[ELF][RISCV] Resolve branch relocations referencing undefined weak to current location if not using PLT

[MaskRay]

Summary

In a -no-pie link we optimize R_PLT_PC to R_PC. Currently we resolve a branch
relocation to the link-time zero address. However such a choice tends to cause
relocation overflow possibility for RISC architectures.

• aarch64: GNU ld: rewrite the instruction to a NOP; ld.lld: branch to the next instruction
• mips: GNU ld: branch to the start of the text segment (?); ld.lld: branch to zero
• ppc32: GNU ld: rewrite the instruction to a NOP; ld.lld: branch to the current instruction
• ppc64: GNU ld: rewrite the instruction to a NOP; ld.lld: branch to the current instruction
• riscv: GNU ld: branch to the absolute zero address (with instruction rewriting)
• i386/x86_64: GNU ld/ld.lld: branch to the link-time zero address

I think that resolving to the same location is a good choice. The instruction,
if triggered, is clearly an undefined behavior. Resolving to the same location
can cause an infinite loop (making the user aware of the issue) while ensuring
no overflow.

[MaskRay]

Looks like GNU as/llvm-mc doesn't use R_RISCV_RVC_JUMP/R_RISCV_RVC_BRANCH for undefined symbols.

[MaskRay]

improve test

[MaskRay]

ping

[jrtc27]

lld/ELF/InputSection.cpp

793

Hm, this is a better way of writing it but it's inconsistent with ARM and AArch64.

[MaskRay]

lld/ELF/InputSection.cpp

793

I can change arm/aarch64 to use this style afterward

[jrtc27]

This isn't specified in the psABI, but I don't think it needs to be (AFAIK Arm's psABI is the only one that does, and it opts for the strange "next instruction" semantics, I guess so you can just skip the NULL check in some cases), it's completely undefined behaviour so should always be in dead code, but not known at compile time so we need to do something.

lld/ELF/InputSection.cpp

793

That's fine with me then

lld/ELF/InputSection.cpp

static uint64_t getAArch64UndefinedRelativeWeakVA(uint64_t type, uint64_t a,
   case R_AARCH64_ADR_PREL_LO21:
   case R_AARCH64_LD_PREL_LO19:
   case R_AARCH64_PLT32:
     return p + a;
   }
   llvm_unreachable("AArch64 pc-relative relocation expected\n");
 }
 
+static uint64_t getRISCVUndefinedRelativeWeakVA(uint64_t type, uint64_t p) {
+  switch (type) {
+  case R_RISCV_BRANCH:
+  case R_RISCV_JAL:
+  case R_RISCV_CALL:
+  case R_RISCV_CALL_PLT:
+  case R_RISCV_RVC_BRANCH:
+  case R_RISCV_RVC_JUMP:
+    return p;
+  default:
+    return 0;
+  }
+}
+
 // ARM SBREL relocations are of the form S + A - B where B is the static base
 // The ARM ABI defines base to be "addressing origin of the output segment
 // defining the symbol S". We defined the "addressing origin"/static base to be
 // the base of the PT_LOAD segment containing the Sym.
 // The procedure call standard only defines a Read Write Position Independent
 // RWPI variant so in practice we should expect the static base to be the base
 // of the RW segment.
 static uint64_t getARMStaticBase(const Symbol &sym) {
uint64_t InputSectionBase::getRelocTargetVA(const InputFile *file, RelType type,
   }
   case R_PC:
   case R_ARM_PCA: {
     uint64_t dest;
     if (expr == R_ARM_PCA)
       // Some PC relative ARM (Thumb) relocations align down the place.
       p = p & 0xfffffffc;
     if (sym.isUndefWeak()) {
-      // On ARM and AArch64 a branch to an undefined weak resolves to the
-      // next instruction, otherwise the place.
+      // On ARM and AArch64 a branch to an undefined weak resolves to the next
+      // instruction, otherwise the place. On RISCV, resolve an undefined weak
+      // to the same instruction to cause an infinite loop (making the user
+      // aware of the issue) while ensuring no overflow.
       if (config->emachine == EM_ARM)
         dest = getARMUndefinedRelativeWeakVA(type, a, p);
       else if (config->emachine == EM_AARCH64)
         dest = getAArch64UndefinedRelativeWeakVA(type, a, p);
       else if (config->emachine == EM_PPC)
         dest = p;
+      else if (config->emachine == EM_RISCV)
+        dest = getRISCVUndefinedRelativeWeakVA(type, p) + a;
       else
         dest = sym.getVA(a);
     } else {
       dest = sym.getVA(a);
     }
     return dest - p;
   }
   case R_PLT:

lld/test/ELF/riscv-undefined-weak.s

relative:
   la a1, target
   sd a2, target+2, t1
 
 ## Branch relocations
 ## If .dynsym does not exist, an undefined weak symbol is non-preemptible.
 ## Treat them as PC relative relocations.
 # RELOC:      0x18 R_RISCV_CALL target 0x0
 # RELOC-NEXT: 0x20 R_RISCV_JAL target 0x0
+# RELOC-NEXT: 0x24 R_RISCV_BRANCH target 0x0
 
 # PC-LABEL:    <branch>:
-# PC-NEXT:     auipc ra, 1048559
-# PC-NEXT:     jalr -368(ra)
-# PC-NEXT:     j 0x0
+# PC-NEXT:     auipc ra, 0
+# PC-NEXT:     jalr ra
+# PC-NEXT:     [[#%x,ADDR:]]:
+# PC-SAME:                    j 0x[[#ADDR]]
+# PC-NEXT:     [[#%x,ADDR:]]:
+# PC-SAME:                    beqz zero, 0x[[#ADDR]]
 
 ## If .dynsym exists, an undefined weak symbol is preemptible.
 ## We create a PLT entry and redirect the reference to it.
 # PLT-LABEL:   <branch>:
 # PLT-NEXT:    auipc ra, 0
 # PLT-NEXT:    jalr 56(ra)
-# PLT-NEXT:    j 0x0
+# PLT-NEXT:    [[#%x,ADDR:]]:
+# PLT-SAME:                   j 0x[[#ADDR]]
+# PLT-NEXT:    [[#%x,ADDR:]]:
+# PLT-SAME:                   beqz zero, 0x[[#ADDR]]
 branch:
   call target
   jal x0, target
+  beq x0, x0, target
 
 ## Absolute relocations are resolved to 0.
 # RELOC:      0x0 R_RISCV_64 target 0x3
 # RELOC-NEXT: 0x8 R_RISCV_32 target 0x4
 # HEX:      section '.data':
 # HEX-NEXT: 03000000 00000000 04000000
 .data
 .p2align 3
 .quad target+3
 .long target+4
 
 # PC-NOT:      .plt:
 # PLT:         .plt: