[LLD][ELF][AArch64] Add support for AArch64 range extension thunks.

[peter.smith]

Summary

The AArch64 unconditional branch and branch and link instructions have a maximum range of +/- 128 Mib. This is usually enough for most programs but it is possible for very large programs or those with a linker script to exceed this range. This change adds support for range-extension thunks to AArch64.

Implementation Notes:

• I've used Thunks that can access the whole address range. There are more efficient Thunks that can be used, for example the PI thunk could use the usual ADRP addressing mode, but this would limit the range to +/- 4Gb. In an ideal world we could generate the thunks with a limited range only when we know they are in range, but this will require some changes and additional complexity in the underlying framework so I chose to keep it simple.
• The test aarch64-thunk-section-location.s is there to check that Thunks are placed roughly 128 MiB into a large Output Section, this test takes a noticeable amount of time to assemble and link, it may not be worth adding the test.
• I've not got any really large > 128 MiB AArch64 programs to test against. I've checked a small test case (absolute and with --pie) that artificially adds in large amounts of .space to check that the thunks are created and execute at runtime.

References:

• http://infocenter.arm.com/help/topic/com.arm.doc.ihi0055b/IHI0055B_aapcs64.pdf The Base Procedure Call Standard (For use of interprocedural scratch registers X16 and X17)
• http://infocenter.arm.com/help/topic/com.arm.doc.ihi0056b/IHI0056B_aaelf64.pdf (For relocations and information about relocations that can be range extended)
• https://developer.arm.com/products/architecture/a-profile/docs/ddi0487/ba/arm-architecture-reference-manual-armv8-for-armv8-a-architecture-profile (For descriptions of instructions)

[peter.smith]

Ping for review; this patch just adds support for AArch64 range extension thunks to the existing framework, no extra complexity has been added to the Relocations implementation.

[peter.smith]

Adding in comment from [llvm-commits]

• I've used Thunks that can access the whole address range. There are more efficient Thunks that can be used, for example the PI thunk could use the usual ADRP addressing mode, but this would limit the range to +/- 4Gb. In an ideal world we could generate the thunks with a limited >range only when we know they are in range, but this will require some changes and additional complexity in the underlying framework so I chose to keep it simple.

Do you know what other linkers do? Do they start with a adrp and upgrade
the thunk if that is not sufficient?

In gold and bfd, an adrp is used if the if the destination is within 4Gb, if it drifts out of range a longer range "stub" very similar to the ones I'm proposing here are used.

On x86_64 the compiler is required to not use the small code model to support more than 4gb. Is there something like it in aarch64?

Yes aarch64 has a small and large code model, the small code-model only supports applications up to 4Gb. AFAIK the large code model is implemented in clang and gcc for non position independent code, but is not yet implemented for position independent code. So at this stage you could not realistically build a position independent example > 4Gb. It is possible to build an executable that does though.

Index: test/ELF/aarch64-thunk-section-location.s

• /dev/null

+++ test/ELF/aarch64-thunk-section-location.s
@@ -0,0 +1,41 @@
+ RUN: llvm-mc -filetype=obj -triple=aarch64-linux-gnu %s -o %t
+ RUN: ld.lld %t -o %t2 2>&1
+ RUN: llvm-objdump -d -start-address=134086664 -stop-address=134086676 -triple=aarch64-linux-gnu %t2 | FileCheck %s
+
+ Check that the range extension thunks are dumped close to the aarch64 branch
+// range of 128 MiB
+ .section .text.1, "ax", %progbits
+ .balign 0x1000
+ .globl _start
+_start:
+ bl high_target
+ ret
+
+ .section .text.2, "ax", %progbits
+ .space 0x2000000
+
+ .section .text.2, "ax", %progbits
+ .space 0x2000000
+
+ .section .text.3, "ax", %progbits
+ .space 0x2000000
+
+ .section .text.4, "ax", %progbits
+ .space 0x2000000 - 0x40000
+
+ .section .text.5, "ax", %progbits
+ .space 0x40000

Why do you need multiple sections instead of a single .space with the
total amount? To show that the thunk could have been placed earlier but
was not?

Yes, exactly that, it isn't a particularly important test case, it is just a check to make sure we try and place the thunk to be in range of the most number of callers when it can.

It is surprising that we expected support more than 4GB of code, but if
that is an aarch64 requirement, LGTM.

Given that it isn't possible to build a position independent executable > 4Gb I think it would be safe to do:

• Use the load-literal for all non-position independent thunks
• Use an ADRP for position independent thunks

Does that sound preferable?

Ideally I think I'd prefer to use ADRP for non-position independent thunks as it can go into execute only memory. However I think supporting multiple ranges of thunks is a separate patch.

Peter

[peter.smith]

Updated diff to use ADRP for position independent code. This thunk has a maximum range of +- 4 Gigabytes which is not the whole address space. However the default small code model only supports programs up to 4 Gigabytes in size and the large code model is not currently implemented in gcc and clang for position independent code so it is safe to use for position independent thunks.

I'll commit tomorrow if there are no further comments.

ELF/Arch/AArch64.cpp

public:
   AArch64();
   RelExpr getRelExpr(RelType Type, const Symbol &S,
                      const uint8_t *Loc) const override;
   bool isPicRel(RelType Type) const override;
   void writeGotPlt(uint8_t *Buf, const Symbol &S) const override;
   void writePltHeader(uint8_t *Buf) const override;
   void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
                 int32_t Index, unsigned RelOff) const override;
+  bool needsThunk(RelExpr Expr, RelType Type, const InputFile *File,
+                  uint64_t BranchAddr, const Symbol &S) const override;
+  bool inBranchRange(RelType Type, uint64_t Src, uint64_t Dst) const override;
   bool usesOnlyLowPageBits(RelType Type) const override;
   void relocateOne(uint8_t *Loc, RelType Type, uint64_t Val) const override;
   RelExpr adjustRelaxExpr(RelType Type, const uint8_t *Data,
                           RelExpr Expr) const override;
   void relaxTlsGdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override;
   void relaxTlsGdToIe(uint8_t *Loc, RelType Type, uint64_t Val) const override;
   void relaxTlsIeToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override;
 };
AArch64::AArch64() {
   GotPltEntrySize = 8;
   PltEntrySize = 16;
   PltHeaderSize = 32;
   DefaultMaxPageSize = 65536;
 
   // It doesn't seem to be documented anywhere, but tls on aarch64 uses variant
   // 1 of the tls structures and the tcb size is 16.
   TcbSize = 16;
+  NeedsThunks = true;
+
+  // See comment in Arch/ARM.cpp for a more detailed explanation of
+  // ThunkSectionSpacing. For AArch64 the only branches we are permitted to
+  // Thunk have a range of +/- 128 MiB
+  ThunkSectionSpacing = (128 * 1024 * 1024) - 0x30000;
 }
 
 RelExpr AArch64::getRelExpr(RelType Type, const Symbol &S,
                             const uint8_t *Loc) const {
   switch (Type) {
   case R_AARCH64_TLSDESC_ADR_PAGE21:
     return R_TLSDESC_PAGE;
   case R_AARCH64_TLSDESC_LD64_LO12:
void AArch64::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
   memcpy(Buf, Inst, sizeof(Inst));
 
   relocateOne(Buf, R_AARCH64_ADR_PREL_PG_HI21,
               getAArch64Page(GotPltEntryAddr) - getAArch64Page(PltEntryAddr));
   relocateOne(Buf + 4, R_AARCH64_LDST64_ABS_LO12_NC, GotPltEntryAddr);
   relocateOne(Buf + 8, R_AARCH64_ADD_ABS_LO12_NC, GotPltEntryAddr);
 }
 
+bool AArch64::needsThunk(RelExpr Expr, RelType Type, const InputFile *File,
+                         uint64_t BranchAddr, const Symbol &S) const {
+  // ELF for the ARM 64-bit architecture, section Call and Jump relocations
+  // only permits range extension thunks for R_AARCH64_CALL26 and
+  // R_AARCH64_JUMP26 relocation types.
+  if (Type != R_AARCH64_CALL26 && Type != R_AARCH64_JUMP26)
+    return false;
+  uint64_t Dst = (Expr == R_PLT_PC) ? S.getPltVA() : S.getVA();
+  return !inBranchRange(Type, BranchAddr, Dst);
+}
+
+bool AArch64::inBranchRange(RelType Type, uint64_t Src, uint64_t Dst) const {
+  if (Type != R_AARCH64_CALL26 && Type != R_AARCH64_JUMP26)
+    return true;
+  // The AArch64 call and unconditional branch instructions have a range of
+  // +/- 128 MiB.
+  uint64_t Range = 128 * 1024 * 1024;
+  if (Dst > Src) {
+    // Immediate of branch is signed.
+    Range -= 4;
+    return Dst - Src <= Range;
+  }
+  return Src - Dst <= Range;
+}
+
 static void write32AArch64Addr(uint8_t *L, uint64_t Imm) {
   uint32_t ImmLo = (Imm & 0x3) << 29;
   uint32_t ImmHi = (Imm & 0x1FFFFC) << 3;
   uint64_t Mask = (0x3 << 29) | (0x1FFFFC << 3);
   write32le(L, (read32le(L) & ~Mask) | ImmLo | ImmHi);
 }
 
 // Return the bits [Start, End] from Val shifted Start bits.

ELF/Thunks.cpp

 using namespace llvm::support::endian;
 using namespace llvm::ELF;
 
 namespace lld {
 namespace elf {
 
 namespace {
 
+// AArch64 long range Thunks
+class AArch64ABSLongThunk final : public Thunk {
+public:
+  AArch64ABSLongThunk(Symbol &Dest) : Thunk(Dest) {}
+  uint32_t size() const override { return 16; }
+  void writeTo(uint8_t *Buf, ThunkSection &IS) const override;
+  void addSymbols(ThunkSection &IS) override;
+};
+
+class AArch64ADRPThunk final : public Thunk {
+public:
+  AArch64ADRPThunk(Symbol &Dest) : Thunk(Dest) {}
+  uint32_t size() const override { return 12; }
+  void writeTo(uint8_t *Buf, ThunkSection &IS) const override;
+  void addSymbols(ThunkSection &IS) override;
+};
+
 // Specific ARM Thunk implementations. The naming convention is:
 // Source State, TargetState, Target Requirement, ABS or PI, Range
 class ARMV7ABSLongThunk final : public Thunk {
 public:
   ARMV7ABSLongThunk(Symbol &Dest) : Thunk(Dest) {}
 
   uint32_t size() const override { return 12; }
   void writeTo(uint8_t *Buf, ThunkSection &IS) const override;
public:
   uint32_t size() const override { return 12; }
   void writeTo(uint8_t *Buf, ThunkSection &IS) const override;
   void addSymbols(ThunkSection &IS) override;
   InputSection *getTargetInputSection() const override;
 };
 
 } // end anonymous namespace
 
+// AArch64 long range Thunks
+
+static uint64_t getAArch64ThunkDestVA(const Symbol &S) {
+  uint64_t V = S.isInPlt() ? S.getPltVA() : S.getVA();
+  return V;
+}
+
+void AArch64ABSLongThunk::writeTo(uint8_t *Buf, ThunkSection &IS) const {
+  const uint8_t Data[] = {
+    0x50, 0x00, 0x00, 0x58, //     ldr x16, L0
+    0x00, 0x02, 0x1f, 0xd6, //     br  x16
+    0x00, 0x00, 0x00, 0x00, // L0: .xword S
+    0x00, 0x00, 0x00, 0x00,
+  };
+  uint64_t S = getAArch64ThunkDestVA(Destination);
+  memcpy(Buf, Data, sizeof(Data));
+  Target->relocateOne(Buf + 8, R_AARCH64_ABS64, S);
+}
+
+void AArch64ABSLongThunk::addSymbols(ThunkSection &IS) {
+  ThunkSym = addSyntheticLocal(
+      Saver.save("__AArch64AbsLongThunk_" + Destination.getName()), STT_FUNC,
+      Offset, size(), &IS);
+  addSyntheticLocal("$x", STT_NOTYPE, Offset, 0, &IS);
+  addSyntheticLocal("$d", STT_NOTYPE, Offset + 8, 0, &IS);
+}
+
+// This Thunk has a maximum range of 4Gb, this is sufficient for all programs
+// using the small code model, including pc-relative ones. At time of writing
+// clang and gcc do not support the large code model for position independent
+// code so it is safe to use this for position independent thunks without
+// worrying about the destination being more than 4Gb away.
+void AArch64ADRPThunk::writeTo(uint8_t *Buf, ThunkSection &IS) const {
+  const uint8_t Data[] = {
+      0x10, 0x00, 0x00, 0x90, // adrp x16, Dest R_AARCH64_ADR_PREL_PG_HI21(Dest)
+      0x10, 0x02, 0x00, 0x91, // add  x16, x16, R_AARCH64_ADD_ABS_LO12_NC(Dest)
+      0x00, 0x02, 0x1f, 0xd6, // br   x16
+  };
+  uint64_t S = getAArch64ThunkDestVA(Destination);
+  uint64_t P = ThunkSym->getVA();
+  memcpy(Buf, Data, sizeof(Data));
+  Target->relocateOne(Buf, R_AARCH64_ADR_PREL_PG_HI21,
+                      getAArch64Page(S) - getAArch64Page(P));
+  Target->relocateOne(Buf + 4, R_AARCH64_ADD_ABS_LO12_NC, S);
+}
+
+void AArch64ADRPThunk::addSymbols(ThunkSection &IS)
+{
+  ThunkSym = addSyntheticLocal(
+      Saver.save("__AArch64ADRPThunk_" + Destination.getName()), STT_FUNC,
+      Offset, size(), &IS);
+  addSyntheticLocal("$x", STT_NOTYPE, Offset, 0, &IS);
+}
+
 // ARM Target Thunks
 static uint64_t getARMThunkDestVA(const Symbol &S) {
   uint64_t V = S.isInPlt() ? S.getPltVA() : S.getVA();
   return SignExtend64<32>(V);
 }
 
 void ARMV7ABSLongThunk::writeTo(uint8_t *Buf, ThunkSection &IS) const {
   const uint8_t Data[] = {
InputSection *MicroMipsR6Thunk::getTargetInputSection() const {
   auto *DR = dyn_cast<Defined>(&Destination);
   return dyn_cast<InputSection>(DR->Section);
 }
 
 Thunk::Thunk(Symbol &D) : Destination(D), Offset(0) {}
 
 Thunk::~Thunk() = default;
 
+static Thunk *addThunkAArch64(RelType Type, Symbol &S) {
+  if (Type != R_AARCH64_CALL26 && Type != R_AARCH64_JUMP26)
+    fatal("unrecognized relocation type");
+  if (Config->Pic)
+    return make<AArch64ADRPThunk>(S);
+  return make<AArch64ABSLongThunk>(S);
+}
+
 // Creates a thunk for Thumb-ARM interworking.
 static Thunk *addThunkArm(RelType Reloc, Symbol &S) {
   // ARM relocations need ARM to Thumb interworking Thunks.
   // Thumb relocations need Thumb to ARM relocations.
   // Use position independent Thunks if we require position independent code.
   switch (Reloc) {
   case R_ARM_PC24:
   case R_ARM_PLT32:
static Thunk *addThunkMips(RelType Type, Symbol &S) {
   if ((S.StOther & STO_MIPS_MICROMIPS) && isMipsR6())
     return make<MicroMipsR6Thunk>(S);
   if (S.StOther & STO_MIPS_MICROMIPS)
     return make<MicroMipsThunk>(S);
   return make<MipsThunk>(S);
 }
 
 Thunk *addThunk(RelType Type, Symbol &S) {
-  if (Config->EMachine == EM_ARM)
+  if (Config->EMachine == EM_AARCH64)
+    return addThunkAArch64(Type, S);
+  else if (Config->EMachine == EM_ARM)
     return addThunkArm(Type, S);
   else if (Config->EMachine == EM_MIPS)
     return addThunkMips(Type, S);
   llvm_unreachable("add Thunk only supported for ARM and Mips");
   return nullptr;
 }
 
 } // end namespace elf
 } // end namespace lld

test/ELF/aarch64-call26-error.s

-// RUN: llvm-mc -filetype=obj -triple=aarch64-pc-freebsd %S/Inputs/abs.s -o %tabs
-// RUN: llvm-mc -filetype=obj -triple=aarch64-pc-freebsd %s -o %t
-// RUN: not ld.lld %t %tabs -o %t2 2>&1 | FileCheck %s
-// REQUIRES: aarch64
-
-.text
-.globl _start
-_start:
-    bl big
-
-// CHECK: R_AARCH64_CALL26 out of range

test/ELF/aarch64-call26-thunk.s

+// RUN: llvm-mc -filetype=obj -triple=aarch64-pc-freebsd %S/Inputs/abs.s -o %tabs
+// RUN: llvm-mc -filetype=obj -triple=aarch64-pc-freebsd %s -o %t
+// RUN: ld.lld %t %tabs -o %t2 2>&1
+// RUN: llvm-objdump -d -triple=aarch64-pc-freebsd %t2 | FileCheck %s
+// REQUIRES: aarch64
+
+.text
+.globl _start
+_start:
+    bl big
+
+// CHECK: Disassembly of section .text:
+// CHECK-NEXT: _start:
+// CHECK-NEXT:    20000:        02 00 00 94     bl      #8
+// CHECK: __AArch64AbsLongThunk_big:
+// CHECK-NEXT:    20008:        50 00 00 58     ldr     x16, #8
+// CHECK-NEXT:    2000c:        00 02 1f d6     br      x16
+// CHECK: $d:
+// CHECK-NEXT:    20010:        00 00 00 00     .word   0x00000000
+// CHECK-NEXT:    20014:        10 00 00 00     .word   0x00000010
+

test/ELF/aarch64-jump26-error.s

-// RUN: llvm-mc -filetype=obj -triple=aarch64-pc-freebsd %S/Inputs/abs.s -o %tabs
-// RUN: llvm-mc -filetype=obj -triple=aarch64-pc-freebsd %s -o %t
-// RUN: not ld.lld %t %tabs -o %t2 2>&1 | FileCheck %s
-// REQUIRES: aarch64
-
-.text
-.globl _start
-_start:
-    b big
-
-// CHECK: R_AARCH64_JUMP26 out of range

test/ELF/aarch64-jump26-thunk.s

+// RUN: llvm-mc -filetype=obj -triple=aarch64-pc-freebsd %S/Inputs/abs.s -o %tabs
+// RUN: llvm-mc -filetype=obj -triple=aarch64-pc-freebsd %s -o %t
+// RUN: ld.lld %t %tabs -o %t2 2>&1
+// RUN: llvm-objdump -d -triple=aarch64-pc-freebsd %t2 | FileCheck %s
+// REQUIRES: aarch64
+
+.text
+.globl _start
+_start:
+    b big
+
+// CHECK: Disassembly of section .text:
+// CHECK-NEXT: _start:
+// CHECK-NEXT:    20000:        02 00 00 14     b       #8
+// CHECK: __AArch64AbsLongThunk_big:
+// CHECK-NEXT:    20008:        50 00 00 58     ldr     x16, #8
+// CHECK-NEXT:    2000c:        00 02 1f d6     br      x16
+// CHECK: $d:
+// CHECK-NEXT:    20010:        00 00 00 00     .word   0x00000000
+// CHECK-NEXT:    20014:        10 00 00 00     .word   0x00000010

test/ELF/aarch64-thunk-pi.s

+// RUN: llvm-mc -filetype=obj -triple=aarch64-linux-gnu %s -o %t
+// RUN: echo "SECTIONS { \
+// RUN:       .text_low : { *(.text_low) } \
+// RUN:       .text_high 0x10000000 : { *(.text_high) } \
+// RUN:       } " > %t.script
+// RUN: ld.lld --script %t.script --shared %t -o %t2 2>&1
+// RUN: llvm-objdump -d -triple=aarch64-linux-gnu %t2 | FileCheck %s
+// REQUIRES: aarch64
+
+// Check that Position Independent thunks are generated for shared libraries.
+ .section .text_low, "ax", %progbits
+ .globl low_target
+ .type low_target, %function
+low_target:
+ // Need thunk to high_target@plt
+ bl high_target
+ ret
+// CHECK: low_target:
+// CHECK-NEXT:        0:        04 00 00 94     bl      #16
+// CHECK-NEXT:        4:        c0 03 5f d6     ret
+
+ .hidden low_target2
+ .globl low_target2
+ .type low_target2, %function
+low_target2:
+ // Need thunk to high_target
+ bl high_target2
+ ret
+// CHECK: low_target2:
+// CHECK-NEXT:        8:        05 00 00 94     bl      #20
+// CHECK-NEXT:        c:        c0 03 5f d6     ret
+
+// Expect range extension thunks for .text_low
+// adrp calculation is (PC + signed immediate) & (!0xfff)
+// CHECK: __AArch64ADRPThunk_high_target:
+// CHECK-NEXT:       10:       10 00 08 90     adrp    x16, #268435456
+// CHECK-NEXT:       14:       10 82 04 91     add     x16, x16, #288
+// CHECK-NEXT:       18:       00 02 1f d6     br      x16
+// CHECK: __AArch64ADRPThunk_high_target2:
+// CHECK-NEXT:       1c:       10 00 08 90     adrp    x16, #268435456
+// CHECK-NEXT:       20:       10 22 00 91     add     x16, x16, #8
+// CHECK-NEXT:       24:       00 02 1f d6     br      x16
+
+
+ .section .text_high, "ax", %progbits
+ .globl high_target
+ .type high_target, %function
+high_target:
+ // No thunk needed as we can reach low_target@plt
+ bl low_target
+ ret
+// CHECK: high_target:
+// CHECK-NEXT: 10000000:        4c 00 00 94     bl      #304
+// CHECK-NEXT: 10000004:        c0 03 5f d6     ret
+
+ .hidden high_target2
+ .globl high_target2
+ .type high_target2, %function
+high_target2:
+ // Need thunk to low_target
+ bl low_target2
+ ret
+// CHECK: high_target2:
+// CHECK-NEXT: 10000008:        02 00 00 94     bl      #8
+// CHECK-NEXT: 1000000c:        c0 03 5f d6     ret
+
+// Expect Thunk for .text.high
+
+// CHECK: __AArch64ADRPThunk_low_target2:
+// CHECK-NEXT: 10000010:  10 00 f8 90   adrp  x16, #-268435456
+// CHECK-NEXT: 10000014:  10 22 00 91   add x16, x16, #8
+// CHECK-NEXT: 10000018:  00 02 1f d6   br  x16
+
+// CHECK: Disassembly of section .plt:
+// CHECK-NEXT: .plt:
+// CHECK-NEXT: 10000100:        f0 7b bf a9     stp     x16, x30, [sp, #-16]!
+// CHECK-NEXT: 10000104:        10 00 00 90     adrp    x16, #0
+// CHECK-NEXT: 10000108:        11 aa 40 f9     ldr     x17, [x16, #336]
+// CHECK-NEXT: 1000010c:        10 42 05 91     add     x16, x16, #336
+// CHECK-NEXT: 10000110:        20 02 1f d6     br      x17
+// CHECK-NEXT: 10000114:        1f 20 03 d5     nop
+// CHECK-NEXT: 10000118:        1f 20 03 d5     nop
+// CHECK-NEXT: 1000011c:        1f 20 03 d5     nop
+// CHECK-NEXT: 10000120:        10 00 00 90     adrp    x16, #0
+// CHECK-NEXT: 10000124:        11 ae 40 f9     ldr     x17, [x16, #344]
+// CHECK-NEXT: 10000128:        10 62 05 91     add     x16, x16, #344
+// CHECK-NEXT: 1000012c:        20 02 1f d6     br      x17
+// CHECK-NEXT: 10000130:        10 00 00 90     adrp    x16, #0
+// CHECK-NEXT: 10000134:        11 b2 40 f9     ldr     x17, [x16, #352]
+// CHECK-NEXT: 10000138:        10 82 05 91     add     x16, x16, #352
+// CHECK-NEXT: 1000013c:        20 02 1f d6     br      x17

test/ELF/aarch64-thunk-script.s

+// RUN: llvm-mc -filetype=obj -triple=aarch64-linux-gnu %s -o %t
+// RUN: echo "SECTIONS { \
+// RUN:       .text_low 0x2000: { *(.text_low) } \
+// RUN:       .text_high 0x8002000 : { *(.text_high) } \
+// RUN:       } " > %t.script
+// RUN: ld.lld --script %t.script %t -o %t2 2>&1
+// RUN: llvm-objdump -d -triple=aarch64-linux-gnu %t2 | FileCheck %s
+// REQUIRES: aarch64
+
+// Check that we have the out of branch range calculation right. The immediate
+// field is signed so we have a slightly higher negative displacement.
+ .section .text_low, "ax", %progbits
+ .globl _start
+ .type _start, %function
+_start:
+ // Need thunk to high_target@plt
+ bl high_target
+ ret
+
+ .section .text_high, "ax", %progbits
+ .globl high_target
+ .type high_target, %function
+high_target:
+ // No Thunk needed as we are within signed immediate range
+ bl _start
+ ret
+
+// CHECK: Disassembly of section .text_low:
+// CHECK-NEXT: _start:
+// CHECK-NEXT:     2000:       02 00 00 94     bl      #8
+// CHECK-NEXT:     2004:       c0 03 5f d6     ret
+// CHECK: __AArch64AbsLongThunk_high_target:
+// CHECK-NEXT:     2008:       50 00 00 58     ldr     x16, #8
+// CHECK-NEXT:     200c:       00 02 1f d6     br      x16
+// CHECK: $d:
+// CHECK-NEXT:     2010:       00 20 00 08     .word   0x08002000
+// CHECK-NEXT:     2014:       00 00 00 00     .word   0x00000000
+// CHECK: Disassembly of section .text_high:
+// CHECK-NEXT: high_target:
+// CHECK-NEXT:  8002000:       00 00 00 96     bl      #-134217728
+// CHECK-NEXT:  8002004:       c0 03 5f d6     ret

test/ELF/aarch64-thunk-section-location.s

+// RUN: llvm-mc -filetype=obj -triple=aarch64-linux-gnu %s -o %t
+// RUN: ld.lld %t -o %t2 2>&1
+// RUN: llvm-objdump -d  -start-address=134086664 -stop-address=134086676 -triple=aarch64-linux-gnu %t2 | FileCheck %s
+// REQUIRES: aarch64
+// Check that the range extension thunks are dumped close to the aarch64 branch
+// range of 128 MiB
+ .section .text.1, "ax", %progbits
+ .balign 0x1000
+ .globl _start
+_start:
+ bl high_target
+ ret
+
+ .section .text.2, "ax", %progbits
+ .space 0x2000000
+
+ .section .text.2, "ax", %progbits
+ .space 0x2000000
+
+ .section .text.3, "ax", %progbits
+ .space 0x2000000
+
+ .section .text.4, "ax", %progbits
+ .space 0x2000000 - 0x40000
+
+ .section .text.5, "ax", %progbits
+ .space 0x40000
+
+ .section .text.6, "ax", %progbits
+ .balign 0x1000
+
+ .globl high_target
+ .type high_target, %function
+high_target:
+ ret
+
+// CHECK: __AArch64AbsLongThunk_high_target:
+// CHECK-NEXT:  7fe0008:        50 00 00 58     ldr     x16, #8
+// CHECK-NEXT:  7fe000c:        00 02 1f d6     br      x16
+// CHECK: $d:
+// CHECK-NEXT:  7fe0010:        00 10 02 08     .word   0x08021000