IAS "expected assembly-time absolute expression" vs jmp relaxations

[andyhhp]

Full example: https://godbolt.org/z/hEG9nx39b

A number of recent CVE mitigations need an instruction in the middle of a function aligned on a boundary. The following is a simplified form of the construct used to keep this working more nicely than hardcoding everything:

.align 64
.skip 64 - (aligned_boundary - some_func), 0xcc

some_func:
    nop

    je 1f
    //.byte 0x74, 1f - (. + 1)
    //je.d8 1f
    
    nop
aligned_boundary:
    nop
1:
    ret

GAS assembles this just fine, but Clang IAS fails with

<source>:2:7: error: expected assembly-time absolute expression
.skip 64 - (aligned_boundary - some_func), 0xcc
      ^

It turns out this is caused by the je 1f in the middle. Swapping it for an opencoded form using .byte makes Clang happy again.

Presumably this is because Clang tries to evaluate the .skip expression before it knows whether je is going to be the disp8 or disp32 form. However, even when using je.d8 to force the disp8 form, it still fails.

I understand that if the offset is genuinely variable, the result can't be assembled, but these examples do not have variable size.

[llvmbot]

@llvm/issue-subscribers-backend-x86

Full example: https://godbolt.org/z/hEG9nx39b

A number of recent CVE mitigations need an instruction in the middle of a function aligned on a boundary. The following is a simplified form of the construct used to keep this working more nicely than hardcoding everything:

.align 64
.skip 64 - (aligned_boundary - some_func), 0xcc

some_func:
    nop

    je 1f
    //.byte 0x74, 1f - (. + 1)
    //je.d8 1f
    
    nop
aligned_boundary:
    nop
1:
    ret

GAS assembles this just fine, but Clang IAS fails with

<source>:2:7: error: expected assembly-time absolute expression
.skip 64 - (aligned_boundary - some_func), 0xcc
      ^

It turns out this is caused by the je 1f in the middle. Swapping it for an opencoded form using .byte makes Clang happy again.

Presumably this is because Clang tries to evaluate the .skip expression before it knows whether je is going to be the disp8 or disp32 form. However, even when using je.d8 to force the disp8 form, it still fails.

I understand that if the offset is genuinely variable, the result can't be assembled, but these examples do not have variable size.