[AArch64] Fix range check of R_AARCH64_TLSLE_ADD_TPREL_HI12

[rprichard]

Summary

An AArch64 LE relocation is a positive ("variant 1") offset. This
relocation is used to write the upper 12 bits of a 24-bit offset into an
add instruction:

add x0, x0, :tprel_hi12:v1

The comment in the ARM docs for R_AARCH64_TLSLE_ADD_TPREL_HI12 is:

"Set an ADD immediate field to bits [23:12] of X; check 0 <= X < 2^24."

[rprichard]

The original line was added in https://reviews.llvm.org/rL260677.

I didn't see any other similar problems with other relocation overflow checks.

[rprichard]

For context, I didn't notice this bug because I needed more than 2^23 bytes of TLS LE memory, but because I was experimenting with using a variant 2 TLS layout with Android/AArch64. The standard layout (variant 1 with a 2-word TCB) is a problem because Bionic has allocated some memory that overlaps with the first TLS segment, accessible using TLS LE. In particular, the stack cookie is a problem (see getStackCookieLocation in https://reviews.llvm.org/D18632), because third-party binaries may be assuming a variant-1 incompatible TLS layout.

This range check bug isn't related to Android, though.

[peter.smith]

This change looks correct to me. The docs link is http://arminfo.emea.arm.com/help/topic/com.arm.doc.ihi0056b/IHI0056B_aaelf64.pdf search for relocation code 549 in Table 4-18, Local Exec TLS relocations. I've checked the other TPREL relocations that LLD has implemented and they are all of the NC (non range checked) kind so it looks like there aren't any others of this form.

[ruiu]

LGTM

lld/trunk/ELF/Arch/AArch64.cpp

void AArch64::relocateOne(uint8_t *Loc, RelType Type, uint64_t Val) const {
   case R_AARCH64_MOVW_UABS_G3:
     or32le(Loc, (Val & 0xFFFF000000000000) >> 43);
     break;
   case R_AARCH64_TSTBR14:
     checkInt(Loc, Val, 16, Type);
     or32le(Loc, (Val & 0xFFFC) << 3);
     break;
   case R_AARCH64_TLSLE_ADD_TPREL_HI12:
-    checkInt(Loc, Val, 24, Type);
+    checkUInt(Loc, Val, 24, Type);
     or32AArch64Imm(Loc, Val >> 12);
     break;
   case R_AARCH64_TLSLE_ADD_TPREL_LO12_NC:
   case R_AARCH64_TLSDESC_ADD_LO12:
     or32AArch64Imm(Loc, Val);
     break;
   default:
     error(getErrorLocation(Loc) + "unrecognized reloc " + Twine(Type));

lld/trunk/test/ELF/aarch64-tls-le.s

 # REQUIRES: aarch64
 # RUN: llvm-mc -filetype=obj -triple=aarch64-unknown-freebsd %s -o %tmain.o
 # RUN: ld.lld %tmain.o -o %tout
 # RUN: llvm-objdump -d %tout | FileCheck %s
 # RUN: llvm-readobj -s -r %tout | FileCheck -check-prefix=RELOC %s
 
 #Local-Dynamic to Initial-Exec relax creates no
 #RELOC:      Relocations [
 #RELOC-NEXT: ]
 
 .globl _start
 _start:
  mrs x0, TPIDR_EL0
  add x0, x0, :tprel_hi12:v1
  add x0, x0, :tprel_lo12_nc:v1
+ mrs x0, TPIDR_EL0
+ add x0, x0, :tprel_hi12:v2
+ add x0, x0, :tprel_lo12_nc:v2
 
 # TCB size = 0x16 and foo is first element from TLS register.
 #CHECK: Disassembly of section .text:
 #CHECK: _start:
 #CHECK:  210000: 40 d0 3b d5     mrs     x0, TPIDR_EL0
 #CHECK:  210004: 00 00 40 91     add     x0, x0, #0, lsl #12
 #CHECK:  210008: 00 40 00 91     add     x0, x0, #16
+#CHECK:  21000c: 40 d0 3b d5     mrs     x0, TPIDR_EL0
+#CHECK:  210010: 00 fc 7f 91     add     x0, x0, #4095, lsl #12
+#CHECK:  210014: 00 e0 3f 91     add     x0, x0, #4088
 
-.type   v1,@object
 .section        .tbss,"awT",@nobits
+
+.type   v1,@object
 .globl  v1
 .p2align 2
 v1:
 .word  0
 .size  v1, 4
 
+# The current offset from the thread pointer is 20. Raise it to just below the
+# 24-bit limit.
+.space (0xfffff8 - 20)
+
+.type   v2,@object
+.globl  v2
+.p2align 2
+v2:
+.word  0
+.size  v2, 4