[ELF2] - Optimization for R_X86_64_GOTTPOFF relocation.

[grimar]

Summary

R_X86_64_GOTTPOFF is not always requires GOT entries. Some relocations can be converted to local ones.
This patch is a port of gold optimizations for this relocation:
https://android.googlesource.com/toolchain/binutils/+/53b6ed3bceea971857c996b6dcb96de96b99335f/binutils-2.19/gold/x86_64.cc#2551

[grimar]

ELF/Target.cpp

362

I dont sure what to do here. How to check out of bound for negative idx. Should I check (will need BufBegin arg I guess) or we can assume its never be out ?

[ruiu]

ELF/InputSection.cpp

150–154

Can you move this above line 137 just like "if (Target->isTlsGlobalDynamicReloc(Type)) { ... }"?

Also, do you think you can merge getTlsOptimization and relocateTlsToLe into one function? I'd probably write like this.

// Some TLS relocations are always compiled to use GOT, but the linker
// is sometimes able to rewrite it so that it doesn't use GOT. This may not
// only apply relocations but also modify preceding instructions.
if (applyOptimizeTls(BufLoc, Type, AddrLoc, Body))
  continue;

ELF/Target.cpp

356

Please add a reference to Ulrich's document.

362–368

Is that actually a possible scenario that one wants to add a TLS value to SP register? Do you have to take care of that?

ELF/Target.h

61

Currently it only returns None or ToLE, so can you change the signature of the function so that it returns a boolean value?

[grimar]

ELF/InputSection.cpp

150–154

About merging into one.
getTlsOptimization() is also now used also in another place, in bool X86_64TargetInfo::relocNeedsGot().
So such merging probably not possible.

ELF/Target.cpp

362–368

I did not analyse how much people do that :)
gold and bfd do the same. And it is still possible scenario even if chance is low. I jsut want to be on a safe side with this single line.

ELF/Target.h

61

Will do.

[ruiu]

ELF/InputSection.cpp

150–154

Fair. Then please rename relocateTlsOptimize. (Readers don't really want to know how it is going to be optimized in this context, so "ToLe" is too detailed.)

ELF/Target.cpp

362–368

As long as it can be written simple enough, I'm fine, but currently it looks a bit too cryptic.

There are six instructions this function may emit. Could you explain what each instruction mean?

0x49 0x81 0xc?
0x49 0xc7 0xc?
0x?? 0x81 0xc?
0x?? 0xc7 0xc?
0x4d 0x8d 0x8?
0x?? 0x8d 0x8?

[grimar]

Review comments addressed.
Simplified.
Test updated.

ELF/InputSection.cpp

150–154

Renaming is done, but I did not move it because I need SymVA variable. Also this part of code became shorter now. And it uses continue like Target->relocNeedsCopy, so it looks to be in the most consistent place now, no ?

ELF/Target.cpp

362–368

That is (but I simplified code, so actual table is below in comments)

1. 0x49 0x81 0xc?

This is 0x49 0x81 0xC? XX XX XX XX, add $0xXXXXXXXX, %r?
Ex: 49 81 C0 00 00 00 00 = add $0x0, %r8

2. 0x49 0xc7 0xc?

This is 0x49 0xC7 0xC? XX XX XX XX, mov $0xXXXXXXXX, %r?
Ex: 49 C7 C0 00 00 00 00 = mov $0x0, %r8

3. 0x?? 0x81 0xc?

Never saw not the 0x48 as prefix for that cases, so
This is 0x48 0x81 0xC? XX XX XX XX, add $0xXXXXXXXX, %r??
Ex: 48 81 C0 00 00 00 00 = add $0x0, %rax

4. 0x?? 0xc7 0xc?

Never saw not the 0x48 as prefix for that cases, so
This is 0x48 0xc7 0xc? XX XX XX XX, mov $0xXXXXXXXX, %r??
Ex: 48 C7 C0 00 00 00 00 = mov $0x0, %rax

5. 0x4d 0x8d 0x8?

This is 0x4D 0x8D 0x8? XX XX XX XX, lea 0xXXXXXXXX(%r?),%r?
Ex: 4D 8D 89 00 00 00 00 = lea 0x0(%r9),%r9

6. 0x?? 0x8d 0x8?

Never saw not the 0x48 as prefix for that cases, so
This is 0x48 0x8d 0x8? XX XX XX XX, lea 0xXXXXXXXX(%r??),%r??
Ex: 48 8D 89 00 00 00 00 = lea 0x0(%rcx),%rcx

362–368

gold and bfd contain misleading comment about that special rsp handling. In fact that also touch r12 for them:

asm:
 addq tls0@GOTTPOFF(%rip), %rsp
 addq tls0@GOTTPOFF(%rip), %r8 
...
 addq tls0@GOTTPOFF(%rip), %r12
...
 addq tls0@GOTTPOFF(%rip), %r15 

00000000004000f0 <main>:
  400105:	48 81 c4 f8 ff ff ff 	add    $0xfffffffffffffff8,%rsp
  40010c:	4d 8d 80 f8 ff ff ff 	lea    -0x8(%r8),%r8
...
  400128:	49 81 c4 f8 ff ff ff 	add    $0xfffffffffffffff8,%r12
...
  40013d:	4d 8d bf f8 ff ff ff 	lea    -0x8(%r15),%r15

Looks like a bug of gold/bfd for me.
I rewrited the code to simplify it and removed special handling for rsp for now. I think we can add that if it will be needed later.

Updated possible emit table is:

2. 0x49 0xC7 0xC?
3. 0x?? 0xC7 0xC?
4. 0x4D 0x8D 0x8?
5. 0x?? 0x8D 0x8?

ELF/Target.h

61

Done.

[grimar]

In D14713#291058, @grimar wrote:

I rewrited the code to simplify it and removed special handling for rsp for now. I think we can add that if it will be needed later.

Or I can insert the fixed (in compare with gold/bfd) check affecting only rsp, but that will enlarge the void X86_64TargetInfo::relocateTlsOptimize()

[ruiu]

ELF/Target.cpp

367

Add BufStart and check for the bound.

370–374

Instruct -> Inst
IsMovOp -> IsMov

375–378

Does this handle SP register?

379

I think the original code was better

write32le(Loc, SA - Out<ELF64LE>::TlsPhdr->p_memsz);

[grimar]

ELF/Target.cpp

375–378

No. As I wrote in comments it will enlarge that code, but I can do that. Should I ?

379

According to manual its optimized exactly to R_X86_64_TPOFF32. Not sure how important skipped in that case OOR check as well:

case R_X86_64_TPOFF32:
    if (!isInt<32>(Val))
      error("R_X86_64_TPOFF32 out of range");

[grimar]

ELF/Target.cpp

375–378

With handling SP/r12 registers will be something like next:
(generates
48 81 c4 f8 ff ff ff add $0xfffffffffffffff8,%rsp for addq tls0@GOTTPOFF(%rip), %rsp
49 81 c4 f8 ff ff ff add $0xfffffffffffffff8,%r12 for addq tls0@GOTTPOFF(%rip), %r12)

void X86_64TargetInfo::relocateTlsOptimize(uint8_t *Loc, uint8_t *BufEnd,
                                           uint32_t Type, uint64_t P,
                                           uint64_t SA) const {
  uint8_t *Prefix = &Loc[-3];
  uint8_t *Inst = &Loc[-2];
  uint8_t *RegSlot = &Loc[-1];
  uint8_t Reg = (Loc[-1]) >> 3;
  bool IsAdd = !(*Inst == 0x8b || Reg == 4);
  if (Reg == 4 && !IsAdd)
    *Inst = 0x81;
  else
    *Inst = IsAdd ? 0x8d : 0xc7;
  if (*Prefix == 0x4c)
    *Prefix = IsAdd ? 0x4d : 0x49;
  *RegSlot = IsAdd ? (0x80 | Reg | (Reg << 3)) : (0xc0 | Reg);

  relocateOne(Loc, BufEnd, R_X86_64_TPOFF32, P, SA);
}

[grimar]

• Review comments addressed
• Added handling of rsp/r12, added comment why it is needed.
• Added buffer overrun check.
• Test updated (added rsp/r12 cases).

ELF/Target.cpp

367

Done.

370–374

Done.

[grimar]

I also have patch implementing optimizations for R_X86_64_TLSLD relocation. Its relies on some code changes in this one, so will post it right after it.

[ruiu]

ELF/InputSection.cpp

150

getTlsOptimization -> isTlsOptimized (since it returns a boolean value.)

Can you move this before

uintX_t SymVA = getSymVA<ELFT>(Body);

?

151

Currently you are not using BufEnd, so please remove that parameter.

ELF/Target.cpp

353

Remove outermost ().

370–371

I'm wondering if this is correct. One should never use a R_X86_64_GOTTPOFF relocation with instructions other than MOV or ADD?

[grimar]

Review comments addressed.

ELF/InputSection.cpp

150

Done.

151

It is used because relocateTlsOptimize() calls relocateOne() which accepts it.
I am not using Type now, so removed it.

ELF/Target.cpp

353

Done.

370–371

As stated in comment above the method, @gottpoff(%rip) must be used in movq or addq instructions only (its written in Ulrich manual), so yes, this relocation optimization only can have mov and add cases and thats definitely correct.
Also just in case gold and bfd has the same logic (but Ulrich is more preferable information source I think).

[ruiu]

ELF/Target.cpp

392

I applied you patch to my local repository to see if there's a room to make this simpler, only to find that this wouldn't be significantly simplified. I slightly updated the comments and code though. Please take a look.

// In some conditions, R_X86_64_GOTTPOFF relocation can be optimized to
// R_X86_64_TPOFF32 so that R_X86_64_TPOFF32 so that it does not use GOT.
// This function does that. Read "ELF Handling For Thread-Local Storage,
// 5.5 x86-x64 linker optimizations" (http://www.akkadia.org/drepper/tls.pdf)
// by Ulrich Drepper for details.
void X86_64TargetInfo::relocateTlsOptimize(uint8_t *Loc, uint8_t *BufStart,
                                           uint8_t *BufEnd, uint64_t P,
                                           uint64_t SA) const {
  // Ulrich's document section 6.5 says that @gottpoff(%rip) must be
  // used in MOVQ or ADDQ instructions only.
  // "MOVQ foo@GOTTPOFF(%RIP), %REG" is transformed to "MOVQ $foo, %REG".
  // "ADDQ foo@GOTTPOFF(%RIP), %REG" is transformed to "LEAQ foo(%REG), %REG"
  // (if the register is not RSP) or "ADDQ $foo, %RSP".
  // Opcodes info can be found at http://ref.x86asm.net/coder64.html#x48.
  if (Loc - 3 < BufStart)
    error("TLS relocation optimization failed. Buffer overrun!");
  uint8_t *Prefix = Loc - 3;
  uint8_t *Inst = Loc - 2;
  uint8_t *RegSlot = Loc - 1;
  uint8_t Reg = Loc[-1] >> 3;
  bool IsMov = *Inst == 0x8b;
  bool RspAdd = !IsMov && Reg == 4;
  // r12 and rsp registers requires special handling.
  // Problem is that for other registers, for example leaq 0xXXXXXXXX(%r11),%r11
  // result out is 7 bytes: 4d 8d 9b XX XX XX XX,
  // but leaq 0xXXXXXXXX(%r12),%r12 is 8 bytes: 4d 8d a4 24 XX XX XX XX.
  // The same true for rsp. So we convert to addq for them, saving 1 byte that
  // we dont have.
  if (RspAdd)
    *Inst = 0x81;
  else
    *Inst = IsMov ? 0xc7 : 0x8d;
  if (*Prefix == 0x4c)
    *Prefix = (IsMov || RspAdd) ? 0x49 : 0x4d;
  *RegSlot = (IsMov || RspAdd) ? (0xc0 | Reg) : (0x80 | Reg | (Reg << 3));
  relocateOne(Loc, BufEnd, R_X86_64_TPOFF32, P, SA);
}

[• rafael]

test/elf2/tls-opt.s

3

Just create a _start and drop the "-e main"

14

Do you really need the binary content? The text should be sufficient, no? I.E.:

// DISASM-NEXT: 11000: {{.*}} movq $-8, %rax

[• rafael]

ELF/Target.cpp

371

Please add a test for this.

It is important to show that we can actually get here with broken input.

[grimar]

Review comments addressed.

ELF/Target.cpp

371

I bit doubt that we should check such things here. Broken input for that place with or without that patch will lead to broken output. With this optimization applied or without it. The difference only in what way it broken (broken + optimization == broken x 2, but still broken).
Broken input is a bug of compiler and should be covered by its tests or by our tests of broken imputs that are separate tests.
Second problem that if according manual this relocation must use only mov or add then in future llvm-mc for example may add check for that and do not generate broken output. That will make this test to fail. We can save from that only by placing precompiled corrupted binaries as inputs, but thats again not for that patch I think.
But anyways just in case I added what you asked for to test. So if you really think we should do that for some reason - I see nothing too much bad in that if it touches only the test. Its easy to remove from test at any time.

392

Looks good. Applied your changes. Thanks !

I only added r12 to comment:

// (if the register is not RSP/R12) or "ADDQ $foo, %RSP".

test/elf2/tls-opt.s

3

Done.

14

Any of them is sufficient I think but we are emiting binary output and not the text. So need to keep and check the binary. At the same time text helps to read the test so it should be there at least in comments for binary I think. But there is no point to move it to comments I believe. I would leave it as is because of that all.

[grimar]

test/elf2/tls-opt.s

25

The last one also is a part of currupted output, I`ll move it below
// Corrupred output:

[grimar]

Rebased.

[grimar]

test/ELF/tls-opt.s

2 ↗

(On Diff #40747)

Forgot to switch to ld.lld here. Will be fixed.

[grimar]

• Rebased
• Removed buffer overrun check and *BeginBuf argument.
• Test: ld.lld2->ld.lld

[ruiu]

LGTM with a nit.

ELF/InputSection.cpp

137

Can you move Body.isTLS() into isTlsOptimized function?

[grimar]

In D14713#295215, @ruiu wrote:

LGTM with a nit.

Will do, thanks !

ELF/InputSection.cpp

for (const RelType &RI : Rels) {
 
     if (Target->isTlsGlobalDynamicReloc(Type)) {
       Target->relocateOne(BufLoc, BufEnd, Type, AddrLoc,
                           Out<ELFT>::Got->getEntryAddr(Body) +
                               getAddend<ELFT>(RI));
       continue;
     }
 
     uintX_t SymVA = getSymVA<ELFT>(Body);
     if (Target->relocNeedsPlt(Type, Body)) {
       SymVA = Out<ELFT>::Plt->getEntryAddr(Body);
       Type = Target->getPLTRefReloc(Type);
     } else if (Target->relocNeedsGot(Type, Body)) {
       SymVA = Out<ELFT>::Got->getEntryAddr(Body);
       Type = Body.isTLS() ? Target->getTlsGotReloc() : Target->getGotRefReloc();
     } else if (Target->relocPointsToGot(Type)) {
       SymVA = Out<ELFT>::Got->getVA();
       Type = Target->getPCRelReloc();
     } else if (!Target->relocNeedsCopy(Type, Body) &&
                isa<SharedSymbol<ELFT>>(Body)) {
       continue;
+    } else if (Body.isTLS() &&
+               Target->getTlsOptimization(Type, Body) == TargetInfo::ToLE) {
+      Target->relocateTlsToLe(BufLoc, BufEnd, Type, AddrLoc, SymVA);
+      continue;
     }
     Target->relocateOne(BufLoc, BufEnd, Type, AddrLoc,
                         SymVA + getAddend<ELFT>(RI));
   }
 }
 
 template <class ELFT> void InputSection<ELFT>::writeTo(uint8_t *Buf) {
   if (this->Header->sh_type == SHT_NOBITS)
     return;

ELF/Target.h

 #include <memory>
 
 namespace lld {
 namespace elf2 {
 class SymbolBody;
 
 class TargetInfo {
 public:
+  enum TlsOpt { None, ToLE };
   unsigned getPageSize() const { return PageSize; }
   uint64_t getVAStart() const;
   unsigned getCopyReloc() const { return CopyReloc; }
   unsigned getPCRelReloc() const { return PCRelReloc; }
   unsigned getGotReloc() const { return GotReloc; }
   unsigned getPltReloc() const { return PltReloc; }
   unsigned getGotRefReloc() const { return GotRefReloc; }
   unsigned getRelativeReloc() const { return RelativeReloc; }
virtual void writePltEntry(uint8_t *Buf, uint64_t GotEntryAddr,
                              uint64_t PltEntryAddr, int32_t Index) const = 0;
   virtual bool isRelRelative(uint32_t Type) const;
   virtual bool relocNeedsCopy(uint32_t Type, const SymbolBody &S) const;
   virtual bool relocNeedsGot(uint32_t Type, const SymbolBody &S) const = 0;
   virtual bool relocPointsToGot(uint32_t Type) const;
   virtual bool relocNeedsPlt(uint32_t Type, const SymbolBody &S) const = 0;
   virtual void relocateOne(uint8_t *Loc, uint8_t *BufEnd, uint32_t Type,
                            uint64_t P, uint64_t SA) const = 0;
-
+  virtual TlsOpt getTlsOptimization(unsigned Type, const SymbolBody &S) const;
+  virtual void relocateTlsToLe(uint8_t *Loc, uint8_t *BufEnd, uint32_t Type,
+                               uint64_t P, uint64_t SA) const;
   virtual ~TargetInfo();
 
 protected:
   unsigned PageSize = 4096;
 
   // On freebsd x86_64 the first page cannot be mmaped.
   // On linux that is controled by vm.mmap_min_addr. At least on some x86_64
   // installs that is 65536, so the first 15 pages cannot be used.

ELF/Target.cpp

public:
   void writePltEntry(uint8_t *Buf, uint64_t GotEntryAddr,
                      uint64_t PltEntryAddr, int32_t Index) const override;
   bool relocNeedsCopy(uint32_t Type, const SymbolBody &S) const override;
   bool relocNeedsGot(uint32_t Type, const SymbolBody &S) const override;
   bool relocNeedsPlt(uint32_t Type, const SymbolBody &S) const override;
   void relocateOne(uint8_t *Loc, uint8_t *BufEnd, uint32_t Type, uint64_t P,
                    uint64_t SA) const override;
   bool isRelRelative(uint32_t Type) const override;
+  TlsOpt getTlsOptimization(unsigned Type, const SymbolBody &S) const override;
+  void relocateTlsToLe(uint8_t *Loc, uint8_t *BufEnd, uint32_t Type, uint64_t P,
+    uint64_t SA) const override;
 };
 
 class PPC64TargetInfo final : public TargetInfo {
 public:
   PPC64TargetInfo();
   void writeGotPltEntry(uint8_t *Buf, uint64_t Plt) const override;
   void writePltZeroEntry(uint8_t *Buf, uint64_t GotEntryAddr,
                          uint64_t PltEntryAddr) const override;
TargetInfo *createTarget() {
   case EM_X86_64:
     return new X86_64TargetInfo();
   }
   error("Unknown target machine");
 }
 
 TargetInfo::~TargetInfo() {}
 
+TargetInfo::TlsOpt TargetInfo::getTlsOptimization(unsigned Type,
+                                                  const SymbolBody &S) const {
+  return None;
+}
+
 uint64_t TargetInfo::getVAStart() const { return Config->Shared ? 0 : VAStart; }
 
 bool TargetInfo::relocNeedsCopy(uint32_t Type, const SymbolBody &S) const {
   return false;
 }
 
 unsigned TargetInfo::getPLTRefReloc(unsigned Type) const { return PCRelReloc; }
 
 bool TargetInfo::relocPointsToGot(uint32_t Type) const { return false; }
 
 bool TargetInfo::isRelRelative(uint32_t Type) const { return true; }
 
 void TargetInfo::writeGotHeaderEntries(uint8_t *Buf) const {}
 
+void TargetInfo::relocateTlsToLe(uint8_t *Loc, uint8_t *BufEnd, uint32_t Type,
+                                 uint64_t P, uint64_t SA) const {}
+
 X86TargetInfo::X86TargetInfo() {
   PCRelReloc = R_386_PC32;
   GotReloc = R_386_GLOB_DAT;
   GotRefReloc = R_386_GOT32;
   PltReloc = R_386_JUMP_SLOT;
 }
 
 void X86TargetInfo::writeGotPltEntry(uint8_t *Buf, uint64_t Plt) const {}
bool X86_64TargetInfo::relocNeedsCopy(uint32_t Type,
   if (Type == R_X86_64_32S || Type == R_X86_64_32 || Type == R_X86_64_PC32 ||
       Type == R_X86_64_64)
     if (auto *SS = dyn_cast<SharedSymbol<ELF64LE>>(&S))
       return SS->Sym.getType() == STT_OBJECT;
   return false;
 }
 
 bool X86_64TargetInfo::relocNeedsGot(uint32_t Type, const SymbolBody &S) const {
+  if (Type == R_X86_64_GOTTPOFF)
+    return getTlsOptimization(Type, S) == None;
   return Type == R_X86_64_GOTTPOFF || Type == R_X86_64_GOTPCREL ||
          relocNeedsPlt(Type, S);
 }
 
 unsigned X86_64TargetInfo::getPLTRefReloc(unsigned Type) const {
   if (Type == R_X86_64_PLT32)
     return R_X86_64_PC32;
   return Type;
bool X86_64TargetInfo::isRelRelative(uint32_t Type) const {
   case R_X86_64_PC8:
   case R_X86_64_PLT32:
   case R_X86_64_DTPOFF32:
   case R_X86_64_DTPOFF64:
     return true;
   }
 }
 
+TargetInfo::TlsOpt
+X86_64TargetInfo::getTlsOptimization(unsigned Type, const SymbolBody &S) const {
+  if (Config->Shared)
+    return None;
+  return (Type == R_X86_64_GOTTPOFF && !canBePreempted(&S, true)) ? ToLE : None;
+}
+
+void X86_64TargetInfo::relocateTlsToLe(uint8_t *Loc, uint8_t *BufEnd,
+                                       uint32_t Type, uint64_t P,
+                                       uint64_t SA) const {
+  uint8_t Val = Loc[-3];
+  uint8_t Ins = Loc[-2];
+  uint8_t Reg = Loc[-1] >> 3;
+  // Originally it can be one of two:
+  // 1) movq foo@gottpoff(%rip), %reg
+  // We change it into one of:
+  // movq $foo, %reg
+  // addq $foo, %rsp (addressing with %rsp is special).
+  // 2) addq foo@gottpoff(%rip), %reg
+  // We change it into leaq foo(%reg), %reg.
+  bool RspAdd = (Ins != 0x8b && Reg == 4);
+  if (Ins == 0x8b || RspAdd) {
+    if (Val == 0x4c)
+      Loc[-3] = 0x49;
+    Loc[-2] = RspAdd ? 0x81 : 0xc7;
+    Loc[-1] = 0xc0 | Reg;
+  } else {
+    if (Val == 0x4c)
+      Loc[-3] = 0x4d;
+    Loc[-2] = 0x8d;
+    Loc[-1] = 0x80 | Reg | (Reg << 3);
+  }
+  write32le(Loc, SA - Out<ELF64LE>::TlsPhdr->p_memsz);
+}
+
 void X86_64TargetInfo::relocateOne(uint8_t *Loc, uint8_t *BufEnd, uint32_t Type,
                                    uint64_t P, uint64_t SA) const {
   switch (Type) {
   case R_X86_64_PC32:
   case R_X86_64_GOTPCREL:
   case R_X86_64_PLT32:
   case R_X86_64_TLSLD:
   case R_X86_64_TLSGD:
   case R_X86_64_TPOFF64:
     write32le(Loc, SA - P);
     break;
   case R_X86_64_64:
   case R_X86_64_DTPOFF64:
     write64le(Loc, SA);
     break;
   case R_X86_64_32:
   case R_X86_64_32S:

test/elf2/tls-opt.s

+// RUN: llvm-mc -filetype=obj -triple=x86_64-unknown-linux %s -o %t.o
+// RUN: ld.lld2 -e main %t.o -o %t1
+// RUN: llvm-readobj -r %t1 | FileCheck --check-prefix=NORELOC %s
+// RUN: llvm-objdump -d %t1 | FileCheck --check-prefix=DISASM %s
+
+// NORELOC:      Relocations [
+// NORELOC-NEXT: ]
+
+// DISASM: Disassembly of section .text:
+// DISASM-NEXT: main:
+// DISASM-NEXT: 11000: 48 c7 c0 fc ff ff ff movq $-4, %rax
+// DISASM-NEXT: 11007: 48 c7 c0 f8 ff ff ff movq $-8, %rax
+// DISASM-NEXT: 1100e: 48 8d 80 fc ff ff ff leaq -4(%rax), %rax
+// DISASM-NEXT: 11015: 48 8d 80 f8 ff ff ff leaq -8(%rax), %rax
+// DISASM-NEXT: 1101c: 48 81 c4 fc ff ff ff addq $-4, %rsp
+// DISASM-NEXT: 11023: 48 81 c4 f8 ff ff ff addq $-8, %rsp
+   
+.type tls0,@object
+.section .tbss,"awT",@nobits
+.globl tls0
+.align 4
+tls0:
+ .long 0
+ .size tls0, 4
+
+.type  tls1,@object
+.globl tls1
+.align 4
+tls1:
+ .long 0
+ .size tls1, 4
+
+.text
+ .globl main
+ .align 16, 0x90
+ .type main,@function
+main:
+ movq tls1@GOTTPOFF(%rip), %rax
+ movq tls0@GOTTPOFF(%rip), %rax
+ addq tls1@GOTTPOFF(%rip), %rax
+ addq tls0@GOTTPOFF(%rip), %rax
+ addq tls1@GOTTPOFF(%rip), %rsp
+ addq tls0@GOTTPOFF(%rip), %rsp