[PATCH v5] x86-64: Add GLIBC_ABI_GNU2_TLS version dependency

[Sam James]

"H.J. Lu" <hjl.tools@gmail.com> writes:

> On Linux/x86-64, programs and shared libraries compiled with
> -mtls-dialect=gnu2 may fail silently at run-time against glibc without
> the GNU2 TLS run-time fix for:
>
> https://sourceware.org/bugzilla/show_bug.cgi?id=31372
>
> A version tag, GLIBC_ABI_GNU2_TLS, has been added to glibc to indicate
> that glibc has the working GNU2 TLS run-time by:
>
> commit 9df8fa397d515dc86ff5565f6c45625e672d539e
> Author: H.J. Lu <hjl.tools@gmail.com>
> Date:   Mon Jul 28 12:18:22 2025 -0700
>
>     x86-64: Add GLIBC_ABI_GNU2_TLS version [BZ #33129]
>
> Add the --gnu2-tls-tag option to x86-64 ELF linker to add the
> GLIBC_ABI_GNU2_TLS version dependency in output programs and shared
> libraries when linking against glibc if input relocatable object files
> have R_X86_64_TLSDESC_CALL relocation.  The output will fail to load and
> run at run-time against glibc which doesn't define the GLIBC_ABI_GNU2_TLS
> version.
>
> Add the --enable-gnu2-tls-tag configure option to enable --gnu2-tls-tag
> by default.  If unspecified, linker will add the GLIBC_ABI_GNU2_TLS
> version dependency if inputs have R_X86_64_TLSDESC_CALL relocation and
> libc.so defines the GLIBC_ABI_GNU2_TLS version.
>
> Update elf_link_add_glibc_verneed to properly add the GLIBC_2.36 version
> dependency when -z mark-plt -z nopack-relative-relocs passed to linker.

BTW, I see this with --enable-targets=all:
...
elf_x86_64_fbsd:
  -z noextern-protected-data  Do not treat protected data symbol as external
  -z indirect-extern-access   Enable indirect external access
  -z noindirect-extern-access Disable indirect external access (default)
  -z dynamic-undefined-weak   Make undefined weak symbols dynamic
  -z nodynamic-undefined-weak Do not make undefined weak symbols dynamic
  -z noreloc-overflow         Disable relocation overflow check
  -z call-nop=PADDING         Use PADDING as 1-byte NOP for branch
  -z ibtplt                   Generate IBT-enabled PLT entries
  -z ibt                      Generate GNU_PROPERTY_X86_FEATURE_1_IBT
  -z shstk                    Generate GNU_PROPERTY_X86_FEATURE_1_SHSTK
  -z cet-report=[none|warning|error] (default: none)
                              Report missing IBT and SHSTK properties
  -z report-relative-reloc    Report relative relocations
  -z x86-64-{baseline|v[234]} Mark x86-64-{baseline|v[234]} ISA level as needed
  -z isa-level-report=[none|all|needed|used] (default: none)
                              Report x86-64 ISA level
  -z lam-u48                  Generate GNU_PROPERTY_X86_FEATURE_1_LAM_U48
  -z lam-u48-report=[none|warning|error] (default: none)
                              Report missing LAM_U48 property
  -z lam-u57                  Generate GNU_PROPERTY_X86_FEATURE_1_LAM_U57
  -z lam-u57-report=[none|warning|error] (default: none)
                              Report missing LAM_U57 property
  -z lam-report=[none|warning|error] (default: none)
                              Report missing LAM_U48 and LAM_U57 properties
  -z mark-plt                 Mark PLT with dynamic tags
  -z nomark-plt               Do not mark PLT with dynamic tags (default)
  -z pack-relative-relocs     Pack relative relocations
  -z nopack-relative-relocs   Do not pack relative relocations (default)
  --gnu2-tls-tag              Add GLIBC_ABI_GNU2_TLS dependency (auto)
                                when no options are specified (default)
  --no-gnu2-tls-tag           Do not add GLIBC_ABI_GNU2_TLS dependency
...

Should we only add it for GNU targets? Or is it fine because of -z XYZ
semantics?

Other options have the same problem anyway so maybe it doesn't matter. I
only noticed because --help is so long.

> [...]
> diff --git a/ld/ld.texi b/ld/ld.texi
> index 413335ad765..7afff6e8ac7 100644
> --- a/ld/ld.texi
> +++ b/ld/ld.texi
> @@ -1743,6 +1743,19 @@ Supported for Linux/i386 and Linux/x86_64.
>  
>  @end table
>  
> +@item --gnu2-tls-tag
> +@itemx --no-gnu2-tls-tag
> +Add @code{GLIBC_ABI_GNU2_TLS} version tag dependency in output programs
> +and shared libraries when linking against glibc if input relocatable
> +object files have @code{R_X86_64_TLSDESC_CALL} relocation.  The output
> +will fail to load and run at run-time against glibc which doesn't define
> +the @code{GLIBC_ABI_GNU2_TLS} version tag.  Unless disabled by the
> +@option{--disable-gnu2-tls-tag} configure option at the linker build
> +time, when no options are specified, linker will add the
> +@code{GLIBC_ABI_GNU2_TLS} version tag dependency if inputs have
> +@code{R_X86_64_TLSDESC_CALL} relocation and libc.so defines the
> +@code{GLIBC_ABI_GNU2_TLS} version tag.  Supported for Linux/x86_64.
> +

This..

>  Other keywords are ignored for Solaris compatibility.
>

..needs to go above the --gnu2-tls-tag item. It is for -z XYZ.

> [...]

sam