Add ARM backend support for pagerando

[rinon]

Summary

Extend lowering to support POT-indirect address computation.

All calls between different bins (executable segments) must be lowered using
page offset table (POT) indirect address computation when pagerando is
enabled. This patch adds support to ARMISelLowering to support this
indirection. The ARMPagerandoOptimizer pass then optimizes intra-bin calls back
to direct calls, since references within the same bin are guaranteeed to have a
fixed PC-relative offset.

For example, the direct call to foo:

BL <ga:@foo>

will be selected as the following, assuming foo is placed in a randomly located
bin:

cp#0: foo(potoff)
cp#1: foo(binoff)

%foo_potoff = LDRi12 <cp#0>, 0
%foo_bin_addr = LDRrs %R9, %vreg1
%foo_binoff = LDRi12 <cp#1>, 0
%foo_addr = ADDrr %vreg2, %vreg3
BLX %foo_addr

Constant pool entry #0 is the offset into the POT table of the bin containing
foo, and entry #1 is the relative offset of foo from the beginning of that bin.
Together these constant pool entries allow us to index the POT and add an offset
to compute the dynamic address of foo.

Inside pagerando bins, global addresses not in the GOT are computed with
approximately the following instruction sequence:

cp#0: global(gotoff)

%got_addr = LDRi12 %R9, 0
%got_off_global = LDRi12 <cp#0>, 0
%global_addr = ADDrr %got_addr, %got_off_global

This sequence loads the address of the GOT into %got_addr from the first POT
entry. The constant pool entry containing the GOT-relative offset of @global is
then added to %got_addr to compute the dynamic address of @global. After this
sequence, %global_addr contains the dynamic address of @global.

Global addresses found in the GOT are loaded in the conventional way (using a
got_brel relocation on a constant pool entry), once the GOT address is loaded
from the first POT entry.

This patch set (D37580, D37581, D37582, D37583, D37584, D37585, D37586, D37587)
is a first draft of the pagerando implementation described in
http://lists.llvm.org/pipermail/llvm-dev/2017-June/113794.html.

[rinon]

This patch set (D37580, D37581, D37582, D37583, D37584, D37585, D37586, D37587) is a first draft of the pagerando implementation described in http://lists.llvm.org/pipermail/llvm-dev/2017-June/113794.html.

[rinon]

Remove old test for bug fix that has already been committed

[rinon]

• Fix style nits

[rinon]

Handle function aliases when checking for pagerando targets

Function aliases should be treated as functions to determine if the target is in
a pagerando bin.

[peter.smith]

I'm mostly a linker person so I'm not best qualified to review the backend changes. I've tried to take a look from an overall toolchain perspective.

How does pagerando handle the Arm exception tables? I can't immediately see how they will work for binned functions. My understanding is that for each executable Section the compiler will output a .ARM.exidx section with a SHF_LINK_ORDER dependency on the executable Section. The format of the .ARM.exidx section is one entry per function | R_ARM_PREL31 offset to function (usually expressed as Section Symbol + offset) | inline unwinding instructions or R_ARM_PREL31 offset to .ARM.extab |. At link time after SHF_LINK_ORDER has been performed we are left with a single .ARM.exidx section containing a table of pc-relative offsets to functions that can be binary searched by the unwinder to find out how to unwind the stack when __cxa_throw is called. We obviously can't use pc-relative offsets to the binned functions (unless we are willing to make the .ARM.exidx section read/write and have the loader update the table). The pc-relative offset could be made to the wrapper functions (no .ARM.exidx section for the Section containing the binned functions, make sure each section containing wrappers has a .ARM.exidx section), but given that the call to cxa_throw would come from the binned function and not the wrapper the unwinder wouldn't be able to find the pc-value at the cxa_throw call site in the table unless the wrapper always tail-called.

My apologies if I'm missing something obvious. Can you add a test that involves exceptions if you have this covered already?

lib/Target/ARM/ARMAsmPrinter.cpp

864

What happens if LTO is not used? Is it just that only the current module gets put into bins and the rest isn't which is sub-optimal but correct or is it fatal? If it is fatal is there any way of asserting that LTO is required, if not then can the comment be expanded?

lib/Target/ARM/ARMConstantPoolValue.h

224

Typo "Mvodifier" should be "Modifier"

lib/Target/ARM/ARMFastISel.cpp

2973

style nit, I think that there is only one statement so the braces aren't needed.

2998

Would "Add the GOT address from POT[0]" be a bit clearer?

lib/Target/ARM/ARMISelLowering.cpp

2057

Given the assert above, could this be true?

[rinon]

• Fix nits
• Clarify comments
• Remove unnecessary PIP addressing check

[rinon]

In D37585#911791, @peter.smith wrote:

I'm mostly a linker person so I'm not best qualified to review the backend changes. I've tried to take a look from an overall toolchain perspective.

Thanks again!

How does pagerando handle the Arm exception tables? ...

Yes, pagerando disrupts the PREL relocations in the exidx tables. Our current solution is to extend the platform or C++ runtime libunwind (_Unwind_RaiseException) to canonicalize the IP back to its original offset in the file + the DSO base address before looking it up in the exidx tables. Depending on the platform and libunwind implementation, this information may be easily available in /proc/PID/maps. I believe the upstream libunwind actually does load maps if available. However, we probably can't rely on reading the maps file, since the LLVM libunwind does not use it.

The alternative to canonicalizing the IP would be, as you pointed out, to dynamically relocate the exception handling table, but that will add more load time and break the ARM spec, both of which seem unacceptable to me. Additionally, unwind libraries that read the ELF file from disk (without those relocations) will still be confused.

The following is a brief description of how we can use the POT to canonicalize addresses for unwinding without reading /proc/PID/maps. I should probably add this to the overall RFC, sorry for not covering this earlier.

In order to not rely on /proc/PID/maps, we must first find the POT entry for the current IP. To find the correct POT entry the unwinder must first find the POT for the current stack frame, which will always be located at the address in R9, assuming that unwinding of deeper stack frames was correct and the unwinder was able to retrieve R9 from its callee-saved stack slot. The unwinder can then iterate the POT and find the entry with the largest value <= IP, which should be the POT entry for the bin containing IP.

We can extract the required segment file offset information from the ELF program headers. As long as the linker preserves the ordering of the pagerando segments between the ELF file and their position in the POT, the unwinder can look up the segment corresponding to the POT index found in the previous step. This segment's program header gives us both the original file offset, as well as the segment size, allowing the unwinder to double check that IP indeed falls into that segment.

With a pagerando-randomized IP and the file offset of the corresponding ELF segment, the unwinder can canonicalize the IP to the address it would be located at if all pagerando pages had been laid out contiguously with the rest of the DSO. Using this canonical IP allows the exception handling table to be referenced normally, without any dynamic relocations.

lib/Target/ARM/ARMAsmPrinter.cpp

864

Calculating the static offset for a POT entry during code generation requires that the entire POT is laid out in the compiler, which requires LTO. We would need a new static relocation to refer to a POT entry if the POT was constructed after code generation. I'll add that to the comment here.

I don't know any good way to check for LTO at this point. POTOFF modifiers should only be emitted for functions marked with the pagerando attribute, and that is only done by a pass run during LTO. I'll look around to see if there might be a way to assert on this.

lib/Target/ARM/ARMFastISel.cpp

2973

Sorry about that. I've seen both styles for if followed by multi-line so I wasn't sure. Fixed now.

lib/Target/ARM/ARMISelLowering.cpp

2057

Given that we don't support pagerando for Windows, no, this can never be hit. Besides, we already handle PIP addressing in the UsePIPAddressing branch. I'll remove this.

[rinon]

Properly handle NULL global value in call lowering

[rinon]

Rebase

[rinon]

Fix POT/bin offset references to aliases.

[rinon]

Don't allow FastISel for libcalls from pagerando functions

[rinon]

• Don't tailcall from non-pagerando to pagerando functions
• Use a heap-allocated array rather than a VLA
• Rebase

[rinon]

Rebase

[rinon]

Rebase.

• Update ARM tests

[rinon]

Rebase

include/llvm/CodeGen/MachineConstantPool.h

public:
 
   /// getConstantPoolIndex - Create a new entry in the constant pool or return
   /// an existing one.  User must specify the minimum required alignment for
   /// the object.
   unsigned getConstantPoolIndex(const Constant *C, unsigned Alignment);
   unsigned getConstantPoolIndex(MachineConstantPoolValue *V,
                                 unsigned Alignment);
 
+  void eraseIndex(unsigned Index);
+
   /// isEmpty - Return true if this constant pool contains no constants.
   bool isEmpty() const { return Constants.empty(); }
 
   const std::vector<MachineConstantPoolEntry> &getConstants() const {
     return Constants;
   }
 
   /// print - Used by the MachineFunction printer to print information about

lib/CodeGen/MachineFunction.cpp

if (Idx != -1) {
     MachineCPVsSharingEntries.insert(V);
     return (unsigned)Idx;
   }
 
   Constants.push_back(MachineConstantPoolEntry(V, Alignment));
   return Constants.size()-1;
 }
 
+void MachineConstantPool::eraseIndex(unsigned Index) {
+  assert(Index < Constants.size() && "Index out of range");
+  Constants.erase(Constants.begin()+Index);
+}
+
 void MachineConstantPool::print(raw_ostream &OS) const {
   if (Constants.empty()) return;
 
   OS << "Constant Pool:\n";
   for (unsigned i = 0, e = Constants.size(); i != e; ++i) {
     OS << "  cp#" << i << ": ";
     if (Constants[i].isMachineConstantPoolEntry())
       Constants[i].Val.MachineCPVal->print(OS);

lib/Target/ARM/ARM.h

 FunctionPass *createMLxExpansionPass();
 FunctionPass *createThumb2ITBlockPass();
 FunctionPass *createARMOptimizeBarriersPass();
 FunctionPass *createThumb2SizeReductionPass(
     std::function<bool(const Function &)> Ftor = nullptr);
 InstructionSelector *
 createARMInstructionSelector(const ARMBaseTargetMachine &TM, const ARMSubtarget &STI,
                              const ARMRegisterBankInfo &RBI);
+FunctionPass *createARMPagerandoOptimizerPass();
 
 void LowerARMMachineInstrToMCInst(const MachineInstr *MI, MCInst &OutMI,
                                   ARMAsmPrinter &AP);
 
 void computeBlockSize(MachineFunction *MF, MachineBasicBlock *MBB,
                       BasicBlockInfo &BBI);
 std::vector<BasicBlockInfo> computeAllBlockSizes(MachineFunction *MF);
 
 
 void initializeARMParallelDSPPass(PassRegistry &);
 void initializeARMLoadStoreOptPass(PassRegistry &);
 void initializeARMPreAllocLoadStoreOptPass(PassRegistry &);
 void initializeARMConstantIslandsPass(PassRegistry &);
 void initializeARMExpandPseudoPass(PassRegistry &);
 void initializeThumb2SizeReducePass(PassRegistry &);
+void initializeARMPagerandoOptimizerPass(PassRegistry &);
 
 } // end namespace llvm
 
 #endif // LLVM_LIB_TARGET_ARM_ARM_H

lib/Target/ARM/ARMAsmPrinter.cpp

 #include "llvm/ADT/SetVector.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/BinaryFormat/COFF.h"
 #include "llvm/CodeGen/MachineFunctionPass.h"
 #include "llvm/CodeGen/MachineJumpTableInfo.h"
 #include "llvm/CodeGen/MachineModuleInfoImpls.h"
 #include "llvm/IR/Constants.h"
 #include "llvm/IR/DataLayout.h"
+#include "llvm/IR/Function.h"
 #include "llvm/IR/Mangler.h"
 #include "llvm/IR/Module.h"
 #include "llvm/IR/Type.h"
 #include "llvm/MC/MCAsmInfo.h"
 #include "llvm/MC/MCAssembler.h"
 #include "llvm/MC/MCContext.h"
 #include "llvm/MC/MCELFStreamer.h"
 #include "llvm/MC/MCInst.h"
MCSymbol *Label = Ctx.getOrCreateSymbol(Twine(Prefix)
                        + "PC" + Twine(FunctionNumber) + "_" + Twine(LabelId));
   return Label;
 }
 
 static MCSymbolRefExpr::VariantKind
 getModifierVariantKind(ARMCP::ARMCPModifier Modifier) {
   switch (Modifier) {
   case ARMCP::no_modifier:
+  case ARMCP::BINOFF:
     return MCSymbolRefExpr::VK_None;
   case ARMCP::TLSGD:
     return MCSymbolRefExpr::VK_TLSGD;
   case ARMCP::TPOFF:
     return MCSymbolRefExpr::VK_TPOFF;
   case ARMCP::GOTTPOFF:
     return MCSymbolRefExpr::VK_GOTTPOFF;
   case ARMCP::SBREL:
     return MCSymbolRefExpr::VK_ARM_SBREL;
   case ARMCP::GOT_PREL:
     return MCSymbolRefExpr::VK_ARM_GOT_PREL;
   case ARMCP::SECREL:
     return MCSymbolRefExpr::VK_SECREL;
+  case ARMCP::GOTOFF:
+    return MCSymbolRefExpr::VK_GOTOFF;
+  case ARMCP::GOT_BREL:
+    return MCSymbolRefExpr::VK_GOT;
+  case ARMCP::POTOFF:
+    // Unreachable, handled in EmitMachineConstantPoolValue
+    break;
   }
   llvm_unreachable("Invalid ARMCPModifier!");
 }
 
 MCSymbol *ARMAsmPrinter::GetARMGVSymbol(const GlobalValue *GV,
                                         unsigned char TargetFlags) {
   if (Subtarget->isTargetMachO()) {
     bool IsIndirect =
for (const auto *GV : ACPC->promotedGlobals()) {
         MCSymbol *GVSym = getSymbol(GV);
         OutStreamer->EmitLabel(GVSym);
         EmittedPromotedGlobalLabels.insert(GV);
       }
     }
     return EmitGlobalConstant(DL, ACPC->getPromotedGlobalInit());
   }
 
+  if (ACPV->getModifier() == ARMCP::POTOFF) {
+    // This constant pool entry refers to an offset into the POT. Compute the
+    // bin of the target and emit the correct constant offset.
+    //
+    // To calculate this offset statically here, we need the entire POT to be
+    // laid out during code generation, which requires LTO in order to generate
+    // all code at once. Building the POT after code generation (i.e. with
+    // traditional linking) would require a new static relocation.
+    auto *F = cast<Function>(cast<ARMConstantPoolConstant>(ACPV)->getGV());
+
+    auto ConstantOffset = ConstantInt::get(
+        ACPV->getType(), GetPOTIndex(F)*DL.getPointerSize());
+    return EmitGlobalConstant(DL, ConstantOffset);
+  }
+
   MCSymbol *MCSym;
   if (ACPV->isLSDA()) {
     MCSym = getCurExceptionSym();
   } else if (ACPV->isBlockAddress()) {
     const BlockAddress *BA =
       cast<ARMConstantPoolConstant>(ACPV)->getBlockAddress();
     MCSym = GetBlockAddressSymbol(BA);
   } else if (ACPV->isGlobalValue()) {
if (ACPV->mustAddCurrentAddress()) {
       // We want "(<expr> - .)", but MC doesn't have a concept of the '.'
       // label, so just emit a local label end reference that instead.
       MCSymbol *DotSym = OutContext.createTempSymbol();
       OutStreamer->EmitLabel(DotSym);
       const MCExpr *DotExpr = MCSymbolRefExpr::create(DotSym, OutContext);
       PCRelExpr = MCBinaryExpr::createSub(PCRelExpr, DotExpr, OutContext);
     }
     Expr = MCBinaryExpr::createSub(Expr, PCRelExpr, OutContext);
+  } else if (ACPV->getModifier() == ARMCP::BINOFF) {
+    // This constant pool entry refers to an offset from the start of a
+    // pagerando bin (segment).
+    auto *F = cast<Function>(cast<ARMConstantPoolConstant>(ACPV)->getGV());
+
+    const MCSymbol *BinSym = GetSectionSymbol(F);
+    const MCExpr *BinExpr = MCSymbolRefExpr::create(BinSym, OutContext);
+    Expr = MCBinaryExpr::createSub(Expr, BinExpr, OutContext);
   }
   OutStreamer->EmitValue(Expr, Size);
 }
 
 void ARMAsmPrinter::EmitJumpTableAddrs(const MachineInstr *MI) {
   const MachineOperand &MO1 = MI->getOperand(1);
   unsigned JTI = MO1.getIndex();
 
for (MachineBasicBlock *MBB : JTBBs) {
     //
     // For example, a table with entries jumping to basic blocks BB0 and BB1
     // would look like:
     // LJTI_0_0:
     //    .word (LBB0 - LJTI_0_0)
     //    .word (LBB1 - LJTI_0_0)
     const MCExpr *Expr = MCSymbolRefExpr::create(MBB->getSymbol(), OutContext);
 
-    if (isPositionIndependent() || Subtarget->isROPI())
+    if (isPositionIndependent() || Subtarget->isROPI() || Subtarget->isPIP())
       Expr = MCBinaryExpr::createSub(Expr, MCSymbolRefExpr::create(JTISymbol,
                                                                    OutContext),
                                      OutContext);
     // If we're generating a table of Thumb addresses in static relocation
     // model, we need to add one to keep interworking correctly.
     else if (AFI->isThumbFunction())
       Expr = MCBinaryExpr::createAdd(Expr, MCConstantExpr::create(1,OutContext),
                                      OutContext);

lib/Target/ARM/ARMConstantIslandPass.cpp

class ARMConstantIslands : public MachineFunctionPass {
     MachineFunction *MF;
     MachineConstantPool *MCP;
     const ARMBaseInstrInfo *TII;
     const ARMSubtarget *STI;
     ARMFunctionInfo *AFI;
     bool isThumb;
     bool isThumb1;
     bool isThumb2;
-    bool isPositionIndependentOrROPI;
+    bool isPositionIndependent_ROPI_PIP;
 
   public:
     static char ID;
 
     ARMConstantIslands() : MachineFunctionPass(ID) {}
 
     bool runOnMachineFunction(MachineFunction &MF) override;
 
bool ARMConstantIslands::runOnMachineFunction(MachineFunction &mf) {
   MCP = mf.getConstantPool();
 
   LLVM_DEBUG(dbgs() << "***** ARMConstantIslands: "
                     << MCP->getConstants().size() << " CP entries, aligned to "
                     << MCP->getConstantPoolAlignment() << " bytes *****\n");
 
   STI = &static_cast<const ARMSubtarget &>(MF->getSubtarget());
   TII = STI->getInstrInfo();
-  isPositionIndependentOrROPI =
-      STI->getTargetLowering()->isPositionIndependent() || STI->isROPI();
+  isPositionIndependent_ROPI_PIP =
+      STI->getTargetLowering()->isPositionIndependent() ||
+      STI->isROPI() || STI->isPIP();
   AFI = MF->getInfo<ARMFunctionInfo>();
 
   isThumb = AFI->isThumbFunction();
   isThumb1 = AFI->isThumb1OnlyFunction();
   isThumb2 = AFI->isThumb2Function();
 
   HasFarJump = false;
   bool GenerateTBB = isThumb2 || (isThumb1 && SynthesizeThumb1TBB);
for (MachineInstr &I : MBB) {
             break;
 
           case ARM::LDRBi12:
           case ARM::LDRi12:
           case ARM::LDRcp:
           case ARM::t2LDRpci:
           case ARM::t2LDRHpci:
           case ARM::t2LDRBpci:
+          case ARM::t2PLDpci:
             Bits = 12;  // +-offset_12
             NegOk = true;
             break;
 
           case ARM::tLDRpci:
             Bits = 8;
             Scale = 4;  // +(offset_8*4)
             break;
if (isThumb2) {
       // %base cannot be redefined after the load as it will appear before
       // TBB/TBH like:
       //      %base =
       //      %base =
       //      tBB %base, %idx
       if (registerDefinedBetween(BaseReg, Load->getNextNode(), MBB->end(), TRI))
         continue;
 
-      if (isPositionIndependentOrROPI) {
+      if (isPositionIndependent_ROPI_PIP) {
         MachineInstr *Add = Load->getNextNode();
         if (Add->getOpcode() != ARM::tADDrr ||
             Add->getOperand(2).getReg() != BaseReg ||
             Add->getOperand(3).getReg() != Load->getOperand(0).getReg() ||
             !Add->getOperand(3).isKill())
           continue;
         if (Add->getOperand(0).getReg() != MI->getOperand(0).getReg())
           continue;

lib/Target/ARM/ARMConstantPoolValue.h

namespace ARMCP {
   enum ARMCPModifier {
     no_modifier, /// None
     TLSGD,       /// Thread Local Storage (General Dynamic Mode)
     GOT_PREL,    /// Global Offset Table, PC Relative
     GOTTPOFF,    /// Global Offset Table, Thread Pointer Offset
     TPOFF,       /// Thread Pointer Offset
     SECREL,      /// Section Relative (Windows TLS)
     SBREL,       /// Static Base Relative (RWPI)
+    GOTOFF,      /// Global Offset Table offset (TODO: Figure out if adding this
+                 /// is ok)
+    GOT_BREL,    /// Global Offset Table offset, generate a GOT entry (TODO:
+                 /// Figure out if adding this is ok)
+    POTOFF,      /// Offset in POT (TODO: Figure out if this should instead be a CPKind)
+    BINOFF,      /// Offset from start of bin (segment) (TODO: Figure out if
+                 /// this should instead be a CPKind)
   };
 
 } // end namespace ARMCP
 
 /// ARMConstantPoolValue - ARM specific constantpool value. This is used to
 /// represent PC-relative displacement between the address of the load
 /// instruction and the constant being loaded, i.e. (&GV-(LPIC+8)).
 class ARMConstantPoolValue : public MachineConstantPoolValue {

 };
 
 /// ARMConstantPoolSymbol - ARM-specific constantpool values for external
 /// symbols.
 class ARMConstantPoolSymbol : public ARMConstantPoolValue {
   const std::string S;          // ExtSymbol being loaded.
 
   ARMConstantPoolSymbol(LLVMContext &C, StringRef s, unsigned id,
                         unsigned char PCAdj, ARMCP::ARMCPModifier Modifier,
                         bool AddCurrentAddress);
 
 public:
   static ARMConstantPoolSymbol *Create(LLVMContext &C, StringRef s, unsigned ID,
-                                       unsigned char PCAdj);
+                                       unsigned char PCAdj,
+                                       ARMCP::ARMCPModifier Modifier = ARMCP::no_modifier);
+
+  static ARMConstantPoolSymbol *Create(LLVMContext &C, StringRef s,
+                                       ARMCP::ARMCPModifier Modifier);
 
   StringRef getSymbol() const { return S; }
 
   int getExistingMachineCPValue(MachineConstantPool *CP,
                                 unsigned Alignment) override;
 
   void addSelectionDAGCSEId(FoldingSetNodeID &ID) override;
 

lib/Target/ARM/ARMConstantPoolValue.cpp

StringRef ARMConstantPoolValue::getModifierText() const {
   case ARMCP::GOTTPOFF:
     return "gottpoff";
   case ARMCP::TPOFF:
     return "tpoff";
   case ARMCP::SBREL:
     return "SBREL";
   case ARMCP::SECREL:
     return "secrel32";
+  case ARMCP::GOTOFF:
+    return "gotoff";
+  case ARMCP::GOT_BREL:
+    return "got_brel";
+  case ARMCP::POTOFF:
+    return "potoff";
+  case ARMCP::BINOFF:
+    return "binoff";
   }
   llvm_unreachable("Unknown modifier!");
 }
 
 int ARMConstantPoolValue::getExistingMachineCPValue(MachineConstantPool *CP,
                                                     unsigned Alignment) {
   llvm_unreachable("Shouldn't be calling this directly!");
 }
 
 void
 ARMConstantPoolValue::addSelectionDAGCSEId(FoldingSetNodeID &ID) {
   ID.AddInteger(LabelId);
   ID.AddInteger(PCAdjust);
+  ID.AddInteger(Modifier);
 }
 
 bool
 ARMConstantPoolValue::hasSameValue(ARMConstantPoolValue *ACPV) {
   if (ACPV->Kind == Kind &&
       ACPV->PCAdjust == PCAdjust &&
       ACPV->Modifier == Modifier &&
       ACPV->LabelId == LabelId &&
ARMConstantPoolSymbol::ARMConstantPoolSymbol(LLVMContext &C, StringRef s,
                                              ARMCP::ARMCPModifier Modifier,
                                              bool AddCurrentAddress)
     : ARMConstantPoolValue(C, id, ARMCP::CPExtSymbol, PCAdj, Modifier,
                            AddCurrentAddress),
       S(s) {}
 
 ARMConstantPoolSymbol *ARMConstantPoolSymbol::Create(LLVMContext &C,
                                                      StringRef s, unsigned ID,
-                                                     unsigned char PCAdj) {
-  return new ARMConstantPoolSymbol(C, s, ID, PCAdj, ARMCP::no_modifier, false);
+                                                     unsigned char PCAdj,
+                                                     ARMCP::ARMCPModifier Modifier) {
+  return new ARMConstantPoolSymbol(C, s, ID, PCAdj, Modifier, false);
+}
+
+ARMConstantPoolSymbol *ARMConstantPoolSymbol::Create(LLVMContext &C,
+                                                     StringRef s,
+                                                     ARMCP::ARMCPModifier Modifier) {
+  return new ARMConstantPoolSymbol(C, s, 0, 0, Modifier, false);
 }
 
 int ARMConstantPoolSymbol::getExistingMachineCPValue(MachineConstantPool *CP,
                                                      unsigned Alignment) {
   return getExistingMachineCPValueImpl<ARMConstantPoolSymbol>(CP, Alignment);
 }
 
 bool ARMConstantPoolSymbol::hasSameValue(ARMConstantPoolValue *ACPV) {

lib/Target/ARM/ARMFastISel.cpp

AddOptionalDefs(BuildMI(*FuncInfo.MBB, FuncInfo.InsertPt, DbgLoc,
                             TII.get(ARM::LDRcp), ResultReg)
                       .addConstantPoolIndex(Idx)
                       .addImm(0));
   }
   return ResultReg;
 }
 
 bool ARMFastISel::isPositionIndependent() const {
-  return TLI.isPositionIndependent();
+  return TLI.isPositionIndependent() || Subtarget->isPIP();
 }
 
 unsigned ARMFastISel::ARMMaterializeGV(const GlobalValue *GV, MVT VT) {
   // For now 32-bit only.
   if (VT != MVT::i32 || GV->isThreadLocal()) return 0;
 
-  // ROPI/RWPI not currently supported.
-  if (Subtarget->isROPI() || Subtarget->isRWPI())
+  // ROPI/RWPI/PIP not currently supported.
+  if (Subtarget->isROPI() || Subtarget->isRWPI() || Subtarget->isPIP())
     return 0;
 
   bool IsIndirect = Subtarget->isGVIndirectSymbol(GV);
   const TargetRegisterClass *RC = isThumb2 ? &ARM::rGPRRegClass
                                            : &ARM::GPRRegClass;
   unsigned DestReg = createResultReg(RC);
 
   // FastISel TLS support on non-MachO is broken, punt to SelectionDAG.

 // of the full call infrastructure since we won't need to worry about things
 // like computed function pointers or strange arguments at call sites.
 // TODO: Try to unify this and the normal call bits for ARM, then try to unify
 // with X86.
 bool ARMFastISel::ARMEmitLibcall(const Instruction *I, RTLIB::Libcall Call) {
   CallingConv::ID CC = TLI.getLibcallCallingConv(Call);
 
   // Handle *simple* calls for now.
+  if (FuncInfo.MF->getFunction().isPagerando())
+    return false;
+
   Type *RetTy = I->getType();
   MVT RetVT;
   if (RetTy->isVoidTy())
     RetVT = MVT::isVoid;
   else if (!isTypeLegal(RetTy, RetVT))
     return false;
 
   // Can't handle non-double multi-reg retvals.
bool ARMFastISel::SelectCall(const Instruction *I,
   const Value *Callee = CI->getCalledValue();
 
   // Can't handle inline asm.
   if (isa<InlineAsm>(Callee)) return false;
 
   // Allow SelectionDAG isel to handle tail calls.
   if (CI->isTailCall()) return false;
 
+  // Can't handle PIP
+  const Function *F = dyn_cast<Function>(Callee);
+  if (FuncInfo.MF->getFunction().isPagerando() || (F && F->isPagerando()))
+    return false;
+
   // Check the calling convention.
   ImmutableCallSite CS(CI);
   CallingConv::ID CC = CS.getCallingConv();
 
   // TODO: Avoid some calling conventions?
 
   FunctionType *FTy = CS.getFunctionType();
   bool isVarArg = FTy->isVarArg();

 }
 
 unsigned ARMFastISel::ARMLowerPICELF(const GlobalValue *GV,
                                      unsigned Align, MVT VT) {
   bool UseGOT_PREL = !TM.shouldAssumeDSOLocal(*GV->getParent(), GV);
 
   LLVMContext *Context = &MF->getFunction().getContext();
   unsigned ARMPCLabelIndex = AFI->createPICLabelUId();
+  ARMConstantPoolValue *CPV;
+  if (Subtarget->isPIP())
+    CPV = ARMConstantPoolConstant::Create(GV, ARMCP::GOTOFF);
+  else {
     unsigned PCAdj = Subtarget->isThumb() ? 4 : 8;
-  ARMConstantPoolValue *CPV = ARMConstantPoolConstant::Create(
+    CPV = ARMConstantPoolConstant::Create(
         GV, ARMPCLabelIndex, ARMCP::CPValue, PCAdj,
         UseGOT_PREL ? ARMCP::GOT_PREL : ARMCP::no_modifier,
         /*AddCurrentAddress=*/UseGOT_PREL);
+  }
 
   unsigned ConstAlign =
       MF->getDataLayout().getPrefTypeAlignment(Type::getInt32PtrTy(*Context));
   unsigned Idx = MF->getConstantPool()->getConstantPoolIndex(CPV, ConstAlign);
 
   unsigned TempReg = MF->getRegInfo().createVirtualRegister(&ARM::rGPRRegClass);
   unsigned Opc = isThumb2 ? ARM::t2LDRpci : ARM::LDRcp;
   MachineInstrBuilder MIB =
       BuildMI(*FuncInfo.MBB, FuncInfo.InsertPt, DbgLoc, TII.get(Opc), TempReg)
           .addConstantPoolIndex(Idx);
   if (Opc == ARM::LDRcp)
     MIB.addImm(0);
   MIB.add(predOps(ARMCC::AL));
 
-  // Fix the address by adding pc.
   unsigned DestReg = createResultReg(TLI.getRegClassFor(VT));
+  if (Subtarget->isPIP()) {
+    // Add the GOT address stored in POT[0]
+    unsigned POTReg = MF->addLiveIn(TLI.getPOTBaseRegister(), &ARM::rGPRRegClass);
+
+    Address GOTAddr;
+    GOTAddr.BaseType = Address::RegBase;
+    GOTAddr.Base.Reg = POTReg;
+    GOTAddr.Offset = 0;
+    unsigned GOTReg;
+    bool RV = ARMEmitLoad(TLI.getPointerTy(DL), GOTReg, GOTAddr);
+    assert(RV && "Should be able to handle this load.");
+    (void)RV;
+
+    Opc = isThumb2 ? ARM::t2ADDrr : ARM::ADDrr;
+    GOTReg = constrainOperandRegClass(TII.get(Opc), GOTReg, 0);
+    DestReg = constrainOperandRegClass(TII.get(Opc), DestReg, 0);
+    AddOptionalDefs(BuildMI(*FuncInfo.MBB, FuncInfo.InsertPt, DbgLoc,
+                            TII.get(Opc), DestReg)
+                    .addReg(GOTReg).addReg(TempReg));
+  } else {
+    // Fix the address by adding pc.
     Opc = Subtarget->isThumb() ? ARM::tPICADD : UseGOT_PREL ? ARM::PICLDR
-                                                          : ARM::PICADD;
     DestReg = constrainOperandRegClass(TII.get(Opc), DestReg, 0);
     MIB = BuildMI(*FuncInfo.MBB, FuncInfo.InsertPt, DbgLoc, TII.get(Opc), DestReg)
-            .addReg(TempReg)
-            .addImm(ARMPCLabelIndex);
     if (!Subtarget->isThumb())
       MIB.add(predOps(ARMCC::AL));
 
     if (UseGOT_PREL && Subtarget->isThumb()) {
       unsigned NewDestReg = createResultReg(TLI.getRegClassFor(VT));
       MIB = BuildMI(*FuncInfo.MBB, FuncInfo.InsertPt, DbgLoc,
                     TII.get(ARM::t2LDRi12), NewDestReg)
-              .addReg(DestReg)
-              .addImm(0);
       DestReg = NewDestReg;
       AddOptionalDefs(MIB);
     }
+  }
   return DestReg;
 }
 
 bool ARMFastISel::fastLowerArguments() {
   if (!FuncInfo.CanLowerReturn)
     return false;
 
   const Function *F = FuncInfo.Fn;

lib/Target/ARM/ARMISelLowering.h

SDValue LowerMemOpCallTo(SDValue Chain, SDValue StackPtr, SDValue Arg,
                              const SDLoc &dl, SelectionDAG &DAG,
                              const CCValAssign &VA,
                              ISD::ArgFlagsTy Flags) const;
     SDValue LowerEH_SJLJ_SETJMP(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerEH_SJLJ_LONGJMP(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerEH_SJLJ_SETUP_DISPATCH(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerINTRINSIC_WO_CHAIN(SDValue Op, SelectionDAG &DAG,
                                     const ARMSubtarget *Subtarget) const;
+    SDValue LowerINTRINSIC_VOID(SDValue Op, SelectionDAG &DAG,
+                                const ARMSubtarget *Subtarget) const;
     SDValue LowerBlockAddress(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerConstantPool(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerGlobalAddress(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerGlobalAddressDarwin(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerGlobalAddressELF(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerGlobalAddressWindows(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerGlobalTLSAddress(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerToTLSGeneralDynamicModel(GlobalAddressSDNode *GA,
                                             SelectionDAG &DAG) const;
     SDValue LowerToTLSExecModels(GlobalAddressSDNode *GA,
                                  SelectionDAG &DAG,
                                  TLSModel::Model model) const;
     SDValue LowerGlobalTLSAddressDarwin(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerGlobalTLSAddressWindows(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerGLOBAL_OFFSET_TABLE(SDValue Op, SelectionDAG &DAG) const;
+    SDValue LowerPOT(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerBR_JT(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerSignedALUO(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerUnsignedALUO(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerSELECT(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerSELECT_CC(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerBRCOND(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerBR_CC(SDValue Op, SelectionDAG &DAG) const;
     SDValue LowerFCOPYSIGN(SDValue Op, SelectionDAG &DAG) const;

lib/Target/ARM/ARMISelLowering.cpp

ARMTargetLowering::ARMTargetLowering(const TargetMachine &TM,
   if (Subtarget->isTargetWindows() && Subtarget->getTargetTriple().isOSMSVCRT())
     for (auto &VT : {MVT::f32, MVT::f64})
       setOperationAction(ISD::FPOWI, VT, Custom);
 
   setOperationAction(ISD::GlobalAddress, MVT::i32,   Custom);
   setOperationAction(ISD::ConstantPool,  MVT::i32,   Custom);
   setOperationAction(ISD::GlobalTLSAddress, MVT::i32, Custom);
   setOperationAction(ISD::BlockAddress, MVT::i32, Custom);
+  setOperationAction(ISD::PAGE_OFFSET_TABLE, MVT::i32, Custom);
 
   setOperationAction(ISD::TRAP, MVT::Other, Legal);
 
   // Use the default implementation.
   setOperationAction(ISD::VASTART,            MVT::Other, Custom);
   setOperationAction(ISD::VAARG,              MVT::Other, Expand);
   setOperationAction(ISD::VACOPY,             MVT::Other, Expand);
   setOperationAction(ISD::VAEND,              MVT::Other, Expand);
if (Subtarget->hasNEON()) {
     setOperationAction(ISD::FMINNAN, MVT::f32, Legal);
     setOperationAction(ISD::FMAXNAN, MVT::f32, Legal);
     setOperationAction(ISD::FMINNAN, MVT::v2f32, Legal);
     setOperationAction(ISD::FMAXNAN, MVT::v2f32, Legal);
     setOperationAction(ISD::FMINNAN, MVT::v4f32, Legal);
     setOperationAction(ISD::FMAXNAN, MVT::v4f32, Legal);
   }
 
+  if (Subtarget->isPIP())
+    setPOTBaseRegister(ARM::R9);
+
   // We have target-specific dag combine patterns for the following nodes:
   // ARMISD::VMOVRRD  - No need to call setTargetDAGCombine
   setTargetDAGCombine(ISD::ADD);
   setTargetDAGCombine(ISD::SUB);
   setTargetDAGCombine(ISD::MUL);
   setTargetDAGCombine(ISD::AND);
   setTargetDAGCombine(ISD::OR);
   setTargetDAGCombine(ISD::XOR);
ARMTargetLowering::LowerCall(TargetLowering::CallLoweringInfo &CLI,
   bool isStub =
       !TM.shouldAssumeDSOLocal(*Mod, GV) && Subtarget->isTargetMachO();
 
   bool isARMFunc = !Subtarget->isThumb() || (isStub && !Subtarget->isMClass());
   bool isLocalARMFunc = false;
   ARMFunctionInfo *AFI = MF.getInfo<ARMFunctionInfo>();
   auto PtrVt = getPointerTy(DAG.getDataLayout());
 
-  if (Subtarget->genLongCalls()) {
+  auto F = dyn_cast_or_null<Function>(GV);
+  if (auto *GA = dyn_cast_or_null<GlobalAlias>(GV)) {
+    if (auto *Aliasee = dyn_cast<GlobalValue>(GA->getAliasee()))
+      F = dyn_cast<Function>(Aliasee);
+  }
+  bool UsePIPAddressing = MF.getFunction().isPagerando() ||
+                          (F && F->isPagerando());
+  if (UsePIPAddressing) {
+    if (GV) {
+      Callee = LowerGlobalAddressELF(Callee, DAG);
+    } else if (ExternalSymbolSDNode *S=dyn_cast<ExternalSymbolSDNode>(Callee)) {
+      SDValue POTValue = DAG.getNode(ISD::PAGE_OFFSET_TABLE, dl,
+                                     DAG.getVTList(MVT::i32, MVT::Other));
+      SDValue GOTAddr = DAG.getLoad(
+          PtrVt, dl, POTValue.getValue(1), POTValue,
+          MachinePointerInfo::getPOT(DAG.getMachineFunction()));
+
+      ARMConstantPoolValue *CPV =
+        ARMConstantPoolSymbol::Create(*DAG.getContext(), S->getSymbol(),
+                                      ARMCP::GOT_BREL);
+      // Get the address of the callee into a register
+      SDValue CPAddr = DAG.getTargetConstantPool(CPV, PtrVt, 4);
+      CPAddr = DAG.getNode(ARMISD::Wrapper, dl, MVT::i32, CPAddr);
+      SDValue Offset = DAG.getLoad(
+          PtrVt, dl, DAG.getEntryNode(), CPAddr,
+          MachinePointerInfo::getConstantPool(DAG.getMachineFunction()));
+
+      Callee = DAG.getNode(ISD::ADD, dl, PtrVt, GOTAddr, Offset);
+      Callee =
+        DAG.getLoad(PtrVt, dl, DAG.getEntryNode(), Callee,
+                    MachinePointerInfo::getGOT(DAG.getMachineFunction()));
+    }
+  } else if (Subtarget->genLongCalls()) {
     assert((!isPositionIndependent() || Subtarget->isTargetWindows()) &&
            "long-calls codegen is not position independent!");
     // Handle a global address or an external symbol. If it's not one of
     // those, the target's already in a register, so we don't need to do
     // anything extra.
     if (isa<GlobalAddressSDNode>(Callee)) {
       // Create a constant pool entry for the callee address
       unsigned ARMPCLabelIndex = AFI->createPICLabelUId();
       ARMConstantPoolValue *CPV =
         ARMConstantPoolConstant::Create(GV, ARMPCLabelIndex, ARMCP::CPValue, 0);
 
       // Get the address of the callee into a register
       SDValue CPAddr = DAG.getTargetConstantPool(CPV, PtrVt, 4);
       CPAddr = DAG.getNode(ARMISD::Wrapper, dl, MVT::i32, CPAddr);
       Callee = DAG.getLoad(
           PtrVt, dl, DAG.getEntryNode(), CPAddr,
           MachinePointerInfo::getConstantPool(DAG.getMachineFunction()));
     } else if (ExternalSymbolSDNode *S=dyn_cast<ExternalSymbolSDNode>(Callee)) {
       const char *Sym = S->getSymbol();
ARMTargetLowering::IsEligibleForTailCallOptimization(SDValue Callee,
   if (GlobalAddressSDNode *G = dyn_cast<GlobalAddressSDNode>(Callee)) {
     const GlobalValue *GV = G->getGlobal();
     const Triple &TT = getTargetMachine().getTargetTriple();
     if (GV->hasExternalWeakLinkage() &&
         (!TT.isOSWindows() || TT.isOSBinFormatELF() || TT.isOSBinFormatMachO()))
       return false;
   }
 
+  // Calls to pagerando functions from non-pagerando (legacy) functions must
+  // initialize the POT register, which is callee-saved. Thus we need to restore
+  // the original value of the POT register after the call and cannot tail call.
+  if (!CallerF.isPagerando()) {
+    if (auto *G = dyn_cast<GlobalAddressSDNode>(Callee)) {
+      auto *GV = G->getGlobal();
+      auto F = dyn_cast<Function>(GV);
+      if (auto *GA = dyn_cast<GlobalAlias>(GV)) {
+        if (auto *Aliasee = dyn_cast<GlobalValue>(GA->getAliasee()))
+          F = dyn_cast<Function>(Aliasee);
+      }
+      if (F && F->isPagerando())
+        return false;
+    }
+  }
+
   // Check that the call results are passed in the same way.
   LLVMContext &C = *DAG.getContext();
   if (!CCState::resultsCompatible(CalleeCC, CallerCC, MF, C, Ins,
                                   CCAssignFnForReturn(CalleeCC, isVarArg),
                                   CCAssignFnForReturn(CallerCC, isVarArg)))
     return false;
   // The callee has to preserve all registers the caller needs to preserve.
   const ARMBaseRegisterInfo *TRI = Subtarget->getRegisterInfo();
SDValue ARMTargetLowering::LowerBlockAddress(SDValue Op,
                                              SelectionDAG &DAG) const {
   MachineFunction &MF = DAG.getMachineFunction();
   ARMFunctionInfo *AFI = MF.getInfo<ARMFunctionInfo>();
   unsigned ARMPCLabelIndex = 0;
   SDLoc DL(Op);
   EVT PtrVT = getPointerTy(DAG.getDataLayout());
   const BlockAddress *BA = cast<BlockAddressSDNode>(Op)->getBlockAddress();
   SDValue CPAddr;
-  bool IsPositionIndependent = isPositionIndependent() || Subtarget->isROPI();
+  bool IsPositionIndependent = isPositionIndependent() || Subtarget->isROPI() ||
+                               Subtarget->isPIP();
   if (!IsPositionIndependent) {
     CPAddr = DAG.getTargetConstantPool(BA, PtrVT, 4);
   } else {
     unsigned PCAdj = Subtarget->isThumb() ? 4 : 8;
     ARMPCLabelIndex = AFI->createPICLabelUId();
     ARMConstantPoolValue *CPV =
       ARMConstantPoolConstant::Create(BA, ARMPCLabelIndex,
                                       ARMCP::CPBlockAddress, PCAdj);
case TLSModel::LocalDynamic:
       return LowerToTLSGeneralDynamicModel(GA, DAG);
     case TLSModel::InitialExec:
     case TLSModel::LocalExec:
       return LowerToTLSExecModels(GA, DAG, model);
   }
   llvm_unreachable("bogus TLS model");
 }
 
+SDValue
+ARMTargetLowering::LowerPOT(SDValue Op, SelectionDAG &DAG) const {
+  assert(Subtarget->isPIP() &&
+         "POT lowering only supported with PIP relocation model");
+
+  SDLoc dl(Op);
+  EVT PtrVT = getPointerTy(DAG.getDataLayout());
+  MachineFunction &MF = DAG.getMachineFunction();
+  unsigned POTReg = getPOTBaseRegister();
+  if (MF.getFunction().isPagerando()) {
+    return DAG.getCopyFromReg(DAG.getEntryNode(), dl, POTReg, PtrVT);
+  } else {
+    // Need to materialize the POT address
+    ARMFunctionInfo *AFI = MF.getInfo<ARMFunctionInfo>();
+    unsigned ARMPCLabelIndex = AFI->createPICLabelUId();
+    unsigned PCAdj = Subtarget->isThumb() ? 4 : 8;
+    ARMConstantPoolValue *CPV = ARMConstantPoolSymbol::Create(
+        *DAG.getContext(), "_PAGE_OFFSET_TABLE_", ARMPCLabelIndex, PCAdj,
+        ARMCP::GOT_PREL);
+    SDValue CPAddr = DAG.getTargetConstantPool(CPV, PtrVT, 4);
+    CPAddr = DAG.getNode(ARMISD::Wrapper, dl, MVT::i32, CPAddr);
+    SDValue Result = DAG.getLoad(
+        PtrVT, dl, DAG.getEntryNode(), CPAddr,
+        MachinePointerInfo::getConstantPool(DAG.getMachineFunction()));
+    SDValue Chain = Result.getValue(1);
+    SDValue PICLabel = DAG.getConstant(ARMPCLabelIndex, dl, MVT::i32);
+    SDValue POTAddress = DAG.getNode(ARMISD::PIC_ADD, dl, PtrVT, Result, PICLabel);
+    POTAddress =
+      DAG.getLoad(PtrVT, dl, Chain, POTAddress,
+                  MachinePointerInfo::getGOT(DAG.getMachineFunction()));
+    Chain = POTAddress.getValue(1);
+
+    Chain = DAG.getCopyToReg(Chain, dl, POTReg, POTAddress);
+    SDValue Ops[2] = { POTAddress, Chain };
+    return DAG.getMergeValues(Ops, dl);
+  }
+}
+
 /// Return true if all users of V are within function F, looking through
 /// ConstantExprs.
 static bool allUsersAreInFunction(const Value *V, const Function *F) {
   SmallVector<const User*,4> Worklist;
   for (auto *U : V->users())
     Worklist.push_back(U);
   while (!Worklist.empty()) {
     auto *U = Worklist.pop_back_val();

 
 SDValue ARMTargetLowering::LowerGlobalAddressELF(SDValue Op,
                                                  SelectionDAG &DAG) const {
   EVT PtrVT = getPointerTy(DAG.getDataLayout());
   SDLoc dl(Op);
   const GlobalValue *GV = cast<GlobalAddressSDNode>(Op)->getGlobal();
   const TargetMachine &TM = getTargetMachine();
   bool IsRO = isReadOnly(GV);
+  bool UseGOT = !TM.shouldAssumeDSOLocal(*GV->getParent(), GV);
 
   // promoteToConstantPool only if not generating XO text section
-  if (TM.shouldAssumeDSOLocal(*GV->getParent(), GV) && !Subtarget->genExecuteOnly())
+  if (!UseGOT && !Subtarget->genExecuteOnly())
     if (SDValue V = promoteToConstantPool(GV, DAG, PtrVT, dl))
       return V;
 
-  if (isPositionIndependent()) {
+  MachineFunction &MF = DAG.getMachineFunction();
+  auto F = dyn_cast<Function>(GV);
+  if (auto *GA = dyn_cast<GlobalAlias>(GV)) {
+    if (auto *Aliasee = dyn_cast<GlobalValue>(GA->getAliasee()))
+      F = dyn_cast<Function>(Aliasee);
+  }
+  bool pagerandoBinTarget = F && F->isPagerando();
+  if (MF.getFunction().isPagerando() || pagerandoBinTarget) {
+    // Position-independent pages, access through the POT
+    // TODO: Add support for MOVT/W
+
+    SDValue BaseAddr;
+    ARMConstantPoolValue *OffsetCPV;
+    SDValue POTValue = DAG.getNode(ISD::PAGE_OFFSET_TABLE, dl,
+                                   DAG.getVTList(MVT::i32, MVT::Other));
+    SDValue Chain = POTValue.getValue(1);
+    if (pagerandoBinTarget) {
+      ARMConstantPoolValue *CPV = ARMConstantPoolConstant::Create(
+          F, ARMCP::POTOFF);
+      SDValue CPAddr = DAG.getTargetConstantPool(CPV, PtrVT, 4);
+      CPAddr = DAG.getNode(ARMISD::Wrapper, dl, MVT::i32, CPAddr);
+      SDValue POTOffset = DAG.getLoad(
+          PtrVT, dl, DAG.getEntryNode(), CPAddr,
+          MachinePointerInfo::getConstantPool(DAG.getMachineFunction()));
+
+      SDValue POTAddr = DAG.getNode(ISD::ADD, dl, PtrVT, POTValue, POTOffset);
+      BaseAddr = DAG.getLoad(
+          PtrVT, dl, Chain, POTAddr,
+          MachinePointerInfo::getPOT(DAG.getMachineFunction()));
+
+      OffsetCPV =
+        ARMConstantPoolConstant::Create(F, ARMCP::BINOFF);
+    } else {
+      BaseAddr = DAG.getLoad(
+          PtrVT, dl, Chain, POTValue,
+          MachinePointerInfo::getPOT(DAG.getMachineFunction()));
+
+      OffsetCPV =
+        ARMConstantPoolConstant::Create(GV, UseGOT ? ARMCP::GOT_BREL : ARMCP::GOTOFF);
+    }
+
+    SDValue OffsetCPAddr = DAG.getTargetConstantPool(OffsetCPV, PtrVT, 4);
+    OffsetCPAddr = DAG.getNode(ARMISD::Wrapper, dl, MVT::i32, OffsetCPAddr);
+    SDValue Offset = DAG.getLoad(
+        PtrVT, dl, DAG.getEntryNode(), OffsetCPAddr,
+        MachinePointerInfo::getConstantPool(DAG.getMachineFunction()));
+
+    SDValue Result = DAG.getNode(ISD::ADD, dl, PtrVT, BaseAddr, Offset);
+    if (UseGOT)
+      Result =
+          DAG.getLoad(PtrVT, dl, DAG.getEntryNode(), Result,
+                      MachinePointerInfo::getGOT(DAG.getMachineFunction()));
+    return Result;
+  } else if (isPositionIndependent() || Subtarget->isPIP()) {
     bool UseGOT_PREL = !TM.shouldAssumeDSOLocal(*GV->getParent(), GV);
     SDValue G = DAG.getTargetGlobalAddress(GV, dl, PtrVT, 0,
                                            UseGOT_PREL ? ARMII::MO_GOT : 0);
     SDValue Result = DAG.getNode(ARMISD::WrapperPIC, dl, PtrVT, G);
     if (UseGOT_PREL)
       Result =
           DAG.getLoad(PtrVT, dl, DAG.getEntryNode(), Result,
                       MachinePointerInfo::getGOT(DAG.getMachineFunction()));
return DAG.getLoad(
         MachinePointerInfo::getConstantPool(DAG.getMachineFunction()));
   }
 }
 
 SDValue ARMTargetLowering::LowerGlobalAddressDarwin(SDValue Op,
                                                     SelectionDAG &DAG) const {
   assert(!Subtarget->isROPI() && !Subtarget->isRWPI() &&
          "ROPI/RWPI not currently supported for Darwin");
+  assert(!Subtarget->isPIP() &&
+         "PIP not currently supported for Darwin");
   EVT PtrVT = getPointerTy(DAG.getDataLayout());
   SDLoc dl(Op);
   const GlobalValue *GV = cast<GlobalAddressSDNode>(Op)->getGlobal();
 
   if (Subtarget->useMovt(DAG.getMachineFunction()))
     ++NumMovwMovt;
 
   // FIXME: Once remat is capable of dealing with instructions with register

 
 SDValue ARMTargetLowering::LowerGlobalAddressWindows(SDValue Op,
                                                      SelectionDAG &DAG) const {
   assert(Subtarget->isTargetWindows() && "non-Windows COFF is not supported");
   assert(Subtarget->useMovt(DAG.getMachineFunction()) &&
          "Windows on ARM expects to use movw/movt");
   assert(!Subtarget->isROPI() && !Subtarget->isRWPI() &&
          "ROPI/RWPI not currently supported for Windows");
+  assert(!Subtarget->isPIP() &&
+         "PIP not currently supported for Windows");
 
   const GlobalValue *GV = cast<GlobalAddressSDNode>(Op)->getGlobal();
   const ARMII::TOF TargetFlags =
     (GV->hasDLLImportStorageClass() ? ARMII::MO_DLLIMPORT : ARMII::MO_NO_FLAG);
   EVT PtrVT = getPointerTy(DAG.getDataLayout());
   SDValue Result;
   SDLoc DL(Op);
 
SDValue ARMTargetLowering::LowerBR_JT(SDValue Op, SelectionDAG &DAG) const {
   if (Subtarget->isThumb2() || (Subtarget->hasV8MBaselineOps() && Subtarget->isThumb())) {
     // Thumb2 and ARMv8-M use a two-level jump. That is, it jumps into the jump table
     // which does another jump to the destination. This also makes it easier
     // to translate it to TBB / TBH later (Thumb2 only).
     // FIXME: This might not work if the function is extremely large.
     return DAG.getNode(ARMISD::BR2_JT, dl, MVT::Other, Chain,
                        Addr, Op.getOperand(2), JTI);
   }
-  if (isPositionIndependent() || Subtarget->isROPI()) {
+  if (isPositionIndependent() || Subtarget->isROPI() || Subtarget->isPIP()) {
     Addr =
         DAG.getLoad((EVT)MVT::i32, dl, Chain, Addr,
                     MachinePointerInfo::getJumpTable(DAG.getMachineFunction()));
     Chain = Addr.getValue(1);
     Addr = DAG.getNode(ISD::ADD, dl, PTy, Table, Addr);
     return DAG.getNode(ARMISD::BR_JT, dl, MVT::Other, Chain, Addr, JTI);
   } else {
     Addr =
SDValue ARMTargetLowering::LowerOperation(SDValue Op, SelectionDAG &DAG) const {
   LLVM_DEBUG(dbgs() << "Lowering node: "; Op.dump());
   switch (Op.getOpcode()) {
   default: llvm_unreachable("Don't know how to custom lower this!");
   case ISD::WRITE_REGISTER: return LowerWRITE_REGISTER(Op, DAG);
   case ISD::ConstantPool: return LowerConstantPool(Op, DAG);
   case ISD::BlockAddress:  return LowerBlockAddress(Op, DAG);
   case ISD::GlobalAddress: return LowerGlobalAddress(Op, DAG);
   case ISD::GlobalTLSAddress: return LowerGlobalTLSAddress(Op, DAG);
+  case ISD::PAGE_OFFSET_TABLE: return LowerPOT(Op, DAG);
   case ISD::SELECT:        return LowerSELECT(Op, DAG);
   case ISD::SELECT_CC:     return LowerSELECT_CC(Op, DAG);
   case ISD::BRCOND:        return LowerBRCOND(Op, DAG);
   case ISD::BR_CC:         return LowerBR_CC(Op, DAG);
   case ISD::BR_JT:         return LowerBR_JT(Op, DAG);
   case ISD::VASTART:       return LowerVASTART(Op, DAG);
   case ISD::ATOMIC_FENCE:  return LowerATOMIC_FENCE(Op, DAG, Subtarget);
   case ISD::PREFETCH:      return LowerPREFETCH(Op, DAG, Subtarget);

 /// SetupEntryBlockForSjLj - Insert code into the entry block that creates and
 /// registers the function context.
 void ARMTargetLowering::SetupEntryBlockForSjLj(MachineInstr &MI,
                                                MachineBasicBlock *MBB,
                                                MachineBasicBlock *DispatchBB,
                                                int FI) const {
   assert(!Subtarget->isROPI() && !Subtarget->isRWPI() &&
          "ROPI/RWPI not currently supported with SjLj");
+  assert(!Subtarget->isPIP() &&
+         "FIXME: PIP not currently supported with SjLj");
   const TargetInstrInfo *TII = Subtarget->getInstrInfo();
   DebugLoc dl = MI.getDebugLoc();
   MachineFunction *MF = MBB->getParent();
   MachineRegisterInfo *MRI = &MF->getRegInfo();
   MachineConstantPool *MCP = MF->getConstantPool();
   ARMFunctionInfo *AFI = MF->getInfo<ARMFunctionInfo>();
   const Function &F = MF->getFunction();
 

lib/Target/ARM/ARMPagerandoOptimizer.cpp

+//===-- ARMPagerandoOptimizer.cpp - Optimizes intra-bin function calls ----===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This pass optimizes calls inside the same position-independent bin to direct
+// calls to avoid the overhead of indirect calls through the POT.
+// The implementation relies on SSA form to follow def-use chains, therefore,
+// this pass must be scheduled before register allocation.
+//
+//===----------------------------------------------------------------------===//
+
+#include "ARM.h"
+#include "ARMBaseInstrInfo.h"
+#include "ARMBaseRegisterInfo.h"
+#include "ARMConstantPoolValue.h"
+#include "ARMMachineFunctionInfo.h"
+#include "llvm/CodeGen/MachineRegisterInfo.h"
+#include "llvm/CodeGen/TargetLowering.h"
+
+using namespace llvm;
+
+#define DEBUG_TYPE "pagerando"
+
+namespace {
+class ARMPagerandoOptimizer : public MachineFunctionPass {
+public:
+  static char ID;
+  explicit ARMPagerandoOptimizer() : MachineFunctionPass(ID) {
+    initializeARMPagerandoOptimizerPass(*PassRegistry::getPassRegistry());
+  }
+
+  bool runOnMachineFunction(MachineFunction &MF) override;
+
+  MachineFunctionProperties getRequiredProperties() const override {
+    return MachineFunctionProperties().set(
+        MachineFunctionProperties::Property::TracksLiveness);
+  }
+
+private:
+  void optimizeCalls(MachineInstr *MI, const Function *Callee);
+  void replaceWithDirectCall(MachineInstr *MI, const Function *Callee);
+  void changeToPCRelativeCall(MachineInstr *MI, const Function *Callee);
+  void deleteCPEntries(MachineFunction &MF, const SmallSet<int, 8> &CPIndices);
+};
+} // end anonymous namespace
+
+char ARMPagerandoOptimizer::ID = 0;
+INITIALIZE_PASS(ARMPagerandoOptimizer, "pagerando-optimizer-arm",
+                "Pagerando intra-bin optimizer for ARM", false, false)
+
+FunctionPass *llvm::createARMPagerandoOptimizerPass() {
+  return new ARMPagerandoOptimizer();
+}
+
+static bool isIntraBin(const MachineConstantPoolEntry &E, StringRef BinPrefix) {
+  if (!E.isMachineConstantPoolEntry()) return false;
+
+  // ARMConstantPoolValue lacks casting infrastructure to use dyn_cast directly
+  auto *CPV = static_cast<ARMConstantPoolValue*>(E.Val.MachineCPVal);
+  auto *CPC = dyn_cast<ARMConstantPoolConstant>(CPV);
+  if (!CPC) return false;
+
+  auto M = CPC->getModifier();
+  auto *F = dyn_cast_or_null<Function>(CPC->getGV());
+
+  return (M == ARMCP::POTOFF || M == ARMCP::BINOFF)
+      && F && F->getSectionPrefix() == BinPrefix;
+}
+
+static const Function *getCallee(const MachineConstantPoolEntry &E) {
+  auto *CPC = static_cast<ARMConstantPoolConstant*>(E.Val.MachineCPVal);
+  return cast<Function>(CPC->getGV());
+}
+
+static int getCPIndex(const MachineInstr &MI) {
+  if (MI.mayLoad() && MI.getNumOperands() > 1 && MI.getOperand(1).isCPI())
+    return MI.getOperand(1).getIndex();
+  return -1;
+}
+
+bool ARMPagerandoOptimizer::runOnMachineFunction(MachineFunction &MF) {
+  auto &F = MF.getFunction();
+  // This pass is an optimization (optional), therefore check skipFunction
+  if (!F.isPagerando() || skipFunction(F)) {
+    return false;
+  }
+
+  // Section prefix is assigned by PagerandoBinning pass
+  auto BinPrefix = F.getSectionPrefix().getValue();
+  auto &CPEntries = MF.getConstantPool()->getConstants();
+
+  // Find intra-bin CP entries
+  SmallSet<int, 8> CPIndices;
+  int Index = 0;
+  for (auto &E : CPEntries) {
+    if (isIntraBin(E, BinPrefix))
+      CPIndices.insert(Index);
+    Index++;
+  }
+
+  if (CPIndices.empty())
+    return false;
+
+  // Collect uses of intra-bin CP entries
+  std::vector<MachineInstr*> Uses;
+  for (auto &BB : MF) {
+    for (auto &MI : BB) {
+      int Index = getCPIndex(MI);
+      if (CPIndices.count(Index))
+        Uses.push_back(&MI);
+    }
+  }
+
+  // Optimize intra-bin calls
+  for (auto *MI : Uses) {
+    int Index = getCPIndex(*MI);
+    auto *Callee = getCallee(CPEntries[Index]);
+    optimizeCalls(MI, Callee);
+  }
+
+  deleteCPEntries(MF, CPIndices);
+
+  return true;
+}
+
+static bool isBXCall(unsigned Opc) {
+  return Opc == ARM::BX_CALL || Opc == ARM::tBX_CALL;
+}
+
+void ARMPagerandoOptimizer::optimizeCalls(MachineInstr *MI,
+                                          const Function *Callee) {
+  auto &MRI = MI->getParent()->getParent()->getRegInfo();
+
+  SmallVector<MachineInstr*, 4> Queue{MI};
+  while (!Queue.empty()) {
+    MI = Queue.pop_back_val();
+
+    if (!MI->isCall()) { // Not a call, enqueue users
+      for (auto &Op : MI->defs()) {
+        for (auto &User : MRI.use_instructions(Op.getReg()))
+          Queue.push_back(&User);
+      }
+      MI->eraseFromParent();
+    } else if (isBXCall(MI->getOpcode())) {
+      changeToPCRelativeCall(MI, Callee);
+    } else { // Standard indirect call
+      replaceWithDirectCall(MI, Callee);
+    }
+  }
+}
+
+static unsigned toDirectCall(unsigned Opc) {
+  switch (Opc) {
+  case ARM::BLX:        return ARM::BL;
+  case ARM::tBLXr:      return ARM::tBL;
+  case ARM::TCRETURNri: return ARM::TCRETURNdi;
+  default:
+    llvm_unreachable("Unhandled ARM call opcode");
+  }
+}
+
+void ARMPagerandoOptimizer::replaceWithDirectCall(MachineInstr *MI,
+                                               const Function *Callee) {
+  auto &MBB = *MI->getParent();
+  auto &TII = *MBB.getParent()->getSubtarget().getInstrInfo();
+
+  auto Opc = toDirectCall(MI->getOpcode());
+  auto MIB = BuildMI(MBB, *MI, MI->getDebugLoc(), TII.get(Opc));
+
+  int SkipOps = 1;
+  if (MI->getOpcode() == ARM::tBLXr) { // Short instruction
+    auto CondOp = predOps(ARMCC::AL);
+    MIB.add(CondOp);
+    SkipOps += CondOp.size();
+  }
+  MIB.addGlobalAddress(Callee);
+
+  // Copy over remaining operands
+  auto RemainingOps = make_range(MI->operands_begin() + SkipOps,
+                                 MI->operands_end());
+  for (auto &Op : RemainingOps)
+    MIB.add(Op);
+
+  MI->eraseFromParent();
+}
+
+// Replace indirect register operand with more efficient PC-relative access
+void ARMPagerandoOptimizer::changeToPCRelativeCall(MachineInstr *MI,
+                                                   const Function *Callee) {
+  auto &MBB = *MI->getParent();
+  auto &MF = *MBB.getParent();
+  auto &C = MF.getFunction().getContext();
+  auto &AFI = *MF.getInfo<ARMFunctionInfo>();
+  auto &TII = *MF.getSubtarget().getInstrInfo();
+  auto &TLI = *MF.getSubtarget().getTargetLowering();
+  auto &DL = MF.getDataLayout();
+  auto &MRI = MF.getRegInfo();
+  auto isThumb = AFI.isThumbFunction();
+
+  // Create updated CP entry for callee
+  auto Label = AFI.createPICLabelUId();
+  auto PCAdj = isThumb ? 4 : 8;
+  auto *CPV = ARMConstantPoolConstant::Create(
+      Callee, Label, ARMCP::CPValue, PCAdj, ARMCP::no_modifier, false);
+  auto Alignment = DL.getPrefTypeAlignment(Type::getInt32PtrTy(C));
+  auto Index = MF.getConstantPool()->getConstantPoolIndex(CPV, Alignment);
+
+  // Load callee offset into register
+  auto Opc = AFI.isThumb2Function() ? ARM::t2LDRpci : ARM::LDRcp;
+  auto OffsetReg = MRI.createVirtualRegister(&ARM::rGPRRegClass);
+  auto MIB = BuildMI(MBB, *MI, MI->getDebugLoc(), TII.get(Opc), OffsetReg)
+      .addConstantPoolIndex(Index);
+  if (Opc == ARM::LDRcp) MIB.addImm(0);
+  MIB.add(predOps(ARMCC::AL));
+
+  // Compute callee address by adding PC
+  // FIXME: this is ugly // comment by Stephen
+  auto RegClass = TLI.getRegClassFor(TLI.getPointerTy(DL));
+  auto AddressReg = MRI.createVirtualRegister(RegClass);
+  Opc = isThumb ? ARM::tPICADD : ARM::PICADD;
+  MIB = BuildMI(MBB, *MI, MI->getDebugLoc(), TII.get(Opc), AddressReg)
+      .addReg(OffsetReg)
+      .addImm(Label);
+  if (!isThumb) MIB.add(predOps(ARMCC::AL));
+
+  // Replace register operand
+  MI->getOperand(0).setReg(AddressReg);
+}
+
+void ARMPagerandoOptimizer::deleteCPEntries(MachineFunction &MF,
+                                         const SmallSet<int, 8> &CPIndices) {
+  auto *CP = MF.getConstantPool();
+  int Size = CP->getConstants().size();
+  int *Indices = new int[Size];
+
+  // Create CP index mapping: Indices[Old] -> New
+  for (int Old = 0, New = 0; Old < Size; ++Old) {
+    Indices[Old] = CPIndices.count(Old) ? -1 : New++;
+  }
+
+  // Update remaining (inter-bin) CP references
+  for (auto &BB : MF) {
+    for (auto &MI : BB) {
+      for (auto &Op : MI.explicit_uses()) {
+        if (Op.isCPI()) {
+          int Old = Op.getIndex();
+          int New = Indices[Old];
+          assert (New != -1 && "CP entry use should have been deleted");
+          Op.setIndex(New);
+        }
+      }
+    }
+  }
+
+  // Delete now unreferenced (intra-bin) CP entries (in reverse order so
+  // deletion does not affect the index of future deletions)
+  for (int Old = Size - 1; Old >= 0; --Old) {
+    if (Indices[Old] == -1)
+      CP->eraseIndex(Old);
+  }
+
+  delete[] Indices;
+}

lib/Target/ARM/ARMSubtarget.h

public:
   bool isXRaySupported() const override;
 
   bool isAPCS_ABI() const;
   bool isAAPCS_ABI() const;
   bool isAAPCS16_ABI() const;
 
   bool isROPI() const;
   bool isRWPI() const;
+  bool isPIP() const;
 
   bool useMachineScheduler() const { return UseMISched; }
   bool disablePostRAScheduler() const { return DisablePostRAScheduler; }
   bool useSoftFloat() const { return UseSoftFloat; }
   bool isThumb() const { return InThumbMode; }
   bool isThumb1Only() const { return InThumbMode && !HasThumb2; }
   bool isThumb2() const { return InThumbMode && HasThumb2; }
   bool hasThumb2() const { return HasThumb2; }

lib/Target/ARM/ARMSubtarget.cpp

void ARMSubtarget::initSubtargetFeatures(StringRef CPU, StringRef FS) {
   }
 
   // NEON f32 ops are non-IEEE 754 compliant. Darwin is ok with it by default.
   const FeatureBitset &Bits = getFeatureBits();
   if ((Bits[ARM::ProcA5] || Bits[ARM::ProcA8]) && // Where this matters
       (Options.UnsafeFPMath || isTargetDarwin()))
     UseNEONForSinglePrecisionFP = true;
 
-  if (isRWPI())
+  if (isRWPI() || isPIP())
     ReserveR9 = true;
 
   // FIXME: Teach TableGen to deal with these instead of doing it manually here.
   switch (ARMProcFamily) {
   case Others:
   case CortexA5:
     break;
   case CortexA7:

 bool ARMSubtarget::isROPI() const {
   return TM.getRelocationModel() == Reloc::ROPI ||
          TM.getRelocationModel() == Reloc::ROPI_RWPI;
 }
 bool ARMSubtarget::isRWPI() const {
   return TM.getRelocationModel() == Reloc::RWPI ||
          TM.getRelocationModel() == Reloc::ROPI_RWPI;
 }
+bool ARMSubtarget::isPIP() const {
+  return TM.getRelocationModel() == Reloc::PIP;
+}
 
 bool ARMSubtarget::isGVIndirectSymbol(const GlobalValue *GV) const {
   if (!TM.shouldAssumeDSOLocal(*GV->getParent(), GV))
     return true;
 
   // 32 bit macho has no relocation for a-b if a is undefined, even if b is in
   // the section that is being relocated. This means we have to use o load even
   // for GVs that are known to be local to the dso.

lib/Target/ARM/ARMTargetMachine.cpp

extern "C" void LLVMInitializeARMTarget() {
   initializeGlobalISel(Registry);
   initializeARMLoadStoreOptPass(Registry);
   initializeARMPreAllocLoadStoreOptPass(Registry);
   initializeARMParallelDSPPass(Registry);
   initializeARMConstantIslandsPass(Registry);
   initializeARMExecutionDomainFixPass(Registry);
   initializeARMExpandPseudoPass(Registry);
   initializeThumb2SizeReducePass(Registry);
+  initializeARMPagerandoOptimizerPass(Registry);
 }
 
 static std::unique_ptr<TargetLoweringObjectFile> createTLOF(const Triple &TT) {
   if (TT.isOSBinFormatMachO())
     return llvm::make_unique<TargetLoweringObjectFileMachO>();
   if (TT.isOSWindows())
     return llvm::make_unique<TargetLoweringObjectFileCOFF>();
   return llvm::make_unique<ARMElfTargetObjectFile>();
static Reloc::Model getEffectiveRelocModel(const Triple &TT,
   if (!RM.hasValue())
     // Default relocation model on Darwin is PIC.
     return TT.isOSBinFormatMachO() ? Reloc::PIC_ : Reloc::Static;
 
   if (*RM == Reloc::ROPI || *RM == Reloc::RWPI || *RM == Reloc::ROPI_RWPI)
     assert(TT.isOSBinFormatELF() &&
            "ROPI/RWPI currently only supported for ELF");
 
+  if (*RM == Reloc::PIP)
+    assert(TT.isOSBinFormatELF() &&
+           "PIP currently only supported for ELF");
+
   // DynamicNoPIC is only used on darwin.
   if (*RM == Reloc::DynamicNoPIC && !TT.isOSDarwin())
     return Reloc::Static;
 
   return *RM;
 }
 
 static CodeModel::Model getEffectiveCodeModel(Optional<CodeModel::Model> CM) {

 
 bool ARMPassConfig::addGlobalInstructionSelect() {
   addPass(new InstructionSelect());
   return false;
 }
 
 void ARMPassConfig::addPreRegAlloc() {
   if (getOptLevel() != CodeGenOpt::None) {
+    if (TM->isPagerando())
+      addPass(createARMPagerandoOptimizerPass());
+
     addPass(createMLxExpansionPass());
 
     if (EnableARMLoadStoreOpt)
       addPass(createARMLoadStoreOptimizationPass(/* pre-register alloc */ true));
 
     if (!DisableA15SDOptimization)
       addPass(createA15SDOptimizerPass());
   }

lib/Target/ARM/ARMTargetTransformInfo.h

public:
 
   void getUnrollingPreferences(Loop *L, ScalarEvolution &SE,
                                TTI::UnrollingPreferences &UP);
 
   bool shouldBuildLookupTablesForConstant(Constant *C) const {
     // In the ROPI and RWPI relocation models we can't have pointers to global
     // variables or functions in constant data, so don't convert switches to
     // lookup tables if any of the values would need relocation.
-    if (ST->isROPI() || ST->isRWPI())
+    if (ST->isROPI() || ST->isRWPI() || ST->isPIP())
       return !C->needsRelocation();
 
     return true;
   }
   /// @}
 };
 
 } // end namespace llvm
 
 #endif // LLVM_LIB_TARGET_ARM_ARMTARGETTRANSFORMINFO_H

lib/Target/ARM/CMakeLists.txt

add_llvm_target(ARMCodeGen
   ARMISelLowering.cpp
   ARMInstrInfo.cpp
   ARMLegalizerInfo.cpp
   ARMParallelDSP.cpp
   ARMLoadStoreOptimizer.cpp
   ARMMCInstLower.cpp
   ARMMachineFunctionInfo.cpp
   ARMMacroFusion.cpp
+  ARMPagerandoOptimizer.cpp
   ARMRegisterInfo.cpp
   ARMOptimizeBarriersPass.cpp
   ARMRegisterBankInfo.cpp
   ARMSelectionDAGInfo.cpp
   ARMSubtarget.cpp
   ARMTargetMachine.cpp
   ARMTargetObjectFile.cpp
   ARMTargetTransformInfo.cpp

test/CodeGen/ARM/pagerando-isel.ll

+; RUN: llc < %s -mtriple=armv7-linux -relocation-model=pip -o /dev/null 2>&1 \
+; RUN:     -print-before=pagerando-optimizer-arm | FileCheck %s
+
+@global_var = global i32 0
+@internal_var = internal global i32 0
+
+define void @legacy() { ret void }
+define void @wrapper() { ret void }
+define hidden void @binned() pagerando { ret void }
+
+; CHECK-LABEL: # *** IR Dump Before Pagerando intra-bin optimizer for ARM ***:
+; CHECK-LABEL: # Machine code for function user: IsSSA, TracksLiveness
+; CHECK-LABEL: Constant Pool:
+; CHECK: cp#0: legacy(got_brel), align=4
+; CHECK: cp#1: wrapper(got_brel), align=4
+; CHECK: cp#2: binned(potoff), align=4
+; CHECK: cp#3: binned(binoff), align=4
+; CHECK: cp#4: global_var(got_brel), align=4
+; CHECK: cp#5: internal_var(gotoff), align=4
+
+; CHECK-LABEL: bb.0 (%ir-block.0)
+; CHECK-NEXT: [[LEGACY_GOT:%[0-9]+]]:gprnopc = LDRi12 %const.0, 0, 14, $noreg :: (load 4 from constant-pool)
+define void @user() pagerando {
+; CHECK-DAG: [[POT:%[0-9]+]]:gpr = COPY $r9
+; CHECK-DAG: [[GOT:%[0-9]+]]:gpr = LDRi12 [[POT]]:gpr, 0, 14, $noreg :: (load 4 from pot)
+; CHECK-DAG: [[LEGACY:%[0-9]+]]:gpr = LDRrs [[GOT]]:gpr, killed [[LEGACY_GOT]]:gprnopc, 0, 14, $noreg :: (load 4 from got)
+
+; CHECK: BLX killed [[LEGACY]]:gpr
+  call void @legacy()
+
+; CHECK: [[WRAPPER_GOT:%[0-9]+]]:gprnopc = LDRi12 %const.1, 0, 14, $noreg :: (load 4 from constant-pool)
+; CHECK: [[WRAPPER:%[0-9]+]]:gpr = LDRrs [[GOT]]:gpr, killed [[WRAPPER_GOT]]
+; CHECK: BLX killed [[WRAPPER]]:gpr
+  call void @wrapper()
+; CHECK: [[BINNED_POTOFF:%[0-9]+]]:gprnopc = LDRi12 %const.2, 0, 14, $noreg :: (load 4 from constant-pool) 
+; CHECK: [[BINNED_BIN:%[0-9]+]]:gpr = LDRrs [[POT]]:gpr, killed [[BINNED_POTOFF]]:gprnopc, 0, 14, $noreg
+; CHECK: [[BINNED_BINOFF:%[0-9]+]]:gpr = LDRi12 %const.3, 0, 14, $noreg :: (load 4 from constant-pool)
+; CHECK: [[BINNED:%[0-9]+]]:gpr = ADDrr killed [[BINNED_BIN]]:gpr, killed [[BINNED_BINOFF]]:gpr, 14, $noreg, $noreg
+; CHECK: BLX killed [[BINNED]]:gpr
+  call void @binned()
+
+; CHECK: [[GLOBAL_VAR_GOT:%[0-9]+]]:gprnopc = LDRi12 %const.4, 0, 14, $noreg :: (load 4 from constant-pool)
+; CHECK: [[GLOBAL_VAR:%[0-9]+]]:gpr = LDRrs [[GOT]]:gpr, killed [[GLOBAL_VAR_GOT]]:gprnopc, 0, 14, $noreg
+; CHECK-DAG: [[VAL:%[0-9]+]]:gpr = LDRi12 killed [[GLOBAL_VAR]]:gpr, 0, 14, $noreg
+  %val = load i32, i32* @global_var
+
+; CHECK-DAG: [[INTERNAL_VAR_GOTOFF:%[0-9]+]]:gprnopc = LDRi12 %const.5, 0, 14, $noreg :: (load 4 from constant-pool)
+; CHECK: STRrs killed [[VAL]]:gpr, [[GOT]]:gpr, killed [[INTERNAL_VAR_GOTOFF]]:gprnopc, 0, 14, $noreg
+  store i32 %val, i32* @internal_var
+
+  ret void
+}

test/CodeGen/ARM/pagerando-optimizer.ll

+; RUN: llc < %s -mtriple=armv7-linux -relocation-model=pip -o - | FileCheck %s
+
+; CHECK-LABEL: .text
+; CHECK-LABEL: wrapper:
+define void @wrapper() { ret void }
+
+; CHECK-LABEL: .section .text.bin_1
+; CHECK-LABEL: orig:
+define hidden void @orig() pagerando { ret void }
+
+; CHECK-LABEL: user:
+define void @user() pagerando {
+  call void @wrapper()
+
+; CHECK-NOT: add
+; CHECK: bl orig
+  call void @orig()
+
+  ret void
+
+; Should not appear in the constant pool of this function.
+; CHECK-NOT: .text.bin_1
+}
+
+; CHECK-LABEL: .section .pot
+; CHECK-LABEL: _PAGE_OFFSET_TABLE_:
+; CHECK-NOT: .text.bin_1
 No newline at end of file