[ELF] - Implemented optimization for R_X86_64_GOTPCREL relocation.

[grimar]

Summary

System V Application Binary Interface AMD64 Architecture Processor Supplement Draft Version 0.99.8
(https://github.com/hjl-tools/x86-psABI/wiki/x86-64-psABI-r249.pdf, B.2 "B.2 Optimize GOTPCRELX Relocations")
introduces possible relaxations for R_X86_64_GOTPCRELX and R_X86_64_REX_GOTPCRELX.

That patch implements the next relaxation:
mov foo@GOTPCREL(%rip), %reg => lea foo(%rip), %reg
and also opens door for implementing all other ones.

Implementation was suggested by Rafael Ávila de Espíndola with few additions and testcases by myself.

[• rafael]

Do you also intend to also implement the other optimizations listed in the ABI?

ELF/Target.cpp

796

canBePreempted already checks this, no?

test/ELF/gotpc-relax-und-dso.s

25

Use {{.*}} instead of checking the bits.

[grimar]

• Addressed review comments
• Rebased

[grimar]

In D15779#329436, @rafael wrote:

Do you also intend to also implement the other optimizations listed in the ABI?

I have plan to implement all those which listed in "B.2 Optimize GOTPCRELX Relocations":
call *foo@GOTPCREL(%rip) -> nop call foo
call *foo@GOTPCREL(%rip) -> call foo nop
jmp *foo@GOTPCREL(%rip) -> jmp foo nop
mov foo@GOTPCREL(%rip), %reg -> lea foo(%rip), %reg (this patch implements it)

I have no any plans about any others optimizations.

ELF/Target.cpp

796

Looks like so, fixed.

test/ELF/gotpc-relax-und-dso.s

25

I leaved bits specially here. I think for patches that emit binary data it is reasonable to check it.
For example the same instruction can be encoded in a different way. This one patch changes one byte and so I would like to check binary output as well as instructions generated.

[• rafael]

One thing to keep in mind is the possibility of overflow (https://sourceware.org/bugzilla/show_bug.cgi?id=18591). No need to handle it now since llvm is also broken (pr 26208). I will try to fix the LLVM, at which point we should probably check for overflows in lld.

ELF/Target.cpp

29

You are passing -1 in here because the offset is not available, correct?
Is there any point in ever passing the offset if we cannot pass it here?

35

Update the comment to say that we can do mov -> lea with R_X86_64_GOTPCREL, but we need R_X86_64_GOTPCRELX for the other optimizations

39

Could canBePreempted take care of the ifunc check?

[grimar]

ELF/Target.cpp

29

I cannot pass it here, but I still do the check for that place inside canOptimizeGotPcRel().
I just assume that there is not possible to have negative buffer overflow from here.
My point was: since we dont have R_X86_64_GOTPCRELX yet its better to do all possible additional checks. After implementation of R_X86_64_GOTPCRELX we probably can remove it (like we dont check overflows for TLS relaxations, assuming inputs are correct).

Also I am not sure will we still perform relaxation for raw R_X86_64_GOTPCREL then or not (I quess better would be to stop support to be consistent with ABI, but if both gold/bfd do that then it is still safe I think).

35

Ok, I can do that.
I just supposed that since we are not going to implement any other ones before R_X86_64_GOTPCRELX then such comment is excessive.
Current one just describes what we do, not sure if we want to list everything we will not do :)

39

I would not do it.
For example we have the next code currently:

if (!CanBePreempted && Body && isGnuIFunc<ELFT>(*Body))
      Reloc = Target->getIRelativeReloc();

Currently we implemented ifunc for static linking case. But afaik gold/bfd supports dynamic case for which real CBP makes sence. And I am not sure we should cover such special type under clear for understanding canBePreempted() name.

[grimar]

In D15779#330019, @rafael wrote:

One thing to keep in mind is the possibility of overflow (https://sourceware.org/bugzilla/show_bug.cgi?id=18591). No need to handle it now since llvm is also broken (pr 26208). I will try to fix the LLVM, at which point we should probably check for overflows in lld.

That is interesting issue, thaks for info.

[• rafael]

Could canBePreempted take care of the ifunc check?

I would not do it.
For example we have the next code currently:

if (!CanBePreempted && Body && isGnuIFunc<ELFT>(*Body))
      Reloc = Target->getIRelativeReloc();

Currently we implemented ifunc for static linking case. But afaik gold/bfd supports dynamic case for which real CBP makes sence. And I am not sure we should cover such special type under clear for understanding canBePreempted() name.

Good point. Thanks.

Comment at: ELF/Target.cpp:955
@@ -906,1 +954,3 @@

case R_X86_64_GOTPCREL:

+ if (S && canOptimizeGotPcRel(Type, *S, Loc, (uint64_t)-1))

+ optimizeGotPcRel(Loc);

rafael wrote:

You are passing -1 in here because the offset is not available, correct?
Is there any point in ever passing the offset if we cannot pass it here?

I cannot pass it here, but I still do the check for that place inside canOptimizeGotPcRel().
I just assume that there is not possible to have negative buffer overflow from here.
My point was: since we dont have R_X86_64_GOTPCRELX yet its better to do all possible additional checks. After implementation of R_X86_64_GOTPCRELX we probably can remove it (like we dont check overflows for TLS relaxations, assuming inputs are correct).

You would still get a buffer overflow. Say Off is 1. On the first call
you pass 1 and avoid the buffer access. On the second one you pass -1
and still access position -2.

The options I see are

• Save the result of the call.
• Propagate Off to RelocateOne
• Don't check it.

I would go with 3 for now.

[grimar]

In D15779#330316, @rafael wrote:

Could canBePreempted take care of the ifunc check?

I would not do it.
For example we have the next code currently:

if (!CanBePreempted && Body && isGnuIFunc<ELFT>(*Body))
      Reloc = Target->getIRelativeReloc();

Currently we implemented ifunc for static linking case. But afaik gold/bfd supports dynamic case for which real CBP makes sence. And I am not sure we should cover such special type under clear for understanding canBePreempted() name.

Good point. Thanks.

Comment at: ELF/Target.cpp:955
@@ -906,1 +954,3 @@

case R_X86_64_GOTPCREL:

+ if (S && canOptimizeGotPcRel(Type, *S, Loc, (uint64_t)-1))

+ optimizeGotPcRel(Loc);

rafael wrote:

You are passing -1 in here because the offset is not available, correct?
Is there any point in ever passing the offset if we cannot pass it here?

I cannot pass it here, but I still do the check for that place inside canOptimizeGotPcRel().
I just assume that there is not possible to have negative buffer overflow from here.
My point was: since we dont have R_X86_64_GOTPCRELX yet its better to do all possible additional checks. After implementation of R_X86_64_GOTPCRELX we probably can remove it (like we dont check overflows for TLS relaxations, assuming inputs are correct).

You would still get a buffer overflow. Say Off is 1. On the first call
you pass 1 and avoid the buffer access. On the second one you pass -1
and still access position -2.

Yes, I know, as "overflow" I was mean that there would not be access violation in that place.
(It is not possible to get it here I believe because of lot of other data in front of buffer before relocations).
So the worst thing could happen is a possible read of some side data at second check. But at least one correct check would still be performed (first one).

The options I see are

• Save the result of the call.
• Propagate Off to RelocateOne
• Don't check it.

I would go with 3 for now.

I am agree with that. Now I think that having partial checks is no better than absence of them here.

[grimar]

Lots of tests started to crash if I remove the "Off <= 2" check. I think that was the reason why I added that initially.

25> lld :: ELF/dynamic-reloc-weak.s
25> lld :: ELF/got.s
25> lld :: ELF/gotpc-relax-und-dso.s
25> lld :: ELF/local-got-shared.s
25> lld :: ELF/local-got.s
25> lld :: ELF/relocation.s
25> lld :: ELF/relro.s

For example ELF/local-got.s which has

_start:
	call bar@gotpcrel

So it looks would be better or to leave check as is for now or to add Off argument to RelocateOne.
I think we should check the buffer somehow to have correct solution. So I would add the argument.

[grimar]

In D15779#330411, @grimar wrote:

Lots of tests started to crash if I remove the "Off <= 2" check. I think that was the reason why I added that initially.

I`ll recheck the reasons of it and how to fix that tomorrow. Probably I am mistaken about that Off argument is needed. Will update the patch then.

[ruiu]

This is not a comment for this particular patch, but in general, pieces of code for code relaxation are scattered to many places -- you have multiple calls of canXXX and call optimizeXXX at some place. It tend to hard to understand. Each patch doesn't increase complexity that much, but when they accumulate, they look being entangled.

Can we separate code relaxation from relocation application? I think that we can create a function that visits all relocations and rewrite code and possibly relocations to relax code, and call that function before applying relocations. Then when we are applying relocations, we don't need to think about code relaxation at all. Anyway, I'd like to find some way to reduce complexity of relocation application.

[grimar]

In D15779#330631, @ruiu wrote:

This is not a comment for this particular patch, but in general, pieces of code for code relaxation are scattered to many places -- you have multiple calls of canXXX and call optimizeXXX at some place. It tend to hard to understand. Each patch doesn't increase complexity that much, but when they accumulate, they look being entangled.

Can we separate code relaxation from relocation application? I think that we can create a function that visits all relocations and rewrite code and possibly relocations to relax code, and call that function before applying relocations. Then when we are applying relocations, we don't need to think about code relaxation at all. Anyway, I'd like to find some way to reduce complexity of relocation application.

I need to think about how possible to do that better. In general that looks for me like additional pass through all relocations and marking them or excluding from futher pass. Idea itself looks attractive for me, but I afraid of possible code duplication that might happen in that case.
Also do you mean you want to see that change before landing any other relaxation patch or its fine to make it right after current pending ones (there are two of them from my side now at reviews: http://reviews.llvm.org/D16201, http://reviews.llvm.org/D15779) ?

[grimar]

• Addressed review comments.
• Removed Off argument.
• Added error message for case when relocation overflow happens during relaxation.

[grimar]

In D15779#330019, @rafael wrote:

One thing to keep in mind is the possibility of overflow (https://sourceware.org/bugzilla/show_bug.cgi?id=18591). No need to handle it now since llvm is also broken (pr 26208). I will try to fix the LLVM, at which point we should probably check for overflows in lld.

Regarding this I added error message to relocateOne() and that have 2 problems:

1. I just unsure how to find out the overflow and not convert mov->lea before we already applying relocations in relocateOne(). I need to find out the distance between symbol and instructions really early to use canOptimizeGotPcRel() method for avoiding create of GOT entries and so on.
2. I did not include the test for it, because it creates 4gb file, I am not sure that is good for test. But I used sample from https://sourceware.org/bugzilla/show_bug.cgi?id=18591 to check that error is displaying.

[• rafael]

ELF/Target.cpp

835

This highlights Rui's comment that we are spreading optimizations out too much. A relocation being relative or not should really not depend on it being optimized. If it is optimized, some other relocation takes its place.

Can you just check for optimization at the caller and pass the new relocation value?

[• rafael]

Or, we should try not computing the size upfront:

It might be possible to avoid this by outputting the file with write:
* Write the allocated output sections, computing addresses.
* Apply relocations, recording which ones require a dynamic reloc.
* Write the dynamic relocations.
// * Write the rest of the file.

[grimar]

X86_64TargetInfo::canOptimizeGotPcRel() needs to have check for "_DYNAMIC" symbol either (since we almost have it, http://reviews.llvm.org/D17607) + testcase.
Both gold/bfd does not apply such optimization for it.

[grimar]

That patch was old, so I:

• Rebased it
• Added _DYNAMIC symbol ignore.
• Reformated the testcases.

[grimar]

• Reimplemented to match updated relocations handling code.

[grimar]

Rebased to fit with the latest llvm and lld code.

[grimar]

Note: this version does not check the instuction op code and does not relax with common gotpcrel relocation.
I think it is save and correct now just to handle R_X86_64_REX_GOTPCRELX one for what this patch do.
This approach simplifies the code a little and should be fully compatible with ABI now.

[• rafael]

ELF/Target.cpp

707

Why is _DYNAMIC special?

The other checks are not architecture specific and should be in architecture independent code.

724

I would probably have this return R_GOT_PC and then have a generic logic for "can we optimize this got use". This would be somewhat similar to the fact that we optimize plt acesses to local symbols.

[grimar]

• Reimplemented in more generic way (addressed review comments).

ELF/Target.cpp

707

That is something directly mentioned in docs I think, but initially in binutils there also were no exception for _DYNAMIC,
and they had to do that finally because it turns out ld.so uses it:
https://sourceware.org/ml/binutils/2012-09/msg00000.html

724

Done, reimplemented in more generic way.

[grimar]

ELF/Target.cpp

717–720

Something *not* mentioned, I mean.

[grimar]

I am reworking this, it was not correct to remove opcode check (I was for some reason thinking that R_X86_64_REX_GOTPCRELX is generated specially for mov->lea relaxation),
so I plan to update this soon.

[grimar]

• Restored removed earlier by mistake a check of opcode for mov->lea conversion.
• Updated code and testcases to produce/relax R_X86_64_GOTPCRELX.

[• rafael]

looking

[• rafael]

ELF/InputSection.h

55–56

It is a bit surprising to see this here. If the got access is relaxed, it result will not refer to a got entry, no?

ELF/Target.cpp

362

I am pretty sure this reference to "_DYNAMIC" is bogus. The email you posted refers to got[0], but we write that value directly. This code will never be used for that.

1000

Every target would have to call this, no? Why not call it from target independent code?

1004

It is not clear why you need this. relocateOne has a value check. Why you need one here?

[• rafael]

ELF/Writer.cpp

415

I don't think you can do an early return here. You should set Expr and let the function continue so we get the checks.

[• rafael]

I decided to apply the patch to give it a better review.

Some of the issues I pointed out in the review (R_RELAX_GOT referring
to got entry) were the causes of other changes (unnecessary continue).

Also, the *GOTPCRELX relocations can always be relaxed if the symbol
is not ifunc or preemptable, no? It is just that it is not always a
mov->lea.

In any case, I have attached the result of simplifying your patch a
bit. Let me know what you think.

Cheers,
Rafael

• t.diff10 KBDownload

[grimar]

In D15779#437390, @rafael wrote:

I decided to apply the patch to give it a better review.

Some of the issues I pointed out in the review (R_RELAX_GOT referring
to got entry) were the causes of other changes (unnecessary continue).

Thanks !

Also, the *GOTPCRELX relocations can always be relaxed if the symbol
is not ifunc or preemptable, no? It is just that it is not always a
mov->lea.

Sure, but this patch supports only mov->lea conversion. So for our case
I decided to check that instruction is exactly mov, because of next:

In any case, I have attached the result of simplifying your patch a
bit. Let me know what you think.

I think it looks better than mine, but it have an issue:
Imagine you have next code to relax:

.text
.globl foo
.type foo, @function
foo:
 nop

.text
.globl _start
 call	*foo@GOTPCREL(%rip)

Since your patch does not check the mov opcode before relaxing, it "relax" that to lea instead
of "nop call foo" or "call foo nop". That is because relaxGot() does not yet know about how to relax the other
instructions yet.

Cheers,
Rafael

• t.diff10 KBDownload

If you dont mind, I`ll use your code as a base, will fix the issue above, add the testcase for it and update.
(I also plan to add other relaxations, but I wonder will it be better to do that in this patch or separatelly,
I`ll take a look how to do that cleaner, probably implementing all of them at once can help to simplify
the patch, probably not).

ELF/Target.cpp

1004

It would write something like "relocation R_X86_64_PC32 is out of range". That does not imo provide enough
info here about what really happened.
Ideally we just should not do that relaxation if we know that overflow happens.

[grimar]

In D15779#437390, @rafael wrote:

I decided to apply the patch to give it a better review.

Some of the issues I pointed out in the review (R_RELAX_GOT referring
to got entry) were the causes of other changes (unnecessary continue).

Also, the *GOTPCRELX relocations can always be relaxed if the symbol
is not ifunc or preemptable, no? It is just that it is not always a
mov->lea.

In any case, I have attached the result of simplifying your patch a
bit. Let me know what you think.

Cheers,
Rafael

• t.diff10 KBDownload

Rafael, returning to this, I have few thoughts now.

Latest x64 ABI describes 3 possible groups of relaxations atm (https://github.com/hjl-tools/x86-psABI/wiki/X86-psABI):

1. Convert call and jump
2. Convert mov->lea
3. Convert Test and Binop Convert memory operand of test and binop into

immediate operand, where binop is one of adc, add, and, cmp, or,
sbb, sub, xor instructions, when position-independent code is disabled.

If there was no 3, we probably would be able to leave R_RELAX_GOT_PC expression assigning
logic as is and just teach relaxGot() to relax all of them at once. If do that at once, that would help to avoid
the op code checks anywhere except relaxGot() itself.

But 3 says that depending on PIC for a specific set of instruction relaxation is possible or not.

That probably does not leave us a chance for above and solution I see is introduce Target method
canGotBeRelaxed() or something, which will check the instructions opcodes, like:

bool canGotBeRelaxed() {
if (call or jump or move opcodes) 
  return true;
if (Test or given binop opcodes)
  return !PIC:
return false; //I guess it is possible to have instructions that can not be relaxed even if RELX relaxation is present ?
}

and call it from adjustExpr(). What do you think ?

[• rafael]

Rafael, returning to this, I have few thoughts now.

Latest x64 ABI describes 3 possible groups of relaxations atm (https://github.com/hjl-tools/x86-psABI/wiki/X86-psABI):

1. Convert call and jump
2. Convert mov->lea
3. Convert Test and Binop Convert memory operand of test and binop into

immediate operand, where binop is one of adc, add, and, cmp, or,
sbb, sub, xor instructions, when position-independent code is disabled.

If there was no 3, we probably would be able to leave R_RELAX_GOT_PC expression assigning
logic as is and just teach relaxGot() to relax all of them at once. If do that at once, that would help to avoid
the op code checks anywhere except relaxGot() itself.

But 3 says that depending on PIC for a specific set of instruction relaxation is possible or not.

That probably does not leave us a chance for above and solution I see is introduce Target method
canGotBeRelaxed() or something, which will check the instructions opcodes, like:

bool canGotBeRelaxed() {
if (call or jump or move opcodes)
  return true;
if (Test or given binop opcodes)
  return !PIC:
return false; //I guess it is possible to have instructions that can not be relaxed even if RELX relaxation is present ?
}

and call it from adjustExpr(). What do you think ?

Yes, I missed that case 3 is non pic only :-(

Given that we don't want to complicate the interface of getRelExpr, I
think that, relative to my patch, what is needed is

• Delete R_RELAXABLE_GOT_PC, getRelExpr returns just R_GOT_PC.
• In Writer.cpp, the code
  
  if (Expr == R_RELAXABLE_GOT_PC)

becomes

if (Expr == R_GOT_PC && Target->canRelaxGot(....))

Given that we will need the predicate, I would leave this patch doing
just mov -> lea for now.

Cheers,
Rafael

[grimar]

In D15779#438263, @rafael wrote:

Given that we will need the predicate, I would leave this patch doing
just mov -> lea for now.

Cheers,
Rafael

Was this about this patch only or it means I should suspend working on
other relaxations for following patches either ?

George.

[grimar]

In D15779#438263, @rafael wrote:

Given that we will need the predicate, I would leave this patch doing
just mov -> lea for now.

Cheers,
Rafael

Ah, I misread. Please ignore my previous comment.

[grimar]

• Updated code according to Rafael's directions.
• Updated testcase to check few other instructions (that them are not converted to lea).

[grimar]

• Rebased to top

[• rafael]

LGTM with nits.

Thank you so much for caring this over some many redesigns. I am very happy to see that this fits nicely in the existing infrastructure.

ELF/Relocations.cpp

345 ↗

(On Diff #58404)

Don't make uintX_t a template parameter. You can just use ELFT::uint

490 ↗

(On Diff #58404)

Use the existing variable Buf.

ELF/Target.cpp

723

Now this is just moving the label, please leave it in the original location.

998

Converting

[• rafael]

LGTM wit nits. See the webpage for the nits, phab is not sending
emails again :-(

[grimar]

In D15779#439090, @rafael wrote:

LGTM with nits.

Thank you so much for caring this over some many redesigns. I am very happy to see that this fits nicely in the existing infrastructure.

Thank you for all that reviews and final code suggestion. Btw today is exactly 5 month from first time this was posted :)

ELF/InputSection.h

enum RelExpr {
   R_MIPS_GP0,
   R_PAGE_PC,
   R_PC,
   R_PLT,
   R_PLT_PC,
   R_PPC_OPD,
   R_PPC_PLT_OPD,
   R_PPC_TOC,
+  R_X86_RELAX_GOT_PC,
   R_RELAX_TLS_GD_TO_IE,
   R_RELAX_TLS_GD_TO_IE_PC,
   R_RELAX_TLS_GD_TO_LE,
   R_RELAX_TLS_IE_TO_LE,
   R_RELAX_TLS_LD_TO_LE,
   R_SIZE,
   R_THUNK,
   R_TLSGD,
   R_TLSGD_PC,
   R_TLSLD,
   R_TLSLD_PC
 };
 
 struct Relocation {
   RelExpr Expr;
   uint32_t Type;
   uint64_t Offset;
   uint64_t Addend;
   SymbolBody *Sym;
 };
 
 // This corresponds to a section of an input file.

ELF/InputSection.cpp

if (Out<ELF64BE>::Opd) {
       uint64_t OpdEnd = OpdStart + Out<ELF64BE>::Opd->getSize();
       bool InOpd = OpdStart <= SymVA && SymVA < OpdEnd;
       if (InOpd)
         SymVA = read64be(&Out<ELF64BE>::OpdBuf[SymVA - OpdStart]);
     }
     return SymVA - P;
   }
   case R_PC:
+  case R_X86_RELAX_GOT_PC:
     return Body.getVA<ELFT>(A) - P;
   case R_PAGE_PC:
     return getAArch64Page(Body.getVA<ELFT>(A)) - getAArch64Page(P);
   }
   llvm_unreachable("Invalid expression");
 }
 
 template <class ELFT>
for (const Relocation &Rel : Relocations) {
     }
 
     if (Expr == R_PPC_PLT_OPD) {
       uint32_t Nop = 0x60000000;
       if (BufLoc + 8 <= BufEnd && read32be(BufLoc + 4) == Nop)
         write32be(BufLoc + 4, 0xe8410028); // ld %r2, 40(%r1)
     }
 
+    if (Expr == R_X86_RELAX_GOT_PC) {
+      if (SymVA + 0x80000000 > 0xFFFFFFFF)
+        error("R_X86_64_GOTPCREL[X] relaxation overflow");
+      BufLoc[-2] = 0x8d;
+      Type = R_X86_64_PC32;
+    }
+
     Target->relocateOne(BufLoc, Type, SymVA);
   }
 }
 
 template <class ELFT> void InputSection<ELFT>::writeTo(uint8_t *Buf) {
   if (this->Header->sh_type == SHT_NOBITS)
     return;
   ELFFile<ELFT> &EObj = this->File->getObj();

ELF/Target.h

public:
   enum PltNeed { Plt_No, Plt_Explicit, Plt_Implicit };
   PltNeed needsPlt(uint32_t Type, const SymbolBody &S) const;
 
   virtual bool needsThunk(uint32_t Type, const InputFile &File,
                           const SymbolBody &S) const;
 
   virtual void writeThunk(uint8_t *Buf, uint64_t S) const {}
 
-  virtual RelExpr getRelExpr(uint32_t Type, const SymbolBody &S) const = 0;
+  virtual RelExpr getRelExpr(uint32_t Type, const SymbolBody &S,
+                             const uint8_t *Loc) const = 0;
   virtual void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const = 0;
   virtual bool isGotRelative(uint32_t Type) const;
   bool canRelaxTls(uint32_t Type, const SymbolBody *S) const;
   template <class ELFT>
   bool needsCopyRel(uint32_t Type, const SymbolBody &S) const;
   virtual ~TargetInfo();
 
   unsigned TlsGdToLeSkip = 1;

ELF/Target.cpp

 #include "OutputSections.h"
 #include "Symbols.h"
 
 #include "llvm/ADT/ArrayRef.h"
 #include "llvm/Object/ELF.h"
 #include "llvm/Support/Endian.h"
 #include "llvm/Support/ELF.h"
 
 using namespace llvm;
 using namespace llvm::object;
 using namespace llvm::support::endian;
 using namespace llvm::ELF;
 
 namespace lld {
 namespace elf {
 
 TargetInfo *Target;
 
 static void or32le(uint8_t *P, int32_t V) { write32le(P, read32le(P) | V); }
 
 template <unsigned N> static void checkInt(int64_t V, uint32_t Type) {
   if (isInt<N>(V))
     return;
   StringRef S = getELFRelocationTypeName(Config->EMachine, Type);
   error("relocation " + S + " out of range");
 }
 
template <unsigned N> static void checkAlignment(uint64_t V, uint32_t Type) {
   StringRef S = getELFRelocationTypeName(Config->EMachine, Type);
   error("improper alignment for relocation " + S);
 }
 
 namespace {
 class X86TargetInfo final : public TargetInfo {
 public:
   X86TargetInfo();
-  RelExpr getRelExpr(uint32_t Type, const SymbolBody &S) const override;
+  RelExpr getRelExpr(uint32_t Type, const SymbolBody &S,
+                     const uint8_t *Loc) const override;
   uint64_t getImplicitAddend(const uint8_t *Buf, uint32_t Type) const override;
   void writeGotPltHeader(uint8_t *Buf) const override;
   uint32_t getDynRel(uint32_t Type) const override;
   uint32_t getTlsGotRel(uint32_t Type) const override;
   bool pointsToLocalDynamicGotEntry(uint32_t Type) const override;
   bool isTlsLocalDynamicRel(uint32_t Type) const override;
   bool isTlsGlobalDynamicRel(uint32_t Type) const override;
   bool isTlsInitialExecRel(uint32_t Type) const override;
public:
 
   bool isGotRelative(uint32_t Type) const override;
   bool refersToGotEntry(uint32_t Type) const override;
 };
 
 class X86_64TargetInfo final : public TargetInfo {
 public:
   X86_64TargetInfo();
-  RelExpr getRelExpr(uint32_t Type, const SymbolBody &S) const override;
+  RelExpr getRelExpr(uint32_t Type, const SymbolBody &S,
+                     const uint8_t *Loc) const override;
   uint32_t getDynRel(uint32_t Type) const override;
   uint32_t getTlsGotRel(uint32_t Type) const override;
   bool pointsToLocalDynamicGotEntry(uint32_t Type) const override;
   bool isTlsLocalDynamicRel(uint32_t Type) const override;
   bool isTlsGlobalDynamicRel(uint32_t Type) const override;
   bool isTlsInitialExecRel(uint32_t Type) const override;
   void writeGotPltHeader(uint8_t *Buf) const override;
   void writeGotPlt(uint8_t *Buf, uint64_t Plt) const override;
   void writePltZero(uint8_t *Buf) const override;
   void writePlt(uint8_t *Buf, uint64_t GotEntryAddr, uint64_t PltEntryAddr,
                 int32_t Index, unsigned RelOff) const override;
   bool needsCopyRelImpl(uint32_t Type) const override;
   bool needsGot(uint32_t Type, const SymbolBody &S) const override;
   bool refersToGotEntry(uint32_t Type) const override;
   bool needsPltImpl(uint32_t Type) const override;
   void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
   bool isRelRelative(uint32_t Type) const override;
   bool isSizeRel(uint32_t Type) const override;
 
   void relaxTlsGdToIe(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
   void relaxTlsGdToLe(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
   void relaxTlsIeToLe(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
   void relaxTlsLdToLe(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
+
+private:
+  bool canRelaxGotPCRel(const SymbolBody &S, const uint8_t *Loc) const;
 };
 
 class PPCTargetInfo final : public TargetInfo {
 public:
   PPCTargetInfo();
   void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
   bool isRelRelative(uint32_t Type) const override;
-  RelExpr getRelExpr(uint32_t Type, const SymbolBody &S) const override;
+  RelExpr getRelExpr(uint32_t Type, const SymbolBody &S,
+                     const uint8_t *Loc) const override;
 };
 
 class PPC64TargetInfo final : public TargetInfo {
 public:
   PPC64TargetInfo();
-  RelExpr getRelExpr(uint32_t Type, const SymbolBody &S) const override;
+  RelExpr getRelExpr(uint32_t Type, const SymbolBody &S,
+                     const uint8_t *Loc) const override;
   void writePlt(uint8_t *Buf, uint64_t GotEntryAddr, uint64_t PltEntryAddr,
                 int32_t Index, unsigned RelOff) const override;
   bool needsGot(uint32_t Type, const SymbolBody &S) const override;
   bool needsPltImpl(uint32_t Type) const override;
   void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
   bool isRelRelative(uint32_t Type) const override;
 };
 
 class AArch64TargetInfo final : public TargetInfo {
 public:
   AArch64TargetInfo();
-  RelExpr getRelExpr(uint32_t Type, const SymbolBody &S) const override;
+  RelExpr getRelExpr(uint32_t Type, const SymbolBody &S,
+                     const uint8_t *Loc) const override;
   uint32_t getDynRel(uint32_t Type) const override;
   bool isTlsGlobalDynamicRel(uint32_t Type) const override;
   bool isTlsInitialExecRel(uint32_t Type) const override;
   void writeGotPlt(uint8_t *Buf, uint64_t Plt) const override;
   void writePltZero(uint8_t *Buf) const override;
   void writePlt(uint8_t *Buf, uint64_t GotEntryAddr, uint64_t PltEntryAddr,
                 int32_t Index, unsigned RelOff) const override;
   uint32_t getTlsGotRel(uint32_t Type) const override;

 private:
   static const uint64_t TcbSize = 16;
 };
 
 class AMDGPUTargetInfo final : public TargetInfo {
 public:
   AMDGPUTargetInfo() {}
   void relocateOne(uint8_t *Loc, uint32_t Type, uint64_t Val) const override;
-  RelExpr getRelExpr(uint32_t Type, const SymbolBody &S) const override;
+  RelExpr getRelExpr(uint32_t Type, const SymbolBody &S,
+                     const uint8_t *Loc) const override;
 };
 
 template <class ELFT> class MipsTargetInfo final : public TargetInfo {
 public:
   MipsTargetInfo();
-  RelExpr getRelExpr(uint32_t Type, const SymbolBody &S) const override;
+  RelExpr getRelExpr(uint32_t Type, const SymbolBody &S,
+                     const uint8_t *Loc) const override;
   uint64_t getImplicitAddend(const uint8_t *Buf, uint32_t Type) const override;
   uint32_t getDynRel(uint32_t Type) const override;
   void writeGotPlt(uint8_t *Buf, uint64_t Plt) const override;
   void writePltZero(uint8_t *Buf) const override;
   void writePlt(uint8_t *Buf, uint64_t GotEntryAddr, uint64_t PltEntryAddr,
                 int32_t Index, unsigned RelOff) const override;
   void writeGotHeader(uint8_t *Buf) const override;
   void writeThunk(uint8_t *Buf, uint64_t S) const override;
bool TargetInfo::isTlsGlobalDynamicRel(uint32_t Type) const {
   return false;
 }
 
 void TargetInfo::relaxTlsGdToLe(uint8_t *Loc, uint32_t Type,
                                 uint64_t Val) const {
   llvm_unreachable("Should not have claimed to be relaxable");
 }
 
 void TargetInfo::relaxTlsGdToIe(uint8_t *Loc, uint32_t Type,
                                 uint64_t Val) const {
   llvm_unreachable("Should not have claimed to be relaxable");
 }
 
 void TargetInfo::relaxTlsIeToLe(uint8_t *Loc, uint32_t Type,
                                 uint64_t Val) const {
   llvm_unreachable("Should not have claimed to be relaxable");
 }
X86TargetInfo::X86TargetInfo() {
   TlsModuleIndexRel = R_386_TLS_DTPMOD32;
   TlsOffsetRel = R_386_TLS_DTPOFF32;
   UseLazyBinding = true;
   PltEntrySize = 16;
   PltZeroSize = 16;
   TlsGdToLeSkip = 2;
 }
 
-RelExpr X86TargetInfo::getRelExpr(uint32_t Type, const SymbolBody &S) const {
+RelExpr X86TargetInfo::getRelExpr(uint32_t Type, const SymbolBody &S,
+                                  const uint8_t *Loc) const {
   switch (Type) {
   default:
     return R_ABS;
   case R_386_PLT32:
   case R_386_PC32:
   case R_386_GOTPC:
     return R_PC;
   }
X86_64TargetInfo::X86_64TargetInfo() {
   TlsModuleIndexRel = R_X86_64_DTPMOD64;
   TlsOffsetRel = R_X86_64_DTPOFF64;
   UseLazyBinding = true;
   PltEntrySize = 16;
   PltZeroSize = 16;
   TlsGdToLeSkip = 2;
 }
 
-RelExpr X86_64TargetInfo::getRelExpr(uint32_t Type, const SymbolBody &S) const {
+bool X86_64TargetInfo::canRelaxGotPCRel(const SymbolBody &S,
+                                        const uint8_t *Loc) const {
+  if (Loc[-2] != 0x8b)
+    return false;
+  if (S.isUndefined() || S.isPreemptible())
+    return false;
+  if (S.isGnuIFunc())
+    return false;
+  return (S.getName() != "_DYNAMIC");
+}
+
+RelExpr X86_64TargetInfo::getRelExpr(uint32_t Type, const SymbolBody &S,
+                                     const uint8_t *Loc) const {
   switch (Type) {
   default:
     return R_ABS;
   case R_X86_64_GOTPCREL:
+  case R_X86_64_GOTPCRELX:
+    return canRelaxGotPCRel(S, Loc) ? R_X86_RELAX_GOT_PC : R_PC;
   case R_X86_64_PLT32:
   case R_X86_64_PC32:
   case R_X86_64_TLSLD:
   case R_X86_64_GOTTPOFF:
   case R_X86_64_TLSGD:
     return R_PC;
   }
 }
 
 void X86_64TargetInfo::writeGotPltHeader(uint8_t *Buf) const {
   write64le(Buf, Out<ELF64LE>::Dynamic->getVA());
 }
if (Config->Shared)
       error(getELFRelocationTypeName(EM_X86_64, Type) +
             " cannot be a dynamic relocation");
   return Type;
 }
 
 uint32_t X86_64TargetInfo::getTlsGotRel(uint32_t Type) const {
   // No other types of TLS relocations requiring GOT should
   // reach here.
   assert(Type == R_X86_64_GOTTPOFF);
   return R_X86_64_PC32;
 }
 
 bool X86_64TargetInfo::isTlsInitialExecRel(uint32_t Type) const {
   return Type == R_X86_64_GOTTPOFF;
 }
 
 bool X86_64TargetInfo::isTlsGlobalDynamicRel(uint32_t Type) const {
bool X86_64TargetInfo::isRelRelative(uint32_t Type) const {
   case R_X86_64_GOTTPOFF:
   case R_X86_64_PC8:
   case R_X86_64_PC16:
   case R_X86_64_PC32:
   case R_X86_64_PC64:
   case R_X86_64_PLT32:
   case R_X86_64_TPOFF32:
     return true;
   }
 }
 
 bool X86_64TargetInfo::isSizeRel(uint32_t Type) const {
   return Type == R_X86_64_SIZE32 || Type == R_X86_64_SIZE64;
 }
 
 // "Ulrich Drepper, ELF Handling For Thread-Local Storage" (5.5
 // x86-x64 linker optimizations, http://www.akkadia.org/drepper/tls.pdf) shows
void X86_64TargetInfo::relocateOne(uint8_t *Loc, uint32_t Type,
   }
 }
 
 // Relocation masks following the #lo(value), #hi(value), #ha(value),
 // #higher(value), #highera(value), #highest(value), and #highesta(value)
 // macros defined in section 4.5.1. Relocation Types of the PPC-elf64abi
 // document.
 static uint16_t applyPPCLo(uint64_t V) { return V; }
 static uint16_t applyPPCHi(uint64_t V) { return V >> 16; }
 static uint16_t applyPPCHa(uint64_t V) { return (V + 0x8000) >> 16; }
 static uint16_t applyPPCHigher(uint64_t V) { return V >> 32; }
 static uint16_t applyPPCHighera(uint64_t V) { return (V + 0x8000) >> 32; }
 static uint16_t applyPPCHighest(uint64_t V) { return V >> 48; }
 static uint16_t applyPPCHighesta(uint64_t V) { return (V + 0x8000) >> 48; }
 
 PPCTargetInfo::PPCTargetInfo() {}
 bool PPCTargetInfo::isRelRelative(uint32_t Type) const { return false; }
 
 void PPCTargetInfo::relocateOne(uint8_t *Loc, uint32_t Type,
                                 uint64_t Val) const {
   switch (Type) {
   case R_PPC_ADDR16_HA:
     write16be(Loc, applyPPCHa(Val));
     break;
   case R_PPC_ADDR16_LO:
     write16be(Loc, applyPPCLo(Val));
     break;
   default:
     fatal("unrecognized reloc " + Twine(Type));
   }
 }
 
-RelExpr PPCTargetInfo::getRelExpr(uint32_t Type, const SymbolBody &S) const {
+RelExpr PPCTargetInfo::getRelExpr(uint32_t Type, const SymbolBody &S,
+                                  const uint8_t *Loc) const {
   return R_ABS;
 }
 
 PPC64TargetInfo::PPC64TargetInfo() {
   GotRel = R_PPC64_GLOB_DAT;
   RelativeRel = R_PPC64_RELATIVE;
   PltEntrySize = 32;
 
uint64_t getPPC64TocBase() {
 
   // Per the ppc64-elf-linux ABI, The TOC base is TOC value plus 0x8000
   // thus permitting a full 64 Kbytes segment. Note that the glibc startup
   // code (crt1.o) assumes that you can get from the TOC base to the
   // start of the .toc section with only a single (signed) 16-bit relocation.
   return TocVA + 0x8000;
 }
 
-RelExpr PPC64TargetInfo::getRelExpr(uint32_t Type, const SymbolBody &S) const {
+RelExpr PPC64TargetInfo::getRelExpr(uint32_t Type, const SymbolBody &S,
+                                    const uint8_t *Loc) const {
   switch (Type) {
   default:
     return R_ABS;
   case R_PPC64_REL24:
     return R_PPC_OPD;
   }
 }
 
AArch64TargetInfo::AArch64TargetInfo() {
   TlsGotRel = R_AARCH64_TLS_TPREL64;
   TlsModuleIndexRel = R_AARCH64_TLS_DTPMOD64;
   TlsOffsetRel = R_AARCH64_TLS_DTPREL64;
   UseLazyBinding = true;
   PltEntrySize = 16;
   PltZeroSize = 32;
 }
 
-RelExpr AArch64TargetInfo::getRelExpr(uint32_t Type,
-                                      const SymbolBody &S) const {
+RelExpr AArch64TargetInfo::getRelExpr(uint32_t Type, const SymbolBody &S,
+                                      const uint8_t *Loc) const {
   switch (Type) {
   default:
     return R_ABS;
   case R_AARCH64_JUMP26:
   case R_AARCH64_CALL26:
   case R_AARCH64_PREL16:
   case R_AARCH64_PREL32:
   case R_AARCH64_PREL64:

 // programs don't use relocations now. Thus, this function is not
 // actually called (relocateOne is called for each relocation).
 // That's why the AMDGPU port works without implementing this function.
 void AMDGPUTargetInfo::relocateOne(uint8_t *Loc, uint32_t Type,
                                    uint64_t Val) const {
   llvm_unreachable("not implemented");
 }
 
-RelExpr AMDGPUTargetInfo::getRelExpr(uint32_t Type, const SymbolBody &S) const {
+RelExpr AMDGPUTargetInfo::getRelExpr(uint32_t Type, const SymbolBody &S,
+                                     const uint8_t *Loc) const {
   llvm_unreachable("not implemented");
 }
 
 template <class ELFT> MipsTargetInfo<ELFT>::MipsTargetInfo() {
   GotHeaderEntriesNum = 2;
   GotPltHeaderEntriesNum = 2;
   PageSize = 65536;
   PltEntrySize = 16;
   PltZeroSize = 32;
   ThunkSize = 16;
   UseLazyBinding = true;
   CopyRel = R_MIPS_COPY;
   PltRel = R_MIPS_JUMP_SLOT;
   RelativeRel = R_MIPS_REL32;
 }
 
 template <class ELFT>
-RelExpr MipsTargetInfo<ELFT>::getRelExpr(uint32_t Type,
-                                         const SymbolBody &S) const {
+RelExpr MipsTargetInfo<ELFT>::getRelExpr(uint32_t Type, const SymbolBody &S,
+                                         const uint8_t *Loc) const {
   switch (Type) {
   default:
     return R_ABS;
   case R_MIPS_HI16:
     // MIPS _gp_disp designates offset between start of function and 'gp'
     // pointer into GOT. __gnu_local_gp is equal to the current value of
     // the 'gp'. Therefore any relocations against them do not require
     // dynamic relocation.

ELF/Writer.cpp

static int32_t findMipsPairedAddend(const uint8_t *Buf, const uint8_t *BufLoc,
   }
   unsigned OldType = Rel->getType(Config->Mips64EL);
   StringRef OldName = getELFRelocationTypeName(Config->EMachine, OldType);
   StringRef NewName = getELFRelocationTypeName(Config->EMachine, Type);
   warning("can't find matching " + NewName + " relocation for " + OldName);
   return 0;
 }
 
+template <class ELFT, class uintX_t>
+static bool handleRelaxation(uint32_t Type, SymbolBody &Body,
+                             InputSectionBase<ELFT> &C, uintX_t Offset,
+                             uintX_t Addend, RelExpr Expr) {
+  if (Expr != R_X86_RELAX_GOT_PC)
+    return false;
+  C.Relocations.push_back({Expr, Type, Offset, Addend, &Body});
+  return true;
+}
+
 // The reason we have to do this early scan is as follows
 // * To mmap the output file, we need to know the size
 // * For that, we need to know how many dynamic relocs we will have.
 // It might be possible to avoid this by outputting the file with write:
 // * Write the allocated output sections, computing addresses.
 // * Apply relocations, recording which ones require a dynamic reloc.
 // * Write the dynamic relocations.
 // * Write the rest of the file.
for (auto I = Rels.begin(), E = Rels.end(); I != E; ++I) {
 
     uintX_t Addend = getAddend<ELFT>(RI);
     const uint8_t *BufLoc = Buf + RI.r_offset;
     if (!RelTy::IsRela)
       Addend += Target->getImplicitAddend(BufLoc, Type);
     if (Config->EMachine == EM_MIPS)
       Addend += findMipsPairedAddend<ELFT>(Buf, BufLoc, Body, &RI, E);
 
-    RelExpr Expr = Target->getRelExpr(Type, Body);
+    const uint8_t *Data = C.getSectionData().data();
+    RelExpr Expr = Target->getRelExpr(Type, Body, Data + RI.r_offset);
     if (unsigned Processed =
             handleTlsRelocation<ELFT>(Type, Body, C, Offset, Addend, Expr)) {
       I += (Processed - 1);
       continue;
     }
 
+    if (handleRelaxation<ELFT>(Type, Body, C, Offset, Addend, Expr))
+      continue;
+
     if (Target->needsDynRelative(Type))
       AddDyn({Target->RelativeRel, C.OutSec, Offset, true, &Body,
               getAddend<ELFT>(RI)});
 
     // If a symbol in a DSO is referenced directly instead of through GOT
     // in a read-only section, we need to create a copy relocation for the
     // symbol.
     if (auto *B = dyn_cast<SharedSymbol<ELFT>>(&Body)) {

test/ELF/Inputs/gotpc-relax-und-dso.s

+.globl dsofoo
+.type dsofoo, @function
+dsofoo:
+ nop

test/ELF/gotpc-relax-und-dso.s

+# REQUIRES: x86
+# RUN: llvm-mc -filetype=obj -triple=x86_64-unknown-linux %s -o %t.o
+# RUN: llvm-mc -filetype=obj -triple=x86_64-pc-linux %S/Inputs/gotpc-relax-und-dso.s -o %tdso.o
+# RUN: ld.lld -shared %tdso.o -o %t.so
+# RUN: ld.lld -shared %t.o %t.so -o %tout
+# RUN: llvm-readobj -r -s %tout | FileCheck --check-prefix=RELOC %s
+# RUN: llvm-objdump -d %tout | FileCheck --check-prefix=DISASM %s
+
+# RELOC:      Relocations [
+# RELOC-NEXT:   Section ({{.*}}) .rela.dyn {
+# RELOC-NEXT:     0x20A0 R_X86_64_GLOB_DAT und 0x0
+# RELOC-NEXT:     0x20A8 R_X86_64_GLOB_DAT dsofoo 0x0
+# RELOC-NEXT:     0x20B0 R_X86_64_GLOB_DAT foo 0x0
+# RELOC-NEXT:     0x20B8 R_X86_64_RELATIVE - 0x2000
+# RELOC-NEXT:   }
+# RELOC-NEXT: ]
+
+# 0x101e + 7 - 36 = 0x1001
+# 0x1025 + 7 - 43 = 0x1001
+# DISASM:      Disassembly of section .text:
+# DISASM-NEXT: foo:
+# DISASM-NEXT:     1000: 90 nop
+# DISASM:      hid:
+# DISASM-NEXT:     1001: 90 nop
+# DISASM:      _start:
+# DISASM-NEXT:     1002: 48 8b 05 97 10 00 00 movq 4247(%rip), %rax
+# DISASM-NEXT:     1009: 48 8b 05 90 10 00 00 movq 4240(%rip), %rax
+# DISASM-NEXT:     1010: 48 8b 05 91 10 00 00 movq 4241(%rip), %rax
+# DISASM-NEXT:     1017: 48 8b 05 8a 10 00 00 movq 4234(%rip), %rax
+# DISASM-NEXT:     101e: 48 8d 05 dc ff ff ff leaq -36(%rip), %rax
+# DISASM-NEXT:     1025: 48 8d 05 d5 ff ff ff leaq -43(%rip), %rax
+# DISASM-NEXT:     102c: 48 8b 05 7d 10 00 00 movq 4221(%rip), %rax
+# DISASM-NEXT:     1033: 48 8b 05 76 10 00 00 movq 4214(%rip), %rax
+# DISASM-NEXT:     103a: 48 8b 05 77 10 00 00 movq 4215(%rip), %rax
+# DISASM-NEXT:     1041: 48 8b 05 70 10 00 00 movq 4208(%rip), %rax
+
+.text
+.globl foo
+.type foo, @function
+foo:
+ nop
+
+.globl hid
+.hidden hid
+.type hid, @function
+hid:
+ nop
+
+.globl _start
+.type _start, @function
+_start:
+ movq und@GOTPCREL(%rip), %rax
+ movq und@GOTPCREL(%rip), %rax
+ movq dsofoo@GOTPCREL(%rip), %rax
+ movq dsofoo@GOTPCREL(%rip), %rax
+ movq hid@GOTPCREL(%rip), %rax
+ movq hid@GOTPCREL(%rip), %rax
+ movq foo@GOTPCREL(%rip), %rax
+ movq foo@GOTPCREL(%rip), %rax
+ movq _DYNAMIC@GOTPCREL(%rip), %rax
+ movq _DYNAMIC@GOTPCREL(%rip), %rax

test/ELF/gotpc-relax.s

+# REQUIRES: x86
+# RUN: llvm-mc -filetype=obj -triple=x86_64-unknown-linux %s -o %t.o
+# RUN: ld.lld %t.o -o %t1
+# RUN: llvm-readobj -r %t1 | FileCheck --check-prefix=RELOC %s
+# RUN: llvm-objdump -d %t1 | FileCheck --check-prefix=DISASM %s
+
+## There is no R_X86_64_GLOB_DAT relocations.
+# RELOC:      Relocations [
+# RELOC-NEXT:  Section ({{.*}}) .rela.plt {
+# RELOC-NOT:    R_X86_64_GLOB_DAT
+
+# 0x11003 + 7 - 10 = 0x11000
+# 0x1100a + 7 - 17 = 0x11000
+# 0x11011 + 7 - 23 = 0x11001
+# 0x11018 + 7 - 30 = 0x11001
+# DISASM:      Disassembly of section .text:
+# DISASM-NEXT: foo:
+# DISASM-NEXT:   11000: 90 nop
+# DISASM:      hid:
+# DISASM-NEXT:   11001: 90 nop
+# DISASM:      ifunc:
+# DISASM-NEXT:   11002: c3 retq
+# DISASM:      _start:
+# DISASM-NEXT: 11003: 48 8d 05 f6 ff ff ff leaq -10(%rip), %rax
+# DISASM-NEXT: 1100a: 48 8d 05 ef ff ff ff leaq -17(%rip), %rax
+# DISASM-NEXT: 11011: 48 8d 05 e9 ff ff ff leaq -23(%rip), %rax
+# DISASM-NEXT: 11018: 48 8d 05 e2 ff ff ff leaq -30(%rip), %rax
+# DISASM-NEXT: 1101f: 48 8b 05 1a 00 00 00 movq 26(%rip), %rax
+# DISASM-NEXT: 11026: 48 8b 05 13 00 00 00 movq 19(%rip), %rax
+
+.text
+.globl foo
+.type foo, @function
+foo:
+ nop
+
+.globl hid
+.hidden hid
+.type hid, @function
+hid:
+ nop
+
+.text
+.type ifunc STT_GNU_IFUNC
+.globl ifunc
+.type ifunc, @function
+ifunc:
+ ret
+
+.globl _start
+.type _start, @function
+_start:
+ movq foo@GOTPCREL(%rip), %rax
+ movq foo@GOTPCREL(%rip), %rax
+ movq hid@GOTPCREL(%rip), %rax
+ movq hid@GOTPCREL(%rip), %rax
+ movq ifunc@GOTPCREL(%rip), %rax
+ movq ifunc@GOTPCREL(%rip), %rax