[ELF] Implement Local Dynamic style TLSDESC for x86-64

[MaskRay]

Summary

For the Local Dynamic case of TLSDESC, _TLS_MODULE_BASE_ is defined as a
special TLS symbol that makes:

1. With LD->LE relaxation: _TLS_MODULE_BASE_@tpoff = 0 (lowest address in

the TLS block).

2. Without relaxation: it produces a dynamic TLSDESC relocation that

computes 0.

A Local Dynamic symbol can be accessed by adding an offset to tpoff (LE)
or dtpoff (LD) of _TLS_MODULE_BASE_. For the Local Dynamic case, this
saves GOT slots as otherwise we would create a dynamic TLSDESC
relocation and reserve two GOT slots for each symbol.

Add ElfSym::TlsModuleBase and change the signature of getTlsTpOffset()
to special case _TLS_MODULE_BASE_.

[grimar]

ELF/InputSection.cpp

594

I searched for _TLS_MODULE_BASE_ in LLVM code and found it is mentioned, but only for AARCH64.
Should it be created for this target too?

ELF/Writer.cpp

1609

i.e. how much reasonable this check is?

[MaskRay]

ELF/Writer.cpp

1609

In GNU linkers, _TLS_MODULE_BASE_ is defined on demand on i386/x86-64/arm/aarch64/s390. Many targets don't have an ABI for TLSDESC. If you feel we don't have to special case the TLSDESC targets that support TLSDESC, I can make this unconditional.

[MaskRay]

Synthesize _TLS_MODULE_BASE_ on all targets for simplicity.

[MaskRay]

Special case _TLS_MODULE_BASE_ on x86/x86-64 currently. We may extend this to
ARM/AArch64 in the future. Other targets don't have ABI for TLSDESC.

[grimar]

ELF/Writer.cpp

1609

I am not sure. Let see what Rui think. Perhaps whitelisting was fine. Without any conditions, I think arm/aarch64 will be just broken with this change (i.e. LLD will produce broken output instead of link error it seems).

1613

tlsBase -> TlsBase

test/ELF/x86-64-tlsdesc-ld.s

5

I would suggest adding a short description.

[ruiu]

ELF/InputSection.cpp

603

This line can be expensive if we have a lot of thread-local local symbols. getName() computes symbol names lazily, so if you call it on a local symbol, the function can be expensive. Maybe you should store TLSModuleBase symbol somewhere and compare S with the pointer?

[grimar]

ELF/InputSection.cpp

603

I thought about that too, but supposed that TLS symbols are not that common. Am I wrong?

[grimar]

ELF/InputSection.cpp

603

Also we can probably avoid this check if create the symbol with value of alignTo(Out::TlsPhdr->p_memsz, Out::TlsPhdr->p_align) it seems.

I.e. I am thinking about using original getTlsTpOffset() helper and creating a symbol with the value of -getTlsTpOffset().
Will this work?

[ruiu]

ELF/InputSection.cpp

603

Maybe it's not a big deal in practice. But identifying a symbol by name always rings a bell, so it'd probably easier to identify by a pointer comparison than explaining why this is not a big deal.

[MaskRay]

Store _TLS_MODULE_BASE as SymbolTable::TlsBase

[MaskRay]

Add comments to the test

[MaskRay]

ELF/InputSection.cpp

603

As a R_X86_64_TLSDESC dynamic relocation, the formula is: Sym->getVA(Addend) (in DynamicReloc::computeAddend())
As @tpoff, the formula is: Sym->getVA(A) + getTlsTpOffset()

Both must equal to 0. So there is a conflict. At least one place has to be a special case.

I feel the most straightforward approach is to special case the @tpoff computation here.

[MaskRay]

Switch back to the original whitelist approach

[grimar]

I have no more comments, this looks good to me.

[MaskRay]

Rename TlsBase to TlsModuleBase, elaborate the comment, and place the whitelist only in Writer::finalizeSections().

[grimar]

ELF/Writer.cpp

1626

Should this assignment be under if (S && S->isUndefined()) check?

I am not sure how much is real (I guess not at all honestly). but if user defines his own _TLS_MODULE_BASE_ symbol, then
with the current code getTlsTpOffset would return 0 for it. It is probably not user would expect.

[grimar]

ELF/Writer.cpp

1626

i.e.

if (S && S->isUndefined()) {
  S->resolve(Defined{/*File=*/nullptr, S->getName(), STB_GLOBAL, STV_HIDDEN,
                         STT_TLS, /*Value=*/0, 0,
                         /*Section=*/nullptr});
  Symtab->TlsModuleBase = S;
}

[ruiu]

LGTM with this change.

ELF/SymbolTable.h

63

We store this kind of symbol to ElfSym defined in Symbols.h. Please move.

[MaskRay]

Move SymTable::TlsModuleBase to ElfSym::TlsModuleBase and
move the assignment under the if (S && S->isUndefined()) check as grimar suggested.

ELF/InputSection.cpp

static Relocation *getRISCVPCRelHi20(const Symbol *Sym, uint64_t Addend) {
 
   error("R_RISCV_PCREL_LO12 relocation points to " + IS->getObjMsg(D->Value) +
         " without an associated R_RISCV_PCREL_HI20 relocation");
   return nullptr;
 }
 
 // A TLS symbol's virtual address is relative to the TLS segment. Add a
 // target-specific adjustment to produce a thread-pointer-relative offset.
-static int64_t getTlsTpOffset() {
+static int64_t getTlsTpOffset(const Symbol &S) {
+  // On targets that support TLSDESC, _TLS_MODULE_BASE_@tpoff = 0.
+  if (&S == Symtab->TlsModuleBase)
+    return 0;
+
   switch (Config->EMachine) {
   case EM_ARM:
   case EM_AARCH64:
     // Variant 1. The thread pointer points to a TCB with a fixed 2-word size,
     // followed by a variable amount of alignment padding, followed by the TLS
     // segment.
-    return alignTo(Config->Wordsize * 2, Out::TlsPhdr->p_align);
+    return S.getVA(0) + alignTo(Config->Wordsize * 2, Out::TlsPhdr->p_align);
   case EM_386:
   case EM_X86_64:
     // Variant 2. The TLS segment is located just before the thread pointer.
-    return -alignTo(Out::TlsPhdr->p_memsz, Out::TlsPhdr->p_align);
+    return S.getVA(0) - alignTo(Out::TlsPhdr->p_memsz, Out::TlsPhdr->p_align);
   case EM_PPC64:
     // The thread pointer points to a fixed offset from the start of the
     // executable's TLS segment. An offset of 0x7000 allows a signed 16-bit
     // offset to reach 0x1000 of TCB/thread-library data and 0xf000 of the
     // program's TLS segment.
-    return -0x7000;
+    return S.getVA(0) - 0x7000;
   default:
     llvm_unreachable("unhandled Config->EMachine");
   }
 }
 
 static uint64_t getRelocTargetVA(const InputFile *File, RelType Type, int64_t A,
                                  uint64_t P, const Symbol &Sym, RelExpr Expr) {
   switch (Expr) {
static uint64_t getRelocTargetVA(const InputFile *File, RelType Type, int64_t A,
   case R_RELAX_TLS_LD_TO_LE:
   case R_TLS:
     // It is not very clear what to return if the symbol is undefined. With
     // --noinhibit-exec, even a non-weak undefined reference may reach here.
     // Just return A, which matches R_ABS, and the behavior of some dynamic
     // loaders.
     if (Sym.isUndefined())
       return A;
-    return Sym.getVA(A) + getTlsTpOffset();
+    return getTlsTpOffset(Sym) + A;
   case R_RELAX_TLS_GD_TO_LE_NEG:
   case R_NEG_TLS:
     if (Sym.isUndefined())
       return A;
-    return -Sym.getVA(0) - getTlsTpOffset() + A;
+    return -getTlsTpOffset(Sym) + A;
   case R_SIZE:
     return Sym.getSize() + A;
   case R_TLSDESC:
     return In.Got->getGlobalDynAddr(Sym) + A;
   case R_TLSDESC_PC:
     return In.Got->getGlobalDynAddr(Sym) + A - P;
   case R_AARCH64_TLSDESC_PAGE:
     return getAArch64Page(In.Got->getGlobalDynAddr(Sym) + A) -

ELF/SymbolTable.h

public:
   // Set of .so files to not link the same shared object file more than once.
   llvm::DenseMap<StringRef, SharedFile *> SoNames;
 
   // Comdat groups define "link once" sections. If two comdat groups have the
   // same name, only one of them is linked, and the other is ignored. This map
   // is used to uniquify them.
   llvm::DenseMap<llvm::CachedHashStringRef, const InputFile *> ComdatGroups;
 
+  // The special TLS symbol _TLS_MODULE_BASE_ on targets that support TLSDESC.
+  const Symbol *TlsModuleBase = nullptr;
+
 private:
   std::vector<Symbol *> findByVersion(SymbolVersion Ver);
   std::vector<Symbol *> findAllByVersion(SymbolVersion Ver);
 
   llvm::StringMap<std::vector<Symbol *>> &getDemangledSyms();
   void handleAnonymousVersion();
   void assignExactVersion(SymbolVersion Ver, uint16_t VersionId,
                           StringRef VersionName);

ELF/Writer.cpp

template <class ELFT> void Writer<ELFT>::finalizeSections() {
   // Define __rel[a]_iplt_{start,end} symbols if needed.
   addRelIpltSymbols();
 
   // RISC-V's gp can address +/- 2 KiB, set it to .sdata + 0x800 if not defined.
   if (Config->EMachine == EM_RISCV)
     if (!dyn_cast_or_null<Defined>(Symtab->find("__global_pointer$")))
       addOptionalRegular("__global_pointer$", findSection(".sdata"), 0x800);
 
+  if (Config->EMachine == EM_X86_64) {
+    // On targets that support TLSDESC, _TLS_MODULE_BASE_ is defined in such a
+    // way that:
+    //
+    // 1) With LD->LE relaxation: _TLS_MODULE_BASE_@tpoff = 0 (lowest address in
+    // the TLS block).
+    // 2) Without relaxation: it produces a dynamic TLSDESC relocation that
+    // computes 0.
+    //
+    // 1) is special cased in @tpoff computation. To satisfy 2), we define it as
+    // an absolute symbol of zero. This is different from GNU linkers which
+    // define _TLS_MODULE_BASE_ relative to the first TLS section.
+    Symbol *S = Symtab->find("_TLS_MODULE_BASE_");
+    if (S && S->isUndefined())
+      S->resolve(Defined{/*File=*/nullptr, S->getName(), STB_GLOBAL, STV_HIDDEN,
+                         STT_TLS, /*Value=*/0, 0,
+                         /*Section=*/nullptr});
+    Symtab->TlsModuleBase = S;
+  }
+
   // This responsible for splitting up .eh_frame section into
   // pieces. The relocation scan uses those pieces, so this has to be
   // earlier.
   finalizeSynthetic(In.EhFrame);
 
   Symtab->forEachSymbol([](Symbol *S) {
     if (!S->IsPreemptible)
       S->IsPreemptible = computeIsPreemptible(*S);

test/ELF/x86-64-tlsdesc-ld.s

+# REQUIRES: x86
+# RUN: llvm-mc -filetype=obj -triple=x86_64 %s -o %t.o
+
+# RUN: ld.lld -shared %t.o -o %t.so
+# RUN: llvm-readobj -r %t.so | FileCheck --check-prefix=LD-REL %s
+# RUN: llvm-objdump -d --no-show-raw-insn %t.so | FileCheck --check-prefix=LD %s
+
+# RUN: ld.lld %t.o -o %t
+# RUN: llvm-readelf -r %t | FileCheck --check-prefix=NOREL %s
+# RUN: llvm-objdump -d --no-show-raw-insn %t | FileCheck --check-prefix=LE %s
+
+## Check _TLS_MODULE_BASE_ used by LD produces a dynamic relocation with a value of 0.
+# LD-REL:      .rela.dyn {
+# LD-REL-NEXT:   0x20A0 R_X86_64_TLSDESC - 0x0
+# LD-REL-NEXT: }
+
+## 0x20a0-0x1007 = 4249
+## dtpoff(a) = 8, dtpoff(b) = 12
+# LD:            leaq 4249(%rip), %rax
+# LD-NEXT: 1007: callq *(%rax)
+# LD-NEXT:       movl %fs:8(%rax), %edx
+# LD-NEXT:       addl %fs:12(%rax), %edx
+
+## When producing an executable, the LD->LE relaxation is the same as GD->LE.
+## tpoff(_TLS_MODULE_BASE_) = 0, tpoff(a) = -8, tpoff(b) = -4
+
+# NOREL: no relocations
+
+# LE:      movq $0, %rax
+# LE-NEXT: nop
+# LE-NEXT: movl %fs:-8(%rax), %edx
+# LE-NEXT: addl %fs:-4(%rax), %edx
+
+leaq _TLS_MODULE_BASE_@tlsdesc(%rip), %rax
+call *_TLS_MODULE_BASE_@tlscall(%rax)
+movl %fs:a@dtpoff(%rax), %edx
+addl %fs:b@dtpoff(%rax), %edx
+
+.section .tbss
+.zero 8
+a:
+.zero 4
+b:
+.zero 4