[lld-macho] -flat_namespace for dylibs should make all externs interposable

[int3]

Summary

All references to interposable symbols can be redirected at runtime to
point to a different symbol definition (with the same name). For
example, if both dylib A and B define symbol _foo, and we load A before
B at runtime, then all references to _foo within dylib B will point to
the definition in dylib A.

ld64 makes all extern symbols interposable when linking with
-flat_namespace.

TODO 1: Support -interposable and -interposable_list, which should
just be a matter of parsing those CLI flags and setting the
Defined::interposable bit.

TODO 2: Set Reloc::FinalDefinitionInLinkageUnit correctly with this info
(we are currently not setting it at all, so we're erring on the
conservative side, but we should help the LTO backend generate more
optimal code.)

[int3]

update test

[modimo]

lld/MachO/SymbolTable.cpp

99

Could this be a config property rather than a per-symbol? It looks like a link invocation will always have flat_namespace or never have it.

lld/MachO/SyntheticSections.cpp

422

Note that the non-lazy binding and lazy binding sections now have to accommodate both DylibSymbols and (interposable) Defined symbols.

Aside from s/DylibSymbol/Symbol/g is the only other change to support this here?

Also, would recommended factoring out the s/DylibSymbol/Symbol/g change to a separate diff as a parent to make it easier to see what files have logic changes in them

[int3]

lld/MachO/SymbolTable.cpp

99

ah this was done with an eye for future support of -interposable_list, which will allow specific symbols to be treated as interposable. I'll add a comment.

lld/MachO/SyntheticSections.cpp

422

Pretty much yeah. I'll split out the NFC changes 👍

[int3]

split out NFC changes

[modimo]

Internally in LLVM IR processing interposability is represented by the following check:

bool GlobalValue::isInterposable() const {
  if (isInterposableLinkage(getLinkage()))
    return true;
  return getParent() && getParent()->getSemanticInterposition() &&
         !isDSOLocal();
}

I'm wondering: is there's a case where a dso_local function/global that comes into link with -flat_namespace/-interposable set? In ELF land interposability is set at compile time but with these flags on MachO it looks possible to set them at link time. If so that also makes pre-LTO optimizations strange because it might inline a function that later turns interposable. Given the previous statement I suspect I'm missing something here.

lld/MachO/SyntheticSections.cpp

422

Thanks!

[int3]

move assert from other diff

[int3]

Hmm, maybe that's why clang doesn't seem to set dso_local when compiling for macos?

~/tmp: cat test.c
void f1(char a) {}
~/tmp: clang -target x86_64-unknown-linux-gnu -c -emit-llvm test.c -o - | llvm-dis
; ModuleID = '<stdin>'
source_filename = "test.c"
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

; Function Attrs: noinline nounwind optnone uwtable
define dso_local void @f1(i8 signext %0) #0 {
  %2 = alloca i8, align 1
  store i8 %0, i8* %2, align 1
  ret void
}

attributes #0 = { noinline nounwind optnone uwtable "disable-tail-calls"="false" "frame-pointer"="all" "less-precise-fpmad"="false" "min-legal-vector-width"="0" "no-infs-fp-math"="false" "no-jump-tables"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+cx8,+fxsr,+mmx,+sse,+sse2,+x87" "tune-cpu"="generic" "unsafe-fp-math"="false" "use-soft-float"="false" }

!llvm.module.flags = !{!0}
!llvm.ident = !{!1}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{!"Apple clang version 13.0.0 (clang-1300.0.29.30)"}
~/tmp: clang -target x86_64-apple-darwin -c -emit-llvm test.c -o - | llvm-dis
; ModuleID = '<stdin>'
source_filename = "test.c"
target datalayout = "e-m:o-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-apple-macosx12.0.0"

; Function Attrs: noinline nounwind optnone ssp uwtable
define void @f1(i8 signext %0) #0 {
  %2 = alloca i8, align 1
  store i8 %0, i8* %2, align 1
  ret void
}

attributes #0 = { noinline nounwind optnone ssp uwtable "darwin-stkchk-strong-link" "disable-tail-calls"="false" "frame-pointer"="all" "less-precise-fpmad"="false" "min-legal-vector-width"="0" "no-infs-fp-math"="false" "no-jump-tables"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "no-trapping-math"="true" "probe-stack"="___chkstk_darwin" "stack-protector-buffer-size"="8" "target-cpu"="penryn" "target-features"="+cx16,+cx8,+fxsr,+mmx,+sahf,+sse,+sse2,+sse3,+sse4.1,+ssse3,+x87" "tune-cpu"="generic" "unsafe-fp-math"="false" "use-soft-float"="false" }

!llvm.module.flags = !{!0, !1, !2}
!llvm.ident = !{!3}

!0 = !{i32 2, !"SDK Version", [2 x i32] [i32 12, i32 1]}
!1 = !{i32 1, !"wchar_size", i32 4}
!2 = !{i32 7, !"PIC Level", i32 2}
!3 = !{!"Apple clang version 13.0.0 (clang-1300.0.29.30)"}

[int3]

Not sure where in the clang codebase this dso_local (or lack thereof) is being determined, though...

[smeenai]

In D119294#3374129, @int3 wrote:

Not sure where in the clang codebase this dso_local (or lack thereof) is being determined, though...

@MaskRay has done the most with dso_local recently, I think.

[modimo]

Clang-12 maintains dso_local on f1 as well, clang-13 and trunk lose it: https://godbolt.org/z/oejTzWsoW

[MaskRay]

I'm wondering: is there's a case where a dso_local function/global that comes into link with -flat_namespace/-interposable set? In ELF land interposability is set at compile time but with these flags on MachO it looks possible to set them at link time. If so that also makes pre-LTO optimizations strange because it might inline a function that later turns interposable. Given the previous statement I suspect I'm missing something here.

https://maskray.me/blog/2021-05-09-fno-semantic-interposition#clang--fno-semantic-interposition has some information about ELF -fno-semantic-interposition.

For ELF, yes. -fno-pic and -fpie have no interposition on defined symbols.
For -fpic, Clang defaults to -fhalf-no-semantic-interposition where interprocedural optimizations are available at compile time even if at link time the symbol are preemptible.
This seems strange but is important to retain the longstanding behavior (not regressing optimizations people get with default clang -fpic -O2 a.cc).
I actually hope that we can transit from the current confusing 3 states to: "Can Clang default to -fno-semantic-interposition?" but there may be some risk (perhaps some people can complain about some cases as described in https://maskray.me/blog/2021-05-16-elf-interposition-and-bsymbolic#interaction-with-ld_preload)

Hmm, maybe that's why clang doesn't seem to set dso_local when compiling for macos?

D98458 (in release/13.x but not in release/12.x) is related. Seems that XNU has reliance on not having dso_local for some cases.

[MaskRay]

lld/test/MachO/flat-namespace-interposable.s

51

add .private_extern test

[int3]

exclude private_externs from being interposable

lld/test/MachO/flat-namespace-interposable.s

51

whoops, I'd indeed forgotten to handle this case in the code. Thanks!

lld/MachO/Arch/ARM.cpp

struct ARM : TargetInfo {
 
   int64_t getEmbeddedAddend(MemoryBufferRef, uint64_t offset,
                             const relocation_info) const override;
   void relocateOne(uint8_t *loc, const Reloc &, uint64_t va,
                    uint64_t pc) const override;
 
   void writeStub(uint8_t *buf, const Symbol &) const override;
   void writeStubHelperHeader(uint8_t *buf) const override;
-  void writeStubHelperEntry(uint8_t *buf, const DylibSymbol &,
+  void writeStubHelperEntry(uint8_t *buf, const Symbol &,
                             uint64_t entryAddr) const override;
 
   void relaxGotLoad(uint8_t *loc, uint8_t type) const override;
   const RelocAttrs &getRelocAttrs(uint8_t type) const override;
   uint64_t getPageSize() const override { return 4 * 1024; }
 };
 
 } // namespace

 void ARM::writeStub(uint8_t *buf, const Symbol &sym) const {
   fatal("TODO: implement this");
 }
 
 void ARM::writeStubHelperHeader(uint8_t *buf) const {
   fatal("TODO: implement this");
 }
 
-void ARM::writeStubHelperEntry(uint8_t *buf, const DylibSymbol &sym,
+void ARM::writeStubHelperEntry(uint8_t *buf, const Symbol &sym,
                                uint64_t entryAddr) const {
   fatal("TODO: implement this");
 }
 
 void ARM::relaxGotLoad(uint8_t *loc, uint8_t type) const {
   fatal("TODO: implement this");
 }
 

lld/MachO/Arch/ARM64.cpp

 using namespace lld::macho;
 
 namespace {
 
 struct ARM64 : ARM64Common {
   ARM64();
   void writeStub(uint8_t *buf, const Symbol &) const override;
   void writeStubHelperHeader(uint8_t *buf) const override;
-  void writeStubHelperEntry(uint8_t *buf, const DylibSymbol &,
+  void writeStubHelperEntry(uint8_t *buf, const Symbol &,
                             uint64_t entryAddr) const override;
   const RelocAttrs &getRelocAttrs(uint8_t type) const override;
   void populateThunk(InputSection *thunk, Symbol *funcSym) override;
 };
 
 } // namespace
 
 // Random notes on reloc types:

 }
 
 static constexpr uint32_t stubHelperEntryCode[] = {
     0x18000050, // 00: ldr  w16, l0
     0x14000000, // 04: b    stubHelperHeader
     0x00000000, // 08: l0: .long 0
 };
 
-void ARM64::writeStubHelperEntry(uint8_t *buf8, const DylibSymbol &sym,
+void ARM64::writeStubHelperEntry(uint8_t *buf8, const Symbol &sym,
                                  uint64_t entryVA) const {
   ::writeStubHelperEntry(buf8, stubHelperEntryCode, sym, entryVA);
 }
 
 // A thunk is the relaxed variation of stubCode. We don't need the
 // extra indirection through a lazy pointer because the target address
 // is known at link time.
 static constexpr uint32_t thunkCode[] = {

lld/MachO/Arch/ARM64Common.h

inline void writeStubHelperHeader(uint8_t *buf8,
   buf32[3] = encodePage21(d, stubHelperHeaderCode[3],
                           pageBits(binderVA) - pcPageBits(3));
   buf32[4] = encodePageOff12(stubHelperHeaderCode[4], binderVA);
   buf32[5] = stubHelperHeaderCode[5];
 }
 
 inline void writeStubHelperEntry(uint8_t *buf8,
                                  const uint32_t stubHelperEntryCode[3],
-                                 const DylibSymbol &sym, uint64_t entryVA) {
+                                 const Symbol &sym, uint64_t entryVA) {
   auto *buf32 = reinterpret_cast<uint32_t *>(buf8);
   auto pcVA = [entryVA](int i) { return entryVA + i * sizeof(uint32_t); };
   uint64_t stubHelperHeaderVA = in.stubHelper->addr;
   buf32[0] = stubHelperEntryCode[0];
   buf32[1] = encodeBranch26({&sym, "stub helper"}, stubHelperEntryCode[1],
                             stubHelperHeaderVA - pcVA(1));
   buf32[2] = sym.lazyBindOffset;
 }
 
 } // namespace macho
 } // namespace lld
 
 #endif

lld/MachO/Arch/ARM64_32.cpp

 using namespace lld::macho;
 
 namespace {
 
 struct ARM64_32 : ARM64Common {
   ARM64_32();
   void writeStub(uint8_t *buf, const Symbol &) const override;
   void writeStubHelperHeader(uint8_t *buf) const override;
-  void writeStubHelperEntry(uint8_t *buf, const DylibSymbol &,
+  void writeStubHelperEntry(uint8_t *buf, const Symbol &,
                             uint64_t entryAddr) const override;
   const RelocAttrs &getRelocAttrs(uint8_t type) const override;
 };
 
 } // namespace
 
 // These are very similar to ARM64's relocation attributes, except that we don't
 // have the BYTE8 flag set.

 }
 
 static constexpr uint32_t stubHelperEntryCode[] = {
     0x18000050, // 00: ldr  w16, l0
     0x14000000, // 04: b    stubHelperHeader
     0x00000000, // 08: l0: .long 0
 };
 
-void ARM64_32::writeStubHelperEntry(uint8_t *buf8, const DylibSymbol &sym,
+void ARM64_32::writeStubHelperEntry(uint8_t *buf8, const Symbol &sym,
                                     uint64_t entryVA) const {
   ::writeStubHelperEntry(buf8, stubHelperEntryCode, sym, entryVA);
 }
 
 ARM64_32::ARM64_32() : ARM64Common(ILP32()) {
   cpuType = CPU_TYPE_ARM64_32;
   cpuSubtype = CPU_SUBTYPE_ARM64_V8;
 

lld/MachO/Arch/X86_64.cpp

struct X86_64 : TargetInfo {
 
   int64_t getEmbeddedAddend(MemoryBufferRef, uint64_t offset,
                             const relocation_info) const override;
   void relocateOne(uint8_t *loc, const Reloc &, uint64_t va,
                    uint64_t relocVA) const override;
 
   void writeStub(uint8_t *buf, const Symbol &) const override;
   void writeStubHelperHeader(uint8_t *buf) const override;
-  void writeStubHelperEntry(uint8_t *buf, const DylibSymbol &,
+  void writeStubHelperEntry(uint8_t *buf, const Symbol &,
                             uint64_t entryAddr) const override;
 
   void relaxGotLoad(uint8_t *loc, uint8_t type) const override;
   const RelocAttrs &getRelocAttrs(uint8_t type) const override;
   uint64_t getPageSize() const override { return 4 * 1024; }
 };
 
 } // namespace
writeRipRelative(d, buf, in.stubHelper->addr, 0xf,
                        in.stubHelper->stubBinder->gotIndex * LP64::wordSize);
 }
 
 static constexpr uint8_t stubHelperEntry[] = {
     0x68, 0, 0, 0, 0, // 0x0: pushq <bind offset>
     0xe9, 0, 0, 0, 0, // 0x5: jmp <__stub_helper>
 };
 
-void X86_64::writeStubHelperEntry(uint8_t *buf, const DylibSymbol &sym,
+void X86_64::writeStubHelperEntry(uint8_t *buf, const Symbol &sym,
                                   uint64_t entryAddr) const {
   memcpy(buf, stubHelperEntry, sizeof(stubHelperEntry));
   write32le(buf + 1, sym.lazyBindOffset);
   writeRipRelative({&sym, "stub helper"}, buf, entryAddr,
                    sizeof(stubHelperEntry), in.stubHelper->addr);
 }
 
 void X86_64::relaxGotLoad(uint8_t *loc, uint8_t type) const {

lld/MachO/SymbolTable.cpp

if (!wasInserted) {
     } else if (auto *dysym = dyn_cast<DylibSymbol>(s)) {
       overridesWeakDef = !isWeakDef && dysym->isWeakDef();
       dysym->unreference();
     }
     // Defined symbols take priority over other types of symbols, so in case
     // of a name conflict, we fall through to the replaceSymbol() call below.
   }
 
+  // With -flat_namespace, all extern symbols in dylibs are interposable.
+  bool interposable = config->namespaceKind == NamespaceKind::flat &&
+                      (config->outputType == MachO::MH_DYLIB ||
+                       config->outputType == MachO::MH_BUNDLE);
   Defined *defined = replaceSymbol<Defined>(
       s, name, file, isec, value, size, isWeakDef, /*isExternal=*/true,
       isPrivateExtern, isThumb, isReferencedDynamically, noDeadStrip,
-      overridesWeakDef, isWeakDefCanBeHidden);
+      overridesWeakDef, isWeakDefCanBeHidden, interposable);
   return defined;
 }
 
 Symbol *SymbolTable::addUndefined(StringRef name, InputFile *file,
                                   bool isWeakRef) {
   Symbol *s;
   bool wasInserted;
   std::tie(s, wasInserted) = insert(name, file);

lld/MachO/Symbols.h

public:
 
   virtual uint64_t getVA() const { return 0; }
 
   virtual bool isWeakDef() const { llvm_unreachable("cannot be weak def"); }
 
   // Only undefined or dylib symbols can be weak references. A weak reference
   // need not be satisfied at runtime, e.g. due to the symbol not being
   // available on a given target platform.
-  virtual bool isWeakRef() const { llvm_unreachable("cannot be a weak ref"); }
+  virtual bool isWeakRef() const { return false; }
 
   virtual bool isTlv() const { llvm_unreachable("cannot be TLV"); }
 
   // Whether this symbol is in the GOT or TLVPointer sections.
   bool isInGot() const { return gotIndex != UINT32_MAX; }
 
   // Whether this symbol is in the StubsSection.
   bool isInStubs() const { return stubsIndex != UINT32_MAX; }
 
   uint64_t getStubVA() const;
   uint64_t getGotVA() const;
   uint64_t getTlvVA() const;
   uint64_t resolveBranchVA() const {
     assert(isa<Defined>(this) || isa<DylibSymbol>(this));
     return isInStubs() ? getStubVA() : getVA();
   }
   uint64_t resolveGotVA() const { return isInGot() ? getGotVA() : getVA(); }
   uint64_t resolveTlvVA() const { return isInGot() ? getTlvVA() : getVA(); }
 
   // The index of this symbol in the GOT or the TLVPointer section, depending
   // on whether it is a thread-local. A given symbol cannot be referenced by
   // both these sections at once.
   uint32_t gotIndex = UINT32_MAX;
-
+  uint32_t lazyBindOffset = UINT32_MAX;
+  uint32_t stubsHelperIndex = UINT32_MAX;
   uint32_t stubsIndex = UINT32_MAX;
-
   uint32_t symtabIndex = UINT32_MAX;
 
   InputFile *getFile() const { return file; }
 
 protected:
   Symbol(Kind k, StringRefZ name, InputFile *file)
       : symbolKind(k), nameData(name.data), file(file), nameSize(name.size),
         isUsedInRegularObj(!file || isa<ObjFile>(file)),
public:
   bool used : 1;
 };
 
 class Defined : public Symbol {
 public:
   Defined(StringRefZ name, InputFile *file, InputSection *isec, uint64_t value,
           uint64_t size, bool isWeakDef, bool isExternal, bool isPrivateExtern,
           bool isThumb, bool isReferencedDynamically, bool noDeadStrip,
-          bool canOverrideWeakDef = false, bool isWeakDefCanBeHidden = false);
+          bool canOverrideWeakDef = false, bool isWeakDefCanBeHidden = false,
+          bool interposable = false);
 
   bool isWeakDef() const override { return weakDef; }
   bool isExternalWeakDef() const {
     return isWeakDef() && isExternal() && !privateExtern;
   }
   bool isTlv() const override;
 
   bool isExternal() const { return external; }
public:
   // This is information for the static linker, and it's also written to the
   // output file's symbol table for tools running later (such as `strip`).
   bool referencedDynamically : 1;
   // Set on symbols that should not be removed by dead code stripping.
   // Set for example on `__attribute__((used))` globals, or on some Objective-C
   // metadata. This is information only for the static linker and not written
   // to the output.
   bool noDeadStrip : 1;
+  // Whether references to this symbol can be interposed at runtime to point to
+  // a different symbol definition (with the same name). For example, if both
+  // dylib A and B define an interposable symbol _foo, and we load A before B at
+  // runtime, then all references to _foo within dylib B will point to the
+  // definition in dylib A.
+  //
+  // Only extern symbols may be interposable.
+  bool interposable : 1;
 
   bool weakDefCanBeHidden : 1;
 
 private:
   const bool weakDef : 1;
   const bool external : 1;
 
 public:
public:
 
   DylibFile *getFile() const {
     assert(!isDynamicLookup());
     return cast<DylibFile>(file);
   }
 
   static bool classof(const Symbol *s) { return s->kind() == DylibKind; }
 
-  uint32_t stubsHelperIndex = UINT32_MAX;
-  uint32_t lazyBindOffset = UINT32_MAX;
-
   RefState getRefState() const { return refState; }
 
   void reference(RefState newState) {
     assert(newState > RefState::Unreferenced);
     if (refState == RefState::Unreferenced && file)
       getFile()->numReferencedSymbols++;
     refState = std::max(refState, newState);
   }

lld/MachO/Symbols.cpp

 #include "InputFiles.h"
 #include "SyntheticSections.h"
 #include "lld/Common/Strings.h"
 
 using namespace llvm;
 using namespace lld;
 using namespace lld::macho;
 
-static_assert(sizeof(void *) != 8 || sizeof(Symbol) == 48,
+static_assert(sizeof(void *) != 8 || sizeof(Symbol) == 56,
               "Try to minimize Symbol's size; we create many instances");
 
 // The Microsoft ABI doesn't support using parent class tail padding for child
 // members, hence the _MSC_VER check.
 #if !defined(_MSC_VER)
-static_assert(sizeof(void *) != 8 || sizeof(Defined) == 80,
+static_assert(sizeof(void *) != 8 || sizeof(Defined) == 88,
               "Try to minimize Defined's size; we create many instances");
 #endif
 
 static_assert(sizeof(SymbolUnion) == sizeof(Defined),
               "Defined should be the largest Symbol kind");
 
 std::string lld::toString(const Symbol &sym) {
   return demangle(sym.getName(), config->demangle);
 }
 
 std::string lld::toMachOString(const object::Archive::Symbol &b) {
   return demangle(b.getName(), config->demangle);
 }
 
 uint64_t Symbol::getStubVA() const { return in.stubs->getVA(stubsIndex); }
 uint64_t Symbol::getGotVA() const { return in.got->getVA(gotIndex); }
 uint64_t Symbol::getTlvVA() const { return in.tlvPointers->getVA(gotIndex); }
 
 Defined::Defined(StringRefZ name, InputFile *file, InputSection *isec,
                  uint64_t value, uint64_t size, bool isWeakDef, bool isExternal,
                  bool isPrivateExtern, bool isThumb,
                  bool isReferencedDynamically, bool noDeadStrip,
-                 bool canOverrideWeakDef, bool isWeakDefCanBeHidden)
+                 bool canOverrideWeakDef, bool isWeakDefCanBeHidden,
+                 bool interposable)
     : Symbol(DefinedKind, name, file), overridesWeakDef(canOverrideWeakDef),
       privateExtern(isPrivateExtern), includeInSymtab(true), thumb(isThumb),
       referencedDynamically(isReferencedDynamically), noDeadStrip(noDeadStrip),
-      weakDefCanBeHidden(isWeakDefCanBeHidden), weakDef(isWeakDef),
-      external(isExternal), isec(isec), value(value), size(size) {
+      interposable(interposable), weakDefCanBeHidden(isWeakDefCanBeHidden),
+      weakDef(isWeakDef), external(isExternal), isec(isec), value(value),
+      size(size) {
   if (isec) {
     isec->symbols.push_back(this);
     // Maintain sorted order.
     for (auto it = isec->symbols.rbegin(), rend = isec->symbols.rend();
          it != rend; ++it) {
       auto next = std::next(it);
       if (next == rend)
         break;

lld/MachO/SyntheticSections.h

 class BindingSection final : public LinkEditSection {
 public:
   BindingSection();
   void finalizeContents() override;
   uint64_t getRawSize() const override { return contents.size(); }
   bool isNeeded() const override { return !bindingsMap.empty(); }
   void writeTo(uint8_t *buf) const override;
 
-  void addEntry(const DylibSymbol *dysym, const InputSection *isec,
-                uint64_t offset, int64_t addend = 0) {
+  void addEntry(const Symbol *dysym, const InputSection *isec, uint64_t offset,
+                int64_t addend = 0) {
     bindingsMap[dysym].emplace_back(addend, Location(isec, offset));
   }
 
 private:
-  BindingsMap<const DylibSymbol *> bindingsMap;
+  BindingsMap<const Symbol *> bindingsMap;
   SmallVector<char, 128> contents;
 };
 
 // Stores bind opcodes for telling dyld which weak symbols need coalescing.
 // There are two types of entries in this section:
 //
 //   1) Non-weak definitions: This is a symbol definition that weak symbols in
 //   other dylibs should coalesce to.

 public:
   LazyBindingSection();
   void finalizeContents() override;
   uint64_t getRawSize() const override { return contents.size(); }
   bool isNeeded() const override { return !entries.empty(); }
   void writeTo(uint8_t *buf) const override;
   // Note that every entry here will by referenced by a corresponding entry in
   // the StubHelperSection.
-  void addEntry(DylibSymbol *dysym);
-  const llvm::SetVector<DylibSymbol *> &getEntries() const { return entries; }
+  void addEntry(Symbol *dysym);
+  const llvm::SetVector<Symbol *> &getEntries() const { return entries; }
 
 private:
-  uint32_t encode(const DylibSymbol &);
+  uint32_t encode(const Symbol &);
 
-  llvm::SetVector<DylibSymbol *> entries;
+  llvm::SetVector<Symbol *> entries;
   SmallVector<char, 128> contents;
   llvm::raw_svector_ostream os{contents};
 };
 
 // Stores a trie that describes the set of exported symbols.
 class ExportSection final : public LinkEditSection {
 public:
   ExportSection();

lld/MachO/SyntheticSections.cpp

void macho::addNonLazyBindingEntries(const Symbol *sym,
   if (const auto *dysym = dyn_cast<DylibSymbol>(sym)) {
     in.binding->addEntry(dysym, isec, offset, addend);
     if (dysym->isWeakDef())
       in.weakBinding->addEntry(sym, isec, offset, addend);
   } else if (const auto *defined = dyn_cast<Defined>(sym)) {
     in.rebase->addEntry(isec, offset);
     if (defined->isExternalWeakDef())
       in.weakBinding->addEntry(sym, isec, offset, addend);
+    else if (defined->interposable)
+      in.binding->addEntry(sym, isec, offset, addend);
   } else {
     // Undefined symbols are filtered out in scanRelocations(); we should never
     // get here
     llvm_unreachable("cannot bind to an undefined symbol");
   }
 }
 
 void NonLazyPointerSectionBase::addEntry(Symbol *sym) {

 // Non-weak bindings need to have their dylib ordinal encoded as well.
 static int16_t ordinalForDylibSymbol(const DylibSymbol &dysym) {
   if (config->namespaceKind == NamespaceKind::flat || dysym.isDynamicLookup())
     return static_cast<int16_t>(BIND_SPECIAL_DYLIB_FLAT_LOOKUP);
   assert(dysym.getFile()->isReferenced());
   return dysym.getFile()->ordinal;
 }
 
+static int16_t ordinalForSymbol(const Symbol &sym) {
+  if (const auto *dysym = dyn_cast<DylibSymbol>(&sym))
+    return ordinalForDylibSymbol(*dysym);
+  assert(cast<Defined>(&sym)->interposable);
+  return BIND_SPECIAL_DYLIB_FLAT_LOOKUP;
+}
+
 static void encodeDylibOrdinal(int16_t ordinal, raw_svector_ostream &os) {
   if (ordinal <= 0) {
     os << static_cast<uint8_t>(BIND_OPCODE_SET_DYLIB_SPECIAL_IMM |
                                (ordinal & BIND_IMMEDIATE_MASK));
   } else if (ordinal <= BIND_IMMEDIATE_MASK) {
     os << static_cast<uint8_t>(BIND_OPCODE_SET_DYLIB_ORDINAL_IMM | ordinal);
   } else {
     os << static_cast<uint8_t>(BIND_OPCODE_SET_DYLIB_ORDINAL_ULEB);

 // entry. It does *not* clear the record state after doing the bind, so
 // subsequent opcodes only need to encode the differences between bindings.
 void BindingSection::finalizeContents() {
   raw_svector_ostream os{contents};
   Binding lastBinding;
   int16_t lastOrdinal = 0;
 
   for (auto &p : sortBindings(bindingsMap)) {
-    const DylibSymbol *sym = p.first;
+    const Symbol *sym = p.first;
     std::vector<BindingEntry> &bindings = p.second;
     uint8_t flags = BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM;
     if (sym->isWeakRef())
       flags |= BIND_SYMBOL_FLAGS_WEAK_IMPORT;
     os << flags << sym->getName() << '\0'
        << static_cast<uint8_t>(BIND_OPCODE_SET_TYPE_IMM | BIND_TYPE_POINTER);
-    int16_t ordinal = ordinalForDylibSymbol(*sym);
+    int16_t ordinal = ordinalForSymbol(*sym);
     if (ordinal != lastOrdinal) {
       encodeDylibOrdinal(ordinal, os);
       lastOrdinal = ordinal;
     }
     std::vector<BindIR> opcodes;
     for (const BindingEntry &b : bindings)
       encodeBinding(b.target.isec->parent,
                     b.target.isec->getOffset(b.target.offset), b.addend,
return target->stubHelperHeaderSize +
          in.lazyBinding->getEntries().size() * target->stubHelperEntrySize;
 }
 
 bool StubHelperSection::isNeeded() const { return in.lazyBinding->isNeeded(); }
 
 void StubHelperSection::writeTo(uint8_t *buf) const {
   target->writeStubHelperHeader(buf);
   size_t off = target->stubHelperHeaderSize;
-  for (const DylibSymbol *sym : in.lazyBinding->getEntries()) {
+  for (const Symbol *sym : in.lazyBinding->getEntries()) {
     target->writeStubHelperEntry(buf + off, *sym, addr + off);
     off += target->stubHelperEntrySize;
   }
 }
 
 void StubHelperSection::setup() {
   Symbol *binder = symtab->addUndefined("dyld_stub_binder", /*file=*/nullptr,
                                         /*isWeakRef=*/false);

 }
 
 LazyBindingSection::LazyBindingSection()
     : LinkEditSection(segment_names::linkEdit, section_names::lazyBinding) {}
 
 void LazyBindingSection::finalizeContents() {
   // TODO: Just precompute output size here instead of writing to a temporary
   // buffer
-  for (DylibSymbol *sym : entries)
+  for (Symbol *sym : entries)
     sym->lazyBindOffset = encode(*sym);
 }
 
 void LazyBindingSection::writeTo(uint8_t *buf) const {
   memcpy(buf, contents.data(), contents.size());
 }
 
-void LazyBindingSection::addEntry(DylibSymbol *dysym) {
-  if (entries.insert(dysym)) {
-    dysym->stubsHelperIndex = entries.size() - 1;
+void LazyBindingSection::addEntry(Symbol *sym) {
+  if (entries.insert(sym)) {
+    sym->stubsHelperIndex = entries.size() - 1;
     in.rebase->addEntry(in.lazyPointers->isec,
-                        dysym->stubsIndex * target->wordSize);
+                        sym->stubsIndex * target->wordSize);
   }
 }
 
 // Unlike the non-lazy binding section, the bind opcodes in this section aren't
 // interpreted all at once. Rather, dyld will start interpreting opcodes at a
 // given offset, typically only binding a single symbol before it finds a
 // BIND_OPCODE_DONE terminator. As such, unlike in the non-lazy-binding case,
 // we cannot encode just the differences between symbols; we have to emit the
 // complete bind information for each symbol.
-uint32_t LazyBindingSection::encode(const DylibSymbol &sym) {
+uint32_t LazyBindingSection::encode(const Symbol &sym) {
   uint32_t opstreamOffset = contents.size();
   OutputSegment *dataSeg = in.lazyPointers->parent;
   os << static_cast<uint8_t>(BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB |
                              dataSeg->index);
   uint64_t offset = in.lazyPointers->addr - dataSeg->addr +
                     sym.stubsIndex * target->wordSize;
   encodeULEB128(offset, os);
-  encodeDylibOrdinal(ordinalForDylibSymbol(sym), os);
+  encodeDylibOrdinal(ordinalForSymbol(sym), os);
 
   uint8_t flags = BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM;
   if (sym.isWeakRef())
     flags |= BIND_SYMBOL_FLAGS_WEAK_IMPORT;
 
   os << flags << sym.getName() << '\0'
      << static_cast<uint8_t>(BIND_OPCODE_DO_BIND)
      << static_cast<uint8_t>(BIND_OPCODE_DONE);

lld/MachO/Target.h

getEmbeddedAddend(llvm::MemoryBufferRef, uint64_t offset,
                     const llvm::MachO::relocation_info) const = 0;
   virtual void relocateOne(uint8_t *loc, const Reloc &, uint64_t va,
                            uint64_t relocVA) const = 0;
 
   // Write code for lazy binding. See the comments on StubsSection for more
   // details.
   virtual void writeStub(uint8_t *buf, const Symbol &) const = 0;
   virtual void writeStubHelperHeader(uint8_t *buf) const = 0;
-  virtual void writeStubHelperEntry(uint8_t *buf, const DylibSymbol &,
+  virtual void writeStubHelperEntry(uint8_t *buf, const Symbol &,
                                     uint64_t entryAddr) const = 0;
 
   // Symbols may be referenced via either the GOT or the stubs section,
   // depending on the relocation type. prepareSymbolRelocation() will set up the
   // GOT/stubs entries, and resolveSymbolVA() will return the addresses of those
   // entries. resolveSymbolVA() may also relax the target instructions to save
   // on a level of address indirection.
   virtual void relaxGotLoad(uint8_t *loc, uint8_t type) const = 0;

lld/MachO/Writer.cpp

static void prepareBranchTarget(Symbol *sym) {
   } else if (auto *defined = dyn_cast<Defined>(sym)) {
     if (defined->isExternalWeakDef()) {
       if (in.stubs->addEntry(sym)) {
         in.rebase->addEntry(in.lazyPointers->isec,
                             sym->stubsIndex * target->wordSize);
         in.weakBinding->addEntry(sym, in.lazyPointers->isec,
                                  sym->stubsIndex * target->wordSize);
       }
+    } else if (defined->interposable) {
+      if (in.stubs->addEntry(sym))
+        in.lazyBinding->addEntry(sym);
     }
   } else {
     llvm_unreachable("invalid branch target symbol type");
   }
 }
 
 // Can a symbol's address can only be resolved at runtime?
 static bool needsBinding(const Symbol *sym) {
   if (isa<DylibSymbol>(sym))
     return true;
   if (const auto *defined = dyn_cast<Defined>(sym))
-    return defined->isExternalWeakDef();
+    return defined->isExternalWeakDef() || defined->interposable;
   return false;
 }
 
 static void prepareSymbolRelocation(Symbol *sym, const InputSection *isec,
                                     const lld::macho::Reloc &r) {
   assert(sym->isLive());
   const RelocAttrs &relocAttrs = target->getRelocAttrs(r.type);
 

lld/test/MachO/flat-namespace-dysyms.s

 # REQUIRES: x86
 # RUN: rm -rf %t; split-file %s %t
 
 # RUN: llvm-mc -filetype=obj -triple=x86_64-apple-macos -o %t/foo.o %t/foo.s
 # RUN: %lld -dylib -o %t/foo.dylib %t/foo.o
 
 # RUN: llvm-mc -filetype=obj -triple=x86_64-apple-macos -o %t/bar.o %t/bar.s
 # RUN: %lld -lSystem -dylib -o %t/bar.dylib %t/bar.o %t/foo.dylib
 
 # RUN: llvm-mc -filetype=obj -triple=x86_64-apple-macos -o %t/baz.o %t/baz.s
 # RUN: %lld -lSystem -dylib -o %t/baz.dylib %t/baz.o %t/bar.dylib
 
 # RUN: llvm-mc -filetype=obj -triple=x86_64-apple-macos -o %t/main.o %t/main.s
 
 ## With flat_namespace, the linker automatically looks in foo.dylib and
 ## bar.dylib too, but it doesn't add a LC_LOAD_DYLIB for it.
 # RUN: %lld -flat_namespace -lSystem %t/main.o %t/baz.dylib -o %t/out -t \
 # RUN:  --reproduce %t/repro.tar | FileCheck --check-prefix=T %s
 ## FIXME: The `bar.dylib` line should use `T-NEXT`, but on Windows we load
 ## libSystem.tbd with different slash styles and end up loading it twice
 ## for that reason.
 # T:      main.o
 # T-NEXT: baz.dylib
 # T:      bar.dylib
 # T-NEXT: foo.dylib
 # RUN: llvm-objdump --macho --all-headers %t/out \
 # RUN:     | FileCheck --check-prefix=HEADERBITS %s
 # RUN: llvm-objdump --macho --bind --lazy-bind --weak-bind %t/out \
 # RUN:     | FileCheck --check-prefix=FLAT %s
 # RUN: llvm-nm -m %t/out | FileCheck --check-prefix=FLATSYM %s
 # RUN: llvm-readobj --syms %t/out | FileCheck --check-prefix=FLATSYM-READOBJ %s
 # RUN: cd %t
 # RUN: tar -tf repro.tar | FileCheck -DPATH='%:t.dir' --check-prefix=REPRO %s
 # RUN: tar -xf repro.tar repro/response.txt
 # RUN: FileCheck --implicit-check-not=dylib --check-prefix=RESPONSE %s \
 # RUN:     < %t/repro/response.txt
 
 # HEADERBITS-NOT: NOUNDEFS
 # HEADERBITS-NOT: TWOLEVEL
 # HEADERBITS: DYLDLINK
 # HEADERBITS-NOT: foo.dylib
 # HEADERBITS-NOT: bar.dylib
 
 # FLAT: Bind table:
 # FLAT: __DATA_CONST __got          0x{{[0-9a-f]*}} pointer         0 flat-namespace   dyld_stub_binder
 # FLAT: Lazy bind table:
 # FLAT-DAG: __DATA   __la_symbol_ptr    0x{{[0-9a-f]*}} flat-namespace   _bar
 # FLAT-DAG: __DATA   __la_symbol_ptr    0x{{[0-9a-f]*}} flat-namespace   _baz
 # FLAT-DAG: __DATA   __la_symbol_ptr    0x{{[0-9a-f]*}} flat-namespace   _foo
 
 ## No "(dynamically looked up)" because llvm-nm -m doesn't print that
 ## for files without MH_TWOLEVEL for some reason.
 # FLATSYM: (undefined) external _bar
 # FLATSYM: (undefined) external _baz
 # FLATSYM: (undefined) external _foo
 
 ## ...but `llvm-readobj --syms` does, so verify we put the right thing there.
 # FLATSYM-READOBJ: Flags [ (0xFE00)
 
 ## All 3 .dylibs should be in a --reproduce archive.
 # REPRO: baz.dylib
 # REPRO: bar.dylib
 # REPRO: foo.dylib
 
 ## ...but only baz.dylib should be in the response file:
 # RESPONSE: baz.dylib
 
 # Undefined symbols should still cause errors by default.
 # RUN: llvm-mc -filetype=obj -triple=x86_64-apple-macos \
 # RUN:     -o %t/main-with-undef.o %t/main-with-undef.s
 # RUN: not %lld -flat_namespace -lSystem %t/main-with-undef.o %t/bar.dylib \
 # RUN:     -o %t/out 2>&1 | FileCheck --check-prefix=UNDEF %s
 # UNDEF: error: undefined symbol: _quux
 
 #--- foo.s
 .globl _foo
 _foo:
   ret
 
 #--- bar.s
 .globl _bar
 _bar:
   callq _foo
   ret
 
 #--- baz.s
 .globl _baz
 _baz:
   callq _bar
   ret
 
 #--- main.s
 .globl _main
 _main:
   callq _foo
   callq _bar
   callq _baz
   ret
 
 #--- main-with-undef.s
 .globl _main
 _main:
   callq _foo
   callq _bar
   callq _baz
   callq _quux
   ret

lld/test/MachO/flat-namespace-interposable.s

+# REQUIRES: x86
+# RUN: rm -rf %t; split-file %s %t
+
+## With -flat_namespace, non-weak extern symbols in dylibs become interposable.
+## Check that we generate the correct bindings for them. The test also includes
+## other symbol types like weak externs to verify we continue to do the same
+## (correct) thing even when `-flat_namespace` is enabled, instead of generating
+## spurious bindings.
+
+# RUN: llvm-mc -filetype=obj -triple=x86_64-apple-macos -o %t/foo.o %t/foo.s
+# RUN: %lld -lSystem -flat_namespace -o %t/foo %t/foo.o
+# RUN: %lld -lSystem -dylib -flat_namespace -o %t/foo.dylib %t/foo.o
+# RUN: %lld -lSystem -bundle -flat_namespace -o %t/foo.bundle %t/foo.o
+# COM: llvm-objdump --macho --bind --lazy-bind --weak-bind %t/foo | FileCheck %s --check-prefix=EXEC
+# RUN: llvm-objdump --macho --bind --lazy-bind --weak-bind %t/foo.dylib | FileCheck %s --check-prefix=DYLIB
+# RUN: llvm-objdump --macho --bind --lazy-bind --weak-bind %t/foo.bundle | FileCheck %s --check-prefix=DYLIB
+
+## Executables with -flat_namespace don't have interposable externs.
+# EXEC:       Bind table:
+# EXEC-NEXT:  segment      section  address  type     addend dylib            symbol
+# EXEC-EMPTY:  
+# EXEC-NEXT:  Lazy bind table:
+# EXEC-NEXT:  segment  section      address  dylib    symbol
+# EXEC-EMPTY:  
+# EXEC-NEXT:  Weak bind table:
+# EXEC-NEXT:  segment  section          address  type     addend   symbol
+# EXEC-NEXT:  __DATA   __la_symbol_ptr  {{.*}}   pointer       0   _weak_extern
+# EXEC-NEXT:  __DATA   __data           {{.*}}   pointer       0   _weak_extern
+# EXEC-EMPTY:
+
+# DYLIB:       Bind table:
+# DYLIB-NEXT:  segment      section        address  type       addend dylib            symbol
+# DYLIB-DAG:   __DATA       __data         {{.*}}   pointer         0 flat-namespace   _extern
+# DYLIB-DAG:   __DATA       __thread_ptrs  {{.*}}   pointer         0 flat-namespace   _tlv
+# DYLIB-DAG:   __DATA_CONST __got          {{.*}}   pointer         0 flat-namespace   dyld_stub_binder
+# DYLIB-EMPTY:
+# DYLIB-NEXT:  Lazy bind table:
+# DYLIB-NEXT:  segment  section            address  dylib            symbol
+# DYLIB-NEXT:  __DATA   __la_symbol_ptr    {{.*}}   flat-namespace   _extern
+# DYLIB-EMPTY:
+# DYLIB-NEXT:  Weak bind table:
+# DYLIB-NEXT:  segment  section            address     type       addend   symbol
+# DYLIB-NEXT:  __DATA   __la_symbol_ptr    {{.*}}   pointer         0   _weak_extern
+# DYLIB-NEXT:  __DATA   __data             {{.*}}   pointer         0   _weak_extern
+
+#--- foo.s
+
+.globl _main, _extern, _weak_extern, _tlv
+.weak_definition _weak_extern
+
+_extern:
+  retq
+_weak_extern:
+  retq
+_local:
+  retq
+
+_main:
+  callq _extern
+  callq _weak_extern
+  callq _local
+  mov _tlv@TLVP(%rip), %rax
+  retq
+
+.data
+.quad _extern
+.quad _weak_extern
+.quad _local
+
+.section __DATA,__thread_vars,thread_local_variables
+_tlv:
+
+.subsections_via_symbols