ldnp
+        .type t4_ff8_ldnp, %function
+        .space 4096 - 8
+t4_ff8_ldnp:
+        adrp x7, dat
+        ldnp x1,x2, [x3, #0]
+        nop
+        ldr x10, [x7, :got_lo12:dat]
+        ret
+
+// Close match for erratum sequence, with adrp at correct address but
+// instruction 2 writes to Rn, with Rn as either destination or as the
+// transfer register but with writeback.
+
+        // ldr instruction writes to Rn
+        .section .text.08, "ax", %progbits
+        .balign 4096
+        .globl t3_ff8_ldr
+        .type t3_ff8_ldr, %function
+        .space 4096 - 8
+t3_ff8_ldr:
+        adrp x0, dat
+        ldr x0, [x1, #0]
+        ldr x0, [x0, :got_lo12:dat]
+        ret
+
+        // str instruction writes to Rn via writeback (pre index)
+        .section .text.09, "ax", %progbits
+        .balign 4096
+        .globl t3_ff8_str
+        .type t3_ff8_str, %function
+        .space 4096 - 8
+t3_ff8_str:
+        adrp x0, dat
+        str x1, [x0, #4]!
+        ldr x0, [x0, :got_lo12:dat]
+        ret
+
+        // ldr instruction writes to Rn via writeback (post index)
+        .section .text.09, "ax", %progbits
+        .balign 4096
+        .globl t3_ffc_ldr
+        .type t3_ffc_ldr, %function
+        .space 4096 - 8
+t3_ffc_ldr:
+        adrp x0, dat
+        ldr x1, [x0], 0x8
+        ldr x0, [x0, :got_lo12:dat]
+        ret
+
+        // stp writes to Rn via writeback (pre index)
+        .section .text.10, "ax", %progbits
+        .balign 4096
+        .globl t4_ffc_stppre
+        .type t4_ffc_stppre, %function
+        .space 4096 - 4
+t4_ffc_stppre:
+        adrp x16, dat
+        stp x1,x2, [x16, #16]!
+        mul x3, x16, x16
+        ldr x14, [x16, #8]
+        ret
+
+        // stp writes to Rn via writeback (post index)
+        .section .text.11, "ax", %progbits
+        .balign 4096
+        .globl t4_ff8_stppost
+        .type t4_ff8_stppost, %function
+        .space 4096 - 8
+t4_ff8_stppost:
+        adrp x16, dat
+        stp x1,x2, [x16], #16
+        mul x3, x16, x16
+        ldr x14, [x16, #8]
+        ret
+
+        // st1 writes to Rn via writeback
+        .section .text.12, "ax", %progbits
+        .balign 4096
+        .globl t3_ff8_st1
+        .type t3_ff8_st1, %function
+        .space 4096 - 8
+t3_ff8_st1:
+        adrp x16, dat
+        st1 { v0.16b}, [x16], x2
+        ldr x13, [x16, :got_lo12:dat]
+        ret
+
+// Close match for erratum sequence, but with optional instruction 3 a branch
+
+        // function call via immediate
+        .section .text.13, "ax", %progbits
+        .balign 4096
+        .globl t4_ffc_blimm
+        .type t4_ffc_blimm, %function
+        .space 4096 - 4
+t4_ffc_blimm:
+        adrp x7, dat
+        stnp x1,x2, [x3, #0]
+        bl t4_ffc_blimm
+        ldr x10, [x7, :got_lo12:dat]
+        ret
+
+        // function call via register
+        .section .text.14, "ax", %progbits
+        .balign 4096
+        .globl t4_ffc_blreg
+        .type t4_ffc_blreg, %function
+        .space 4096 - 4
+t4_ffc_blreg:
+        adrp x7, dat
+        stnp x1,x2, [x3, #0]
+        blr x4
+        ldr x10, [x7, :got_lo12:dat]
+        ret
+
+        // Unconditional branch immediate
+        .section .text.15, "ax", %progbits
+        .balign 4096
+        .globl t4_ffc_branchimm
+        .type t4_ffc_branchimm, %function
+        .space 4096 - 4
+t4_ffc_branchimm:
+        adrp x7, dat
+        stnp x1,x2, [x3, #0]
+        b t4_ffc_branchimm
+        ldr x10, [x7, :got_lo12:dat]
+        ret
+
+        // Unconditional branch register
+        .section .text.16, "ax", %progbits
+        .balign 4096
+        .globl t4_ffc_branchreg
+        .type t4_ffc_branchreg, %function
+        .space 4096 - 4
+t4_ffc_branchreg:
+        adrp x7, dat
+        stnp x1,x2, [x3, #0]
+        br x4
+        ldr x10, [x7, :got_lo12:dat]
+        ret
+
+        // Conditional branch
+        .section .text.17, "ax", %progbits
+        .balign 4096
+        .globl t4_ffc_branchcond
+        .type t4_ffc_branchcond, %function
+        .space 4096 - 4
+t4_ffc_branchcond:
+        adrp x7, dat
+        stnp x1,x2, [x3, #0]
+        cbz x5, t4_ffc_branchcond
+        ldr x10, [x7, :got_lo12:dat]
+        ret
+
+        // Conditional branch immediate
+        .section .text.18, "ax", %progbits
+        .balign 4096
+        .globl t4_ffc_branchcondimm
+        .type t4_ffc_branchcondimm, %function
+        .space 4096 - 4
+t4_ffc_branchcondimm:
+        adrp x7, dat
+        stnp x1,x2, [x3, #0]
+        beq t4_ffc_branchcondimm
+        ldr x10, [x7, :got_lo12:dat]
+        ret
+        
+// Bitpattern matches erratum sequence but either all or part of the sequence
+// is in inline literal data
+        .section .text.19, "ax", %progbits
+        .balign 4096
+        .globl t3_ffc_ldrtraildata
+        .type t3_ff8_ldrtraildata, %function
+        .space 4096 - 8
+t3_ff8_ldrtraildata:
+        adrp x0, dat
+        ldr x1, [x1, #0]
+        // 0xf9400000 = ldr x0, [x0]
+        .byte 0x00
+        .byte 0x00
+        .byte 0x40
+        .byte 0xf9
+        ldr x0, [x0, :got_lo12:dat]
+        ret
+
+        .section .text.20, "ax", %progbits
+        .balign 4096
+        .globl t3_ffc_ldrpredata
+        .type t3_ff8_ldrpredata, %function
+        .space 4096 - 8
+t3_ff8_ldrpredata:
+        // 0x90000000 = adrp x0, #0
+        .byte 0x00
+        .byte 0x00
+        .byte 0x00
+        .byte 0x90
+        ldr x1, [x1, #0]
+        ldr x0, [x0, :got_lo12:dat]
+        ret
+
+        .section .text.21, "ax", %progbits
+        .balign 4096
+        .globl t3_ffc_ldralldata
+        .type t3_ff8_ldralldata, %function
+        .space 4096 - 8
+t3_ff8_ldralldata:
+        // 0x90000000 = adrp x0, #0
+        .byte 0x00
+        .byte 0x00
+        .byte 0x00
+        .byte 0x90
+        // 0xf9400021 = ldr x1, [x1]
+        .byte 0x21
+        .byte 0x00
+        .byte 0x40
+        .byte 0xf9
+        // 0xf9400000 = ldr x0, [x0]
+        .byte 0x00
+        .byte 0x00
+        .byte 0x40
+        .byte 0xf9
+
+        ret
+
+        .text
+        .globl _start
+        .type _start, %function
+_start:
+        ret
+
+
+
+
+
+// Bitpattern matches erratum sequence but section is not executable
+        .data
+        .globl dat
+dat:    .word 0

lld/trunk/test/ELF/aarch64-cortex-a53-843419-recognize.s

+// REQUIRES: aarch64
+// RUN: llvm-mc -filetype=obj -triple=aarch64-none-linux %s -o %t.o
+// RUN: ld.lld -fix-cortex-a53-843419 -verbose %t.o -o %t2 | FileCheck -check-prefix CHECK-PRINT %s
+
+// Test cases for Cortex-A53 Erratum 843419
+// See ARM-EPM-048406 Cortex_A53_MPCore_Software_Developers_Errata_Notice.pdf
+// for full erratum details.
+// In Summary
+// 1.)
+// ADRP (0xff8 or 0xffc)
+// 2.)
+// - load or store single register or either integer or vector registers
+// - STP or STNP of either vector or vector registers
+// - Advanced SIMD ST1 store instruction
+// Must not write Rn
+// 3.) optional instruction, can't be a branch, must not write Rn, may read Rn
+// 4.) A load or store instruction from the Load/Store register unsigned
+// immediate class using Rn as the base register
+
+// Each section contains a sequence of instructions that should be recognized
+// as erratum 843419. The test cases cover the major variations such as:
+// adrp starts at 0xfff8 or 0xfffc
+// Variations in instruction class for instruction 2
+// Optional instruction 3 present or not
+// Load or store for instruction 4.
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 21FF8 in unpatched output.
+        .section .text.01, "ax", %progbits
+        .balign 4096
+        .globl t3_ff8_ldr
+        .type t3_ff8_ldr, %function
+        .space 4096 - 8
+t3_ff8_ldr:
+        adrp x0, dat1
+        ldr x1, [x1, #0]
+        ldr x0, [x0, :got_lo12:dat1]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 23FF8 in unpatched output.
+        .section .text.02, "ax", %progbits
+        .balign 4096
+        .globl t3_ff8_ldrsimd
+        .type t3_ff8_ldrsimd, %function
+        .space 4096 - 8
+t3_ff8_ldrsimd:
+        adrp x0, dat2
+        ldr s1, [x1, #0]
+        ldr x2, [x0, :got_lo12:dat2]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 25FFC in unpatched output.
+        .section .text.03, "ax", %progbits
+        .balign 4096
+        .globl t3_ffc_ldrpost
+        .type t3_ffc_ldrpost, %function
+        .space 4096 - 4
+t3_ffc_ldrpost:
+        adrp x0, dat3
+        ldr s1, [x1], #8
+        ldr x3, [x0, :got_lo12:dat3]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 27FF8 in unpatched output.
+        .section .text.04, "ax", %progbits
+        .balign 4096
+        .globl t3_ff8_strpre
+        .type t3_ff8_strpre, %function
+        .space 4096 - 8
+t3_ff8_strpre:
+        adrp x0, dat1
+        str s1, [x1, #8]!
+        ldr x2, [x0, :lo12:dat1]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 29FFC in unpatched output.
+        .section .text.05, "ax", %progbits
+        .balign 4096
+        .globl t3_ffc_str
+        .type t3_ffc_str, %function
+        .space 4096 - 4
+t3_ffc_str:
+        adrp x28, dat2
+        str x2, [x2, #0]
+        str x28, [x28, :lo12:dat2]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 2BFFC in unpatched output.
+        .section .text.06, "ax", %progbits
+        .balign 4096
+        .globl t3_ffc_strsimd
+        .type t3_ffc_strsimd, %function
+        .space 4096 - 4
+t3_ffc_strsimd:
+        adrp x28, dat3
+        str w4, [x2, #0]
+        str x4, [x28, :lo12:dat3]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 2DFF8 in unpatched output.
+        .section .text.07, "ax", %progbits
+        .balign 4096
+        .globl t3_ff8_ldrunpriv
+        .type t3_ff8_ldrunpriv, %function
+        .space 4096 - 8
+t3_ff8_ldrunpriv:
+        adrp x29, dat1
+        ldtrb w1, [x2, #0]
+        ldr x29, [x29, :got_lo12:dat1]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 2FFFC in unpatched output.
+        .section .text.08, "ax", %progbits
+        .balign 4096
+        .globl t3_ffc_ldur
+        .type t3_ffc_ldur, %function
+        .space 4096 - 4
+t3_ffc_ldur:
+        adrp x29, dat2
+        ldur w2, [x2, #4]
+        ldr x29, [x29, :got_lo12:dat2]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 31FFC in unpatched output.
+        .section .text.09, "ax", %progbits
+        .balign 4096
+        .globl t3_ffc_sturh
+        .type t3_ffc_sturh, %function
+        .space 4096 - 4
+t3_ffc_sturh:
+        adrp x18, dat3
+        sturh w3, [x2, #4]
+        ldr x1, [x18, :got_lo12:dat3]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 33FF8 in unpatched output.
+        .section .text.10, "ax", %progbits
+        .balign 4096
+        .globl t3_ff8_literal
+        .type t3_ff8_literal, %function
+        .space 4096 - 8
+t3_ff8_literal:
+        adrp x18, dat1
+        ldr x3, t3_ff8_literal
+        ldr x18, [x18, :lo12:dat1]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 35FFC in unpatched output.
+        .section .text.11, "ax", %progbits
+        .balign 4096
+        .globl t3_ffc_register
+        .type t3_ffc_register, %function
+        .space 4096 - 4
+t3_ffc_register:
+        adrp x15, dat2
+        ldr x3, [x2, x1]
+        ldr x10, [x15, :lo12:dat2]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 37FF8 in unpatched output.
+        .section .text.12, "ax", %progbits
+        .balign 4096
+        .globl t3_ff8_stp
+        .type t3_ff8_stp, %function
+        .space 4096 - 8
+t3_ff8_stp:
+        adrp x16, dat3
+        stp x1,x2, [x3, #0]
+        ldr x13, [x16, :lo12:dat3]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 39FFC in unpatched output.
+        .section .text.13, "ax", %progbits
+        .balign 4096
+        .globl t3_ffc_stnp
+        .type t3_ffc_stnp, %function
+        .space 4096 - 4
+t3_ffc_stnp:
+        adrp x7, dat1
+        stnp x1,x2, [x3, #0]
+        ldr x9, [x7, :lo12:dat1]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 3BFFC in unpatched output.
+        .section .text.14, "ax", %progbits
+        .balign 4096
+        .globl t3_ffc_st1singlepost
+        .type t3_ffc_st1singlepost, %function
+        .space 4096 - 4
+t3_ffc_st1singlepost:
+        adrp x23, dat2
+        st1 { v0.16b }, [x1], x2
+        ldr x22, [x23, :lo12:dat2]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 3DFF8 in unpatched output.
+        .section .text.15, "ax", %progbits
+        .balign 4096
+        .globl t3_ff8_st1multiple
+        .type t3_ff8_st1muliple, %function
+        .space 4096 - 8
+t3_ff8_st1multiple:
+        adrp x23, dat3
+        st1 { v0.16b, v1.16b }, [x1]
+        ldr x24, [x23, :lo12:dat3]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 3FFF8 in unpatched output.
+        .section .text.16, "ax", %progbits
+        .balign 4096
+        .globl t4_ff8_ldr
+        .type t4_ff8_ldr, %function
+        .space 4096 - 8
+t4_ff8_ldr:
+        adrp x0, dat1
+        ldr x1, [x1, #0]
+        add x2, x2, x0
+        ldr x2, [x0, :got_lo12:dat1]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 41FFC in unpatched output.
+        .section .text.17, "ax", %progbits
+        .balign 4096
+        .globl t4_ffc_str
+        .type t4_ffc_str, %function
+        .space 4096 - 4
+t4_ffc_str:
+        adrp x28, dat2
+        str x2, [x2, #0]
+        sub x0, x1, x2
+        str x27, [x28, :got_lo12:dat2]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 43FF8 in unpatched output.
+        .section .text.18, "ax", %progbits
+        .balign 4096
+        .globl t4_ff8_stp
+        .type t4_ff8_stp, %function
+        .space 4096 - 8
+t4_ff8_stp:
+        adrp x16, dat3
+        stp x1,x2, [x3, #0]
+        mul x3, x16, x16
+        ldr x14, [x16, :got_lo12:dat3]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 45FF8 in unpatched output.
+        .section .text.19, "ax", %progbits
+        .balign 4096
+        .globl t4_ff8_stppre
+        .type t4_ff8_stppre, %function
+        .space 4096 - 8
+t4_ff8_stppre:
+        adrp x16, dat1
+        stp x1,x2, [x3, #16]!
+        mul x3, x16, x16
+        ldr x14, [x16, #8]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 47FF8 in unpatched output.
+        .section .text.20, "ax", %progbits
+        .balign 4096
+        .globl t4_ff8_stppost
+        .type t4_ff8_stppost, %function
+        .space 4096 - 8
+t4_ff8_stppost:
+        adrp x16, dat2
+        stp x1,x2, [x3], #16
+        mul x3, x16, x16
+        ldr x14, [x16, #8]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 49FFC in unpatched output.
+        .section .text.21, "ax", %progbits
+        .balign 4096
+        .globl t4_ffc_stpsimd
+        .type t4_ffc_stpsimd, %function
+        .space 4096 - 4
+t4_ffc_stpsimd:
+        adrp x16, dat3
+        stp q1,q2, [x3, #0]
+        mul x3, x16, x16
+        ldr x14, [x16, #8]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 4BFFC in unpatched output.
+        .section .text.22, "ax", %progbits
+        .balign 4096
+        .globl t4_ffc_stnp
+        .type t4_ffc_stnp, %function
+        .space 4096 - 4
+t4_ffc_stnp:
+        adrp x7, dat1
+        stnp x1,x2, [x3, #0]
+        nop
+        ldr x10, [x7, :got_lo12:dat1]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 4DFFC in unpatched output.
+        .section .text.23, "ax", %progbits
+        .balign 4096
+        .globl t4_ffc_st1
+        .type t4_ffc_st1, %function
+        .space 4096 - 4
+t4_ffc_st1:
+        adrp x24, dat2
+        st1 { v0.16b }, [x1]
+        ldr x22, [x23, :got_lo12:dat2]
+        str x24, [x24, #32760]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 4FFF8 in unpatched output.
+        .section .text.24, "ax", %progbits
+        .balign 4096
+        .globl t3_ff8_ldr_once
+        .type t3_ff8_ldr_once, %function
+        .space 4096 - 8
+t3_ff8_ldr_once:
+        adrp x0, dat3
+        st1 { v0.16b }, [x1], x2
+        ldr x1, [x0, #16]
+        ldr x2, [x0, #16]
+        ret
+
+        .text
+        .globl _start
+        .type _start, %function
+_start:
+        ret
+
+        .data
+        .globl dat
+        .globl dat2
+        .globl dat3
+dat1:   .quad 1
+dat2:   .quad 2
+dat3:   .quad 3

lld/trunk/test/ELF/aarch64-cortex-a53-843419-thunk.s

+// REQUIRES: aarch64
+// RUN: llvm-mc -filetype=obj -triple=aarch64-none-linux %s -o %t.o
+// RUN: echo "SECTIONS { \
+// RUN:          .text1 0x10000 : { *(.text.01) *(.text.02) *(.text.03) } \
+// RUN:          .text2 0x100000000 : { *(.text.04) } } " > %t.script
+// RUN: ld.lld --script %t.script -fix-cortex-a53-843419 -verbose %t.o -o %t2 | FileCheck -check-prefix=CHECK-PRINT %s
+
+// Test cases for Cortex-A53 Erratum 843419 that involve interactions with
+// range extension thunks. Both erratum fixes and range extension thunks need
+// precise address information and after creation alter address information.
+
+
+        .section .text.01, "ax", %progbits
+        .balign 4096
+        .globl _start
+        .type _start, %function
+_start:
+        bl far_away
+        // Thunk to far_away, size 16-bytes goes here.
+
+        .section .text.02, "ax", %progbits
+        .space 4096 - 28
+
+        // Erratum sequence will only line up at address 0 modulo 0xffc when
+        // Thunk is inserted.
+        .section .text.03, "ax", %progbits
+        .globl t3_ff8_ldr
+        .type t3_ff8_ldr, %function
+t3_ff8_ldr:
+        adrp x0, dat
+        ldr x1, [x1, #0]
+        ldr x0, [x0, :got_lo12:dat]
+        ret
+
+// CHECK-PRINT: detected cortex-a53-843419 erratum sequence starting at 10FFC in unpatched output.
+        .section .text.04, "ax", %progbits
+        .globl far_away
+        .type far_away, function
+far_away:
+        ret
+
+        .section .data
+        .globl dat
+dat:    .quad 0