[ELF] Make the rule to create relative relocations in a writable section stricter

[MaskRay]

Summary

The current rule is loose: !Sym.IsPreemptible || Expr == R_GOT.

When the symbol is non-preemptable, this allows absolute relocation
types with smaller numbers of bits, e.g. R_X86_64_{8,16,32}. They are
disallowed by ld.bfd and gold, e.g.

ld.bfd: a.o: relocation R_X86_64_8 against `.text' can not be used when making a shared object; recompile with -fPIC

This patch:

a) Add TargetInfo::SymbolicRel to represent relocation types that resolve to a
symbol value (e.g. R_AARCH_ABS64, R_386_32, R_X86_64_64).

As a side benefit, we currently (ab)use GotRel (R_*_GLOB_DAT) to resolve
GOT slots that are link-time constants. Since we now use Target->SymbolRel
to do the job, we can remove R_*_GLOB_DAT from relocateOne() for all targets.
R_*_GLOB_DAT cannot be used as static relocation types.

b) Change the condition to !Sym.IsPreemptible && Type != Target->SymbolicRel || Expr == R_GOT.

Some tests are caught by the improved error checking (ld.bfd/gold also
issue errors on them). Many misuse .long where .quad should be used
instead.

[MaskRay]

Update a comment

[arichardson]

This looks good to me. However, I think the name SymbolicRel does not make it immediately obvious to me it should be used for. Maybe add a comment to the member?

ELF/Target.h

98

Maybe something like 'AbsPtrRel'? To me symbolic does not necessarily imply a elf_addr size relocation against a symbol.

[grimar]

ELF/Relocations.cpp

971

This comment is a bit unclear now. It says "Copy relocations ... are only possible if we are creating an executable",
what made sence before when the condition was if (Config->Shared), but now it also allows
Config->Pie, which stands for position independent executable.

[MaskRay]

ELF/Target.h

98

I'd like to stick with the current name. AbsPtrRel sounds to me it has something to do with pointers but it doesn't. I have to confess this name was inspired by musl defined general dynamic relocation types:

http://git.musl-libc.org/cgit/musl/tree/arch/x86_64/reloc.h#n7
#define REL_SYMBOLIC R_X86_64_64

Symbolic means it takes the address of a symbol at runtime.

		case REL_SYMBOLIC:
		case REL_GOT:
		case REL_PLT:
			*reloc_addr = sym_val + addend;
			break;
		case REL_RELATIVE:
			*reloc_addr = (size_t)base + addend;
			break;

[MaskRay]

Add comment about

(Config->Pie && Expr == R_ABS && Type != Target->SymbolicRel)) {

[grimar]

This looks good to me, I have no more comments.

[ruiu]

LGTM

[peter.smith]

This commit has caused the arm lld buildbot to fail. I can reproduce it on an Arm machine and a bisect found this one as the change. If I revert this change then the specific failure goes away. Unfortunately I can't tell you exactly what is wrong yet, the failure is in the libclang unit tests which are a shared object linked by LLD. I haven't yet had a chance to isolate the segfault and work out what is causing it. I'll keep looking to see if I can work out what specifically is wrong.

First failure: http://lab.llvm.org:8011/builders/clang-cmake-armv8-lld/builds/1558

[peter.smith]

A look at the differences between libclang.so with and without the patch is that what used to be a R_ARM_RELATIVE relocation is now a R_ARM_ABS32 relocation to an undefined symbol. The latter will likely resolve to 0. All of the difference is concentrated in the .init_array section which uses the R_ARM_TARGET1 relocation, which is treated as R_ARM_ABS32 by default but with an option be treated as R_ARM_REL32 (some embedded systems use offsets rather than addresses).
For example:
Good

Contents of section .init_array:
 2d21008 c980c300 c46fb301 f89ab301 acfbb601  .....o..........
 2d21018 8067b801 8040b901 403fbf01 00bec101  .g...@..@?......
 2d21028 c0bdc201 c873c301 8c52c501 7810c601  .....s...R..x...
...
02d21008  00000017 R_ARM_RELATIVE   
02d2100c  00000017 R_ARM_RELATIVE   
02d21010  00000017 R_ARM_RELATIVE   
02d21014  00000017 R_ARM_RELATIVE   
02d21018  00000017 R_ARM_RELATIVE   
02d2101c  00000017 R_ARM_RELATIVE   
02d21020  00000017 R_ARM_RELATIVE   
02d21024  00000017 R_ARM_RELATIVE   
02d21028  00000017 R_ARM_RELATIVE

Bad:

Contents of section .init_array:
 2d21008 c980c300 00000000 00000000 00000000  ................
 2d21018 00000000 00000000 00000000 00000000  ................
 2d21028 00000000 00000000 00000000 00000000  ................
...
02d21008  00000017 R_ARM_RELATIVE
02d2100c  00000002 R_ARM_ABS32      
02d21010  00000002 R_ARM_ABS32      
02d21014  00000002 R_ARM_ABS32      
02d21018  00000002 R_ARM_ABS32      
02d2101c  00000002 R_ARM_ABS32      
02d21020  00000002 R_ARM_ABS32      
02d21024  00000002 R_ARM_ABS32      
02d21028  00000002 R_ARM_ABS32

So far I've not been able to make a simpler reproducer, as can be seen from the first entry in the .init_array there must be some special case.

[peter.smith]

Reproducer:
cat init.cpp

template <class T>
struct Bar {    
    T X;
    Bar(T X) : X(X) {}
};

Foo<int> F(0);
Bar<int> B(1);

int func(void) {
    return F.X + B.X;
}

clang --target=arm-linux-gnueabihf init.cpp -fpic --shared -o init.so  -fuse-ld=lld

llvm-readobj --relocs init.so 

File: init.so
Format: ELF32-arm-little
Arch: arm
AddressSize: 32bit
LoadName: 
Relocations [
  Section (6) .rel.dyn {
    0x2000 R_ARM_RELATIVE - 0x0
    0x2008 R_ARM_RELATIVE - 0x0
    0x3000 R_ARM_RELATIVE - 0x0
    0x2004 R_ARM_ABS32 - 0x0
    0x20D8 R_ARM_GLOB_DAT __gmon_start__ 0x0
    0x20DC R_ARM_GLOB_DAT _ITM_deregisterTMCloneTable 0x0
    0x20E0 R_ARM_GLOB_DAT _ITM_registerTMCloneTable 0x0
    0x20E4 R_ARM_GLOB_DAT __cxa_finalize@GLIBC_2.4 0x0
    0x20E8 R_ARM_GLOB_DAT _Jv_RegisterClasses 0x0
    0x20EC R_ARM_GLOB_DAT B 0x0
    0x20F0 R_ARM_GLOB_DAT F 0x0
  }
  Section (8) .rel.plt {
    0x3010 R_ARM_JUMP_SLOT __gmon_start__ 0x0
    0x3014 R_ARM_JUMP_SLOT __cxa_finalize@GLIBC_2.4 0x0
    0x3018 R_ARM_JUMP_SLOT _ZN3FooIiEC2Ei 0x0
    0x301C R_ARM_JUMP_SLOT _ZN3BarIiEC2Ei 0x0
  }
]

Note the 0x2004 R_ARM_ABS32 - 0x0 which is is in the .init_array section.

[peter.smith]

lld/trunk/ELF/Relocations.cpp

922 ↗

(On Diff #204045)

I'm not sure that there is always just one relocation per Target that is a SymbolicRel. On Arm there are a few implementation defined relocations like R_ARM_TARGET1 that can be R_ARM_ABS32 or R_ARM_REL32 depending on the platform. I think that this needs to be a callback to Target so that more than one relocation can apply.

927 ↗

(On Diff #204045)

Can we guarantee that Sym is in the dynamic symbol table after we have narrowed the relocation types accepted?

[MaskRay]

@peter.smith Sorry I just noticed the build bot was failing. Just commited a workaround rL363236

ld.bfd's rules to resolve absolute relocation types to R_*_RELATIVE are scattered. I do want to find a unified approach to handle them.
I'll do some experiments with R_ARM_TARGET1 (I didn't know this relocation type). PPC64 may have a similar relocation type that I'm not aware of...

[peter.smith]

Was difficult to spot what was wrong with the bot as there were lots of commits and a non specific error message.

I'll have a think to see if there are any other relocation types besides R_ARM_TARGET1 that LLD supports that can be made into a R_ARM_RELATIVE. I don't know PPC very well unfortunately. The other case I thought of that could be difficult is ILP32, where even on something like X86_64, or AArch64 the symbolic rel for a pointer would be the 32-bit relocation. I know LLD doesn't support the AArch64 ILP32 so this isn't a problem right now.

In theory R_ARM_TARGET2 (references to TypeInfo in read-only exception handling tables) can be made into an alias for R_ARM_ABS32 with Target2Policy::Abs (--target2=abs). That option is intended for embedded systems without dynamic linking (the default is to treat it as R_ARM_GOT_PREL). So in theory it is possible, although unlikely and would arguably be better triggering an Error message if it were used.

The R_ARM_TARGET1 is a result of Arm's embedded past where there were several toolchains with subtly different ABIs, when it came to defining the official ABI there were some implementation defined points. In one environment the libraries static initialisation code used offsets to the initialization function, in another it used absolute addresses of the initialization function, the R_ARM_TARGET1 permitted a compiler to support both choices as the linker could choose depending . For Linux R_ARM_TARGET1 is essentially an alias for R_ARM_ABS32.

[peter.smith]

I'll have a think to see if there are any other relocation types besides R_ARM_TARGET1 that LLD supports that can be made into a R_ARM_RELATIVE. I don't know PPC very well unfortunately. The other case I thought of that could be difficult is ILP32, where even on something like X86_64, or AArch64 the symbolic rel for a pointer would be the 32-bit relocation. I know LLD doesn't support the AArch64 ILP32 so this isn't a problem right now.

Taken a look; on the Arm side I can't find anything other than R_ARM_TARGET1 and to a lesser extent R_ARM_TARGET2 that need to be considered as an alias for R_ARM_ABS32, when considering whether R_ARM_RELATIVE can be used.

ELF/Arch/AArch64.cpp

 
 AArch64::AArch64() {
   CopyRel = R_AARCH64_COPY;
   RelativeRel = R_AARCH64_RELATIVE;
   IRelativeRel = R_AARCH64_IRELATIVE;
   GotRel = R_AARCH64_GLOB_DAT;
   NoneRel = R_AARCH64_NONE;
   PltRel = R_AARCH64_JUMP_SLOT;
+  SymbolicRel = R_AARCH64_ABS64;
   TlsDescRel = R_AARCH64_TLSDESC;
   TlsGotRel = R_AARCH64_TLS_TPREL64;
   PltEntrySize = 16;
   PltHeaderSize = 32;
   DefaultMaxPageSize = 65536;
 
   // Align to the 2 MiB page size (known as a superpage or huge page).
   // FreeBSD automatically promotes 2 MiB-aligned allocations.
case R_AARCH64_PREL16:
     write16le(Loc, Val);
     break;
   case R_AARCH64_ABS32:
   case R_AARCH64_PREL32:
     checkIntUInt(Loc, Val, 32, Type);
     write32le(Loc, Val);
     break;
   case R_AARCH64_ABS64:
-  case R_AARCH64_GLOB_DAT:
   case R_AARCH64_PREL64:
     write64le(Loc, Val);
     break;
   case R_AARCH64_ADD_ABS_LO12_NC:
     or32AArch64Imm(Loc, Val);
     break;
   case R_AARCH64_ADR_GOT_PAGE:
   case R_AARCH64_ADR_PREL_PG_HI21:

ELF/Arch/AMDGPU.cpp

RelExpr getRelExpr(RelType Type, const Symbol &S,
                      const uint8_t *Loc) const override;
 };
 } // namespace
 
 AMDGPU::AMDGPU() {
   RelativeRel = R_AMDGPU_RELATIVE64;
   GotRel = R_AMDGPU_ABS64;
   NoneRel = R_AMDGPU_NONE;
+  SymbolicRel = R_AMDGPU_ABS64;
 }
 
 static uint32_t getEFlags(InputFile *File) {
   return cast<ObjFile<ELF64LE>>(File)->getObj().getHeader()->e_flags;
 }
 
 uint32_t AMDGPU::calcEFlags() const {
   assert(!ObjectFiles.empty());

ELF/Arch/ARM.cpp

 
 ARM::ARM() {
   CopyRel = R_ARM_COPY;
   RelativeRel = R_ARM_RELATIVE;
   IRelativeRel = R_ARM_IRELATIVE;
   GotRel = R_ARM_GLOB_DAT;
   NoneRel = R_ARM_NONE;
   PltRel = R_ARM_JUMP_SLOT;
+  SymbolicRel = R_ARM_ABS32;
   TlsGotRel = R_ARM_TLS_TPOFF32;
   TlsModuleIndexRel = R_ARM_TLS_DTPMOD32;
   TlsOffsetRel = R_ARM_TLS_DTPOFF32;
   GotBaseSymInGotPlt = false;
   PltEntrySize = 16;
   PltHeaderSize = 32;
   TrapInstr = {0xd4, 0xd4, 0xd4, 0xd4};
   NeedsThunks = true;
bool ARM::inBranchRange(RelType Type, uint64_t Src, uint64_t Dst) const {
   uint64_t Distance = (Src > Dst) ? Src - Dst : Dst - Src;
   return Distance <= Range;
 }
 
 void ARM::relocateOne(uint8_t *Loc, RelType Type, uint64_t Val) const {
   switch (Type) {
   case R_ARM_ABS32:
   case R_ARM_BASE_PREL:
-  case R_ARM_GLOB_DAT:
   case R_ARM_GOTOFF32:
   case R_ARM_GOT_BREL:
   case R_ARM_GOT_PREL:
   case R_ARM_REL32:
   case R_ARM_RELATIVE:
   case R_ARM_SBREL32:
   case R_ARM_TARGET1:
   case R_ARM_TARGET2:

ELF/Arch/Hexagon.cpp

void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
                 int32_t Index, unsigned RelOff) const override;
 };
 } // namespace
 
 Hexagon::Hexagon() {
   PltRel = R_HEX_JMP_SLOT;
   RelativeRel = R_HEX_RELATIVE;
   GotRel = R_HEX_GLOB_DAT;
+  SymbolicRel = R_HEX_32;
 
   // The zero'th GOT entry is reserved for the address of _DYNAMIC.  The
   // next 3 are reserved for the dynamic loader.
   GotPltHeaderEntriesNum = 4;
 
   PltEntrySize = 16;
   PltHeaderSize = 32;
 

ELF/Arch/Mips.cpp

template <class ELFT> MIPS<ELFT>::MIPS() {
   PltRel = R_MIPS_JUMP_SLOT;
   NeedsThunks = true;
 
   // Set `sigrie 1` as a trap instruction.
   write32(TrapInstr.data(), 0x04170001);
 
   if (ELFT::Is64Bits) {
     RelativeRel = (R_MIPS_64 << 8) | R_MIPS_REL32;
+    SymbolicRel = R_MIPS_64;
     TlsGotRel = R_MIPS_TLS_TPREL64;
     TlsModuleIndexRel = R_MIPS_TLS_DTPMOD64;
     TlsOffsetRel = R_MIPS_TLS_DTPREL64;
   } else {
     RelativeRel = R_MIPS_REL32;
+    SymbolicRel = R_MIPS_32;
     TlsGotRel = R_MIPS_TLS_TPREL32;
     TlsModuleIndexRel = R_MIPS_TLS_DTPMOD32;
     TlsOffsetRel = R_MIPS_TLS_DTPREL32;
   }
 }
 
 template <class ELFT> uint32_t MIPS<ELFT>::calcEFlags() const {
   return calcMipsEFlags<ELFT>();

ELF/Arch/PPC.cpp

 }
 
 PPC::PPC() {
   GotRel = R_PPC_GLOB_DAT;
   NoneRel = R_PPC_NONE;
   PltRel = R_PPC_JMP_SLOT;
   RelativeRel = R_PPC_RELATIVE;
   IRelativeRel = R_PPC_IRELATIVE;
+  SymbolicRel = R_PPC_ADDR32;
   GotBaseSymInGotPlt = false;
   GotHeaderEntriesNum = 3;
   GotPltHeaderEntriesNum = 0;
   PltHeaderSize = 64; // size of PLTresolve in .glink
   PltEntrySize = 4;
 
   NeedsThunks = true;
 
void PPC::relocateOne(uint8_t *Loc, RelType Type, uint64_t Val) const {
   case R_PPC_GOT_TLSGD16_LO:
   case R_PPC_GOT_TLSLD16_LO:
   case R_PPC_GOT_TPREL16_LO:
   case R_PPC_REL16_LO:
   case R_PPC_TPREL16_LO:
     write16(Loc, Val);
     break;
   case R_PPC_ADDR32:
-  case R_PPC_GLOB_DAT:
   case R_PPC_REL32:
     write32(Loc, Val);
     break;
   case R_PPC_REL14: {
     uint32_t Mask = 0x0000FFFC;
     checkInt(Loc, Val, 16, Type);
     checkAlignment(Loc, Val, 4, Type);
     write32(Loc, (read32(Loc) & ~Mask) | (Val & Mask));

ELF/Arch/PPC64.cpp

 }
 
 PPC64::PPC64() {
   GotRel = R_PPC64_GLOB_DAT;
   NoneRel = R_PPC64_NONE;
   PltRel = R_PPC64_JMP_SLOT;
   RelativeRel = R_PPC64_RELATIVE;
   IRelativeRel = R_PPC64_IRELATIVE;
+  SymbolicRel = R_PPC64_ADDR64;
   PltEntrySize = 4;
   GotBaseSymInGotPlt = false;
   GotHeaderEntriesNum = 1;
   GotPltHeaderEntriesNum = 2;
   PltHeaderSize = 60;
   NeedsThunks = true;
 
   TlsModuleIndexRel = R_PPC64_DTPMOD64;

ELF/Arch/SPARCV9.cpp

 } // namespace
 
 SPARCV9::SPARCV9() {
   CopyRel = R_SPARC_COPY;
   GotRel = R_SPARC_GLOB_DAT;
   NoneRel = R_SPARC_NONE;
   PltRel = R_SPARC_JMP_SLOT;
   RelativeRel = R_SPARC_RELATIVE;
+  SymbolicRel = R_SPARC_64;
   PltEntrySize = 32;
   PltHeaderSize = 4 * PltEntrySize;
 
   DefaultCommonPageSize = 8192;
   DefaultMaxPageSize = 0x100000;
   DefaultImageBase = 0x100000;
 }
 
case R_SPARC_WDISP19:
     break;
   case R_SPARC_GOT10:
   case R_SPARC_PC10:
     // T-simm10
     write32be(Loc, (read32be(Loc) & ~0x000003ff) | (Val & 0x000003ff));
     break;
   case R_SPARC_64:
   case R_SPARC_UA64:
-  case R_SPARC_GLOB_DAT:
     // V-xword64
     write64be(Loc, Val);
     break;
   default:
     llvm_unreachable("unknown relocation");
   }
 }
 

ELF/Arch/X86.cpp

 
 X86::X86() {
   CopyRel = R_386_COPY;
   GotRel = R_386_GLOB_DAT;
   NoneRel = R_386_NONE;
   PltRel = R_386_JUMP_SLOT;
   IRelativeRel = R_386_IRELATIVE;
   RelativeRel = R_386_RELATIVE;
+  SymbolicRel = R_386_32;
   TlsGotRel = R_386_TLS_TPOFF;
   TlsModuleIndexRel = R_386_TLS_DTPMOD32;
   TlsOffsetRel = R_386_TLS_DTPOFF32;
   PltEntrySize = 16;
   PltHeaderSize = 16;
   TrapInstr = {0xcc, 0xcc, 0xcc, 0xcc}; // 0xcc = INT3
 
   // Align to the non-PAE large page size (known as a superpage or huge page).
case R_386_PC16:
     // that we are passed the final value, which already had the
     // current location subtracted from it.
     // We just check that Val fits in 17 bits. This misses some cases, but
     // should have no false positives.
     checkInt(Loc, Val, 17, Type);
     write16le(Loc, Val);
     break;
   case R_386_32:
-  case R_386_GLOB_DAT:
   case R_386_GOT32:
   case R_386_GOT32X:
   case R_386_GOTOFF:
   case R_386_GOTPC:
   case R_386_PC32:
   case R_386_PLT32:
   case R_386_RELATIVE:
   case R_386_TLS_DTPMOD32:

ELF/Arch/X86_64.cpp

 
 X86_64::X86_64() {
   CopyRel = R_X86_64_COPY;
   GotRel = R_X86_64_GLOB_DAT;
   NoneRel = R_X86_64_NONE;
   PltRel = R_X86_64_JUMP_SLOT;
   RelativeRel = R_X86_64_RELATIVE;
   IRelativeRel = R_X86_64_IRELATIVE;
+  SymbolicRel = R_X86_64_64;
   TlsDescRel = R_X86_64_TLSDESC;
   TlsGotRel = R_X86_64_TPOFF64;
   TlsModuleIndexRel = R_X86_64_DTPMOD64;
   TlsOffsetRel = R_X86_64_DTPOFF64;
   PltEntrySize = 16;
   PltHeaderSize = 16;
   TrapInstr = {0xcc, 0xcc, 0xcc, 0xcc}; // 0xcc = INT3
 
void X86_64::relocateOne(uint8_t *Loc, RelType Type, uint64_t Val) const {
   case R_X86_64_TLSLD:
   case R_X86_64_DTPOFF32:
   case R_X86_64_SIZE32:
     checkInt(Loc, Val, 32, Type);
     write32le(Loc, Val);
     break;
   case R_X86_64_64:
   case R_X86_64_DTPOFF64:
-  case R_X86_64_GLOB_DAT:
   case R_X86_64_PC64:
   case R_X86_64_SIZE64:
   case R_X86_64_GOT64:
   case R_X86_64_GOTOFF64:
   case R_X86_64_GOTPC64:
     write64le(Loc, Val);
     break;
   default:

ELF/Relocations.cpp

static void addGotEntry(Symbol &Sym) {
   //
   // (We don't actually write a value to a GOT slot right now, but we
   // add a static relocation to a Relocations vector so that
   // InputSection::relocate will do the work for us. We may be able
   // to just write a value now, but it is a TODO.)
   bool IsLinkTimeConstant =
       !Sym.IsPreemptible && (!Config->Pic || isAbsolute(Sym));
   if (IsLinkTimeConstant) {
-    In.Got->Relocations.push_back({Expr, Target->GotRel, Off, 0, &Sym});
+    In.Got->Relocations.push_back({Expr, Target->SymbolicRel, Off, 0, &Sym});
     return;
   }
 
   // Otherwise, we emit a dynamic relocation to .rel[a].dyn so that
   // the GOT slot will be fixed at load-time.
   if (!Sym.isTls() && !Sym.IsPreemptible && Config->Pic && !isAbsolute(Sym)) {
-    addRelativeReloc(In.Got, Off, &Sym, 0, R_ABS, Target->GotRel);
+    addRelativeReloc(In.Got, Off, &Sym, 0, R_ABS, Target->SymbolicRel);
     return;
   }
-  Main->RelaDyn->addReloc(Sym.isTls() ? Target->TlsGotRel : Target->GotRel,
-                          In.Got, Off, &Sym, 0,
-                          Sym.IsPreemptible ? R_ADDEND : R_ABS, Target->GotRel);
+  Main->RelaDyn->addReloc(
+      Sym.isTls() ? Target->TlsGotRel : Target->GotRel, In.Got, Off, &Sym, 0,
+      Sym.IsPreemptible ? R_ADDEND : R_ABS, Target->SymbolicRel);
 }
 
 // Return true if we can define a symbol in the executable that
 // contains the value/function of a symbol defined in a shared
 // library.
 static bool canDefineSymbolInExecutable(Symbol &Sym) {
   // If the symbol has default visibility the symbol defined in the
   // executable will preempt it.
static void processRelocAux(InputSectionBase &Sec, RelExpr Expr, RelType Type,
                             uint64_t Offset, Symbol &Sym, const RelTy &Rel,
                             int64_t Addend) {
   if (isStaticLinkTimeConstant(Expr, Type, Sym, Sec, Offset)) {
     Sec.Relocations.push_back({Expr, Type, Offset, Addend, &Sym});
     return;
   }
   bool CanWrite = (Sec.Flags & SHF_WRITE) || !Config->ZText;
   if (CanWrite) {
-    // R_GOT refers to a position in the got, even if the symbol is preemptible.
-    bool IsPreemptibleValue = Sym.IsPreemptible && Expr != R_GOT;
-
-    if (!IsPreemptibleValue) {
+    if ((!Sym.IsPreemptible && Type == Target->SymbolicRel) || Expr == R_GOT) {
+      // If this is a symbolic relocation to a non-preemptable symbol, or an
+      // R_GOT, its address is link-time value plus load address. Represent it
+      // with a relative relocation.
       addRelativeReloc(&Sec, Offset, &Sym, Addend, Expr, Type);
       return;
     } else if (RelType Rel = Target->getDynRel(Type)) {
       Sec.getPartition().RelaDyn->addReloc(Rel, &Sec, Offset, &Sym, Addend,
                                            R_ADDEND, Type);
 
       // MIPS ABI turns using of GOT and dynamic relocations inside out.
       // While regular ABI uses dynamic relocations to fill up GOT entries
error(
         "can't create dynamic relocation " + toString(Type) + " against " +
         (Sym.getName().empty() ? "local symbol" : "symbol: " + toString(Sym)) +
         " in readonly segment; recompile object files with -fPIC "
         "or pass '-Wl,-z,notext' to allow text relocations in the output" +
         getLocation(Sec, Sym, Offset));
     return;
   }
 
-  // Copy relocations are only possible if we are creating an executable.
-  if (Config->Shared) {
-    errorOrWarn("relocation " + toString(Type) +
-                " cannot be used against symbol " + toString(Sym) +
-                "; recompile with -fPIC" + getLocation(Sec, Sym, Offset));
+  // Copy relocations (for STT_OBJECT) and canonical PLT (for STT_FUNC) are only
+  // possible in an executable.
+  //
+  // Among R_ABS relocatoin types, SymbolicRel has the same size as the word
+  // size. Others have fewer bits and may cause runtime overflow in -pie/-shared
+  // mode. Disallow them.
+  if (Config->Shared ||
+      (Config->Pie && Expr == R_ABS && Type != Target->SymbolicRel)) {
+    errorOrWarn(
+        "relocation " + toString(Type) + " cannot be used against " +
+        (Sym.getName().empty() ? "local symbol" : "symbol " + toString(Sym)) +
     return;
   }
 
   // If the symbol is undefined we already reported any relevant errors.
   if (Sym.isUndefined())
     return;
 
   if (!canDefineSymbolInExecutable(Sym)) {

ELF/Target.h

public:
   bool GotBaseSymInGotPlt = true;
 
   RelType CopyRel;
   RelType GotRel;
   RelType NoneRel;
   RelType PltRel;
   RelType RelativeRel;
   RelType IRelativeRel;
+  RelType SymbolicRel;
   RelType TlsDescRel;
   RelType TlsGotRel;
   RelType TlsModuleIndexRel;
   RelType TlsOffsetRel;
   unsigned PltEntrySize;
   unsigned PltHeaderSize;
 
   // At least on x86_64 positions 1 and 2 are used by the first plt entry

test/ELF/linkerscript/visibility.s

 # CHECK-NEXT:   Other [
 # CHECK-NEXT:     STV_HIDDEN
 # CHECK-NEXT:   ]
 # CHECK-NEXT:   Section:
 # CHECK-NEXT: }
 
         .data
         .hidden foo
-        .long foo
+        .quad foo

test/ELF/merge-string-error.s

 // REQUIRES: x86
 // RUN: llvm-mc -filetype=obj -triple=x86_64-pc-linux %s -o %t.o
 // RUN: not ld.lld %t.o -o /dev/null -shared 2>&1 | FileCheck %s
 
         .section  .rodata.str1.1,"aMS",@progbits,1
   .asciz  "abc"
 
         .data
-        .long .rodata.str1.1 + 4
+        .quad .rodata.str1.1 + 4
 
 // CHECK: merge-string-error.s.tmp.o:(.rodata.str1.1): offset is outside the section

test/ELF/pack-dyn-relocs-loop.s

 // CHECK:         Name: foo (62)
 // CHECK-NEXT:    Type: SHT_PROGBITS (0x1)
 // CHECK-NEXT:    Flags [ (0x3)
 // CHECK-NEXT:      SHF_ALLOC (0x2)
 // CHECK-NEXT:      SHF_WRITE (0x1)
 // CHECK-NEXT:    ]
 // CHECK-NEXT:    Address: 0x10004
 // CHECK-NEXT:    Offset: 0x10004
-// CHECK-NEXT:    Size: 12
+// CHECK-NEXT:    Size: 24
 
 
 .data
 .long 0
 
 .section foo,"aw"
 foof:
-.long foof
-.long bar-53
-.long bar
+.quad foof
+.quad bar-53
+.quad bar
 
 .section x,"a"
 .zero 65036
 
 .section barr,"a"
 .p2align 1
 bar:

test/ELF/relocation-before-merge-start.s

 // REQUIRES: x86
 // RUN: llvm-mc %s -o %t.o -filetype=obj -triple=x86_64-pc-linux
 // RUN: not ld.lld %t.o -o /dev/null -shared 2>&1 | FileCheck %s
 // CHECK: relocation-before-merge-start.s.tmp.o:(.foo): offset is outside the section
 
 .data
-.long .foo - 1
+.quad .foo - 1
 .section  .foo,"aM",@progbits,4
 .quad 0

test/ELF/relocation-past-merge-end.s

 // REQUIRES: x86
 // RUN: llvm-mc %s -o %t.o -filetype=obj -triple=x86_64-pc-linux
 // RUN: not ld.lld %t.o -o /dev/null -shared 2>&1 | FileCheck %s
 // CHECK: relocation-past-merge-end.s.tmp.o:(.foo): offset is outside the section
 
 .data
-.long .foo + 10
+.quad .foo + 10
 .section  .foo,"aM",@progbits,4
 .quad 0

test/ELF/x86-64-dyn-rel-error5.s

+# REQUIRES: x86
+# RUN: llvm-mc -filetype=obj -triple=x86_64 %s -o %t.o
+# RUN: not ld.lld -pie %t.o -o /dev/null 2>&1 | FileCheck %s
+# RUN: not ld.lld -shared %t.o -o /dev/null 2>&1 | FileCheck %s
+
+## Check we don't create dynamic relocations in a writable section,
+## if the number of bits is smaller than the wordsize.
+
+.globl hidden
+.hidden hidden
+local:
+hidden:
+
+# CHECK: error: relocation R_X86_64_8 cannot be used against local symbol; recompile with -fPIC
+# CHECK-NEXT: >>> defined in {{.*}}.o
+# CHECK-NEXT: >>> referenced by {{.*}}.o:(.data+0x0)
+# CHECK: error: relocation R_X86_64_16 cannot be used against local symbol; recompile with -fPIC
+# CHECK: error: relocation R_X86_64_32 cannot be used against local symbol; recompile with -fPIC
+# CHECK: error: relocation R_X86_64_32 cannot be used against symbol hidden; recompile with -fPIC
+
+.data
+.byte local     # R_X86_64_8
+.short local    # R_X86_64_16
+.long local     # R_X86_64_32
+
+.long hidden    # R_X86_64_32