[lld/ELF] Don't relax R_X86_64_(REX_)GOTPCRELX when offset is too far

[aeubanks]

Summary

For each R_X86_64_(REX_)GOTPCRELX relocation, check that the offset to the symbol is representable with 2^32 signed offset. If not, add a GOT entry for it and set its expr to R_GOT_PC so that we emit the GOT load instead of the relaxed lea. Do this in finalizeAddressDependentContent() where we iteratively attempt this (e.g. RISCV uses this for relaxation, ARM uses this to insert thunks).

Decided not to do the opposite of inserting GOT entries initially and removing them when relaxable because removing GOT entries isn't simple.

One drawback of this approach is that if we see any GOTPCRELX relocation, we'll create an empty .got even if it's not required in the end.

[aeubanks]

one issue with this patch is that if we decided to remove the GOT earlier on in removeUnusedSyntheticSections, we don't emit the GOT. any ideas for how to structure that?

also the relax naming needs to be changed since we're basically unrelaxing here, but I'll fix that if this approach seems ok

[MaskRay]

This should state the motication, which is likely to alleviate relocation overflow pressure.

On x86-64, linkers optimize some GOT-indirect instructions (R_X86_64_REX_GOTPCRELX; e.g. movq var@GOTPCREL(%rip), %rax) to PC-relative instructions. The distance between a code section and .got is usually smaller than The distance between a code section and .data/.bss. ld.lld's one-pass relocation scanning scheme has a limitation: if it decides to suppress a GOT entry and it turns out that optimizing the instruction will lead to relocation overflow, the decision cannot be reverted. It should be easy to work around the issue with -Wl,--no-relax.

However, I'm not sure adding another relocation scanning pass for this purpose is a good idea. It's quite a bit of code targeted with very specific workloads where -Wl,--no-relax can be used instead. Our relocation scanning is more complex than mold and makes us slower. I'm fairly concerned of more relocation passes.

(Another minor thing is that I think our relocation scanning really needs overhaul to improve performance. This tricky case would add another item to account for when we do the refactoring.)

[aeubanks]

In D157020#4558475, @MaskRay wrote:

This should state the motication, which is likely to alleviate relocation overflow pressure.

On x86-64, linkers optimize some GOT-indirect instructions (R_X86_64_REX_GOTPCRELX; e.g. movq var@GOTPCREL(%rip), %rax) to PC-relative instructions. The distance between a code section and .got is usually smaller than The distance between a code section and .data/.bss. ld.lld's one-pass relocation scanning scheme has a limitation: if it decides to suppress a GOT entry and it turns out that optimizing the instruction will lead to relocation overflow, the decision cannot be reverted. It should be easy to work around the issue with -Wl,--no-relax.

I wouldn't say this is to "alleviate relocation overflow pressure", I'd say this is straight up just a bug fix. The linker shouldn't be doing this optimization if it breaks linking right?

However, I'm not sure adding another relocation scanning pass for this purpose is a good idea. It's quite a bit of code targeted with very specific workloads where -Wl,--no-relax can be used instead. Our relocation scanning is more complex than mold and makes us slower. I'm fairly concerned of more relocation passes.

Perhaps we can avoid the extra relocation scan in cases where we detect that the max offset is under 2^31?
I'm pretty --no-relax will be unacceptable performance-wise for accessing extern globals.

(Another minor thing is that I think our relocation scanning really needs overhaul to improve performance. This tricky case would add another item to account for when we do the refactoring.)

[MaskRay]

In D157020#4558525, @aeubanks wrote:

In D157020#4558475, @MaskRay wrote:

This should state the motication, which is likely to alleviate relocation overflow pressure.

On x86-64, linkers optimize some GOT-indirect instructions (R_X86_64_REX_GOTPCRELX; e.g. movq var@GOTPCREL(%rip), %rax) to PC-relative instructions. The distance between a code section and .got is usually smaller than The distance between a code section and .data/.bss. ld.lld's one-pass relocation scanning scheme has a limitation: if it decides to suppress a GOT entry and it turns out that optimizing the instruction will lead to relocation overflow, the decision cannot be reverted. It should be easy to work around the issue with -Wl,--no-relax.

I wouldn't say this is to "alleviate relocation overflow pressure", I'd say this is straight up just a bug fix. The linker shouldn't be doing this optimization if it breaks linking right?

I think it's unfair to call it a linker bug. Having R_X86_64_REX_GOTPCRELX and R_X86_64_GOTPCRELX out-of-range issues implies that the program no longer fits into the small code model, and we are in the realm of doing extra stuff to try to make program work, with certain constraints in the toolchain pieces.
Whether the linker provides the GOTPCRELX range check for deciding optimization is an add-on instead of a requirement.
With lld's one-pass main relocation scanning architecture, it's costly to perform the additional check, so we can say we made a deliberate choice not to support this case in the presence of --relax.

However, I'm not sure adding another relocation scanning pass for this purpose is a good idea. It's quite a bit of code targeted with very specific workloads where -Wl,--no-relax can be used instead. Our relocation scanning is more complex than mold and makes us slower. I'm fairly concerned of more relocation passes.

Perhaps we can avoid the extra relocation scan in cases where we detect that the max offset is under 2^31?
I'm pretty --no-relax will be unacceptable performance-wise for accessing extern globals.

I doubt that the percentage is going to be large.
But really, global variable accesses really should not be a bottleneck of well-written applications, especially in the oversized server applications.

(Another minor thing is that I think our relocation scanning really needs overhaul to improve performance. This tricky case would add another item to account for when we do the refactoring.)

[aeubanks]

we'd like to have a single configuration across all builds so that people don't have to manually specify -Wl,--[no-]relax
the problems with --no-relax are:

• increases .rela.dyn and .got section sizes
• causes regressions on some microbenchmarks

that's why I'd like to make this work in general without users having to specify flags

if we limit the extra scanning pass to cases where there may be a relocation overflow, so that it doesn't run for most normal-sized binaries, is that still a concern? if other arches already do this sort of thunk creation/relaxation I don't see why x86-64 can't do it

[MaskRay]

In D157020#4570667, @aeubanks wrote:

we'd like to have a single configuration across all builds so that people don't have to manually specify -Wl,--[no-]relax
the problems with --no-relax are:

• increases .rela.dyn and .got section sizes

The .rela.dyn and .got size increase is negligible, mostly in the scale of less than 0.1% VM size.

• causes regressions on some microbenchmarks

that's why I'd like to make this work in general without users having to specify flags

What microbenchmarks? Are they good indicators of real-world application performance?

Note, for relocation overflow mitigation, it's natural to have a separate configuration. You can utilize a linker script using INSERT [AFTER|BEFORE] or --no-relax.

if we limit the extra scanning pass to cases where there may be a relocation overflow, so that it doesn't run for most normal-sized binaries, is that still a concern? if other arches already do this sort of thunk creation/relaxation I don't see why x86-64 can't do it

An extra relocation scanning pass adds conceivable overhead. I am not sure how the pass can be limited. In theory one can add relocation distance metric to somewhere in TargetInfo::relocateAlloc, but this would bring overhead as well.

[aeubanks]

In D157020#4571332, @MaskRay wrote:

In D157020#4570667, @aeubanks wrote:

we'd like to have a single configuration across all builds so that people don't have to manually specify -Wl,--[no-]relax
the problems with --no-relax are:

• increases .rela.dyn and .got section sizes

The .rela.dyn and .got size increase is negligible, mostly in the scale of less than 0.1% VM size.

• causes regressions on some microbenchmarks

that's why I'd like to make this work in general without users having to specify flags

What microbenchmarks? Are they good indicators of real-world application performance?

I can show you exactly which ones internally (and they're consistent even with alignment), although I'll dig into it more first.

Note, for relocation overflow mitigation, it's natural to have a separate configuration. You can utilize a linker script using INSERT [AFTER|BEFORE] or --no-relax.

I'd really like for users not to have to specify flags or linker scripts, those are all unfortunate workarounds when we can just fix this in lld.

if we limit the extra scanning pass to cases where there may be a relocation overflow, so that it doesn't run for most normal-sized binaries, is that still a concern? if other arches already do this sort of thunk creation/relaxation I don't see why x86-64 can't do it

An extra relocation scanning pass adds conceivable overhead. I am not sure how the pass can be limited. In theory one can add relocation distance metric to somewhere in TargetInfo::relocateAlloc, but this would bring overhead as well.

I mean we can check the min/max virtual address and see if it's greater than 2^31. This seems pretty quick and easy and should handle most normal sized binaries, unless I'm missing something?

[aeubanks]

and in general it seems unfortunate to have to pass --no-relax and get suboptimal codegen everywhere in the binary if you have too large of a binary

[aeubanks]

skip extra relocation scan if the max VA offset must be under 2^31-1

[aeubanks]

lld/ELF/Arch/X86_64.cpp

319

@MaskRay is this ok performance wise? this should be very quick and we should skip the expensive stuff below for typical binaries

[aeubanks]

fix .got not getting emitted if it was removed earlier due to being unused by marking it as needed if we see any relaxable GOT_PC relocations

[MaskRay]

lld/ELF/Arch/X86_64.cpp

317

319

if (maxVA - minVA < (uint64_t(1) << 31)) or isUInt<31>(...)

lld/test/ELF/x86-64-gotpc-relax-too-far.s

9

Prefer llvm-readelf -S for new tests. The tabular output is easier to read than llvm-readobj -S

lld/test/ELF/x86-64-gotpc-relax.s

8

Additionally test -S and check that .got has a size of 0.

Add a comment:

##  In our implementation, .got is retained even if all GOT-generating relocations are optimized.

[aeubanks]

address comments

[aeubanks]

update

[MaskRay]

lld/ELF/Arch/X86_64.cpp

319

isUInt<31>(...) is better

lld/ELF/Relocations.cpp

1445

Repeating the complex !sym.isPreemptible && !isAbsoluteValue(sym) && ... condition is error-prone and not nice.

If the intent is to execute in.got->hasGotOffRel.store(true, std::memory_order_relaxed);, just duplicate this statement when expr becomes R_RELAX_GOT_PC

lld/test/ELF/x86-64-gotpc-err.s

10

You move this into x86-64-gotpc-relax-too-far.s but lose this error.

We need another linker script to place .got far away from .text to retain coverage for this error.

lld/test/ELF/x86-64-gotpc-relax.s

16

[aeubanks]

address comments

lld/test/ELF/x86-64-gotpc-err.s

10

Correct me if I'm wrong, but I don't think this was testing a far away .got and that's not what the original patch was doing: https://reviews.llvm.org/D93259.

I can add test coverage for that if you'd like though.

[aeubanks]

lld/test/ELF/x86-64-gotpc-err.s

10

https://github.com/llvm/llvm-project/blob/e6b2525dafbab55e5e7748f3f302bb6a45899511/lld/ELF/Arch/X86_64.cpp#L768 is the check for a far away .got and removing that check at clean ToT doesn't make check-lld fail so I don't think we have test coverage for it

[MaskRay]

lld/test/ELF/x86-64-gotpc-err.s

10

I am not sure what you mean but checkInt(loc, val, 32, rel); in relaxGot is how we get an relocation R_X86_64_REX_GOTPCRELX out of range error for x86-64-gotpc-err.s.

With the current patch, we lose test for relocation R_X86_64_REX_GOTPCRELX out of range. We should do:

We need another linker script to place .got far away from .text to retain coverage for this error.

[aeubanks]

lld/test/ELF/x86-64-gotpc-err.s

10

with this patch, the checkInt in relaxGot should never trigger (I should make it an assert instead). that check isn't the distance to the got, it's the distance to the actual symbol since we only go to relaxGot if we've relaxed the GOT load to a direct reference to the symbol

the check here is what you're referring to the .got is too far away, and we'll only hit that with -Wl,--no-relax. and we don't have any existing test coverage for that checkInt

[aeubanks]

change checkInt in relaxGot to an assert

[MaskRay]

lld/test/ELF/x86-64-gotpc-err.s

10

If checkInt in relaxGot should never trigger, that code should be changed.

We still need a check when .got is more than 2GiB away from the relocated location. It's ok if the message has changed, but we need to test the behavior.

[aeubanks]

lld/test/ELF/x86-64-gotpc-err.s

10

I'll add the .got far away test in a different patch since that's not technically related to this patch.
I've updated the code to be an assert

[MaskRay]

lld/ELF/Arch/X86_64.cpp

331

If R_RELAX_GOT_PC is tested, is R_X86_64_GOTPCRELX/R_X86_64_REX_GOTPCRELX check still necessary?

[aeubanks]

remove R_X86_64_(REX_)GOTPCRELX check

lld/ELF/Arch/X86_64.cpp

331

I was worried that other arches/relocations would use R_RELAX_GOT_PC, but no it's just R_X86_64_GOTPCRELX/R_X86_64_REX_GOTPCRELX, so removed

[aeubanks]

lld/test/ELF/x86-64-gotpc-err.s

10

https://github.com/llvm/llvm-project/pull/67609 for the .got too far test

[MaskRay]

Final nits

lld/ELF/Arch/X86_64.cpp

334

if (isInt<32>(v))

lld/test/ELF/x86-64-gotpc-relax-too-far.s

26

Add an out-of-range __start_data to test two GOT entries?

[aeubanks]

address comments

lld/ELF/Arch/X86_64.cpp

 //===- X86_64.cpp ---------------------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "OutputSections.h"
+#include "Relocations.h"
 #include "Symbols.h"
 #include "SyntheticSections.h"
 #include "Target.h"
 #include "lld/Common/ErrorHandler.h"
 #include "llvm/BinaryFormat/ELF.h"
 #include "llvm/Support/Endian.h"
+#include "llvm/Support/MathExtras.h"
 
 using namespace llvm;
 using namespace llvm::object;
 using namespace llvm::support::endian;
 using namespace llvm::ELF;
 using namespace lld;
 using namespace lld::elf;
 
void applyJumpInstrMod(uint8_t *loc, JumpModType type,
                          unsigned size) const override;
   RelExpr adjustGotPcExpr(RelType type, int64_t addend,
                           const uint8_t *loc) const override;
   void relocateAlloc(InputSectionBase &sec, uint8_t *buf) const override;
   bool adjustPrologueForCrossSplitStack(uint8_t *loc, uint8_t *end,
                                         uint8_t stOther) const override;
   bool deleteFallThruJmpInsn(InputSection &is, InputFile *file,
                              InputSection *nextIS) const override;
+  bool relaxOnce(int pass) const override;
 };
 } // namespace
 
 // This is vector of NOP instructions of sizes from 1 to 8 bytes.  The
 // appropriately sized instructions are used to fill the gaps between sections
 // which are executed during fall through.
 static const std::vector<std::vector<uint8_t>> nopInstructions = {
     {0x90},
bool X86_64::deleteFallThruJmpInsn(InputSection &is, InputFile *file,
   // Cancel R
   r.expr = R_NONE;
   r.offset = 0;
   is.drop_back(sizeOfDirectJmpInsn);
   is.nopFiller = true;
   return true;
 }
 
+bool X86_64::relaxOnce(int pass) const {
+  uint64_t minVA = UINT64_MAX, maxVA = 0;
+  for (OutputSection *osec : outputSections) {
+    minVA = std::min(minVA, osec->addr);
+    maxVA = std::max(maxVA, osec->addr + osec->size);
+  }
+  // If the max VA difference is under 2^31, GOT-generating relocations with a 32-bit range cannot overflow.
+  if (isUInt<31>(maxVA - minVA))
+    return false;
+
+  SmallVector<InputSection *, 0> storage;
+  bool changed = false;
+  for (OutputSection *osec : outputSections) {
+    if (!(osec->flags & SHF_EXECINSTR))
+      continue;
+    for (InputSection *sec : getInputSections(*osec, storage)) {
+      for (Relocation &rel : sec->relocs()) {
+        if (rel.expr != R_RELAX_GOT_PC)
+          continue;
+
+        uint64_t v = sec->getRelocTargetVA(
+            sec->file, rel.type, rel.addend,
+            sec->getOutputSection()->addr + rel.offset, *rel.sym, rel.expr);
+        if (isInt<32>(v))
+          continue;
+        if (rel.sym->auxIdx == 0) {
+          rel.sym->allocateAux();
+          addGotEntry(*rel.sym);
+          changed = true;
+        }
+        rel.expr = R_GOT_PC;
+      }
+    }
+  }
+  return changed;
+}
+
 RelExpr X86_64::getRelExpr(RelType type, const Symbol &s,
                            const uint8_t *loc) const {
   switch (type) {
   case R_X86_64_8:
   case R_X86_64_16:
   case R_X86_64_32:
   case R_X86_64_32S:
   case R_X86_64_64:
static void relaxGotNoPic(uint8_t *loc, uint64_t val, uint8_t op,
   // "INSTRUCTION SET REFERENCE, N-Z" (Vol. 2B 4-1) for
   // descriptions about each operation.
   loc[-2] = 0x81;
   loc[-3] = (rex & ~0x4) | (rex & 0x4) >> 2;
   write32le(loc, val);
 }
 
 static void relaxGot(uint8_t *loc, const Relocation &rel, uint64_t val) {
-  checkInt(loc, val, 32, rel);
+  assert(isInt<32>(val) &&
+         "GOTPCRELX should not have been relaxed if it overflows");
   const uint8_t op = loc[-2];
   const uint8_t modRm = loc[-1];
 
   // Convert "mov foo@GOTPCREL(%rip),%reg" to "lea foo(%rip),%reg".
   if (op == 0x8b) {
     loc[-2] = 0x8d;
     write32le(loc, val);
     return;

lld/ELF/Relocations.h

 };
 
 // This function writes undefined symbol diagnostics to an internal buffer.
 // Call reportUndefinedSymbols() after calling scanRelocations() to emit
 // the diagnostics.
 template <class ELFT> void scanRelocations();
 void reportUndefinedSymbols();
 void postScanRelocations();
+void addGotEntry(Symbol &sym);
 
 void hexagonTLSSymbolUpdate(ArrayRef<OutputSection *> outputSections);
 bool hexagonNeedsTLSSymbol(ArrayRef<OutputSection *> outputSections);
 
 class ThunkSection;
 class Thunk;
 class InputSectionDescription;
 

lld/ELF/Relocations.cpp

static void addPltEntry(PltSection &plt, GotPltSection &gotPlt,
   plt.addEntry(sym);
   gotPlt.addEntry(sym);
   rel.addReloc({type, &gotPlt, sym.getGotPltOffset(),
                 sym.isPreemptible ? DynamicReloc::AgainstSymbol
                                   : DynamicReloc::AddendOnlyWithTargetVA,
                 sym, 0, R_ABS});
 }
 
-static void addGotEntry(Symbol &sym) {
+void elf::addGotEntry(Symbol &sym) {
   in.got->addEntry(sym);
   uint64_t off = sym.getGotOffset();
 
   // If preemptible, emit a GLOB_DAT relocation.
   if (sym.isPreemptible) {
     mainPart->relaDyn->addReloc({target->gotRel, in.got.get(), off,
                                  DynamicReloc::AgainstSymbol, sym, 0, R_ABS});
     return;
if (expr != R_GOT_PC) {
       if (!(config->emachine == EM_HEXAGON &&
             (type == R_HEX_GD_PLT_B22_PCREL ||
              type == R_HEX_GD_PLT_B22_PCREL_X ||
              type == R_HEX_GD_PLT_B32_PCREL_X)))
         expr = fromPlt(expr);
     } else if (!isAbsoluteValue(sym)) {
       expr =
           target->adjustGotPcExpr(type, addend, sec->content().data() + offset);
+      // If the target adjusted the expression to R_RELAX_GOT_PC, we may end up
+      // needing the GOT if we can't relax everything.
+      if (expr == R_RELAX_GOT_PC)
+        in.got->hasGotOffRel.store(true, std::memory_order_relaxed);
     }
   }
 
   // We were asked not to generate PLT entries for ifuncs. Instead, pass the
   // direct relocation on through.
   if (LLVM_UNLIKELY(isIfunc) && config->zIfuncNoplt) {
     std::lock_guard<std::mutex> lock(relocMutex);
     sym.exportDynamic = true;
if ((type == R_PPC64_TLSGD && expr == R_TLSDESC_CALL) ||
 
       // Offset the 4-byte aligned R_PPC64_TLSGD by one byte in the NOTOC case,
       // so we can discern it later from the toc-case.
       if (i->getType(/*isMips64EL=*/false) == R_PPC64_REL24_NOTOC)
         ++offset;
     }
   }
 
   // If the relocation does not emit a GOT or GOTPLT entry but its computation
   // uses their addresses, we need GOT or GOTPLT to be created.
   //
   // The 5 types that relative GOTPLT are all x86 and x86-64 specific.
   if (oneof<R_GOTPLTONLY_PC, R_GOTPLTREL, R_GOTPLT, R_PLT_GOTPLT,
             R_TLSDESC_GOTPLT, R_TLSGD_GOTPLT>(expr)) {
     in.gotPlt->hasGotPltOffRel.store(true, std::memory_order_relaxed);
   } else if (oneof<R_GOTONLY_PC, R_GOTREL, R_PPC32_PLTREL, R_PPC64_TOCBASE,
                    R_PPC64_RELAX_TOC>(expr)) {

lld/ELF/Writer.cpp

if (config->fixCortexA53Errata843419) {
       changed |= a64p.createFixes();
     }
     if (config->fixCortexA8) {
       if (changed)
         script->assignAddresses();
       changed |= a32p.createFixes();
     }
 
+    finalizeSynthetic(in.got.get());
     if (in.mipsGot)
       in.mipsGot->updateAllocSize();
 
     for (Partition &part : partitions) {
       changed |= part.relaDyn->updateAllocSize();
       if (part.relrDyn)
         changed |= part.relrDyn->updateAllocSize();
       if (part.memtagDescriptors)

lld/test/ELF/x86-64-gotpc-err.s

-# REQUIRES: x86
-# RUN: split-file %s %t
-# RUN: llvm-mc -filetype=obj -triple=x86_64 %t/a.s -o %t/a.o
-# RUN: not ld.lld -T %t/lds %t/a.o -o /dev/null 2>&1 | FileCheck %s
-
-## Test diagnostics for GOTPCRELX overflows. In addition, test that there is no
-## `>>> defined in` for linker synthesized __stop_* symbols (there is no
-## associated file or linker script line number).
-
-# CHECK:      error: {{.*}}:(.text+0x2): relocation R_X86_64_GOTPCRELX out of range: 2147483655 is not in [-2147483648, 2147483647]; references '__stop_data'
-# CHECK-NEXT: error: {{.*}}:(.text+0x9): relocation R_X86_64_REX_GOTPCRELX out of range: 2147483648 is not in [-2147483648, 2147483647]; references '__stop_data'
-# CHECK-NOT: error:
-
-#--- a.s
-  movl __stop_data@GOTPCREL(%rip), %eax  # out of range
-  movq __stop_data@GOTPCREL(%rip), %rax  # out of range
-  movq __stop_data@GOTPCREL(%rip), %rax  # in range
-
-.section data,"aw",@progbits
-.space 13
-
-#--- lds
-SECTIONS {
-  .text 0x200000 : { *(.text) }
-  data 0x80200000 : { *(data) }
-}

lld/test/ELF/x86-64-gotpc-relax-too-far.s

+# REQUIRES: x86
+# RUN: split-file %s %t
+# RUN: llvm-mc -filetype=obj -triple=x86_64 %t/a.s -o %t/a.o
+# RUN: ld.lld -T %t/lds1 %t/a.o -o %t/bin
+# RUN: llvm-objdump --no-print-imm-hex -d %t/bin | FileCheck --check-prefix=DISASM %s
+# RUN: llvm-readelf -S %t/bin | FileCheck --check-prefixes=GOT %s
+# RUN: ld.lld -T %t/lds2 %t/a.o -o %t/bin2
+# RUN: llvm-readelf -S %t/bin2 | FileCheck --check-prefixes=UNNECESSARY-GOT %s
+
+# DISASM:      <_foo>:
+# DISASM-NEXT: movl    2097146(%rip), %eax
+# DISASM:      <_start>:
+# DISASM-NEXT: movl    1048578(%rip), %eax
+# DISASM-NEXT: movq    1048571(%rip), %rax
+# DISASM-NEXT: leaq    2147483641(%rip), %rax
+# DISASM-NEXT: leal    2147483635(%rip), %eax
+
+# In our implementation, .got is retained even if all GOT-generating relocations are optimized.
+# Make sure .got still exists with the right size.
+# UNNECESSARY-GOT: .got PROGBITS 0000000000300000 101020 000000 00 WA 0 0 8
+#             GOT: .got PROGBITS 0000000000300000 102000 000010 00 WA 0 0 8
+
+#--- a.s
+.section .text.foo,"ax"
+.globl _foo
+.type _foo, @function
+_foo:
+  movl __start_data@GOTPCREL(%rip), %eax  # out of range
+
+.section .text,"ax"
+.globl _start
+.type _start, @function
+_start:
+  movl __stop_data@GOTPCREL(%rip), %eax  # out of range
+  movq __stop_data@GOTPCREL(%rip), %rax  # out of range
+  movq __stop_data@GOTPCREL(%rip), %rax  # in range
+  movl __stop_data@GOTPCREL(%rip), %eax  # in range
+
+.section data,"aw",@progbits
+.space 13
+
+#--- lds1
+SECTIONS {
+  .text.foo 0x100000 : { *(.text.foo) }
+  .text 0x200000 : { *(.text) }
+  .got 0x300000 : { *(.got) }
+  data 0x80200000 : { *(data) }
+}
+#--- lds2
+SECTIONS {
+  .text.foo 0x100000 : { *(.text.foo) }
+  .text 0x200000 : { *(.text) }
+  .got 0x300000 : { *(.got) }
+  data 0x400000 : { *(data) }
+}

lld/test/ELF/x86-64-gotpc-relax.s

 # REQUIRES: x86
 ## Test R_X86_64_GOTPCRELX and R_X86_64_REX_GOTPCRELX GOT optimization.
 
 # RUN: llvm-mc -filetype=obj -relax-relocations -triple=x86_64-unknown-linux %s -o %t.o
 # RUN: ld.lld %t.o -o %t1 --no-apply-dynamic-relocs
 # RUN: llvm-readelf -S -r -x .got.plt %t1 | FileCheck --check-prefixes=CHECK,NOAPPLY %s
 # RUN: ld.lld %t.o -o %t1 --apply-dynamic-relocs
 # RUN: llvm-readelf -S -r -x .got.plt %t1 | FileCheck --check-prefixes=CHECK,APPLY %s
 # RUN: ld.lld %t.o -o %t1
 # RUN: llvm-objdump --no-print-imm-hex -d %t1 | FileCheck --check-prefix=DISASM %s
 
 ## --no-relax disables GOT optimization.
 # RUN: ld.lld --no-relax %t.o -o %t2
 # RUN: llvm-objdump --no-print-imm-hex -d %t2 | FileCheck --check-prefix=NORELAX %s
 
-## .got is removed as all GOT-generating relocations are optimized.
+## In our implementation, .got is retained even if all GOT-generating relocations are optimized.
 # CHECK:      Name              Type            Address          Off    Size   ES Flg Lk Inf Al
-# CHECK:      .iplt             PROGBITS        0000000000201210 000210 000010 00  AX  0   0 16
-# CHECK-NEXT: .got.plt          PROGBITS        0000000000202220 000220 000008 00  WA  0   0  8
+# CHECK:      .iplt             PROGBITS        0000000000201280 000280 000010 00  AX  0   0 16
+# CHECK-NEXT: .got              PROGBITS        0000000000202290 000290 000000 00  WA  0   0  8
 
 ## There is one R_X86_64_IRELATIVE relocations.
 # RELOC-LABEL: Relocation section '.rela.dyn' at offset {{.*}} contains 1 entry:
 # CHECK:           Offset             Info             Type               Symbol's Value  Symbol's Name + Addend
-# CHECK:       0000000000202220  0000000000000025 R_X86_64_IRELATIVE                        201172
+# CHECK:       0000000000203290  0000000000000025 R_X86_64_IRELATIVE                        2011e2
 # CHECK-LABEL: Hex dump of section '.got.plt':
-# NOAPPLY-NEXT:  0x00202220 00000000 00000000
-# APPLY-NEXT:    0x00202220 72112000 00000000
+# NOAPPLY-NEXT:  0x00203290 00000000 00000000
+# APPLY-NEXT:    0x00203290 e2112000 00000000
 
 # 0x201173 + 7 - 10 = 0x201170
 # 0x20117a + 7 - 17 = 0x201170
 # 0x201181 + 7 - 23 = 0x201171
 # 0x201188 + 7 - 30 = 0x201171
 # DISASM:      Disassembly of section .text:
 # DISASM-EMPTY:
 # DISASM-NEXT: <foo>:
-# DISASM-NEXT:   201170: 90 nop
+# DISASM-NEXT:   2011e0: 90 nop
 # DISASM:      <hid>:
-# DISASM-NEXT:   201171: 90 nop
+# DISASM-NEXT:   2011e1: 90 nop
 # DISASM:      <ifunc>:
-# DISASM-NEXT:   201172: c3 retq
+# DISASM-NEXT:   2011e2: c3 retq
 # DISASM:      <_start>:
 # DISASM-NEXT: leaq -10(%rip), %rax
 # DISASM-NEXT: leaq -17(%rip), %rax
 # DISASM-NEXT: leaq -23(%rip), %rax
 # DISASM-NEXT: leaq -30(%rip), %rax
-# DISASM-NEXT: movq 4234(%rip), %rax
-# DISASM-NEXT: movq 4227(%rip), %rax
+# DISASM-NEXT: movq 8330(%rip), %rax
+# DISASM-NEXT: movq 8323(%rip), %rax
 # DISASM-NEXT: leaq -52(%rip), %rax
 # DISASM-NEXT: leaq -59(%rip), %rax
 # DISASM-NEXT: leaq -65(%rip), %rax
 # DISASM-NEXT: leaq -72(%rip), %rax
-# DISASM-NEXT: movq 4192(%rip), %rax
-# DISASM-NEXT: movq 4185(%rip), %rax
-# DISASM-NEXT: callq 0x201170 <foo>
-# DISASM-NEXT: callq 0x201170 <foo>
-# DISASM-NEXT: callq 0x201171 <hid>
-# DISASM-NEXT: callq 0x201171 <hid>
-# DISASM-NEXT: callq *4155(%rip)
-# DISASM-NEXT: callq *4149(%rip)
-# DISASM-NEXT: jmp   0x201170 <foo>
+# DISASM-NEXT: movq 8288(%rip), %rax
+# DISASM-NEXT: movq 8281(%rip), %rax
+# DISASM-NEXT: callq 0x2011e0 <foo>
+# DISASM-NEXT: callq 0x2011e0 <foo>
+# DISASM-NEXT: callq 0x2011e1 <hid>
+# DISASM-NEXT: callq 0x2011e1 <hid>
+# DISASM-NEXT: callq *8251(%rip)
+# DISASM-NEXT: callq *8245(%rip)
+# DISASM-NEXT: jmp   0x2011e0 <foo>
 # DISASM-NEXT: nop
-# DISASM-NEXT: jmp   0x201170 <foo>
+# DISASM-NEXT: jmp   0x2011e0 <foo>
 # DISASM-NEXT: nop
-# DISASM-NEXT: jmp   0x201171 <hid>
+# DISASM-NEXT: jmp   0x2011e1 <hid>
 # DISASM-NEXT: nop
-# DISASM-NEXT: jmp   0x201171 <hid>
+# DISASM-NEXT: jmp   0x2011e1 <hid>
 # DISASM-NEXT: nop
-# DISASM-NEXT: jmpq  *4119(%rip)
-# DISASM-NEXT: jmpq  *4113(%rip)
+# DISASM-NEXT: jmpq  *8215(%rip)
+# DISASM-NEXT: jmpq  *8209(%rip)
 
 # NORELAX-LABEL: <_start>:
 # NORELAX-COUNT-12: movq
 # NORELAX-COUNT-6:  callq *
 # NORELAX-COUNT-6:  jmpq *
 
 .text
 .globl foo