[BOLT] Add new class for symbolizing X86 instructions

[maksfb]

Summary

While disassembling instructions, we need to replace certain immediate
operands with symbols. This symbolizing process relies on reading
relocations against instructions. However, Some X86 instructions can
have multiple immediate operands with up to two relocations against
them. Thus, correctly matching a relocation to an operand is not
always possible without knowing the operand offset within the
instruction.

Luckily, LLVM provides an interface for passing the required info from
the disassembler via a virtual MCSymbolizer class. Creating a
target-specific version allows a precise matching of relocations to
operands.

This diff adds X86MCSymbolizer class that performs X86-specific
symbolizing (currently limited to non-branch instructions).

[Amir]

Would be best to split out X86Disassembler.cpp changes if they're fixing some bugs and provide a test case for them separately.

[maksfb]

In D120928#3358041, @Amir wrote:

Would be best to split out X86Disassembler.cpp changes if they're fixing some bugs and provide a test case for them separately.

As far as I can tell, the features are exposed only via virtual class/interface. BOLT has a concrete X86 implementation that is being tested with regression tests.

[rafauler]

LGTM. Nice!

[maksfb]

Rebase on https://reviews.llvm.org/D126101

[maksfb]

Ignore implicit operands in X86MCSymbolizer::tryAddingSymbolicOperand().

bolt/include/bolt/Core/BinaryContext.h

public:
   std::unique_ptr<const MCInstrAnalysis> MIA;
 
   std::unique_ptr<MCPlusBuilder> MIB;
 
   std::unique_ptr<const MCRegisterInfo> MRI;
 
   std::unique_ptr<MCDisassembler> DisAsm;
 
+  /// Symbolic disassembler.
+  std::unique_ptr<MCDisassembler> SymbolicDisAsm;
+
   std::unique_ptr<MCAsmBackend> MAB;
 
   /// Indicates if relocations are available for usage.
   bool HasRelocations{false};
 
   /// Is the binary always loaded at a fixed address. Shared objects and
   /// position-independent executables (PIEs) are examples of binaries that
   /// will have HasFixedLoadAddress set to false.

bolt/include/bolt/Core/BinaryFunction.h

public:
   }
 
   /// Iterate over all jump tables associated with this function.
   iterator_range<std::map<uint64_t, JumpTable *>::const_iterator>
   jumpTables() const {
     return make_range(JumpTables.begin(), JumpTables.end());
   }
 
+  /// Return relocation associated with a given \p Offset in the function,
+  /// or nullptr if no such relocation exists.
+  const Relocation *getRelocationAt(uint64_t Offset) const {
+    assert(CurrentState == State::Empty &&
+           "Relocations unavailable in the current function state.");
+    auto RI = Relocations.find(Offset);
+    return (RI == Relocations.end()) ? nullptr : &RI->second;
+  }
+
   /// Returns the raw binary encoding of this function.
   ErrorOr<ArrayRef<uint8_t>> getData() const;
 
   BinaryFunction &updateState(BinaryFunction::State State) {
     CurrentState = State;
     return *this;
   }
 

bolt/include/bolt/Core/MCPlusBuilder.h

 
 #include "bolt/Core/MCPlus.h"
 #include "bolt/Core/Relocation.h"
 #include "llvm/ADT/ArrayRef.h"
 #include "llvm/ADT/BitVector.h"
 #include "llvm/ADT/Optional.h"
 #include "llvm/ADT/StringMap.h"
 #include "llvm/MC/MCAsmBackend.h"
+#include "llvm/MC/MCDisassembler/MCSymbolizer.h"
 #include "llvm/MC/MCExpr.h"
 #include "llvm/MC/MCInst.h"
 #include "llvm/MC/MCInstrAnalysis.h"
 #include "llvm/MC/MCInstrDesc.h"
 #include "llvm/MC/MCInstrInfo.h"
 #include "llvm/Support/Allocator.h"
 #include "llvm/Support/ErrorHandling.h"
 #include "llvm/Support/ErrorOr.h"
 #include <cassert>
 #include <cstdint>
 #include <map>
 #include <system_error>
 #include <unordered_map>
 #include <unordered_set>
 
 namespace llvm {
 class MCContext;
 class MCFixup;
 class MCRegisterInfo;
 class MCSymbol;
 class raw_ostream;
 
 namespace bolt {
+class BinaryFunction;
 
 /// Different types of indirect branches encountered during disassembly.
 enum class IndirectBranchType : char {
   UNKNOWN = 0,             /// Unable to determine type.
   POSSIBLE_TAIL_CALL,      /// Possibly a tail call.
   POSSIBLE_JUMP_TABLE,     /// Possibly a switch/jump table.
   POSSIBLE_PIC_JUMP_TABLE, /// Possibly a jump table for PIC.
   POSSIBLE_GOTO,           /// Possibly a gcc's computed goto.
MCPlusBuilder(const MCInstrAnalysis *Analysis, const MCInstrInfo *Info,
       : Analysis(Analysis), Info(Info), RegInfo(RegInfo) {
     // Initialize the default annotation allocator with id 0
     AnnotationAllocators.emplace(0, AnnotationAllocator());
     MaxAllocatorId++;
     // Build alias map
     initAliases();
   }
 
+  /// Create and return target-specific MC symbolizer for the \p Function.
+  virtual std::unique_ptr<MCSymbolizer>
+  createTargetSymbolizer(BinaryFunction &Function) const {
+    return nullptr;
+  }
+
   /// Initialize a new annotation allocator and return its id
   AllocatorIdTy initializeNewAnnotationAllocator() {
     AnnotationAllocators.emplace(MaxAllocatorId, AnnotationAllocator());
     return MaxAllocatorId++;
   }
 
   /// Return the annotation allocator of a given id
   AnnotationAllocator &getAnnotationAllocator(AllocatorIdTy AllocatorId) {

bolt/lib/Core/BinaryContext.cpp

BinaryContext::createBinaryContext(const ObjectFile *File, bool IsPIC,
 
   BC->MAB = std::unique_ptr<MCAsmBackend>(
       BC->TheTarget->createMCAsmBackend(*BC->STI, *BC->MRI, MCTargetOptions()));
 
   BC->setFilename(File->getFileName());
 
   BC->HasFixedLoadAddress = !IsPIC;
 
+  BC->SymbolicDisAsm = std::unique_ptr<MCDisassembler>(
+      BC->TheTarget->createMCDisassembler(*BC->STI, *BC->Ctx));
+
+  if (!BC->SymbolicDisAsm)
+    return createStringError(
+        make_error_code(std::errc::not_supported),
+        Twine("BOLT-ERROR: no disassembler info for target ", TripleName));
+
   return std::move(BC);
 }
 
 bool BinaryContext::forceSymbolRelocations(StringRef SymbolName) const {
   if (opts::HotText &&
       (SymbolName == "__hot_start" || SymbolName == "__hot_end"))
     return true;
 

bolt/lib/Core/BinaryFunction.cpp

bool BinaryFunction::disassemble() {
   assert(ErrorOrFunctionData && "function data is not available");
   ArrayRef<uint8_t> FunctionData = *ErrorOrFunctionData;
   assert(FunctionData.size() == getMaxSize() &&
          "function size does not match raw data size");
 
   auto &Ctx = BC.Ctx;
   auto &MIB = BC.MIB;
 
+  BC.SymbolicDisAsm->setSymbolizer(MIB->createTargetSymbolizer(*this));
+
   // Insert a label at the beginning of the function. This will be our first
   // basic block.
   Labels[0] = Ctx->createNamedTempSymbol("BB0");
 
   auto handlePCRelOperand = [&](MCInst &Instruction, uint64_t Address,
                                 uint64_t Size) {
     uint64_t TargetAddress = 0;
     if (!MIB->evaluateMemOperandTarget(Instruction, TargetAddress, Address,
for (uint64_t Offset = 0; Offset < getSize(); Offset += Size) {
     const uint64_t AbsoluteInstrAddr = getAddress() + Offset;
 
     // Check for data inside code and ignore it
     if (const size_t DataInCodeSize = getSizeOfDataInCodeAt(Offset)) {
       Size = DataInCodeSize;
       continue;
     }
 
-    if (!BC.DisAsm->getInstruction(Instruction, Size,
+    if (!BC.SymbolicDisAsm->getInstruction(Instruction, Size,
                                            FunctionData.slice(Offset),
                                            AbsoluteInstrAddr, nulls())) {
       // Functions with "soft" boundaries, e.g. coming from assembly source,
       // can have 0-byte padding at the end.
       if (isZeroPaddingAt(Offset))
         break;
 
       errs() << "BOLT-WARNING: unable to disassemble instruction at offset 0x"
              << Twine::utohexstr(Offset) << " (address 0x"
              << Twine::utohexstr(AbsoluteInstrAddr) << ") in function " << *this
for (uint64_t Offset = 0; Offset < getSize(); Offset += Size) {
     // Special handling for AVX-512 instructions.
     if (MIB->hasEVEXEncoding(Instruction)) {
       if (BC.HasRelocations && opts::TrapOnAVX512) {
         setTrapOnEntry();
         BC.TrappedFunctions.push_back(this);
         break;
       }
 
-      // Check if our disassembly is correct and matches the assembler output.
-      if (!BC.validateEncoding(Instruction, FunctionData.slice(Offset, Size))) {
-        if (opts::Verbosity >= 1) {
+      // Disassemble again without the symbolizer and check that the disassembly
+      // matches the assembler output.
+      MCInst TempInst;
+      BC.DisAsm->getInstruction(TempInst, Size, FunctionData.slice(Offset),
+                                AbsoluteInstrAddr, nulls());
+      if (!BC.validateEncoding(TempInst, FunctionData.slice(Offset, Size))) {
+        if (opts::Verbosity >= 0) {
           errs() << "BOLT-WARNING: internal assembler/disassembler error "
                     "detected for AVX512 instruction:\n";
-          BC.printInstruction(errs(), Instruction, AbsoluteInstrAddr);
+          BC.printInstruction(errs(), TempInst, AbsoluteInstrAddr);
           errs() << " in function " << *this << '\n';
         }
 
         setIgnored();
         break;
       }
     }
 
if (MIB->isBranch(Instruction) || MIB->isCall(Instruction)) {
           handleIndirectBranch(Instruction, Size, Offset);
         // Indirect call. We only need to fix it if the operand is RIP-relative.
         if (IsSimple && MIB->hasPCRelOperand(Instruction))
           handlePCRelOperand(Instruction, AbsoluteInstrAddr, Size);
 
         if (BC.isAArch64())
           handleAArch64IndirectCall(Instruction, Offset);
       }
-    } else {
+    } else if (BC.isAArch64()) {
       // Check if there's a relocation associated with this instruction.
       bool UsedReloc = false;
       for (auto Itr = Relocations.lower_bound(Offset),
                 ItrE = Relocations.lower_bound(Offset + Size);
            Itr != ItrE; ++Itr) {
         const Relocation &Relocation = Itr->second;
         uint64_t SymbolValue = Relocation.Value - Relocation.Addend;
         if (Relocation.isPCRelative())
           SymbolValue += getAddress() + Relocation.Offset;
 
-        // Process reference to the symbol.
-        if (BC.isX86())
-          BC.handleAddressRef(SymbolValue, *this, Relocation.isPCRelative());
-
-        if (BC.isAArch64() || !Relocation.isPCRelative()) {
-          int64_t Value = Relocation.Value;
-          const bool Result = BC.MIB->replaceImmWithSymbolRef(
-              Instruction, Relocation.Symbol, Relocation.Addend, Ctx.get(),
-              Value, Relocation.Type);
-          (void)Result;
-          assert(Result && "cannot replace immediate with relocation");
+            Instruction, Relocation.Symbol, Relocation.Addend, Ctx.get(), Value,
+            Relocation.Type);
 
-          if (BC.isX86()) {
-            // Make sure we replaced the correct immediate (instruction
-            // can have multiple immediate operands).
-            assert(
-                truncateToSize(static_cast<uint64_t>(Value),
-                               Relocation::getSizeForType(Relocation.Type)) ==
-                    truncateToSize(Relocation.Value, Relocation::getSizeForType(
-                                                         Relocation.Type)) &&
-                "immediate value mismatch in function");
-          } else if (BC.isAArch64()) {
-            // For aarch, if we replaced an immediate with a symbol from a
-            // relocation, we mark it so we do not try to further process a
-            // pc-relative operand. All we need is the symbol.
-            UsedReloc = true;
-          }
-        } else {
-          // Check if the relocation matches memop's Disp.
-          uint64_t TargetAddress;
-          if (!BC.MIB->evaluateMemOperandTarget(Instruction, TargetAddress,
-                                                AbsoluteInstrAddr, Size)) {
-            errs() << "BOLT-ERROR: PC-relative operand can't be evaluated\n";
-            exit(1);
-          }
-          assert(TargetAddress == Relocation.Value + AbsoluteInstrAddr + Size &&
-                 "Immediate value mismatch detected.");
-
-          const MCExpr *Expr = MCSymbolRefExpr::create(
-              Relocation.Symbol, MCSymbolRefExpr::VK_None, *BC.Ctx);
-          // Real addend for pc-relative targets is adjusted with a delta
-          // from relocation placement to the next instruction.
-          const uint64_t TargetAddend =
-              Relocation.Addend + Offset + Size - Relocation.Offset;
-          if (TargetAddend) {
-            const MCConstantExpr *Offset =
-                MCConstantExpr::create(TargetAddend, *BC.Ctx);
-            Expr = MCBinaryExpr::createAdd(Expr, Offset, *BC.Ctx);
-          }
-          BC.MIB->replaceMemOperandDisp(
-              Instruction, MCOperand::createExpr(BC.MIB->getTargetExprFor(
-                               Instruction, Expr, *BC.Ctx, 0)));
-          UsedReloc = true;
-        }
-      }
+        // For aarch64, if we replaced an immediate with a symbol from a
 
       if (MIB->hasPCRelOperand(Instruction) && !UsedReloc)
         handlePCRelOperand(Instruction, AbsoluteInstrAddr, Size);
     }
 
 add_instruction:
     if (getDWARFLineTable()) {
       Instruction.setLoc(findDebugLineInformationForInstructionAt(
if (BC.MIB->isNoop(Instruction)) {
       //       E.g. nopw 0x0(%rax,%rax,1) is 9 bytes, but re-encoded it's only
       //       5 bytes. Preserve the size info using annotations.
       MIB->addAnnotation(Instruction, "Size", static_cast<uint32_t>(Size));
     }
 
     addInstruction(Offset, std::move(Instruction));
   }
 
+  // Reset symbolizer for the disassembler.
+  BC.SymbolicDisAsm->setSymbolizer(nullptr);
+
   clearList(Relocations);
 
   if (!IsSimple) {
     clearList(Instructions);
     return false;
   }
 
   updateState(State::Disassembled);

bolt/lib/Core/CMakeLists.txt

 set(LLVM_LINK_COMPONENTS
   DebugInfoDWARF
   Demangle
   MC
+  MCDisassembler
   Object
   Support
   )
 
 add_llvm_library(LLVMBOLTCore
   BinaryBasicBlock.cpp
   BinaryContext.cpp
   BinaryData.cpp

bolt/lib/Target/X86/CMakeLists.txt

 set(LLVM_LINK_COMPONENTS
   BOLTCore
   BOLTUtils
   MC
+  MCDisassembler
   Support
   X86Desc
   )
 
 add_llvm_library(LLVMBOLTTargetX86
   X86MCPlusBuilder.cpp
+  X86MCSymbolizer.cpp
 
   DEPENDS
   X86CommonTableGen
   )
 
 include_directories(
   ${LLVM_MAIN_SRC_DIR}/lib/Target/X86
   ${LLVM_BINARY_DIR}/lib/Target/X86
   )

bolt/lib/Target/X86/X86MCPlusBuilder.cpp

 //===- bolt/Target/X86/X86MCPlusBuilder.cpp -------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 // This file provides X86-specific MCPlus builder.
 //
 //===----------------------------------------------------------------------===//
 
 #include "MCTargetDesc/X86BaseInfo.h"
 #include "MCTargetDesc/X86InstrRelaxTables.h"
 #include "MCTargetDesc/X86MCTargetDesc.h"
+#include "X86MCSymbolizer.h"
 #include "bolt/Core/MCPlus.h"
 #include "bolt/Core/MCPlusBuilder.h"
 #include "llvm/BinaryFormat/ELF.h"
 #include "llvm/MC/MCContext.h"
 #include "llvm/MC/MCFixupKindInfo.h"
 #include "llvm/MC/MCInst.h"
 #include "llvm/MC/MCInstBuilder.h"
 #include "llvm/MC/MCInstrInfo.h"

 }
 
 class X86MCPlusBuilder : public MCPlusBuilder {
 public:
   X86MCPlusBuilder(const MCInstrAnalysis *Analysis, const MCInstrInfo *Info,
                    const MCRegisterInfo *RegInfo)
       : MCPlusBuilder(Analysis, Info, RegInfo) {}
 
+  std::unique_ptr<MCSymbolizer>
+  createTargetSymbolizer(BinaryFunction &Function) const override {
+    return std::make_unique<X86MCSymbolizer>(Function);
+  }
+
   bool isBranch(const MCInst &Inst) const override {
     return Analysis->isBranch(Inst) && !isTailCall(Inst);
   }
 
   bool isNoop(const MCInst &Inst) const override {
     return X86::isNOP(Inst.getOpcode());
   }
 

bolt/lib/Target/X86/X86MCSymbolizer.h

+//===- bolt/Target/X86/X86MCSymbolizer.h ------------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef BOLT_CORE_X86MCSYMBOLIZER_H
+#define BOLT_CORE_X86MCSYMBOLIZER_H
+
+#include "bolt/Core/BinaryFunction.h"
+#include "llvm/MC/MCDisassembler/MCSymbolizer.h"
+
+namespace llvm {
+namespace bolt {
+
+class X86MCSymbolizer : public MCSymbolizer {
+protected:
+  BinaryFunction &Function;
+
+public:
+  X86MCSymbolizer(BinaryFunction &Function)
+      : MCSymbolizer(*Function.getBinaryContext().Ctx.get(), nullptr),
+        Function(Function) {}
+
+  X86MCSymbolizer(const X86MCSymbolizer &) = delete;
+  X86MCSymbolizer &operator=(const X86MCSymbolizer &) = delete;
+  virtual ~X86MCSymbolizer();
+
+  bool tryAddingSymbolicOperand(MCInst &Inst, raw_ostream &CStream,
+                                int64_t Value, uint64_t Address, bool IsBranch,
+                                uint64_t Offset, uint64_t OpSize,
+                                uint64_t InstSize) override;
+
+  void tryAddingPcLoadReferenceComment(raw_ostream &CStream, int64_t Value,
+                                       uint64_t Address) override;
+};
+
+} // namespace bolt
+} // namespace llvm
+
+#endif

bolt/lib/Target/X86/X86MCSymbolizer.cpp

+//===- bolt/Target/X86/X86MCSymbolizer.cpp --------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "X86MCSymbolizer.h"
+#include "MCTargetDesc/X86BaseInfo.h"
+#include "bolt/Core/BinaryContext.h"
+#include "bolt/Core/BinaryFunction.h"
+#include "bolt/Core/MCPlusBuilder.h"
+#include "bolt/Core/Relocation.h"
+#include "llvm/MC/MCInst.h"
+#include "llvm/MC/MCRegisterInfo.h"
+
+#define DEBUG_TYPE "bolt-symbolizer"
+
+namespace llvm {
+namespace bolt {
+
+X86MCSymbolizer::~X86MCSymbolizer() {}
+
+bool X86MCSymbolizer::tryAddingSymbolicOperand(
+    MCInst &Inst, raw_ostream &CStream, int64_t Value, uint64_t InstAddress,
+    bool IsBranch, uint64_t ImmOffset, uint64_t ImmSize, uint64_t InstSize) {
+  if (IsBranch)
+    return false;
+
+  // Ignore implicit operands.
+  if (ImmSize == 0)
+    return false;
+
+  BinaryContext &BC = Function.getBinaryContext();
+  MCContext *Ctx = BC.Ctx.get();
+
+  if (BC.MIB->isBranch(Inst) || BC.MIB->isCall(Inst))
+    return false;
+
+  /// Add symbolic operand to the instruction with an optional addend.
+  auto addOperand = [&](const MCSymbol *Symbol, uint64_t Addend) {
+    const MCExpr *Expr = MCSymbolRefExpr::create(Symbol, *Ctx);
+    if (Addend)
+      Expr = MCBinaryExpr::createAdd(Expr, MCConstantExpr::create(Addend, *Ctx),
+                                     *Ctx);
+    Inst.addOperand(MCOperand::createExpr(Expr));
+  };
+
+  // Check for relocations against the operand.
+  const uint64_t InstOffset = InstAddress - Function.getAddress();
+  if (const Relocation *Relocation =
+          Function.getRelocationAt(InstOffset + ImmOffset)) {
+    uint64_t SymbolValue = Relocation->Value - Relocation->Addend;
+    if (Relocation->isPCRelative())
+      SymbolValue += InstAddress + ImmOffset;
+
+    // Process reference to the symbol.
+    BC.handleAddressRef(SymbolValue, Function, Relocation->isPCRelative());
+
+    uint64_t Addend = Relocation->Addend;
+    // Real addend for pc-relative targets is adjusted with a delta from
+    // the relocation placement to the next instruction.
+    if (Relocation->isPCRelative())
+      Addend += InstOffset + InstSize - Relocation->Offset;
+
+    addOperand(Relocation->Symbol, Addend);
+
+    return true;
+  }
+
+  // Check if the operand being added is a displacement part of a compound
+  // memory operand that uses PC-relative addressing. If it is, try to symbolize
+  // it without relocations.
+  const int MemOp = BC.MIB->getMemoryOperandNo(Inst);
+  if (MemOp == -1)
+    return false;
+
+  const unsigned DispOp = MemOp + X86::AddrDisp;
+  if (Inst.getNumOperands() != DispOp)
+    return false;
+
+  const MCOperand &Base = Inst.getOperand(MemOp + X86::AddrBaseReg);
+  if (Base.getReg() != BC.MRI->getProgramCounter())
+    return false;
+
+  const MCOperand &Scale = Inst.getOperand(MemOp + X86::AddrScaleAmt);
+  const MCOperand &Index = Inst.getOperand(MemOp + X86::AddrIndexReg);
+  if (Scale.getImm() != 0 && Index.getReg() != MCRegister::NoRegister)
+    return false;
+
+  const MCSymbol *TargetSymbol;
+  uint64_t TargetOffset;
+  std::tie(TargetSymbol, TargetOffset) =
+      BC.handleAddressRef(Value, Function, /*IsPCRel*/ true);
+
+  addOperand(TargetSymbol, TargetOffset);
+
+  return true;
+}
+
+void X86MCSymbolizer::tryAddingPcLoadReferenceComment(raw_ostream &CStream,
+                                                      int64_t Value,
+                                                      uint64_t Address) {}
+
+} // namespace bolt
+} // namespace llvm

bolt/test/X86/double-rel.s

+## Check that BOLT can correctly use relocations to symbolize instruction
+## operands when an instruction can have up to two relocations associated
+## with it.
+
+# REQUIRES: system-linux
+
+# RUN: llvm-mc -filetype=obj -triple x86_64-unknown-linux %s -o %t.o
+# RUN: ld.lld %t.o -o %t.exe -q --Tdata=0x80000
+# RUN: llvm-bolt %t.exe -relocs -o /dev/null -print-only=_start -print-disasm \
+# RUN:   | FileCheck %s --check-prefix=CHECK-BOLT
+# RUN: llvm-objdump -d --print-imm-hex %t.exe \
+# RUN:   | FileCheck %s --check-prefix=CHECK-OBJDUMP
+
+  .data
+  .globl VAR
+VAR:
+  .quad
+
+  .text
+  .globl _start
+  .type _start,@function
+_start:
+  .cfi_startproc
+
+## VAR value is 0x80000. Using relocations, llvm-bolt should correctly
+## symbolize the instruction operands.
+
+  movq $VAR, 0x80000
+# CHECK-BOLT:    movq $VAR, 0x80000
+# CHECK-OBJDUMP: movq $0x80000, 0x80000
+
+  movq $0x80000, VAR
+# CHECK-BOLT-NEXT:    movq $0x80000, VAR
+# CHECK-OBJDUMP-NEXT: movq $0x80000, 0x80000
+
+  movq $VAR, VAR
+# CHECK-BOLT-NEXT:    movq $VAR, VAR
+# CHECK-OBJDUMP-NEXT: movq $0x80000, 0x80000
+
+  retq
+  .size _start, .-_start
+  .cfi_endproc