Access protected symbols via GOT, even in non-PIC mode

[joerg]

Summary

Access to protected symbols is special as they can not be interposed. Compare https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65248 for the history.

This patch introduces a new predicate on Global Value to decide whether a symbol can be interposed. Hidden and local symbols can never be interposed. Protected symbols are safe as well, if they are actually defined. Common linkage counts as definition here. The rest of the patch teaches the X86 target about using PIC access for interposable protected symbols, even when not doing PIC normally. This is required to avoid copy relocations, which would change the address and are rejected by newer binutils versions.

[joerg]

Explicitly check that the address of a protected function uses the GOT as well. That's the remaining concern the IRC discussion.

[• rafael]

include/llvm/IR/GlobalValue.h

371

The spec says:

• all of the non-default visibility attributes, when applied to a symbol reference, imply that a definition to satisfy that reference must be provided within the current executable or shared object.

So whether we have a definition or not should not change this.

I understand what you are trying to do: Given a undefined symbol, be conservative and assume it can be in another DSO. Given that we can't have copy relocs for protected, the issue is more noticeable there.

But I think that that should be handled independently. What is needed is a -mno-copy-reloc that instructs llvm to not assume that the linker can use copy relocations to fix up any bad guesses as to where a symbol is.

For example, given

declare void @somewhere()
define void @here() { ret void }
define void @use() {
  call void @here()
  call void @somewhere()
  ret void
}

We would get:

• -relocation-model=pic:

callq   here@PLT
callq   somewhere@PLT

• -relocation-model=static:

callq   here
callq   somewhere

• -relocation-model=static -mno-copy-reloc:

callq   here
callq   somewhere@PLT

With a default visibility undefined symbol playing the role of a safe undefined symbol, a protected one can be required to be in this DSO as the spec says.

include/llvm/IR/GlobalValue.h

/// @}
   }
 
   /// Returns true if this global's definition will be the one chosen by the
   /// linker.
   bool isStrongDefinitionForLinker() const {
     return !(isDeclarationForLinker() || isWeakForLinker());
   }
 
+  /// Returns true if references to this global value can not be resolved
+  /// at link time to absolute addresses or fixed offsets.
+  bool isInterposable() const {
+    return !hasLocalLinkage() && !hasHiddenVisibility() &&
+      (!hasProtectedVisibility() || !(isStrongDefinitionForLinker() || hasCommonLinkage()));
+  }
+
   // Returns true if the alignment of the value can be unilaterally
   // increased.
   bool canIncreaseAlignment() const;
 
   /// This method unlinks 'this' from the containing module, but does not delete
   /// it.
   virtual void removeFromParent() = 0;
 

lib/Target/X86/X86FastISel.cpp

if (!Subtarget->isPICStyleRIPRel() ||
 
         // Prepare for inserting code in the local-value area.
         SavePoint SaveInsertPt = enterLocalValueArea();
 
         if (TLI.getPointerTy(DL) == MVT::i64) {
           Opc = X86::MOV64rm;
           RC  = &X86::GR64RegClass;
 
-          if (Subtarget->isPICStyleRIPRel())
+          // MO_GETPCREL is used for accessing protected symbols, so
+          // support that even for non-PIC.
+          if (Subtarget->isPICStyleRIPRel() || GVFlags == X86II::MO_GOTPCREL)
             StubAM.Base.Reg = X86::RIP;
         } else {
           Opc = X86::MOV32rm;
           RC  = &X86::GR32RegClass;
         }
 
         LoadReg = createResultReg(RC);
         MachineInstrBuilder LoadMI =

lib/Target/X86/X86ISelLowering.cpp

if (OpFlags == X86II::MO_NO_FLAG &&
       X86::isOffsetSuitableForCodeModel(Offset, M)) {
     // A direct static reference to a global.
     Result = DAG.getTargetGlobalAddress(GV, dl, PtrVT, Offset);
     Offset = 0;
   } else {
     Result = DAG.getTargetGlobalAddress(GV, dl, PtrVT, 0, OpFlags);
   }
 
-  if (Subtarget.isPICStyleRIPRel() &&
+  // MO_GETPCREL is used for accessing protected symbols, so
+  // support that even for non-PIC.
+  if ((Subtarget.isPICStyleRIPRel() || OpFlags == X86II::MO_GOTPCREL) &&
       (M == CodeModel::Small || M == CodeModel::Kernel))
     Result = DAG.getNode(X86ISD::WrapperRIP, dl, PtrVT, Result);
   else
     Result = DAG.getNode(X86ISD::Wrapper, dl, PtrVT, Result);
 
   // With PIC, the address is actually $g + Offset.
   if (isGlobalRelativeToPICBase(OpFlags)) {
     Result = DAG.getNode(ISD::ADD, dl, PtrVT,

lib/Target/X86/X86InstrInfo.cpp

bool runOnMachineFunction(MachineFunction &MF) override {
         static_cast<const X86TargetMachine *>(&MF.getTarget());
       const X86Subtarget &STI = MF.getSubtarget<X86Subtarget>();
 
       // Don't do anything if this is 64-bit as 64-bit PIC
       // uses RIP relative addressing.
       if (STI.is64Bit())
         return false;
 
-      // Only emit a global base reg in PIC mode.
-      if (TM->getRelocationModel() != Reloc::PIC_)
+      // A global base register is used only in PIC mode or for
+      // addressing protected symbol on ELF targets.
+      if (TM->getRelocationModel() != Reloc::PIC_ && !STI.isTargetELF())
         return false;
 
       X86MachineFunctionInfo *X86FI = MF.getInfo<X86MachineFunctionInfo>();
       unsigned GlobalBaseReg = X86FI->getGlobalBaseReg();
 
       // If we didn't need a GlobalBaseReg, don't insert code.
       if (GlobalBaseReg == 0)
         return false;
 
       // Insert the set of GlobalBaseReg into the first MBB of the function
       MachineBasicBlock &FirstMBB = MF.front();
       MachineBasicBlock::iterator MBBI = FirstMBB.begin();
       DebugLoc DL = FirstMBB.findDebugLoc(MBBI);
       MachineRegisterInfo &RegInfo = MF.getRegInfo();
       const X86InstrInfo *TII = STI.getInstrInfo();
 
       unsigned PC;
-      if (STI.isPICStyleGOT())
+      if (STI.isPICStyleGOT() || STI.isTargetELF())
         PC = RegInfo.createVirtualRegister(&X86::GR32RegClass);
       else
         PC = GlobalBaseReg;
 
       // Operand of MovePCtoStack is completely ignored by asm printer. It's
       // only used in JIT code emission as displacement to pc.
       BuildMI(FirstMBB, MBBI, DL, TII->get(X86::MOVPC32r), PC).addImm(0);
 
       // If we're using vanilla 'GOT' PIC style, we should use relative addressing
       // not to pc, but to _GLOBAL_OFFSET_TABLE_ external.
-      if (STI.isPICStyleGOT()) {
+      if (STI.isPICStyleGOT() || STI.isTargetELF()) {
         // Generate addl $__GLOBAL_OFFSET_TABLE_ + [.-piclabel], %some_register
         BuildMI(FirstMBB, MBBI, DL, TII->get(X86::ADD32ri), GlobalBaseReg)
           .addReg(PC).addExternalSymbol("_GLOBAL_OFFSET_TABLE_",
                                         X86II::MO_GOT_ABSOLUTE_ADDRESS);
       }
 
       return true;
     }

lib/Target/X86/X86Subtarget.cpp

if (isTargetDarwin()) {
       // If symbol visibility is hidden, the extra load is not needed if
       // target is x86-64 or the symbol is definitely defined in the current
       // translation unit.
       if (GV->hasDefaultVisibility() && !isDef)
         return X86II::MO_GOTPCREL;
     } else if (!isTargetWin64()) {
       assert(isTargetELF() && "Unknown rip-relative target");
 
-      // Extra load is needed for all externally visible.
-      if (!GV->hasLocalLinkage() && GV->hasDefaultVisibility())
+      // Extra load is needed if the reference can't be resolved at link time.
+      if (GV->isInterposable())
         return X86II::MO_GOTPCREL;
     }
 
     return X86II::MO_NO_FLAG;
   }
 
   if (isPICStyleGOT()) {   // 32-bit ELF targets.
-    // Extra load is needed for all externally visible.
-    if (GV->hasLocalLinkage() || GV->hasHiddenVisibility())
-      return X86II::MO_GOTOFF;
+    // Extra load is needed if the reference can't be resolved at link time.
+    if (GV->isInterposable())
       return X86II::MO_GOT;
+    return X86II::MO_GOTOFF;
   }
 
   if (isPICStyleStubPIC()) {  // Darwin/32 in PIC mode.
     // Determine whether we have a stub reference and/or whether the reference
     // is relative to the PIC base or not.
 
     // If this is a strong reference to a definition, it is definitely not
     // through a stub.
if (isPICStyleStubNoDynamic()) {  // Darwin/32 in -mdynamic-no-pic mode.
     // normal $non_lazy_ptr stub because this symbol might be resolved late.
     if (!GV->hasHiddenVisibility())  // Non-hidden $non_lazy_ptr reference.
       return X86II::MO_DARWIN_NONLAZY;
 
     // Otherwise, no stub.
     return X86II::MO_NO_FLAG;
   }
 
+  if (!isDef && GV->hasProtectedVisibility() && GV->isInterposable()) {
+    // Copy relocations for protected symbols are invalid, so force
+    // using indirect access here.
+    return is64Bit() ? X86II::MO_GOTPCREL : X86II::MO_GOT;
+  }
+
   // Direct static reference to global.
   return X86II::MO_NO_FLAG;
 }
 
 
 /// This function returns the name of a function which has an interface like
 /// the non-standard bzero function, if such a function exists on the
 /// current subtarget and it is considered preferable over memset with zero

test/CodeGen/X86/protected.ll

+; RUN: llc < %s -march=x86-64 -O2 | FileCheck %s --check-prefix=CHECK-ELF64
+; RUN: llc < %s -march=x86-64 -O2 -relocation-model=pic | FileCheck %s --check-prefix=CHECK-ELF64
+; fast-isel does not use RIP-relative address by default.
+; RUN: llc < %s -march=x86-64 -O0 | FileCheck %s --check-prefix=CHECK-ELF64-ABS
+; RUN: llc < %s -march=x86-64 -O0 -relocation-model=pic | FileCheck %s --check-prefix=CHECK-ELF64
+
+; RUN: llc < %s -march=x86 -O2 | FileCheck %s --check-prefix=CHECK-ELF32
+; RUN: llc < %s -march=x86 -O2 -relocation-model=pic | FileCheck %s --check-prefix=CHECK-ELF32-PIC
+; RUN: llc < %s -march=x86 -O0 | FileCheck %s --check-prefix=CHECK-ELF32
+; RUN: llc < %s -march=x86 -O0 -relocation-model=pic | FileCheck %s --check-prefix=CHECK-ELF32-PIC
+
+@protected_undef = external protected global i32, align 4
+
+define i32 @protected_accessor() {
+entry:
+  %0 = load i32, i32* @protected_undef, align 4
+  ret i32 %0
+}
+
+; CHECK-ELF64:               movq protected_undef@GOTPCREL(%rip), %rax
+; CHECK-ELF64-NEXT:          movl (%rax), %eax
+; CHECK-ELF64-ABS:           movq protected_undef@GOTPCREL(%rip), %rax
+; CHECK-ELF64-ABS-NEXT:      movl (%rax), %eax
+
+; CHECK-ELF32:               addl $_GLOBAL_OFFSET_TABLE_+({{.*}}), %eax
+; CHECK-ELF32-NEXT:          movl protected_undef@GOT(%eax), %eax
+; CHECK-ELF32-NEXT:          movl (%eax), %eax
+; CHECK-ELF32-PIC:           addl $_GLOBAL_OFFSET_TABLE_+({{.*}}), %eax
+; CHECK-ELF32-PIC-NEXT:      movl protected_undef@GOT(%eax), %eax
+; CHECK-ELF32-PIC-NEXT:      movl (%eax), %eax
+
+@protected_common = common protected global i32 0, align 4
+
+define i32 @protected_accessor2() {
+entry:
+  %0 = load i32, i32* @protected_common, align 4
+  ret i32 %0
+}
+
+; CHECK-ELF64:               movl protected_common(%rip), %eax
+; CHECK-ELF64-ABS:           movl protected_common, %eax
+; CHECK-ELF32:               movl protected_common, %eax
+; CHECK-ELF32-PIC:           movl protected_common@GOTOFF(%eax), %eax
+
+@protected_def = common protected global i32 0, align 4
+
+define i32 @protected_accessor3() {
+entry:
+  %0 = load i32, i32* @protected_def, align 4
+  ret i32 %0
+}
+
+; CHECK-ELF64:               movl protected_def(%rip), %eax
+; CHECK-ELF64-ABS:           movl protected_def, %eax
+
+; CHECK-ELF32:               movl protected_def, %eax
+; CHECK-ELF32-PIC:           movl protected_def@GOTOFF(%eax), %eax
+
+define i8* @protected_function_accessor() #0 {
+entry:
+  ret i8* bitcast (void ()* @protected_function to i8*)
+}
+
+declare protected void @protected_function() #1
+
+; CHECK-ELF64:               movq protected_function@GOTPCREL(%rip), %rax
+; CHECK-ELF32:               movl protected_function@GOT(%eax), %eax