[lld-macho] Add initial support for chained fixups

[BertalanD]

Summary

This commit adds support for chained fixups, which were introduced in
Apple's late 2020 OS releases. This format replaces the dyld opcodes
used for supplying rebase and binding information, and produces smaller
binaries and allows page-in linking.

A high-level overview of the format and my implementation can be found
in SyntheticSections.h.

This feature is not enabled by default for now, as further real world
testing is required to ensure there are no regressions.

Like in ld64, lazy binding is disabled when chained fixups are in use,
and the -init_offsets transformation is performed by default.

[thakis]

Very cool. I haven't really looked at it yet. (I'll play with it once the prerequisites are landed; fewer patch invocations then :) )

lld/MachO/Driver.cpp

1571

Emit a diag if makeChainedFixups is true but the deployment target (config->platformInfo.minimum) is too old to support them.

Below are no action required:

• Idea guying, not for this patch (and likely never): What does dyld do if a binary has both bind opcodes and chained fixups? Does it use the opcodes on older macOS (or iOS or…) versions but the fixups on newer versions?

• nit: I'd s/makeChainedFixups/emitFixupChains/ (to be closer to the flag name), but meh. Oh, you made it match the section, not the flag. Even more meh then, but s/make/emit/ in the variable still seems marginally better to me.

lld/MachO/SyntheticSections.h

668

Maybe mention that the motivation is that text pages can be relocated lazily at page-in time, and that they don't become dirty and can be discarded and paged in again as needed. That is, the benefits are:

• somewhat faster startup (no need to do all relocs at app startup)
• more memory-efficient, since text pages can be discarded

That motivates why the fixups are per-page and then chained (since that's how they're accessed at page-in time).

[BertalanD]

lld/MachO/Driver.cpp

1571

Emit a diag if makeChainedFixups is true but the deployment target (config->platformInfo.minimum) is too old to support them.

Will do!

Idea guying, not for this patch (and likely never): What does dyld do if a binary has both bind opcodes and chained fixups? Does it use the opcodes on older macOS (or iOS or…) versions but the fixups on newer versions?

That would be an awesome hack. We could *maybe* make chained fixups' new binding behavior (always eager, uses the GOT instead of LazyPointerSection) work with bind opcodes, but it still wouldn't work with an older dyld. LC_DYLD_CHAINED_FIXUPS is defined as 0x34 | LC_REQ_DYLD, which means dyld will refuse to load the file with a "load command unknown" message if it does not know about it.

nit: I'd s/makeChainedFixups/emitFixupChains/ (to be closer to the flag name), but meh. Oh, you made it match the section, not the flag. Even more meh then, but s/make/emit/ in the variable still seems marginally better to me.

makeChainedFixups it is then. The double "fixup chains" and "chained fixups" naming is not ideal, but oh well. Apple's user-facing documentation uses the latter, that's what we should do as well IMO.

[BertalanD]

lld/MachO/Driver.cpp

1571

of course I meant emitFixupChains. note to self: don't respond to code review at 11 PM.

[BertalanD]

Added diagnostics for too old deployment targets, rebase target address overflows, and tweaked comments.

[BertalanD]

Attempt to fix the Windows build.

[thakis]

lld/test/MachO/chained-fixups-addend.s

15

I just noticed that otool -chained_fixups -dyld_info a.out prints dyld_info output before chained_fixups output. We should probably change llvm-otool to match (and then update this test – looks like that should be doable?)

[BertalanD]

lld/test/MachO/chained-fixups-addend.s

15

I believe the symbol table should also come before either of these. It would simplify the flat-namespace-interposable test. Could we also fix that in D132865?

[thakis]

lld/test/MachO/chained-fixups-addend.s

15

Do you mean -I output? That's already before the two others. Do you mean --syms output? That doesn't have an otool equivalent, so we can't match otool's order there (which D132865 is about).

Sorry, I'm not sure what you mean. I'm guessing you mean "It'd be convenient if objdump --syms output was before --chained-fixups and --dyld-info output". If so, sure go for it, but imho it doesn't belong in a patch that makes output consistent with otool. (…at least I think there's no way to trigger --syms output via llvm-otool?)

[BertalanD]

lld/test/MachO/chained-fixups-addend.s

15

What I meant to write (and spectacularly failed to do so) is that llvm-objdump --macho --syms --dyld-info should print the symbol table before the fixups just like it puts the symbol table before --bind or --rebase, for consistency. Not sure where I got the idea about Apple otool being like this. Anyway, I agree that I should put it up as a separate patch then.

[BertalanD]

Rebase on top of D132865 and D132947.

[thakis]

Sorry that the review is taking so long! Here's one question about the driver code (and a few minor suggestions).

lld/MachO/Driver.cpp

933

(This seems unrelated. I'd land that separately if you want (no review needed), or just revert it. This runs just once, so std::vector is good enough, and in c++20 vector is constexpr anyways. And having to manually repeat the number of elements is a tiny bit inconvenient.)

982

Shouldn't this return false too (…or fall through to the return false two lines further down)? (If this is intentional, then this check should probably be below the arch and pic checks below – else we return true here without. checkout archs and pic!)

Does ld just warn when this happens? Maybe we should see if we can get away with making this an error.

Maybe it'd be good to have some tests for the diags here.

1705

If you want, you can land moving this further up in a separate commit too (
"""
[lld/mac] Move isPic up

Needed for chainedFixups patch.
No behavior change.
""") – just land, no review needed.

But keeping it here is fine too.

lld/MachO/Options.td

1234

I think you can move these out of undocumented. The help text says "experimental", that seems clear enough :)

(…and then we won't forget to move it out of undocumented when we enable it by default.)

[BertalanD]

Thank you for the review!

lld/MachO/Driver.cpp

933

I know this change is absolutely insignificant, but this pointless allocation has been bothering me so much...

I'll land this change separately.

982

Shouldn't this return false too (…or fall through to the return false two lines further down)?

Oh, right. It should definitely fall through. I didn't want to make this a hard error, because ld64 doesn't have such a diagnostic at all. I figured we might want to play around with enabling it for unsupported targets to see what happens, and calling error() would have prevented that.

As for the rest of the diagnostics in this function:

• Chained fixups do exist for arm64_32, but this patch does not attempt to implement the 32-bit encoding, which has some peculiarities due to the next offsets not being able to encode the whole range of a page. And I don't think we should make things more complicated for the sake of a probably soon-to-be-obsoleted platform.
• ld64 falls back to generating dyld opcodes when PIE is disabled, even if chained fixups were explicitly requested with -fixup_chains. That's just weird.

Maybe it'd be good to have some tests for the diags here.

Agreed, I'm on it.

lld/MachO/Options.td

1234

I'll move it into grp_rare then. -fixup_chains is not documented in the ld64 man page, but I guess it's useful enough to move it to be near the less esoteric options.

[thakis]

This is excellent.

Apologies for taking so long to take a real look.

A long list of nits below, but nothing substantial.

lld/MachO/Arch/ARM64Common.h

117

(this should be

encodePage21(&buf32[0], d, stubCode[0], pageBits(pointerVA) - pcPageBits);
encodePageOff12(&buf32[1], d, stubCode[1], pointerVA);

after rebasing across D133269)

lld/MachO/Driver.cpp

933

Software is one of the few areas where human brains have to deal with 9+ orders of magnitude within a relatively short timespan: a single bit can be a critical source of a bug, and right after that you might think about how to best organize gigabytes of data. You might try to shave off cycles form a very hot inner loop, or have a function that's 10^6 times as inefficient than it could be and it'll still finished imperceptibly fast as it's only called once.

This is really hard to wrap your brain around.

I get it, superfluous allocations feel silly. But a _single_ superfluous allocation that happens just one during startup is absolutely, completely irrelevant. (This one happens to go away by itself when we adopt C++20 too, but that fact really doesn't matter here.)

Go ahead and change it if you want (in a separate commit), but learning to quiet the part of the brain that screams and shouts "this! is! so! inefficient!" and considering if it actually matters is imho a very useful skill to have.

(In contrast, increasing readability and clarity code on the other hand is almost always worth it.)

1526

Maybe add something like "Like in ld64, enabling chained fixups enables the -init_offsets transformation" to commit message.

lld/MachO/SyntheticSections.cpp

340

nit: This conditional is duplicated in writeChainedFixup. Should it be in a file-local-static definedNeedsBind() helper?

346

nit: return here, keep non-chained path dedented and don't add an else

355

Maybe assert(reinterpret_cast<uintptr_t>(buf) % target->wordSize == 0 && "unaligned fixup address")? (optional)

357

nit: maybe & 0xf'ffff'ffff to make the truncation explicit?

373

(same)

2094

Since we always write this section: Can we end up in a situation where we write this section but pageStarts is empty (and calling back() is UB)?

AFAICT pageStarts is only added to if there actually are fixups, and a tiny program not calling anything might not have any (?)

2102

Out of curiosity: What are the implications of (not) doing this?

2106

(same question as above)

2140

Is the on-disk layout of this section described anywhere? Consider putting a short comment at the top of this function that describes the layout, maybe.

Maybe something like:

// LC_DYLD_CHAINED_FIXUPS data consists of (in this order):
// * A dyld_chained_fixups_header
// * A dyld_chained_starts_in_image
// * One dyld_chained_starts_in_segment per segment
// * List of all imports (dyld_chained_import, dyld_chained_import_addend, 
     or dyld_chained_import_addend64)
// * Names of imported symbols

(Do we have flexibility where to put the symbol name table? Does ld64 put it after the imports?)

2142

Maybe add // This is step 3 of the algorithm described in the class comment of ChainedFixupsSection.

2149

Explicitly list needed captures instead of saying &. & capture lists are bug magnets. (In this case it's obviously harmless, but it's imho still a good habit to almost never capture &)

2161

What is this hole for? Is it filled elsewhere?

i.e. maybe a comment like "dyld_chained_starts_in_image is followed by an uint32_t for each segment. Leave room for it, and fill it via the segStarts pointer. This is extremely obvious once you know it, but it took me a bit to figure out. (Now that I did, it's obvious to me too and I don't know why it took me that long. But it did.)

2168

Cute. But doesn't buf = alignTo<8>(buf); do the same thing in slightly less roundabout? :D

2178

nit: Maybe make writeImport return void and do buf += importEntrySize(importFormat) in the next line instead? feels a bit clearer to me – that way, writeImport has only a single responsibility.

(But a writing function returning how much it wrote is fairly common too, so up to you)

2196

Maybe add // This is step 2 of the algorithm described in the class comment of ChainedFixupsSection.

2197

nit: Should something somewhere error out if !isUInt<32>(symtabSize) since even dyld_chained_import_addend64::name_offset is too small then?

(I doubt anything will ever hit that; otoh you check most other bounds and it's like 2 lines)

lld/MachO/SyntheticSections.h

275

No change needed here, but: They're bound eagerly at page-in time on new OS versions, which in a way means they're always bound lazily as-needed, right?

(Comment is fine as-is, I'm asking just to make sure I'm understanding things. And there are OS versions that have chained fixups but no page-in linking.)

706

nit: dylibs are binaries too. s/binaries/executables/, but I'm guessing bundles (MH_BUNDLES) can have chained fixups as well, so maybe s/binaries and dylibs/binaries/ instead to cover all three.

735

Great comment :)

770

remove trailing extraneous ;, then clang-format will do a better job of formatting this line

(…maybe we should build llvm with -Wextra-semi :) )

lld/MachO/Writer.cpp

1094

A bit unfortunate that clang-format wants to reformat this, makes it hard to see that the change here is the addition of in.chainedFixups. Even if you land the reformatting without the addition first, everything will shift around when you add it and it's still a bit hard to see (but maybe slightly easier since the change is on the first touched line then). So maybe precommit the format change (and the change to std::array – but see above :P)

1200

Maybe add // This is step 5 of the algorithm described in the class comment of ChainedFixupsSection.

[thakis]

Also, you mentioned elsewhere that lld "creates 5 more __DATA pages for Chromium (which apparently aren't page-in linked?) because LLD doesn't do ObjC optimizations". Could you file an issue for that with some details and reference that in a FIXME somewhere (commit message, maybe)?

Maybe include a short summary of missing pieces in the commit message might generally be good:

• Link to that to-be-filed ObjC thing
• DYLD_CHAINED_PTR_64_OFFSET support
• …I think that's it?

[BertalanD]

lld/MachO/Driver.cpp

933

This is great advice, I'm going to keep this in mind the next time I do changes like this one.

(fwiw, this change has already landed in 4f688d00f43056a94869aff32d5cdcddedf88a84 though)

lld/MachO/SyntheticSections.cpp

2094

SegmentInfo objects are created by traversing ChainedFixupsSection::locations, so they should always have at least one entry in pageStarts.

2102

I do not know, unfortunately I couldn't find any design docs that would explain the rationale.

The source releases aren't too helpful either: ld64 mentions // move to DYLD_CHAINED_PTR_64_OFFSET when OS is ready (https://github.com/apple-opensource/ld64/blob/e28c028b20af187a16a7161d89e91868a450cadc/src/ld/OutputFile.cpp#L5249), but not much more.

lld/MachO/SyntheticSections.h

275

They're bound eagerly at page-in time on new OS versions, which in a way means they're always bound lazily as-needed, right?

That's correct. They are bound lazily on macOS 13+ in the sense that symbol lookups aren't performed upfront at load time. I wouldn't call it true lazy binding though, as the observable behavior is the same as eager binding: symbols from dlopen()-ed dylibs can't fulfill undefined references:

❯ cat undef.c
int undef() { return 42; }
❯ clang -dynamiclib undef.c -o libundef.dylib
❯ cat main.c
#include <dlfcn.h>
int undef();

int main() { dlopen("./libundef.dylib", RTLD_NOW); return undef(); }
❯ clang main.c -undefined dynamic_lookup
ld: warning: -undefined dynamic_lookup may not work with chained fixups
❯ ./a.out
dyld[59352]: symbol not found in flat namespace '_undef'
[1]    59352 abort      ./a.out

I believe this is not only because the GOT entries for undef and dlopen end up on the same page (so calling dlopen would cause both symbols to be bound): the WWDC video mentions that dlopen()-ed dylibs continue to be relocated by dyld, so it wouldn't surprise me if the kernel knew nothing about their symbols at all even after they've been loaded.

[BertalanD]

rebased and started addressing review comments

[int3]

lld/MachO/SyntheticSections.cpp

2159–2160

I think return buf - reinterpret_cast<uint8_t *>(header) should work too and is a bit more succinct

lld/MachO/SyntheticSections.h

276

[BertalanD]

Cleaned up writeStub() implementations by taking the GOT/lazy pointer address as a parameter. Addressed review comments from Jez.

[BertalanD]

lld/MachO/SyntheticSections.cpp

355

We diagnose unaligned fixups when chaining them together in Writer::buildFixupChains(). The format actually allows 8k+4-addresses.

[BertalanD]

Added driver tests, tweaked help messages.

[BertalanD]

lld/MachO/Options.td

1234

Moving out of grp_undocumented feels wrong to me. I made the help text slightly more useful though.

[BertalanD]

I'll be mostly AFK for a couple of hours, so feel free to revert immediately if this commit starts breaking bots.

lld/MachO/Arch/ARM.cpp

 struct ARM : TargetInfo {
   ARM(uint32_t cpuSubtype);
 
   int64_t getEmbeddedAddend(MemoryBufferRef, uint64_t offset,
                             const relocation_info) const override;
   void relocateOne(uint8_t *loc, const Reloc &, uint64_t va,
                    uint64_t pc) const override;
 
-  void writeStub(uint8_t *buf, const Symbol &) const override;
+  void writeStub(uint8_t *buf, const Symbol &, uint64_t) const override;
   void writeStubHelperHeader(uint8_t *buf) const override;
   void writeStubHelperEntry(uint8_t *buf, const Symbol &,
                             uint64_t entryAddr) const override;
 
   void writeObjCMsgSendStub(uint8_t *buf, Symbol *sym, uint64_t stubsAddr,
                             uint64_t stubOffset, uint64_t selrefsVA,
                             uint64_t selectorIndex, uint64_t gotAddr,
                             uint64_t msgSendIndex) const override;
case ARM_RELOC_BR24: {
     write32le(loc, base);
     break;
   }
   default:
     fatal("unhandled relocation type");
   }
 }
 
-void ARM::writeStub(uint8_t *buf, const Symbol &sym) const {
+void ARM::writeStub(uint8_t *buf, const Symbol &sym, uint64_t) const {
   fatal("TODO: implement this");
 }
 
 void ARM::writeStubHelperHeader(uint8_t *buf) const {
   fatal("TODO: implement this");
 }
 
 void ARM::writeStubHelperEntry(uint8_t *buf, const Symbol &sym,

lld/MachO/Arch/ARM64.cpp

 using namespace llvm::support::endian;
 using namespace lld;
 using namespace lld::macho;
 
 namespace {
 
 struct ARM64 : ARM64Common {
   ARM64();
-  void writeStub(uint8_t *buf, const Symbol &) const override;
+  void writeStub(uint8_t *buf, const Symbol &, uint64_t) const override;
   void writeStubHelperHeader(uint8_t *buf) const override;
   void writeStubHelperEntry(uint8_t *buf, const Symbol &,
                             uint64_t entryAddr) const override;
 
   void writeObjCMsgSendStub(uint8_t *buf, Symbol *sym, uint64_t stubsAddr,
                             uint64_t stubOffset, uint64_t selrefsVA,
                             uint64_t selectorIndex, uint64_t gotAddr,
                             uint64_t msgSendIndex) const override;

 }};
 
 static constexpr uint32_t stubCode[] = {
     0x90000010, // 00: adrp  x16, __la_symbol_ptr@page
     0xf9400210, // 04: ldr   x16, [x16, __la_symbol_ptr@pageoff]
     0xd61f0200, // 08: br    x16
 };
 
-void ARM64::writeStub(uint8_t *buf8, const Symbol &sym) const {
-  ::writeStub<LP64>(buf8, stubCode, sym);
+void ARM64::writeStub(uint8_t *buf8, const Symbol &sym,
+                      uint64_t pointerVA) const {
+  ::writeStub(buf8, stubCode, sym, pointerVA);
 }
 
 static constexpr uint32_t stubHelperHeaderCode[] = {
     0x90000011, // 00: adrp  x17, _dyld_private@page
     0x91000231, // 04: add   x17, x17, _dyld_private@pageoff
     0xa9bf47f0, // 08: stp   x16/x17, [sp, #-16]!
     0x90000010, // 0c: adrp  x16, dyld_stub_binder@page
     0xf9400210, // 10: ldr   x16, [x16, dyld_stub_binder@pageoff]

lld/MachO/Arch/ARM64Common.h

llvm::support::endian::write32le(loc,
                                    base | bitField(va, scale, 12 - scale, 10));
 }
 
 inline uint64_t pageBits(uint64_t address) {
   const uint64_t pageMask = ~0xfffull;
   return address & pageMask;
 }
 
-template <class LP>
 inline void writeStub(uint8_t *buf8, const uint32_t stubCode[3],
-                      const macho::Symbol &sym) {
+                      const macho::Symbol &sym, uint64_t pointerVA) {
   auto *buf32 = reinterpret_cast<uint32_t *>(buf8);
   constexpr size_t stubCodeSize = 3 * sizeof(uint32_t);
   SymbolDiagnostic d = {&sym, "stub"};
   uint64_t pcPageBits =
       pageBits(in.stubs->addr + sym.stubsIndex * stubCodeSize);
-  uint64_t lazyPointerVA =
-      in.lazyPointers->addr + sym.stubsIndex * LP::wordSize;
-  encodePage21(&buf32[0], d, stubCode[0], pageBits(lazyPointerVA) - pcPageBits);
-  encodePageOff12(&buf32[1], d, stubCode[1], lazyPointerVA);
+  encodePage21(&buf32[0], d, stubCode[0], pageBits(pointerVA) - pcPageBits);
+  encodePageOff12(&buf32[1], d, stubCode[1], pointerVA);
   buf32[2] = stubCode[2];
 }
 
 template <class LP>
 inline void writeStubHelperHeader(uint8_t *buf8,
                                   const uint32_t stubHelperHeaderCode[6]) {
   auto *buf32 = reinterpret_cast<uint32_t *>(buf8);
   auto pcPageBits = [](int i) {

lld/MachO/Arch/ARM64_32.cpp

 using namespace llvm::support::endian;
 using namespace lld;
 using namespace lld::macho;
 
 namespace {
 
 struct ARM64_32 : ARM64Common {
   ARM64_32();
-  void writeStub(uint8_t *buf, const Symbol &) const override;
+  void writeStub(uint8_t *buf, const Symbol &, uint64_t) const override;
   void writeStubHelperHeader(uint8_t *buf) const override;
   void writeStubHelperEntry(uint8_t *buf, const Symbol &,
                             uint64_t entryAddr) const override;
   void writeObjCMsgSendStub(uint8_t *buf, Symbol *sym, uint64_t stubsAddr,
                             uint64_t stubOffset, uint64_t selrefsVA,
                             uint64_t selectorIndex, uint64_t gotAddr,
                             uint64_t msgSendIndex) const override;
 };

 // 32-bit 'w' registers, instead of the 64-bit 'x' ones.
 
 static constexpr uint32_t stubCode[] = {
     0x90000010, // 00: adrp  x16, __la_symbol_ptr@page
     0xb9400210, // 04: ldr   w16, [x16, __la_symbol_ptr@pageoff]
     0xd61f0200, // 08: br    x16
 };
 
-void ARM64_32::writeStub(uint8_t *buf8, const Symbol &sym) const {
-  ::writeStub<ILP32>(buf8, stubCode, sym);
+void ARM64_32::writeStub(uint8_t *buf8, const Symbol &sym,
+                         uint64_t pointerVA) const {
+  ::writeStub(buf8, stubCode, sym, pointerVA);
 }
 
 static constexpr uint32_t stubHelperHeaderCode[] = {
     0x90000011, // 00: adrp  x17, _dyld_private@page
     0x91000231, // 04: add   x17, x17, _dyld_private@pageoff
     0xa9bf47f0, // 08: stp   x16/x17, [sp, #-16]!
     0x90000010, // 0c: adrp  x16, dyld_stub_binder@page
     0xb9400210, // 10: ldr   w16, [x16, dyld_stub_binder@pageoff]

lld/MachO/Arch/X86_64.cpp

 struct X86_64 : TargetInfo {
   X86_64();
 
   int64_t getEmbeddedAddend(MemoryBufferRef, uint64_t offset,
                             const relocation_info) const override;
   void relocateOne(uint8_t *loc, const Reloc &, uint64_t va,
                    uint64_t relocVA) const override;
 
-  void writeStub(uint8_t *buf, const Symbol &) const override;
+  void writeStub(uint8_t *buf, const Symbol &,
+                 uint64_t pointerVA) const override;
   void writeStubHelperHeader(uint8_t *buf) const override;
   void writeStubHelperEntry(uint8_t *buf, const Symbol &,
                             uint64_t entryAddr) const override;
 
   void writeObjCMsgSendStub(uint8_t *buf, Symbol *sym, uint64_t stubsAddr,
                             uint64_t stubOffset, uint64_t selrefsVA,
                             uint64_t selectorIndex, uint64_t gotAddr,
                             uint64_t msgSendIndex) const override;
static void writeRipRelative(SymbolDiagnostic d, uint8_t *buf, uint64_t bufAddr,
   // stored in the last 4 bytes of the instruction.
   write32le(buf + bufOff - 4, destAddr - rip);
 }
 
 static constexpr uint8_t stub[] = {
     0xff, 0x25, 0, 0, 0, 0, // jmpq *__la_symbol_ptr(%rip)
 };
 
-void X86_64::writeStub(uint8_t *buf, const Symbol &sym) const {
+void X86_64::writeStub(uint8_t *buf, const Symbol &sym,
+                       uint64_t pointerVA) const {
   memcpy(buf, stub, 2); // just copy the two nonzero bytes
   uint64_t stubAddr = in.stubs->addr + sym.stubsIndex * sizeof(stub);
-  writeRipRelative({&sym, "stub"}, buf, stubAddr, sizeof(stub),
-                   in.lazyPointers->addr + sym.stubsIndex * LP64::wordSize);
+  writeRipRelative({&sym, "stub"}, buf, stubAddr, sizeof(stub), pointerVA);
 }
 
 static constexpr uint8_t stubHelperHeader[] = {
     0x4c, 0x8d, 0x1d, 0, 0, 0, 0, // 0x0: leaq ImageLoaderCache(%rip), %r11
     0x41, 0x53,                   // 0x7: pushq %r11
     0xff, 0x25, 0,    0, 0, 0,    // 0x9: jmpq *dyld_stub_binder@GOT(%rip)
     0x90,                         // 0xf: nop
 };

lld/MachO/Config.h

struct Configuration {
   bool searchDylibsFirst = false;
   bool saveTemps = false;
   bool adhocCodesign = false;
   bool emitFunctionStarts = false;
   bool emitBitcodeBundle = false;
   bool emitDataInCodeInfo = false;
   bool emitEncryptionInfo = false;
   bool emitInitOffsets = false;
+  bool emitChainedFixups = false;
   bool timeTraceEnabled = false;
   bool dataConst = false;
   bool dedupLiterals = true;
   bool deadStripDuplicates = false;
   bool omitDebugInfo = false;
   bool warnDylibInstallName = false;
   bool ignoreOptimizationHints = false;
   bool forceExactCpuSubtypeMatch = false;

lld/MachO/Driver.cpp

 }
 
 static bool dataConstDefault(const InputArgList &args) {
   static const std::array<std::pair<PlatformType, VersionTuple>, 5> minVersion =
       {{{PLATFORM_MACOS, VersionTuple(10, 15)},
         {PLATFORM_IOS, VersionTuple(13, 0)},
         {PLATFORM_TVOS, VersionTuple(13, 0)},
         {PLATFORM_WATCHOS, VersionTuple(6, 0)},
         {PLATFORM_BRIDGEOS, VersionTuple(4, 0)}}};
   PlatformType platform = removeSimulator(config->platformInfo.target.Platform);
   auto it = llvm::find_if(minVersion,
                           [&](const auto &p) { return p.first == platform; });
   if (it != minVersion.end())
     if (config->platformInfo.minimum < it->second)
       return false;
 
   switch (config->outputType) {
case MH_OBJECT:
     return false;
   default:
     llvm_unreachable(
         "unsupported output type for determining data-const default");
   }
   return false;
 }
 
+static bool shouldEmitChainedFixups(const InputArgList &args) {
+  const Arg *arg = args.getLastArg(OPT_fixup_chains, OPT_no_fixup_chains);
+  if (arg && arg->getOption().matches(OPT_no_fixup_chains))
+    return false;
+
+  bool isRequested = arg != nullptr;
+
+  // Version numbers taken from the Xcode 13.3 release notes.
+  static const std::array<std::pair<PlatformType, VersionTuple>, 4> minVersion =
+      {{{PLATFORM_MACOS, VersionTuple(11, 0)},
+        {PLATFORM_IOS, VersionTuple(13, 4)},
+        {PLATFORM_TVOS, VersionTuple(14, 0)},
+        {PLATFORM_WATCHOS, VersionTuple(7, 0)}}};
+  PlatformType platform = removeSimulator(config->platformInfo.target.Platform);
+  auto it = llvm::find_if(minVersion,
+                          [&](const auto &p) { return p.first == platform; });
+  if (it != minVersion.end() && it->second > config->platformInfo.minimum) {
+    if (!isRequested)
+      return false;
+
+    warn("-fixup_chains requires " + getPlatformName(config->platform()) + " " +
+         it->second.getAsString() + ", which is newer than target minimum of " +
+         config->platformInfo.minimum.getAsString());
+  }
+
+  if (!is_contained({AK_x86_64, AK_x86_64h, AK_arm64}, config->arch())) {
+    if (isRequested)
+      error("-fixup_chains is only supported on x86_64 and arm64 targets");
+    return false;
+  }
+
+  if (!config->isPic) {
+    if (isRequested)
+      error("-fixup_chains is incompatible with -no_pie");
+    return false;
+  }
+
+  // TODO: Enable by default once stable.
+  return isRequested;
+}
+
 void SymbolPatterns::clear() {
   literals.clear();
   globs.clear();
 }
 
 void SymbolPatterns::insert(StringRef symbolName) {
   if (symbolName.find_first_of("*?[]") == StringRef::npos)
     literals.insert(CachedHashStringRef(symbolName));
if (!fs::real_path(config->osoPrefix, expanded,
       // real_path removes trailing slashes as part of the normalization, but
       // these are meaningful for our text based stripping
       if (config->osoPrefix.equals(".") || config->osoPrefix.endswith(sep))
         expanded += sep;
       config->osoPrefix = saver().save(expanded.str());
     }
   }
 
+  config->isPic = config->outputType == MH_DYLIB ||
+                  config->outputType == MH_BUNDLE ||
+                  (config->outputType == MH_EXECUTE &&
+                   args.hasFlag(OPT_pie, OPT_no_pie, true));
+
   // Must be set before any InputSections and Symbols are created.
   config->deadStrip = args.hasArg(OPT_dead_strip);
 
   config->systemLibraryRoots = getSystemLibraryRoots(args);
   if (const char *path = getReproduceOption(args)) {
     // Note that --reproduce is a debug option so you can ignore it
     // if you are trying to understand the whole picture of the code.
     Expected<std::unique_ptr<TarWriter>> errOrWriter =
bool macho::link(ArrayRef<const char *> argsArr, llvm::raw_ostream &stdoutOS,
   config->deadStripDylibs = args.hasArg(OPT_dead_strip_dylibs);
   config->demangle = args.hasArg(OPT_demangle);
   config->implicitDylibs = !args.hasArg(OPT_no_implicit_dylibs);
   config->emitFunctionStarts =
       args.hasFlag(OPT_function_starts, OPT_no_function_starts, true);
   config->emitBitcodeBundle = args.hasArg(OPT_bitcode_bundle);
   config->emitDataInCodeInfo =
       args.hasFlag(OPT_data_in_code_info, OPT_no_data_in_code_info, true);
-  config->emitInitOffsets = args.hasArg(OPT_init_offsets);
+  config->emitChainedFixups = shouldEmitChainedFixups(args);
+  config->emitInitOffsets =
+      config->emitChainedFixups || args.hasArg(OPT_init_offsets);
   config->icfLevel = getICFLevel(args);
   config->dedupLiterals =
       args.hasFlag(OPT_deduplicate_literals, OPT_icf_eq, false) ||
       config->icfLevel != ICFLevel::none;
   config->deadStripDuplicates = args.hasArg(OPT_dead_strip_duplicates);
   config->warnDylibInstallName = args.hasFlag(
       OPT_warn_dylib_install_name, OPT_no_warn_dylib_install_name, false);
   config->ignoreOptimizationHints = args.hasArg(OPT_ignore_optimization_hints);
if (config->warnDylibInstallName && config->outputType != MH_DYLIB)
       warn(
           arg->getAsString(args) +
           ": ignored, only has effect with -dylib [--warn-dylib-install-name]");
     else
       config->installName = arg->getValue();
   } else if (config->outputType == MH_DYLIB) {
     config->installName = config->finalOutput;
   }
 
   if (args.hasArg(OPT_mark_dead_strippable_dylib)) {
     if (config->outputType != MH_DYLIB)
       warn("-mark_dead_strippable_dylib: ignored, only has effect with -dylib");
     else
       config->markDeadStrippableDylib = true;
   }
 
   if (const Arg *arg = args.getLastArg(OPT_static, OPT_dynamic))
if (config->timeTraceEnabled)
     timeTraceProfilerInitialize(config->timeTraceGranularity, config->progName);
 
   {
     TimeTraceScope timeScope("ExecuteLinker");
 
     initLLVM(); // must be run before any call to addFile()
     createFiles(args);
 
-    config->isPic = config->outputType == MH_DYLIB ||
-                    config->outputType == MH_BUNDLE ||
-                    (config->outputType == MH_EXECUTE &&
-                     args.hasFlag(OPT_pie, OPT_no_pie, true));
-
     // Now that all dylibs have been loaded, search for those that should be
     // re-exported.
     {
       auto reexportHandler = [](const Arg *arg,
                                 const std::vector<StringRef> &extensions) {
         config->hasReexports = true;
         StringRef searchName = arg->getValue();
         if (!markReexport(searchName, extensions))

lld/MachO/InputSection.h

 
 constexpr const char authGot[] = "__auth_got";
 constexpr const char authPtr[] = "__auth_ptr";
 constexpr const char binding[] = "__binding";
 constexpr const char bitcodeBundle[] = "__bundle";
 constexpr const char cString[] = "__cstring";
 constexpr const char cfString[] = "__cfstring";
 constexpr const char cgProfile[] = "__cg_profile";
+constexpr const char chainFixups[] = "__chainfixups";
 constexpr const char codeSignature[] = "__code_signature";
 constexpr const char common[] = "__common";
 constexpr const char compactUnwind[] = "__compact_unwind";
 constexpr const char data[] = "__data";
 constexpr const char debugAbbrev[] = "__debug_abbrev";
 constexpr const char debugInfo[] = "__debug_info";
 constexpr const char debugLine[] = "__debug_line";
 constexpr const char debugStr[] = "__debug_str";

lld/MachO/InputSection.cpp

if (getFileSize() == 0)
     return;
 
   memcpy(buf, data.data(), data.size());
 
   for (size_t i = 0; i < relocs.size(); i++) {
     const Reloc &r = relocs[i];
     uint8_t *loc = buf + r.offset;
     uint64_t referentVA = 0;
+
+    const bool needsFixup = config->emitChainedFixups &&
+                            target->hasAttr(r.type, RelocAttrBits::UNSIGNED);
     if (target->hasAttr(r.type, RelocAttrBits::SUBTRAHEND)) {
       const Symbol *fromSym = r.referent.get<Symbol *>();
       const Reloc &minuend = relocs[++i];
       uint64_t minuendVA;
       if (const Symbol *toSym = minuend.referent.dyn_cast<Symbol *>())
         minuendVA = toSym->getVA() + minuend.addend;
       else {
         auto *referentIsec = minuend.referent.get<InputSection *>();
         assert(!::shouldOmitFromOutput(referentIsec));
         minuendVA = referentIsec->getVA(minuend.addend);
       }
       referentVA = minuendVA - fromSym->getVA();
     } else if (auto *referentSym = r.referent.dyn_cast<Symbol *>()) {
       if (target->hasAttr(r.type, RelocAttrBits::LOAD) &&
           !referentSym->isInGot())
         target->relaxGotLoad(loc, r.type);
       // For dtrace symbols, do not handle them as normal undefined symbols
       if (referentSym->getName().startswith("___dtrace_")) {
         // Change dtrace call site to pre-defined instructions
         target->handleDtraceReloc(referentSym, r, loc);
         continue;
       }
       referentVA = resolveSymbolVA(referentSym, r.type) + r.addend;
 
-      if (isThreadLocalVariables(getFlags())) {
+      if (isThreadLocalVariables(getFlags()) && isa<Defined>(referentSym)) {
         // References from thread-local variable sections are treated as offsets
         // relative to the start of the thread-local data memory area, which
         // is initialized via copying all the TLV data sections (which are all
         // contiguous).
-        if (isa<Defined>(referentSym))
-          referentVA -= firstTLVDataSection->addr;
+      } else if (needsFixup) {
+        writeChainedFixup(loc, referentSym, r.addend);
+        continue;
       }
     } else if (auto *referentIsec = r.referent.dyn_cast<InputSection *>()) {
       assert(!::shouldOmitFromOutput(referentIsec));
       referentVA = referentIsec->getVA(r.addend);
+
+      if (needsFixup) {
+        writeChainedRebase(loc, referentVA);
+        continue;
+      }
     }
     target->relocateOne(loc, r, referentVA, getVA() + r.offset);
   }
 }
 
 ConcatInputSection *macho::makeSyntheticInputSection(StringRef segName,
                                                      StringRef sectName,
                                                      uint32_t flags,

lld/MachO/Options.td

 def no_encryption : Flag<["-"], "no_encryption">,
     HelpText<"Do not generate the LC_ENCRYPTION_INFO load command">,
     Group<grp_undocumented>;
 def executable_path : Flag<["-"], "executable_path">,
     HelpText<"This option is undocumented in ld64">,
     Flags<[HelpHidden]>,
     Group<grp_undocumented>;
 def fixup_chains : Flag<["-"], "fixup_chains">,
-    HelpText<"This option is undocumented in ld64">,
-    Flags<[HelpHidden]>,
+    HelpText<"Emit chained fixups">,
+    Group<grp_undocumented>;
+def no_fixup_chains : Flag<["-"], "no_fixup_chains">,
+    HelpText<"Emit fixup information as classic dyld opcodes">,
     Group<grp_undocumented>;
 def fixup_chains_section : Flag<["-"], "fixup_chains_section">,
     HelpText<"This option is undocumented in ld64">,
     Flags<[HelpHidden]>,
     Group<grp_undocumented>;
 def flto_codegen_only : Flag<["-"], "flto-codegen-only">,
     HelpText<"This option is undocumented in ld64">,
     Flags<[HelpHidden]>,

lld/MachO/Symbols.h

public:
 
   // Whether this symbol is in the GOT or TLVPointer sections.
   bool isInGot() const { return gotIndex != UINT32_MAX; }
 
   // Whether this symbol is in the StubsSection.
   bool isInStubs() const { return stubsIndex != UINT32_MAX; }
 
   uint64_t getStubVA() const;
+  uint64_t getLazyPtrVA() const;
   uint64_t getGotVA() const;
   uint64_t getTlvVA() const;
   uint64_t resolveBranchVA() const {
     assert(isa<Defined>(this) || isa<DylibSymbol>(this));
     return isInStubs() ? getStubVA() : getVA();
   }
   uint64_t resolveGotVA() const { return isInGot() ? getGotVA() : getVA(); }
   uint64_t resolveTlvVA() const { return isInGot() ? getTlvVA() : getVA(); }

lld/MachO/Symbols.cpp

std::string lld::toString(const Symbol &sym) {
   return demangle(sym.getName(), config->demangle);
 }
 
 std::string lld::toMachOString(const object::Archive::Symbol &b) {
   return demangle(b.getName(), config->demangle);
 }
 
 uint64_t Symbol::getStubVA() const { return in.stubs->getVA(stubsIndex); }
+uint64_t Symbol::getLazyPtrVA() const {
+  return in.lazyPointers->getVA(stubsIndex);
+}
 uint64_t Symbol::getGotVA() const { return in.got->getVA(gotIndex); }
 uint64_t Symbol::getTlvVA() const { return in.tlvPointers->getVA(gotIndex); }
 
 Defined::Defined(StringRefZ name, InputFile *file, InputSection *isec,
                  uint64_t value, uint64_t size, bool isWeakDef, bool isExternal,
                  bool isPrivateExtern, bool includeInSymtab, bool isThumb,
                  bool isReferencedDynamically, bool noDeadStrip,
                  bool canOverrideWeakDef, bool isWeakDefCanBeHidden,

lld/MachO/SyntheticSections.h

 #include "OutputSegment.h"
 #include "Target.h"
 #include "Writer.h"
 
 #include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/Hashing.h"
 #include "llvm/ADT/Optional.h"
 #include "llvm/ADT/SetVector.h"
+#include "llvm/BinaryFormat/MachO.h"
 #include "llvm/MC/StringTableBuilder.h"
 #include "llvm/Support/MathExtras.h"
 #include "llvm/Support/raw_ostream.h"
 
 #include <unordered_map>
 
 namespace llvm {
 class DWARFUnit;

 // the resolved symbol.
 //
 // With weak symbols, the situation is slightly different. Since there is no
 // "weak lazy" lookup, function calls to weak symbols are always non-lazily
 // bound. We emit both regular non-lazy bindings as well as weak bindings, in
 // order that the weak bindings may overwrite the non-lazy bindings if an
 // appropriate symbol is found at runtime. However, the bound addresses will
 // still be written (non-lazily) into the LazyPointerSection.
+//
+// Symbols are always bound eagerly when chained fixups are used. In that case,
+// StubsSection contains indirect jumps to addresses stored in the GotSection.
+// The GOT directly contains the fixup entries, which will be replaced by the
+// address of the target symbols on load. LazyPointerSection and
+// StubHelperSection are not used.
 
 class StubsSection final : public SyntheticSection {
 public:
   StubsSection();
   uint64_t getSize() const override;
   bool isNeeded() const override { return !entries.empty(); }
   void finalize() override;
   void writeTo(uint8_t *buf) const override;

 // Note that this section may also be targeted by non-lazy bindings. In
 // particular, this happens when branch relocations target weak symbols.
 class LazyPointerSection final : public SyntheticSection {
 public:
   LazyPointerSection();
   uint64_t getSize() const override;
   bool isNeeded() const override;
   void writeTo(uint8_t *buf) const override;
+  uint64_t getVA(uint32_t index) const {
+    return addr + (index << target->p2WordSize);
+  }
 };
 
 class LazyBindingSection final : public LinkEditSection {
 public:
   LazyBindingSection();
   void finalizeContents() override;
   uint64_t getRawSize() const override { return contents.size(); }
   bool isNeeded() const override { return !entries.empty(); }

 
 // This section stores 32-bit __TEXT segment offsets of initializer functions.
 //
 // The compiler stores pointers to initializers in __mod_init_func. These need
 // to be fixed up at load time, which takes time and dirties memory. By
 // synthesizing InitOffsetsSection from them, this data can live in the
 // read-only __TEXT segment instead. This section is used by default when
 // chained fixups are enabled.
 //
 // There is no similar counterpart to __mod_term_func, as that section is
 // deprecated, and static destructors are instead handled by registering them
 // via __cxa_atexit from an autogenerated initializer function (see D121736).
 class InitOffsetsSection final : public SyntheticSection {
 public:
   InitOffsetsSection();
   bool isNeeded() const override { return !sections.empty(); }
   uint64_t getSize() const override;
   void writeTo(uint8_t *buf) const override;
   void setUp();
 
   void addInput(ConcatInputSection *isec) { sections.push_back(isec); }
   const std::vector<ConcatInputSection *> &inputs() const { return sections; }
 
 private:
   std::vector<ConcatInputSection *> sections;
 };
 
+// Chained fixups are a replacement for classic dyld opcodes. In this format,
+// most of the metadata necessary for binding symbols and rebasing addresses is
+// stored directly in the memory location that will have the fixup applied.
+//
+// The fixups form singly linked lists; each one covering a single page in
+// memory. The __LINKEDIT,__chainfixups section stores the page offset of the
+// first fixup of each page; the rest can be found by walking the chain using
+// the offset that is embedded in each entry.
+//
+// This setup allows pages to be relocated lazily at page-in time and without
+// being dirtied. The kernel can discard and load them again as needed. This
+// technique, called page-in linking, was introduced in macOS 13.
+//
+// The benefits of this format are:
+//  - smaller __LINKEDIT segment, as most of the fixup information is stored in
+//    the data segment
+//  - faster startup, since not all relocations need to be done upfront
+//  - slightly lower memory usage, as fewer pages are dirtied
+//
+// Userspace x86_64 and arm64 binaries have two types of fixup entries:
+//   - Rebase entries contain an absolute address, to which the object's load
+//     address will be added to get the final value. This is used for loading
+//     the address of a symbol defined in the same binary.
+//   - Binding entries are mostly used for symbols imported from other dylibs,
+//     but for weakly bound and interposable symbols as well. They are looked up
+//     by a (symbol name, library) pair stored in __chainfixups. This import
+//     entry also encodes whether the import is weak (i.e. if the symbol is
+//     missing, it should be set to null instead of producing a load error).
+//     The fixup encodes an ordinal associated with the import, and an optional
+//     addend.
+//
+// The entries are tightly packed 64-bit bitfields. One of the bits specifies
+// which kind of fixup to interpret them as.
+//
+// LLD generates the fixup data in 5 stages:
+//   1. While scanning relocations, we make a note of each location that needs
+//      a fixup by calling addRebase() or addBinding(). During this, we assign
+//      a unique ordinal for each (symbol name, library, addend) import tuple.
+//   2. After addresses have been assigned to all sections, and thus the memory
+//      layout of the linked image is final; finalizeContents() is called. Here,
+//      the page offsets of the chain start entries are calculated.
+//   3. ChainedFixupsSection::writeTo() writes the page start offsets and the
+//      imports table to the output file.
+//   4. Each section's fixup entries are encoded and written to disk in
+//      ConcatInputSection::writeTo(), but without writing the offsets that form
+//      the chain.
+//   5. Finally, each page's (which might correspond to multiple sections)
+//      fixups are linked together in Writer::buildFixupChains().
+class ChainedFixupsSection final : public LinkEditSection {
+public:
+  ChainedFixupsSection();
+  void finalizeContents() override;
+  uint64_t getRawSize() const override { return size; }
+  bool isNeeded() const override;
+  void writeTo(uint8_t *buf) const override;
+
+  void addRebase(const InputSection *isec, uint64_t offset) {
+    locations.emplace_back(isec, offset);
+  }
+  void addBinding(const Symbol *dysym, const InputSection *isec,
+                  uint64_t offset, int64_t addend = 0);
+
+  void setHasNonWeakDefinition() { hasNonWeakDef = true; }
+
+  // Returns an (ordinal, inline addend) tuple used by dyld_chained_ptr_64_bind.
+  std::pair<uint32_t, uint8_t> getBinding(const Symbol *sym,
+                                          int64_t addend) const;
+
+  const std::vector<Location> &getLocations() const { return locations; }
+
+  bool hasWeakBinding() const { return hasWeakBind; }
+  bool hasNonWeakDefinition() const { return hasNonWeakDef; }
+
+private:
+  // Location::offset initially stores the offset within an InputSection, but
+  // contains output segment offsets after finalizeContents().
+  std::vector<Location> locations;
+  // (target symbol, addend) => import ordinal
+  llvm::MapVector<std::pair<const Symbol *, int64_t>, uint32_t> bindings;
+
+  struct SegmentInfo {
+    SegmentInfo(const OutputSegment *oseg) : oseg(oseg) {}
+
+    const OutputSegment *oseg;
+    // (page index, fixup starts offset)
+    llvm::SmallVector<std::pair<uint16_t, uint16_t>> pageStarts;
+
+    size_t getSize() const;
+    size_t writeTo(uint8_t *buf) const;
+  };
+  llvm::SmallVector<SegmentInfo, 4> fixupSegments;
+
+  size_t symtabSize = 0;
+  size_t size = 0;
+
+  bool needsAddend = false;
+  bool needsLargeAddend = false;
+  bool hasWeakBind = false;
+  bool hasNonWeakDef = false;
+  llvm::MachO::ChainedImportFormat importFormat;
+};
+
+void writeChainedRebase(uint8_t *buf, uint64_t targetVA);
+void writeChainedFixup(uint8_t *buf, const Symbol *sym, int64_t addend);
+
 struct InStruct {
   const uint8_t *bufferStart = nullptr;
   MachHeaderSection *header = nullptr;
   CStringSection *cStringSection = nullptr;
   DeduplicatedCStringSection *objcMethnameSection = nullptr;
   WordLiteralSection *wordLiteralSection = nullptr;
   RebaseSection *rebase = nullptr;
   BindingSection *binding = nullptr;
   WeakBindingSection *weakBinding = nullptr;
   LazyBindingSection *lazyBinding = nullptr;
   ExportSection *exports = nullptr;
   GotSection *got = nullptr;
   TlvPointerSection *tlvPointers = nullptr;
   LazyPointerSection *lazyPointers = nullptr;
   StubsSection *stubs = nullptr;
   StubHelperSection *stubHelper = nullptr;
   ObjCStubsSection *objcStubs = nullptr;
   ConcatInputSection *objcSelrefs = nullptr;
   UnwindInfoSection *unwindInfo = nullptr;
   ObjCImageInfoSection *objCImageInfo = nullptr;
   ConcatInputSection *imageLoaderCache = nullptr;
   InitOffsetsSection *initOffsets = nullptr;
+  ChainedFixupsSection *chainedFixups = nullptr;
 };
 
 extern InStruct in;
 extern std::vector<SyntheticSection *> syntheticSections;
 
 void createSyntheticSymbols();
 
 } // namespace lld::macho
 
 #endif

lld/MachO/SyntheticSections.cpp

if (config->outputType == MH_EXECUTE && !config->staticLink &&
       target->cpuSubtype == CPU_SUBTYPE_X86_64_ALL &&
       config->platform() == PLATFORM_MACOS &&
       config->platformInfo.minimum >= VersionTuple(10, 5))
     subtype |= CPU_SUBTYPE_LIB64;
 
   return subtype;
 }
 
+static bool hasWeakBinding() {
+  return config->emitChainedFixups ? in.chainedFixups->hasWeakBinding()
+                                   : in.weakBinding->hasEntry();
+}
+
+static bool hasNonWeakDefinition() {
+  return config->emitChainedFixups ? in.chainedFixups->hasNonWeakDefinition()
+                                   : in.weakBinding->hasNonWeakDefinition();
+}
+
 void MachHeaderSection::writeTo(uint8_t *buf) const {
   auto *hdr = reinterpret_cast<mach_header *>(buf);
   hdr->magic = target->magic;
   hdr->cputype = target->cpuType;
   hdr->cpusubtype = cpuSubtype();
   hdr->filetype = config->outputType;
   hdr->ncmds = loadCommands.size();
   hdr->sizeofcmds = sizeOfCmds;
if (config->markDeadStrippableDylib)
     hdr->flags |= MH_DEAD_STRIPPABLE_DYLIB;
 
   if (config->outputType == MH_EXECUTE && config->isPic)
     hdr->flags |= MH_PIE;
 
   if (config->outputType == MH_DYLIB && config->applicationExtension)
     hdr->flags |= MH_APP_EXTENSION_SAFE;
 
-  if (in.exports->hasWeakSymbol || in.weakBinding->hasNonWeakDefinition())
+  if (in.exports->hasWeakSymbol || hasNonWeakDefinition())
     hdr->flags |= MH_WEAK_DEFINES;
 
-  if (in.exports->hasWeakSymbol || in.weakBinding->hasEntry())
+  if (in.exports->hasWeakSymbol || hasWeakBinding())
     hdr->flags |= MH_BINDS_TO_WEAK;
 
   for (const OutputSegment *seg : outputSegments) {
     for (const OutputSection *osec : seg->getSections()) {
       if (isThreadLocalVariables(osec->flags)) {
         hdr->flags |= MH_HAS_TLV_DESCRIPTORS;
         break;
       }
NonLazyPointerSectionBase::NonLazyPointerSectionBase(const char *segname,
                                                      const char *name)
     : SyntheticSection(segname, name) {
   align = target->wordSize;
 }
 
 void macho::addNonLazyBindingEntries(const Symbol *sym,
                                      const InputSection *isec, uint64_t offset,
                                      int64_t addend) {
+  if (config->emitChainedFixups) {
+    if (needsBinding(sym))
+      in.chainedFixups->addBinding(sym, isec, offset, addend);
+    else if (isa<Defined>(sym))
+      in.chainedFixups->addRebase(isec, offset);
+    else
+      llvm_unreachable("cannot bind to an undefined symbol");
+    return;
+  }
+
   if (const auto *dysym = dyn_cast<DylibSymbol>(sym)) {
     in.binding->addEntry(dysym, isec, offset, addend);
     if (dysym->isWeakDef())
       in.weakBinding->addEntry(sym, isec, offset, addend);
   } else if (const auto *defined = dyn_cast<Defined>(sym)) {
     in.rebase->addEntry(isec, offset);
     if (defined->isExternalWeakDef())
       in.weakBinding->addEntry(sym, isec, offset, addend);
     else if (defined->interposable)
       in.binding->addEntry(sym, isec, offset, addend);
   } else {
     // Undefined symbols are filtered out in scanRelocations(); we should never
     // get here
     llvm_unreachable("cannot bind to an undefined symbol");
   }
 }
 
 void NonLazyPointerSectionBase::addEntry(Symbol *sym) {
   if (entries.insert(sym)) {
     assert(!sym->isInGot());
     sym->gotIndex = entries.size() - 1;
 
     addNonLazyBindingEntries(sym, isec, sym->gotIndex * target->wordSize);
   }
 }
 
+void macho::writeChainedRebase(uint8_t *buf, uint64_t targetVA) {
+  assert(config->emitChainedFixups);
+  assert(target->wordSize == 8 && "Only 64-bit platforms are supported");
+  auto *rebase = reinterpret_cast<dyld_chained_ptr_64_rebase *>(buf);
+  rebase->target = targetVA & 0xf'ffff'ffff;
+  rebase->high8 = (targetVA >> 56);
+  rebase->reserved = 0;
+  rebase->next = 0;
+  rebase->bind = 0;
+
+  // The fixup format places a 64 GiB limit on the output's size.
+  // Should we handle this gracefully?
+  uint64_t encodedVA = rebase->target | ((uint64_t)rebase->high8 << 56);
+  if (encodedVA != targetVA)
+    error("rebase target address 0x" + Twine::utohexstr(targetVA) +
+          " does not fit into chained fixup. Re-link with -no_fixup_chains");
+}
+
+static void writeChainedBind(uint8_t *buf, const Symbol *sym, int64_t addend) {
+  assert(config->emitChainedFixups);
+  assert(target->wordSize == 8 && "Only 64-bit platforms are supported");
+  auto *bind = reinterpret_cast<dyld_chained_ptr_64_bind *>(buf);
+  auto [ordinal, inlineAddend] = in.chainedFixups->getBinding(sym, addend);
+  bind->ordinal = ordinal;
+  bind->addend = inlineAddend;
+  bind->reserved = 0;
+  bind->next = 0;
+  bind->bind = 1;
+}
+
+void macho::writeChainedFixup(uint8_t *buf, const Symbol *sym, int64_t addend) {
+  if (needsBinding(sym))
+    writeChainedBind(buf, sym, addend);
+  else
+    writeChainedRebase(buf, sym->getVA() + addend);
+}
+
 void NonLazyPointerSectionBase::writeTo(uint8_t *buf) const {
+  if (config->emitChainedFixups) {
+    for (size_t i = 0, n = entries.size(); i < n; ++i)
+      writeChainedFixup(&buf[i * target->wordSize], entries[i], 0);
+  } else {
     for (size_t i = 0, n = entries.size(); i < n; ++i)
       if (auto *defined = dyn_cast<Defined>(entries[i]))
         write64le(&buf[i * target->wordSize], defined->getVA());
   }
+}
 
 GotSection::GotSection()
     : NonLazyPointerSectionBase(segment_names::data, section_names::got) {
   flags = S_NON_LAZY_SYMBOL_POINTERS;
 }
 
 TlvPointerSection::TlvPointerSection()
     : NonLazyPointerSectionBase(segment_names::data,

 
 uint64_t StubsSection::getSize() const {
   return entries.size() * target->stubSize;
 }
 
 void StubsSection::writeTo(uint8_t *buf) const {
   size_t off = 0;
   for (const Symbol *sym : entries) {
-    target->writeStub(buf + off, *sym);
+    uint64_t pointerVA =
+        config->emitChainedFixups ? sym->getGotVA() : sym->getLazyPtrVA();
+    target->writeStub(buf + off, *sym, pointerVA);
     off += target->stubSize;
   }
 }
 
 void StubsSection::finalize() { isFinal = true; }
 
 static void addBindingsForStub(Symbol *sym) {
+  assert(!config->emitChainedFixups);
   if (auto *dysym = dyn_cast<DylibSymbol>(sym)) {
     if (sym->isWeakDef()) {
       in.binding->addEntry(dysym, in.lazyPointers->isec,
                            sym->stubsIndex * target->wordSize);
       in.weakBinding->addEntry(sym, in.lazyPointers->isec,
                                sym->stubsIndex * target->wordSize);
     } else {
       in.lazyBinding->addEntry(dysym);
if (auto *dysym = dyn_cast<DylibSymbol>(sym)) {
     llvm_unreachable("invalid stub target symbol type");
   }
 }
 
 void StubsSection::addEntry(Symbol *sym) {
   bool inserted = entries.insert(sym);
   if (inserted) {
     sym->stubsIndex = entries.size() - 1;
+
+    if (config->emitChainedFixups)
+      in.got->addEntry(sym);
+    else
       addBindingsForStub(sym);
   }
 }
 
 StubHelperSection::StubHelperSection()
     : SyntheticSection(segment_names::text, section_names::stubHelper) {
   flags = S_ATTR_SOME_INSTRUCTIONS | S_ATTR_PURE_INSTRUCTIONS;
   align = 4; // This section comprises machine instructions
 }
for (Symbol *sym : entries)
     sym->lazyBindOffset = encode(*sym);
 }
 
 void LazyBindingSection::writeTo(uint8_t *buf) const {
   memcpy(buf, contents.data(), contents.size());
 }
 
 void LazyBindingSection::addEntry(Symbol *sym) {
+  assert(!config->emitChainedFixups && "Chained fixups always bind eagerly");
   if (entries.insert(sym)) {
     sym->stubsHelperIndex = entries.size() - 1;
     in.rebase->addEntry(in.lazyPointers->isec,
                         sym->stubsIndex * target->wordSize);
   }
 }
 
 // Unlike the non-lazy binding section, the bind opcodes in this section aren't
for (const InputFile *file : inputFiles) {
           }
         }
       }
     }
   }
 
   // __dyld_private is a local symbol too. It's linker-created and doesn't
   // exist in any object file.
-  if (Defined *dyldPrivate = in.stubHelper->dyldPrivate)
-    localSymbolsHandler(dyldPrivate);
+  if (in.stubHelper && in.stubHelper->dyldPrivate)
+    localSymbolsHandler(in.stubHelper->dyldPrivate);
 
   for (Symbol *sym : symtab->getSymbols()) {
     if (!sym->isLive())
       continue;
     if (auto *defined = dyn_cast<Defined>(sym)) {
       if (!defined->includeInSymtab)
         continue;
       assert(defined->isExternal());
macho::makeSymtabSection(StringTableSection &stringTableSection) {
   return make<SymtabSectionImpl<LP>>(stringTableSection);
 }
 
 IndirectSymtabSection::IndirectSymtabSection()
     : LinkEditSection(segment_names::linkEdit,
                       section_names::indirectSymbolTable) {}
 
 uint32_t IndirectSymtabSection::getNumSymbols() const {
-  return in.got->getEntries().size() + in.tlvPointers->getEntries().size() +
-         2 * in.stubs->getEntries().size();
+  uint32_t size = in.got->getEntries().size() +
+                  in.tlvPointers->getEntries().size() +
+                  in.stubs->getEntries().size();
+  if (!config->emitChainedFixups)
+    size += in.stubs->getEntries().size();
+  return size;
 }
 
 bool IndirectSymtabSection::isNeeded() const {
   return in.got->isNeeded() || in.tlvPointers->isNeeded() ||
          in.stubs->isNeeded();
 }
 
 void IndirectSymtabSection::finalizeContents() {
   uint32_t off = 0;
   in.got->reserved1 = off;
   off += in.got->getEntries().size();
   in.tlvPointers->reserved1 = off;
   off += in.tlvPointers->getEntries().size();
   in.stubs->reserved1 = off;
+  if (in.lazyPointers) {
     off += in.stubs->getEntries().size();
     in.lazyPointers->reserved1 = off;
   }
+}
 
 static uint32_t indirectValue(const Symbol *sym) {
   if (sym->symtabIndex == UINT32_MAX)
     return INDIRECT_SYMBOL_LOCAL;
   if (auto *defined = dyn_cast<Defined>(sym))
     if (defined->privateExtern)
       return INDIRECT_SYMBOL_LOCAL;
   return sym->symtabIndex;
 }
 
 void IndirectSymtabSection::writeTo(uint8_t *buf) const {
   uint32_t off = 0;
   for (const Symbol *sym : in.got->getEntries()) {
     write32le(buf + off * sizeof(uint32_t), indirectValue(sym));
     ++off;
   }
   for (const Symbol *sym : in.tlvPointers->getEntries()) {
     write32le(buf + off * sizeof(uint32_t), indirectValue(sym));
     ++off;
   }
   for (const Symbol *sym : in.stubs->getEntries()) {
     write32le(buf + off * sizeof(uint32_t), indirectValue(sym));
     ++off;
   }
+
+  if (in.lazyPointers) {
     // There is a 1:1 correspondence between stubs and LazyPointerSection
     // entries. But giving __stubs and __la_symbol_ptr the same reserved1
     // (the offset into the indirect symbol table) so that they both refer
     // to the same range of offsets confuses `strip`, so write the stubs
     // symbol table offsets a second time.
     for (const Symbol *sym : in.stubs->getEntries()) {
       write32le(buf + off * sizeof(uint32_t), indirectValue(sym));
       ++off;
     }
   }
+}
 
 StringTableSection::StringTableSection()
     : LinkEditSection(segment_names::linkEdit, section_names::stringTable) {}
 
 uint32_t StringTableSection::addString(StringRef str) {
   uint32_t strx = size;
   strings.push_back(str); // TODO: consider deduplicating strings
   size += str.size() + 1; // account for null terminator
void macho::createSyntheticSymbols() {
   // The Itanium C++ ABI requires dylibs to pass a pointer to __cxa_atexit
   // which does e.g. cleanup of static global variables. The ABI document
   // says that the pointer can point to any address in one of the dylib's
   // segments, but in practice ld64 seems to set it to point to the header,
   // so that's what's implemented here.
   addHeaderSymbol("___dso_handle");
 }
 
+ChainedFixupsSection::ChainedFixupsSection()
+    : LinkEditSection(segment_names::linkEdit, section_names::chainFixups) {}
+
+bool ChainedFixupsSection::isNeeded() const {
+  assert(config->emitChainedFixups);
+  // dyld always expects LC_DYLD_CHAINED_FIXUPS to point to a valid
+  // dyld_chained_fixups_header, so we create this section even if there aren't
+  // any fixups.
+  return true;
+}
+
+static bool needsWeakBind(const Symbol &sym) {
+  if (auto *dysym = dyn_cast<DylibSymbol>(&sym))
+    return dysym->isWeakDef();
+  if (auto *defined = dyn_cast<Defined>(&sym))
+    return defined->isExternalWeakDef();
+  return false;
+}
+
+void ChainedFixupsSection::addBinding(const Symbol *sym,
+                                      const InputSection *isec, uint64_t offset,
+                                      int64_t addend) {
+  locations.emplace_back(isec, offset);
+  int64_t outlineAddend = (addend < 0 || addend > 0xFF) ? addend : 0;
+  auto [it, inserted] = bindings.insert(
+      {{sym, outlineAddend}, static_cast<uint32_t>(bindings.size())});
+
+  if (inserted) {
+    symtabSize += sym->getName().size() + 1;
+    hasWeakBind = hasWeakBind || needsWeakBind(*sym);
+    if (!isInt<23>(outlineAddend))
+      needsLargeAddend = true;
+    else if (outlineAddend != 0)
+      needsAddend = true;
+  }
+}
+
+std::pair<uint32_t, uint8_t>
+ChainedFixupsSection::getBinding(const Symbol *sym, int64_t addend) const {
+  int64_t outlineAddend = (addend < 0 || addend > 0xFF) ? addend : 0;
+  auto it = bindings.find({sym, outlineAddend});
+  assert(it != bindings.end() && "binding not found in the imports table");
+  if (outlineAddend == 0)
+    return {it->second, addend};
+  return {it->second, 0};
+}
+
+static size_t writeImport(uint8_t *buf, int format, uint32_t libOrdinal,
+                          bool weakRef, uint32_t nameOffset, int64_t addend) {
+  switch (format) {
+  case DYLD_CHAINED_IMPORT: {
+    auto *import = reinterpret_cast<dyld_chained_import *>(buf);
+    import->lib_ordinal = libOrdinal;
+    import->weak_import = weakRef;
+    import->name_offset = nameOffset;
+    return sizeof(dyld_chained_import);
+  }
+  case DYLD_CHAINED_IMPORT_ADDEND: {
+    auto *import = reinterpret_cast<dyld_chained_import_addend *>(buf);
+    import->lib_ordinal = libOrdinal;
+    import->weak_import = weakRef;
+    import->name_offset = nameOffset;
+    import->addend = addend;
+    return sizeof(dyld_chained_import_addend);
+  }
+  case DYLD_CHAINED_IMPORT_ADDEND64: {
+    auto *import = reinterpret_cast<dyld_chained_import_addend64 *>(buf);
+    import->lib_ordinal = libOrdinal;
+    import->weak_import = weakRef;
+    import->name_offset = nameOffset;
+    import->addend = addend;
+    return sizeof(dyld_chained_import_addend64);
+  }
+  default:
+    llvm_unreachable("Unknown import format");
+  }
+}
+
+size_t ChainedFixupsSection::SegmentInfo::getSize() const {
+  assert(pageStarts.size() > 0 && "SegmentInfo for segment with no fixups?");
+  return alignTo<8>(sizeof(dyld_chained_starts_in_segment) +
+                    pageStarts.back().first * sizeof(uint16_t));
+}
+
+size_t ChainedFixupsSection::SegmentInfo::writeTo(uint8_t *buf) const {
+  auto *segInfo = reinterpret_cast<dyld_chained_starts_in_segment *>(buf);
+  segInfo->size = getSize();
+  segInfo->page_size = target->getPageSize();
+  // FIXME: Use DYLD_CHAINED_PTR_64_OFFSET on newer OS versions.
+  segInfo->pointer_format = DYLD_CHAINED_PTR_64;
+  segInfo->segment_offset = oseg->addr - in.header->addr;
+  segInfo->max_valid_pointer = 0; // not used on 64-bit
+  segInfo->page_count = pageStarts.back().first + 1;
+
+  uint16_t *starts = segInfo->page_start;
+  for (size_t i = 0; i < segInfo->page_count; ++i)
+    starts[i] = DYLD_CHAINED_PTR_START_NONE;
+
+  for (auto [pageIdx, startAddr] : pageStarts)
+    starts[pageIdx] = startAddr;
+  return segInfo->size;
+}
+
+static size_t importEntrySize(int format) {
+  switch (format) {
+  case DYLD_CHAINED_IMPORT:
+    return sizeof(dyld_chained_import);
+  case DYLD_CHAINED_IMPORT_ADDEND:
+    return sizeof(dyld_chained_import_addend);
+  case DYLD_CHAINED_IMPORT_ADDEND64:
+    return sizeof(dyld_chained_import_addend64);
+  default:
+    llvm_unreachable("Unknown import format");
+  }
+}
+
+// This is step 3 of the algorithm described in the class comment of
+// ChainedFixupsSection.
+//
+// LC_DYLD_CHAINED_FIXUPS data consists of (in this order):
+// * A dyld_chained_fixups_header
+// * A dyld_chained_starts_in_image
+// * One dyld_chained_starts_in_segment per segment
+// * List of all imports (dyld_chained_import, dyld_chained_import_addend, or
+//   dyld_chained_import_addend64)
+// * Names of imported symbols
+void ChainedFixupsSection::writeTo(uint8_t *buf) const {
+  auto *header = reinterpret_cast<dyld_chained_fixups_header *>(buf);
+  header->fixups_version = 0;
+  header->imports_count = bindings.size();
+  header->imports_format = importFormat;
+  header->symbols_format = 0;
+
+  buf += alignTo<8>(sizeof(*header));
+
+  auto curOffset = [&buf, &header]() -> uint32_t {
+    return buf - reinterpret_cast<uint8_t *>(header);
+  };
+
+  header->starts_offset = curOffset();
+
+  auto *imageInfo = reinterpret_cast<dyld_chained_starts_in_image *>(buf);
+  imageInfo->seg_count = outputSegments.size();
+  uint32_t *segStarts = imageInfo->seg_info_offset;
+
+  // dyld_chained_starts_in_image ends in a flexible array member containing an
+  // uint32_t for each segment. Leave room for it, and fill it via segStarts.
+  buf += alignTo<8>(offsetof(dyld_chained_starts_in_image, seg_info_offset) +
+                    outputSegments.size() * sizeof(uint32_t));
+
+  // Initialize all offsets to 0, which indicates that the segment does not have
+  // fixups. Those that do have them will be filled in below.
+  for (size_t i = 0; i < outputSegments.size(); ++i)
+    segStarts[i] = 0;
+
+  for (const SegmentInfo &seg : fixupSegments) {
+    segStarts[seg.oseg->index] = curOffset() - header->starts_offset;
+    buf += seg.writeTo(buf);
+  }
+
+  // Write imports table.
+  header->imports_offset = curOffset();
+  uint64_t nameOffset = 0;
+  for (auto [import, idx] : bindings) {
+    const Symbol &sym = *import.first;
+    int16_t libOrdinal = needsWeakBind(sym) ? BIND_SPECIAL_DYLIB_WEAK_LOOKUP
+                                            : ordinalForSymbol(sym);
+    buf += writeImport(buf, importFormat, libOrdinal, sym.isWeakRef(),
+                       nameOffset, import.second);
+    nameOffset += sym.getName().size() + 1;
+  }
+
+  // Write imported symbol names.
+  header->symbols_offset = curOffset();
+  for (auto [import, idx] : bindings) {
+    StringRef name = import.first->getName();
+    memcpy(buf, name.data(), name.size());
+    buf += name.size() + 1; // account for null terminator
+  }
+
+  assert(curOffset() == getRawSize());
+}
+
+// This is step 2 of the algorithm described in the class comment of
+// ChainedFixupsSection.
+void ChainedFixupsSection::finalizeContents() {
+  assert(target->wordSize == 8 && "Only 64-bit platforms are supported");
+  assert(config->emitChainedFixups);
+
+  if (!isUInt<32>(symtabSize))
+    error("cannot encode chained fixups: imported symbols table size " +
+          Twine(symtabSize) + " exceeds 4 GiB");
+
+  if (needsLargeAddend || !isUInt<23>(symtabSize))
+    importFormat = DYLD_CHAINED_IMPORT_ADDEND64;
+  else if (needsAddend)
+    importFormat = DYLD_CHAINED_IMPORT_ADDEND;
+  else
+    importFormat = DYLD_CHAINED_IMPORT;
+
+  for (Location &loc : locations)
+    loc.offset =
+        loc.isec->parent->getSegmentOffset() + loc.isec->getOffset(loc.offset);
+
+  llvm::sort(locations, [](const Location &a, const Location &b) {
+    const OutputSegment *segA = a.isec->parent->parent;
+    const OutputSegment *segB = b.isec->parent->parent;
+    if (segA == segB)
+      return a.offset < b.offset;
+    return segA->addr < segB->addr;
+  });
+
+  auto sameSegment = [](const Location &a, const Location &b) {
+    return a.isec->parent->parent == b.isec->parent->parent;
+  };
+
+  const uint64_t pageSize = target->getPageSize();
+  for (size_t i = 0, count = locations.size(); i < count;) {
+    const Location &firstLoc = locations[i];
+    fixupSegments.emplace_back(firstLoc.isec->parent->parent);
+    while (i < count && sameSegment(locations[i], firstLoc)) {
+      uint32_t pageIdx = locations[i].offset / pageSize;
+      fixupSegments.back().pageStarts.emplace_back(
+          pageIdx, locations[i].offset % pageSize);
+      ++i;
+      while (i < count && sameSegment(locations[i], firstLoc) &&
+             locations[i].offset / pageSize == pageIdx)
+        ++i;
+    }
+  }
+
+  // Compute expected encoded size.
+  size = alignTo<8>(sizeof(dyld_chained_fixups_header));
+  size += alignTo<8>(offsetof(dyld_chained_starts_in_image, seg_info_offset) +
+                     outputSegments.size() * sizeof(uint32_t));
+  for (const SegmentInfo &seg : fixupSegments)
+    size += seg.getSize();
+  size += importEntrySize(importFormat) * bindings.size();
+  size += symtabSize;
+}
+
 template SymtabSection *macho::makeSymtabSection<LP64>(StringTableSection &);
 template SymtabSection *macho::makeSymtabSection<ILP32>(StringTableSection &);

lld/MachO/Target.h

public:
   virtual int64_t
   getEmbeddedAddend(llvm::MemoryBufferRef, uint64_t offset,
                     const llvm::MachO::relocation_info) const = 0;
   virtual void relocateOne(uint8_t *loc, const Reloc &, uint64_t va,
                            uint64_t relocVA) const = 0;
 
   // Write code for lazy binding. See the comments on StubsSection for more
   // details.
-  virtual void writeStub(uint8_t *buf, const Symbol &) const = 0;
+  virtual void writeStub(uint8_t *buf, const Symbol &,
+                         uint64_t pointerVA) const = 0;
   virtual void writeStubHelperHeader(uint8_t *buf) const = 0;
   virtual void writeStubHelperEntry(uint8_t *buf, const Symbol &,
                                     uint64_t entryAddr) const = 0;
 
   virtual void writeObjCMsgSendStub(uint8_t *buf, Symbol *sym,
                                     uint64_t stubsAddr, uint64_t stubOffset,
                                     uint64_t selrefsVA, uint64_t selectorIndex,
                                     uint64_t gotAddr,

lld/MachO/Writer.cpp

public:
   template <class LP> void createLoadCommands();
   void finalizeAddresses();
   void finalizeLinkEditSegment();
   void assignAddresses(OutputSegment *);
 
   void openFile();
   void writeSections();
   void applyOptimizationHints();
+  void buildFixupChains();
   void writeUuid();
   void writeCodeSignature();
   void writeOutputFile();
 
   template <class LP> void run();
 
   ThreadPool threadPool;
   std::unique_ptr<FileOutputBuffer> &buffer;
void writeTo(uint8_t *buf) const override {
     c->cmdsize = getSize();
     c->dataoff = static_cast<uint32_t>(section->fileOff);
     c->datasize = section->getSize();
   }
 
   CodeSignatureSection *section;
 };
 
+class LCExportsTrie final : public LoadCommand {
+public:
+  LCExportsTrie(ExportSection *section) : section(section) {}
+
+  uint32_t getSize() const override { return sizeof(linkedit_data_command); }
+
+  void writeTo(uint8_t *buf) const override {
+    auto *c = reinterpret_cast<linkedit_data_command *>(buf);
+    c->cmd = LC_DYLD_EXPORTS_TRIE;
+    c->cmdsize = getSize();
+    c->dataoff = section->fileOff;
+    c->datasize = section->getSize();
+  }
+
+  ExportSection *section;
+};
+
+class LCChainedFixups final : public LoadCommand {
+public:
+  LCChainedFixups(ChainedFixupsSection *section) : section(section) {}
+
+  uint32_t getSize() const override { return sizeof(linkedit_data_command); }
+
+  void writeTo(uint8_t *buf) const override {
+    auto *c = reinterpret_cast<linkedit_data_command *>(buf);
+    c->cmd = LC_DYLD_CHAINED_FIXUPS;
+    c->cmdsize = getSize();
+    c->dataoff = section->fileOff;
+    c->datasize = section->getSize();
+  }
+
+  ChainedFixupsSection *section;
+};
+
 } // namespace
 
 void Writer::treatSpecialUndefineds() {
   if (config->entry)
     if (auto *undefined = dyn_cast<Undefined>(config->entry))
       treatUndefinedSymbol(*undefined, "the entry point");
 
   // FIXME: This prints symbols that are undefined both in input files and
for (auto it = isec->relocs.begin(); it != isec->relocs.end(); ++it) {
         if (!isa<Undefined>(sym) && validateSymbolRelocation(sym, isec, r))
           prepareSymbolRelocation(sym, isec, r);
       } else {
         // Canonicalize the referent so that later accesses in Writer won't
         // have to worry about it. Perhaps we should do this for Defined::isec
         // too...
         auto *referentIsec = r.referent.get<InputSection *>();
         r.referent = referentIsec->canonical();
-        if (!r.pcrel)
+        if (!r.pcrel) {
+          if (config->emitChainedFixups)
+            in.chainedFixups->addRebase(isec, r.offset);
+          else
             in.rebase->addEntry(isec, r.offset);
         }
       }
     }
+  }
 
   in.unwindInfo->prepareRelocations();
 }
 
+static void addNonWeakDefinition(const Defined *defined) {
+  if (config->emitChainedFixups)
+    in.chainedFixups->setHasNonWeakDefinition();
+  else
+    in.weakBinding->addNonWeakDefinition(defined);
+}
+
 void Writer::scanSymbols() {
   TimeTraceScope timeScope("Scan symbols");
   for (Symbol *sym : symtab->getSymbols()) {
     if (auto *defined = dyn_cast<Defined>(sym)) {
       if (!defined->isLive())
         continue;
       defined->canonicalize();
       if (defined->overridesWeakDef)
-        in.weakBinding->addNonWeakDefinition(defined);
+        addNonWeakDefinition(defined);
       if (!defined->isAbsolute() && isCodeSection(defined->isec))
         in.unwindInfo->addSymbol(defined);
     } else if (const auto *dysym = dyn_cast<DylibSymbol>(sym)) {
       // This branch intentionally doesn't check isLive().
       if (dysym->isDynamicLookup())
         continue;
       dysym->getFile()->refState =
           std::max(dysym->getFile()->refState, dysym->getRefState());

 
 template <class LP> void Writer::createLoadCommands() {
   uint8_t segIndex = 0;
   for (OutputSegment *seg : outputSegments) {
     in.header->addLoadCommand(make<LCSegment<LP>>(seg->name, seg));
     seg->index = segIndex++;
   }
 
+  if (config->emitChainedFixups) {
+    in.header->addLoadCommand(make<LCChainedFixups>(in.chainedFixups));
+    in.header->addLoadCommand(make<LCExportsTrie>(in.exports));
+  } else {
     in.header->addLoadCommand(make<LCDyldInfo>(
         in.rebase, in.binding, in.weakBinding, in.lazyBinding, in.exports));
+  }
   in.header->addLoadCommand(make<LCSymtab>(symtabSection, stringTableSection));
   in.header->addLoadCommand(
       make<LCDysymtab>(symtabSection, indirectSymtabSection));
   if (!config->umbrella.empty())
     in.header->addLoadCommand(make<LCSubFramework>(config->umbrella));
   if (config->emitEncryptionInfo)
     in.header->addLoadCommand(make<LCEncryptionInfo<LP>>());
   for (StringRef path : config->runtimePaths)
for (OutputSegment *seg : outputSegments) {
     seg->fileSize = fileOff - seg->fileOff;
     seg->assignAddressesToStartEndSymbols();
   }
 }
 
 void Writer::finalizeLinkEditSegment() {
   TimeTraceScope timeScope("Finalize __LINKEDIT segment");
   // Fill __LINKEDIT contents.
-  std::vector<LinkEditSection *> linkEditSections{
-      in.rebase,
-      in.binding,
-      in.weakBinding,
-      in.lazyBinding,
-      in.exports,
-      symtabSection,
-      indirectSymtabSection,
-      dataInCodeSection,
-      functionStartsSection,
+  std::array<LinkEditSection *, 10> linkEditSections{
+      in.rebase,         in.binding,
+      in.weakBinding,    in.lazyBinding,
+      in.exports,        in.chainedFixups,
+      symtabSection,     indirectSymtabSection,
+      dataInCodeSection, functionStartsSection,
   };
   SmallVector<std::shared_future<void>> threadFutures;
   threadFutures.reserve(linkEditSections.size());
   for (LinkEditSection *osec : linkEditSections)
     if (osec)
       threadFutures.emplace_back(threadPool.async(
           [](LinkEditSection *osec) { osec->finalizeContents(); }, osec));
   for (std::shared_future<void> &future : threadFutures)
void Writer::writeUuid() {
   // Append the output filename so that identical binaries with different names
   // don't get the same UUID.
   hashes[chunks.size()] = xxHash64(sys::path::filename(config->finalOutput));
   uint64_t digest = xxHash64({reinterpret_cast<uint8_t *>(hashes.data()),
                               hashes.size() * sizeof(uint64_t)});
   uuidCommand->writeUuid(digest);
 }
 
+// This is step 5 of the algorithm described in the class comment of
+// ChainedFixupsSection.
+void Writer::buildFixupChains() {
+  if (!config->emitChainedFixups)
+    return;
+
+  const std::vector<Location> &loc = in.chainedFixups->getLocations();
+  if (loc.empty())
+    return;
+
+  TimeTraceScope timeScope("Build fixup chains");
+
+  const uint64_t pageSize = target->getPageSize();
+  constexpr uint32_t stride = 4; // for DYLD_CHAINED_PTR_64
+
+  for (size_t i = 0, count = loc.size(); i < count;) {
+    const OutputSegment *oseg = loc[i].isec->parent->parent;
+    uint8_t *buf = buffer->getBufferStart() + oseg->fileOff;
+    uint64_t pageIdx = loc[i].offset / pageSize;
+    ++i;
+
+    while (i < count && loc[i].isec->parent->parent == oseg &&
+           (loc[i].offset / pageSize) == pageIdx) {
+      uint64_t offset = loc[i].offset - loc[i - 1].offset;
+
+      auto fail = [&](Twine message) {
+        error(loc[i].isec->getSegName() + "," + loc[i].isec->getName() +
+              ", offset " +
+              Twine(loc[i].offset - loc[i].isec->parent->getSegmentOffset()) +
+              ": " + message);
+      };
+
+      if (offset < target->wordSize)
+        return fail("fixups overlap");
+      if (offset % stride != 0)
+        return fail(
+            "fixups are unaligned (offset " + Twine(offset) +
+            " is not a multiple of the stride). Re-link with -no_fixup_chains");
+
+      // The "next" field is in the same location for bind and rebase entries.
+      reinterpret_cast<dyld_chained_ptr_64_bind *>(buf + loc[i - 1].offset)
+          ->next = offset / stride;
+      ++i;
+    }
+  }
+}
+
 void Writer::writeCodeSignature() {
   if (codeSignatureSection) {
     TimeTraceScope timeScope("Write code signature");
     codeSignatureSection->writeHashes(buffer->getBufferStart());
   }
 }
 
 void Writer::writeOutputFile() {
   TimeTraceScope timeScope("Write output file");
   openFile();
   reportPendingUndefinedSymbols();
   if (errorCount())
     return;
   writeSections();
   applyOptimizationHints();
+  buildFixupChains();
   writeUuid();
   writeCodeSignature();
 
   if (auto e = buffer->commit())
     fatal("failed to write output '" + buffer->getPath() +
           "': " + toString(std::move(e)));
 }
 
if (in.initOffsets->isNeeded())
     in.initOffsets->setUp();
 
   // Do not proceed if there were undefined or duplicate symbols.
   reportPendingUndefinedSymbols();
   reportPendingDuplicateSymbols();
   if (errorCount())
     return;
 
-  if (in.stubHelper->isNeeded())
+  if (in.stubHelper && in.stubHelper->isNeeded())
     in.stubHelper->setUp();
 
   if (in.objCImageInfo->isNeeded())
     in.objCImageInfo->finalizeContents();
 
   // At this point, we should know exactly which output sections are needed,
   // courtesy of scanSymbols() and scanRelocations().
   createOutputSections<LP>();
if (config->dedupLiterals)
     in.cStringSection =
         make<DeduplicatedCStringSection>(section_names::cString);
   else
     in.cStringSection = make<CStringSection>(section_names::cString);
   in.objcMethnameSection =
       make<DeduplicatedCStringSection>(section_names::objcMethname);
   in.wordLiteralSection =
       config->dedupLiterals ? make<WordLiteralSection>() : nullptr;
+  if (config->emitChainedFixups) {
+    in.chainedFixups = make<ChainedFixupsSection>();
+  } else {
     in.rebase = make<RebaseSection>();
     in.binding = make<BindingSection>();
     in.weakBinding = make<WeakBindingSection>();
     in.lazyBinding = make<LazyBindingSection>();
+    in.lazyPointers = make<LazyPointerSection>();
+    in.stubHelper = make<StubHelperSection>();
+  }
   in.exports = make<ExportSection>();
   in.got = make<GotSection>();
   in.tlvPointers = make<TlvPointerSection>();
-  in.lazyPointers = make<LazyPointerSection>();
   in.stubs = make<StubsSection>();
-  in.stubHelper = make<StubHelperSection>();
   in.objcStubs = make<ObjCStubsSection>();
   in.unwindInfo = makeUnwindInfoSection();
   in.objCImageInfo = make<ObjCImageInfoSection>();
   in.initOffsets = make<InitOffsetsSection>();
 
   // This section contains space for just a single word, and will be used by
   // dyld to cache an address to the image loader it uses.
   uint8_t *arr = bAlloc().Allocate<uint8_t>(target->wordSize);

lld/test/MachO/chained-fixups-addend.s

+# REQUIRES: x86
+# RUN: rm -rf %t; split-file %s %t
+# RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin %t/dylib.s -o %t/dylib.o
+# RUN: %lld -lSystem -dylib %t/dylib.o -o %t/libdylib.dylib
+
+## FileCheck does not like wrapping arithmetic, so we specify all 3 check variables manually:
+##   ADDEND  := inline/outline addend, unsigned
+##   OUTLINE := outline addend, signed
+##   REBASE  := target of rebase; 0x1000 + ADDEND, unsigned
+
+## We can use the DYLD_CHAINED_IMPORT import format if 0 <= ADDEND <= 255 bytes.
+# RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin %t/main.s -o %t/main.o --defsym ADDEND=0
+# RUN: %lld -lSystem -dylib %t/main.o -L%t -ldylib -fixup_chains -o %t/out
+# RUN: llvm-objdump --macho --chained-fixups --dyld-info %t/out | \
+# RUN:     FileCheck %s -D#OUTLINE=0 -D#ADDEND=0 -D#%x,REBASE=0x1000 --check-prefixes=IMPORT,COMMON
+# RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin %t/main.s -o %t/main.o --defsym ADDEND=255
+# RUN: %lld -lSystem -dylib %t/main.o -L%t -ldylib -fixup_chains -o %t/out
+# RUN: llvm-objdump --macho --chained-fixups --dyld-info %t/out | \
+# RUN:     FileCheck %s -D#OUTLINE=0 -D#ADDEND=255 -D#%x,REBASE=0x10FF --check-prefixes=IMPORT,COMMON
+
+## DYLD_CHAINED_IMPORT_ADDEND is used if the addend fits in a 32-bit signed integer.
+# RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin %t/main.s -o %t/main.o --defsym ADDEND=-1
+# RUN: %lld -lSystem -dylib %t/main.o -L%t -ldylib -fixup_chains -o %t/out
+# RUN: llvm-objdump --macho --chained-fixups --dyld-info %t/out | \
+# RUN:     FileCheck %s -D#%d,OUTLINE=-1 -D#%x,ADDEND=0xFFFFFFFFFFFFFFFF -D#%x,REBASE=0xFFF \
+# RUN:     --check-prefixes=IMPORT-ADDEND,COMMON
+# RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin %t/main.s -o %t/main.o --defsym ADDEND=256
+# RUN: %lld -lSystem -dylib %t/main.o -L%t -ldylib -fixup_chains -o %t/out
+# RUN: llvm-objdump --macho --chained-fixups --dyld-info %t/out | \
+# RUN:     FileCheck %s -D#OUTLINE=256 -D#ADDEND=256 -D#%x,REBASE=0x1100 \
+# RUN:     --check-prefixes=IMPORT-ADDEND,COMMON
+
+## Otherwise, DYLD_CHAINED_IMPORT_ADDEND64 is used.
+# RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin %t/main.s -o %t/main.o --defsym ADDEND=0x100000000
+# RUN: %lld -lSystem -dylib %t/main.o -L%t -ldylib -fixup_chains -o %t/out
+# RUN: llvm-objdump --macho --chained-fixups --dyld-info %t/out | \
+# RUN:     FileCheck %s -D#%x,OUTLINE=0x100000000 -D#%x,ADDEND=0x100000000 \
+# RUN:     -D#%x,REBASE=0x100001000 --check-prefixes=IMPORT-ADDEND64,COMMON
+
+# COMMON:      dyld information:
+# COMMON-NEXT: segment  section address pointer  type  addend            dylib     symbol/vm address
+# COMMON-NEXT: __DATA   __data    {{.*}}         bind  0x[[#%X, ADDEND]] libdylib  _dysym
+# COMMON-NEXT: __DATA   __data    {{.*}}         rebase                            0x[[#%X, REBASE]]
+
+# COMMON:        chained fixups header (LC_DYLD_CHAINED_FIXUPS)
+# IMPORT:          imports_format = 1 (DYLD_CHAINED_IMPORT)
+# IMPORT-ADDEND:   imports_format = 2 (DYLD_CHAINED_IMPORT_ADDEND)
+# IMPORT-ADDEND64: imports_format = 3 (DYLD_CHAINED_IMPORT_ADDEND64)
+
+# IMPORT:             dyld chained import[0]
+# IMPORT-ADDEND:      dyld chained import addend[0]
+# IMPORT-ADDEND64:    dyld chained import addend64[0]
+# COMMON-NEXT:          lib_ordinal = 2 (libdylib)
+# COMMON-NEXT:          weak_import = 0
+# COMMON-NEXT:          name_offset = 0 (_dysym)
+# IMPORT-ADDEND-NEXT:   addend      = [[#%d, OUTLINE]]
+# IMPORT-ADDEND64-NEXT: addend      = [[#%d, OUTLINE]]
+
+#--- dylib.s
+.globl _dysym
+
+_dysym:
+  ret
+
+#--- main.s
+.globl _dysym, _local
+
+.data
+_local:
+.skip 128
+
+.p2align 3
+.quad _dysym + ADDEND
+.quad _local + ADDEND

lld/test/MachO/chained-fixups-empty.s

+# REQUIRES: x86
+# RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin %s -o %t.o
+# RUN: %lld -dylib -fixup_chains -o %t %t.o
+# RUN: llvm-objdump --macho --all-headers %t | FileCheck %s
+
+## dyld always expects LC_DYLD_CHAINED_FIXUPS to point to a valid
+## chained fixups header, even if there aren't any fixups.
+# CHECK:            cmd LC_DYLD_CHAINED_FIXUPS
+# CHECK-NEXT:   cmdsize 16
+# CHECK-NEXT:   dataoff [[#]]
+# CHECK-NEXT:  datasize 48
+
+## While ld64 emits the root trie node even if there are no exports,
+## setting the data size and offset to zero works too in practice.
+# CHECK:            cmd LC_DYLD_EXPORTS_TRIE
+# CHECK-NEXT:   cmdsize 16
+# CHECK-NEXT:   dataoff 0
+# CHECK-NEXT:  datasize 0
+
+## Old load commands should not be generated.
+# CHECK-NOT: cmd LC_DYLD_INFO_ONLY
+
+_not_exported:
+  .space 1

lld/test/MachO/flat-namespace-interposable.s

 # REQUIRES: x86
 # RUN: rm -rf %t; split-file %s %t
 
 ## With -flat_namespace, non-weak extern symbols in dylibs become interposable.
 ## Check that we generate the correct bindings for them. The test also includes
 ## other symbol types like weak externs to verify we continue to do the same
 ## (correct) thing even when `-flat_namespace` is enabled, instead of generating
 ## spurious bindings.
 
 # RUN: llvm-mc -filetype=obj -triple=x86_64-apple-macos -o %t/foo.o %t/foo.s
 # RUN: %lld -lSystem -flat_namespace -o %t/foo %t/foo.o
+# RUN: %lld -lSystem -flat_namespace -fixup_chains -o %t/chained %t/foo.o
 # RUN: %lld -lSystem -dylib -flat_namespace -o %t/foo.dylib %t/foo.o
+# RUN: %lld -lSystem -dylib -flat_namespace -fixup_chains -o %t/chained.dylib %t/foo.o
 # RUN: %lld -lSystem -bundle -flat_namespace -o %t/foo.bundle %t/foo.o
+# RUN: %lld -lSystem -bundle -flat_namespace -fixup_chains -o %t/chained.bundle %t/foo.o
 # RUN: llvm-objdump --macho --syms --rebase --bind --lazy-bind --weak-bind %t/foo | \
 # RUN:   FileCheck %s --check-prefixes=SYMS,EXEC --implicit-check-not=_private_extern
-# RUN: llvm-objdump --macho --syms --rebase --bind --lazy-bind --weak-bind %t/foo.dylib | \
-# RUN:   FileCheck %s --check-prefixes=SYMS,DYLIB --implicit-check-not=_private_extern
-# RUN: llvm-objdump --macho --syms --rebase --bind --lazy-bind --weak-bind %t/foo.bundle | \
-# RUN:   FileCheck %s --check-prefixes=SYMS,DYLIB --implicit-check-not=_private_extern
+# RUN: llvm-objdump --macho --syms %t/chained >> %t/chained.objdump
+# RUN: llvm-objdump --macho --dyld-info %t/chained >> %t/chained.objdump
+# RUN: FileCheck %s --check-prefixes=SYMS,CHAINED-EXEC < %t/chained.objdump
+# RUN: llvm-objdump --macho --syms %t/chained.dylib >> %t/dylib.objdump
+# RUN: llvm-objdump --macho --dyld-info %t/chained.dylib >> %t/dylib.objdump
+# RUN: FileCheck %s --check-prefixes=SYMS,CHAINED-DYLIB < %t/dylib.objdump
+# RUN: llvm-objdump --macho --syms %t/chained.bundle >> %t/bundle.objdump
+# RUN: llvm-objdump --macho --dyld-info %t/chained.bundle >> %t/bundle.objdump
+# RUN: FileCheck %s --check-prefixes=SYMS,CHAINED-DYLIB < %t/bundle.objdump
 
 # SYMS: SYMBOL TABLE:
 # SYMS-DAG: [[#%x, EXTERN_REF:]] l     O __DATA,__data _extern_ref
 # SYMS-DAG: [[#%x, LOCAL_REF:]]  l     O __DATA,__data _local_ref
 # SYMS-DAG: [[#%x, WEAK_REF:]]   l     O __DATA,__data _weak_ref
 # SYMS-DAG: [[#%x, TLV_REF:]]    g     O __DATA,__thread_vars _tlv
 
 ## Executables with -flat_namespace don't have interposable externs.

 # EXEC-NEXT:  segment  section          address  dylib    symbol
 # EXEC-EMPTY:
 # EXEC-NEXT:  Weak bind table:
 # EXEC-NEXT:  segment  section          address                type     addend   symbol
 # EXEC-NEXT:  __DATA   __la_symbol_ptr  0x[[#%.8X, WEAK_LAZY]] pointer       0   _weak_extern
 # EXEC-NEXT:  __DATA   __data           0x[[#%.8X, WEAK_REF]]  pointer       0   _weak_extern
 # EXEC-EMPTY:
 
+# CHAINED-EXEC:      dyld information:
+# CHAINED-EXEC-NEXT: segment      section  address               pointer type   addend dylib  symbol/vm address
+# CHAINED-EXEC-DAG:  __DATA_CONST __got    {{.*}}                {{.*}}  bind   0x0    weak   _weak_extern
+# CHAINED-EXEC-DAG: __DATA       __data    0x[[#%x, EXTERN_REF]] {{.*}}  rebase               {{.*}}
+# CHAINED-EXEC-DAG: __DATA       __data    0x[[#%x, WEAK_REF]]   {{.*}}  bind   0x0    weak   _weak_extern
+# CHAINED-EXEC-DAG: __DATA       __data    0x[[#%x, LOCAL_REF]]  {{.*}}  rebase               {{.*}}
+# CHAINED-EXEC-EMPTY:
+
 # DYLIB:       Rebase table:
 # DYLIB-NEXT:  segment      section          address                  type
 # DYLIB-DAG:   __DATA       __la_symbol_ptr  0x[[#%X, WEAK_LAZY:]]    pointer
 # DYLIB-DAG:   __DATA       __la_symbol_ptr  0x[[#%X, EXTERN_LAZY:]]  pointer
 # DYLIB-DAG:   __DATA       __data           0x[[#%.8X, EXTERN_REF]]  pointer
 # DYLIB-DAG:   __DATA       __data           0x[[#%.8X, LOCAL_REF]]   pointer
 # DYLIB-DAG:   __DATA       __data           0x[[#%.8X, WEAK_REF]]    pointer
 # DYLIB-DAG:   __DATA       __thread_ptrs    0x[[#%.8X, TLV_REF]]     pointer

 # DYLIB-NEXT:  __DATA   __la_symbol_ptr    0x[[#%.8X, EXTERN_LAZY]] flat-namespace   _extern
 # DYLIB-EMPTY:
 # DYLIB-NEXT:  Weak bind table:
 # DYLIB-NEXT:  segment  section            address                  type    addend   symbol
 # DYLIB-NEXT:  __DATA   __la_symbol_ptr    0x[[#%.8X, WEAK_LAZY]]   pointer      0   _weak_extern
 # DYLIB-NEXT:  __DATA   __data             0x[[#%.8X, WEAK_REF]]    pointer      0   _weak_extern
 # DYLIB-EMPTY:
 
+# CHAINED-DYLIB: dyld information:
+# CHAINED-DYLIB-NEXT: segment      section      address               pointer type  addend dylib           symbol/vm address
+# CHAINED-DYLIB-DAG: __DATA_CONST __got         {{.*}}                {{.*}}  bind  0x0    weak            _weak_extern
+# CHAINED-DYLIB-DAG: __DATA_CONST __got         {{.*}}                {{.*}}  bind  0x0    flat-namespace  _extern
+# CHAINED-DYLIB-DAG: __DATA       __data        0x[[#%x, EXTERN_REF]] {{.*}}  bind  0x0    flat-namespace  _extern
+# CHAINED-DYLIB-DAG: __DATA       __data        0x[[#%x, WEAK_REF]]   {{.*}}  bind  0x0    weak            _weak_extern
+# CHAINED-DYLIB-DAG: __DATA       __data        0x[[#%x, LOCAL_REF]]  {{.*}}  rebase                       {{.*}}
+# CHAINED-DYLIB-DAG: __DATA       __thread_ptrs 0x[[#%x, TLV_REF]]    {{.*}}  bind  0x0    flat-namespace  _tlv
+# CHAINED-DYLIB-EMPTY:
+
 #--- foo.s
 
 .globl _main, _extern, _weak_extern, _tlv
 .weak_definition _weak_extern
 .private_extern _private_extern
 
 _extern:
   retq

lld/test/MachO/invalid/chained-fixups-incompatible.s

+# REQUIRES: x86, aarch64
+# RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin %s -o %t.o
+# RUN: not %lld -lSystem -no_pie -fixup_chains %t.o -o /dev/null 2>&1 | \
+# RUN:   FileCheck %s --check-prefix=NO-PIE
+# RUN: %no-fatal-warnings-lld -fixup_chains %t.o -o /dev/null \
+# RUN:   -lSystem -platform_version macos 10.15 10.15 2>&1 | \
+# RUN:   FileCheck %s --check-prefix=VERSION
+# RUN: llvm-mc -filetype=obj -triple=arm64_32-apple-darwin %s -o %t-arm64_32.o
+# RUN: not %lld-watchos -lSystem -fixup_chains %t-arm64_32.o -o /dev/null 2>&1 | \
+# RUN:   FileCheck %s --check-prefix=ARCH
+
+## Check that we emit diagnostics when -fixup_chains is explicitly specified,
+## but we don't support creating chained fixups for said configuration.
+# NO-PIE:  error: -fixup_chains is incompatible with -no_pie
+# VERSION: warning: -fixup_chains requires macOS 11.0, which is newer than target minimum of 10.15
+# ARCH:    error: -fixup_chains is only supported on x86_64 and arm64 targets
+
+.globl _main
+_main:
+  ret

lld/test/MachO/tlv-dylib.s

 # REQUIRES: x86
 # RUN: rm -rf %t; split-file %s %t
 
 # RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin %t/libtlv.s -o %t/libtlv.o
 # RUN: %lld -dylib -install_name @executable_path/libtlv.dylib \
 # RUN:   -lSystem -o %t/libtlv.dylib %t/libtlv.o
 # RUN: llvm-objdump --macho --exports-trie --rebase %t/libtlv.dylib | \
 # RUN:   FileCheck %s --check-prefix=DYLIB
 # DYLIB-DAG: _foo [per-thread]
 # DYLIB-DAG: _bar [per-thread]
 ## Make sure we don't emit rebase opcodes for relocations in __thread_vars.
 # DYLIB:       Rebase table:
 # DYLIB-NEXT:  segment  section            address     type
 # DYLIB-EMPTY:
 
+# RUN: %lld -dylib -install_name @executable_path/libtlv.dylib \
+# RUN:   -lSystem -fixup_chains -o %t/libtlv.dylib %t/libtlv.o
+## Make sure we don't emit fixups in __thread_vars.
+# RUN: llvm-objdump --macho --chained-fixups %t/libtlv.dylib | \
+# RUN:   FileCheck %s --check-prefix=CHAINED
+# CHAINED-NOT: __thread_vars
+
 # RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin %t/test.s -o %t/test.o
 # RUN: %lld -lSystem -L%t -ltlv %t/test.o -o %t/test
 # RUN: llvm-objdump --bind -d --no-show-raw-insn %t/test | FileCheck %s
 
 # CHECK:      movq [[#]](%rip), %rax ## 0x[[#%x, FOO:]]
 # CHECK-NEXT: movq [[#]](%rip), %rax ## 0x[[#%x, BAR:]]
 # CHECK-NEXT: movq [[#]](%rip), %rax ## 0x[[#%x, BAZ:]]
 

lld/test/MachO/weak-binding.s

 # REQUIRES: x86
 # RUN: rm -rf %t; split-file %s %t
 # RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin %t/test.s -o %t/test.o
 # RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin %t/libfoo.s -o %t/libfoo.o
 # RUN: %lld -dylib %t/libfoo.o -o %t/libfoo.dylib
 # RUN: %lld %t/test.o -L%t -lfoo -o %t/test -lSystem
-# RUN: llvm-objdump -d --no-show-raw-insn --rebase --bind --lazy-bind \
-# RUN:   --weak-bind --full-contents %t/test | FileCheck %s
+# RUN: llvm-objdump -d --no-show-raw-insn --rebase --bind --lazy-bind --weak-bind \
+# RUN:     --full-contents %t/test | FileCheck --check-prefixes=COMMON,CHECK %s
 
-# CHECK:      Contents of section __DATA_CONST,__got:
+# RUN: %lld -fixup_chains %t/test.o -L%t -lfoo -o %t/chained -lSystem
+# RUN: llvm-objdump -d --no-show-raw-insn --syms --full-contents %t/chained > %t/chained.objdump
+# RUN: llvm-objdump --macho --dyld-info %t/chained >> %t/chained.objdump
+# RUN: FileCheck %s --check-prefixes=COMMON,CHAINED < %t/chained.objdump
+
+# CHAINED: SYMBOL TABLE:
+# CHAINED: [[#%x,WEAK_INT:]] l     F __TEXT,__text _weak_internal{{$}}
+
+# COMMON:      Contents of section __DATA_CONST,__got:
 ## Check that this section contains a nonzero pointer. It should point to
 ## _weak_external_for_gotpcrel.
-# CHECK-NEXT: {{[0-9a-f]+}} {{[0-9a-f ]*[1-9a-f]+[0-9a-f ]*}}
+# COMMON-NEXT: {{[0-9a-f]+}} {{[0-9a-f ]*[1-9a-f]+[0-9a-f ]*}}
 
 # CHECK:      Contents of section __DATA,__la_symbol_ptr:
 ## Check that this section contains a nonzero pointer. It should point to
 ## _weak_external_fn, but we don't have a good way of testing the exact value as
 ## the bytes here are in little-endian order.
 # CHECK-NEXT: {{[0-9a-f]+}} {{[0-9a-f ]*[1-9a-f]+[0-9a-f ]*}}
 
-# CHECK:      <_main>:
-# CHECK-NEXT: movq  [[#]](%rip), %rax  ## 0x[[#%X,WEAK_DY_GOT_ADDR:]]
-# CHECK-NEXT: movq  [[#]](%rip), %rax  ## 0x[[#%X,WEAK_EXT_GOT_ADDR:]]
-# CHECK-NEXT: leaq  [[#]](%rip), %rax  ## 0x[[#%X,WEAK_INT_GOT_ADDR:]]
-# CHECK-NEXT: movq  [[#]](%rip), %rax  ## 0x[[#%X,WEAK_TLV_ADDR:]]
-# CHECK-NEXT: movq  [[#]](%rip), %rax  ## 0x[[#%X,WEAK_DY_TLV_ADDR:]]
-# CHECK-NEXT: leaq  [[#]](%rip), %rax  ## 0x[[#%X,WEAK_INT_TLV_ADDR:]]
-# CHECK-NEXT: callq 0x{{[0-9a-f]*}}
-# CHECK-NEXT: callq 0x{{[0-9a-f]*}}
-# CHECK-NEXT: callq 0x{{[0-9a-f]*}}
+# COMMON-LABEL:      <_main>:
+# COMMON-NEXT: movq  [[#]](%rip), %rax  ## 0x[[#%X,WEAK_DY_GOT_ADDR:]]
+# COMMON-NEXT: movq  [[#]](%rip), %rax  ## 0x[[#%X,WEAK_EXT_GOT_ADDR:]]
+# COMMON-NEXT: leaq  [[#]](%rip), %rax  ## 0x[[#%X,WEAK_INT_GOT_ADDR:]]
+# COMMON-NEXT: movq  [[#]](%rip), %rax  ## 0x[[#%X,WEAK_TLV_ADDR:]]
+# COMMON-NEXT: movq  [[#]](%rip), %rax  ## 0x[[#%X,WEAK_DY_TLV_ADDR:]]
+# COMMON-NEXT: leaq  [[#]](%rip), %rax  ## 0x[[#%X,WEAK_INT_TLV_ADDR:]]
+# COMMON-NEXT: callq 0x{{[0-9a-f]*}}
+# COMMON-NEXT: callq 0x{{[0-9a-f]*}}
+# COMMON-NEXT: callq 0x{{[0-9a-f]*}}
 
 # CHECK-LABEL: Rebase table:
 # CHECK:       __DATA        __la_symbol_ptr 0x[[#%x,WEAK_EXT_FN:]]  pointer
 
 # CHECK-LABEL: Bind table:
 # CHECK-DAG:   __DATA_CONST  __got           0x[[#WEAK_DY_GOT_ADDR]] pointer 0 libfoo    _weak_dysym_for_gotpcrel
 # CHECK-DAG:   __DATA        __la_symbol_ptr 0x[[#%x,WEAK_DY_FN:]]   pointer 0 libfoo    _weak_dysym_fn
 # CHECK-DAG:   __DATA        __data          0x[[#%x,WEAK_DY:]]      pointer 0 libfoo    _weak_dysym

 # CHECK-EMPTY:
 
 ## Weak internal symbols don't get bindings
 # RUN: llvm-objdump --macho --bind --lazy-bind --weak-bind %t/test | FileCheck %s --check-prefix=WEAK-INTERNAL
 # WEAK-INTERNAL-NOT: _weak_internal
 # WEAK-INTERNAL-NOT: _weak_internal_fn
 # WEAK-INTERNAL-NOT: _weak_internal_tlv
 
+# CHAINED-LABEL: dyld information:
+# CHAINED-NEXT:  segment      section       address                  pointer type  addend dylib      symbol/vm address
+# CHAINED-DAG:   __DATA_CONST __got         0x{{[0-9a-f]*}}          {{.*}}  bind  0x0    weak       _weak_external_fn
+# CHAINED-DAG:   __DATA_CONST __got         0x{{[0-9a-f]*}}          {{.*}}  bind  0x0    weak       _weak_dysym_fn
+# CHAINED-DAG:   __DATA_CONST __got         0x[[#WEAK_EXT_GOT_ADDR]] {{.*}}  bind  0x0    weak       _weak_external_for_gotpcrel
+# CHAINED-DAG:   __DATA_CONST __got         0x[[#WEAK_DY_GOT_ADDR]]  {{.*}}  bind  0x0    weak       _weak_dysym_for_gotpcrel
+# CHAINED-DAG:   __DATA       __data        0x{{[0-9a-f]*}}          {{.*}}  bind  0x0    weak       _weak_dysym
+# CHAINED-DAG:   __DATA       __data        0x{{[0-9a-f]*}}          {{.*}}  bind  0x2    weak       _weak_external
+# CHAINED-DAG:   __DATA       __data        0x{{[0-9a-f]*}}          {{.*}}  rebase                  0x[[#%X,WEAK_INT]]
+# CHAINED-DAG:   __DATA       __thread_vars 0x{{[0-9a-f]*}}          {{.*}}  bind  0x0    libSystem  __tlv_bootstrap
+# CHAINED-DAG:   __DATA       __thread_vars 0x{{[0-9a-f]*}}          {{.*}}  bind  0x0    libSystem  __tlv_bootstrap
+# CHAINED-DAG:   __DATA       __thread_ptrs 0x[[#WEAK_DY_TLV_ADDR]]  {{.*}}  bind  0x0    weak       _weak_dysym_tlv
+# CHAINED-DAG:   __DATA       __thread_ptrs 0x[[#WEAK_TLV_ADDR]]     {{.*}}  bind  0x0    weak       _weak_tlv
+# CHAINED-EMPTY:
+
 #--- libfoo.s
 
 .globl _weak_dysym
 .weak_definition _weak_dysym
 _weak_dysym:
   .quad 0x1234
 
 .globl _weak_dysym_for_gotpcrel

lld/test/MachO/weak-reference.s

 # REQUIRES: x86
 # RUN: rm -rf %t; split-file %s %t
 # RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin %t/libfoo.s -o %t/libfoo.o
 # RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin %t/strongref.s -o %t/strongref.o
 # RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin %t/test.s -o %t/test.o
 # RUN: llvm-mc -filetype=obj -triple=x86_64-apple-darwin %t/invalid.s -o %t/invalid.o
 # RUN: %lld -lSystem -dylib %t/libfoo.o -o %t/libfoo.dylib
 
 # RUN: %lld -lSystem %t/test.o %t/libfoo.dylib -o %t/test
-# RUN: llvm-objdump --macho --syms --bind %t/test | FileCheck %s --check-prefixes=SYMS,BIND
+# RUN: %lld -fixup_chains -lSystem %t/test.o %t/libfoo.dylib -o %t/chained
+# RUN: llvm-objdump --macho --syms --bind --lazy-bind %t/test | FileCheck %s --check-prefixes=SYMS,BIND
+# RUN: llvm-objdump --macho --syms --dyld-info %t/chained | FileCheck %s --check-prefixes=CHAINED
 ## llvm-objdump doesn't print out all the flags info for lazy & weak bindings,
 ## so we use obj2yaml instead to test them.
 # RUN: obj2yaml %t/test | FileCheck %s --check-prefix=YAML
 
 # RUN: %lld -lSystem %t/libfoo.dylib %t/test.o -o %t/test
-# RUN: llvm-objdump --macho --syms --bind %t/test | FileCheck %s --check-prefixes=SYMS,BIND
+# RUN: llvm-objdump --macho --syms --bind --lazy-bind %t/test | FileCheck %s --check-prefixes=SYMS,BIND
 # RUN: obj2yaml %t/test | FileCheck %s --check-prefix=YAML
 
 # SYMS:     SYMBOL TABLE:
 # SYMS-DAG: 0000000000000000  w  *UND* _foo
 # SYMS-DAG: 0000000000000000  w  *UND* _foo_fn
 # SYMS-DAG: 0000000000000000  w  *UND* _foo_tlv
 # SYMS-DAG: 0000000000000000  w  *UND* _weak_foo
 # SYMS-DAG: 0000000000000000  w  *UND* _weak_foo_fn
 
 # BIND:      Bind table:
 # BIND-NEXT: segment       section          address         type     addend dylib   symbol
 # BIND-DAG:  __DATA        __data           0x{{[0-9a-f]+}} pointer       0 libfoo  _foo (weak_import)
 # BIND-DAG:  __DATA_CONST  __got            0x{{[0-9a-f]+}} pointer       0 libfoo  _foo (weak_import)
 # BIND-DAG:  __DATA        __thread_ptrs    0x{{[0-9a-f]+}} pointer       0 libfoo  _foo_tlv (weak_import)
 # BIND-DAG:  __DATA        __data           0x{{[0-9a-f]+}} pointer       0 libfoo  _weak_foo (weak_import)
 # BIND-DAG:  __DATA        __la_symbol_ptr  0x{{[0-9a-f]+}} pointer       0 libfoo  _weak_foo_fn (weak_import)
+# BIND:      Lazy bind table:
+# BIND-NEXT: segment       section          address                         dylib   symbol
+# BIND-DAG:  __DATA        __la_symbol_ptr  0x{{[0-9a-f]+}}                  libfoo  _foo_fn
+
+# CHAINED:      dyld information:
+# CHAINED-NEXT: segment      section       address pointer type  addend dylib    symbol/vm address
+# CHAINED-DAG:  __DATA_CONST __got             {{.*}}      bind  0x0    libfoo   _foo (weak import)
+# CHAINED-DAG:  __DATA       __data            {{.*}}      bind  0x0    libfoo   _foo (weak import)
+# CHAINED-DAG:  __DATA       __thread_ptrs     {{.*}}      bind  0x0    libfoo   _foo_tlv (weak import)
+# CHAINED-DAG:  __DATA_CONST __got             {{.*}}      bind  0x0    libfoo   _foo_fn (weak import)
+# CHAINED-DAG:  __DATA       __data            {{.*}}      bind  0x0    weak     _weak_foo (weak import)
+# CHAINED-DAG:  __DATA_CONST __got             {{.*}}      bind  0x0    weak     _weak_foo_fn (weak import)
 
 # YAML-LABEL: WeakBindOpcodes:
 # YAML:        - Opcode:          BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM
 # YAML-NEXT:     Imm:             0
 # YAML-NEXT:     Symbol:          _weak_foo_fn
 # YAML:        - Opcode:          BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM
 # YAML-NEXT:     Imm:             0
 # YAML-NEXT:     Symbol:          _weak_foo
 # YAML-LABEL: LazyBindOpcodes:
 # YAML:        - Opcode:          BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM
 # YAML-NEXT:     Imm:             1
 # YAML-NEXT:     Symbol:          _foo_fn
 
 ## Check that if both strong & weak references are present in inputs, the weak
 ## reference takes priority. NOTE: ld64 actually emits a strong reference if
 ## the reference is to a function symbol or a TLV. I'm not sure if there's a
 ## good reason for that, so I'm deviating here for a simpler implementation.
 # RUN: %lld -lSystem %t/test.o %t/strongref.o %t/libfoo.dylib -o %t/with-strong
+# RUN: %lld -fixup_chains -lSystem %t/test.o %t/strongref.o %t/libfoo.dylib -o %t/with-strong-chained
 # RUN: llvm-objdump --macho --bind %t/with-strong | FileCheck %s --check-prefix=STRONG-BIND
+# RUN: llvm-objdump --macho --dyld-info %t/with-strong-chained | FileCheck %s --check-prefix=STRONG-CHAINED
 # RUN: obj2yaml %t/with-strong | FileCheck %s --check-prefix=STRONG-YAML
 # RUN: %lld -lSystem %t/strongref.o %t/test.o %t/libfoo.dylib -o %t/with-strong
+# RUN: %lld -fixup_chains -lSystem %t/strongref.o %t/test.o %t/libfoo.dylib -o %t/with-strong-chained
 # RUN: llvm-objdump --macho --bind %t/with-strong | FileCheck %s --check-prefix=STRONG-BIND
+# RUN: llvm-objdump --macho --dyld-info %t/with-strong-chained | FileCheck %s --check-prefix=STRONG-CHAINED
 # RUN: obj2yaml %t/with-strong | FileCheck %s --check-prefix=STRONG-YAML
 # RUN: %lld -lSystem %t/libfoo.dylib %t/strongref.o %t/test.o -o %t/with-strong
+# RUN: %lld -fixup_chains -lSystem %t/libfoo.dylib %t/strongref.o %t/test.o -o %t/with-strong-chained
 # RUN: llvm-objdump --macho --bind %t/with-strong | FileCheck %s --check-prefix=STRONG-BIND
+# RUN: llvm-objdump --macho --dyld-info %t/with-strong-chained | FileCheck %s --check-prefix=STRONG-CHAINED
 # RUN: obj2yaml %t/with-strong | FileCheck %s --check-prefix=STRONG-YAML
 # RUN: %lld -lSystem %t/libfoo.dylib %t/test.o %t/strongref.o -o %t/with-strong
+# RUN: %lld -fixup_chains -lSystem %t/libfoo.dylib %t/test.o %t/strongref.o -o %t/with-strong-chained
 # RUN: llvm-objdump --macho --bind %t/with-strong | FileCheck %s --check-prefix=STRONG-BIND
+# RUN: llvm-objdump --macho --dyld-info %t/with-strong-chained | FileCheck %s --check-prefix=STRONG-CHAINED
 # RUN: obj2yaml %t/with-strong | FileCheck %s --check-prefix=STRONG-YAML
 # RUN: %lld -lSystem %t/test.o %t/libfoo.dylib %t/strongref.o -o %t/with-strong
+# RUN: %lld -fixup_chains -lSystem %t/test.o %t/libfoo.dylib %t/strongref.o -o %t/with-strong-chained
 # RUN: llvm-objdump --macho --bind %t/with-strong | FileCheck %s --check-prefix=STRONG-BIND
+# RUN: llvm-objdump --macho --dyld-info %t/with-strong-chained | FileCheck %s --check-prefix=STRONG-CHAINED
 # RUN: obj2yaml %t/with-strong | FileCheck %s --check-prefix=STRONG-YAML
 # RUN: %lld -lSystem %t/strongref.o %t/libfoo.dylib %t/test.o -o %t/with-strong
+# RUN: %lld -fixup_chains -lSystem %t/strongref.o %t/libfoo.dylib %t/test.o -o %t/with-strong-chained
 # RUN: llvm-objdump --macho --bind %t/with-strong | FileCheck %s --check-prefix=STRONG-BIND
+# RUN: llvm-objdump --macho --dyld-info %t/with-strong-chained | FileCheck %s --check-prefix=STRONG-CHAINED
 # RUN: obj2yaml %t/with-strong | FileCheck %s --check-prefix=STRONG-YAML
 
 # STRONG-BIND:      Bind table:
 # STRONG-BIND-NEXT: segment       section          address         type       addend dylib   symbol
 # STRONG-BIND-DAG:  __DATA        __data           0x{{[0-9a-f]+}} pointer         0 libfoo  _foo{{$}}
 # STRONG-BIND-DAG:  __DATA        __data           0x{{[0-9a-f]+}} pointer         0 libfoo  _foo{{$}}
 # STRONG-BIND-DAG:  __DATA_CONST  __got            0x{{[0-9a-f]+}} pointer         0 libfoo  _foo{{$}}
 # STRONG-BIND-DAG:  __DATA        __thread_ptrs    0x{{[0-9a-f]+}} pointer         0 libfoo  _foo_tlv{{$}}
 # STRONG-BIND-DAG:  __DATA        __data           0x{{[0-9a-f]+}} pointer         0 libfoo  _weak_foo{{$}}
 # STRONG-BIND-DAG:  __DATA        __data           0x{{[0-9a-f]+}} pointer         0 libfoo  _weak_foo{{$}}
 # STRONG-BIND-DAG:  __DATA        __la_symbol_ptr  0x{{[0-9a-f]+}} pointer         0 libfoo  _weak_foo_fn{{$}}
 
+# STRONG-CHAINED:      dyld information:
+# STRONG-CHAINED-NEXT: segment      section      address pointer type  addend dylib   symbol/vm address
+# STRONG-CHAINED-DAG:  __DATA_CONST __got            {{.*}}      bind  0x0    weak    _weak_foo_fn{{$}}
+# STRONG-CHAINED-DAG:  __DATA_CONST __got            {{.*}}      bind  0x0    libfoo  _foo_fn{{$}}
+# STRONG-CHAINED-DAG:  __DATA_CONST __got            {{.*}}      bind  0x0    libfoo  _foo{{$}}
+# STRONG-CHAINED-DAG:  __DATA       __data           {{.*}}      bind  0x0    libfoo  _foo{{$}}
+# STRONG-CHAINED-DAG:  __DATA       __data           {{.*}}      bind  0x0    libfoo  _foo{{$}}
+# STRONG-CHAINED-DAG:  __DATA       __data           {{.*}}      bind  0x0    weak    _weak_foo{{$}}
+# STRONG-CHAINED-DAG:  __DATA       __data           {{.*}}      bind  0x0    weak    _weak_foo{{$}}
+# STRONG-CHAINED-DAG:  __DATA       __thread_ptrs    {{.*}}      bind  0x0    libfoo  _foo_tlv{{$}}
+
 # STRONG-YAML-LABEL: WeakBindOpcodes:
 # STRONG-YAML:        - Opcode:          BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM
 # STRONG-YAML-NEXT:     Imm:             0
 # STRONG-YAML-NEXT:     Symbol:          _weak_foo_fn
 # STRONG-YAML:        - Opcode:          BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM
 # STRONG-YAML-NEXT:     Imm:             0
 # STRONG-YAML-NEXT:     Symbol:          _weak_foo
 # STRONG-YAML-LABEL: LazyBindOpcodes:

llvm/include/llvm/BinaryFormat/MachO.h

struct nlist_64 {
   uint32_t n_strx;
   uint8_t n_type;
   uint8_t n_sect;
   uint16_t n_desc;
   uint64_t n_value;
 };
 
 // Values for dyld_chained_fixups_header::imports_format.
-enum {
+enum ChainedImportFormat {
   DYLD_CHAINED_IMPORT = 1,
   DYLD_CHAINED_IMPORT_ADDEND = 2,
   DYLD_CHAINED_IMPORT_ADDEND64 = 3,
 };
 
 // Values for dyld_chained_fixups_header::symbols_format.
 enum {
   DYLD_CHAINED_SYMBOL_UNCOMPRESSED = 0,