1//===- Relocations.cpp ----------------------------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file implements the core relocation processing logic. It analyzes
10// relocations and determines what auxiliary data structures (GOT, PLT, copy
11// relocations) need to be created during linking.
12//
13// The main entry point is scanRelocations<ELFT>(), which calls scanSection()
14// to process all relocations within an input section. For each relocation,
15// scan() analyzes the type and target, and determines whether a synthetic
16// section entry or dynamic relocation is needed.
17//
18// Note: This file analyzes what needs to be done but doesn't apply the
19// actual relocations - that happens later in InputSection::writeTo().
20// Instead, it populates Relocation objects in InputSectionBase::relocations
21// and creates necessary synthetic sections (GOT, PLT, etc.).
22//
23// In addition, this file implements the core Thunk creation logic, called
24// during finalizeAddressDependentContent().
25//
26//===----------------------------------------------------------------------===//
27
28#include "Relocations.h"
29#include "Config.h"
30#include "InputFiles.h"
31#include "LinkerScript.h"
32#include "OutputSections.h"
33#include "RelocScan.h"
34#include "SymbolTable.h"
35#include "Symbols.h"
36#include "SyntheticSections.h"
37#include "Target.h"
38#include "Thunks.h"
39#include "lld/Common/ErrorHandler.h"
40#include "lld/Common/Memory.h"
41#include "llvm/ADT/SmallSet.h"
42#include "llvm/BinaryFormat/ELF.h"
43#include "llvm/Demangle/Demangle.h"
44#include "llvm/Support/Parallel.h"
45#include <algorithm>
46#include <atomic>
47
48using namespace llvm;
49using namespace llvm::ELF;
50using namespace llvm::object;
51using namespace llvm::support::endian;
52using namespace lld;
53using namespace lld::elf;
54
55static void printDefinedLocation(ELFSyncStream &s, const Symbol &sym) {
56 s << "\n>>> defined in " << sym.file;
57}
58
59// Construct a message in the following format.
60//
61// >>> defined in /home/alice/src/foo.o
62// >>> referenced by bar.c:12 (/home/alice/src/bar.c:12)
63// >>> /home/alice/src/bar.o:(.text+0x1)
64void elf::printLocation(ELFSyncStream &s, InputSectionBase &sec,
65 const Symbol &sym, uint64_t off) {
66 printDefinedLocation(s, sym);
67 s << "\n>>> referenced by ";
68 auto tell = s.tell();
69 s << sec.getSrcMsg(sym, offset: off);
70 if (tell != s.tell())
71 s << "\n>>> ";
72 s << sec.getObjMsg(offset: off);
73}
74
75void elf::reportRangeError(Ctx &ctx, uint8_t *loc, const Relocation &rel,
76 const Twine &v, int64_t min, uint64_t max) {
77 ErrorPlace errPlace = getErrorPlace(ctx, loc);
78 auto diag = Err(ctx);
79 diag << errPlace.loc << "relocation " << rel.type
80 << " out of range: " << v.str() << " is not in [" << min << ", " << max
81 << ']';
82
83 if (rel.sym) {
84 if (!rel.sym->isSection())
85 diag << "; references '" << rel.sym << '\'';
86 else if (auto *d = dyn_cast<Defined>(Val: rel.sym))
87 diag << "; references section '" << d->section->name << "'";
88
89 if (ctx.arg.emachine == EM_X86_64 && rel.type == R_X86_64_PC32 &&
90 rel.sym->getOutputSection() &&
91 (rel.sym->getOutputSection()->flags & SHF_X86_64_LARGE)) {
92 diag << "; R_X86_64_PC32 should not reference a section marked "
93 "SHF_X86_64_LARGE";
94 }
95 }
96 if (!errPlace.srcLoc.empty())
97 diag << "\n>>> referenced by " << errPlace.srcLoc;
98 if (rel.sym && !rel.sym->isSection())
99 printDefinedLocation(s&: diag, sym: *rel.sym);
100
101 if (errPlace.isec && errPlace.isec->name.starts_with(Prefix: ".debug"))
102 diag << "; consider recompiling with -fdebug-types-section to reduce size "
103 "of debug sections";
104}
105
106void elf::reportRangeError(Ctx &ctx, uint8_t *loc, int64_t v, int n,
107 const Symbol &sym, const Twine &msg) {
108 auto diag = Err(ctx);
109 diag << getErrorPlace(ctx, loc).loc << msg << " is out of range: " << v
110 << " is not in [" << llvm::minIntN(N: n) << ", " << llvm::maxIntN(N: n) << "]";
111 if (!sym.getName().empty()) {
112 diag << "; references '" << &sym << '\'';
113 printDefinedLocation(s&: diag, sym);
114 }
115}
116
117// True if non-preemptable symbol always has the same value regardless of where
118// the DSO is loaded.
119bool elf::isAbsolute(const Symbol &sym) {
120 if (sym.isUndefined())
121 return true;
122 if (const auto *dr = dyn_cast<Defined>(Val: &sym))
123 return dr->section == nullptr; // Absolute symbol.
124 return false;
125}
126
127static bool isAbsoluteOrTls(const Symbol &sym) {
128 return isAbsolute(sym) || sym.isTls();
129}
130
131// Returns true if Expr refers a PLT entry.
132static bool needsPlt(RelExpr expr) {
133 return oneof<R_PLT, R_PLT_PC, R_PLT_GOTREL, R_PLT_GOTPLT, R_GOTPLT_GOTREL,
134 R_GOTPLT_PC, RE_LOONGARCH_PLT_PAGE_PC, RE_PPC32_PLTREL,
135 RE_PPC64_CALL_PLT>(expr);
136}
137
138bool lld::elf::needsGot(RelExpr expr) {
139 return oneof<R_GOT, R_GOT_OFF, RE_MIPS_GOT_LOCAL_PAGE, RE_MIPS_GOT_OFF,
140 RE_MIPS_GOT_OFF32, RE_AARCH64_GOT_PAGE_PC, R_GOT_PC, R_GOTPLT,
141 RE_AARCH64_GOT_PAGE, RE_LOONGARCH_GOT, RE_LOONGARCH_GOT_PAGE_PC>(
142 expr);
143}
144
145// True if this expression is of the form Sym - X, where X is a position in the
146// file (PC, or GOT for example).
147static bool isRelExpr(RelExpr expr) {
148 return oneof<R_PC, R_GOTREL, R_GOTPLTREL, RE_ARM_PCA, RE_MIPS_GOTREL,
149 RE_PPC64_CALL, RE_AARCH64_PAGE_PC, R_RELAX_GOT_PC,
150 RE_RISCV_PC_INDIRECT, RE_LOONGARCH_PAGE_PC,
151 RE_LOONGARCH_PC_INDIRECT>(expr);
152}
153
154static RelExpr toPlt(RelExpr expr) {
155 switch (expr) {
156 case RE_LOONGARCH_PAGE_PC:
157 return RE_LOONGARCH_PLT_PAGE_PC;
158 case RE_PPC64_CALL:
159 return RE_PPC64_CALL_PLT;
160 case R_PC:
161 return R_PLT_PC;
162 case R_ABS:
163 return R_PLT;
164 case R_GOTREL:
165 return R_PLT_GOTREL;
166 default:
167 return expr;
168 }
169}
170
171static RelExpr fromPlt(RelExpr expr) {
172 // We decided not to use a plt. Optimize a reference to the plt to a
173 // reference to the symbol itself.
174 switch (expr) {
175 case R_PLT_PC:
176 case RE_PPC32_PLTREL:
177 return R_PC;
178 case RE_LOONGARCH_PLT_PAGE_PC:
179 return RE_LOONGARCH_PAGE_PC;
180 case RE_PPC64_CALL_PLT:
181 return RE_PPC64_CALL;
182 case R_PLT:
183 return R_ABS;
184 case R_PLT_GOTPLT:
185 return R_GOTPLTREL;
186 case R_PLT_GOTREL:
187 return R_GOTREL;
188 default:
189 return expr;
190 }
191}
192
193// Returns true if a given shared symbol is in a read-only segment in a DSO.
194template <class ELFT> static bool isReadOnly(SharedSymbol &ss) {
195 using Elf_Phdr = typename ELFT::Phdr;
196
197 // Determine if the symbol is read-only by scanning the DSO's program headers.
198 const auto &file = cast<SharedFile>(Val&: *ss.file);
199 for (const Elf_Phdr &phdr :
200 check(file.template getObj<ELFT>().program_headers()))
201 if ((phdr.p_type == ELF::PT_LOAD || phdr.p_type == ELF::PT_GNU_RELRO) &&
202 !(phdr.p_flags & ELF::PF_W) && ss.value >= phdr.p_vaddr &&
203 ss.value < phdr.p_vaddr + phdr.p_memsz)
204 return true;
205 return false;
206}
207
208// Returns symbols at the same offset as a given symbol, including SS itself.
209//
210// If two or more symbols are at the same offset, and at least one of
211// them are copied by a copy relocation, all of them need to be copied.
212// Otherwise, they would refer to different places at runtime.
213template <class ELFT>
214static SmallPtrSet<SharedSymbol *, 4> getSymbolsAt(Ctx &ctx, SharedSymbol &ss) {
215 using Elf_Sym = typename ELFT::Sym;
216
217 const auto &file = cast<SharedFile>(Val&: *ss.file);
218
219 SmallPtrSet<SharedSymbol *, 4> ret;
220 for (const Elf_Sym &s : file.template getGlobalELFSyms<ELFT>()) {
221 if (s.st_shndx == SHN_UNDEF || s.st_shndx == SHN_ABS ||
222 s.getType() == STT_TLS || s.st_value != ss.value)
223 continue;
224 StringRef name = check(s.getName(file.getStringTable()));
225 Symbol *sym = ctx.symtab->find(name);
226 if (auto *alias = dyn_cast_or_null<SharedSymbol>(Val: sym))
227 ret.insert(Ptr: alias);
228 }
229
230 // The loop does not check SHT_GNU_verneed, so ret does not contain
231 // non-default version symbols. If ss has a non-default version, ret won't
232 // contain ss. Just add ss unconditionally. If a non-default version alias is
233 // separately copy relocated, it and ss will have different addresses.
234 // Fortunately this case is impractical and fails with GNU ld as well.
235 ret.insert(Ptr: &ss);
236 return ret;
237}
238
239// When a symbol is copy relocated or we create a canonical plt entry, it is
240// effectively a defined symbol. In the case of copy relocation the symbol is
241// in .bss and in the case of a canonical plt entry it is in .plt. This function
242// replaces the existing symbol with a Defined pointing to the appropriate
243// location.
244static void replaceWithDefined(Ctx &ctx, Symbol &sym, SectionBase &sec,
245 uint64_t value, uint64_t size) {
246 uint16_t versionId = sym.versionId;
247 Defined(ctx, sym.file, StringRef(), sym.binding, sym.stOther, sym.type, value,
248 size, &sec)
249 .overwrite(sym);
250
251 sym.versionId = versionId;
252 sym.isUsedInRegularObj = true;
253 // A copy relocated alias may need a GOT entry.
254 sym.flags.fetch_and(i: NEEDS_GOT | NEEDS_GOT_AUTH, m: std::memory_order_relaxed);
255}
256
257// Reserve space in .bss or .bss.rel.ro for copy relocation.
258//
259// The copy relocation is pretty much a hack. If you use a copy relocation
260// in your program, not only the symbol name but the symbol's size, RW/RO
261// bit and alignment become part of the ABI. In addition to that, if the
262// symbol has aliases, the aliases become part of the ABI. That's subtle,
263// but if you violate that implicit ABI, that can cause very counter-
264// intuitive consequences.
265//
266// So, what is the copy relocation? It's for linking non-position
267// independent code to DSOs. In an ideal world, all references to data
268// exported by DSOs should go indirectly through GOT. But if object files
269// are compiled as non-PIC, all data references are direct. There is no
270// way for the linker to transform the code to use GOT, as machine
271// instructions are already set in stone in object files. This is where
272// the copy relocation takes a role.
273//
274// A copy relocation instructs the dynamic linker to copy data from a DSO
275// to a specified address (which is usually in .bss) at load-time. If the
276// static linker (that's us) finds a direct data reference to a DSO
277// symbol, it creates a copy relocation, so that the symbol can be
278// resolved as if it were in .bss rather than in a DSO.
279//
280// As you can see in this function, we create a copy relocation for the
281// dynamic linker, and the relocation contains not only symbol name but
282// various other information about the symbol. So, such attributes become a
283// part of the ABI.
284//
285// Note for application developers: I can give you a piece of advice if
286// you are writing a shared library. You probably should export only
287// functions from your library. You shouldn't export variables.
288//
289// As an example what can happen when you export variables without knowing
290// the semantics of copy relocations, assume that you have an exported
291// variable of type T. It is an ABI-breaking change to add new members at
292// end of T even though doing that doesn't change the layout of the
293// existing members. That's because the space for the new members are not
294// reserved in .bss unless you recompile the main program. That means they
295// are likely to overlap with other data that happens to be laid out next
296// to the variable in .bss. This kind of issue is sometimes very hard to
297// debug. What's a solution? Instead of exporting a variable V from a DSO,
298// define an accessor getV().
299template <class ELFT> static void addCopyRelSymbol(Ctx &ctx, SharedSymbol &ss) {
300 // Copy relocation against zero-sized symbol doesn't make sense.
301 uint64_t symSize = ss.getSize();
302 if (symSize == 0 || ss.alignment == 0)
303 Err(ctx) << "cannot create a copy relocation for symbol " << &ss;
304
305 // See if this symbol is in a read-only segment. If so, preserve the symbol's
306 // memory protection by reserving space in the .bss.rel.ro section.
307 bool isRO = isReadOnly<ELFT>(ss);
308 BssSection *sec = make<BssSection>(args&: ctx, args: isRO ? ".bss.rel.ro" : ".bss",
309 args&: symSize, args&: ss.alignment);
310 OutputSection *osec = (isRO ? ctx.in.bssRelRo : ctx.in.bss)->getParent();
311
312 // At this point, sectionBases has been migrated to sections. Append sec to
313 // sections.
314 if (osec->commands.empty() ||
315 !isa<InputSectionDescription>(Val: osec->commands.back()))
316 osec->commands.push_back(Elt: make<InputSectionDescription>(args: ""));
317 auto *isd = cast<InputSectionDescription>(Val: osec->commands.back());
318 isd->sections.push_back(Elt: sec);
319 osec->commitSection(isec: sec);
320
321 // Look through the DSO's dynamic symbol table for aliases and create a
322 // dynamic symbol for each one. This causes the copy relocation to correctly
323 // interpose any aliases.
324 for (SharedSymbol *sym : getSymbolsAt<ELFT>(ctx, ss))
325 replaceWithDefined(ctx, sym&: *sym, sec&: *sec, value: 0, size: sym->size);
326
327 ctx.in.relaDyn->addSymbolReloc(dynType: ctx.target->copyRel, isec&: *sec, offsetInSec: 0, sym&: ss);
328}
329
330// .eh_frame sections are mergeable input sections, so their input
331// offsets are not linearly mapped to output section. For each input
332// offset, we need to find a section piece containing the offset and
333// add the piece's base address to the input offset to compute the
334// output offset. That isn't cheap.
335//
336// This class is to speed up the offset computation. When we process
337// relocations, we access offsets in the monotonically increasing
338// order. So we can optimize for that access pattern.
339//
340// For sections other than .eh_frame, this class doesn't do anything.
341namespace {
342class OffsetGetter {
343public:
344 OffsetGetter() = default;
345 explicit OffsetGetter(EhInputSection &sec) {
346 cies = sec.cies;
347 fdes = sec.fdes;
348 i = cies.begin();
349 j = fdes.begin();
350 }
351
352 // Translates offsets in input sections to offsets in output sections.
353 // Given offset must increase monotonically. We assume that Piece is
354 // sorted by inputOff.
355 uint64_t get(Ctx &ctx, uint64_t off) {
356 while (j != fdes.end() && j->inputOff <= off)
357 ++j;
358 auto it = j;
359 if (j == fdes.begin() || j[-1].inputOff + j[-1].size <= off) {
360 while (i != cies.end() && i->inputOff <= off)
361 ++i;
362 if (i == cies.begin() || i[-1].inputOff + i[-1].size <= off) {
363 Err(ctx) << ".eh_frame: relocation is not in any piece";
364 return 0;
365 }
366 it = i;
367 }
368
369 // Offset -1 means that the piece is dead (i.e. garbage collected).
370 if (it[-1].outputOff == -1)
371 return -1;
372 return it[-1].outputOff + (off - it[-1].inputOff);
373 }
374
375private:
376 ArrayRef<EhSectionPiece> cies, fdes;
377 ArrayRef<EhSectionPiece>::iterator i, j;
378};
379} // namespace
380
381// Custom error message if Sym is defined in a discarded section.
382template <class ELFT>
383static void maybeReportDiscarded(Ctx &ctx, ELFSyncStream &msg, Undefined &sym) {
384 auto *file = dyn_cast<ObjFile<ELFT>>(sym.file);
385 if (!file || !sym.discardedSecIdx)
386 return;
387 ArrayRef<typename ELFT::Shdr> objSections =
388 file->template getELFShdrs<ELFT>();
389
390 if (sym.type == ELF::STT_SECTION) {
391 msg << "relocation refers to a discarded section: ";
392 msg << CHECK2(
393 file->getObj().getSectionName(objSections[sym.discardedSecIdx]), file);
394 } else {
395 msg << "relocation refers to a symbol in a discarded section: " << &sym;
396 }
397 msg << "\n>>> defined in " << file;
398
399 Elf_Shdr_Impl<ELFT> elfSec = objSections[sym.discardedSecIdx - 1];
400 if (elfSec.sh_type != SHT_GROUP)
401 return;
402
403 // If the discarded section is a COMDAT.
404 StringRef signature = file->getShtGroupSignature(objSections, elfSec);
405 if (const InputFile *prevailing =
406 ctx.symtab->comdatGroups.lookup(Val: CachedHashStringRef(signature))) {
407 msg << "\n>>> section group signature: " << signature
408 << "\n>>> prevailing definition is in " << prevailing;
409 if (sym.nonPrevailing) {
410 msg << "\n>>> or the symbol in the prevailing group had STB_WEAK "
411 "binding and the symbol in a non-prevailing group had STB_GLOBAL "
412 "binding. Mixing groups with STB_WEAK and STB_GLOBAL binding "
413 "signature is not supported";
414 }
415 }
416}
417
418// Check whether the definition name def is a mangled function name that matches
419// the reference name ref.
420static bool canSuggestExternCForCXX(StringRef ref, StringRef def) {
421 llvm::ItaniumPartialDemangler d;
422 std::string name = def.str();
423 if (d.partialDemangle(MangledName: name.c_str()))
424 return false;
425 char *buf = d.getFunctionName(Buf: nullptr, N: nullptr);
426 if (!buf)
427 return false;
428 bool ret = ref == buf;
429 free(ptr: buf);
430 return ret;
431}
432
433// Suggest an alternative spelling of an "undefined symbol" diagnostic. Returns
434// the suggested symbol, which is either in the symbol table, or in the same
435// file of sym.
436static const Symbol *getAlternativeSpelling(Ctx &ctx, const Undefined &sym,
437 std::string &pre_hint,
438 std::string &post_hint) {
439 DenseMap<StringRef, const Symbol *> map;
440 if (sym.file->kind() == InputFile::ObjKind) {
441 auto *file = cast<ELFFileBase>(Val: sym.file);
442 // If sym is a symbol defined in a discarded section, maybeReportDiscarded()
443 // will give an error. Don't suggest an alternative spelling.
444 if (sym.discardedSecIdx != 0 &&
445 file->getSections()[sym.discardedSecIdx] == &InputSection::discarded)
446 return nullptr;
447
448 // Build a map of local defined symbols.
449 for (const Symbol *s : sym.file->getSymbols())
450 if (s->isLocal() && s->isDefined() && !s->getName().empty())
451 map.try_emplace(Key: s->getName(), Args&: s);
452 }
453
454 auto suggest = [&](StringRef newName) -> const Symbol * {
455 // If defined locally.
456 if (const Symbol *s = map.lookup(Val: newName))
457 return s;
458
459 // If in the symbol table and not undefined.
460 if (const Symbol *s = ctx.symtab->find(name: newName))
461 if (!s->isUndefined())
462 return s;
463
464 return nullptr;
465 };
466
467 // This loop enumerates all strings of Levenshtein distance 1 as typo
468 // correction candidates and suggests the one that exists as a non-undefined
469 // symbol.
470 StringRef name = sym.getName();
471 for (size_t i = 0, e = name.size(); i != e + 1; ++i) {
472 // Insert a character before name[i].
473 std::string newName = (name.substr(Start: 0, N: i) + "0" + name.substr(Start: i)).str();
474 for (char c = '0'; c <= 'z'; ++c) {
475 newName[i] = c;
476 if (const Symbol *s = suggest(newName))
477 return s;
478 }
479 if (i == e)
480 break;
481
482 // Substitute name[i].
483 newName = std::string(name);
484 for (char c = '0'; c <= 'z'; ++c) {
485 newName[i] = c;
486 if (const Symbol *s = suggest(newName))
487 return s;
488 }
489
490 // Transpose name[i] and name[i+1]. This is of edit distance 2 but it is
491 // common.
492 if (i + 1 < e) {
493 newName[i] = name[i + 1];
494 newName[i + 1] = name[i];
495 if (const Symbol *s = suggest(newName))
496 return s;
497 }
498
499 // Delete name[i].
500 newName = (name.substr(Start: 0, N: i) + name.substr(Start: i + 1)).str();
501 if (const Symbol *s = suggest(newName))
502 return s;
503 }
504
505 // Case mismatch, e.g. Foo vs FOO.
506 for (auto &it : map)
507 if (name.equals_insensitive(RHS: it.first))
508 return it.second;
509 for (Symbol *sym : ctx.symtab->getSymbols())
510 if (!sym->isUndefined() && name.equals_insensitive(RHS: sym->getName()))
511 return sym;
512
513 // The reference may be a mangled name while the definition is not. Suggest a
514 // missing extern "C".
515 if (name.starts_with(Prefix: "_Z")) {
516 std::string buf = name.str();
517 llvm::ItaniumPartialDemangler d;
518 if (!d.partialDemangle(MangledName: buf.c_str()))
519 if (char *buf = d.getFunctionName(Buf: nullptr, N: nullptr)) {
520 const Symbol *s = suggest(buf);
521 free(ptr: buf);
522 if (s) {
523 pre_hint = ": extern \"C\" ";
524 return s;
525 }
526 }
527 } else {
528 const Symbol *s = nullptr;
529 for (auto &it : map)
530 if (canSuggestExternCForCXX(ref: name, def: it.first)) {
531 s = it.second;
532 break;
533 }
534 if (!s)
535 for (Symbol *sym : ctx.symtab->getSymbols())
536 if (canSuggestExternCForCXX(ref: name, def: sym->getName())) {
537 s = sym;
538 break;
539 }
540 if (s) {
541 pre_hint = " to declare ";
542 post_hint = " as extern \"C\"?";
543 return s;
544 }
545 }
546
547 return nullptr;
548}
549
550static void reportUndefinedSymbol(Ctx &ctx, const UndefinedDiag &undef,
551 bool correctSpelling) {
552 Undefined &sym = *undef.sym;
553 ELFSyncStream msg(ctx, DiagLevel::None);
554
555 auto visibility = [&]() {
556 switch (sym.visibility()) {
557 case STV_INTERNAL:
558 return "internal ";
559 case STV_HIDDEN:
560 return "hidden ";
561 case STV_PROTECTED:
562 return "protected ";
563 default:
564 return "";
565 }
566 };
567
568 switch (ctx.arg.ekind) {
569 case ELF32LEKind:
570 maybeReportDiscarded<ELF32LE>(ctx, msg, sym);
571 break;
572 case ELF32BEKind:
573 maybeReportDiscarded<ELF32BE>(ctx, msg, sym);
574 break;
575 case ELF64LEKind:
576 maybeReportDiscarded<ELF64LE>(ctx, msg, sym);
577 break;
578 case ELF64BEKind:
579 maybeReportDiscarded<ELF64BE>(ctx, msg, sym);
580 break;
581 default:
582 llvm_unreachable("");
583 }
584 if (msg.str().empty())
585 msg << "undefined " << visibility() << "symbol: " << &sym;
586
587 const size_t maxUndefReferences = 3;
588 for (UndefinedDiag::Loc l :
589 ArrayRef(undef.locs).take_front(N: maxUndefReferences)) {
590 InputSectionBase &sec = *l.sec;
591 uint64_t offset = l.offset;
592
593 msg << "\n>>> referenced by ";
594 // In the absence of line number information, utilize DW_TAG_variable (if
595 // present) for the enclosing symbol (e.g. var in `int *a[] = {&undef};`).
596 Symbol *enclosing = sec.getEnclosingSymbol(offset);
597
598 ELFSyncStream msg1(ctx, DiagLevel::None);
599 auto tell = msg.tell();
600 msg << sec.getSrcMsg(sym: enclosing ? *enclosing : sym, offset);
601 if (tell != msg.tell())
602 msg << "\n>>> ";
603 msg << sec.getObjMsg(offset);
604 }
605
606 if (maxUndefReferences < undef.locs.size())
607 msg << "\n>>> referenced " << (undef.locs.size() - maxUndefReferences)
608 << " more times";
609
610 if (correctSpelling) {
611 std::string pre_hint = ": ", post_hint;
612 if (const Symbol *corrected =
613 getAlternativeSpelling(ctx, sym, pre_hint, post_hint)) {
614 msg << "\n>>> did you mean" << pre_hint << corrected << post_hint
615 << "\n>>> defined in: " << corrected->file;
616 }
617 }
618
619 if (sym.getName().starts_with(Prefix: "_ZTV"))
620 msg << "\n>>> the vtable symbol may be undefined because the class is "
621 "missing its key function "
622 "(see https://lld.llvm.org/missingkeyfunction)";
623 if (ctx.arg.gcSections && ctx.arg.zStartStopGC &&
624 sym.getName().starts_with(Prefix: "__start_")) {
625 msg << "\n>>> the encapsulation symbol needs to be retained under "
626 "--gc-sections properly; consider -z nostart-stop-gc "
627 "(see https://lld.llvm.org/ELF/start-stop-gc)";
628 }
629
630 if (undef.isWarning)
631 Warn(ctx) << msg.str();
632 else
633 ctx.e.error(msg: msg.str(), tag: ErrorTag::SymbolNotFound, args: {sym.getName()});
634}
635
636void elf::reportUndefinedSymbols(Ctx &ctx) {
637 // Find the first "undefined symbol" diagnostic for each diagnostic, and
638 // collect all "referenced from" lines at the first diagnostic.
639 DenseMap<Symbol *, UndefinedDiag *> firstRef;
640 for (UndefinedDiag &undef : ctx.undefErrs) {
641 assert(undef.locs.size() == 1);
642 if (UndefinedDiag *canon = firstRef.lookup(Val: undef.sym)) {
643 canon->locs.push_back(Elt: undef.locs[0]);
644 undef.locs.clear();
645 } else
646 firstRef[undef.sym] = &undef;
647 }
648
649 // Enable spell corrector for the first 2 diagnostics.
650 for (auto [i, undef] : llvm::enumerate(First&: ctx.undefErrs))
651 if (!undef.locs.empty())
652 reportUndefinedSymbol(ctx, undef, correctSpelling: i < 2);
653}
654
655// Report an undefined symbol if necessary.
656// Returns true if the undefined symbol will produce an error message.
657bool elf::maybeReportUndefined(Ctx &ctx, Undefined &sym, InputSectionBase &sec,
658 uint64_t offset) {
659 // If versioned, issue an error (even if the symbol is weak) because we don't
660 // know the defining filename which is required to construct a Verneed entry.
661 if (sym.hasVersionSuffix) {
662 ctx.undefErrs.push_back(Elt: {.sym: &sym, .locs: {{.sec: &sec, .offset: offset}}, .isWarning: false});
663 return true;
664 }
665 if (sym.isWeak())
666 return false;
667
668 bool canBeExternal = !sym.isLocal() && sym.visibility() == STV_DEFAULT;
669 if (ctx.arg.unresolvedSymbols == UnresolvedPolicy::Ignore && canBeExternal)
670 return false;
671
672 // clang (as of 2019-06-12) / gcc (as of 8.2.1) PPC64 may emit a .rela.toc
673 // which references a switch table in a discarded .rodata/.text section. The
674 // .toc and the .rela.toc are incorrectly not placed in the comdat. The ELF
675 // spec says references from outside the group to a STB_LOCAL symbol are not
676 // allowed. Work around the bug.
677 //
678 // PPC32 .got2 is similar but cannot be fixed. Multiple .got2 is infeasible
679 // because .LC0-.LTOC is not representable if the two labels are in different
680 // .got2
681 if (sym.discardedSecIdx != 0 && (sec.name == ".got2" || sec.name == ".toc"))
682 return false;
683
684 bool isWarning =
685 (ctx.arg.unresolvedSymbols == UnresolvedPolicy::Warn && canBeExternal) ||
686 ctx.arg.noinhibitExec;
687 ctx.undefErrs.push_back(Elt: {.sym: &sym, .locs: {{.sec: &sec, .offset: offset}}, .isWarning: isWarning});
688 return !isWarning;
689}
690
691bool RelocScan::maybeReportUndefined(Undefined &sym, uint64_t offset) {
692 std::lock_guard<std::mutex> lock(ctx.relocMutex);
693 return elf::maybeReportUndefined(ctx, sym, sec&: *sec, offset);
694}
695
696bool RelocScan::checkTlsLe(uint64_t offset, Symbol &sym, RelType type) {
697 if (!ctx.arg.shared)
698 return false;
699 auto diag = Err(ctx);
700 diag << "relocation " << type << " against " << &sym
701 << " cannot be used with -shared";
702 printLocation(s&: diag, sec&: *sec, sym, off: offset);
703 return true;
704}
705
706template <bool concurrent = false>
707static void addRelativeReloc(Ctx &ctx, InputSectionBase &isec,
708 uint64_t offsetInSec, Symbol &sym, int64_t addend,
709 RelExpr expr, RelType type, unsigned shard = 0) {
710 bool isAArch64Auth =
711 ctx.arg.emachine == EM_AARCH64 && type == R_AARCH64_AUTH_ABS64;
712
713 // Add a relative relocation. If relrDyn section is enabled, and the
714 // relocation offset is guaranteed to be even, add the relocation to
715 // the relrDyn section, otherwise add it to the relaDyn section.
716 // relrDyn sections don't support odd offsets. Also, relrDyn sections
717 // don't store the addend values, so we must write it to the relocated
718 // address.
719 //
720 // When symbol values are determined in finalizeAddressDependentContent,
721 // some .relr.auth.dyn relocations may be moved to .rela.dyn.
722 //
723 // MTE globals may need to store the original addend as well so cannot use
724 // relrDyn. TODO: It should be unambiguous when not using R_ADDEND_NEG below?
725 RelrBaseSection *relrDyn = ctx.in.relrDyn.get();
726 if (isAArch64Auth)
727 relrDyn = ctx.in.relrAuthDyn.get();
728 if (sym.isTagged())
729 relrDyn = nullptr;
730 if (relrDyn && isec.addralign >= 2 && offsetInSec % 2 == 0) {
731 relrDyn->addRelativeReloc<concurrent>(isec, offsetInSec, sym, addend, type,
732 expr, shard);
733 return;
734 }
735 RelType relativeType = ctx.target->relativeRel;
736 if (isAArch64Auth)
737 relativeType = R_AARCH64_AUTH_RELATIVE;
738 ctx.in.relaDyn->addRelativeReloc<concurrent>(relativeType, isec, offsetInSec,
739 sym, addend, type, expr, shard);
740 // With MTE globals, we always want to derive the address tag by `ldg`-ing
741 // the symbol. When we have a RELATIVE relocation though, we no longer have
742 // a reference to the symbol. Because of this, when we have an addend that
743 // puts the result of the RELATIVE relocation out-of-bounds of the symbol
744 // (e.g. the addend is outside of [0, sym.getSize()]), the AArch64 MemtagABI
745 // says we should store the offset to the start of the symbol in the target
746 // field. This is described in further detail in:
747 // https://github.com/ARM-software/abi-aa/blob/main/memtagabielf64/memtagabielf64.rst#841extended-semantics-of-r_aarch64_relative
748 if (sym.isTagged() &&
749 (addend < 0 || static_cast<uint64_t>(addend) >= sym.getSize()))
750 isec.addReloc(r: {.expr: R_ADDEND_NEG, .type: type, .offset: offsetInSec, .addend: addend, .sym: &sym});
751}
752
753template <class PltSection, class GotPltSection>
754static void addPltEntry(Ctx &ctx, PltSection &plt, GotPltSection &gotPlt,
755 RelocationBaseSection &rel, RelType type, Symbol &sym) {
756 plt.addEntry(sym);
757 bool isPreemptible = sym.isPreemptible;
758 RelExpr expr = isPreemptible ? R_ADDEND : R_ABS;
759 if (!ctx.target->usesGotPlt) {
760 rel.addReloc(
761 {type, &plt, sym.getPltOffset(ctx), isPreemptible, sym, 0, expr});
762 return;
763 }
764 gotPlt.addEntry(sym);
765 rel.addReloc(
766 {type, &gotPlt, sym.getGotPltOffset(ctx), isPreemptible, sym, 0, expr});
767}
768
769void elf::addGotEntry(Ctx &ctx, Symbol &sym) {
770 ctx.in.got->addEntry(sym);
771 uint64_t off = sym.getGotOffset(ctx);
772
773 // If preemptible, emit a GLOB_DAT relocation.
774 if (sym.isPreemptible) {
775 ctx.in.relaDyn->addReloc(
776 reloc: {ctx.target->gotRel, ctx.in.got.get(), off, true, sym, 0, R_ADDEND});
777 return;
778 }
779
780 // Otherwise, the value is either a link-time constant or the load base
781 // plus a constant.
782 if (!ctx.arg.isPic || isAbsolute(sym))
783 ctx.in.got->addConstant(r: {.expr: R_ABS, .type: ctx.target->symbolicRel, .offset: off, .addend: 0, .sym: &sym});
784 else
785 addRelativeReloc(ctx, isec&: *ctx.in.got, offsetInSec: off, sym, addend: 0, expr: R_ABS,
786 type: ctx.target->symbolicRel);
787}
788
789static void addGotAuthEntry(Ctx &ctx, Symbol &sym) {
790 ctx.in.got->addEntry(sym);
791 ctx.in.got->addAuthEntry(sym);
792 uint64_t off = sym.getGotOffset(ctx);
793
794 // If preemptible, emit a GLOB_DAT relocation.
795 if (sym.isPreemptible) {
796 ctx.in.relaDyn->addReloc(reloc: {R_AARCH64_AUTH_GLOB_DAT, ctx.in.got.get(), off,
797 true, sym, 0, R_ADDEND});
798 return;
799 }
800
801 // Signed GOT requires dynamic relocation.
802 ctx.in.relaDyn->addReloc(
803 reloc: {R_AARCH64_AUTH_RELATIVE, ctx.in.got.get(), off, false, sym, 0, R_ABS});
804}
805
806static void addTpOffsetGotEntry(Ctx &ctx, Symbol &sym) {
807 ctx.in.got->addEntry(sym);
808 uint64_t off = sym.getGotOffset(ctx);
809 if (!sym.isPreemptible && !ctx.arg.shared) {
810 ctx.in.got->addConstant(r: {.expr: R_TPREL, .type: ctx.target->symbolicRel, .offset: off, .addend: 0, .sym: &sym});
811 return;
812 }
813 ctx.in.relaDyn->addAddendOnlyRelocIfNonPreemptible(
814 dynType: ctx.target->tlsGotRel, isec&: *ctx.in.got, offsetInSec: off, sym, addendRelType: ctx.target->symbolicRel);
815}
816
817// Return true if we can define a symbol in the executable that
818// contains the value/function of a symbol defined in a shared
819// library.
820static bool canDefineSymbolInExecutable(Ctx &ctx, Symbol &sym) {
821 // If the symbol has default visibility the symbol defined in the
822 // executable will preempt it.
823 // Note that we want the visibility of the shared symbol itself, not
824 // the visibility of the symbol in the output file we are producing.
825 if (!sym.dsoProtected)
826 return true;
827
828 // If we are allowed to break address equality of functions, defining
829 // a plt entry will allow the program to call the function in the
830 // .so, but the .so and the executable will no agree on the address
831 // of the function. Similar logic for objects.
832 return ((sym.isFunc() && ctx.arg.ignoreFunctionAddressEquality) ||
833 (sym.isObject() && ctx.arg.ignoreDataAddressEquality));
834}
835
836// Returns true if a given relocation can be computed at link-time.
837// This only handles relocation types expected in process().
838//
839// For instance, we know the offset from a relocation to its target at
840// link-time if the relocation is PC-relative and refers a
841// non-interposable function in the same executable. This function
842// will return true for such relocation.
843//
844// If this function returns false, that means we need to emit a
845// dynamic relocation so that the relocation will be fixed at load-time.
846bool RelocScan::isStaticLinkTimeConstant(RelExpr e, RelType type,
847 const Symbol &sym,
848 uint64_t relOff) const {
849 // These expressions always compute a constant
850 if (oneof<R_GOTPLT, R_GOT_OFF, R_RELAX_HINT, RE_MIPS_GOT_LOCAL_PAGE,
851 RE_MIPS_GOTREL, RE_MIPS_GOT_OFF, RE_MIPS_GOT_OFF32,
852 RE_MIPS_GOT_GP_PC, RE_AARCH64_GOT_PAGE_PC, R_GOT_PC, R_GOTONLY_PC,
853 R_GOTPLTONLY_PC, R_PLT_PC, R_PLT_GOTREL, R_PLT_GOTPLT,
854 R_GOTPLT_GOTREL, R_GOTPLT_PC, RE_PPC32_PLTREL, RE_PPC64_CALL_PLT,
855 RE_RISCV_ADD, RE_AARCH64_GOT_PAGE, RE_LOONGARCH_PLT_PAGE_PC,
856 RE_LOONGARCH_GOT, RE_LOONGARCH_GOT_PAGE_PC>(expr: e))
857 return true;
858
859 // These never do, except if the entire file is position dependent or if
860 // only the low bits are used.
861 if (e == R_GOT || e == R_PLT)
862 return ctx.target->usesOnlyLowPageBits(type) || !ctx.arg.isPic;
863 // R_AARCH64_AUTH_ABS64 and iRelSymbolicRel require a dynamic relocation.
864 if (e == RE_AARCH64_AUTH || type == ctx.target->iRelSymbolicRel)
865 return false;
866
867 // The behavior of an undefined weak reference is implementation defined.
868 // (We treat undefined non-weak the same as undefined weak.) For static
869 // -no-pie linking, dynamic relocations are generally avoided (except
870 // IRELATIVE). Emitting dynamic relocations for -shared aligns with its -z
871 // undefs default. Dynamic -no-pie linking and -pie allow flexibility.
872 if (sym.isPreemptible)
873 return sym.isUndefined() && !ctx.arg.isPic;
874 if (!ctx.arg.isPic)
875 return true;
876
877 // Constant when referencing a non-preemptible symbol.
878 if (e == R_SIZE || e == RE_RISCV_LEB128)
879 return true;
880
881 // For the target and the relocation, we want to know if they are
882 // absolute or relative.
883 bool absVal = isAbsoluteOrTls(sym) && e != RE_PPC64_TOCBASE;
884 bool relE = isRelExpr(expr: e);
885 if (absVal && !relE)
886 return true;
887 if (!absVal && relE)
888 return true;
889 if (!absVal && !relE)
890 return ctx.target->usesOnlyLowPageBits(type);
891
892 assert(absVal && relE);
893
894 // Allow R_PLT_PC (optimized to R_PC here) to a hidden undefined weak symbol
895 // in PIC mode. This is a little strange, but it allows us to link function
896 // calls to such symbols (e.g. glibc/stdlib/exit.c:__run_exit_handlers).
897 // Normally such a call will be guarded with a comparison, which will load a
898 // zero from the GOT.
899 if (sym.isUndefined())
900 return true;
901
902 // We set the final symbols values for linker script defined symbols later.
903 // They always can be computed as a link time constant.
904 if (sym.scriptDefined)
905 return true;
906
907 auto diag = Err(ctx);
908 diag << "relocation " << type << " cannot refer to absolute symbol: " << &sym;
909 printLocation(s&: diag, sec&: *sec, sym, off: relOff);
910 return true;
911}
912
913// The reason we have to do this early scan is as follows
914// * To mmap the output file, we need to know the size
915// * For that, we need to know how many dynamic relocs we will have.
916// It might be possible to avoid this by outputting the file with write:
917// * Write the allocated output sections, computing addresses.
918// * Apply relocations, recording which ones require a dynamic reloc.
919// * Write the dynamic relocations.
920// * Write the rest of the file.
921// This would have some drawbacks. For example, we would only know if .rela.dyn
922// is needed after applying relocations. If it is, it will go after rw and rx
923// sections. Given that it is ro, we will need an extra PT_LOAD. This
924// complicates things for the dynamic linker and means we would have to reserve
925// space for the extra PT_LOAD even if we end up not using it.
926void RelocScan::process(RelExpr expr, RelType type, uint64_t offset,
927 Symbol &sym, int64_t addend) const {
928 // If non-ifunc non-preemptible, change PLT to direct call and optimize GOT
929 // indirection.
930 const bool isIfunc = sym.isGnuIFunc();
931 if (!sym.isPreemptible && !isIfunc) {
932 if (expr != R_GOT_PC) {
933 expr = fromPlt(expr);
934 } else if (!isAbsoluteOrTls(sym)) {
935 expr = ctx.target->adjustGotPcExpr(type, addend,
936 loc: sec->content().data() + offset);
937 // If the target adjusted the expression to an optimizable form, we may
938 // end up needing the GOT if we can't optimize everything.
939 if (expr == R_RELAX_GOT_PC || expr == R_RELAX_GOT_PC_NOPIC)
940 ctx.in.got->hasGotOffRel.store(i: true, m: std::memory_order_relaxed);
941 }
942 }
943
944 // We were asked not to generate PLT entries for ifuncs. Instead, pass the
945 // direct relocation on through.
946 if (LLVM_UNLIKELY(isIfunc) && ctx.arg.zIfuncNoplt) {
947 std::lock_guard<std::mutex> lock(ctx.relocMutex);
948 sym.isExported = true;
949 ctx.in.relaDyn->addSymbolReloc(dynType: type, isec&: *sec, offsetInSec: offset, sym, addend, addendRelType: type);
950 return;
951 }
952
953 if (needsGot(expr)) {
954 if (ctx.arg.emachine == EM_MIPS) {
955 // MIPS ABI has special rules to process GOT entries and doesn't
956 // require relocation entries for them. A special case is TLS
957 // relocations. In that case dynamic loader applies dynamic
958 // relocations to initialize TLS GOT entries.
959 // See "Global Offset Table" in Chapter 5 in the following document
960 // for detailed description:
961 // ftp://www.linux-mips.org/pub/linux/mips/doc/ABI/mipsabi.pdf
962 ctx.in.mipsGot->addEntry(file&: *sec->file, sym, addend, expr);
963 } else if (!sym.isTls() || ctx.arg.emachine != EM_LOONGARCH) {
964 // Many LoongArch TLS relocs reuse the RE_LOONGARCH_GOT type, in which
965 // case the NEEDS_GOT flag shouldn't get set.
966 sym.setFlags(NEEDS_GOT);
967 }
968 } else if (needsPlt(expr)) {
969 sym.setFlags(NEEDS_PLT);
970 } else if (LLVM_UNLIKELY(isIfunc)) {
971 sym.setFlags(HAS_DIRECT_RELOC);
972 }
973
974 processAux(expr, type, offset, sym, addend);
975}
976
977// Process relocation after needsGot/needsPlt flags are already handled.
978// This is the bottom half of process(), handling isStaticLinkTimeConstant
979// check, dynamic relocations, copy relocations, and error reporting.
980void RelocScan::processAux(RelExpr expr, RelType type, uint64_t offset,
981 Symbol &sym, int64_t addend) const {
982 const bool isIfunc = sym.isGnuIFunc();
983
984 // If the relocation is known to be a link-time constant, we know no dynamic
985 // relocation will be created, pass the control to relocateAlloc() or
986 // relocateNonAlloc() to resolve it.
987 if (isStaticLinkTimeConstant(e: expr, type, sym, relOff: offset)) {
988 sec->addReloc(r: {.expr: expr, .type: type, .offset: offset, .addend: addend, .sym: &sym});
989 return;
990 }
991
992 // Use a simple -z notext rule that treats all sections except .eh_frame as
993 // writable. GNU ld does not produce dynamic relocations in .eh_frame.
994 //
995 // For MIPS, we don't implement GNU ld's DW_EH_PE_absptr to DW_EH_PE_pcrel
996 // conversion. We still emit a dynamic relocation.
997 bool canWrite = (sec->flags & SHF_WRITE) ||
998 !(ctx.arg.zText ||
999 (isa<EhInputSection>(Val: sec) && ctx.arg.emachine != EM_MIPS));
1000 if (canWrite) {
1001 RelType rel = ctx.target->getDynRel(type);
1002 if (oneof<R_GOT, RE_LOONGARCH_GOT>(expr) ||
1003 ((rel == ctx.target->symbolicRel ||
1004 (ctx.arg.emachine == EM_AARCH64 && type == R_AARCH64_AUTH_ABS64)) &&
1005 !sym.isPreemptible)) {
1006 addRelativeReloc<true>(ctx, isec&: *sec, offsetInSec: offset, sym, addend, expr, type, shard);
1007 return;
1008 }
1009 if (rel != 0) {
1010 if (ctx.arg.emachine == EM_MIPS && rel == ctx.target->symbolicRel)
1011 rel = ctx.target->relativeRel;
1012 std::lock_guard<std::mutex> lock(ctx.relocMutex);
1013 if (LLVM_UNLIKELY(type == ctx.target->iRelSymbolicRel)) {
1014 if (sym.isPreemptible) {
1015 auto diag = Err(ctx);
1016 diag << "relocation " << type
1017 << " cannot be used against preemptible symbol '" << &sym << "'";
1018 printLocation(s&: diag, sec&: *sec, sym, off: offset);
1019 } else if (isIfunc) {
1020 auto diag = Err(ctx);
1021 diag << "relocation " << type
1022 << " cannot be used against ifunc symbol '" << &sym << "'";
1023 printLocation(s&: diag, sec&: *sec, sym, off: offset);
1024 } else {
1025 ctx.in.relaDyn->addReloc(reloc: {ctx.target->iRelativeRel, sec, offset,
1026 false, sym, addend, R_ABS});
1027 return;
1028 }
1029 }
1030 ctx.in.relaDyn->addSymbolReloc(dynType: rel, isec&: *sec, offsetInSec: offset, sym, addend, addendRelType: type);
1031
1032 // MIPS ABI turns using of GOT and dynamic relocations inside out.
1033 // While regular ABI uses dynamic relocations to fill up GOT entries
1034 // MIPS ABI requires dynamic linker to fills up GOT entries using
1035 // specially sorted dynamic symbol table. This affects even dynamic
1036 // relocations against symbols which do not require GOT entries
1037 // creation explicitly, i.e. do not have any GOT-relocations. So if
1038 // a preemptible symbol has a dynamic relocation we anyway have
1039 // to create a GOT entry for it.
1040 // If a non-preemptible symbol has a dynamic relocation against it,
1041 // dynamic linker takes it st_value, adds offset and writes down
1042 // result of the dynamic relocation. In case of preemptible symbol
1043 // dynamic linker performs symbol resolution, writes the symbol value
1044 // to the GOT entry and reads the GOT entry when it needs to perform
1045 // a dynamic relocation.
1046 // ftp://www.linux-mips.org/pub/linux/mips/doc/ABI/mipsabi.pdf p.4-19
1047 if (ctx.arg.emachine == EM_MIPS)
1048 ctx.in.mipsGot->addEntry(file&: *sec->file, sym, addend, expr);
1049 return;
1050 }
1051 }
1052
1053 // When producing an executable, we can perform copy relocations (for
1054 // STT_OBJECT) and canonical PLT (for STT_FUNC) if sym is defined by a DSO.
1055 // Copy relocations/canonical PLT entries are unsupported for
1056 // R_AARCH64_AUTH_ABS64.
1057 if (!ctx.arg.shared && sym.isShared() &&
1058 !(ctx.arg.emachine == EM_AARCH64 && type == R_AARCH64_AUTH_ABS64)) {
1059 if (!canDefineSymbolInExecutable(ctx, sym)) {
1060 auto diag = Err(ctx);
1061 diag << "cannot preempt symbol: " << &sym;
1062 printLocation(s&: diag, sec&: *sec, sym, off: offset);
1063 return;
1064 }
1065
1066 if (sym.isObject()) {
1067 // Produce a copy relocation.
1068 if (auto *ss = dyn_cast<SharedSymbol>(Val: &sym)) {
1069 if (!ctx.arg.zCopyreloc) {
1070 auto diag = Err(ctx);
1071 diag << "unresolvable relocation " << type << " against symbol '"
1072 << ss << "'; recompile with -fPIC or remove '-z nocopyreloc'";
1073 printLocation(s&: diag, sec&: *sec, sym, off: offset);
1074 }
1075 sym.setFlags(NEEDS_COPY);
1076 }
1077 sec->addReloc(r: {.expr: expr, .type: type, .offset: offset, .addend: addend, .sym: &sym});
1078 return;
1079 }
1080
1081 // This handles a non PIC program call to function in a shared library. In
1082 // an ideal world, we could just report an error saying the relocation can
1083 // overflow at runtime. In the real world with glibc, crt1.o has a
1084 // R_X86_64_PC32 pointing to libc.so.
1085 //
1086 // The general idea on how to handle such cases is to create a PLT entry and
1087 // use that as the function value.
1088 //
1089 // For the static linking part, we just return a plt expr and everything
1090 // else will use the PLT entry as the address.
1091 //
1092 // The remaining problem is making sure pointer equality still works. We
1093 // need the help of the dynamic linker for that. We let it know that we have
1094 // a direct reference to a so symbol by creating an undefined symbol with a
1095 // non zero st_value. Seeing that, the dynamic linker resolves the symbol to
1096 // the value of the symbol we created. This is true even for got entries, so
1097 // pointer equality is maintained. To avoid an infinite loop, the only entry
1098 // that points to the real function is a dedicated got entry used by the
1099 // plt. That is identified by special relocation types (R_X86_64_JUMP_SLOT,
1100 // R_386_JMP_SLOT, etc).
1101
1102 // For position independent executable on i386, the plt entry requires ebx
1103 // to be set. This causes two problems:
1104 // * If some code has a direct reference to a function, it was probably
1105 // compiled without -fPIE/-fPIC and doesn't maintain ebx.
1106 // * If a library definition gets preempted to the executable, it will have
1107 // the wrong ebx value.
1108 if (sym.isFunc()) {
1109 if (ctx.arg.pie && ctx.arg.emachine == EM_386) {
1110 auto diag = Err(ctx);
1111 diag << "symbol '" << &sym
1112 << "' cannot be preempted; recompile with -fPIE";
1113 printLocation(s&: diag, sec&: *sec, sym, off: offset);
1114 }
1115 sym.setFlags(NEEDS_COPY | NEEDS_PLT);
1116 sec->addReloc(r: {.expr: expr, .type: type, .offset: offset, .addend: addend, .sym: &sym});
1117 return;
1118 }
1119 }
1120
1121 auto diag = Err(ctx);
1122 diag << "relocation " << type << " cannot be used against ";
1123 if (sym.getName().empty())
1124 diag << "local symbol";
1125 else
1126 diag << "symbol '" << &sym << "'";
1127 diag << "; recompile with -fPIC";
1128 printLocation(s&: diag, sec&: *sec, sym, off: offset);
1129}
1130
1131template <class ELFT, class RelTy>
1132void TargetInfo::scanSectionImpl(InputSectionBase &sec, Relocs<RelTy> rels,
1133 unsigned shard) {
1134 RelocScan rs(ctx, &sec, shard);
1135 // Many relocations end up in sec.relocations.
1136 sec.relocations.reserve(N: rels.size());
1137
1138 for (auto it = rels.begin(); it != rels.end(); ++it) {
1139 auto type = it->getType(false);
1140 rs.scan<ELFT, RelTy>(it, type, rs.getAddend<ELFT>(*it, type));
1141 }
1142}
1143
1144template <class ELFT>
1145void TargetInfo::scanSection1(InputSectionBase &sec, unsigned shard) {
1146 const RelsOrRelas<ELFT> rels = sec.template relsOrRelas<ELFT>();
1147 if (rels.areRelocsCrel())
1148 scanSectionImpl<ELFT>(sec, rels.crels, shard);
1149 else if (rels.areRelocsRel())
1150 scanSectionImpl<ELFT>(sec, rels.rels, shard);
1151 else
1152 scanSectionImpl<ELFT>(sec, rels.relas, shard);
1153}
1154
1155void TargetInfo::scanSection(InputSectionBase &sec, unsigned shard) {
1156 invokeELFT(scanSection1, sec, shard);
1157}
1158
1159void RelocScan::scanEhSection(EhInputSection &s) {
1160 sec = &s;
1161 OffsetGetter getter(s);
1162 auto rels = s.rels;
1163 s.relocations.reserve(N: rels.size());
1164 for (auto &r : rels) {
1165 // Ignore R_*_NONE and other marker relocations.
1166 if (r.expr == R_NONE)
1167 continue;
1168 uint64_t offset = getter.get(ctx, off: r.offset);
1169 // Skip if the relocation offset is within a dead piece.
1170 if (offset == uint64_t(-1))
1171 continue;
1172 Symbol *sym = r.sym;
1173 if (sym->isUndefined() &&
1174 maybeReportUndefined(sym&: cast<Undefined>(Val&: *sym), offset))
1175 continue;
1176 process(expr: r.expr, type: r.type, offset, sym&: *sym, addend: r.addend);
1177 }
1178}
1179
1180template <class ELFT> void elf::scanRelocations(Ctx &ctx) {
1181 // Scan all relocations. Each relocation goes through a series of tests to
1182 // determine if it needs special treatment, such as creating GOT, PLT,
1183 // copy relocations, etc. Note that relocations for non-alloc sections are
1184 // directly processed by InputSection::relocateNonAlloc.
1185
1186 size_t numFiles = ctx.objectFiles.size();
1187 std::atomic<size_t> next{0};
1188 // MIPS modifies MipsGotSection during relocation scanning, which is not
1189 // suitable for parallelism.
1190 size_t numWorkers = ctx.arg.emachine == EM_MIPS
1191 ? 1
1192 : std::min<size_t>(a: ctx.arg.threadCount, b: numFiles + 1);
1193 parallelFor(0, numWorkers, [&](unsigned shard) {
1194 // Tasks claim work items off a shared counter: item i < numFiles scans
1195 // ctx.objectFiles[i] while the last item scans special sections.
1196 for (size_t i;
1197 (i = next.fetch_add(i: 1, m: std::memory_order_relaxed)) <= numFiles;) {
1198 if (i != numFiles) {
1199 for (InputSectionBase *s : ctx.objectFiles[i]->getSections())
1200 if (s && s->kind() == SectionBase::Regular && s->isLive() &&
1201 (s->flags & SHF_ALLOC) &&
1202 !(s->type == SHT_ARM_EXIDX && ctx.arg.emachine == EM_ARM))
1203 ctx.target->scanSection(sec&: *s, shard);
1204 continue;
1205 }
1206 RelocScan scanner(ctx, nullptr, shard);
1207 for (EhInputSection *sec : ctx.in.ehFrame->sections)
1208 scanner.scanEhSection(s&: *sec);
1209 ARMExidxSyntheticSection *armExidx = ctx.in.armExidx.get();
1210 if (armExidx && armExidx->isLive())
1211 for (InputSection *sec : armExidx->exidxSections)
1212 if (sec->isLive())
1213 ctx.target->scanSection(sec&: *sec, shard);
1214 }
1215 });
1216}
1217
1218RelocationBaseSection &elf::getIRelativeSection(Ctx &ctx) {
1219 // Prior to Android V, there was a bug that caused RELR relocations to be
1220 // applied after packed relocations. This meant that resolvers referenced by
1221 // IRELATIVE relocations in the packed relocation section would read
1222 // unrelocated globals with RELR relocations when
1223 // --pack-relative-relocs=android+relr is enabled. Work around this by placing
1224 // IRELATIVE in .rela.plt.
1225 return ctx.arg.androidPackDynRelocs ? *ctx.in.relaPlt : *ctx.in.relaDyn;
1226}
1227
1228static bool handleNonPreemptibleIfunc(Ctx &ctx, Symbol &sym, uint16_t flags) {
1229 // Non-preemptible ifuncs are called via a PLT entry that resolves the actual
1230 // address at runtime. We create an IPLT entry and an IGOTPLT slot. The
1231 // IGOTPLT slot is relocated by an IRELATIVE relocation, whose addend encodes
1232 // the resolver address. At startup, the runtime calls the resolver and
1233 // fills the IGOTPLT slot.
1234 //
1235 // For direct (non-GOT/PLT) relocations, the symbol must have a constant
1236 // address. We achieve this by redirecting the symbol to its IPLT entry
1237 // ("canonicalizing" it), so all references see the same address, and the
1238 // resolver is called exactly once. This may result in two GOT entries: one
1239 // in .got.plt for the IRELATIVE, and one in .got pointing to the canonical
1240 // IPLT entry (for GOT-generating relocations). We clone the symbol to
1241 // preserve the original resolver address for the IRELATIVE addend. The clone
1242 // is tracked in ctx.irelativeSyms so that linker relaxation can adjust its
1243 // value when the resolver address changes.
1244 //
1245 // Note: IRELATIVE relocations are needed even in static executables; see
1246 // `addRelIpltSymbols`.
1247 if (!sym.isGnuIFunc() || sym.isPreemptible || ctx.arg.zIfuncNoplt)
1248 return false;
1249 // Skip unreferenced non-preemptible ifunc.
1250 if (!(flags & (NEEDS_GOT | NEEDS_GOT_AUTH | NEEDS_PLT | HAS_DIRECT_RELOC)))
1251 return true;
1252 // We only support one kind of GOT entry, and IPLT entries currently always
1253 // use non-AUTH GOT entries.
1254 if (flags & NEEDS_GOT_AUTH) {
1255 auto diag = Err(ctx);
1256 diag << "AUTH GOT entry for non-preemptible ifunc '" << sym.getName()
1257 << "' requested, but R_AARCH64_AUTH_IRELATIVE is not supported yet";
1258 return true;
1259 }
1260
1261 auto addIpltEntry = [&](Symbol &irelativeSym) {
1262 irelativeSym.isInIplt = true;
1263 irelativeSym.allocateAux(ctx);
1264 auto &dyn = getIRelativeSection(ctx);
1265 addPltEntry(ctx, plt&: *ctx.in.iplt, gotPlt&: *ctx.in.igotPlt, rel&: dyn,
1266 type: ctx.target->iRelativeRel, sym&: irelativeSym);
1267 };
1268
1269 if (flags & HAS_DIRECT_RELOC) {
1270 // Change the value to the IPLT and redirect all references to it.
1271 auto &d = cast<Defined>(Val&: sym);
1272 auto *irelativeSym = addSyntheticLocal(ctx, name: d.getName(), type: d.type, value: d.value,
1273 size: d.size, section&: *d.section);
1274 addIpltEntry(*irelativeSym);
1275 ctx.irelativeSyms.push_back(Elt: irelativeSym);
1276 sym.isInIplt = true;
1277 sym.allocateAux(ctx);
1278 ctx.symAux.back().pltIdx = ctx.symAux[irelativeSym->auxIdx].pltIdx;
1279 d.section = ctx.in.iplt.get();
1280 d.value = d.getPltIdx(ctx) * ctx.target->ipltEntrySize;
1281 d.size = 0;
1282 // It's important to set the symbol type here so that dynamic loaders
1283 // don't try to call the PLT as if it were an ifunc resolver.
1284 d.type = STT_FUNC;
1285
1286 if (flags & NEEDS_GOT)
1287 addGotEntry(ctx, sym);
1288 } else {
1289 addIpltEntry(sym);
1290 if (flags & NEEDS_GOT) {
1291 // Redirect GOT accesses to point to the Igot.
1292 sym.gotInIgot = true;
1293 }
1294 }
1295 return true;
1296}
1297
1298void elf::postScanRelocations(Ctx &ctx) {
1299 bool needsTlsIe = false;
1300 auto fn = [&](Symbol &sym) {
1301 auto flags = sym.flags.load(m: std::memory_order_relaxed);
1302 if (handleNonPreemptibleIfunc(ctx, sym, flags))
1303 return;
1304
1305 if (sym.isTagged() && sym.isDefined())
1306 ctx.in.memtagGlobalDescriptors->addSymbol(sym);
1307
1308 if (!sym.needsDynReloc())
1309 return;
1310 sym.allocateAux(ctx);
1311
1312 if (flags & (NEEDS_GOT | NEEDS_GOT_AUTH)) {
1313 if ((flags & NEEDS_GOT) && (flags & NEEDS_GOT_AUTH)) {
1314 auto diag = Err(ctx);
1315 diag << "both AUTH and non-AUTH GOT entries for '" << sym.getName()
1316 << "' requested, but only one type of GOT entry per symbol is "
1317 "supported";
1318 return;
1319 }
1320 if (flags & NEEDS_GOT_AUTH)
1321 addGotAuthEntry(ctx, sym);
1322 else
1323 addGotEntry(ctx, sym);
1324 }
1325 if (flags & NEEDS_PLT)
1326 addPltEntry(ctx, plt&: *ctx.in.plt, gotPlt&: *ctx.in.gotPlt, rel&: *ctx.in.relaPlt,
1327 type: ctx.target->pltRel, sym);
1328 if (flags & NEEDS_COPY) {
1329 if (sym.isObject()) {
1330 invokeELFT(addCopyRelSymbol, ctx, cast<SharedSymbol>(sym));
1331 // NEEDS_COPY is cleared for sym and its aliases so that in
1332 // later iterations aliases won't cause redundant copies.
1333 assert(!sym.hasFlag(NEEDS_COPY));
1334 } else {
1335 assert(sym.isFunc() && sym.hasFlag(NEEDS_PLT));
1336 if (!sym.isDefined()) {
1337 replaceWithDefined(ctx, sym, sec&: *ctx.in.plt,
1338 value: ctx.target->pltHeaderSize +
1339 ctx.target->pltEntrySize * sym.getPltIdx(ctx),
1340 size: 0);
1341 sym.setFlags(NEEDS_COPY);
1342 if (ctx.arg.emachine == EM_PPC) {
1343 // PPC32 canonical PLT entries are at the beginning of .glink
1344 cast<Defined>(Val&: sym).value = ctx.in.plt->headerSize;
1345 ctx.in.plt->headerSize += 16;
1346 cast<PPC32GlinkSection>(Val&: *ctx.in.plt).canonical_plts.push_back(Elt: &sym);
1347 }
1348 }
1349 }
1350 }
1351
1352 if (!sym.isTls())
1353 return;
1354 GotSection *got = ctx.in.got.get();
1355
1356 if (flags & (NEEDS_TLSDESC | NEEDS_TLSDESC_AUTH)) {
1357 if ((flags & NEEDS_TLSDESC) && (flags & NEEDS_TLSDESC_AUTH)) {
1358 Err(ctx)
1359 << "both AUTH and non-AUTH TLSDESC entries for '" << sym.getName()
1360 << "' requested, but only one type of TLSDESC entry per symbol is "
1361 "supported";
1362 return;
1363 }
1364 got->addTlsDescEntry(sym);
1365 RelType tlsDescRel = ctx.target->tlsDescRel;
1366 if (flags & NEEDS_TLSDESC_AUTH) {
1367 got->addTlsDescAuthEntry();
1368 tlsDescRel = ELF::R_AARCH64_AUTH_TLSDESC;
1369 }
1370 ctx.in.relaDyn->addAddendOnlyRelocIfNonPreemptible(
1371 dynType: tlsDescRel, isec&: *got, offsetInSec: got->getTlsDescOffset(sym), sym, addendRelType: tlsDescRel);
1372 }
1373 if (flags & NEEDS_TLSGD) {
1374 got->addDynTlsEntry(sym);
1375 uint64_t off = got->getGlobalDynOffset(b: sym);
1376 uint64_t offsetOff = off + ctx.arg.wordsize;
1377 if (sym.isPreemptible) {
1378 ctx.in.relaDyn->addSymbolReloc(dynType: ctx.target->tlsModuleIndexRel, isec&: *got, offsetInSec: off,
1379 sym);
1380 // If the symbol is preemptible we need the dynamic linker to write
1381 // the offset too.
1382 ctx.in.relaDyn->addSymbolReloc(dynType: ctx.target->tlsOffsetRel, isec&: *got,
1383 offsetInSec: offsetOff, sym);
1384 } else {
1385 if (ctx.arg.shared)
1386 ctx.in.relaDyn->addReloc(reloc: {ctx.target->tlsModuleIndexRel, got, off});
1387 else
1388 // Write one to the GOT slot.
1389 got->addConstant(r: {.expr: R_ADDEND, .type: ctx.target->symbolicRel, .offset: off, .addend: 1, .sym: &sym});
1390 got->addConstant(r: {.expr: R_ABS, .type: ctx.target->tlsOffsetRel, .offset: offsetOff, .addend: 0, .sym: &sym});
1391 }
1392 }
1393 if (flags & NEEDS_GOT_DTPREL) {
1394 got->addEntry(sym);
1395 got->addConstant(
1396 r: {.expr: R_ABS, .type: ctx.target->tlsOffsetRel, .offset: sym.getGotOffset(ctx), .addend: 0, .sym: &sym});
1397 }
1398
1399 if (flags & NEEDS_TLSIE) {
1400 needsTlsIe = true;
1401 addTpOffsetGotEntry(ctx, sym);
1402 }
1403 };
1404
1405 ctx.target->finalizeRelocScan();
1406
1407 GotSection *got = ctx.in.got.get();
1408 if (ctx.needsTlsLd.load(m: std::memory_order_relaxed) && got->addTlsIndex()) {
1409 if (ctx.arg.shared)
1410 ctx.in.relaDyn->addReloc(
1411 reloc: {ctx.target->tlsModuleIndexRel, got, got->getTlsIndexOff()});
1412 else
1413 got->addConstant(r: {.expr: R_ADDEND, .type: ctx.target->symbolicRel,
1414 .offset: got->getTlsIndexOff(), .addend: 1, .sym: ctx.dummySym});
1415 }
1416
1417 assert(ctx.symAux.size() == 1);
1418 for (Symbol *sym : ctx.symtab->getSymbols())
1419 fn(*sym);
1420
1421 // Local symbols may need the aforementioned non-preemptible ifunc and GOT
1422 // handling. They don't need regular PLT.
1423 for (ELFFileBase *file : ctx.objectFiles)
1424 for (Symbol *sym : file->getLocalSymbols())
1425 fn(*sym);
1426
1427 if (needsTlsIe)
1428 ctx.hasTlsIe.store(i: true, m: std::memory_order_relaxed);
1429
1430 if (ctx.arg.branchToBranch)
1431 ctx.target->applyBranchToBranchOpt();
1432}
1433
1434static bool mergeCmp(const InputSection *a, const InputSection *b) {
1435 // std::merge requires a strict weak ordering.
1436 if (a->outSecOff < b->outSecOff)
1437 return true;
1438
1439 // FIXME dyn_cast<ThunkSection> is non-null for any SyntheticSection.
1440 if (a->outSecOff == b->outSecOff && a != b) {
1441 auto *ta = dyn_cast<ThunkSection>(Val: a);
1442 auto *tb = dyn_cast<ThunkSection>(Val: b);
1443
1444 // Check if Thunk is immediately before any specific Target
1445 // InputSection for example Mips LA25 Thunks.
1446 if (ta && ta->getTargetInputSection() == b)
1447 return true;
1448
1449 // Place Thunk Sections without specific targets before
1450 // non-Thunk Sections.
1451 if (ta && !tb && !ta->getTargetInputSection())
1452 return true;
1453 }
1454
1455 return false;
1456}
1457
1458// Call Fn on every executable InputSection accessed via the linker script
1459// InputSectionDescription::Sections.
1460static void forEachInputSectionDescription(
1461 ArrayRef<OutputSection *> outputSections,
1462 llvm::function_ref<void(OutputSection *, InputSectionDescription *)> fn) {
1463 for (OutputSection *os : outputSections) {
1464 if (!(os->flags & SHF_ALLOC) || !(os->flags & SHF_EXECINSTR))
1465 continue;
1466 for (SectionCommand *bc : os->commands)
1467 if (auto *isd = dyn_cast<InputSectionDescription>(Val: bc))
1468 fn(os, isd);
1469 }
1470}
1471
1472ThunkCreator::ThunkCreator(Ctx &ctx) : ctx(ctx) {}
1473
1474ThunkCreator::~ThunkCreator() {}
1475
1476// Thunk Implementation
1477//
1478// Thunks (sometimes called stubs, veneers or branch islands) are small pieces
1479// of code that the linker inserts inbetween a caller and a callee. The thunks
1480// are added at link time rather than compile time as the decision on whether
1481// a thunk is needed, such as the caller and callee being out of range, can only
1482// be made at link time.
1483//
1484// It is straightforward to tell given the current state of the program when a
1485// thunk is needed for a particular call. The more difficult part is that
1486// the thunk needs to be placed in the program such that the caller can reach
1487// the thunk and the thunk can reach the callee; furthermore, adding thunks to
1488// the program alters addresses, which can mean more thunks etc.
1489//
1490// In lld we have a synthetic ThunkSection that can hold many Thunks.
1491// The decision to have a ThunkSection act as a container means that we can
1492// more easily handle the most common case of a single block of contiguous
1493// Thunks by inserting just a single ThunkSection.
1494//
1495// The implementation of Thunks in lld is split across these areas
1496// Relocations.cpp : Framework for creating and placing thunks
1497// Thunks.cpp : The code generated for each supported thunk
1498// Target.cpp : Target specific hooks that the framework uses to decide when
1499// a thunk is used
1500// Synthetic.cpp : Implementation of ThunkSection
1501// Writer.cpp : Iteratively call framework until no more Thunks added
1502//
1503// Thunk placement requirements:
1504// Mips LA25 thunks. These must be placed immediately before the callee section
1505// We can assume that the caller is in range of the Thunk. These are modelled
1506// by Thunks that return the section they must precede with
1507// getTargetInputSection().
1508//
1509// ARM interworking and range extension thunks. These thunks must be placed
1510// within range of the caller. All implemented ARM thunks can always reach the
1511// callee as they use an indirect jump via a register that has no range
1512// restrictions.
1513//
1514// Thunk placement algorithm:
1515// For Mips LA25 ThunkSections; the placement is explicit, it has to be before
1516// getTargetInputSection().
1517//
1518// For thunks that must be placed within range of the caller there are many
1519// possible choices given that the maximum range from the caller is usually
1520// much larger than the average InputSection size. Desirable properties include:
1521// - Maximize reuse of thunks by multiple callers
1522// - Minimize number of ThunkSections to simplify insertion
1523// - Handle impact of already added Thunks on addresses
1524// - Simple to understand and implement
1525//
1526// In lld for the first pass, we pre-create one or more ThunkSections per
1527// InputSectionDescription at Target specific intervals. A ThunkSection is
1528// placed so that the estimated end of the ThunkSection is within range of the
1529// start of the InputSectionDescription or the previous ThunkSection. For
1530// example:
1531// InputSectionDescription
1532// Section 0
1533// ...
1534// Section N
1535// ThunkSection 0
1536// Section N + 1
1537// ...
1538// Section N + K
1539// Thunk Section 1
1540//
1541// The intention is that we can add a Thunk to a ThunkSection that is well
1542// spaced enough to service a number of callers without having to do a lot
1543// of work. An important principle is that it is not an error if a Thunk cannot
1544// be placed in a pre-created ThunkSection; when this happens we create a new
1545// ThunkSection placed next to the caller. This allows us to handle the vast
1546// majority of thunks simply, but also handle rare cases where the branch range
1547// is smaller than the target specific spacing.
1548//
1549// The algorithm is expected to create all the thunks that are needed in a
1550// single pass, with a small number of programs needing a second pass due to
1551// the insertion of thunks in the first pass increasing the offset between
1552// callers and callees that were only just in range.
1553//
1554// A consequence of allowing new ThunkSections to be created outside of the
1555// pre-created ThunkSections is that in rare cases calls to Thunks that were in
1556// range in pass K, are out of range in some pass > K due to the insertion of
1557// more Thunks in between the caller and callee. When this happens we retarget
1558// the relocation back to the original target and create another Thunk.
1559
1560// Remove ThunkSections that are empty, this should only be the initial set
1561// precreated on pass 0.
1562
1563// Insert the Thunks for OutputSection OS into their designated place
1564// in the Sections vector, and recalculate the InputSection output section
1565// offsets.
1566// This may invalidate any output section offsets stored outside of InputSection
1567void ThunkCreator::mergeThunks(ArrayRef<OutputSection *> outputSections) {
1568 forEachInputSectionDescription(
1569 outputSections, fn: [&](OutputSection *os, InputSectionDescription *isd) {
1570 if (isd->thunkSections.empty())
1571 return;
1572
1573 // Remove any zero sized precreated Thunks.
1574 llvm::erase_if(C&: isd->thunkSections,
1575 P: [](const std::pair<ThunkSection *, uint32_t> &ts) {
1576 return ts.first->getSize() == 0;
1577 });
1578
1579 // ISD->ThunkSections contains all created ThunkSections, including
1580 // those inserted in previous passes. Extract the Thunks created this
1581 // pass and order them in ascending outSecOff.
1582 std::vector<ThunkSection *> newThunks;
1583 for (std::pair<ThunkSection *, uint32_t> ts : isd->thunkSections)
1584 if (ts.second == pass)
1585 newThunks.push_back(x: ts.first);
1586 llvm::stable_sort(Range&: newThunks,
1587 C: [](const ThunkSection *a, const ThunkSection *b) {
1588 return a->outSecOff < b->outSecOff;
1589 });
1590
1591 // Merge sorted vectors of Thunks and InputSections by outSecOff
1592 SmallVector<InputSection *, 0> tmp;
1593 tmp.reserve(N: isd->sections.size() + newThunks.size());
1594
1595 std::merge(first1: isd->sections.begin(), last1: isd->sections.end(),
1596 first2: newThunks.begin(), last2: newThunks.end(), result: std::back_inserter(x&: tmp),
1597 comp: mergeCmp);
1598
1599 isd->sections = std::move(tmp);
1600 });
1601}
1602
1603constexpr uint32_t HEXAGON_MASK_END_PACKET = 3 << 14;
1604constexpr uint32_t HEXAGON_END_OF_PACKET = 3 << 14;
1605constexpr uint32_t HEXAGON_END_OF_DUPLEX = 0 << 14;
1606
1607// Return the distance between the packet start and the instruction in the
1608// relocation.
1609static int getHexagonPacketOffset(const InputSection &isec,
1610 const Relocation &rel) {
1611 const ArrayRef<uint8_t> data = isec.content();
1612
1613 // Search back as many as 3 instructions.
1614 for (unsigned i = 0;; i++) {
1615 if (i == 3 || rel.offset < (i + 1) * 4)
1616 return i * 4;
1617 uint32_t instWord =
1618 read32(ctx&: isec.getCtx(), p: data.data() + (rel.offset - (i + 1) * 4));
1619 if (((instWord & HEXAGON_MASK_END_PACKET) == HEXAGON_END_OF_PACKET) ||
1620 ((instWord & HEXAGON_MASK_END_PACKET) == HEXAGON_END_OF_DUPLEX))
1621 return i * 4;
1622 }
1623}
1624
1625static int64_t getPCBias(Ctx &ctx, const InputSection &isec,
1626 const Relocation &rel) {
1627 if (ctx.arg.emachine == EM_ARM) {
1628 switch (rel.type) {
1629 case R_ARM_THM_JUMP19:
1630 case R_ARM_THM_JUMP24:
1631 case R_ARM_THM_CALL:
1632 return 4;
1633 default:
1634 return 8;
1635 }
1636 }
1637 if (ctx.arg.emachine == EM_HEXAGON)
1638 return -getHexagonPacketOffset(isec, rel);
1639 return 0;
1640}
1641
1642// Find or create a ThunkSection within the InputSectionDescription (ISD) that
1643// is in range of Src. An ISD maps to a range of InputSections described by a
1644// linker script section pattern such as { .text .text.* }.
1645ThunkSection *ThunkCreator::getISDThunkSec(OutputSection *os,
1646 InputSection *isec,
1647 InputSectionDescription *isd,
1648 const Relocation &rel,
1649 uint64_t src) {
1650 // See the comment in getThunk for -pcBias below.
1651 const int64_t pcBias = getPCBias(ctx, isec: *isec, rel);
1652 for (std::pair<ThunkSection *, uint32_t> tp : isd->thunkSections) {
1653 ThunkSection *ts = tp.first;
1654 uint64_t tsBase = os->addr + ts->outSecOff - pcBias;
1655 uint64_t tsLimit = tsBase + ts->getSize();
1656 if (ctx.target->inBranchRange(type: rel.type, src,
1657 dst: (src > tsLimit) ? tsBase : tsLimit))
1658 return ts;
1659 }
1660
1661 // No suitable ThunkSection exists. This can happen when there is a branch
1662 // with lower range than the ThunkSection spacing or when there are too
1663 // many Thunks. Create a new ThunkSection as close to the InputSection as
1664 // possible. Error if InputSection is so large we cannot place ThunkSection
1665 // anywhere in Range.
1666 uint64_t thunkSecOff = isec->outSecOff;
1667 if (!ctx.target->inBranchRange(type: rel.type, src,
1668 dst: os->addr + thunkSecOff + rel.addend)) {
1669 thunkSecOff = isec->outSecOff + isec->getSize();
1670 if (!ctx.target->inBranchRange(type: rel.type, src,
1671 dst: os->addr + thunkSecOff + rel.addend))
1672 Fatal(ctx) << "InputSection too large for range extension thunk "
1673 << isec->getObjMsg(offset: src - (os->addr << isec->outSecOff));
1674 }
1675 return addThunkSection(os, isd, off: thunkSecOff);
1676}
1677
1678// Add a Thunk that needs to be placed in a ThunkSection that immediately
1679// precedes its Target.
1680ThunkSection *ThunkCreator::getISThunkSec(InputSection *isec) {
1681 ThunkSection *ts = thunkedSections.lookup(Val: isec);
1682 if (ts)
1683 return ts;
1684
1685 // Find InputSectionRange within Target Output Section (TOS) that the
1686 // InputSection (IS) that we need to precede is in.
1687 OutputSection *tos = isec->getParent();
1688 for (SectionCommand *bc : tos->commands) {
1689 auto *isd = dyn_cast<InputSectionDescription>(Val: bc);
1690 if (!isd || isd->sections.empty())
1691 continue;
1692
1693 InputSection *first = isd->sections.front();
1694 InputSection *last = isd->sections.back();
1695
1696 if (isec->outSecOff < first->outSecOff || last->outSecOff < isec->outSecOff)
1697 continue;
1698
1699 ts = addThunkSection(os: tos, isd, off: isec->outSecOff, /*isPrefix=*/true);
1700 thunkedSections[isec] = ts;
1701 return ts;
1702 }
1703
1704 return nullptr;
1705}
1706
1707// Create one or more ThunkSections per OS that can be used to place Thunks.
1708// We attempt to place the ThunkSections using the following desirable
1709// properties:
1710// - Within range of the maximum number of callers
1711// - Minimise the number of ThunkSections
1712//
1713// We follow a simple but conservative heuristic to place ThunkSections at
1714// offsets that are multiples of a Target specific branch range.
1715// For an InputSectionDescription that is smaller than the range, a single
1716// ThunkSection at the end of the range will do.
1717//
1718// For an InputSectionDescription that is more than twice the size of the range,
1719// we place the last ThunkSection at range bytes from the end of the
1720// InputSectionDescription in order to increase the likelihood that the
1721// distance from a thunk to its target will be sufficiently small to
1722// allow for the creation of a short thunk.
1723void ThunkCreator::createInitialThunkSections(
1724 ArrayRef<OutputSection *> outputSections) {
1725 uint32_t thunkSectionSpacing = ctx.target->getThunkSectionSpacing();
1726 forEachInputSectionDescription(
1727 outputSections, fn: [&](OutputSection *os, InputSectionDescription *isd) {
1728 if (isd->sections.empty())
1729 return;
1730
1731 uint32_t isdBegin = isd->sections.front()->outSecOff;
1732 uint32_t isdEnd =
1733 isd->sections.back()->outSecOff + isd->sections.back()->getSize();
1734 uint32_t lastThunkLowerBound = -1;
1735 if (isdEnd - isdBegin > thunkSectionSpacing * 2)
1736 lastThunkLowerBound = isdEnd - thunkSectionSpacing;
1737
1738 uint32_t isecLimit;
1739 uint32_t prevIsecLimit = isdBegin;
1740 uint32_t thunkUpperBound = isdBegin + thunkSectionSpacing;
1741
1742 for (const InputSection *isec : isd->sections) {
1743 isecLimit = isec->outSecOff + isec->getSize();
1744 if (isecLimit > thunkUpperBound) {
1745 addThunkSection(os, isd, off: prevIsecLimit);
1746 thunkUpperBound = prevIsecLimit + thunkSectionSpacing;
1747 }
1748 if (isecLimit > lastThunkLowerBound)
1749 break;
1750 prevIsecLimit = isecLimit;
1751 }
1752 addThunkSection(os, isd, off: isecLimit);
1753 });
1754}
1755
1756ThunkSection *ThunkCreator::addThunkSection(OutputSection *os,
1757 InputSectionDescription *isd,
1758 uint64_t off, bool isPrefix) {
1759 auto *ts = make<ThunkSection>(args&: ctx, args&: os, args&: off);
1760 ts->partition = os->partition;
1761 if ((ctx.arg.fixCortexA53Errata843419 || ctx.arg.fixCortexA8) &&
1762 !isd->sections.empty() && !isPrefix) {
1763 // The errata fixes are sensitive to addresses modulo 4 KiB. When we add
1764 // thunks we disturb the base addresses of sections placed after the thunks
1765 // this makes patches we have generated redundant, and may cause us to
1766 // generate more patches as different instructions are now in sensitive
1767 // locations. When we generate more patches we may force more branches to
1768 // go out of range, causing more thunks to be generated. In pathological
1769 // cases this can cause the address dependent content pass not to converge.
1770 // We fix this by rounding up the size of the ThunkSection to 4KiB, this
1771 // limits the insertion of a ThunkSection on the addresses modulo 4 KiB,
1772 // which means that adding Thunks to the section does not invalidate
1773 // errata patches for following code.
1774 // Rounding up the size to 4KiB has consequences for code-size and can
1775 // trip up linker script defined assertions. For example the linux kernel
1776 // has an assertion that what LLD represents as an InputSectionDescription
1777 // does not exceed 4 KiB even if the overall OutputSection is > 128 Mib.
1778 // We use the heuristic of rounding up the size when both of the following
1779 // conditions are true:
1780 // 1.) The OutputSection is larger than the ThunkSectionSpacing. This
1781 // accounts for the case where no single InputSectionDescription is
1782 // larger than the OutputSection size. This is conservative but simple.
1783 // 2.) The InputSectionDescription is larger than 4 KiB. This will prevent
1784 // any assertion failures that an InputSectionDescription is < 4 KiB
1785 // in size.
1786 //
1787 // isPrefix is a ThunkSection explicitly inserted before its target
1788 // section. We suppress the rounding up of the size of these ThunkSections
1789 // as unlike normal ThunkSections, they are small in size, but when BTI is
1790 // enabled very frequent. This can bloat code-size and push the errata
1791 // patches out of branch range.
1792 uint64_t isdSize = isd->sections.back()->outSecOff +
1793 isd->sections.back()->getSize() -
1794 isd->sections.front()->outSecOff;
1795 if (os->size > ctx.target->getThunkSectionSpacing() && isdSize > 4096)
1796 ts->roundUpSizeForErrata = true;
1797 }
1798 isd->thunkSections.push_back(Elt: {ts, pass});
1799 return ts;
1800}
1801
1802static bool isThunkSectionCompatible(InputSection *source, Thunk &thunk) {
1803 // Thunks that precede their target section are logically an alternative entry
1804 // point and can always compatible.
1805 if (thunk.getTargetInputSection())
1806 return true;
1807
1808 SectionBase *target = thunk.getThunkTargetSym()->section;
1809 OutputSection *sourceOS = source->getOutputSection();
1810 OutputSection *targetOS = target->getOutputSection();
1811 assert(sourceOS && targetOS);
1812
1813 // Thunks in a different Overlay Output Section can't be reused
1814 // as we can't guarantee that the Overlay will be in memory.
1815 return (sourceOS == targetOS || !targetOS->inOverlay);
1816}
1817
1818std::pair<Thunk *, bool> ThunkCreator::getThunk(InputSection *isec,
1819 Relocation &rel, uint64_t src) {
1820 SmallVector<std::unique_ptr<Thunk>, 0> *thunkVec = nullptr;
1821 // Arm and Thumb have a PC Bias of 8 and 4 respectively, this is cancelled
1822 // out in the relocation addend. We compensate for the PC bias so that
1823 // an Arm and Thumb relocation to the same destination get the same keyAddend,
1824 // which is usually 0.
1825 const int64_t pcBias = getPCBias(ctx, isec: *isec, rel);
1826 const int64_t keyAddend = rel.addend + pcBias;
1827
1828 // We use a ((section, offset), addend) pair to find the thunk position if
1829 // possible so that we create only one thunk for aliased symbols or ICFed
1830 // sections. There may be multiple relocations sharing the same (section,
1831 // offset + addend) pair. We may revert the relocation back to its original
1832 // non-Thunk target, so we cannot fold offset + addend.
1833 if (auto *d = dyn_cast<Defined>(Val: rel.sym))
1834 if (!d->isInPlt(ctx) && d->section)
1835 thunkVec = &thunkedSymbolsBySectionAndAddend[{{d->section, d->value},
1836 keyAddend}];
1837 if (!thunkVec)
1838 thunkVec = &thunkedSymbols[{rel.sym, keyAddend}];
1839
1840 // Check existing Thunks for Sym to see if they can be reused
1841 for (auto &t : *thunkVec)
1842 if (isThunkSectionCompatible(source: isec, thunk&: *t) && t->isCompatibleWith(*isec, rel) &&
1843 ctx.target->inBranchRange(type: rel.type, src,
1844 dst: t->getThunkTargetSym()->getVA(ctx, addend: -pcBias)))
1845 return std::make_pair(x: t.get(), y: false);
1846
1847 // No existing compatible Thunk in range, create a new one
1848 thunkVec->push_back(Elt: addThunk(ctx, isec: *isec, rel));
1849 return std::make_pair(x: thunkVec->back().get(), y: true);
1850}
1851
1852std::pair<Thunk *, bool> ThunkCreator::getSyntheticLandingPad(Defined &d,
1853 int64_t a) {
1854 auto [it, isNew] = landingPadsBySectionAndAddend.try_emplace(
1855 Key: {{d.section, d.value}, a}, Args: nullptr);
1856 if (isNew)
1857 it->second = addLandingPadThunk(ctx, s&: d, a);
1858 return {it->second.get(), isNew};
1859}
1860
1861// Return true if the relocation target is an in range Thunk.
1862// Return false if the relocation is not to a Thunk. If the relocation target
1863// was originally to a Thunk, but is no longer in range we revert the
1864// relocation back to its original non-Thunk target.
1865bool ThunkCreator::normalizeExistingThunk(Relocation &rel, uint64_t src) {
1866 if (Thunk *t = thunks.lookup(Val: rel.sym)) {
1867 if (ctx.target->inBranchRange(type: rel.type, src,
1868 dst: rel.sym->getVA(ctx, addend: rel.addend)))
1869 return true;
1870 rel.sym = &t->destination;
1871 rel.addend = t->addend;
1872 if (rel.sym->isInPlt(ctx))
1873 rel.expr = toPlt(expr: rel.expr);
1874 }
1875 return false;
1876}
1877
1878// When indirect branches are restricted, such as AArch64 BTI Thunks may need
1879// to target a linker generated landing pad instead of the target. This needs
1880// to be done once per pass as the need for a BTI thunk is dependent whether
1881// a thunk is short or long. We iterate over all the thunks to make sure we
1882// catch thunks that have been created but are no longer live. Non-live thunks
1883// are not reachable via normalizeExistingThunk() but are still written.
1884bool ThunkCreator::addSyntheticLandingPads() {
1885 bool addressesChanged = false;
1886 for (Thunk *t : allThunks) {
1887 if (!t->needsSyntheticLandingPad())
1888 continue;
1889 Thunk *lpt;
1890 bool isNew;
1891 auto &dr = cast<Defined>(Val&: t->destination);
1892 std::tie(args&: lpt, args&: isNew) = getSyntheticLandingPad(d&: dr, a: t->addend);
1893 if (isNew) {
1894 addressesChanged = true;
1895 getISThunkSec(isec: cast<InputSection>(Val: dr.section))->addThunk(t: lpt);
1896 }
1897 t->landingPad = lpt->getThunkTargetSym();
1898 }
1899 return addressesChanged;
1900}
1901
1902// Process all relocations from the InputSections that have been assigned
1903// to InputSectionDescriptions and redirect through Thunks if needed. The
1904// function should be called iteratively until it returns false.
1905//
1906// PreConditions:
1907// All InputSections that may need a Thunk are reachable from
1908// OutputSectionCommands.
1909//
1910// All OutputSections have an address and all InputSections have an offset
1911// within the OutputSection.
1912//
1913// The offsets between caller (relocation place) and callee
1914// (relocation target) will not be modified outside of createThunks().
1915//
1916// PostConditions:
1917// If return value is true then ThunkSections have been inserted into
1918// OutputSections. All relocations that needed a Thunk based on the information
1919// available to createThunks() on entry have been redirected to a Thunk. Note
1920// that adding Thunks changes offsets between caller and callee so more Thunks
1921// may be required.
1922//
1923// If return value is false then no more Thunks are needed, and createThunks has
1924// made no changes. If the target requires range extension thunks, currently
1925// ARM, then any future change in offset between caller and callee risks a
1926// relocation out of range error.
1927bool ThunkCreator::createThunks(uint32_t pass,
1928 ArrayRef<OutputSection *> outputSections) {
1929 this->pass = pass;
1930 bool addressesChanged = false;
1931
1932 if (pass == 0 && ctx.target->getThunkSectionSpacing())
1933 createInitialThunkSections(outputSections);
1934
1935 if (ctx.arg.emachine == EM_AARCH64)
1936 addressesChanged = addSyntheticLandingPads();
1937
1938 // Create all the Thunks and insert them into synthetic ThunkSections. The
1939 // ThunkSections are later inserted back into InputSectionDescriptions.
1940 // We separate the creation of ThunkSections from the insertion of the
1941 // ThunkSections as ThunkSections are not always inserted into the same
1942 // InputSectionDescription as the caller.
1943 forEachInputSectionDescription(
1944 outputSections, fn: [&](OutputSection *os, InputSectionDescription *isd) {
1945 for (InputSection *isec : isd->sections)
1946 for (Relocation &rel : isec->relocs()) {
1947 uint64_t src = isec->getVA(offset: rel.offset);
1948
1949 // If we are a relocation to an existing Thunk, check if it is
1950 // still in range. If not then Rel will be altered to point to its
1951 // original target so another Thunk can be generated.
1952 if (pass > 0 && normalizeExistingThunk(rel, src))
1953 continue;
1954
1955 if (!ctx.target->needsThunk(expr: rel.expr, relocType: rel.type, file: isec->file, branchAddr: src,
1956 s: *rel.sym, a: rel.addend))
1957 continue;
1958
1959 Thunk *t;
1960 bool isNew;
1961 std::tie(args&: t, args&: isNew) = getThunk(isec, rel, src);
1962
1963 if (isNew) {
1964 // Find or create a ThunkSection for the new Thunk
1965 ThunkSection *ts;
1966 if (auto *tis = t->getTargetInputSection())
1967 ts = getISThunkSec(isec: tis);
1968 else
1969 ts = getISDThunkSec(os, isec, isd, rel, src);
1970 ts->addThunk(t);
1971 thunks[t->getThunkTargetSym()] = t;
1972 allThunks.push_back(x: t);
1973 }
1974
1975 // Redirect relocation to Thunk, we never go via the PLT to a Thunk
1976 rel.sym = t->getThunkTargetSym();
1977 rel.expr = fromPlt(expr: rel.expr);
1978
1979 // On AArch64 and PPC, a jump/call relocation may be encoded as
1980 // STT_SECTION + non-zero addend, clear the addend after
1981 // redirection.
1982 if (ctx.arg.emachine != EM_MIPS)
1983 rel.addend = -getPCBias(ctx, isec: *isec, rel);
1984 }
1985
1986 for (auto &p : isd->thunkSections) {
1987 // Sort in pass 0, which creates most thunks.
1988 if (pass == 0)
1989 p.first->sortByDestination();
1990 addressesChanged |= p.first->assignOffsets();
1991 }
1992 });
1993
1994 for (auto &p : thunkedSections)
1995 addressesChanged |= p.second->assignOffsets();
1996
1997 // Merge all created synthetic ThunkSections back into OutputSection
1998 mergeThunks(outputSections);
1999 return addressesChanged;
2000}
2001
2002static bool matchesRefTo(const NoCrossRefCommand &cmd, StringRef osec) {
2003 if (cmd.toFirst)
2004 return cmd.outputSections[0] == osec;
2005 return llvm::is_contained(Range: cmd.outputSections, Element: osec);
2006}
2007
2008template <class ELFT, class Rels>
2009static void scanCrossRefs(Ctx &ctx, const NoCrossRefCommand &cmd,
2010 OutputSection *osec, InputSection *sec, Rels rels) {
2011 for (const auto &r : rels) {
2012 Symbol &sym = sec->file->getSymbol(symbolIndex: r.getSymbol(ctx.arg.isMips64EL));
2013 // A legal cross-reference is when the destination output section is
2014 // nullptr, osec for a self-reference, or a section that is described by the
2015 // NOCROSSREFS/NOCROSSREFS_TO command.
2016 auto *dstOsec = sym.getOutputSection();
2017 if (!dstOsec || dstOsec == osec || !matchesRefTo(cmd, osec: dstOsec->name))
2018 continue;
2019
2020 std::string toSymName;
2021 if (!sym.isSection())
2022 toSymName = toStr(ctx, sym);
2023 else if (auto *d = dyn_cast<Defined>(Val: &sym))
2024 toSymName = d->section->name;
2025 Err(ctx) << sec->getLocation(offset: r.r_offset)
2026 << ": prohibited cross reference from '" << osec->name << "' to '"
2027 << toSymName << "' in '" << dstOsec->name << "'";
2028 }
2029}
2030
2031// For each output section described by at least one NOCROSSREFS(_TO) command,
2032// scan relocations from its input sections for prohibited cross references.
2033template <class ELFT> void elf::checkNoCrossRefs(Ctx &ctx) {
2034 for (OutputSection *osec : ctx.outputSections) {
2035 for (const NoCrossRefCommand &noxref : ctx.script->noCrossRefs) {
2036 if (!llvm::is_contained(Range: noxref.outputSections, Element: osec->name) ||
2037 (noxref.toFirst && noxref.outputSections[0] == osec->name))
2038 continue;
2039 for (SectionCommand *cmd : osec->commands) {
2040 auto *isd = dyn_cast<InputSectionDescription>(Val: cmd);
2041 if (!isd)
2042 continue;
2043 parallelForEach(isd->sections, [&](InputSection *sec) {
2044 invokeOnRelocs(*sec, scanCrossRefs<ELFT>, ctx, noxref, osec, sec);
2045 });
2046 }
2047 }
2048 }
2049}
2050
2051template void elf::scanRelocations<ELF32LE>(Ctx &);
2052template void elf::scanRelocations<ELF32BE>(Ctx &);
2053template void elf::scanRelocations<ELF64LE>(Ctx &);
2054template void elf::scanRelocations<ELF64BE>(Ctx &);
2055
2056template void elf::checkNoCrossRefs<ELF32LE>(Ctx &);
2057template void elf::checkNoCrossRefs<ELF32BE>(Ctx &);
2058template void elf::checkNoCrossRefs<ELF64LE>(Ctx &);
2059template void elf::checkNoCrossRefs<ELF64BE>(Ctx &);
2060