[RISCV][LLD] Add RISCV zcmt optimise in linker relaxation

[VincentWu]

Summary

This patch implements optimizations for the zcmt extension in lld.

A new TableJumpSectio has been added.

Scans each R_RISCV_CALL/R_RISCV_CALL_PLT relocType in each section before the linker relaxation, recording the name of the symbol.

In finalizeContents the recorded symbol names are sorted in descending order by the number of jumps.

Optimise and insert a new cm.jt/cm.jalt during the relax process. in the process, we reused the`R_RISCV_JAL` relocType

co-author: @ScottEgerton

[kito-cheng]

I think this should really write a psABI spec proposal first.

lld/ELF/Arch/RISCV.cpp

673

This relaxation type remove 6 byte, so this should has higher priority than R_RISCV_CALL/R_RISCV_CALL_PLT to jal?

lld/ELF/SyntheticSections.cpp

1165 ↗

(On Diff #462714)

Should be SHT_PROGBITS, SHT_RISCV_ATTRIBUTES is only used for .riscv.attribute.

1188–1192 ↗

(On Diff #462714)

This should be enough.

1273–1287 ↗

(On Diff #462714)

Hmm, how do you deal with more than one local symbol with same name?

e.g.
Following example has 2 different bar:

foo1.c

static int bar (){return 1;}

int foo1(){return bar();}

foo2.c

static int bar (){return 2;}

int foo2(){return bar();}

main.c

int foo1();
int foo2();
int main(){return foo1()+foo2();}

lld/ELF/SyntheticSections.h

380

addCMJTEntryCandidate/getaddCMJTEntryIndex, and same for addEntryZero/getEntryZero

403

entriesZero -> CMJTEntryCandidates
finalizedEntriesZero -> finalizedCMJTEntries
and same for entriesRa/finalizedEntriesRa.

We only need to record symbol name for finalEntries, so std::vector<std::string> is enough?

410

CMJTEntry/CMJALTEntry rather than Zero/Ra, e.g. maxCMJTEntrySize/maxCMJALTEntrySize, startCMJTEntryIdx/startCMJALTEntryIdx.

lld/ELF/Writer.cpp

457

newlib's implementation using __tbljalvec_base$? and maybe use STB_GLOBAL like __global_pointer$?

https://github.com/linsinan1995/riscv-glibc/commit/5d2e0376316f64acfc047dc3e29fd266a456fb8f

[VincentWu]

address part of comments

lld/ELF/SyntheticSections.cpp

1237 ↗

(On Diff #462714)

We only need to record symbol name for finalEntries, so std::vector<std::string> is enough?

yep but we need sort it in descending order by the number of jumps.
it will be spand more linking time to copy again.

so I chose memory space instead of time.

did you mean it is acceptable if i spend more time to copy it again?

[sinan]

lld/ELF/SyntheticSections.cpp

1165 ↗

(On Diff #462882)

SHF_ALLOC | SHF_EXECINSTR is more appropriate IMO
(https://github.com/riscv/riscv-code-size-reduction/blob/main/Zc-specification/tablejump.adoc#table-jump-fault-handling)

[craig.topper]

lld/ELF/Options.td

324

RISCV-> RISC-V

[MaskRay]

lld/ELF/Options.td

323

FF: we require that new options must start with --, not -

lld/ELF/SyntheticSections.cpp

1164 ↗

(On Diff #462882)

The implementation should be moved to Arch/RISCV.cpp to avoid redundant virtual functions in TargetInfo.

lld/ELF/SyntheticSections.h

32

This is inefficient. If DenseMap<CachedStringRef, ...> works, prefer it.

[jrtc27]

We have the RISC-V attributes section, you should use that (and --(no-)relax) to determine whether or not to use Zcmt relaxation, not invent some new flag, especially since compiler drivers can't use it unless they're sure the linker supports that new flag (think Clang + binutils as the common case where it's hard to know for sure; at least with LLD the likelihood is it's not older than the Clang version, especially in the embedded space) or you require users to opt-in at link time to the relaxation.

[jrtc27]

lld/ELF/Arch/RISCV.cpp

391

This seems wrong

899

This seems like poor design, you shouldn't be using R_RISCV_JAL once it's no longer a JAL instruction there

lld/ELF/SyntheticSections.cpp

1213 ↗

(On Diff #462882)

When moving this to RISCV.cpp please use extractBits

lld/ELF/Writer.cpp

1652

Why isn't this done when we read in the relocations the first time?

2905

Huh? This doesn't make any sense? You're just writing the jump table section on top of every SHF_ALLOC output section? Make it act like every single other synthetic section and end up in an output section.

[VincentWu]

Refactoring the implementation of lld from psABI.
rebase & address comments

[VincentWu]

lld/ELF/Arch/RISCV.cpp

899

Use R_RISCV_32 or R_RISCV_64 instead

lld/ELF/Writer.cpp

1652

IMHO, we can calculate the gain value directly if we scan them when all relaxation have been done.

[VincentWu]

Reduce the time complexity of the algorithm by storing symbol pointers instead of symbol names

Try to compile *Vim* with zcmt opt, the code size of result is about 2.5M. get 0.1M (3.8%) code size decrease when it compare to the code size of *Vim* without zcmt (2.6M).

[VincentWu]

extend the size of InputSection

[MaskRay]

In D134600#4289590, @VincentWu wrote:

extend the size of InputSection

Why is this change? InputSection may have millions of instances for a large link. Increasing a word may increase the peak memory usage by 1%. We should strive to avoid it.

[VincentWu]

Revert commit "extend sizeof InputSection"

[jrtc27]

lld/ELF/Arch/RISCV.cpp

338

These are extremely dodgy

762

Blank line doesn't match style

766

This naming doesn't fit

1184

"Entrys" is not an English word

1217

We call finalizeContents more than once?

lld/ELF/SyntheticSections.cpp

42 ↗

(On Diff #516290)

?

[kito-cheng]

lld/ELF/Arch/RISCV.cpp

338

See https://github.com/llvm/llvm-project/blob/main/lld/ELF/Arch/RISCV.cpp#L53-L54 , I think we can use same way here.

[VincentWu]

address comments

[VincentWu]

lld/ELF/Arch/RISCV.cpp

1217

This method will be called at the end of the last round of relaxation. the changed in Writer<ELFT>::finalizeAddressDependentContent() might be set as true, which will cause the linker to do an additional relaxation. the code here is just try to avoiding it being called again in an additional relaxation.

[jrtc27]

lld/ELF/Arch/RISCV.cpp

338

Uh, what is this diff now? That's not what Kito said to do, and doesn't make it less dodgy. All you've done is given it a name, but that doesn't change the fact that the whole approach is dodgy.

[VincentWu]

use INTERNAL_ relocation type for Zcmt

[liaolucy]

ping

[VincentWu]

Hi all,

I think I've tried to address all the comments in this revision so far, if I missed something, please remind me again.

This revision hasn't received new commit for a while. So this ping is ask if there is any further comment for this revision?
I'll try to make changes as soon as possible so that we can move forward with the revision.

Is this patch currently meeting some blocks? If there is anything I can do to help, please let me know.

Uh, what is this diff now? That's not what Kito said to do, and doesn't make it less dodgy. All you've done is given it a name, but that doesn't change the fact that the whole approach is dodgy.

@jrtc27 Hope I get what you mean correctly this time, does it still dodgy?

@MaskRay Dose anything I can do for this patch? or do you have any thoughts on how this patch could be improved?

[nemanjai]

This hasn't received any attention in a bit over a month. Has it been moved to GitHub or are the reviewers just busy? It would be great to make progress with Zcmt.

[VincentWu]

In D134600#4657172, @nemanjai wrote:

This hasn't received any attention in a bit over a month. Has it been moved to GitHub or are the reviewers just busy? It would be great to make progress with Zcmt.

no， this patch not been moved to github, it will be reviewed here.
I am trying to find more evidence make this patch looks more reliable

[nemanjai]

I am only starting my involvement with RISC-V and thereby have much less experience than most of the other reviewers. Especially when it comes to lld. So if any of the more experienced reviewers disagree with any of my suggestions, please favour their suggestions over mine.

I for one certainly would like to see support for Zcmt land in lld sooner rather than later, so I have provided a number of comments that I am hoping can at least help advance the discussion even if they do not need to be incorporated.

Finally, it is not clear to me where the JVT is set (i.e. csrw jvt, <reg with base address>). Is that set in some library or the crt files? I imagine that is documented somewhere, but I think it might be useful to add a link to that documentation as a comment to the entry point for this relaxation (relaxTableJump()).

lld/ELF/Arch/RISCV.cpp

1167

If a function returns an index, I think it should be called getIndex() rather than getEntry().

1172–1181

Can this not just be something like:

// Find this symbol in the ordered list of entries if it exists.
assert(maxSize >= entriesList.size() &&
       "Finalized vector of entries exceeds maximum");
auto idx = std::find_if(
    entriesList.begin(), entriesList.end(),
    [symbol](llvm::detail::DenseMapPair<const Symbol *, int> &e) {
      return e.first == symbol;
    });
if (idx == entriesList.end())
  return entriesList.size();
return idx - entriesList.begin();

1199

I think it is useful to not name the opposite of what they mean (even though I do understand that gain is wrt. the goal of code size reduction). It is probably to change all references to gain to codeSizeReduction or csReduction if that's to long.

1225

I think it would be useful to document this. Perhaps something like:

// The total reduction in code size is J - JA + JTS - JAE.
// Where:
// J = number of bytes saved for all the cm.jt instructions emitted
// JA = number of bytes saved for all the cm.jalt instructions emitted
// JTS = size of the part of the table for cm.jt jumps (i.e. 32 x worsize)
// JAE = number of entries emitted for the cm.jalt jumps x wordsize

Plus it seems like a much more readable implementation would be something like:

int sizeIncrease = getSize();
for (auto entry : finalizedCMJTEntries) {
  if (sizeIncrease < 0)
    break;
  sizeIncrease -= entry.second;
}
for (auto entry : finalizedCMJALTEntries) {
  if (sizeIncrease < 0)
    break;
  sizeIncrease -= entry.second;
}

In fact, it might be useful to just implement a function getSizeReduction() similar to getSize() that would simply return the amount of code size reduction for all the table entries.

1244

/// Sort the map in decreasing order of the amount of code reduction provided
/// by the entries. Drop any entries that can't fit in the map from the tail
/// end since they provide less code reduction. Drop any entries that cause
/// an increase in code size (i.e. the reduction from instruction conversion
/// does not cover the code size gain from adding a table entry).

1264

// Drop any items that have a negative effect (i.e. increase code size).

1292

Is this needed if there are no entries in finalizedCMJALTEntries?

1313–1314

What is this for? How can there be a symbol in the vector that has a zero "gain"? Wouldn't that just mean that it doesn't have any calls? Seems more like this should be an assert.

lld/ELF/Options.td

323

I find the name and description somewhat unnatural for what this does. I think something like this would feel more natural:

riscv-tbljmp
"Enable conversion of call instructions to table jump instruction from the Zcmt extension for frequently called functions (RISC-V only)"

Also, is an option perhaps too coarse-grained? Is it feasible that a user would want to use table jumps within some objects but not in others? Namely, if the user compiles some objects with no Zcmt, shouldn't the linker respect that?

lld/ELF/Target.h

38

I think it would be clearer if this had entry or target in the name since it is writing a table entry (a target address).

lld/ELF/Writer.cpp

1680

I wonder if it would be possible and/or advantageous to produce the jump table and convert the instructions before we begin the process of relaxation. I am not familiar enough with the process here so this may not make sense, but this is how I see it and why I'm suggesting this...

1. This adds another source of volatility with relaxation, possibly making it more difficult to reach a fixed point
2. If we compile with -ffunction-sections, the linker has the ability to lay out the sections that contain functions for which we will use the jump table as far away from the rest of text as possible. This will keep the remaining functions closer and make them more likely to be possible to relax. Of course, the functions for which we're emitting jump table entries will themselves have calls, so an optimal layout is not feasible to compute, but it is likely useful to sort such functions late.

lld/test/ELF/riscv-tbljal-call.s

1

I think it would be useful to add checks for the layout of the jump table including the padding.

[VincentWu]

address comments

[VincentWu]

In D134600#4657177, @nemanjai wrote:

Finally, it is not clear to me where the JVT is set (i.e. csrw jvt, <reg with base address>). Is that set in some library or the crt files? I imagine that is documented somewhere, but I think it might be useful to add a link to that documentation as a comment to the entry point for this relaxation (relaxTableJump()).

as psabi has mentioned https://github.com/riscv-non-isa/riscv-elf-psabi-doc/blob/master/riscv-elf.adoc

This relaxation requires programs to initialize the jvt CSR with the address of the __jvt_base$ symbol before executing table jump instructions. It is recommended to initialize jvt CSR immediately after global pointer initialization.

lld/ELF/Options.td

323

Also, is an option perhaps too coarse-grained? Is it feasible that a user would want to use table jumps within some objects but not in others? Namely, if the user compiles some objects with no Zcmt, shouldn't the linker respect that?

Yes, it is coarse-grained a bit. But this extension is intended for embedded systems, (It is incompatible with applications-class processors.). Thus I think it might be ok if we just do it like that.

lld/ELF/Writer.cpp

1680

IMHO, I don't think it's possible to produce jump table before the linker relaxation. Because we need to calculate the reduction gained when jumping using TableJump instruction. But it will be changed by Compressed Tail Call Relaxation and Compressed Function Call Relaxation during linker relaxation.

As mentioned in psABI:"Compressed Tail Call Relaxation and Compressed Function Call Relaxation are always prefered during relaxation, since table jump relaxation has no extra size saving over these two relaxations and might bring a performance overhead."

If we produce the jump table before the linker relaxation, the code size reduction may be reduced to a small amount and even lead to a negative optimization.

[VincentWu]

add riscvTableJumpSection only when SizeReduction > 0

[VincentWu]

Hi all,
I tried linking several common applications and libraries using this patch to compare Zcmt's contribution to reducing Code Szie.

The results can be found in the Sheet or in the image below.

Besides that, I found a problem that needs to be discussed.

In TableJumpSection::finalizeContents(), the linker will abort the tbljal optimization and empty the Jump table if tbljal would cause a negative optimization (i.e., the size reduction caused by the Table jump Inst is less than the size increase caused by making the Jump Table).

However, the linker still adds the symbol __jvt_base$ to .symtab . This results in a small increase in program size.

[VincentWu]

lld/ELF/Writer.cpp

1717–1718

the linker still adds the symbol __jvt_base$ to .symtab . This results in a small increase in program size.

Thus, I tried to delay adding the symbol __jvt_base$ here and remove the symbol __jvt_base$ when the Jump Table is not empty. Something like that

But it will crash with error placeholder symbol reached writer at lld/ELF/Symbols.cpp:154. Does anyone can point out anything else should I do to add symbol delay?

lld/ELF/Arch/RISCV.cpp

public:
   uint32_t calcEFlags() const override;
   int64_t getImplicitAddend(const uint8_t *buf, RelType type) const override;
   void writeGotHeader(uint8_t *buf) const override;
   void writeGotPlt(uint8_t *buf, const Symbol &s) const override;
   void writeIgotPlt(uint8_t *buf, const Symbol &s) const override;
   void writePltHeader(uint8_t *buf) const override;
   void writePlt(uint8_t *buf, const Symbol &sym,
                 uint64_t pltEntryAddr) const override;
+  void writeTableJumpHeader(uint8_t *buf) const override;
+  void writeTableJump(uint8_t *buf, const uint64_t symbol) const override;
   RelType getDynRel(RelType type) const override;
   RelExpr getRelExpr(RelType type, const Symbol &s,
                      const uint8_t *loc) const override;
   void relocate(uint8_t *loc, const Relocation &rel,
                 uint64_t val) const override;
   bool relaxOnce(int pass) const override;
 };
 
 } // end anonymous namespace
 
 // These are internal relocation numbers for GP relaxation. They aren't part
 // of the psABI spec.
 #define INTERNAL_R_RISCV_GPREL_I 256
 #define INTERNAL_R_RISCV_GPREL_S 257
+#define INTERNAL_R_RISCV_TBJAL 258
 
 const uint64_t dtpOffset = 0x800;
 
 enum Op {
   ADDI = 0x13,
   AUIPC = 0x17,
   JALR = 0x67,
   LD = 0x3003,
void RISCV::writePlt(uint8_t *buf, const Symbol &sym,
   // nop
   uint32_t offset = sym.getGotPltVA() - pltEntryAddr;
   write32le(buf + 0, utype(AUIPC, X_T3, hi20(offset)));
   write32le(buf + 4, itype(config->is64 ? LD : LW, X_T3, X_T3, lo12(offset)));
   write32le(buf + 8, itype(JALR, X_T1, X_T3, 0));
   write32le(buf + 12, itype(ADDI, 0, 0, 0));
 }
 
+void RISCV::writeTableJumpHeader(uint8_t *buf) const {
+  if (config->is64)
+    write64le(buf, mainPart->dynamic->getVA());
+  else
+    write32le(buf, mainPart->dynamic->getVA());
+}
+
+void RISCV::writeTableJump(uint8_t *buf, const uint64_t address) const {
+  if (config->is64)
+    write64le(buf, address);
+  else
+    write32le(buf, address);
+}
+
 RelType RISCV::getDynRel(RelType type) const {
   return type == target->symbolicRel ? type
                                      : static_cast<RelType>(R_RISCV_NONE);
 }
 
 RelExpr RISCV::getRelExpr(const RelType type, const Symbol &s,
                           const uint8_t *loc) const {
   switch (type) {
RelExpr RISCV::getRelExpr(const RelType type, const Symbol &s,
   }
 }
 
 void RISCV::relocate(uint8_t *loc, const Relocation &rel, uint64_t val) const {
   const unsigned bits = config->wordsize * 8;
 
   switch (rel.type) {
   case R_RISCV_32:
     write32le(loc, val);
     return;
   case R_RISCV_64:
     write64le(loc, val);
     return;
 
   case R_RISCV_RVC_BRANCH: {
     checkInt(loc, val, 9, rel);
     checkAlignment(loc, val, 2, rel);
if (imm == 0) { // `c.lui rd, 0` is illegal, convert to `c.li rd, 0`
       uint16_t imm17 = extractBits(val + 0x800, 17, 17) << 12;
       uint16_t imm16_12 = extractBits(val + 0x800, 16, 12) << 2;
       write16le(loc, (read16le(loc) & 0xEF83) | imm17 | imm16_12);
     }
     return;
   }
 
   case R_RISCV_JAL: {
     checkInt(loc, val, 21, rel);
     checkAlignment(loc, val, 2, rel);
 
     uint32_t insn = read32le(loc) & 0xFFF;
     uint32_t imm20 = extractBits(val, 20, 20) << 31;
     uint32_t imm10_1 = extractBits(val, 10, 1) << 21;
     uint32_t imm11 = extractBits(val, 11, 11) << 20;
     uint32_t imm19_12 = extractBits(val, 19, 12) << 12;
     insn |= imm20 | imm10_1 | imm11 | imm19_12;
case INTERNAL_R_RISCV_GPREL_S: {
     if (rel.type == INTERNAL_R_RISCV_GPREL_I)
       insn = setLO12_I(insn, displace);
     else
       insn = setLO12_S(insn, displace);
     write32le(loc, insn);
     return;
   }
 
+  case INTERNAL_R_RISCV_TBJAL:
+    return;
+
   case R_RISCV_ADD8:
     *loc += val;
     return;
   case R_RISCV_ADD16:
     write16le(loc, read16le(loc) + val);
     return;
   case R_RISCV_ADD32:
     write32le(loc, read32le(loc) + val);
for (InputSection *sec : getInputSections(*osec, storage)) {
       llvm::sort(sec->relaxAux->anchors, [](auto &a, auto &b) {
         return std::make_pair(a.offset, a.end) <
                std::make_pair(b.offset, b.end);
       });
     }
   }
 }
 
+static bool relaxTableJump(const InputSection &sec, size_t i, uint64_t loc,
+                      Relocation &r, uint32_t &remove) {
+  if (!in.riscvTableJumpSection || !in.riscvTableJumpSection->isFinalized)
+    return false;
+
+  const auto jalr = sec.contentMaybeDecompress().data()[r.offset + 4];
+  const uint8_t rd = extractBits(jalr, 11, 7);
+  int tblEntryIndex = -1;
+  if (rd == 0) {
+    tblEntryIndex = in.riscvTableJumpSection->getCMJTEntryIndex(r.sym);
+  } else if (rd == X_RA) {
+    tblEntryIndex = in.riscvTableJumpSection->getCMJALTEntryIndex(r.sym);
+  }
+
+  if (tblEntryIndex >= 0) {
+    sec.relaxAux->relocTypes[i] = INTERNAL_R_RISCV_TBJAL;
+    sec.relaxAux->writes.push_back(0xA002 |
+                                   (tblEntryIndex << 2)); // cm.jt or cm.jalt
+    remove = 6;
+    return true;
+  }
+  return false;
+}
+
 // Relax R_RISCV_CALL/R_RISCV_CALL_PLT auipc+jalr to c.j, c.jal, or jal.
 static void relaxCall(const InputSection &sec, size_t i, uint64_t loc,
                       Relocation &r, uint32_t &remove) {
   const bool rvc = config->eflags & EF_RISCV_RVC;
   const Symbol &sym = *r.sym;
   const uint64_t insnPair = read64le(sec.content().data() + r.offset);
   const uint32_t rd = extractBits(insnPair, 32 + 11, 32 + 7);
   const uint64_t dest =
       (r.expr == R_PLT_PC ? sym.getPltVA() : sym.getVA()) + r.addend;
   const int64_t displace = dest - loc;
 
   if (rvc && isInt<12>(displace) && rd == 0) {
     sec.relaxAux->relocTypes[i] = R_RISCV_RVC_JUMP;
     sec.relaxAux->writes.push_back(0xa001); // c.j
     remove = 6;
   } else if (rvc && isInt<12>(displace) && rd == X_RA &&
              !config->is64) { // RV32C only
     sec.relaxAux->relocTypes[i] = R_RISCV_RVC_JUMP;
     sec.relaxAux->writes.push_back(0x2001); // c.jal
     remove = 6;
-  } else if (isInt<21>(displace)) {
+  } else if (!relaxTableJump(sec, i, loc, r, remove) && isInt<21>(displace)) {
     sec.relaxAux->relocTypes[i] = R_RISCV_JAL;
     sec.relaxAux->writes.push_back(0x6f | rd << 7); // jal
     remove = 4;
   }
 }
 
 // Relax local-exec TLS when hi20 is zero.
 static void relaxTlsLe(const InputSection &sec, size_t i, uint64_t loc,
case R_RISCV_TPREL_ADD:
     break;
   case R_RISCV_TPREL_LO12_I:
     // addi rd, rd, %tprel_lo(x) => addi rd, tp, st_value(x)
     sec.relaxAux->relocTypes[i] = R_RISCV_32;
     insn = (insn & ~(31 << 15)) | (X_TP << 15);
     sec.relaxAux->writes.push_back(setLO12_I(insn, val));
     break;
   case R_RISCV_TPREL_LO12_S:
     // sw rs, %tprel_lo(x)(rd) => sw rs, st_value(x)(rd)
     sec.relaxAux->relocTypes[i] = R_RISCV_32;
     insn = (insn & ~(31 << 15)) | (X_TP << 15);
     sec.relaxAux->writes.push_back(setLO12_S(insn, val));
     break;
   }
 }
 
 static void relaxHi20Lo12(const InputSection &sec, size_t i, uint64_t loc,
case R_RISCV_TPREL_LO12_S:
         relaxTlsLe(sec, i, loc, r, remove);
       break;
     case R_RISCV_HI20:
     case R_RISCV_LO12_I:
     case R_RISCV_LO12_S:
       if (i + 1 != sec.relocs().size() &&
           sec.relocs()[i + 1].type == R_RISCV_RELAX)
         relaxHi20Lo12(sec, i, loc, r, remove);
+    case R_RISCV_JAL:
+      if (i + 1 != sec.relocations.size() &&
+          sec.relocations[i + 1].type == R_RISCV_RELAX)
+        relaxTableJump(sec, i, loc, r, remove);
       break;
     }
 
     // For all anchors whose offsets are <= r.offset, they are preceded by
     // the previous relocation whose `relocDeltas` value equals `delta`.
     // Decrease their st_value and update their st_size.
     for (; sa.size() && sa[0].offset <= r.offset; sa = sa.slice(1)) {
       if (sa[0].end)
         sa[0].d->size = sa[0].offset - delta - sa[0].d->value;
for (InputSection *sec : getInputSections(*osec, storage)) {
               write16le(p + j, 0x0001); // c.nop
             }
           }
         } else if (RelType newType = aux.relocTypes[i]) {
           switch (newType) {
           case INTERNAL_R_RISCV_GPREL_I:
           case INTERNAL_R_RISCV_GPREL_S:
             break;
+          case INTERNAL_R_RISCV_TBJAL:
+            assert(config->riscvTbljal);
+            assert((aux.writes[writesIdx] & 0xfc03) == 0xA002);
+            skip = 2;
+            write16le(p, aux.writes[writesIdx++]);
+            break;
           case R_RISCV_RELAX:
             // Used by relaxTlsLe to indicate the relocation is ignored.
             break;
           case R_RISCV_RVC_JUMP:
             skip = 2;
             write16le(p, aux.writes[writesIdx++]);
             break;
           case R_RISCV_JAL:
             skip = 4;
             write32le(p, aux.writes[writesIdx++]);
             break;
+          case R_RISCV_64:
+            break;
           case R_RISCV_32:
-            // Used by relaxTlsLe to write a uint32_t then suppress the handling
-            // in relocateAlloc.
+            // Used by relaxTlsLe to write a uint32_t then suppress the
+            // handling in relocateAlloc.
             skip = 4;
             write32le(p, aux.writes[writesIdx++]);
             aux.relocTypes[i] = R_RISCV_NONE;
             break;
           default:
             llvm_unreachable("unsupported type");
           }
         }
void elf::mergeRISCVAttributesSections() {
   ctx.inputSections.insert(ctx.inputSections.begin() + place,
                            mergeAttributesSection(sections));
 }
 
 TargetInfo *elf::getRISCVTargetInfo() {
   static RISCV target;
   return &target;
 }
+
+TableJumpSection::TableJumpSection()
+    : SyntheticSection(SHF_ALLOC | SHF_EXECINSTR, SHT_PROGBITS,
+                       config->wordsize, ".riscv.jvt") {}
+
+void TableJumpSection::addCMJTEntryCandidate(const Symbol *symbol, int gain) {
+  addEntry(symbol, CMJTEntryCandidates, gain);
+}
+
+int TableJumpSection::getCMJTEntryIndex(const Symbol *symbol) {
+  uint32_t index = getEntry(symbol, maxCMJTEntrySize, finalizedCMJTEntries);
+  return index < finalizedCMJTEntries.size() ? (int)(startCMJTEntryIdx + index)
+                                             : -1;
+}
+
+void TableJumpSection::addCMJALTEntryCandidate(const Symbol *symbol, int gain) {
+  addEntry(symbol, CMJALTEntryCandidates, gain);
+}
+
+int TableJumpSection::getCMJALTEntryIndex(const Symbol *symbol) {
+  uint32_t index = getEntry(symbol, maxCMJALTEntrySize, finalizedCMJALTEntries);
+  return index < finalizedCMJALTEntries.size()
+             ? (int)(startCMJALTEntryIdx + index)
+             : -1;
+}
+
+void TableJumpSection::addEntry(
+    const Symbol *symbol, llvm::DenseMap<const Symbol *, int> &entriesList,
+    int gain) {
+  entriesList[symbol] += gain;
+}
+
+uint32_t TableJumpSection::getEntry(
+    const Symbol *symbol, uint32_t maxSize,
+    SmallVector<llvm::detail::DenseMapPair<const Symbol *, int>, 0>
+        &entriesList) {
+  // Prevent adding duplicate entries
+  uint32_t i = 0;
+
+  for (; i < entriesList.size() && i <= maxSize; i++) {
+    // If this is a duplicate addition, do not add it and return the address
+    // offset of the original entry.
+    if (symbol == entriesList[i].first) {
+      return i;
+    }
+  }
+  return i;
+}
+
+void TableJumpSection::scanTableJumpEntries(const InputSection &sec) const {
+  for (auto [i, r] : llvm::enumerate(sec.relocations)) {
+    Defined *definedSymbol = dyn_cast<Defined>(r.sym);
+    if (!definedSymbol)
+      continue;
+    if (i + 1 == sec.relocs().size() ||
+        sec.relocs()[i + 1].type != R_RISCV_RELAX)
+      continue;
+    switch (r.type) {
+    case R_RISCV_JAL:
+    case R_RISCV_CALL:
+    case R_RISCV_CALL_PLT: {
+      const auto jalr = sec.contentMaybeDecompress().data()[r.offset + 4];
+      const uint8_t rd = extractBits(jalr, 11, 7);
+
+      int gain = 6;
+      if (sec.relaxAux->relocTypes[i] == R_RISCV_RVC_JUMP)
+        continue;
+      else if (sec.relaxAux->relocTypes[i] == R_RISCV_JAL)
+        gain = 2;
+
+      if (rd == 0)
+        in.riscvTableJumpSection->addCMJTEntryCandidate(r.sym, gain);
+      else if (rd == X_RA)
+        in.riscvTableJumpSection->addCMJALTEntryCandidate(r.sym, gain);
+    }
+    }
+  }
+}
+
+void TableJumpSection::finalizeContents() {
+  if (isFinalized)
+    return;
+  isFinalized = true;
+
+  finalizedCMJTEntries = finalizeEntry(CMJTEntryCandidates, maxCMJTEntrySize);
+  finalizedCMJALTEntries =
+      finalizeEntry(CMJALTEntryCandidates, maxCMJALTEntrySize);
+  CMJTEntryCandidates.clear();
+  CMJALTEntryCandidates.clear();
+
+  if (finalizedCMJALTEntries.size() > 0) {
+    int gainRequired = maxCMJTEntrySize * config->wordsize;
+    for (auto entry : finalizedCMJTEntries) {
+      gainRequired -= entry.second;
+    }
+    if (gainRequired > 0) {
+      for (auto entry : finalizedCMJALTEntries) {
+        gainRequired -= (entry.second - config->wordsize);
+        if (gainRequired <= 0)
+          break;
+      }
+    }
+
+    // Stop relax to cm.jalt if there will be negative effect
+    if (gainRequired > 0)
+      finalizedCMJALTEntries.clear();
+  }
+}
+
+SmallVector<llvm::detail::DenseMapPair<const Symbol *, int>, 0>
+TableJumpSection::finalizeEntry(llvm::DenseMap<const Symbol *, int> EntryMap,
+                                uint32_t maxSize) {
+  auto cmp = [](const llvm::detail::DenseMapPair<const Symbol *, int> &p1,
+                const llvm::detail::DenseMapPair<const Symbol *, int> &p2) {
+    return p1.second > p2.second;
+  };
+
+  SmallVector<llvm::detail::DenseMapPair<const Symbol *, int>, 0>
+      tempEntryVector;
+  std::copy(EntryMap.begin(), EntryMap.end(),
+            std::back_inserter(tempEntryVector));
+  std::sort(tempEntryVector.begin(), tempEntryVector.end(), cmp);
+
+  auto finalizedVector = tempEntryVector;
+  if (tempEntryVector.size() >= maxSize)
+    finalizedVector =
+        SmallVector<llvm::detail::DenseMapPair<const Symbol *, int>, 0>(
+            tempEntryVector.begin(), tempEntryVector.begin() + maxSize);
+
+  // drop the item which has negitive effect
+  while (finalizedVector.size()) {
+    if (finalizedVector.rbegin()->second < config->wordsize)
+      finalizedVector.pop_back();
+    else
+      break;
+  }
+  return finalizedVector;
+}
+
+size_t TableJumpSection::getSize() const {
+  if (isFinalized) {
+    if (!finalizedCMJALTEntries.empty())
+      return (startCMJALTEntryIdx + finalizedCMJALTEntries.size()) *
+             config->wordsize;
+    return (startCMJTEntryIdx + finalizedCMJTEntries.size()) * config->wordsize;
+  } else {
+    if (!CMJALTEntryCandidates.empty())
+      return (startCMJALTEntryIdx + CMJALTEntryCandidates.size()) *
+             config->wordsize;
+    return (startCMJTEntryIdx + CMJTEntryCandidates.size()) * config->wordsize;
+  }
+}
+
+void TableJumpSection::writeTo(uint8_t *buf) {
+  target->writeTableJumpHeader(buf);
+  writeEntries(buf + startCMJTEntryIdx * config->wordsize,
+               finalizedCMJTEntries);
+  padWords(buf + ((startCMJTEntryIdx + finalizedCMJTEntries.size()) *
+                  config->wordsize),
+           startCMJALTEntryIdx);
+  writeEntries(buf + (startCMJALTEntryIdx * config->wordsize),
+               finalizedCMJALTEntries);
+}
+
+void TableJumpSection::padWords(uint8_t *buf, const uint8_t maxWordCount) {
+  for (size_t i = 0; i < maxWordCount; ++i) {
+    if (config->is64)
+      write64le(buf, 0);
+    else
+      write32le(buf, 0);
+  }
+}
+
+void TableJumpSection::writeEntries(
+    uint8_t *buf,
+    SmallVector<llvm::detail::DenseMapPair<const Symbol *, int>, 0>
+        &entriesList) {
+  for (const auto &entry : entriesList) {
+    if (entry.second == 0)
+      continue;
+    // Use the symbol from in.symTab to ensure we have the final adjusted
+    // symbol.
+    if (!entry.first->isDefined())
+      continue;
+    target->writeTableJump(buf, entry.first->getVA());
+    buf += config->wordsize;
+  }
+}

lld/ELF/Config.h

struct Config {
   bool pie;
   bool printGcSections;
   bool printIcfSections;
   bool relax;
   bool relaxGP;
   bool relocatable;
   bool relrGlibc = false;
   bool relrPackDynRelocs = false;
+  bool riscvTbljal;
   llvm::DenseSet<llvm::StringRef> saveTempsArgs;
   llvm::SmallVector<std::pair<llvm::GlobPattern, uint32_t>, 0> shuffleSections;
   bool singleRoRx;
   bool shared;
   bool symbolic;
   bool isStatic = false;
   bool sysvHash = false;
   bool target1Rel;

lld/ELF/Driver.cpp

static void readConfigs(opt::InputArgList &args) {
   config->warnBackrefs =
       args.hasFlag(OPT_warn_backrefs, OPT_no_warn_backrefs, false);
   config->warnCommon = args.hasFlag(OPT_warn_common, OPT_no_warn_common, false);
   config->warnSymbolOrdering =
       args.hasFlag(OPT_warn_symbol_ordering, OPT_no_warn_symbol_ordering, true);
   config->whyExtract = args.getLastArgValue(OPT_why_extract);
   config->zCombreloc = getZFlag(args, "combreloc", "nocombreloc", true);
   config->zCopyreloc = getZFlag(args, "copyreloc", "nocopyreloc", true);
+  config->riscvTbljal = args.hasArg(OPT_riscv_tbljal);
   config->zForceBti = hasZOption(args, "force-bti");
   config->zForceIbt = hasZOption(args, "force-ibt");
   config->zGlobal = hasZOption(args, "global");
   config->zGnustack = getZGnuStack(args);
   config->zHazardplt = hasZOption(args, "hazardplt");
   config->zIfuncNoplt = hasZOption(args, "ifunc-noplt");
   config->zInitfirst = hasZOption(args, "initfirst");
   config->zInterpose = hasZOption(args, "interpose");

lld/ELF/Options.td

 defm pack_dyn_relocs:
   EEq<"pack-dyn-relocs", "Pack dynamic relocations in the given format">,
   MetaVarName<"[none,android,relr,android+relr]">;
 
 defm use_android_relr_tags: BB<"use-android-relr-tags",
     "Use SHT_ANDROID_RELR / DT_ANDROID_RELR* tags instead of SHT_RELR / DT_RELR*",
     "Use SHT_RELR / DT_RELR* tags (default)">;
 
+def riscv_tbljal: FF<"riscv-tbljal">,
+  HelpText<"(RISC-V only) Enable table jump instructions from the Zcmt extension">;
+
 def pic_veneer: F<"pic-veneer">,
   HelpText<"Always generate position independent thunks (veneers)">;
 
 defm pie: B<"pie",
     "Create a position independent executable",
     "Do not create a position independent executable (default)">;
 
 defm print_gc_sections: B<"print-gc-sections",

lld/ELF/SyntheticSections.h

 #include "InputSection.h"
 #include "llvm/ADT/DenseSet.h"
 #include "llvm/ADT/MapVector.h"
 #include "llvm/MC/StringTableBuilder.h"
 #include "llvm/Support/Compiler.h"
 #include "llvm/Support/Endian.h"
 #include "llvm/Support/Parallel.h"
 #include "llvm/Support/Threading.h"
 
 namespace lld::elf {
 class Defined;
 struct PhdrEntry;
 class SymbolTableBaseSection;
 
 struct CieRecord {
   EhSectionPiece *cie = nullptr;
   SmallVector<EhSectionPiece *, 0> fdes;
public:
   // Flag to force GotPlt to be in output if we have relocations
   // that relies on its address.
   std::atomic<bool> hasGotPltOffRel = false;
 
 private:
   SmallVector<const Symbol *, 0> entries;
 };
 
+class TableJumpSection final : public SyntheticSection {
+public:
+  TableJumpSection();
+  size_t getSize() const override;
+  void writeTo(uint8_t *buf) override;
+  void finalizeContents() override;
+
+  void addCMJTEntryCandidate(const Symbol *symbol, int gain);
+  int getCMJTEntryIndex(const Symbol *symbol);
+  void addCMJALTEntryCandidate(const Symbol *symbol, int gain);
+  int getCMJALTEntryIndex(const Symbol *symbol);
+  void scanTableJumpEntries(const InputSection &sec) const;
+
+  bool isFinalized = false;
+
+private:
+  SmallVector<llvm::detail::DenseMapPair<const Symbol *, int>, 0>
+  finalizeEntry(llvm::DenseMap<const Symbol *, int> EntryMap, uint32_t maxSize);
+  void addEntry(const Symbol *symbol,
+                llvm::DenseMap<const Symbol *, int> &entriesList, int gain);
+  uint32_t getEntry(const Symbol *symbol, uint32_t maxSize,
+                    SmallVector<llvm::detail::DenseMapPair<const Symbol *, int>,
+                                0> &entriesList);
+  void writeEntries(uint8_t *buf,
+                    SmallVector<llvm::detail::DenseMapPair<const Symbol *, int>,
+                                0> &entriesList);
+  void padWords(uint8_t *buf, const uint8_t maxWordCount);
+
+  // used in finalizeContents function.
+  static const size_t maxCMJTEntrySize = 32;
+  static const size_t maxCMJALTEntrySize = 224;
+
+  static const size_t startCMJTEntryIdx = 0;
+  static const size_t startCMJALTEntryIdx = 32;
+
+  llvm::DenseMap<const Symbol *, int> CMJTEntryCandidates;
+  SmallVector<llvm::detail::DenseMapPair<const Symbol *, int>, 0>
+      finalizedCMJTEntries;
+  llvm::DenseMap<const Symbol *, int> CMJALTEntryCandidates;
+  SmallVector<llvm::detail::DenseMapPair<const Symbol *, int>, 0>
+      finalizedCMJALTEntries;
+};
+
 // The IgotPltSection is a Got associated with the PltSection for GNU Ifunc
 // Symbols that will be relocated by Target->IRelativeRel.
 // On most Targets the IgotPltSection will immediately follow the GotPltSection
 // on ARM the IgotPltSection will immediately follow the GotSection.
 class IgotPltSection final : public SyntheticSection {
 public:
   IgotPltSection();
   void addEntry(Symbol &sym);
struct InStruct {
   std::unique_ptr<InputSection> attributes;
   std::unique_ptr<SyntheticSection> riscvAttributes;
   std::unique_ptr<BssSection> bss;
   std::unique_ptr<BssSection> bssRelRo;
   std::unique_ptr<GotSection> got;
   std::unique_ptr<GotPltSection> gotPlt;
   std::unique_ptr<IgotPltSection> igotPlt;
   std::unique_ptr<PPC64LongBranchTargetSection> ppc64LongBranchTarget;
+  std::unique_ptr<TableJumpSection> riscvTableJumpSection;
   std::unique_ptr<SyntheticSection> mipsAbiFlags;
   std::unique_ptr<MipsGotSection> mipsGot;
   std::unique_ptr<SyntheticSection> mipsOptions;
   std::unique_ptr<SyntheticSection> mipsReginfo;
   std::unique_ptr<MipsRldMapSection> mipsRldMap;
   std::unique_ptr<SyntheticSection> partEnd;
   std::unique_ptr<SyntheticSection> partIndex;
   std::unique_ptr<PltSection> plt;

lld/ELF/Target.h

 public:
   virtual uint32_t calcEFlags() const { return 0; }
   virtual RelExpr getRelExpr(RelType type, const Symbol &s,
                              const uint8_t *loc) const = 0;
   virtual RelType getDynRel(RelType type) const { return 0; }
   virtual void writeGotPltHeader(uint8_t *buf) const {}
   virtual void writeGotHeader(uint8_t *buf) const {}
   virtual void writeGotPlt(uint8_t *buf, const Symbol &s) const {};
+  virtual void writeTableJumpHeader(uint8_t *buf) const {};
+  virtual void writeTableJump(uint8_t *buf, const uint64_t symbol) const {};
   virtual void writeIgotPlt(uint8_t *buf, const Symbol &s) const {}
   virtual int64_t getImplicitAddend(const uint8_t *buf, RelType type) const;
   virtual int getTlsGdRelaxSkip(RelType type) const { return 1; }
 
   // If lazy binding is supported, the first entry of the PLT has code
   // to call the dynamic linker to resolve PLT entries the first time
   // they are called. This function writes that code.
   virtual void writePltHeader(uint8_t *buf) const {}

lld/ELF/Writer.cpp

if (config->emachine == EM_PPC) {
     add(*in.ppc32Got2);
   }
 
   if (config->emachine == EM_PPC64) {
     in.ppc64LongBranchTarget = std::make_unique<PPC64LongBranchTargetSection>();
     add(*in.ppc64LongBranchTarget);
   }
 
+  if (config->emachine == EM_RISCV && config->riscvTbljal) {
+    in.riscvTableJumpSection = std::make_unique<TableJumpSection>();
+    add(*in.riscvTableJumpSection);
+
+    symtab.addSymbol(Defined{
+        /*file=*/nullptr, "__jvt_base$", STB_GLOBAL, STT_NOTYPE, STT_NOTYPE,
+        /*value=*/0, /*size=*/0, in.riscvTableJumpSection.get()});
+  }
+
   in.gotPlt = std::make_unique<GotPltSection>();
   add(*in.gotPlt);
   in.igotPlt = std::make_unique<IgotPltSection>();
   add(*in.igotPlt);
 
   // _GLOBAL_OFFSET_TABLE_ is defined relative to either .got.plt or .got. Treat
   // it as a relocation and ensure the referenced section is created.
   if (ElfSym::globalOffsetTable && config->emachine != EM_MIPS) {
template <class ELFT> void Writer<ELFT>::finalizeAddressDependentContent() {
   for (Partition &part : partitions)
     finalizeSynthetic(part.armExidx.get());
   resolveShfLinkOrder();
 
   // Converts call x@GDPLT to call __tls_get_addr
   if (config->emachine == EM_HEXAGON)
     hexagonTLSSymbolUpdate(outputSections);
 
   uint32_t pass = 0, assignPasses = 0;
   for (;;) {
     bool changed = target->needsThunks ? tc.createThunks(pass, outputSections)
                                        : target->relaxOnce(pass);
     ++pass;
 
     // With Thunk Size much smaller than branch range we expect to
     // converge quickly; if we get to 30 something has gone wrong.
     if (changed && pass >= 30) {
       error(target->needsThunks ? "thunk creation not converged"
                                 : "relaxation not converged");
       break;
     }
 
     if (config->fixCortexA53Errata843419) {
       if (changed)
         script->assignAddresses();
       changed |= a64p.createFixes();
     }
     if (config->fixCortexA8) {
       if (changed)
         script->assignAddresses();
       changed |= a32p.createFixes();
     }
+    if (config->riscvTbljal) {
+      if (!changed) {
+        // scan all R_RISCV_JAL, R_RISCV_CALL/R_RISCV_CALL_PLT for RISCV Zcmt
+        // Jump table.
+        if (in.riscvTableJumpSection) {
+          for (InputSectionBase *inputSection : ctx.inputSections) {
+            in.riscvTableJumpSection->scanTableJumpEntries(
+                cast<InputSection>(*inputSection));
+          }
+          in.riscvTableJumpSection->finalizeContents();
+          changed |= target->relaxOnce(pass);
+        }
+      }
+    }
 
     if (in.mipsGot)
       in.mipsGot->updateAllocSize();
 
     for (Partition &part : partitions) {
       changed |= part.relaDyn->updateAllocSize();
       if (part.relrDyn)
         changed |= part.relrDyn->updateAllocSize();
if (!changed) {
                     " does not converge");
         break;
       }
     }
   }
   if (!config->relocatable && config->emachine == EM_RISCV)
     riscvFinalizeRelax(pass);
 
   if (config->relocatable)
     for (OutputSection *sec : outputSections)
       sec->addr = 0;
 
   // If addrExpr is set, the address may not be a multiple of the alignment.
   // Warn because this is error-prone.
   for (SectionCommand *cmd : script->sectionCommands)
     if (auto *osd = dyn_cast<OutputDesc>(cmd)) {
       OutputSection *osec = &osd->osec;
       if (osec->addr % osec->addralign != 0)

 }
 
 template <class ELFT> void Writer<ELFT>::writeSectionsBinary() {
   parallel::TaskGroup tg;
   for (OutputSection *sec : outputSections)
     if (sec->flags & SHF_ALLOC)
       sec->writeTo<ELFT>(Out::bufferStart + sec->offset, tg);
 }
 
 static void fillTrap(uint8_t *i, uint8_t *end) {
   for (; i + 4 <= end; i += 4)
     memcpy(i, &target->trapInstr, 4);
 }
 
 // Fill the last page of executable segments with trap instructions
 // instead of leaving them as zero. Even though it is not required by any
 // standard, it is in general a good thing to do for security reasons.

lld/test/ELF/riscv-tbljal-call.s

+# REQUIRES: riscv
+
+# RUN: llvm-mc -filetype=obj -triple=riscv32 -mattr=+relax -mattr=+experimental-zcmt %s -o %t.rv32.o
+# RUN: llvm-mc -filetype=obj -triple=riscv64 -mattr=+relax -mattr=+experimental-zcmt %s -o %t.rv64.o
+
+# tbljal conversion
+# RUN: ld.lld %t.rv32.o --riscv-tbljal --defsym foo=_start+0x150000 -o %t.rv32
+# RUN: ld.lld %t.rv64.o --riscv-tbljal --defsym foo=_start+0x150000 -o %t.rv64
+# RUN: llvm-objdump -d -M no-aliases --mattr=+experimental-zcmt --no-show-raw-insn %t.rv32 | FileCheck --check-prefix=TBLJAL32 %s
+# RUN: llvm-objdump -d -M no-aliases --mattr=+experimental-zcmt --no-show-raw-insn %t.rv64 | FileCheck --check-prefix=TBLJAL64 %s
+# TBLJAL32:      cm.jalt 32
+# TBLJAL32-NEXT: cm.jalt 32
+# TBLJAL32-NEXT: cm.jalt 32
+# TBLJAL32-NEXT: cm.jalt 32
+# TBLJAL32-NEXT: cm.jalt 32
+# TBLJAL32-NEXT: cm.jalt 32
+# TBLJAL32-NEXT: cm.jalt 32
+# TBLJAL32-NEXT: cm.jalt 32
+# TBLJAL32-NEXT: cm.jalt 32
+# TBLJAL32-NEXT: cm.jalt 32
+# TBLJAL32-NEXT: cm.jalt 32
+# TBLJAL32-NEXT: cm.jalt 32
+# TBLJAL32-NEXT: cm.jalt 32
+# TBLJAL32-NEXT: cm.jalt 32
+# TBLJAL32-NEXT: cm.jalt 32
+# TBLJAL32-NEXT: cm.jalt 32
+# TBLJAL32-NEXT: cm.jalt 32
+# TBLJAL32-NEXT: cm.jalt 32
+# TBLJAL32-NEXT: cm.jalt 32
+# TBLJAL32-NEXT: cm.jalt 32
+# TBLJAL32-NEXT: cm.jt   2
+# TBLJAL32-NEXT: cm.jt   2
+# TBLJAL32-NEXT: cm.jt   1
+# TBLJAL32-NEXT: cm.jt   1
+# TBLJAL32-NEXT: cm.jt   1
+# TBLJAL32-NEXT: cm.jt   0
+# TBLJAL32-NEXT: cm.jt   0
+# TBLJAL32-NEXT: cm.jt   0
+# TBLJAL32-NEXT: cm.jt   0
+
+# TBLJAL64:      cm.jt   0
+# TBLJAL64-NEXT: cm.jt   0
+# TBLJAL64-NEXT: cm.jt   0
+# TBLJAL64-NEXT: cm.jt   0
+
+
+.global _start
+.p2align 3
+_start:
+  call foo
+  call foo
+  call foo
+  call foo
+  call foo
+  call foo
+  call foo
+  call foo
+  call foo
+  call foo
+  call foo
+  call foo
+  call foo
+  call foo
+  call foo
+  call foo
+  call foo
+  call foo
+  call foo
+  call foo
+  tail foo_1
+  tail foo_1
+  tail foo_2
+  tail foo_2
+  tail foo_2
+  tail foo_3
+  tail foo_3
+  tail foo_3
+  tail foo_3
+
+foo_1:
+  nop
+
+foo_2:
+  nop
+
+foo_3:
+  nop
+

lld/test/ELF/riscv-tbljal-syms.s

+# REQUIRES: riscv
+
+// Check that relaxation correctly adjusts symbol addresses and sizes.
+
+# RUN: llvm-mc -filetype=obj -triple=riscv32 -mattr=+relax -mattr=+experimental-zcmt %s -o %t.rv32.o
+# RUN: llvm-mc -filetype=obj -triple=riscv64 -mattr=+relax -mattr=+experimental-zcmt %s -o %t.rv64.o
+# RUN: ld.lld -Ttext=0x100000 --riscv-tbljal %t.rv32.o -o %t.rv32
+# RUN: ld.lld -Ttext=0x100000 --riscv-tbljal %t.rv64.o -o %t.rv64
+
+# RUN: llvm-readelf -s %t.rv32 | FileCheck %s
+# RUN: llvm-readelf -s %t.rv64 | FileCheck %s
+
+# CHECK: 00100000     4 NOTYPE  LOCAL  DEFAULT     1 a
+# CHECK: 00100000     8 NOTYPE  LOCAL  DEFAULT     1 b
+# CHECK: 00100004     4 NOTYPE  LOCAL  DEFAULT     1 c
+# CHECK: 00100004     8 NOTYPE  LOCAL  DEFAULT     1 d
+# CHECK: 00100000    12 NOTYPE  GLOBAL DEFAULT     1 _start
+
+.global _start
+_start:
+a:
+b:
+  add  a0, a1, a2
+.size a, . - a
+c:
+d:
+  call _start
+.size b, . - b
+.size c, . - c
+  add a0, a1, a2
+.size d, . - d
+.size _start, . - _start