FYI: a possible fix for pr36678

[• espindola]

Summary

This is a possible fix for pr36678. Having implemented it I now think there is a better way to do it.

What this does is create special plt entries that don't require ebx to be set. That way non pic code can be linker into position independent executable.

The problem I see with this patch is that it is a fairly complicated way of supporting a corner case:.

An alternative that might be simpler is using the thunk infrastructure to create thunks that set ebx and jump to the regular plt entry. We would need to make the preempted symbol point to the thunk.

Yet another option is just producing an error in this situation. If someone really want writable code they can use -z text. I will give this a try. Hopefully there are few cases that depend on this and they can be easily fixed (and they would crash right now anyway).

ELF/Arch/X86.cpp

public:
   RelExpr getRelExpr(RelType Type, const Symbol &S,
                      const uint8_t *Loc) const override;
   int64_t getImplicitAddend(const uint8_t *Buf, RelType Type) const override;
   void writeGotPltHeader(uint8_t *Buf) const override;
   RelType getDynRel(RelType Type) const override;
   void writeGotPlt(uint8_t *Buf, const Symbol &S) const override;
   void writeIgotPlt(uint8_t *Buf, const Symbol &S) const override;
   void writePltHeader(uint8_t *Buf) const override;
+  virtual void writePltImpl(uint8_t *Buf, uint64_t GotPltEntryAddr,
+                            uint64_t PltEntryAddr, int32_t Index,
+                            unsigned RelOff, unsigned PrefixSize) const;
   void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
-                int32_t Index, unsigned RelOff) const override;
+                int32_t Index, unsigned RelOff) const override {
+    return writePltImpl(Buf, GotPltEntryAddr, PltEntryAddr, Index, RelOff, 0);
+  }
+  void writeCanonicalPlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
+                         uint64_t PltEntryAddr, int32_t Index,
+                         unsigned RelOff) const override;
   void relocateOne(uint8_t *Loc, RelType Type, uint64_t Val) const override;
 
   RelExpr adjustRelaxExpr(RelType Type, const uint8_t *Data,
                           RelExpr Expr) const override;
   void relaxTlsGdToIe(uint8_t *Loc, RelType Type, uint64_t Val) const override;
   void relaxTlsGdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override;
   void relaxTlsIeToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override;
   void relaxTlsLdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const override;
 };
 } // namespace
 
 X86::X86() {
   CopyRel = R_386_COPY;
   GotRel = R_386_GLOB_DAT;
   PltRel = R_386_JUMP_SLOT;
   IRelativeRel = R_386_IRELATIVE;
   RelativeRel = R_386_RELATIVE;
   TlsGotRel = R_386_TLS_TPOFF;
   TlsModuleIndexRel = R_386_TLS_DTPMOD32;
   TlsOffsetRel = R_386_TLS_DTPOFF32;
   GotEntrySize = 4;
   GotPltEntrySize = 4;
   PltEntrySize = 16;
+  if (Config->Pic)
+    CanonicalPltEntrySize = PltEntrySize + 12;
   PltHeaderSize = 16;
   TlsGdRelaxSkip = 2;
   TrapInstr = 0xcccccccc; // 0xcc = INT3
 }
 
 static bool hasBaseReg(uint8_t ModRM) { return (ModRM & 0xc7) != 0x5; }
 
 RelExpr X86::getRelExpr(RelType Type, const Symbol &S,

 
 void X86::writeGotPltHeader(uint8_t *Buf) const {
   write32le(Buf, InX::Dynamic->getVA());
 }
 
 void X86::writeGotPlt(uint8_t *Buf, const Symbol &S) const {
   // Entries in .got.plt initially points back to the corresponding
   // PLT entries with a fixed offset to skip the first instruction.
+  if (S.NeedsPltAddr)
+    write32le(Buf, S.getPltVA() + 6 + 12);
+  else
     write32le(Buf, S.getPltVA() + 6);
 }
 
 void X86::writeIgotPlt(uint8_t *Buf, const Symbol &S) const {
   // An x86 entry is the address of the ifunc resolver function.
   write32le(Buf, S.getVA());
 }
 
 RelType X86::getDynRel(RelType Type) const {
const uint8_t PltData[] = {
       0x90, 0x90, 0x90, 0x90, // nop
   };
   memcpy(Buf, PltData, sizeof(PltData));
   uint32_t GotPlt = InX::GotPlt->getVA();
   write32le(Buf + 2, GotPlt + 4);
   write32le(Buf + 8, GotPlt + 8);
 }
 
-void X86::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
-                   uint64_t PltEntryAddr, int32_t Index,
-                   unsigned RelOff) const {
+void X86::writePltImpl(uint8_t *Buf, uint64_t GotPltEntryAddr,
+                       uint64_t PltEntryAddr, int32_t Index, unsigned RelOff,
+                       unsigned PrefixSize) const {
   const uint8_t Inst[] = {
       0xff, 0x00, 0, 0, 0, 0, // jmp *foo_in_GOT or jmp *foo@GOT(%ebx)
       0x68, 0, 0, 0, 0,       // pushl $reloc_offset
       0xe9, 0, 0, 0, 0,       // jmp .PLT0@PC
   };
   memcpy(Buf, Inst, sizeof(Inst));
 
   if (Config->Pic) {
     // jmp *foo@GOT(%ebx)
     uint32_t Ebx = InX::Got->getVA() + InX::Got->getSize();
     Buf[1] = 0xa3;
     write32le(Buf + 2, GotPltEntryAddr - Ebx);
   } else {
     // jmp *foo_in_GOT
     Buf[1] = 0x25;
     write32le(Buf + 2, GotPltEntryAddr);
   }
 
   write32le(Buf + 7, RelOff);
-  write32le(Buf + 12, -Index * PltEntrySize - PltHeaderSize - 16);
+  write32le(Buf + 12, -InX::Plt->getPltEntryStart(Index) - 16 - PrefixSize);
+}
+
+void X86::writeCanonicalPlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
+                            uint64_t PltEntryAddr, int32_t Index,
+                            unsigned RelOff) const {
+  unsigned PrefixSize = 0;
+  if (Config->Pic) {
+    const uint8_t Inst[] = {
+        0xe8, 0x00, 0x00, 0x00, 0x00,      // call <next instruction>
+        0x5b,                              // pop %ebx
+        0x81, 0xc3, 0x03, 0x00, 0x00, 0x00 // add $_GLOBAL_OFFSET_TABLE_,%ebx
+    };
+    memcpy(Buf, Inst, sizeof(Inst));
+    write32le(Buf + 8,
+              InX::Got->getVA() + InX::Got->getSize() - PltEntryAddr + 8 - 13);
+    Buf += sizeof(Inst);
+    PrefixSize = sizeof(Inst);
+  }
+  writePltImpl(Buf, GotPltEntryAddr, PltEntryAddr, Index, RelOff, PrefixSize);
 }
 
 int64_t X86::getImplicitAddend(const uint8_t *Buf, RelType Type) const {
   switch (Type) {
   case R_386_8:
   case R_386_PC8:
     return SignExtend64<8>(*Buf);
   case R_386_16:

 }
 
 namespace {
 class RetpolinePic : public X86 {
 public:
   RetpolinePic();
   void writeGotPlt(uint8_t *Buf, const Symbol &S) const override;
   void writePltHeader(uint8_t *Buf) const override;
-  void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
-                int32_t Index, unsigned RelOff) const override;
+  void writePltImpl(uint8_t *Buf, uint64_t GotPltEntryAddr,
+                    uint64_t PltEntryAddr, int32_t Index, unsigned RelOff,
+                    unsigned PrefixSize) const override;
 };
 
 class RetpolineNoPic : public X86 {
 public:
   RetpolineNoPic();
   void writeGotPlt(uint8_t *Buf, const Symbol &S) const override;
   void writePltHeader(uint8_t *Buf) const override;
-  void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
-                int32_t Index, unsigned RelOff) const override;
+  void writePltImpl(uint8_t *Buf, uint64_t GotPltEntryAddr,
+                    uint64_t PltEntryAddr, int32_t Index, unsigned RelOff,
+                    unsigned PrefixSize) const override;
 };
 } // namespace
 
 RetpolinePic::RetpolinePic() {
   PltHeaderSize = 48;
   PltEntrySize = 32;
+  CanonicalPltEntrySize = PltEntrySize + 12;
 }
 
 void RetpolinePic::writeGotPlt(uint8_t *Buf, const Symbol &S) const {
+  if (S.NeedsPltAddr)
+    write32le(Buf, S.getPltVA() + 17 + 12);
+  else
     write32le(Buf, S.getPltVA() + 17);
 }
 
 void RetpolinePic::writePltHeader(uint8_t *Buf) const {
   const uint8_t Insn[] = {
       0xff, 0xb3, 0,    0,    0,    0,          // 0:    pushl GOTPLT+4(%ebx)
       0x50,                                     // 6:    pushl %eax
       0x8b, 0x83, 0,    0,    0,    0,          // 7:    mov GOTPLT+8(%ebx), %eax
       0xe8, 0x0e, 0x00, 0x00, 0x00,             // d:    call next
void RetpolinePic::writePltHeader(uint8_t *Buf) const {
   memcpy(Buf, Insn, sizeof(Insn));
 
   uint32_t Ebx = InX::Got->getVA() + InX::Got->getSize();
   uint32_t GotPlt = InX::GotPlt->getVA() - Ebx;
   write32le(Buf + 2, GotPlt + 4);
   write32le(Buf + 9, GotPlt + 8);
 }
 
-void RetpolinePic::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
+void RetpolinePic::writePltImpl(uint8_t *Buf, uint64_t GotPltEntryAddr,
                                 uint64_t PltEntryAddr, int32_t Index,
-                            unsigned RelOff) const {
+                                unsigned RelOff, unsigned PrefixSize) const {
   const uint8_t Insn[] = {
       0x50,                   // pushl %eax
       0x8b, 0x83, 0, 0, 0, 0, // mov foo@GOT(%ebx), %eax
       0xe8, 0,    0, 0, 0,    // call plt+0x20
       0xe9, 0,    0, 0, 0,    // jmp plt+0x12
       0x68, 0,    0, 0, 0,    // pushl $reloc_offset
       0xe9, 0,    0, 0, 0,    // jmp plt+0
   };
   memcpy(Buf, Insn, sizeof(Insn));
 
   uint32_t Ebx = InX::Got->getVA() + InX::Got->getSize();
   write32le(Buf + 3, GotPltEntryAddr - Ebx);
-  write32le(Buf + 8, -Index * PltEntrySize - PltHeaderSize - 12 + 32);
-  write32le(Buf + 13, -Index * PltEntrySize - PltHeaderSize - 17 + 18);
+  unsigned Start = InX::Plt->getPltEntryStart(Index);
+  write32le(Buf + 8, -Start - 12 + 32 - PrefixSize);
+  write32le(Buf + 13, -Start - 17 + 18 - PrefixSize);
   write32le(Buf + 18, RelOff);
-  write32le(Buf + 23, -Index * PltEntrySize - PltHeaderSize - 27);
+  write32le(Buf + 23, -Start - 27 - PrefixSize);
 }
 
 RetpolineNoPic::RetpolineNoPic() {
   PltHeaderSize = 48;
   PltEntrySize = 32;
 }
 
 void RetpolineNoPic::writeGotPlt(uint8_t *Buf, const Symbol &S) const {
void RetpolineNoPic::writePltHeader(uint8_t *Buf) const {
   };
   memcpy(Buf, PltData, sizeof(PltData));
 
   uint32_t GotPlt = InX::GotPlt->getVA();
   write32le(Buf + 2, GotPlt + 4);
   write32le(Buf + 8, GotPlt + 8);
 }
 
-void RetpolineNoPic::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
+void RetpolineNoPic::writePltImpl(uint8_t *Buf, uint64_t GotPltEntryAddr,
                                   uint64_t PltEntryAddr, int32_t Index,
-                              unsigned RelOff) const {
+                                  unsigned RelOff, unsigned PrefixSize) const {
+  assert(PrefixSize == 0 && "Wrote a ebx prefix for a non pic output");
   const uint8_t Insn[] = {
       0x50,             // 0:  pushl %eax
       0xa1, 0, 0, 0, 0, // 1:  mov foo_in_GOT, %eax
       0xe8, 0, 0, 0, 0, // 6:  call plt+0x20
       0xe9, 0, 0, 0, 0, // b:  jmp plt+0x11
       0x68, 0, 0, 0, 0, // 10: pushl $reloc_offset
       0xe9, 0, 0, 0, 0, // 15: jmp plt+0
   };

ELF/Driver.cpp

if (!File->ArchiveName.empty())
           if (!Sym->isLocal() && Sym->File == File)
             Sym->VersionId = VER_NDX_LOCAL;
 }
 
 // Do actual linking. Note that when this function is called,
 // all linker scripts have already been parsed.
 template <class ELFT> void LinkerDriver::link(opt::InputArgList &Args) {
   Target = getTarget();
+  if (Target->CanonicalPltEntrySize == 0)
+    Target->CanonicalPltEntrySize = Target->PltEntrySize;
 
   Config->MaxPageSize = getMaxPageSize(Args);
   Config->ImageBase = getImageBase(Args);
 
   // If a -hash-style option was not given, set to a default value,
   // which varies depending on the target.
   if (!Args.hasArg(OPT_hash_style)) {
     if (Config->EMachine == EM_MIPS)

ELF/Relocations.cpp

if (Sym.isFunc()) {
     // a direct reference to a so symbol by creating an undefined symbol with a
     // non zero st_value. Seeing that, the dynamic linker resolves the symbol to
     // the value of the symbol we created. This is true even for got entries, so
     // pointer equality is maintained. To avoid an infinite loop, the only entry
     // that points to the real function is a dedicated got entry used by the
     // plt. That is identified by special relocation types (R_X86_64_JUMP_SLOT,
     // R_386_JMP_SLOT, etc).
     Sym.NeedsPltAddr = true;
+    if (Config->EMachine == EM_386)
+      InX::Got->HasGotOffRel = true;
     Expr = toPlt(Expr);
     Sec.Relocations.push_back({Expr, Type, Offset, Addend, &Sym});
     return Expr;
   }
 
   errorOrWarn("symbol '" + toString(Sym) + "' has no type" +
               getLocation(Sec, Sym, Offset));
   return Expr;

ELF/Symbols.cpp

 
 uint64_t Symbol::getGotPltOffset() const {
   return GotPltIndex * Target->GotPltEntrySize;
 }
 
 uint64_t Symbol::getPltVA() const {
   if (this->IsInIplt)
     return InX::Iplt->getVA() + PltIndex * Target->PltEntrySize;
-  return InX::Plt->getVA() + Target->PltHeaderSize +
-         PltIndex * Target->PltEntrySize;
+  return InX::Plt->getVA() + InX::Plt->getPltEntryStart(PltIndex);
 }
 
 uint64_t Symbol::getSize() const {
   if (const auto *DR = dyn_cast<Defined>(this))
     return DR->Size;
   if (const auto *S = dyn_cast<SharedSymbol>(this))
     return S->Size;
   return 0;

ELF/SyntheticSections.h

 //===----------------------------------------------------------------------===//
 
 #ifndef LLD_ELF_SYNTHETIC_SECTION_H
 #define LLD_ELF_SYNTHETIC_SECTION_H
 
 #include "EhFrame.h"
 #include "GdbIndex.h"
 #include "InputSection.h"
+#include "Target.h"
 #include "llvm/ADT/MapVector.h"
 #include "llvm/MC/StringTableBuilder.h"
 #include <functional>
 
 namespace lld {
 namespace elf {
 class SharedSymbol;
 

 // header as its first entry that is used at run-time to resolve lazy binding.
 // The latter is used for GNU Ifunc symbols, that will be subject to a
 // Target->IRelativeRel.
 class PltSection : public SyntheticSection {
 public:
   PltSection(bool IsIplt);
   void writeTo(uint8_t *Buf) override;
   size_t getSize() const override;
+  void finalizeContents() override;
   bool empty() const override { return Entries.empty(); }
   void addSymbols();
-
+  size_t numEntries() { return Entries.size(); }
   template <class ELFT> void addEntry(Symbol &Sym);
 
+  unsigned getPltEntryStart(int32_t Index) {
+    int32_t NumRegular = numEntries() - NumCanonicalEntries;
+    if (Index < NumRegular)
+      return Target->PltHeaderSize + Index * Target->PltEntrySize;
+    return Target->PltHeaderSize + NumRegular * Target->PltEntrySize +
+           (Index - NumRegular) * Target->CanonicalPltEntrySize;
+  }
+
+  // The number of plt entries for NeedsPltAddr symbols. They are called
+  // canonical because they are used as the address of the symbol.
+  size_t NumCanonicalEntries;
+
 private:
   unsigned getPltRelocOff() const;
   std::vector<std::pair<const Symbol *, unsigned>> Entries;
+
   size_t HeaderSize;
   bool IsIplt;
 };
 
 // GdbIndexChunk is created for each .debug_info section and contains
 // information to create a part of .gdb_index for a given input section.
 struct GdbIndexChunk {
   struct AddressEntry {

ELF/SyntheticSections.cpp

void PltSection::writeTo(uint8_t *Buf) {
   // linker to resolve dynsyms at runtime. Write such code.
   if (!IsIplt)
     Target->writePltHeader(Buf);
   size_t Off = HeaderSize;
   // The IPlt is immediately after the Plt, account for this in RelOff
   unsigned PltOff = getPltRelocOff();
 
   for (auto &I : Entries) {
-    const Symbol *B = I.first;
+    const Symbol *S = I.first;
     unsigned RelOff = I.second + PltOff;
-    uint64_t Got = B->getGotPltVA();
+    uint64_t Got = S->getGotPltVA();
     uint64_t Plt = this->getVA() + Off;
-    Target->writePlt(Buf + Off, Got, Plt, B->PltIndex, RelOff);
+    if (S->NeedsPltAddr) {
+      Target->writeCanonicalPlt(Buf + Off, Got, Plt, S->PltIndex, RelOff);
+      Off += Target->CanonicalPltEntrySize;
+    } else {
+      Target->writePlt(Buf + Off, Got, Plt, S->PltIndex, RelOff);
       Off += Target->PltEntrySize;
     }
   }
+}
 
 template <class ELFT> void PltSection::addEntry(Symbol &Sym) {
   Sym.PltIndex = Entries.size();
   RelocationBaseSection *PltRelocSection = InX::RelaPlt;
   if (IsIplt) {
     PltRelocSection = InX::RelaIplt;
     Sym.IsInIplt = true;
   }
   unsigned RelOff =
       static_cast<RelocationSection<ELFT> *>(PltRelocSection)->getRelocOffset();
   Entries.push_back(std::make_pair(&Sym, RelOff));
 }
 
+void PltSection::finalizeContents() {
+  auto I = llvm::partition(Entries, [](std::pair<const Symbol *, unsigned> &P) {
+    return !P.first->NeedsPltAddr;
+  });
+  NumCanonicalEntries = std::distance(I, Entries.end());
+}
+
 size_t PltSection::getSize() const {
-  return HeaderSize + Entries.size() * Target->PltEntrySize;
+  return HeaderSize +
+         (Entries.size() - NumCanonicalEntries) * Target->PltEntrySize +
+         NumCanonicalEntries * Target->CanonicalPltEntrySize;
 }
 
 // Some architectures such as additional symbols in the PLT section. For
 // example ARM uses mapping symbols to aid disassembly
 void PltSection::addSymbols() {
   // The PLT may have symbols defined for the Header, the IPLT has no header
   if (!IsIplt)
     Target->addPltHeaderSymbols(*this);

ELF/Target.h

public:
   // If lazy binding is supported, the first entry of the PLT has code
   // to call the dynamic linker to resolve PLT entries the first time
   // they are called. This function writes that code.
   virtual void writePltHeader(uint8_t *Buf) const {}
 
   virtual void writePlt(uint8_t *Buf, uint64_t GotEntryAddr,
                         uint64_t PltEntryAddr, int32_t Index,
                         unsigned RelOff) const {}
+  virtual void writeCanonicalPlt(uint8_t *Buf, uint64_t GotEntryAddr,
+                                 uint64_t PltEntryAddr, int32_t Index,
+                                 unsigned RelOff) const {
+    writePlt(Buf, GotEntryAddr, PltEntryAddr, Index, RelOff);
+  }
   virtual void addPltHeaderSymbols(InputSection &IS) const {}
   virtual void addPltSymbols(InputSection &IS, uint64_t Off) const {}
 
   // Returns true if a relocation only uses the low bits of a value such that
   // all those bits are in in the same page. For example, if the relocation
   // only uses the low 12 bits in a system with 4k pages. If this is true, the
   // bits will always have the same value at runtime and we don't have to emit
   // a dynamic relocation.
public:
   RelType RelativeRel;
   RelType IRelativeRel;
   RelType TlsDescRel;
   RelType TlsGotRel;
   RelType TlsModuleIndexRel;
   RelType TlsOffsetRel;
   unsigned GotEntrySize = 0;
   unsigned GotPltEntrySize = 0;
+  unsigned CanonicalPltEntrySize = 0;
   unsigned PltEntrySize;
   unsigned PltHeaderSize;
 
   // At least on x86_64 positions 1 and 2 are used by the first plt entry
   // to support lazy loading.
   unsigned GotPltHeaderEntriesNum = 3;
 
   // Set to 0 for variant 2

test/ELF/Inputs/i386-pic-plt.s

+        .global foo
+        .type foo, @function
+        .global bar
+        .type bar, @function
+bar:
+foo:
+        nop

test/ELF/i386-pic-plt.s

+// REQUIRES: x86
+// RUN: llvm-mc -filetype=obj -triple=i386-pc-linux %s -o %t.o
+// RUN: llvm-mc -filetype=obj -triple=i386-pc-linux %p/Inputs/i386-pic-plt.s -o %t2.o
+// RUN: ld.lld -shared %t2.o -o %t2.so
+// RUN: ld.lld %t.o %t2.so -o %t
+// RUN: llvm-objdump -d %t | FileCheck %s
+// RUN: ld.lld %t.o %t2.so -o %t2 -pie
+// RUN: llvm-objdump -d %t2 | FileCheck --check-prefix=PIE %s
+// RUN: ld.lld %t.o %t2.so -o %t3 -pie -z retpolineplt
+// RUN: llvm-objdump -d %t3 | FileCheck --check-prefix=PICRET %s
+
+
+// CHECK:      Disassembly of section .plt:
+// CHECK:      jmpl   *73740
+// CHECK-NEXT: pushl  $0
+// CHECK-NEXT: jmp    -32 <.plt>
+// CHECK-NEXT: jmpl    *73744
+// CHECK-NEXT: pushl   $8
+// CHECK-NEXT: jmp     -48 <.plt>
+
+// PIE:      Disassembly of section .plt:
+// PIE:      calll   0
+// PIE-NEXT: popl    %ebx
+// PIE-NEXT: addl    $8259, %ebx
+// PIE-NEXT: jmpl    *-4188(%ebx)
+// PIE-NEXT: pushl   $0
+// PIE-NEXT: jmp     -44 <.plt>
+// PIE-NEXT: calll   0
+// PIE-NEXT: %ebx
+// PIE-NEXT: addl    $8231, %ebx
+// PIE-NEXT: jmpl    *-4184(%ebx)
+// PIE-NEXT: pushl   $8
+// PIE-NEXT: jmp     -72 <.plt>
+
+// PICRET:      Disassembly of section .plt:
+// PICRET:      calll   0
+// PICRET-NEXT: popl    %ebx
+// PICRET-NEXT: addl    $8227, %ebx
+// PICRET-NEXT: pushl   %eax
+// PICRET-NEXT: movl    -4188(%ebx), %eax
+// PICRET-NEXT: calll   -40 <.plt+0x20>
+// PICRET-NEXT: jmp     -59 <.plt+0x12>
+// PICRET-NEXT: pushl   $0
+// PICRET-NEXT: jmp     -87 <.plt>
+// PICRET:      calll   0 <.plt+0x61>
+// PICRET-NEXT: popl    %ebx
+// PICRET-NEXT: addl    $8183, %ebx
+// PICRET-NEXT: pushl   %eax
+// PICRET-NEXT: movl    -4184(%ebx), %eax
+// PICRET-NEXT: calll   -84 <.plt+0x20>
+// PICRET-NEXT: jmp     -103 <.plt+0x12>
+// PICRET-NEXT: pushl   $8
+// PICRET-NEXT: jmp     -131 <.plt>
+
+.global _start
+_start:
+  call foo
+  call bar