[ELF] Disable relocation validation when targeting weak undefined symbols

[jhenderson]

Summary

When referencing weak undefined symbols, relocations are patched as though they target address zero. However, in the case of relative relocations, if the address being patched is large, the relocation will fail with an out of range error. This is unhelpful to the user, and they can only work around it by changing the base address of their program or explicitly defining the symbol, if this validation fails, which may not be desired.

This patch disables the validation of relocations when they target weak undefined symbols, in order to work around this issue. This is safe, because all such calls should be guarded anyway to ensure that the symbol really is defined.

[ruiu]

ELF/InputSection.cpp

731–733

I wonder if you really have to change this many places to handle weak undefined symbols. If you don't call relocateOne if UndefinedWeak is true, doesn't it work?

[jhenderson]

ELF/InputSection.cpp

731–733

I'm happy to do that. The only reason I did it this way was to match ld.bfd and gold's behaviour in this situation, but I don't think it really matters (the call should never be executed anyway).

[jhenderson]

ELF/InputSection.cpp

731–733

I've looked at making a version of this change that does what you suggested. However, this alternative behaviour breaks the guarantee provided by the ELF specification, that undefined weak symbols are treated as having a value of zero (ignoring the ARM special case). I'm concerned that there might be some issue with a corner case that relies on this behaviour.

The end result of this alternative change would be that either zero or the addend would be left in place in the instruction (depending on whether RELA or REL relocations are used), as opposed to zero or a value relative to zero (depending on whether we are dealing with an absolute or relative relocation).

[davidb]

ELF/InputSection.cpp

731–733

The change as it currently stands doesn't necessarily guarantee the result of the relocation patch is zero?

Can't you just enforce TargetVA to 0 when invoking relocateOne?

[davidb]

ELF/InputSection.cpp

731–733

With the ARM special case, are you referring to PC-biasing?

[ruiu]

Yeah. If the ELF specification says that unresolved weak symbols must be handled as address zero, and if address zero is not representable for some relocation, then I think the logical consequence is we should report it as error.

[jhenderson]

Having considered this, and looked at the latest behaviour of ld.bfd and gold (they both emit an error in this case), I think this change is not necessary after all.

ELF/InputSection.cpp

731–733

The change as it currently stands doesn't necessarily guarantee the result of the relocation patch is zero?

This isn't what is required by the standard, and isn't what is being attempted here. The idea is that the relocation is performed as if the virtual address of the target is zero, so a non-zero value will usually end up being patched in for relative relocations. An exception is that on ARM/AARCH64, PC-relative references are patched such that the branch etc ends up jumping to the next instruction (see getARMUndefinedRelativeWeakVA in LLD's code base).

Unfortunately treating a symbol as having a value of zero when the rest of the program is at a very high address can lead to out-of-range errors, hence the purpose of this change.

[bd1976llvm]

In D35944#824267, @ruiu wrote:

Yeah. If the ELF specification says that unresolved weak symbols must be handled as address zero, and if address zero is not representable for some relocation, then I think the logical consequence is we should report it as error.

Hi Rui,

Although this is being abandoned I wanted to point out that the behaviour of either ignoring the overflowing relocation or not performing the validation is correct and lld's current behavior is broken.
To see why consider the following example:

#pragma weak foo
void foo();
void main() {if (foo) foo();}

Here I only want to call foo if there is a definition. To do this I am using the "pragma weak" feature. The documentation for the feature states:

#pragma weak symbol
This pragma declares symbol to be weak, as if the declaration had the attribute of the same name. The pragma may appear before or after the declaration of symbol. It is not an error for symbol to never be defined at all.

However, with the current behavior of lld if I link this program at high address (e.g: lld main.o -Ttext=0xBADBADBAD) then lld errors with a relocation overflow error - lld, currently, breaks the "pragma weak" feature which guarantees that "it is not an error for the symbol to never be defined at all".

[ruiu]

Hi Ben,

Is that a real scenario? I mean, if function foo is defined in the same compilation unit as main, it is resolved locally, and if function foo is not defined in the same compilation unit as main, then the compiler emits a call instruction that can jump to any address (because the compiler doesn't know where foo will be after linking), no?

[bd1976llvm]

Hi Rui,

Is that a real scenario?

This absolutely is a real example. In fact that is the canonical code sequence for using weak symbols.

I mean, if function foo is defined in the same compilation unit as main, it is resolved locally, and if function foo is not defined in the same compilation unit as main, then the compiler emits a call instruction that can jump to any address (because the compiler doesn't know where foo will be after linking), no?

I'm afraid not. I am skipping some platform specific details here but in general the compiler must codegen so that the "if (foo)" test uses an absolute relocation however, it is free to use any valid code sequence for the call to foo. For example, when using the small code model on the x86_64 platform the compiler would be expected to use codegen that requires a 32 bit relative relocation for the call. For power-pc the call would be expected to require a 24 bit relative relocation etc...

Your next question might be: Why can't we require that the codegen always uses references with a large enough range? Well, we can't do that as it would penalize the codegen for weak references.

In some cases the linker could change the code or generate trampolines to make the call reach address 0 but this is extra work that the linker should not do as these references are invalid anyway.

[bd1976llvm]

Rafael via mailing list:

But isn't it invalid to ask for small code model and use high addresses?

Clang's behavior is inconsistent among architectures. For example, given

---

extern int foo1 attribute((weak));
int *bar1() { return &foo1; }
extern int foo2;

int *bar2() { return &foo2; }

And the command line

clang -target aarch64-pc-linux -S -Os test.c -fPIE -mpie-copy-relocations

We get

adrp    x0, :got:foo1
ldr     x0, [x0, :got_lo12:foo1]

...

adrp    x0, foo2
add     x0, x0, :lo12:foo2

but for x86_64 clang fails to take into consideration the fact that 0
might be out of range:

leaq    foo1(%rip), %rax
retq

leaq    foo2(%rip), %rax
retq

I think that is a bug in llvm on x86_64. I will take a quick look.

Cheers,
Rafael

Hi Rafael,

The behaviour for weak references is different across different platforms.

For example on arm and power you can write.

void f1() attribute((weak));
void main() {f1();}

Which can be expected to work correctly. However, this may fault on x86_64.

I think that is a bug in llvm on x86_64. I will take a quick look.

That does look like a bug. However, in general the codegen should not account for the possibility that the reference is unresolved - because we want to generate identical code as for strong references for the case that the weak reference is resolved. i.e:

"void f1() attribute((weak)); void f2() {f1();}" and "void f1(); void f2() {f1();}"

should codegen identically.

Another way to see what the right behaviour should be here is to draw a comparison with the lld feature "--unresolved-symbols=ignore-all".

If I link this example:

void f1(); void main() {f1();}

At a high address, e.g. "lld main.o -Ttext=0xbadbadbad" - I get an undefined symbol error. If I link the same example with: "lld main.o -Ttext=0xbadbadbad --unresolved-symbols=ignore-all" the link should succeed. It would clearly be a bug here to warn about an overflowing relocation - the same logic should apply to weak references.

ELF/Arch/AArch64.cpp

public:
   RelExpr getRelExpr(uint32_t Type, const SymbolBody &S,
                      const uint8_t *Loc) const override;
   bool isPicRel(uint32_t Type) const override;
   void writeGotPlt(uint8_t *Buf, const SymbolBody &S) const override;
   void writePltHeader(uint8_t *Buf) const override;
   void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
                 int32_t Index, unsigned RelOff) const override;
   bool usesOnlyLowPageBits(uint32_t Type) const override;
-  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
+  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                   bool Validate = true) const override;
   RelExpr adjustRelaxExpr(uint32_t Type, const uint8_t *Data,
                           RelExpr Expr) const override;
   void relaxTlsGdToLe(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
   void relaxTlsGdToIe(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
   void relaxTlsIeToLe(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
 };
 } // namespace
 

 
 static void or32le(uint8_t *P, int32_t V) { write32le(P, read32le(P) | V); }
 
 // Update the immediate field in a AARCH64 ldr, str, and add instruction.
 static void or32AArch64Imm(uint8_t *L, uint64_t Imm) {
   or32le(L, (Imm & 0xFFF) << 10);
 }
 
-void AArch64::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const {
+void AArch64::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                          bool Validate) const {
   switch (Type) {
   case R_AARCH64_ABS16:
   case R_AARCH64_PREL16:
+    if (Validate)
       checkIntUInt<16>(Loc, Val, Type);
     write16le(Loc, Val);
     break;
   case R_AARCH64_ABS32:
   case R_AARCH64_PREL32:
+    if (Validate)
       checkIntUInt<32>(Loc, Val, Type);
     write32le(Loc, Val);
     break;
   case R_AARCH64_ABS64:
   case R_AARCH64_GLOB_DAT:
   case R_AARCH64_PREL64:
     write64le(Loc, Val);
     break;
   case R_AARCH64_ADD_ABS_LO12_NC:
     or32AArch64Imm(Loc, Val);
     break;
   case R_AARCH64_ADR_GOT_PAGE:
   case R_AARCH64_ADR_PREL_PG_HI21:
   case R_AARCH64_TLSIE_ADR_GOTTPREL_PAGE21:
   case R_AARCH64_TLSDESC_ADR_PAGE21:
+    if (Validate)
       checkInt<33>(Loc, Val, Type);
     write32AArch64Addr(Loc, Val >> 12);
     break;
   case R_AARCH64_ADR_PREL_LO21:
+    if (Validate)
       checkInt<21>(Loc, Val, Type);
     write32AArch64Addr(Loc, Val);
     break;
   case R_AARCH64_CALL26:
   case R_AARCH64_JUMP26:
+    if (Validate)
       checkInt<28>(Loc, Val, Type);
     or32le(Loc, (Val & 0x0FFFFFFC) >> 2);
     break;
   case R_AARCH64_CONDBR19:
+    if (Validate)
       checkInt<21>(Loc, Val, Type);
     or32le(Loc, (Val & 0x1FFFFC) << 3);
     break;
   case R_AARCH64_LD64_GOT_LO12_NC:
   case R_AARCH64_TLSIE_LD64_GOTTPREL_LO12_NC:
   case R_AARCH64_TLSDESC_LD64_LO12:
+    if (Validate)
       checkAlignment<8>(Loc, Val, Type);
     or32le(Loc, (Val & 0xFF8) << 7);
     break;
   case R_AARCH64_LDST8_ABS_LO12_NC:
     or32AArch64Imm(Loc, getBits(Val, 0, 11));
     break;
   case R_AARCH64_LDST16_ABS_LO12_NC:
     or32AArch64Imm(Loc, getBits(Val, 1, 11));
     break;
case R_AARCH64_MOVW_UABS_G1_NC:
     break;
   case R_AARCH64_MOVW_UABS_G2_NC:
     or32le(Loc, (Val & 0xFFFF00000000) >> 27);
     break;
   case R_AARCH64_MOVW_UABS_G3:
     or32le(Loc, (Val & 0xFFFF000000000000) >> 43);
     break;
   case R_AARCH64_TSTBR14:
+    if (Validate)
       checkInt<16>(Loc, Val, Type);
     or32le(Loc, (Val & 0xFFFC) << 3);
     break;
   case R_AARCH64_TLSLE_ADD_TPREL_HI12:
+    if (Validate)
       checkInt<24>(Loc, Val, Type);
     or32AArch64Imm(Loc, Val >> 12);
     break;
   case R_AARCH64_TLSLE_ADD_TPREL_LO12_NC:
   case R_AARCH64_TLSDESC_ADD_LO12:
     or32AArch64Imm(Loc, Val);
     break;
   default:
     error(getErrorLocation(Loc) + "unrecognized reloc " + Twine(Type));

ELF/Arch/AMDGPU.cpp

 using namespace llvm::ELF;
 using namespace lld;
 using namespace lld::elf;
 
 namespace {
 class AMDGPU final : public TargetInfo {
 public:
   AMDGPU();
-  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
+  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                   bool Validate = true) const override;
   RelExpr getRelExpr(uint32_t Type, const SymbolBody &S,
                      const uint8_t *Loc) const override;
 };
 } // namespace
 
 AMDGPU::AMDGPU() {
   RelativeRel = R_AMDGPU_REL64;
   GotRel = R_AMDGPU_ABS64;
   GotEntrySize = 8;
 }
 
-void AMDGPU::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const {
+void AMDGPU::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                         bool /*Validate*/) const {
   switch (Type) {
   case R_AMDGPU_ABS32:
   case R_AMDGPU_GOTPCREL:
   case R_AMDGPU_GOTPCREL32_LO:
   case R_AMDGPU_REL32:
   case R_AMDGPU_REL32_LO:
     write32le(Loc, Val);
     break;

ELF/Arch/ARM.cpp

public:
   void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
                 int32_t Index, unsigned RelOff) const override;
   void addPltSymbols(InputSectionBase *IS, uint64_t Off) const override;
   void addPltHeaderSymbols(InputSectionBase *ISD) const override;
   bool needsThunk(RelExpr Expr, uint32_t RelocType, const InputFile *File,
                   const SymbolBody &S) const override;
   bool inBranchRange(uint32_t RelocType, uint64_t Src,
                      uint64_t Dst) const override;
-  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
+  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                   bool Validate = true) const override;
 };
 } // namespace
 
 ARM::ARM() {
   CopyRel = R_ARM_COPY;
   RelativeRel = R_ARM_RELATIVE;
   IRelativeRel = R_ARM_IRELATIVE;
   GotRel = R_ARM_GLOB_DAT;
bool ARM::inBranchRange(uint32_t RelocType, uint64_t Src, uint64_t Dst) const {
   else
     // Bit 0 == 1 denotes Thumb state, it is not part of the range
     Dst &= ~0x1;
 
   uint64_t Distance = (Src > Dst) ? Src - Dst : Dst - Src;
   return Distance <= Range;
 }
 
-void ARM::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const {
+void ARM::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                      bool Validate) const {
   switch (Type) {
   case R_ARM_ABS32:
   case R_ARM_BASE_PREL:
   case R_ARM_GLOB_DAT:
   case R_ARM_GOTOFF32:
   case R_ARM_GOT_BREL:
   case R_ARM_GOT_PREL:
   case R_ARM_REL32:
void ARM::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
   case R_ARM_TLS_TPOFF32:
   case R_ARM_TLS_DTPOFF32:
     write32le(Loc, Val);
     break;
   case R_ARM_TLS_DTPMOD32:
     write32le(Loc, 1);
     break;
   case R_ARM_PREL31:
+    if (Validate)
       checkInt<31>(Loc, Val, Type);
     write32le(Loc, (read32le(Loc) & 0x80000000) | (Val & ~0x80000000));
     break;
   case R_ARM_CALL:
     // R_ARM_CALL is used for BL and BLX instructions, depending on the
     // value of bit 0 of Val, we must select a BL or BLX instruction
     if (Val & 1) {
       // If bit 0 of Val is 1 the target is Thumb, we must select a BLX.
       // The BLX encoding is 0xfa:H:imm24 where Val = imm24:H:'1'
+      if (Validate)
         checkInt<26>(Loc, Val, Type);
       write32le(Loc, 0xfa000000 |                    // opcode
                          ((Val & 2) << 23) |         // H
                          ((Val >> 2) & 0x00ffffff)); // imm24
       break;
     }
     if ((read32le(Loc) & 0xfe000000) == 0xfa000000)
       // BLX (always unconditional) instruction to an ARM Target, select an
       // unconditional BL.
       write32le(Loc, 0xeb000000 | (read32le(Loc) & 0x00ffffff));
     // fall through as BL encoding is shared with B
     LLVM_FALLTHROUGH;
   case R_ARM_JUMP24:
   case R_ARM_PC24:
   case R_ARM_PLT32:
+    if (Validate)
       checkInt<26>(Loc, Val, Type);
     write32le(Loc, (read32le(Loc) & ~0x00ffffff) | ((Val >> 2) & 0x00ffffff));
     break;
   case R_ARM_THM_JUMP11:
+    if (Validate)
       checkInt<12>(Loc, Val, Type);
     write16le(Loc, (read32le(Loc) & 0xf800) | ((Val >> 1) & 0x07ff));
     break;
   case R_ARM_THM_JUMP19:
     // Encoding T3: Val = S:J2:J1:imm6:imm11:0
+    if (Validate)
       checkInt<21>(Loc, Val, Type);
     write16le(Loc,
               (read16le(Loc) & 0xfbc0) |   // opcode cond
                   ((Val >> 10) & 0x0400) | // S
                   ((Val >> 12) & 0x003f)); // imm6
     write16le(Loc + 2,
               0x8000 |                    // opcode
                   ((Val >> 8) & 0x0800) | // J2
                   ((Val >> 5) & 0x2000) | // J1
case R_ARM_THM_CALL:
     }
     // Bit 12 is 0 for BLX, 1 for BL
     write16le(Loc + 2, (read16le(Loc + 2) & ~0x1000) | (Val & 1) << 12);
     // Fall through as rest of encoding is the same as B.W
     LLVM_FALLTHROUGH;
   case R_ARM_THM_JUMP24:
     // Encoding B  T4, BL T1, BLX T2: Val = S:I1:I2:imm10:imm11:0
     // FIXME: Use of I1 and I2 require v6T2ops
+    if (Validate)
       checkInt<25>(Loc, Val, Type);
     write16le(Loc,
               0xf000 |                     // opcode
                   ((Val >> 14) & 0x0400) | // S
                   ((Val >> 12) & 0x03ff)); // imm10
     write16le(Loc + 2,
               (read16le(Loc + 2) & 0xd000) |                  // opcode
                   (((~(Val >> 10)) ^ (Val >> 11)) & 0x2000) | // J1
                   (((~(Val >> 11)) ^ (Val >> 13)) & 0x0800) | // J2
                   ((Val >> 1) & 0x07ff));                     // imm11
     break;
   case R_ARM_MOVW_ABS_NC:
   case R_ARM_MOVW_PREL_NC:
     write32le(Loc, (read32le(Loc) & ~0x000f0fff) | ((Val & 0xf000) << 4) |
                        (Val & 0x0fff));
     break;
   case R_ARM_MOVT_ABS:
   case R_ARM_MOVT_PREL:
+    if (Validate)
       checkInt<32>(Loc, Val, Type);
     write32le(Loc, (read32le(Loc) & ~0x000f0fff) |
                        (((Val >> 16) & 0xf000) << 4) | ((Val >> 16) & 0xfff));
     break;
   case R_ARM_THM_MOVT_ABS:
   case R_ARM_THM_MOVT_PREL:
     // Encoding T1: A = imm4:i:imm3:imm8
+    if (Validate)
       checkInt<32>(Loc, Val, Type);
     write16le(Loc,
               0xf2c0 |                     // opcode
                   ((Val >> 17) & 0x0400) | // i
                   ((Val >> 28) & 0x000f)); // imm4
     write16le(Loc + 2,
               (read16le(Loc + 2) & 0x8f00) | // opcode
                   ((Val >> 12) & 0x7000) |   // imm3
                   ((Val >> 16) & 0x00ff));   // imm8

ELF/Arch/AVR.cpp

 using namespace lld;
 using namespace lld::elf;
 
 namespace {
 class AVR final : public TargetInfo {
 public:
   RelExpr getRelExpr(uint32_t Type, const SymbolBody &S,
                      const uint8_t *Loc) const override;
-  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
+  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                   bool Validate = true) const override;
 };
 } // namespace
 
 RelExpr AVR::getRelExpr(uint32_t Type, const SymbolBody &S,
                         const uint8_t *Loc) const {
   switch (Type) {
   case R_AVR_CALL:
     return R_ABS;
   default:
     error(toString(S.File) + ": unknown relocation type: " + toString(Type));
     return R_HINT;
   }
 }
 
-void AVR::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const {
+void AVR::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                      bool /*Validate*/) const {
   switch (Type) {
   case R_AVR_CALL: {
     uint16_t Hi = Val >> 17;
     uint16_t Lo = Val >> 1;
     write16le(Loc, read16le(Loc) | ((Hi >> 1) << 4) | (Hi & 1));
     write16le(Loc + 2, Lo);
     break;
   }

ELF/Arch/Mips.cpp

public:
   bool isPicRel(uint32_t Type) const override;
   uint32_t getDynRel(uint32_t Type) const override;
   void writeGotPlt(uint8_t *Buf, const SymbolBody &S) const override;
   void writePltHeader(uint8_t *Buf) const override;
   void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
                 int32_t Index, unsigned RelOff) const override;
   bool needsThunk(RelExpr Expr, uint32_t RelocType, const InputFile *File,
                   const SymbolBody &S) const override;
-  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
+  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                   bool Validate = true) const override;
   bool usesOnlyLowPageBits(uint32_t Type) const override;
 };
 } // namespace
 
 template <class ELFT> MIPS<ELFT>::MIPS() {
   GotPltHeaderEntriesNum = 2;
   DefaultMaxPageSize = 65536;
   GotEntrySize = sizeof(typename ELFT::uint);

 template <endianness E, uint8_t BSIZE, uint8_t SHIFT>
 static int64_t getPcRelocAddend(const uint8_t *Loc) {
   uint32_t Instr = read32<E>(Loc);
   uint32_t Mask = 0xffffffff >> (32 - BSIZE);
   return SignExtend64<BSIZE + SHIFT>((Instr & Mask) << SHIFT);
 }
 
 template <endianness E, uint8_t BSIZE, uint8_t SHIFT>
-static void applyMipsPcReloc(uint8_t *Loc, uint32_t Type, uint64_t V) {
+static void applyMipsPcReloc(uint8_t *Loc, uint32_t Type, uint64_t V,
+                             bool Validate) {
   uint32_t Mask = 0xffffffff >> (32 - BSIZE);
   uint32_t Instr = read32<E>(Loc);
+  if (Validate) {
     if (SHIFT > 0)
       checkAlignment<(1 << SHIFT)>(Loc, V, Type);
     checkInt<BSIZE + SHIFT>(Loc, V, Type);
+  }
   write32<E>(Loc, (Instr & ~Mask) | ((V >> SHIFT) & Mask));
 }
 
 template <endianness E> static void writeMipsHi16(uint8_t *Loc, uint64_t V) {
   uint32_t Instr = read32<E>(Loc);
   uint16_t Res = ((V + 0x8000) >> 16) & 0xffff;
   write32<E>(Loc, (Instr & 0xffff0000) | Res);
 }
calculateMipsRelChain(uint8_t *Loc, uint32_t Type, uint64_t Val) {
   if (Type2 == R_MIPS_SUB && (Type3 == R_MIPS_HI16 || Type3 == R_MIPS_LO16))
     return std::make_pair(Type3, -Val);
   error(getErrorLocation(Loc) + "unsupported relocations combination " +
         Twine(Type));
   return std::make_pair(Type & 0xff, Val);
 }
 
 template <class ELFT>
-void MIPS<ELFT>::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const {
+void MIPS<ELFT>::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                             bool Validate) const {
   const endianness E = ELFT::TargetEndianness;
   // Thread pointer and DRP offsets from the start of TLS data area.
   // https://www.linux-mips.org/wiki/NPTL
   if (Type == R_MIPS_TLS_DTPREL_HI16 || Type == R_MIPS_TLS_DTPREL_LO16 ||
       Type == R_MIPS_TLS_DTPREL32 || Type == R_MIPS_TLS_DTPREL64)
     Val -= 0x8000;
   else if (Type == R_MIPS_TLS_TPREL_HI16 || Type == R_MIPS_TLS_TPREL_LO16 ||
            Type == R_MIPS_TLS_TPREL32 || Type == R_MIPS_TLS_TPREL64)
else {
       writeMipsLo16<E>(Loc, Val);
     }
     break;
   case R_MIPS_GOT_DISP:
   case R_MIPS_GOT_PAGE:
   case R_MIPS_GPREL16:
   case R_MIPS_TLS_GD:
   case R_MIPS_TLS_LDM:
+    if (Validate)
       checkInt<16>(Loc, Val, Type);
     LLVM_FALLTHROUGH;
   case R_MIPS_CALL16:
   case R_MIPS_CALL_LO16:
   case R_MIPS_GOT_LO16:
   case R_MIPS_GOT_OFST:
   case R_MIPS_LO16:
   case R_MIPS_PCLO16:
   case R_MIPS_TLS_DTPREL_LO16:
case R_MIPS_HIGHER:
     break;
   case R_MIPS_HIGHEST:
     writeMipsHighest<E>(Loc, Val);
     break;
   case R_MIPS_JALR:
     // Ignore this optimization relocation for now
     break;
   case R_MIPS_PC16:
-    applyMipsPcReloc<E, 16, 2>(Loc, Type, Val);
+    applyMipsPcReloc<E, 16, 2>(Loc, Type, Val, Validate);
     break;
   case R_MIPS_PC19_S2:
-    applyMipsPcReloc<E, 19, 2>(Loc, Type, Val);
+    applyMipsPcReloc<E, 19, 2>(Loc, Type, Val, Validate);
     break;
   case R_MIPS_PC21_S2:
-    applyMipsPcReloc<E, 21, 2>(Loc, Type, Val);
+    applyMipsPcReloc<E, 21, 2>(Loc, Type, Val, Validate);
     break;
   case R_MIPS_PC26_S2:
-    applyMipsPcReloc<E, 26, 2>(Loc, Type, Val);
+    applyMipsPcReloc<E, 26, 2>(Loc, Type, Val, Validate);
     break;
   case R_MIPS_PC32:
-    applyMipsPcReloc<E, 32, 0>(Loc, Type, Val);
+    applyMipsPcReloc<E, 32, 0>(Loc, Type, Val, Validate);
     break;
   default:
     error(getErrorLocation(Loc) + "unrecognized reloc " + Twine(Type));
   }
 }
 
 template <class ELFT>
 bool MIPS<ELFT>::usesOnlyLowPageBits(uint32_t Type) const {

ELF/Arch/PPC.cpp

 using namespace llvm::ELF;
 using namespace lld;
 using namespace lld::elf;
 
 namespace {
 class PPC final : public TargetInfo {
 public:
   PPC() { GotBaseSymOff = 0x8000; }
-  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
+  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                   bool Validate = true) const override;
   RelExpr getRelExpr(uint32_t Type, const SymbolBody &S,
                      const uint8_t *Loc) const override;
 };
 } // namespace
 
-void PPC::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const {
+void PPC::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                      bool /*Validate*/) const {
   switch (Type) {
   case R_PPC_ADDR16_HA:
     write16be(Loc, (Val + 0x8000) >> 16);
     break;
   case R_PPC_ADDR16_LO:
     write16be(Loc, Val);
     break;
   case R_PPC_ADDR32:

ELF/Arch/PPC64.cpp

 namespace {
 class PPC64 final : public TargetInfo {
 public:
   PPC64();
   RelExpr getRelExpr(uint32_t Type, const SymbolBody &S,
                      const uint8_t *Loc) const override;
   void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
                 int32_t Index, unsigned RelOff) const override;
-  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
+  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                   bool Validate = true) const override;
 };
 } // namespace
 
 // Relocation masks following the #lo(value), #hi(value), #ha(value),
 // #higher(value), #highera(value), #highest(value), and #highesta(value)
 // macros defined in section 4.5.1. Relocation Types of the PPC-elf64abi
 // document.
 static uint16_t applyPPCLo(uint64_t V) { return V; }
case R_PPC64_TOC16_LO:
     return {R_PPC64_ADDR16_LO, V};
   case R_PPC64_TOC16_LO_DS:
     return {R_PPC64_ADDR16_LO_DS, V};
   default:
     return {Type, Val};
   }
 }
 
-void PPC64::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const {
+void PPC64::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                        bool Validate) const {
   // For a TOC-relative relocation, proceed in terms of the corresponding
   // ADDR16 relocation type.
   std::tie(Type, Val) = toAddr16Rel(Type, Val);
 
   switch (Type) {
   case R_PPC64_ADDR14: {
+    if (Validate)
       checkAlignment<4>(Loc, Val, Type);
     // Preserve the AA/LK bits in the branch instruction
     uint8_t AALK = Loc[3];
     write16be(Loc + 2, (AALK & 3) | (Val & 0xfffc));
     break;
   }
   case R_PPC64_ADDR16:
+    if (Validate)
       checkInt<16>(Loc, Val, Type);
     write16be(Loc, Val);
     break;
   case R_PPC64_ADDR16_DS:
+    if (Validate)
       checkInt<16>(Loc, Val, Type);
     write16be(Loc, (read16be(Loc) & 3) | (Val & ~3));
     break;
   case R_PPC64_ADDR16_HA:
   case R_PPC64_REL16_HA:
     write16be(Loc, applyPPCHa(Val));
     break;
   case R_PPC64_ADDR16_HI:
   case R_PPC64_REL16_HI:
case R_PPC64_ADDR16_LO:
     write16be(Loc, applyPPCLo(Val));
     break;
   case R_PPC64_ADDR16_LO_DS:
   case R_PPC64_REL16_LO:
     write16be(Loc, (read16be(Loc) & 3) | (applyPPCLo(Val) & ~3));
     break;
   case R_PPC64_ADDR32:
   case R_PPC64_REL32:
+    if (Validate)
       checkInt<32>(Loc, Val, Type);
     write32be(Loc, Val);
     break;
   case R_PPC64_ADDR64:
   case R_PPC64_REL64:
   case R_PPC64_TOC:
     write64be(Loc, Val);
     break;
   case R_PPC64_REL24: {
     uint32_t Mask = 0x03FFFFFC;
+    if (Validate)
       checkInt<24>(Loc, Val, Type);
     write32be(Loc, (read32be(Loc) & ~Mask) | (Val & Mask));
     break;
   }
   default:
     error(getErrorLocation(Loc) + "unrecognized reloc " + Twine(Type));
   }
 }
 
 TargetInfo *elf::getPPC64TargetInfo() {
   static PPC64 Target;
   return &Target;
 }

ELF/Arch/SPARCV9.cpp

 namespace {
 class SPARCV9 final : public TargetInfo {
 public:
   SPARCV9();
   RelExpr getRelExpr(uint32_t Type, const SymbolBody &S,
                      const uint8_t *Loc) const override;
   void writePlt(uint8_t *Buf, uint64_t GotEntryAddr, uint64_t PltEntryAddr,
                 int32_t Index, unsigned RelOff) const override;
-  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
+  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                   bool Validate = true) const override;
 };
 } // namespace
 
 SPARCV9::SPARCV9() {
   CopyRel = R_SPARC_COPY;
   GotRel = R_SPARC_GLOB_DAT;
   PltRel = R_SPARC_JMP_SLOT;
   RelativeRel = R_SPARC_RELATIVE;
RelExpr SPARCV9::getRelExpr(uint32_t Type, const SymbolBody &S,
   case R_SPARC_NONE:
     return R_NONE;
   default:
     error(toString(S.File) + ": unknown relocation type: " + toString(Type));
     return R_HINT;
   }
 }
 
-void SPARCV9::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const {
+void SPARCV9::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                          bool Validate) const {
   switch (Type) {
   case R_SPARC_32:
   case R_SPARC_UA32:
     // V-word32
+    if (Validate)
       checkUInt<32>(Loc, Val, Type);
     write32be(Loc, Val);
     break;
   case R_SPARC_DISP32:
     // V-disp32
+    if (Validate)
       checkInt<32>(Loc, Val, Type);
     write32be(Loc, Val);
     break;
   case R_SPARC_WDISP30:
   case R_SPARC_WPLT30:
     // V-disp30
+    if (Validate)
       checkInt<32>(Loc, Val, Type);
     write32be(Loc, (read32be(Loc) & ~0x3fffffff) | ((Val >> 2) & 0x3fffffff));
     break;
   case R_SPARC_22:
     // V-imm22
+    if (Validate)
       checkUInt<22>(Loc, Val, Type);
     write32be(Loc, (read32be(Loc) & ~0x003fffff) | (Val & 0x003fffff));
     break;
   case R_SPARC_GOT22:
   case R_SPARC_PC22:
     // T-imm22
     write32be(Loc, (read32be(Loc) & ~0x003fffff) | ((Val >> 10) & 0x003fffff));
     break;
   case R_SPARC_WDISP19:
     // V-disp19
+    if (Validate)
       checkInt<21>(Loc, Val, Type);
     write32be(Loc, (read32be(Loc) & ~0x0007ffff) | ((Val >> 2) & 0x0007ffff));
     break;
   case R_SPARC_GOT10:
   case R_SPARC_PC10:
     // T-simm10
     write32be(Loc, (read32be(Loc) & ~0x000003ff) | (Val & 0x000003ff));
     break;
   case R_SPARC_64:

ELF/Arch/X86.cpp

public:
   int64_t getImplicitAddend(const uint8_t *Buf, uint32_t Type) const override;
   void writeGotPltHeader(uint8_t *Buf) const override;
   uint32_t getDynRel(uint32_t Type) const override;
   void writeGotPlt(uint8_t *Buf, const SymbolBody &S) const override;
   void writeIgotPlt(uint8_t *Buf, const SymbolBody &S) const override;
   void writePltHeader(uint8_t *Buf) const override;
   void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
                 int32_t Index, unsigned RelOff) const override;
-  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
+  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                   bool Validate = true) const override;
 
   RelExpr adjustRelaxExpr(uint32_t Type, const uint8_t *Data,
                           RelExpr Expr) const override;
   void relaxTlsGdToIe(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
   void relaxTlsGdToLe(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
   void relaxTlsIeToLe(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
   void relaxTlsLdToLe(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
 };
int64_t X86::getImplicitAddend(const uint8_t *Buf, uint32_t Type) const {
   case R_386_PC32:
   case R_386_PLT32:
   case R_386_TLS_LDO_32:
   case R_386_TLS_LE:
     return SignExtend64<32>(read32le(Buf));
   }
 }
 
-void X86::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const {
+void X86::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                      bool Validate) const {
   // R_386_{PC,}{8,16} are not part of the i386 psABI, but they are
   // being used for some 16-bit programs such as boot loaders, so
   // we want to support them.
   switch (Type) {
   case R_386_8:
+    if (Validate)
       checkUInt<8>(Loc, Val, Type);
     *Loc = Val;
     break;
   case R_386_PC8:
+    if (Validate)
       checkInt<8>(Loc, Val, Type);
     *Loc = Val;
     break;
   case R_386_16:
+    if (Validate)
       checkUInt<16>(Loc, Val, Type);
     write16le(Loc, Val);
     break;
   case R_386_PC16:
     // R_386_PC16 is normally used with 16 bit code. In that situation
     // the PC is 16 bits, just like the addend. This means that it can
     // point from any 16 bit address to any other if the possibility
     // of wrapping is included.
     // The only restriction we have to check then is that the destination
     // address fits in 16 bits. That is impossible to do here. The problem is
     // that we are passed the final value, which already had the
     // current location subtracted from it.
     // We just check that Val fits in 17 bits. This misses some cases, but
     // should have no false positives.
+    if (Validate)
       checkInt<17>(Loc, Val, Type);
     write16le(Loc, Val);
     break;
   default:
+    if (Validate)
       checkInt<32>(Loc, Val, Type);
     write32le(Loc, Val);
   }
 }
 
 void X86::relaxTlsGdToLe(uint8_t *Loc, uint32_t Type, uint64_t Val) const {
   // Convert
   //   leal x@tlsgd(, %ebx, 1),
   //   call __tls_get_addr@plt

ELF/Arch/X86_64.cpp

public:
   RelExpr getRelExpr(uint32_t Type, const SymbolBody &S,
                      const uint8_t *Loc) const override;
   bool isPicRel(uint32_t Type) const override;
   void writeGotPltHeader(uint8_t *Buf) const override;
   void writeGotPlt(uint8_t *Buf, const SymbolBody &S) const override;
   void writePltHeader(uint8_t *Buf) const override;
   void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
                 int32_t Index, unsigned RelOff) const override;
-  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
+  void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                   bool Validate = true) const override;
 
   RelExpr adjustRelaxExpr(uint32_t Type, const uint8_t *Data,
                           RelExpr Expr) const override;
   void relaxGot(uint8_t *Loc, uint64_t Val) const override;
   void relaxTlsGdToIe(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
   void relaxTlsGdToLe(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
   void relaxTlsIeToLe(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
   void relaxTlsLdToLe(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
const uint8_t Inst[] = {
       0x66, 0x66,                                          // .word 0x6666
       0x66,                                                // .byte 0x66
       0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 0x00, 0x00 // mov %fs:0,%rax
   };
   memcpy(Loc - 3, Inst, sizeof(Inst));
 }
 
 template <class ELFT>
-void X86_64<ELFT>::relocateOne(uint8_t *Loc, uint32_t Type,
-                               uint64_t Val) const {
+void X86_64<ELFT>::relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                               bool Validate) const {
   switch (Type) {
   case R_X86_64_8:
+    if (Validate)
       checkUInt<8>(Loc, Val, Type);
     *Loc = Val;
     break;
   case R_X86_64_16:
+    if (Validate)
       checkUInt<16>(Loc, Val, Type);
     write16le(Loc, Val);
     break;
   case R_X86_64_32:
+    if (Validate)
       checkUInt<32>(Loc, Val, Type);
     write32le(Loc, Val);
     break;
   case R_X86_64_32S:
   case R_X86_64_TPOFF32:
   case R_X86_64_GOT32:
   case R_X86_64_GOTPCREL:
   case R_X86_64_GOTPCRELX:
   case R_X86_64_REX_GOTPCRELX:
   case R_X86_64_PC32:
   case R_X86_64_GOTTPOFF:
   case R_X86_64_PLT32:
   case R_X86_64_TLSGD:
   case R_X86_64_TLSLD:
   case R_X86_64_DTPOFF32:
   case R_X86_64_SIZE32:
+    if (Validate)
       checkInt<32>(Loc, Val, Type);
     write32le(Loc, Val);
     break;
   case R_X86_64_64:
   case R_X86_64_DTPOFF64:
   case R_X86_64_GLOB_DAT:
   case R_X86_64_PC64:
   case R_X86_64_SIZE64:
   case R_X86_64_GOT64:

ELF/InputSection.cpp

case R_RELAX_TLS_GD_TO_IE_END:
       Target->relaxTlsGdToIe(BufLoc, Type, TargetVA);
       break;
     case R_PPC_PLT_OPD:
       // Patch a nop (0x60000000) to a ld.
       if (BufLoc + 8 <= BufEnd && read32be(BufLoc + 4) == 0x60000000)
         write32be(BufLoc + 4, 0xe8410028); // ld %r2, 40(%r1)
       LLVM_FALLTHROUGH;
     default:
-      Target->relocateOne(BufLoc, Type, TargetVA);
+      bool UndefinedWeak = (Rel.Sym->isUndefined() || Rel.Sym->isLazy()) &&
+                           !Rel.Sym->isLocal() && Rel.Sym->symbol()->isWeak();
+      Target->relocateOne(BufLoc, Type, TargetVA, !UndefinedWeak);
       break;
     }
   }
 }
 
 template <class ELFT> void InputSection::writeTo(uint8_t *Buf) {
   if (this->Type == SHT_NOBITS)
     return;

ELF/Target.h

public:
   // targeting S.
   virtual bool needsThunk(RelExpr Expr, uint32_t RelocType,
                           const InputFile *File, const SymbolBody &S) const;
   // Return true if we can reach Dst from Src with Relocation RelocType
   virtual bool inBranchRange(uint32_t RelocType, uint64_t Src,
                              uint64_t Dst) const;
   virtual RelExpr getRelExpr(uint32_t Type, const SymbolBody &S,
                              const uint8_t *Loc) const = 0;
-  virtual void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const = 0;
+  virtual void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val,
+                           bool Validate = true) const = 0;
   virtual ~TargetInfo();
 
   unsigned TlsGdRelaxSkip = 1;
   unsigned PageSize = 4096;
   unsigned DefaultMaxPageSize = 4096;
 
   // On FreeBSD x86_64 the first page cannot be mmaped.
   // On Linux that is controled by vm.mmap_min_addr. At least on some x86_64

test/ELF/weak-undef-and-large-addr.s

+# REQUIRES: x86
+# RUN: llvm-mc -filetype=obj -triple=x86_64-pc-linux %s -o %t.o
+# RUN: ld.lld %t.o -o %t.elf -Ttext=0x200000000
+
+.weak foo
+
+.globl _start
+_start:
+    call foo