[ELF] - Implemented optimization for R_X86_64_GOTPCREL relocation.

[grimar]

Summary

System V Application Binary Interface AMD64 Architecture Processor Supplement Draft Version 0.99.8
(https://github.com/hjl-tools/x86-psABI/wiki/x86-64-psABI-r249.pdf, B.2 "B.2 Optimize GOTPCRELX Relocations")
introduces possible relaxations for R_X86_64_GOTPCRELX and R_X86_64_REX_GOTPCRELX.

That patch implements the next relaxation:
mov foo@GOTPCREL(%rip), %reg => lea foo(%rip), %reg
and also opens door for implementing all other ones.

Implementation was suggested by Rafael Ávila de Espíndola with few additions and testcases by myself.

[• rafael]

Do you also intend to also implement the other optimizations listed in the ABI?

ELF/Target.cpp

771

canBePreempted already checks this, no?

test/ELF/gotpc-relax-und-dso.s

25

Use {{.*}} instead of checking the bits.

[grimar]

• Addressed review comments
• Rebased

[grimar]

In D15779#329436, @rafael wrote:

Do you also intend to also implement the other optimizations listed in the ABI?

I have plan to implement all those which listed in "B.2 Optimize GOTPCRELX Relocations":
call *foo@GOTPCREL(%rip) -> nop call foo
call *foo@GOTPCREL(%rip) -> call foo nop
jmp *foo@GOTPCREL(%rip) -> jmp foo nop
mov foo@GOTPCREL(%rip), %reg -> lea foo(%rip), %reg (this patch implements it)

I have no any plans about any others optimizations.

ELF/Target.cpp

771

Looks like so, fixed.

test/ELF/gotpc-relax-und-dso.s

25

I leaved bits specially here. I think for patches that emit binary data it is reasonable to check it.
For example the same instruction can be encoded in a different way. This one patch changes one byte and so I would like to check binary output as well as instructions generated.

[• rafael]

One thing to keep in mind is the possibility of overflow (https://sourceware.org/bugzilla/show_bug.cgi?id=18591). No need to handle it now since llvm is also broken (pr 26208). I will try to fix the LLVM, at which point we should probably check for overflows in lld.

ELF/Target.cpp

41

You are passing -1 in here because the offset is not available, correct?
Is there any point in ever passing the offset if we cannot pass it here?

47

Update the comment to say that we can do mov -> lea with R_X86_64_GOTPCREL, but we need R_X86_64_GOTPCRELX for the other optimizations

51

Could canBePreempted take care of the ifunc check?

[grimar]

ELF/Target.cpp

41

I cannot pass it here, but I still do the check for that place inside canOptimizeGotPcRel().
I just assume that there is not possible to have negative buffer overflow from here.
My point was: since we dont have R_X86_64_GOTPCRELX yet its better to do all possible additional checks. After implementation of R_X86_64_GOTPCRELX we probably can remove it (like we dont check overflows for TLS relaxations, assuming inputs are correct).

Also I am not sure will we still perform relaxation for raw R_X86_64_GOTPCREL then or not (I quess better would be to stop support to be consistent with ABI, but if both gold/bfd do that then it is still safe I think).

47

Ok, I can do that.
I just supposed that since we are not going to implement any other ones before R_X86_64_GOTPCRELX then such comment is excessive.
Current one just describes what we do, not sure if we want to list everything we will not do :)

51

I would not do it.
For example we have the next code currently:

if (!CanBePreempted && Body && isGnuIFunc<ELFT>(*Body))
      Reloc = Target->getIRelativeReloc();

Currently we implemented ifunc for static linking case. But afaik gold/bfd supports dynamic case for which real CBP makes sence. And I am not sure we should cover such special type under clear for understanding canBePreempted() name.

[grimar]

In D15779#330019, @rafael wrote:

One thing to keep in mind is the possibility of overflow (https://sourceware.org/bugzilla/show_bug.cgi?id=18591). No need to handle it now since llvm is also broken (pr 26208). I will try to fix the LLVM, at which point we should probably check for overflows in lld.

That is interesting issue, thaks for info.

[• rafael]

Could canBePreempted take care of the ifunc check?

I would not do it.
For example we have the next code currently:

if (!CanBePreempted && Body && isGnuIFunc<ELFT>(*Body))
      Reloc = Target->getIRelativeReloc();

Currently we implemented ifunc for static linking case. But afaik gold/bfd supports dynamic case for which real CBP makes sence. And I am not sure we should cover such special type under clear for understanding canBePreempted() name.

Good point. Thanks.

Comment at: ELF/Target.cpp:955
@@ -906,1 +954,3 @@

case R_X86_64_GOTPCREL:

+ if (S && canOptimizeGotPcRel(Type, *S, Loc, (uint64_t)-1))

+ optimizeGotPcRel(Loc);

rafael wrote:

You are passing -1 in here because the offset is not available, correct?
Is there any point in ever passing the offset if we cannot pass it here?

I cannot pass it here, but I still do the check for that place inside canOptimizeGotPcRel().
I just assume that there is not possible to have negative buffer overflow from here.
My point was: since we dont have R_X86_64_GOTPCRELX yet its better to do all possible additional checks. After implementation of R_X86_64_GOTPCRELX we probably can remove it (like we dont check overflows for TLS relaxations, assuming inputs are correct).

You would still get a buffer overflow. Say Off is 1. On the first call
you pass 1 and avoid the buffer access. On the second one you pass -1
and still access position -2.

The options I see are

• Save the result of the call.
• Propagate Off to RelocateOne
• Don't check it.

I would go with 3 for now.

[grimar]

In D15779#330316, @rafael wrote:

Could canBePreempted take care of the ifunc check?

I would not do it.
For example we have the next code currently:

if (!CanBePreempted && Body && isGnuIFunc<ELFT>(*Body))
      Reloc = Target->getIRelativeReloc();

Currently we implemented ifunc for static linking case. But afaik gold/bfd supports dynamic case for which real CBP makes sence. And I am not sure we should cover such special type under clear for understanding canBePreempted() name.

Good point. Thanks.

Comment at: ELF/Target.cpp:955
@@ -906,1 +954,3 @@

case R_X86_64_GOTPCREL:

+ if (S && canOptimizeGotPcRel(Type, *S, Loc, (uint64_t)-1))

+ optimizeGotPcRel(Loc);

rafael wrote:

You are passing -1 in here because the offset is not available, correct?
Is there any point in ever passing the offset if we cannot pass it here?

I cannot pass it here, but I still do the check for that place inside canOptimizeGotPcRel().
I just assume that there is not possible to have negative buffer overflow from here.
My point was: since we dont have R_X86_64_GOTPCRELX yet its better to do all possible additional checks. After implementation of R_X86_64_GOTPCRELX we probably can remove it (like we dont check overflows for TLS relaxations, assuming inputs are correct).

You would still get a buffer overflow. Say Off is 1. On the first call
you pass 1 and avoid the buffer access. On the second one you pass -1
and still access position -2.

Yes, I know, as "overflow" I was mean that there would not be access violation in that place.
(It is not possible to get it here I believe because of lot of other data in front of buffer before relocations).
So the worst thing could happen is a possible read of some side data at second check. But at least one correct check would still be performed (first one).

The options I see are

• Save the result of the call.
• Propagate Off to RelocateOne
• Don't check it.

I would go with 3 for now.

I am agree with that. Now I think that having partial checks is no better than absence of them here.

[grimar]

Lots of tests started to crash if I remove the "Off <= 2" check. I think that was the reason why I added that initially.

25> lld :: ELF/dynamic-reloc-weak.s
25> lld :: ELF/got.s
25> lld :: ELF/gotpc-relax-und-dso.s
25> lld :: ELF/local-got-shared.s
25> lld :: ELF/local-got.s
25> lld :: ELF/relocation.s
25> lld :: ELF/relro.s

For example ELF/local-got.s which has

_start:
	call bar@gotpcrel

So it looks would be better or to leave check as is for now or to add Off argument to RelocateOne.
I think we should check the buffer somehow to have correct solution. So I would add the argument.

[grimar]

In D15779#330411, @grimar wrote:

Lots of tests started to crash if I remove the "Off <= 2" check. I think that was the reason why I added that initially.

I`ll recheck the reasons of it and how to fix that tomorrow. Probably I am mistaken about that Off argument is needed. Will update the patch then.

[ruiu]

This is not a comment for this particular patch, but in general, pieces of code for code relaxation are scattered to many places -- you have multiple calls of canXXX and call optimizeXXX at some place. It tend to hard to understand. Each patch doesn't increase complexity that much, but when they accumulate, they look being entangled.

Can we separate code relaxation from relocation application? I think that we can create a function that visits all relocations and rewrite code and possibly relocations to relax code, and call that function before applying relocations. Then when we are applying relocations, we don't need to think about code relaxation at all. Anyway, I'd like to find some way to reduce complexity of relocation application.

[grimar]

In D15779#330631, @ruiu wrote:

This is not a comment for this particular patch, but in general, pieces of code for code relaxation are scattered to many places -- you have multiple calls of canXXX and call optimizeXXX at some place. It tend to hard to understand. Each patch doesn't increase complexity that much, but when they accumulate, they look being entangled.

Can we separate code relaxation from relocation application? I think that we can create a function that visits all relocations and rewrite code and possibly relocations to relax code, and call that function before applying relocations. Then when we are applying relocations, we don't need to think about code relaxation at all. Anyway, I'd like to find some way to reduce complexity of relocation application.

I need to think about how possible to do that better. In general that looks for me like additional pass through all relocations and marking them or excluding from futher pass. Idea itself looks attractive for me, but I afraid of possible code duplication that might happen in that case.
Also do you mean you want to see that change before landing any other relaxation patch or its fine to make it right after current pending ones (there are two of them from my side now at reviews: http://reviews.llvm.org/D16201, http://reviews.llvm.org/D15779) ?

[grimar]

• Addressed review comments.
• Removed Off argument.
• Added error message for case when relocation overflow happens during relaxation.

[grimar]

In D15779#330019, @rafael wrote:

One thing to keep in mind is the possibility of overflow (https://sourceware.org/bugzilla/show_bug.cgi?id=18591). No need to handle it now since llvm is also broken (pr 26208). I will try to fix the LLVM, at which point we should probably check for overflows in lld.

Regarding this I added error message to relocateOne() and that have 2 problems:

1. I just unsure how to find out the overflow and not convert mov->lea before we already applying relocations in relocateOne(). I need to find out the distance between symbol and instructions really early to use canOptimizeGotPcRel() method for avoiding create of GOT entries and so on.
2. I did not include the test for it, because it creates 4gb file, I am not sure that is good for test. But I used sample from https://sourceware.org/bugzilla/show_bug.cgi?id=18591 to check that error is displaying.

[• rafael]

ELF/Target.cpp

804

This highlights Rui's comment that we are spreading optimizations out too much. A relocation being relative or not should really not depend on it being optimized. If it is optimized, some other relocation takes its place.

Can you just check for optimization at the caller and pass the new relocation value?

[• rafael]

Or, we should try not computing the size upfront:

It might be possible to avoid this by outputting the file with write:
* Write the allocated output sections, computing addresses.
* Apply relocations, recording which ones require a dynamic reloc.
* Write the dynamic relocations.
// * Write the rest of the file.

[grimar]

X86_64TargetInfo::canOptimizeGotPcRel() needs to have check for "_DYNAMIC" symbol either (since we almost have it, http://reviews.llvm.org/D17607) + testcase.
Both gold/bfd does not apply such optimization for it.

[grimar]

That patch was old, so I:

• Rebased it
• Added _DYNAMIC symbol ignore.
• Reformated the testcases.

[grimar]

• Reimplemented to match updated relocations handling code.

[grimar]

Rebased to fit with the latest llvm and lld code.

[grimar]

Note: this version does not check the instuction op code and does not relax with common gotpcrel relocation.
I think it is save and correct now just to handle R_X86_64_REX_GOTPCRELX one for what this patch do.
This approach simplifies the code a little and should be fully compatible with ABI now.

[• rafael]

ELF/Target.cpp

709

I would probably have this return R_GOT_PC and then have a generic logic for "can we optimize this got use". This would be somewhat similar to the fact that we optimize plt acesses to local symbols.

713

Why is _DYNAMIC special?

The other checks are not architecture specific and should be in architecture independent code.

[grimar]

• Reimplemented in more generic way (addressed review comments).

ELF/Target.cpp

709

Done, reimplemented in more generic way.

713

That is something directly mentioned in docs I think, but initially in binutils there also were no exception for _DYNAMIC,
and they had to do that finally because it turns out ld.so uses it:
https://sourceware.org/ml/binutils/2012-09/msg00000.html

[grimar]

ELF/Target.cpp

707–708

Something *not* mentioned, I mean.

[grimar]

I am reworking this, it was not correct to remove opcode check (I was for some reason thinking that R_X86_64_REX_GOTPCRELX is generated specially for mov->lea relaxation),
so I plan to update this soon.

[grimar]

• Restored removed earlier by mistake a check of opcode for mov->lea conversion.
• Updated code and testcases to produce/relax R_X86_64_GOTPCRELX.

[• rafael]

looking

[• rafael]

ELF/InputSection.h

67 ↗

(On Diff #58087)

It is a bit surprising to see this here. If the got access is relaxed, it result will not refer to a got entry, no?

ELF/Target.cpp

370

I am pretty sure this reference to "_DYNAMIC" is bogus. The email you posted refers to got[0], but we write that value directly. This code will never be used for that.

1007

Every target would have to call this, no? Why not call it from target independent code?

1011

It is not clear why you need this. relocateOne has a value check. Why you need one here?

[• rafael]

ELF/Writer.cpp

288

I don't think you can do an early return here. You should set Expr and let the function continue so we get the checks.

[• rafael]

I decided to apply the patch to give it a better review.

Some of the issues I pointed out in the review (R_RELAX_GOT referring
to got entry) were the causes of other changes (unnecessary continue).

Also, the *GOTPCRELX relocations can always be relaxed if the symbol
is not ifunc or preemptable, no? It is just that it is not always a
mov->lea.

In any case, I have attached the result of simplifying your patch a
bit. Let me know what you think.

Cheers,
Rafael

• t.diff10 KBDownload

[grimar]

In D15779#437390, @rafael wrote:

I decided to apply the patch to give it a better review.

Some of the issues I pointed out in the review (R_RELAX_GOT referring
to got entry) were the causes of other changes (unnecessary continue).

Thanks !

Also, the *GOTPCRELX relocations can always be relaxed if the symbol
is not ifunc or preemptable, no? It is just that it is not always a
mov->lea.

Sure, but this patch supports only mov->lea conversion. So for our case
I decided to check that instruction is exactly mov, because of next:

In any case, I have attached the result of simplifying your patch a
bit. Let me know what you think.

I think it looks better than mine, but it have an issue:
Imagine you have next code to relax:

.text
.globl foo
.type foo, @function
foo:
 nop

.text
.globl _start
 call	*foo@GOTPCREL(%rip)

Since your patch does not check the mov opcode before relaxing, it "relax" that to lea instead
of "nop call foo" or "call foo nop". That is because relaxGot() does not yet know about how to relax the other
instructions yet.

Cheers,
Rafael

• t.diff10 KBDownload

If you dont mind, I`ll use your code as a base, will fix the issue above, add the testcase for it and update.
(I also plan to add other relaxations, but I wonder will it be better to do that in this patch or separatelly,
I`ll take a look how to do that cleaner, probably implementing all of them at once can help to simplify
the patch, probably not).

ELF/Target.cpp

1011

It would write something like "relocation R_X86_64_PC32 is out of range". That does not imo provide enough
info here about what really happened.
Ideally we just should not do that relaxation if we know that overflow happens.

[grimar]

In D15779#437390, @rafael wrote:

I decided to apply the patch to give it a better review.

Some of the issues I pointed out in the review (R_RELAX_GOT referring
to got entry) were the causes of other changes (unnecessary continue).

Also, the *GOTPCRELX relocations can always be relaxed if the symbol
is not ifunc or preemptable, no? It is just that it is not always a
mov->lea.

In any case, I have attached the result of simplifying your patch a
bit. Let me know what you think.

Cheers,
Rafael

• t.diff10 KBDownload

Rafael, returning to this, I have few thoughts now.

Latest x64 ABI describes 3 possible groups of relaxations atm (https://github.com/hjl-tools/x86-psABI/wiki/X86-psABI):

1. Convert call and jump
2. Convert mov->lea
3. Convert Test and Binop Convert memory operand of test and binop into

immediate operand, where binop is one of adc, add, and, cmp, or,
sbb, sub, xor instructions, when position-independent code is disabled.

If there was no 3, we probably would be able to leave R_RELAX_GOT_PC expression assigning
logic as is and just teach relaxGot() to relax all of them at once. If do that at once, that would help to avoid
the op code checks anywhere except relaxGot() itself.

But 3 says that depending on PIC for a specific set of instruction relaxation is possible or not.

That probably does not leave us a chance for above and solution I see is introduce Target method
canGotBeRelaxed() or something, which will check the instructions opcodes, like:

bool canGotBeRelaxed() {
if (call or jump or move opcodes) 
  return true;
if (Test or given binop opcodes)
  return !PIC:
return false; //I guess it is possible to have instructions that can not be relaxed even if RELX relaxation is present ?
}

and call it from adjustExpr(). What do you think ?

[• rafael]

Rafael, returning to this, I have few thoughts now.

Latest x64 ABI describes 3 possible groups of relaxations atm (https://github.com/hjl-tools/x86-psABI/wiki/X86-psABI):

1. Convert call and jump
2. Convert mov->lea
3. Convert Test and Binop Convert memory operand of test and binop into

immediate operand, where binop is one of adc, add, and, cmp, or,
sbb, sub, xor instructions, when position-independent code is disabled.

If there was no 3, we probably would be able to leave R_RELAX_GOT_PC expression assigning
logic as is and just teach relaxGot() to relax all of them at once. If do that at once, that would help to avoid
the op code checks anywhere except relaxGot() itself.

But 3 says that depending on PIC for a specific set of instruction relaxation is possible or not.

That probably does not leave us a chance for above and solution I see is introduce Target method
canGotBeRelaxed() or something, which will check the instructions opcodes, like:

bool canGotBeRelaxed() {
if (call or jump or move opcodes)
  return true;
if (Test or given binop opcodes)
  return !PIC:
return false; //I guess it is possible to have instructions that can not be relaxed even if RELX relaxation is present ?
}

and call it from adjustExpr(). What do you think ?

Yes, I missed that case 3 is non pic only :-(

Given that we don't want to complicate the interface of getRelExpr, I
think that, relative to my patch, what is needed is

• Delete R_RELAXABLE_GOT_PC, getRelExpr returns just R_GOT_PC.
• In Writer.cpp, the code
  
  if (Expr == R_RELAXABLE_GOT_PC)

becomes

if (Expr == R_GOT_PC && Target->canRelaxGot(....))

Given that we will need the predicate, I would leave this patch doing
just mov -> lea for now.

Cheers,
Rafael

[grimar]

In D15779#438263, @rafael wrote:

Given that we will need the predicate, I would leave this patch doing
just mov -> lea for now.

Cheers,
Rafael

Was this about this patch only or it means I should suspend working on
other relaxations for following patches either ?

George.

[grimar]

In D15779#438263, @rafael wrote:

Given that we will need the predicate, I would leave this patch doing
just mov -> lea for now.

Cheers,
Rafael

Ah, I misread. Please ignore my previous comment.

[grimar]

• Updated code according to Rafael's directions.
• Updated testcase to check few other instructions (that them are not converted to lea).

[grimar]

• Rebased to top

[• rafael]

LGTM with nits.

Thank you so much for caring this over some many redesigns. I am very happy to see that this fits nicely in the existing infrastructure.

ELF/Relocations.cpp

345 ↗

(On Diff #58404)

Don't make uintX_t a template parameter. You can just use ELFT::uint

490 ↗

(On Diff #58404)

Use the existing variable Buf.

ELF/Target.cpp

708

Now this is just moving the label, please leave it in the original location.

1005

Converting

[• rafael]

LGTM wit nits. See the webpage for the nits, phab is not sending
emails again :-(

[grimar]

In D15779#439090, @rafael wrote:

LGTM with nits.

Thank you so much for caring this over some many redesigns. I am very happy to see that this fits nicely in the existing infrastructure.

Thank you for all that reviews and final code suggestion. Btw today is exactly 5 month from first time this was posted :)

ELF/InputSection.cpp

if (Target->isTlsGlobalDynamicRel(Type) &&
       continue;
     }
 
     uintX_t SymVA = Body.getVA<ELFT>(A);
     uint8_t *PairedLoc = nullptr;
     if (Config->EMachine == EM_MIPS)
       PairedLoc = findMipsPairedReloc(Buf, &RI, Rels.end());
 
+    if (Target->doRelax(Type, Body, AddrLoc, SymVA, BufLoc))
+      continue;
+
     if (Target->needsPlt<ELFT>(Type, Body)) {
       SymVA = Body.getPltVA<ELFT>() + A;
     } else if (Target->needsGot(Type, Body)) {
       if (Config->EMachine == EM_MIPS)
         SymVA = getMipsGotVA<ELFT>(Body, SymVA, BufLoc, PairedLoc) + A;
       else
         SymVA = Body.getGotVA<ELFT>() + A;
       if (Body.IsTls)

ELF/Target.h

public:
   template <class ELFT>
   PltNeed needsPlt(uint32_t Type, const SymbolBody &S) const;
 
   virtual void relocateOne(uint8_t *Loc, uint8_t *BufEnd, uint32_t Type,
                            uint64_t P, uint64_t SA, uint64_t ZA = 0,
                            uint8_t *PairedLoc = nullptr) const = 0;
   virtual bool isGotRelative(uint32_t Type) const;
   bool canRelaxTls(uint32_t Type, const SymbolBody *S) const;
+  virtual uint32_t getRelaxed(uint32_t Type, const SymbolBody &S,
+                              const uint8_t *Loc) const;
+  virtual bool doRelax(uint32_t Type, const SymbolBody &S, uint64_t P,
+                       uint64_t SA, uint8_t *Loc) const;
   template <class ELFT>
   bool needsCopyRel(uint32_t Type, const SymbolBody &S) const;
   size_t relaxTls(uint8_t *Loc, uint8_t *BufEnd, uint32_t Type, uint64_t P,
                   uint64_t SA, const SymbolBody &S) const;
   virtual ~TargetInfo();
 
   unsigned PageSize = 4096;
 

ELF/Target.cpp

 namespace lld {
 namespace elf {
 
 TargetInfo *Target;
 
 template <endianness E> static void add32(void *P, int32_t V) {
   write32<E>(P, read32<E>(P) + V);
 }
 
 static void add32le(uint8_t *P, int32_t V) { add32<support::little>(P, V); }
 static void or32le(uint8_t *P, int32_t V) { write32le(P, read32le(P) | V); }
 
 template <unsigned N> static void checkInt(int64_t V, uint32_t Type) {
   if (isInt<N>(V))
     return;
   StringRef S = getELFRelocationTypeName(Config->EMachine, Type);
   error("relocation " + S + " out of range");
 }
 
 template <unsigned N> static void checkUInt(uint64_t V, uint32_t Type) {
   if (isUInt<N>(V))
     return;
   StringRef S = getELFRelocationTypeName(Config->EMachine, Type);
   error("relocation " + S + " out of range");
 }
 
 template <unsigned N> static void checkIntUInt(uint64_t V, uint32_t Type) {
public:
 
   bool isGotRelative(uint32_t Type) const override;
   bool refersToGotEntry(uint32_t Type) const override;
 };
 
 class X86_64TargetInfo final : public TargetInfo {
 public:
   X86_64TargetInfo();
+  bool doRelax(uint32_t Type, const SymbolBody &S, uint64_t P, uint64_t SA,
+               uint8_t *Loc) const override;
   uint32_t getTlsGotRel(uint32_t Type) const override;
   bool pointsToLocalDynamicGotEntry(uint32_t Type) const override;
   bool isTlsLocalDynamicRel(uint32_t Type) const override;
   bool isTlsGlobalDynamicRel(uint32_t Type) const override;
   bool isTlsInitialExecRel(uint32_t Type) const override;
   void writeGotPltHeader(uint8_t *Buf) const override;
   void writeGotPlt(uint8_t *Buf, uint64_t Plt) const override;
   void writePltZero(uint8_t *Buf) const override;
   void writePlt(uint8_t *Buf, uint64_t GotEntryAddr, uint64_t PltEntryAddr,
                 int32_t Index, unsigned RelOff) const override;
   bool needsCopyRelImpl(uint32_t Type) const override;
   bool needsGot(uint32_t Type, SymbolBody &S) const override;
   bool refersToGotEntry(uint32_t Type) const override;
   bool needsPltImpl(uint32_t Type) const override;
   void relocateOne(uint8_t *Loc, uint8_t *BufEnd, uint32_t Type, uint64_t P,
                    uint64_t SA, uint64_t ZA = 0,
                    uint8_t *PairedLoc = nullptr) const override;
   bool isRelRelative(uint32_t Type) const override;
   bool isSizeRel(uint32_t Type) const override;
+  uint32_t getRelaxed(uint32_t Type, const SymbolBody &S,
+                      const uint8_t *Loc) const override;
 
   size_t relaxTlsGdToIe(uint8_t *Loc, uint8_t *BufEnd, uint32_t Type,
                         uint64_t P, uint64_t SA) const override;
   size_t relaxTlsGdToLe(uint8_t *Loc, uint8_t *BufEnd, uint32_t Type,
                         uint64_t P, uint64_t SA) const override;
   size_t relaxTlsIeToLe(uint8_t *Loc, uint8_t *BufEnd, uint32_t Type,
                         uint64_t P, uint64_t SA) const override;
   size_t relaxTlsLdToLe(uint8_t *Loc, uint8_t *BufEnd, uint32_t Type,
bool TargetInfo::canRelaxTls(uint32_t Type, const SymbolBody *S) const {
   // Initial-Exec relocs can be relaxed to Local-Exec if the symbol is locally
   // defined.
   if (isTlsInitialExecRel(Type))
     return !S->isPreemptible();
 
   return false;
 }
 
+uint32_t TargetInfo::getRelaxed(uint32_t Type, const SymbolBody &S,
+                                const uint8_t *Loc) const {
+  return Type;
+}
+
 uint64_t TargetInfo::getVAStart() const { return Config->Pic ? 0 : VAStart; }
 
 bool TargetInfo::needsCopyRelImpl(uint32_t Type) const { return false; }
 
 template <typename ELFT> static bool mayNeedCopy(const SymbolBody &S) {
   if (Config->Shared)
     return false;
   auto *SS = dyn_cast<SharedSymbol<ELFT>>(&S);
   if (!SS)
     return false;
   return SS->Sym.getType() == STT_OBJECT;
 }
 
+bool TargetInfo::doRelax(uint32_t Type, const SymbolBody &S, uint64_t P,
+                         uint64_t SA, uint8_t *Loc) const {
+  return false;
+}
+
 template <class ELFT>
 bool TargetInfo::needsCopyRel(uint32_t Type, const SymbolBody &S) const {
   return mayNeedCopy<ELFT>(S) && needsCopyRelImpl(Type);
 }
 
 bool TargetInfo::isGotRelative(uint32_t Type) const { return false; }
 bool TargetInfo::isHintRel(uint32_t Type) const { return false; }
 bool TargetInfo::isRelRelative(uint32_t Type) const { return true; }
bool TargetInfo::isTlsGlobalDynamicRel(uint32_t Type) const {
   return false;
 }
 
 size_t TargetInfo::relaxTls(uint8_t *Loc, uint8_t *BufEnd, uint32_t Type,
                             uint64_t P, uint64_t SA,
                             const SymbolBody &S) const {
   if (isTlsGlobalDynamicRel(Type)) {
     if (S.isPreemptible())
       return relaxTlsGdToIe(Loc, BufEnd, Type, P, SA);
     return relaxTlsGdToLe(Loc, BufEnd, Type, P, SA);
   }
   if (isTlsLocalDynamicRel(Type))
     return relaxTlsLdToLe(Loc, BufEnd, Type, P, SA);
   assert(isTlsInitialExecRel(Type));
   return relaxTlsIeToLe(Loc, BufEnd, Type, P, SA);
 }
 
X86_64TargetInfo::X86_64TargetInfo() {
   PltRel = R_X86_64_JUMP_SLOT;
   RelativeRel = R_X86_64_RELATIVE;
   IRelativeRel = R_X86_64_IRELATIVE;
   TlsGotRel = R_X86_64_TPOFF64;
   TlsModuleIndexRel = R_X86_64_DTPMOD64;
   TlsOffsetRel = R_X86_64_DTPOFF64;
   UseLazyBinding = true;
   PltEntrySize = 16;
   PltZeroSize = 16;
 }
 
 void X86_64TargetInfo::writeGotPltHeader(uint8_t *Buf) const {
   write64le(Buf, Out<ELF64LE>::Dynamic->getVA());
 }
 
 void X86_64TargetInfo::writeGotPlt(uint8_t *Buf, uint64_t Plt) const {
   // See comments in X86TargetInfo::writeGotPlt.
   write32le(Buf, Plt + 6);
 }
 
 void X86_64TargetInfo::writePltZero(uint8_t *Buf) const {
   const uint8_t PltData[] = {
       0xff, 0x35, 0x00, 0x00, 0x00, 0x00, // pushq GOT+8(%rip)

 
 uint32_t X86_64TargetInfo::getTlsGotRel(uint32_t Type) const {
   // No other types of TLS relocations requiring GOT should
   // reach here.
   assert(Type == R_X86_64_GOTTPOFF);
   return R_X86_64_PC32;
 }
 
 bool X86_64TargetInfo::isTlsInitialExecRel(uint32_t Type) const {
   return Type == R_X86_64_GOTTPOFF;
 }
 
 bool X86_64TargetInfo::isTlsGlobalDynamicRel(uint32_t Type) const {
   return Type == R_X86_64_TLSGD;
 }
 
 bool X86_64TargetInfo::pointsToLocalDynamicGotEntry(uint32_t Type) const {
bool X86_64TargetInfo::isRelRelative(uint32_t Type) const {
   case R_X86_64_DTPOFF32:
   case R_X86_64_DTPOFF64:
   case R_X86_64_PC8:
   case R_X86_64_PC16:
   case R_X86_64_PC32:
   case R_X86_64_PC64:
   case R_X86_64_PLT32:
     return true;
   }
 }
 
 bool X86_64TargetInfo::isSizeRel(uint32_t Type) const {
   return Type == R_X86_64_SIZE32 || Type == R_X86_64_SIZE64;
 }
 
 // "Ulrich Drepper, ELF Handling For Thread-Local Storage" (5.5
 // x86-x64 linker optimizations, http://www.akkadia.org/drepper/tls.pdf) shows
const uint8_t Inst[] = {
       0x66,                                                //.byte 0x66
       0x64, 0x48, 0x8b, 0x04, 0x25, 0x00, 0x00, 0x00, 0x00 // mov %fs:0,%rax
   };
   memcpy(Loc - 3, Inst, sizeof(Inst));
   // The next relocation should be against __tls_get_addr, so skip it
   return 1;
 }
 
+uint32_t X86_64TargetInfo::getRelaxed(uint32_t Type, const SymbolBody &S,
+                                      const uint8_t *Loc) const {
+  if (Type != R_X86_64_GOTPCREL)
+    return Type;
+  if (Loc[-2] != 0x8b || S.isPreemptible())
+    return Type;
+  if (S.isGnuIfunc<ELF64LE>())
+    return Type;
+  if (S.getName() == "_DYNAMIC")
+    return Type;
+  return R_X86_64_PC32;
+}
+
+bool X86_64TargetInfo::doRelax(uint32_t Type, const SymbolBody &S, uint64_t P,
+                               uint64_t SA, uint8_t *Loc) const {
+  if (getRelaxed(Type, S, Loc) == Type)
+    return false;
+
+  if (SA - P + 0x80000000 > 0xFFFFFFFF)
+    error("R_X86_64_GOTPCREL relaxation overflow");
+
+  Loc[-2] = 0x8d;
+  write32le(Loc, SA - P);
+  return true;
+}
+
 void X86_64TargetInfo::relocateOne(uint8_t *Loc, uint8_t *BufEnd, uint32_t Type,
                                    uint64_t P, uint64_t SA, uint64_t ZA,
                                    uint8_t *PairedLoc) const {
   switch (Type) {
   case R_X86_64_32:
     checkUInt<32>(SA, Type);
     write32le(Loc, SA);
     break;
void X86_64TargetInfo::relocateOne(uint8_t *Loc, uint8_t *BufEnd, uint32_t Type,
   }
 }
 
 // Relocation masks following the #lo(value), #hi(value), #ha(value),
 // #higher(value), #highera(value), #highest(value), and #highesta(value)
 // macros defined in section 4.5.1. Relocation Types of the PPC-elf64abi
 // document.
 static uint16_t applyPPCLo(uint64_t V) { return V; }
 static uint16_t applyPPCHi(uint64_t V) { return V >> 16; }
 static uint16_t applyPPCHa(uint64_t V) { return (V + 0x8000) >> 16; }
 static uint16_t applyPPCHigher(uint64_t V) { return V >> 32; }
 static uint16_t applyPPCHighera(uint64_t V) { return (V + 0x8000) >> 32; }
 static uint16_t applyPPCHighest(uint64_t V) { return V >> 48; }
 static uint16_t applyPPCHighesta(uint64_t V) { return (V + 0x8000) >> 48; }
 
 PPCTargetInfo::PPCTargetInfo() {}
 bool PPCTargetInfo::isRelRelative(uint32_t Type) const { return false; }
 
 void PPCTargetInfo::relocateOne(uint8_t *Loc, uint8_t *BufEnd, uint32_t Type,
                                 uint64_t P, uint64_t SA, uint64_t ZA,
                                 uint8_t *PairedLoc) const {
   switch (Type) {
   case R_PPC_ADDR16_HA:

ELF/Writer.cpp

if (!Target->canRelaxTls(Type, &Body)) {
         Out<ELFT>::RelaDyn->addReloc({Target->TlsModuleIndexRel,
                                       DynamicReloc<ELFT>::Off_GTlsIndex,
                                       &Body});
         Out<ELFT>::RelaDyn->addReloc(
             {Target->TlsOffsetRel, DynamicReloc<ELFT>::Off_GTlsOffset, &Body});
       }
       return true;
     }
     if (!Body.isPreemptible())
       return true;
   }
   return false;
 }
 
 // The reason we have to do this early scan is as follows
 // * To mmap the output file, we need to know the size
 // * For that, we need to know how many dynamic relocs we will have.
if (NeedPlt) {
           continue;
         Out<ELFT>::Got->addEntry(Body);
         Out<ELFT>::RelaDyn->addReloc(
             {Target->GotRel, DynamicReloc<ELFT>::Off_Got, &Body});
       }
       continue;
     }
 
+    const uint8_t *Data = C.getSectionData().data();
+    Type = Target->getRelaxed(Type, Body, Data + RI.r_offset);
+
     // If a relocation needs GOT, we create a GOT slot for the symbol.
     if (Target->needsGot(Type, Body)) {
       if (Body.isInGot())
         continue;
       Out<ELFT>::Got->addEntry(Body);
 
       if (Config->EMachine == EM_MIPS) {
         // MIPS ABI has special rules to process GOT entries

test/ELF/Inputs/gotpc-relax-und-dso.s

+.globl dsofoo
+.type dsofoo, @function
+dsofoo:
+ nop

test/ELF/gotpc-relax-und-dso.s

+# REQUIRES: x86
+# RUN: llvm-mc -filetype=obj -triple=x86_64-unknown-linux %s -o %t.o
+# RUN: llvm-mc -filetype=obj -triple=x86_64-pc-linux %S/Inputs/gotpc-relax-und-dso.s -o %tdso.o
+# RUN: ld.lld -shared %tdso.o -o %t.so
+# RUN: ld.lld -shared %t.o %t.so -o %tout
+# RUN: llvm-readobj -r -s %tout | FileCheck --check-prefix=RELOC %s
+# RUN: llvm-objdump -d %tout | FileCheck --check-prefix=DISASM %s
+
+# RELOC:      Relocations [
+# RELOC-NEXT:   Section ({{.*}}) .rela.dyn {
+# RELOC-NEXT:     0x20A0 R_X86_64_GLOB_DAT und 0x0
+# RELOC-NEXT:     0x20A8 R_X86_64_GLOB_DAT dsofoo 0x0
+# RELOC-NEXT:     0x20B0 R_X86_64_GLOB_DAT foo 0x0
+# RELOC-NEXT:     0x20B8 R_X86_64_RELATIVE - 0x2000
+# RELOC-NEXT:   }
+# RELOC-NEXT: ]
+
+# 0x101e + 7 - 36 = 0x1001
+# 0x1025 + 7 - 43 = 0x1001
+# DISASM:      Disassembly of section .text:
+# DISASM-NEXT: foo:
+# DISASM-NEXT:     1000: 90 nop
+# DISASM:      hid:
+# DISASM-NEXT:     1001: 90 nop
+# DISASM:      _start:
+# DISASM-NEXT:     1002: 48 8b 05 97 10 00 00 movq 4247(%rip), %rax
+# DISASM-NEXT:     1009: 48 8b 05 90 10 00 00 movq 4240(%rip), %rax
+# DISASM-NEXT:     1010: 48 8b 05 91 10 00 00 movq 4241(%rip), %rax
+# DISASM-NEXT:     1017: 48 8b 05 8a 10 00 00 movq 4234(%rip), %rax
+# DISASM-NEXT:     101e: 48 8d 05 dc ff ff ff leaq -36(%rip), %rax
+# DISASM-NEXT:     1025: 48 8d 05 d5 ff ff ff leaq -43(%rip), %rax
+# DISASM-NEXT:     102c: 48 8b 05 7d 10 00 00 movq 4221(%rip), %rax
+# DISASM-NEXT:     1033: 48 8b 05 76 10 00 00 movq 4214(%rip), %rax
+# DISASM-NEXT:     103a: 48 8b 05 77 10 00 00 movq 4215(%rip), %rax
+# DISASM-NEXT:     1041: 48 8b 05 70 10 00 00 movq 4208(%rip), %rax
+
+.text
+.globl foo
+.type foo, @function
+foo:
+ nop
+
+.globl hid
+.hidden hid
+.type hid, @function
+hid:
+ nop
+
+.globl _start
+.type _start, @function
+_start:
+ movq und@GOTPCREL(%rip), %rax
+ movq und@GOTPCREL(%rip), %rax
+ movq dsofoo@GOTPCREL(%rip), %rax
+ movq dsofoo@GOTPCREL(%rip), %rax
+ movq hid@GOTPCREL(%rip), %rax
+ movq hid@GOTPCREL(%rip), %rax
+ movq foo@GOTPCREL(%rip), %rax
+ movq foo@GOTPCREL(%rip), %rax
+ movq _DYNAMIC@GOTPCREL(%rip), %rax
+ movq _DYNAMIC@GOTPCREL(%rip), %rax

test/ELF/gotpc-relax.s

+# REQUIRES: x86
+# RUN: llvm-mc -filetype=obj -triple=x86_64-unknown-linux %s -o %t.o
+# RUN: ld.lld %t.o -o %t1
+# RUN: llvm-readobj -r %t1 | FileCheck --check-prefix=RELOC %s
+# RUN: llvm-objdump -d %t1 | FileCheck --check-prefix=DISASM %s
+
+## There is no R_X86_64_GLOB_DAT relocations.
+# RELOC:      Relocations [
+# RELOC-NEXT:  Section ({{.*}}) .rela.plt {
+# RELOC-NOT:    R_X86_64_GLOB_DAT
+
+# 0x11003 + 7 - 10 = 0x11000
+# 0x1100a + 7 - 17 = 0x11000
+# 0x11011 + 7 - 23 = 0x11001
+# 0x11018 + 7 - 30 = 0x11001
+# DISASM:      Disassembly of section .text:
+# DISASM-NEXT: foo:
+# DISASM-NEXT:   11000: 90 nop
+# DISASM:      hid:
+# DISASM-NEXT:   11001: 90 nop
+# DISASM:      ifunc:
+# DISASM-NEXT:   11002: c3 retq
+# DISASM:      _start:
+# DISASM-NEXT: 11003: 48 8d 05 f6 ff ff ff leaq -10(%rip), %rax
+# DISASM-NEXT: 1100a: 48 8d 05 ef ff ff ff leaq -17(%rip), %rax
+# DISASM-NEXT: 11011: 48 8d 05 e9 ff ff ff leaq -23(%rip), %rax
+# DISASM-NEXT: 11018: 48 8d 05 e2 ff ff ff leaq -30(%rip), %rax
+# DISASM-NEXT: 1101f: 48 8b 05 1a 00 00 00 movq 26(%rip), %rax
+# DISASM-NEXT: 11026: 48 8b 05 13 00 00 00 movq 19(%rip), %rax
+
+.text
+.globl foo
+.type foo, @function
+foo:
+ nop
+
+.globl hid
+.hidden hid
+.type hid, @function
+hid:
+ nop
+
+.text
+.type ifunc STT_GNU_IFUNC
+.globl ifunc
+.type ifunc, @function
+ifunc:
+ ret
+
+.globl _start
+.type _start, @function
+_start:
+ movq foo@GOTPCREL(%rip), %rax
+ movq foo@GOTPCREL(%rip), %rax
+ movq hid@GOTPCREL(%rip), %rax
+ movq hid@GOTPCREL(%rip), %rax
+ movq ifunc@GOTPCREL(%rip), %rax
+ movq ifunc@GOTPCREL(%rip), %rax