Compiler/ARM-CGT: More detail on CODEGEN-7356: MOVT symbol+offset are wrong

The circumstances which lead to the wrong behavior are rather narrow.  They are ...

• Have a MOVT instruction with symbol+CONSTANT, and CONSTANT is non-zero
• Build with a non-TI (typically GNU) assembler
• Link with the TI linker

The MOVT instruction can appear in code generated by a compiler, or hand-coded assembly.

Thanks and regards,

-George

I'll try to shed a little light if I can. As George said, we're still trying to determine what to do about this issue.

To try to answer the questions directly:

> Is there any more information available for this issue?

Not other than the JIRA entry you cited, which is the best way to track it.

> The JIRA entry refers specifically to ARM_20.2.0.LTS.  Is this vulnerability also present in ARM_18.1.4.LTS and ARM_18.1.8.LTS?

Yes.

The JIRA and E2E post refer to this issue in the context of the linker and combinations of GCC and TI's ARM-CGT toolchains.  Is this the limit of the scope of the problem? 

In theory the same issue could arise from using the TI linker to link code from any other object producer (IAR, Keil, clang). We have not directly confirmed this, but since the linker is mishandling the relocation then it's almost certainly true.

> If we exclusively use TI's ARM-CGT toolchain are we invulnerable to this problem?

Yes, because the TI assembler does not use the REL-form relocation that is misinterpreted by the linker. To provide a bit more detail, the issue is when a hi-part relocation like  R_ARM_THM_MOVT_ABS has a non-zero addend, which is the constant-offset part of the symbolic expression. ELF provides two ways to encode addends. The first way is directly in the instruction. This is called a REL-type relocation. The second way is in a separate field of the relocation entry itself. This is called a RELA-type reloctation. The bug only occurs in the first case, because the linker mis-interprets the encoded addend. But the TI assembler does not generate REL-type relocations for hi-part relocations; it always uses the RELA form.

> If this bug is fixed, will the new version of the ARM-CGT toolchain become incompatible with the current versions of the ARM-CGT toolchain?

We think we can fix it without breaking compatibility. It helps that the TI assembler does not generate the broken relocation, so we should be able to fix the broken case in the linker without affecting any TI-generated object. But we're still working to thoroughly analyze all the possible ramifications.

I hope this helps.

-Alan