[RISCV][LLD] Add RISCV zcmt optimise in linker relaxation

[VincentWu]

Summary

This patch implements optimizations for the zcmt extension in lld.

A new TableJumpSectio has been added.

Scans each R_RISCV_CALL/R_RISCV_CALL_PLT relocType in each section before the linker relaxation, recording the name of the symbol.

In finalizeContents the recorded symbol names are sorted in descending order by the number of jumps.

Optimise and insert a new cm.jt/cm.jalt during the relax process. in the process, we reused the`R_RISCV_JAL` relocType

co-author: @ScottEgerton

[kito-cheng]

I think this should really write a psABI spec proposal first.

lld/ELF/Arch/RISCV.cpp

617

This relaxation type remove 6 byte, so this should has higher priority than R_RISCV_CALL/R_RISCV_CALL_PLT to jal?

lld/ELF/SyntheticSections.cpp

1165

Should be SHT_PROGBITS, SHT_RISCV_ATTRIBUTES is only used for .riscv.attribute.

1188–1192

This should be enough.

1273–1287

Hmm, how do you deal with more than one local symbol with same name?

e.g.
Following example has 2 different bar:

foo1.c

static int bar (){return 1;}

int foo1(){return bar();}

foo2.c

static int bar (){return 2;}

int foo2(){return bar();}

main.c

int foo1();
int foo2();
int main(){return foo1()+foo2();}

lld/ELF/SyntheticSections.h

379

addCMJTEntryCandidate/getaddCMJTEntryIndex, and same for addEntryZero/getEntryZero

402

entriesZero -> CMJTEntryCandidates
finalizedEntriesZero -> finalizedCMJTEntries
and same for entriesRa/finalizedEntriesRa.

We only need to record symbol name for finalEntries, so std::vector<std::string> is enough?

409

CMJTEntry/CMJALTEntry rather than Zero/Ra, e.g. maxCMJTEntrySize/maxCMJALTEntrySize, startCMJTEntryIdx/startCMJALTEntryIdx.

lld/ELF/Writer.cpp

457

newlib's implementation using __tbljalvec_base$? and maybe use STB_GLOBAL like __global_pointer$?

https://github.com/linsinan1995/riscv-glibc/commit/5d2e0376316f64acfc047dc3e29fd266a456fb8f

[VincentWu]

address part of comments

lld/ELF/SyntheticSections.cpp

1237

We only need to record symbol name for finalEntries, so std::vector<std::string> is enough?

yep but we need sort it in descending order by the number of jumps.
it will be spand more linking time to copy again.

so I chose memory space instead of time.

did you mean it is acceptable if i spend more time to copy it again?

[sinan]

lld/ELF/SyntheticSections.cpp

1165

SHF_ALLOC | SHF_EXECINSTR is more appropriate IMO
(https://github.com/riscv/riscv-code-size-reduction/blob/main/Zc-specification/tablejump.adoc#table-jump-fault-handling)

[craig.topper]

lld/ELF/Options.td

321

RISCV-> RISC-V

[MaskRay]

lld/ELF/Options.td

320

FF: we require that new options must start with --, not -

lld/ELF/SyntheticSections.cpp

1164

The implementation should be moved to Arch/RISCV.cpp to avoid redundant virtual functions in TargetInfo.

lld/ELF/SyntheticSections.h

31

This is inefficient. If DenseMap<CachedStringRef, ...> works, prefer it.

[jrtc27]

We have the RISC-V attributes section, you should use that (and --(no-)relax) to determine whether or not to use Zcmt relaxation, not invent some new flag, especially since compiler drivers can't use it unless they're sure the linker supports that new flag (think Clang + binutils as the common case where it's hard to know for sure; at least with LLD the likelihood is it's not older than the Clang version, especially in the embedded space) or you require users to opt-in at link time to the relaxation.

[jrtc27]

lld/ELF/Arch/RISCV.cpp

377

This seems wrong

824

This seems like poor design, you shouldn't be using R_RISCV_JAL once it's no longer a JAL instruction there

lld/ELF/SyntheticSections.cpp

1213

When moving this to RISCV.cpp please use extractBits

lld/ELF/Writer.cpp

1637

Why isn't this done when we read in the relocations the first time?

2859

Huh? This doesn't make any sense? You're just writing the jump table section on top of every SHF_ALLOC output section? Make it act like every single other synthetic section and end up in an output section.

[VincentWu]

Refactoring the implementation of lld from psABI.
rebase & address comments

[VincentWu]

lld/ELF/Arch/RISCV.cpp

824

Use R_RISCV_32 or R_RISCV_64 instead

lld/ELF/Writer.cpp

1637

IMHO, we can calculate the gain value directly if we scan them when all relaxation have been done.

[VincentWu]

Reduce the time complexity of the algorithm by storing symbol pointers instead of symbol names

Try to compile *Vim* with zcmt opt, the code size of result is about 2.5M. get 0.1M (3.8%) code size decrease when it compare to the code size of *Vim* without zcmt (2.6M).

[VincentWu]

extend the size of InputSection

[MaskRay]

In D134600#4289590, @VincentWu wrote:

extend the size of InputSection

Why is this change? InputSection may have millions of instances for a large link. Increasing a word may increase the peak memory usage by 1%. We should strive to avoid it.

[VincentWu]

Revert commit "extend sizeof InputSection"

[jrtc27]

lld/ELF/Arch/RISCV.cpp

324

These are extremely dodgy

703

Blank line doesn't match style

707

This naming doesn't fit

919

"Entrys" is not an English word

952

We call finalizeContents more than once?

lld/ELF/SyntheticSections.cpp

42

?

[kito-cheng]

lld/ELF/Arch/RISCV.cpp

324

See https://github.com/llvm/llvm-project/blob/main/lld/ELF/Arch/RISCV.cpp#L53-L54 , I think we can use same way here.

[VincentWu]

address comments

[VincentWu]

lld/ELF/Arch/RISCV.cpp

952

This method will be called at the end of the last round of relaxation. the changed in Writer<ELFT>::finalizeAddressDependentContent() might be set as true, which will cause the linker to do an additional relaxation. the code here is just try to avoiding it being called again in an additional relaxation.

[jrtc27]

lld/ELF/Arch/RISCV.cpp

324

Uh, what is this diff now? That's not what Kito said to do, and doesn't make it less dodgy. All you've done is given it a name, but that doesn't change the fact that the whole approach is dodgy.

[VincentWu]

use INTERNAL_ relocation type for Zcmt

[liaolucy]

ping

[VincentWu]

Hi all,

I think I've tried to address all the comments in this revision so far, if I missed something, please remind me again.

This revision hasn't received new commit for a while. So this ping is ask if there is any further comment for this revision?
I'll try to make changes as soon as possible so that we can move forward with the revision.

Is this patch currently meeting some blocks? If there is anything I can do to help, please let me know.

Uh, what is this diff now? That's not what Kito said to do, and doesn't make it less dodgy. All you've done is given it a name, but that doesn't change the fact that the whole approach is dodgy.

@jrtc27 Hope I get what you mean correctly this time, does it still dodgy?

@MaskRay Dose anything I can do for this patch? or do you have any thoughts on how this patch could be improved?

[nemanjai]

This hasn't received any attention in a bit over a month. Has it been moved to GitHub or are the reviewers just busy? It would be great to make progress with Zcmt.

[VincentWu]

In D134600#4657172, @nemanjai wrote:

This hasn't received any attention in a bit over a month. Has it been moved to GitHub or are the reviewers just busy? It would be great to make progress with Zcmt.

no， this patch not been moved to github, it will be reviewed here.
I am trying to find more evidence make this patch looks more reliable

[nemanjai]

I am only starting my involvement with RISC-V and thereby have much less experience than most of the other reviewers. Especially when it comes to lld. So if any of the more experienced reviewers disagree with any of my suggestions, please favour their suggestions over mine.

I for one certainly would like to see support for Zcmt land in lld sooner rather than later, so I have provided a number of comments that I am hoping can at least help advance the discussion even if they do not need to be incorporated.

Finally, it is not clear to me where the JVT is set (i.e. csrw jvt, <reg with base address>). Is that set in some library or the crt files? I imagine that is documented somewhere, but I think it might be useful to add a link to that documentation as a comment to the entry point for this relaxation (relaxTableJump()).

lld/ELF/Arch/RISCV.cpp

902

If a function returns an index, I think it should be called getIndex() rather than getEntry().

907–916

Can this not just be something like:

// Find this symbol in the ordered list of entries if it exists.
assert(maxSize >= entriesList.size() &&
       "Finalized vector of entries exceeds maximum");
auto idx = std::find_if(
    entriesList.begin(), entriesList.end(),
    [symbol](llvm::detail::DenseMapPair<const Symbol *, int> &e) {
      return e.first == symbol;
    });
if (idx == entriesList.end())
  return entriesList.size();
return idx - entriesList.begin();

934

I think it is useful to not name the opposite of what they mean (even though I do understand that gain is wrt. the goal of code size reduction). It is probably to change all references to gain to codeSizeReduction or csReduction if that's to long.

960

I think it would be useful to document this. Perhaps something like:

// The total reduction in code size is J - JA + JTS - JAE.
// Where:
// J = number of bytes saved for all the cm.jt instructions emitted
// JA = number of bytes saved for all the cm.jalt instructions emitted
// JTS = size of the part of the table for cm.jt jumps (i.e. 32 x worsize)
// JAE = number of entries emitted for the cm.jalt jumps x wordsize

Plus it seems like a much more readable implementation would be something like:

int sizeIncrease = getSize();
for (auto entry : finalizedCMJTEntries) {
  if (sizeIncrease < 0)
    break;
  sizeIncrease -= entry.second;
}
for (auto entry : finalizedCMJALTEntries) {
  if (sizeIncrease < 0)
    break;
  sizeIncrease -= entry.second;
}

In fact, it might be useful to just implement a function getSizeReduction() similar to getSize() that would simply return the amount of code size reduction for all the table entries.

979

/// Sort the map in decreasing order of the amount of code reduction provided
/// by the entries. Drop any entries that can't fit in the map from the tail
/// end since they provide less code reduction. Drop any entries that cause
/// an increase in code size (i.e. the reduction from instruction conversion
/// does not cover the code size gain from adding a table entry).

999

// Drop any items that have a negative effect (i.e. increase code size).

1027

Is this needed if there are no entries in finalizedCMJALTEntries?

1048–1049

What is this for? How can there be a symbol in the vector that has a zero "gain"? Wouldn't that just mean that it doesn't have any calls? Seems more like this should be an assert.

lld/ELF/Options.td

320

I find the name and description somewhat unnatural for what this does. I think something like this would feel more natural:

riscv-tbljmp
"Enable conversion of call instructions to table jump instruction from the Zcmt extension for frequently called functions (RISC-V only)"

Also, is an option perhaps too coarse-grained? Is it feasible that a user would want to use table jumps within some objects but not in others? Namely, if the user compiles some objects with no Zcmt, shouldn't the linker respect that?

lld/ELF/Target.h

37

I think it would be clearer if this had entry or target in the name since it is writing a table entry (a target address).

lld/ELF/Writer.cpp

1674

I wonder if it would be possible and/or advantageous to produce the jump table and convert the instructions before we begin the process of relaxation. I am not familiar enough with the process here so this may not make sense, but this is how I see it and why I'm suggesting this...

1. This adds another source of volatility with relaxation, possibly making it more difficult to reach a fixed point
2. If we compile with -ffunction-sections, the linker has the ability to lay out the sections that contain functions for which we will use the jump table as far away from the rest of text as possible. This will keep the remaining functions closer and make them more likely to be possible to relax. Of course, the functions for which we're emitting jump table entries will themselves have calls, so an optimal layout is not feasible to compute, but it is likely useful to sort such functions late.

lld/test/ELF/riscv-tbljal-call.s

2

I think it would be useful to add checks for the layout of the jump table including the padding.

[VincentWu]

address comments

[VincentWu]

In D134600#4657177, @nemanjai wrote:

Finally, it is not clear to me where the JVT is set (i.e. csrw jvt, <reg with base address>). Is that set in some library or the crt files? I imagine that is documented somewhere, but I think it might be useful to add a link to that documentation as a comment to the entry point for this relaxation (relaxTableJump()).

as psabi has mentioned https://github.com/riscv-non-isa/riscv-elf-psabi-doc/blob/master/riscv-elf.adoc

This relaxation requires programs to initialize the jvt CSR with the address of the __jvt_base$ symbol before executing table jump instructions. It is recommended to initialize jvt CSR immediately after global pointer initialization.

lld/ELF/Options.td

320

Also, is an option perhaps too coarse-grained? Is it feasible that a user would want to use table jumps within some objects but not in others? Namely, if the user compiles some objects with no Zcmt, shouldn't the linker respect that?

Yes, it is coarse-grained a bit. But this extension is intended for embedded systems, (It is incompatible with applications-class processors.). Thus I think it might be ok if we just do it like that.

lld/ELF/Writer.cpp

1674

IMHO, I don't think it's possible to produce jump table before the linker relaxation. Because we need to calculate the reduction gained when jumping using TableJump instruction. But it will be changed by Compressed Tail Call Relaxation and Compressed Function Call Relaxation during linker relaxation.

As mentioned in psABI:"Compressed Tail Call Relaxation and Compressed Function Call Relaxation are always prefered during relaxation, since table jump relaxation has no extra size saving over these two relaxations and might bring a performance overhead."

If we produce the jump table before the linker relaxation, the code size reduction may be reduced to a small amount and even lead to a negative optimization.

[VincentWu]

add riscvTableJumpSection only when SizeReduction > 0

[VincentWu]

Hi all,
I tried linking several common applications and libraries using this patch to compare Zcmt's contribution to reducing Code Szie.

The results can be found in the Sheet or in the image below.

Besides that, I found a problem that needs to be discussed.

In TableJumpSection::finalizeContents(), the linker will abort the tbljal optimization and empty the Jump table if tbljal would cause a negative optimization (i.e., the size reduction caused by the Table jump Inst is less than the size increase caused by making the Jump Table).

However, the linker still adds the symbol __jvt_base$ to .symtab . This results in a small increase in program size.

[VincentWu]

lld/ELF/Writer.cpp

1697–1698

the linker still adds the symbol __jvt_base$ to .symtab . This results in a small increase in program size.

Thus, I tried to delay adding the symbol __jvt_base$ here and remove the symbol __jvt_base$ when the Jump Table is not empty. Something like that

But it will crash with error placeholder symbol reached writer at lld/ELF/Symbols.cpp:154. Does anyone can point out anything else should I do to add symbol delay?

lld/ELF/Arch/RISCV.cpp

public:
   uint32_t calcEFlags() const override;
   int64_t getImplicitAddend(const uint8_t *buf, RelType type) const override;
   void writeGotHeader(uint8_t *buf) const override;
   void writeGotPlt(uint8_t *buf, const Symbol &s) const override;
   void writeIgotPlt(uint8_t *buf, const Symbol &s) const override;
   void writePltHeader(uint8_t *buf) const override;
   void writePlt(uint8_t *buf, const Symbol &sym,
                 uint64_t pltEntryAddr) const override;
+  void writeTableJumpHeader(uint8_t *buf) const override;
+  void writeTableJump(uint8_t *buf, const uint64_t symbol) const override;
   RelType getDynRel(RelType type) const override;
   RelExpr getRelExpr(RelType type, const Symbol &s,
                      const uint8_t *loc) const override;
   void relocate(uint8_t *loc, const Relocation &rel,
                 uint64_t val) const override;
   bool relaxOnce(int pass) const override;
 };
 
void RISCV::writePlt(uint8_t *buf, const Symbol &sym,
   // nop
   uint32_t offset = sym.getGotPltVA() - pltEntryAddr;
   write32le(buf + 0, utype(AUIPC, X_T3, hi20(offset)));
   write32le(buf + 4, itype(config->is64 ? LD : LW, X_T3, X_T3, lo12(offset)));
   write32le(buf + 8, itype(JALR, X_T1, X_T3, 0));
   write32le(buf + 12, itype(ADDI, 0, 0, 0));
 }
 
+void RISCV::writeTableJumpHeader(uint8_t *buf) const {
+  if (config->is64)
+    write64le(buf, mainPart->dynamic->getVA());
+  else
+    write32le(buf, mainPart->dynamic->getVA());
+}
+
+void RISCV::writeTableJump(uint8_t *buf, const uint64_t address) const {
+  if (config->is64)
+    write64le(buf, address);
+  else
+    write32le(buf, address);
+}
+
 RelType RISCV::getDynRel(RelType type) const {
   return type == target->symbolicRel ? type
                                      : static_cast<RelType>(R_RISCV_NONE);
 }
 
 RelExpr RISCV::getRelExpr(const RelType type, const Symbol &s,
                           const uint8_t *loc) const {
   switch (type) {
RelExpr RISCV::getRelExpr(const RelType type, const Symbol &s,
   }
 }
 
 void RISCV::relocate(uint8_t *loc, const Relocation &rel, uint64_t val) const {
   const unsigned bits = config->wordsize * 8;
 
   switch (rel.type) {
   case R_RISCV_32:
     write32le(loc, val);
     return;
   case R_RISCV_64:
     write64le(loc, val);
     return;
 
   case R_RISCV_RVC_BRANCH: {
     checkInt(loc, val, 9, rel);
     checkAlignment(loc, val, 2, rel);
if (imm == 0) { // `c.lui rd, 0` is illegal, convert to `c.li rd, 0`
       uint16_t imm17 = extractBits(val + 0x800, 17, 17) << 12;
       uint16_t imm16_12 = extractBits(val + 0x800, 16, 12) << 2;
       write16le(loc, (read16le(loc) & 0xEF83) | imm17 | imm16_12);
     }
     return;
   }
 
   case R_RISCV_JAL: {
+    if (config->riscvTbljal && (read16le(loc) & 0xfc03) == 0xa002)
+      return;
+
     checkInt(loc, val, 21, rel);
     checkAlignment(loc, val, 2, rel);
 
     uint32_t insn = read32le(loc) & 0xFFF;
     uint32_t imm20 = extractBits(val, 20, 20) << 31;
     uint32_t imm10_1 = extractBits(val, 10, 1) << 21;
     uint32_t imm11 = extractBits(val, 11, 11) << 20;
     uint32_t imm19_12 = extractBits(val, 19, 12) << 12;
if (rvc && isInt<12>(displace) && rd == 0) {
     sec.relaxAux->relocTypes[i] = R_RISCV_RVC_JUMP;
     sec.relaxAux->writes.push_back(0xa001); // c.j
     remove = 6;
   } else if (rvc && isInt<12>(displace) && rd == X_RA &&
              !config->is64) { // RV32C only
     sec.relaxAux->relocTypes[i] = R_RISCV_RVC_JUMP;
     sec.relaxAux->writes.push_back(0x2001); // c.jal
     remove = 6;
-  } else if (isInt<21>(displace)) {
+  } else {
+    if (isInt<21>(displace)) {
       sec.relaxAux->relocTypes[i] = R_RISCV_JAL;
       sec.relaxAux->writes.push_back(0x6f | rd << 7); // jal
       remove = 4;
     }
+
+    int tblEntryIndex = -1;
+    if (config->riscvTbljal) {
+      if (rd == 0)
+        tblEntryIndex = in.riscvTableJumpSection->getEntryZero(*r.sym);
+      else if (rd == X_RA)
+        tblEntryIndex = in.riscvTableJumpSection->getEntryRa(*r.sym);
+
+      if (tblEntryIndex >= 0) {
+        sec.relaxAux->relocTypes[i] = R_RISCV_JAL;
+
+        // remove > 0 means the inst has been write to jal
+        // rewrite the last item.
+        if (remove)
+          sec.relaxAux->writes.back() =
+              (0xa002 | (tblEntryIndex << 2)); // cm.jt or cm.jalt
+        else
+          sec.relaxAux->writes.push_back(
+              0xa002 | (tblEntryIndex << 2)); // cm.jt or cm.jalt
+        remove = 6;
+      }
+    }
+  }
 }
 
 // Relax local-exec TLS when hi20 is zero.
 static void relaxTlsLe(const InputSection &sec, size_t i, uint64_t loc,
                        Relocation &r, uint32_t &remove) {
   uint64_t val = r.sym->getVA(r.addend);
   if (hi20(val) != 0)
     return;
for (auto [i, r] : llvm::enumerate(sec.relocations)) {
     case R_RISCV_TPREL_HI20:
     case R_RISCV_TPREL_ADD:
     case R_RISCV_TPREL_LO12_I:
     case R_RISCV_TPREL_LO12_S:
       if (i + 1 != sec.relocations.size() &&
           sec.relocations[i + 1].type == R_RISCV_RELAX)
         relaxTlsLe(sec, i, loc, r, remove);
       break;
     }
 
     // For all anchors whose offsets are <= r.offset, they are preceded by
     // the previous relocation whose `relocDeltas` value equals `delta`.
     // Decrease their st_value and update their st_size.
     for (; sa.size() && sa[0].offset <= r.offset; sa = sa.slice(1)) {
       if (sa[0].end)
         sa[0].d->size = sa[0].offset - delta - sa[0].d->value;
       else
         sa[0].d->value -= delta - valueDelta.find(sa[0].d)->second;
     }
     delta += remove;
     if (delta != cur) {
for (InputSection *sec : getInputSections(*osec, storage)) {
           case R_RISCV_RELAX:
             // Used by relaxTlsLe to indicate the relocation is ignored.
             break;
           case R_RISCV_RVC_JUMP:
             skip = 2;
             write16le(p, aux.writes[writesIdx++]);
             break;
           case R_RISCV_JAL:
+            if (config->riscvTbljal &&
+                (aux.writes[writesIdx] & 0xfc03) == 0xa002) {
+              skip = 2;
+              write16le(p, aux.writes[writesIdx++]);
+            } else {
               skip = 4;
               write32le(p, aux.writes[writesIdx++]);
+            }
             break;
           case R_RISCV_32:
             // Used by relaxTlsLe to write a uint32_t then suppress the handling
             // in relocateAlloc.
             skip = 4;
             write32le(p, aux.writes[writesIdx++]);
             aux.relocTypes[i] = R_RISCV_NONE;
             break;
for (InputSection *sec : getInputSections(*osec, storage)) {
       }
     }
   }
 }
 
 TargetInfo *elf::getRISCVTargetInfo() {
   static RISCV target;
   return &target;
 }

lld/ELF/Config.h

struct Configuration {
   bool picThunk;
   bool pie;
   bool printGcSections;
   bool printIcfSections;
   bool relax;
   bool relocatable;
   bool relrGlibc = false;
   bool relrPackDynRelocs = false;
+  bool riscvTbljal;
   llvm::DenseSet<llvm::StringRef> saveTempsArgs;
   llvm::SmallVector<std::pair<llvm::GlobPattern, uint32_t>, 0> shuffleSections;
   bool singleRoRx;
   bool shared;
   bool symbolic;
   bool isStatic = false;
   bool sysvHash = false;
   bool target1Rel;

lld/ELF/Driver.cpp

static void readConfigs(opt::InputArgList &args) {
   config->warnBackrefs =
       args.hasFlag(OPT_warn_backrefs, OPT_no_warn_backrefs, false);
   config->warnCommon = args.hasFlag(OPT_warn_common, OPT_no_warn_common, false);
   config->warnSymbolOrdering =
       args.hasFlag(OPT_warn_symbol_ordering, OPT_no_warn_symbol_ordering, true);
   config->whyExtract = args.getLastArgValue(OPT_why_extract);
   config->zCombreloc = getZFlag(args, "combreloc", "nocombreloc", true);
   config->zCopyreloc = getZFlag(args, "copyreloc", "nocopyreloc", true);
+  config->riscvTbljal = args.hasArg(OPT_riscv_tbljal);
   config->zForceBti = hasZOption(args, "force-bti");
   config->zForceIbt = hasZOption(args, "force-ibt");
   config->zGlobal = hasZOption(args, "global");
   config->zGnustack = getZGnuStack(args);
   config->zHazardplt = hasZOption(args, "hazardplt");
   config->zIfuncNoplt = hasZOption(args, "ifunc-noplt");
   config->zInitfirst = hasZOption(args, "initfirst");
   config->zInterpose = hasZOption(args, "interpose");

lld/ELF/InputSection.h

 
 private:
   template <class ELFT, class RelTy>
   void copyRelocations(uint8_t *buf, llvm::ArrayRef<RelTy> rels);
 
   template <class ELFT> void copyShtGroup(uint8_t *buf);
 };
 
-static_assert(sizeof(InputSection) <= 160, "InputSection is too big");
+static_assert(sizeof(InputSection) <= 168, "InputSection is too big");
 
 class SyntheticSection : public InputSection {
 public:
   SyntheticSection(uint64_t flags, uint32_t type, uint32_t alignment,
                    StringRef name)
       : InputSection(nullptr, flags, type, alignment, {}, name,
                      InputSectionBase::Synthetic) {}
 

lld/ELF/Options.td

 defm pack_dyn_relocs:
   EEq<"pack-dyn-relocs", "Pack dynamic relocations in the given format">,
   MetaVarName<"[none,android,relr,android+relr]">;
 
 defm use_android_relr_tags: BB<"use-android-relr-tags",
     "Use SHT_ANDROID_RELR / DT_ANDROID_RELR* tags instead of SHT_RELR / DT_RELR*",
     "Use SHT_RELR / DT_RELR* tags (default)">;
 
+def riscv_tbljal: F<"riscv-tbljal">,
+  HelpText<"(RISCV only) Enable table jump instructions from the Zce extension">;
+
 def pic_veneer: F<"pic-veneer">,
   HelpText<"Always generate position independent thunks (veneers)">;
 
 defm pie: B<"pie",
     "Create a position independent executable",
     "Do not create a position independent executable (default)">;
 
 defm print_gc_sections: B<"print-gc-sections",

lld/ELF/SyntheticSections.h

 #include "Config.h"
 #include "InputSection.h"
 #include "llvm/ADT/DenseSet.h"
 #include "llvm/ADT/MapVector.h"
 #include "llvm/MC/StringTableBuilder.h"
 #include "llvm/Support/Endian.h"
 #include "llvm/Support/Parallel.h"
 #include "llvm/Support/Threading.h"
+#include <map>
 
 namespace lld::elf {
 class Defined;
 struct PhdrEntry;
 class SymbolTableBaseSection;
 
 struct CieRecord {
   EhSectionPiece *cie = nullptr;
public:
   // Flag to force GotPlt to be in output if we have relocations
   // that relies on its address.
   std::atomic<bool> hasGotPltOffRel = false;
 
 private:
   SmallVector<const Symbol *, 0> entries;
 };
 
+class TableJumpSection final : public SyntheticSection {
+public:
+  TableJumpSection();
+  size_t getSize() const override;
+  void writeTo(uint8_t *buf) override;
+  bool isNeeded() const override;
+  void finalizeContents() override;
+
+  void addEntryZero(const Symbol &symbol);
+  int getEntryZero(const Symbol &symbol);
+  void addEntryRa(const Symbol &symbol);
+  int getEntryRa(const Symbol &symbol);
+  void scanTableJumpEntrys(const InputSection &sec) const;
+
+  // Flag to force TableJump to be in output if we have relocations
+  // that relies on its address.
+  bool hasTableJumpOffRel = false;
+
+protected:
+  uint64_t size = 0;
+
+private:
+  void addEntry(const Symbol &symbol, std::map<std::string, int> &entriesList);
+  uint32_t getEntry(const Symbol &symbol,
+                    std::vector<std::pair<std::string, int>> &entriesList);
+  void writeEntries(uint8_t *buf,
+                    std::vector<std::pair<std::string, int>> &entriesList);
+  void padUntil(uint8_t *buf, const uint8_t index);
+
+  const size_t xlen = config->is64 ? 64 : 32;
+
+  std::map<std::string, int> entriesZero;
+  std::vector<std::pair<std::string, int>> finalizedEntriesZero;
+  std::map<std::string, int> entriesRa;
+  std::vector<std::pair<std::string, int>> finalizedEntriesRa;
+
+  // used in finalizeContents function.
+  const size_t maxSizeZero = 64;
+  const size_t maxSizeRa = 192;
+
+  const size_t startZero = 0;
+  const size_t startRa = 64;
+};
+
 // The IgotPltSection is a Got associated with the PltSection for GNU Ifunc
 // Symbols that will be relocated by Target->IRelativeRel.
 // On most Targets the IgotPltSection will immediately follow the GotPltSection
 // on ARM the IgotPltSection will immediately follow the GotSection.
 class IgotPltSection final : public SyntheticSection {
 public:
   IgotPltSection();
   void addEntry(Symbol &sym);

 struct InStruct {
   std::unique_ptr<InputSection> attributes;
   std::unique_ptr<BssSection> bss;
   std::unique_ptr<BssSection> bssRelRo;
   std::unique_ptr<GotSection> got;
   std::unique_ptr<GotPltSection> gotPlt;
   std::unique_ptr<IgotPltSection> igotPlt;
   std::unique_ptr<PPC64LongBranchTargetSection> ppc64LongBranchTarget;
+  std::unique_ptr<TableJumpSection> riscvTableJumpSection;
   std::unique_ptr<SyntheticSection> mipsAbiFlags;
   std::unique_ptr<MipsGotSection> mipsGot;
   std::unique_ptr<SyntheticSection> mipsOptions;
   std::unique_ptr<SyntheticSection> mipsReginfo;
   std::unique_ptr<MipsRldMapSection> mipsRldMap;
   std::unique_ptr<SyntheticSection> partEnd;
   std::unique_ptr<SyntheticSection> partIndex;
   std::unique_ptr<PltSection> plt;

lld/ELF/SyntheticSections.cpp

 #include "llvm/ADT/StringExtras.h"
 #include "llvm/BinaryFormat/Dwarf.h"
 #include "llvm/BinaryFormat/ELF.h"
 #include "llvm/DebugInfo/DWARF/DWARFDebugPubTable.h"
 #include "llvm/Support/Endian.h"
 #include "llvm/Support/LEB128.h"
 #include "llvm/Support/Parallel.h"
 #include "llvm/Support/TimeProfiler.h"
 #include <cstdlib>
 
 using namespace llvm;
 using namespace llvm::dwarf;
 using namespace llvm::ELF;
 using namespace llvm::object;
 using namespace llvm::support;
 using namespace lld;
 using namespace lld::elf;

 }
 
 bool GotPltSection::isNeeded() const {
   // We need to emit GOTPLT even if it's empty if there's a relocation relative
   // to it.
   return !entries.empty() || hasGotPltOffRel;
 }
 
+TableJumpSection::TableJumpSection()
+    : SyntheticSection(SHF_ALLOC | SHF_WRITE, SHT_RISCV_ATTRIBUTES,
+                       config->wordsize, ".tbljalentries") {}
+
+void TableJumpSection::addEntryZero(const Symbol &symbol) {
+  addEntry(symbol, entriesZero);
+}
+
+int TableJumpSection::getEntryZero(const Symbol &symbol) {
+  uint32_t index = getEntry(symbol, finalizedEntriesZero);
+  return index < maxSizeZero ? (int)(startZero + index) : -1;
+}
+
+void TableJumpSection::addEntryRa(const Symbol &symbol) {
+  addEntry(symbol, entriesRa);
+}
+
+int TableJumpSection::getEntryRa(const Symbol &symbol) {
+  uint32_t index = getEntry(symbol, finalizedEntriesRa);
+  return index < maxSizeRa ? (int)(startRa + index) : -1;
+}
+
+void TableJumpSection::addEntry(const Symbol &symbol,
+                                std::map<std::string, int> &entriesList) {
+  if (entriesList.count(symbol.getName().str()) == 0) {
+    entriesList[symbol.getName().str()] = 1;
+  } else {
+    entriesList[symbol.getName().str()] += 1;
+  }
+}
+
+uint32_t TableJumpSection::getEntry(
+    const Symbol &symbol,
+    std::vector<std::pair<std::string, int>> &entriesList) {
+  // Prevent adding duplicate entries
+  uint32_t i = 0;
+  for (; i < entriesList.size(); ++i) {
+    // If this is a duplicate addition, do not add it and return the address
+    // offset of the original entry.
+    if (symbol.getName().compare(entriesList[i].first) == 0) {
+      return i;
+    }
+  }
+  return i;
+}
+
+void TableJumpSection::scanTableJumpEntrys(const InputSection &sec) const {
+  for (auto [i, r] : llvm::enumerate(sec.relocations)) {
+    switch (r.type) {
+    // auipc + jalr pair
+    case R_RISCV_CALL:
+    case R_RISCV_CALL_PLT: {
+      const auto jalr = sec.data()[r.offset + 4];
+      const uint8_t rd = (jalr & ((1ULL << (11 + 1)) - 1)) >> 7;
+      if (rd == 0)
+        in.riscvTableJumpSection->addEntryZero(*r.sym);
+      else if (rd == 1)
+        in.riscvTableJumpSection->addEntryRa(*r.sym);
+      else
+        return; // Unknown link register, do not modify.
+    }
+    }
+  }
+}
+
+void TableJumpSection::finalizeContents() {
+  auto cmp = [](const std::pair<std::string, int> &p1,
+                const std::pair<std::string, int> &p2) {
+    return p1.second > p2.second;
+  };
+
+  std::copy(entriesZero.begin(), entriesZero.end(),
+            std::back_inserter(finalizedEntriesZero));
+  std::sort(finalizedEntriesZero.begin(), finalizedEntriesZero.end(), cmp);
+  if (finalizedEntriesZero.size() > maxSizeZero)
+    finalizedEntriesZero.resize(maxSizeZero);
+
+  std::copy(entriesRa.begin(), entriesRa.end(),
+            std::back_inserter(finalizedEntriesRa));
+  std::sort(finalizedEntriesRa.begin(), finalizedEntriesRa.end(), cmp);
+  if (finalizedEntriesRa.size() > maxSizeRa)
+    finalizedEntriesRa.resize(maxSizeRa);
+}
+
+size_t TableJumpSection::getSize() const {
+  if (!entriesRa.empty()) {
+    return (startRa + entriesRa.size()) * xlen;
+  }
+  return (startZero + entriesZero.size()) * xlen;
+}
+
+void TableJumpSection::writeTo(uint8_t *buf) {
+  target->writeTableJumpHeader(buf);
+  writeEntries(buf + startZero, finalizedEntriesZero);
+  padUntil(buf + ((startZero + finalizedEntriesZero.size()) * xlen),
+           startRa * xlen);
+  writeEntries(buf + startRa, finalizedEntriesRa);
+}
+
+void TableJumpSection::padUntil(uint8_t *buf, const uint8_t address) {
+  for (size_t i = 0; i < address; ++i) {
+    if (config->is64)
+      write64le(buf, 0);
+    else
+      write32le(buf, 0);
+  }
+}
+
+void TableJumpSection::writeEntries(
+    uint8_t *buf, std::vector<std::pair<std::string, int>> &entriesList) {
+  for (const auto &symbolName : entriesList) {
+    // Use the symbol from in.symTab to ensure we have the final adjusted
+    // symbol.
+    for (const auto &symbol : in.symTab->getSymbols()) {
+      if (symbol.sym->getName() != symbolName.first)
+        continue;
+      // Only process defined symbols.
+      auto *definedSymbol = dyn_cast<Defined>(symbol.sym);
+      if (!definedSymbol)
+        continue;
+      target->writeTableJump(buf, definedSymbol->getVA());
+      buf += config->wordsize;
+    }
+  }
+}
+
+bool TableJumpSection::isNeeded() const { return config->riscvTbljal; }
+
 static StringRef getIgotPltName() {
   // On ARM the IgotPltSection is part of the GotSection.
   if (config->emachine == EM_ARM)
     return ".got";
 
   // On PowerPC64 the GotPltSection is renamed to '.plt' so the IgotPltSection
   // needs to be named the same.
   if (config->emachine == EM_PPC64)

lld/ELF/Target.h

 public:
   virtual uint32_t calcEFlags() const { return 0; }
   virtual RelExpr getRelExpr(RelType type, const Symbol &s,
                              const uint8_t *loc) const = 0;
   virtual RelType getDynRel(RelType type) const { return 0; }
   virtual void writeGotPltHeader(uint8_t *buf) const {}
   virtual void writeGotHeader(uint8_t *buf) const {}
   virtual void writeGotPlt(uint8_t *buf, const Symbol &s) const {};
+  virtual void writeTableJumpHeader(uint8_t *buf) const {};
+  virtual void writeTableJump(uint8_t *buf, const uint64_t symbol) const {};
   virtual void writeIgotPlt(uint8_t *buf, const Symbol &s) const {}
   virtual int64_t getImplicitAddend(const uint8_t *buf, RelType type) const;
   virtual int getTlsGdRelaxSkip(RelType type) const { return 1; }
 
   // If lazy binding is supported, the first entry of the PLT has code
   // to call the dynamic linker to resolve PLT entries the first time
   // they are called. This function writes that code.
   virtual void writePltHeader(uint8_t *buf) const {}

lld/ELF/Writer.cpp

if (config->emachine == EM_PPC) {
     add(*in.ppc32Got2);
   }
 
   if (config->emachine == EM_PPC64) {
     in.ppc64LongBranchTarget = std::make_unique<PPC64LongBranchTargetSection>();
     add(*in.ppc64LongBranchTarget);
   }
 
+  if (config->emachine == EM_RISCV && config->riscvTbljal) {
+    in.riscvTableJumpSection = std::make_unique<TableJumpSection>();
+    add(*in.riscvTableJumpSection);
+
+    symtab->addSymbol(Defined{
+        /*file=*/nullptr, ".tbljalentries", STB_WEAK, STT_NOTYPE, STT_NOTYPE,
+        /*value=*/0, /*size=*/0, in.riscvTableJumpSection.get()});
+  }
+
   in.gotPlt = std::make_unique<GotPltSection>();
   add(*in.gotPlt);
   in.igotPlt = std::make_unique<IgotPltSection>();
   add(*in.igotPlt);
 
   // _GLOBAL_OFFSET_TABLE_ is defined relative to either .got.plt or .got. Treat
   // it as a relocation and ensure the referenced section is created.
   if (ElfSym::globalOffsetTable && config->emachine != EM_MIPS) {
template <class ELFT> void Writer<ELFT>::finalizeAddressDependentContent() {
   for (Partition &part : partitions)
     finalizeSynthetic(part.armExidx.get());
   resolveShfLinkOrder();
 
   // Converts call x@GDPLT to call __tls_get_addr
   if (config->emachine == EM_HEXAGON)
     hexagonTLSSymbolUpdate(outputSections);
 
+  // scan all R_RISCV_CALL/R_RISCV_CALL_PLT for RISCV Zcmt Jump table.
+  if (in.riscvTableJumpSection) {
+    for (InputSectionBase *inputSection : inputSections) {
+      in.riscvTableJumpSection->scanTableJumpEntrys(
+          cast<InputSection>(*inputSection));
+    }
+    in.riscvTableJumpSection->finalizeContents();
+  }
+
   uint32_t pass = 0, assignPasses = 0;
   for (;;) {
     bool changed = target->needsThunks ? tc.createThunks(pass, outputSections)
                                        : target->relaxOnce(pass);
     ++pass;
 
     // With Thunk Size much smaller than branch range we expect to
     // converge quickly; if we get to 15 something has gone wrong.
if (config->fixCortexA8) {
       if (changed)
         script->assignAddresses();
       changed |= a32p.createFixes();
     }
 
     if (in.mipsGot)
       in.mipsGot->updateAllocSize();
 
     for (Partition &part : partitions) {
       changed |= part.relaDyn->updateAllocSize();
       if (part.relrDyn)
         changed |= part.relrDyn->updateAllocSize();
     }
 
     const Defined *changedSym = script->assignAddresses();
     if (!changed) {
       // Some symbols may be dependent on section addresses. When we break the
       // loop, the symbol values are finalized because a previous
       // assignAddresses() finalized section addresses.
       if (!changedSym)
         break;
       if (++assignPasses == 5) {
         errorOrWarn("assignment to symbol " + toString(*changedSym) +
                     " does not converge");
         break;
       }
     }
   }
   if (!config->relocatable && config->emachine == EM_RISCV)
     riscvFinalizeRelax(pass);
 
   if (config->relocatable)
     for (OutputSection *sec : outputSections)
       sec->addr = 0;
 
   // If addrExpr is set, the address may not be a multiple of the alignment.
   // Warn because this is error-prone.
   for (SectionCommand *cmd : script->sectionCommands)
     if (auto *osd = dyn_cast<OutputDesc>(cmd)) {
       OutputSection *osec = &osd->osec;
       if (osec->addr % osec->alignment != 0)
setReservedSymbolSections();
     finalizeSynthetic(in.bssRelRo.get());
     finalizeSynthetic(in.symTabShndx.get());
     finalizeSynthetic(in.shStrTab.get());
     finalizeSynthetic(in.strTab.get());
     finalizeSynthetic(in.got.get());
     finalizeSynthetic(in.mipsGot.get());
     finalizeSynthetic(in.igotPlt.get());
     finalizeSynthetic(in.gotPlt.get());
+    finalizeSynthetic(in.riscvTableJumpSection.get());
     finalizeSynthetic(in.relaIplt.get());
     finalizeSynthetic(in.relaPlt.get());
     finalizeSynthetic(in.plt.get());
     finalizeSynthetic(in.iplt.get());
     finalizeSynthetic(in.ppc32Got2.get());
     finalizeSynthetic(in.partIndex.get());
 
     // Dynamic section must be the last one in this list and dynamic
template <class ELFT> void Writer<ELFT>::openFile() {
   }
   buffer = std::move(*bufferOrErr);
   Out::bufferStart = buffer->getBufferStart();
 }
 
 template <class ELFT> void Writer<ELFT>::writeSectionsBinary() {
   parallel::TaskGroup tg;
   for (OutputSection *sec : outputSections)
-    if (sec->flags & SHF_ALLOC)
+    if (sec->flags & SHF_ALLOC) {
       sec->writeTo<ELFT>(Out::bufferStart + sec->offset, tg);
+      if (config->emachine == EM_RISCV && config->riscvTbljal)
+        in.riscvTableJumpSection->writeTo(Out::bufferStart + sec->offset);
+    }
 }
 
 static void fillTrap(uint8_t *i, uint8_t *end) {
   for (; i + 4 <= end; i += 4)
     memcpy(i, &target->trapInstr, 4);
 }
 
 // Fill the last page of executable segments with trap instructions

lld/test/ELF/riscv-tbljal-call.s

+# REQUIRES: riscv
+
+# RUN: llvm-mc -filetype=obj -triple=riscv32 -mattr=+relax -mattr=+experimental-zcmt %s -o %t.rv32.o
+# RUN: llvm-mc -filetype=obj -triple=riscv64 -mattr=+relax -mattr=+experimental-zcmt %s -o %t.rv64.o
+
+# tbljal conversion
+# RUN: ld.lld %t.rv32.o -riscv-tbljal --defsym foo=_start+30 -o %t.rv32
+# RUN: ld.lld %t.rv64.o -riscv-tbljal --defsym foo=_start+30 -o %t.rv64
+# RUN: llvm-objdump -d -M no-aliases --mattr=+experimental-zcmt --no-show-raw-insn %t.rv32 | FileCheck --check-prefix=TBLJAL %s
+# RUN: llvm-objdump -d -M no-aliases --mattr=+experimental-zcmt --no-show-raw-insn %t.rv64 | FileCheck --check-prefix=TBLJAL %s
+# TBLJAL:      cm.jalt 66
+# TBLJAL-NEXT: cm.jt   2
+# TBLJAL-NEXT: cm.jalt 67
+# TBLJAL-NEXT: cm.jalt 65
+# TBLJAL-NEXT: cm.jalt 65
+# TBLJAL-NEXT: cm.jalt 64
+# TBLJAL-NEXT: cm.jalt 64
+# TBLJAL-NEXT: cm.jalt 64
+# TBLJAL-NEXT: cm.jt   3
+# TBLJAL-NEXT: cm.jt   1
+# TBLJAL-NEXT: cm.jt   1
+# TBLJAL-NEXT: cm.jt   0
+# TBLJAL-NEXT: cm.jt   0
+# TBLJAL-NEXT: cm.jt   0
+
+# Check the bounds of what would be out of range (for the first call) for other jump types.
+# RUN: ld.lld %t.rv32.o -riscv-tbljal --defsym foo=_start+0x100000 -o %t-boundary.rv32
+# RUN: ld.lld %t.rv64.o -riscv-tbljal --defsym foo=_start+0x100000 -o %t-boundary.rv64
+# RUN: ld.lld %t.rv32.o --defsym foo=_start+0x100000 -o %t-oldboundary.rv32
+# RUN: ld.lld %t.rv64.o --defsym foo=_start+0x100000 -o %t-oldboundary.rv64
+# RUN: llvm-objdump -d -M no-aliases --mattr=+experimental-zcmt --no-show-raw-insn %t-boundary.rv32 | FileCheck --check-prefix=BOUNDARY %s
+# RUN: llvm-objdump -d -M no-aliases --mattr=+experimental-zcmt --no-show-raw-insn %t-boundary.rv64 | FileCheck --check-prefix=BOUNDARY %s
+# RUN: llvm-objdump -d -M no-aliases --mattr=+experimental-zcmt --no-show-raw-insn %t-oldboundary.rv32 | FileCheck --check-prefix=OLDBOUNDARY %s
+# RUN: llvm-objdump -d -M no-aliases --mattr=+experimental-zcmt --no-show-raw-insn %t-oldboundary.rv64 | FileCheck --check-prefix=OLDBOUNDARY %s
+# OLDBOUNDARY:      auipc  ra, 256
+# OLDBOUNDARY-NEXT: jalr   ra, 0(ra)
+# OLDBOUNDARY-NEXT: jal    zero, {{.*}} <foo>
+# OLDBOUNDARY-NEXT: jal    ra, {{.*}} <foo_1>
+# OLDBOUNDARY-NEXT: jal    ra, {{.*}} <foo_2>
+# OLDBOUNDARY-NEXT: jal    ra, {{.*}} <foo_2>
+# OLDBOUNDARY-NEXT: jal    ra, {{.*}} <foo_3>
+# OLDBOUNDARY-NEXT: jal    ra, {{.*}} <foo_3>
+# OLDBOUNDARY-NEXT: jal    ra, {{.*}} <foo_3>
+# OLDBOUNDARY-NEXT: jal    zero, {{.*}} <foo_1>
+# OLDBOUNDARY-NEXT: jal    zero, {{.*}} <foo_2>
+# OLDBOUNDARY-NEXT: jal    zero, {{.*}} <foo_2>
+# OLDBOUNDARY-NEXT: jal    zero, {{.*}} <foo_3>
+# OLDBOUNDARY-NEXT: jal    zero, {{.*}} <foo_3>
+# OLDBOUNDARY-NEXT: jal    zero, {{.*}} <foo_3>
+# BOUNDARY:      cm.jalt 66
+# BOUNDARY-NEXT: cm.jt   2
+# BOUNDARY-NEXT: cm.jalt 67
+# BOUNDARY-NEXT: cm.jalt 65
+# BOUNDARY-NEXT: cm.jalt 65
+# BOUNDARY-NEXT: cm.jalt 64
+# BOUNDARY-NEXT: cm.jalt 64
+# BOUNDARY-NEXT: cm.jalt 64
+# BOUNDARY-NEXT: cm.jt   3
+# BOUNDARY-NEXT: cm.jt   1
+# BOUNDARY-NEXT: cm.jt   1
+# BOUNDARY-NEXT: cm.jt   0
+# BOUNDARY-NEXT: cm.jt   0
+# BOUNDARY-NEXT: cm.jt   0
+
+# Check relaxation works across output sections
+#  echo 'SECTIONS { .text 0x100000 : { *(.text) } .foo : ALIGN(8) { foo = .; } }' > %t-cross-section.lds
+#  ld.lld %t.rv32c.o %t-cross-section.lds -o %t-cross-section.rv32
+#  ld.lld %t.rv64c.o %t-cross-section.lds -o %t-cross-section.rv64
+
+.global _start
+.p2align 3
+_start:
+  call foo
+  tail foo
+
+  call foo_1
+  call foo_2
+  call foo_2
+  call foo_3
+  call foo_3
+  call foo_3
+  tail foo_1
+  tail foo_2
+  tail foo_2
+  tail foo_3
+  tail foo_3
+  tail foo_3
+
+foo_1:
+  nop
+
+foo_2:
+  nop
+
+foo_3:
+  nop
+

lld/test/ELF/riscv-tbljal-syms.s

+# REQUIRES: riscv
+
+// Check that relaxation correctly adjusts symbol addresses and sizes.
+
+# RUN: llvm-mc -filetype=obj -triple=riscv32 -mattr=+relax -mattr=+experimental-zcmt %s -o %t.rv32.o
+# RUN: llvm-mc -filetype=obj -triple=riscv64 -mattr=+relax -mattr=+experimental-zcmt %s -o %t.rv64.o
+# RUN: ld.lld -Ttext=0x100000 -riscv-tbljal %t.rv32.o -o %t.rv32
+# RUN: ld.lld -Ttext=0x100000 -riscv-tbljal %t.rv64.o -o %t.rv64
+
+# RUN: llvm-readelf -s %t.rv32 | FileCheck %s
+# RUN: llvm-readelf -s %t.rv64 | FileCheck %s
+
+# CHECK: 100000     4 NOTYPE  LOCAL  DEFAULT     1 a
+# CHECK: 100000     6 NOTYPE  LOCAL  DEFAULT     1 b
+# CHECK: 100004     2 NOTYPE  LOCAL  DEFAULT     1 c
+# CHECK: 100004     6 NOTYPE  LOCAL  DEFAULT     1 d
+# CHECK: 100000    10 NOTYPE  GLOBAL DEFAULT     1 _start
+
+.global _start
+_start:
+a:
+b:
+  add  a0, a1, a2
+.size a, . - a
+c:
+d:
+  call _start
+.size b, . - b
+.size c, . - c
+  add a0, a1, a2
+.size d, . - d
+.size _start, . - _start