Optimize x86 GOT32X/GOTPCRELX relocations

R_386_GOT32X, R_X86_64_GOTPCRELX and R_X86_64_REX_GOTPCRELX relocations
retrieve the symbol address via its GOT slot.  If the symbol address is
known at the link-time, we can use it directly by changing instruction
encoding.  Indirect branch can only be converted to PC relative direct
branch.  MOV can be changed to LEA or encoded differently with signed
address.  The subset of binary operations can be encoded only with
signed address.

If undefined weak symbol is resolved to zero link-time, we can use it
as address.  Zero addresss can't used with PC relative direct branch
when PIC is true since the current PC is unknown.  In 64-bit, 32-bit
relocation for PC relatiave direct branch to zero may also overflow.

If this optimization causes relocation overflow, --no-relax can be used
to work around it.

bfd/

	PR ld/19609
	* elf32-i386.c (elf_i386_convert_load): Convert to R_386_32 for
	load with locally bound symbols if PIC is false or there is no
	base register.  Optimize branch to 0 if PIC is false.
	(elf_i386_relocate_section): Don't generate dynamic relocations
	against undefined weak symbols if PIC is false.
	* elf64-x86-64.c (elf_x86_64_convert_load): Disable optimization
	if we can't estimate relocation overflow with --no-relax.
	Convert to R_X86_64_32S/R_X86_64_32 for load with locally bound
	symbols if PIC is false.  Optimize branch to 0 if PIC is false.
	(elf_x86_64_relocate_section): Don't generate dynamic relocations
	against undefined weak symbols if PIC is false.

ld/

	PR ld/19609
	* testsuite/ld-i386/got1.dd: Updated.
	* testsuite/ld-i386/lea1c.d: Likewise.
	* testsuite/ld-i386/load1-nacl.d: Likewise.
	* testsuite/ld-i386/load1.d: Likewise.
	* testsuite/ld-i386/load4b.d: Likewise.
	* testsuite/ld-i386/load5b.d: Likewise.
	* testsuite/ld-i386/mov1b.d: Likewise.
	* testsuite/ld-x86-64/mov1b.d: Likewise.
	* testsuite/ld-x86-64/mov1d.d: Likewise.
	* testsuite/ld-ifunc/ifunc-21-i386.d: Likewise.
	* testsuite/ld-ifunc/ifunc-21-x86-64.d: Likewise.
	* testsuite/ld-ifunc/ifunc-22-i386.d: Likewise.
	* testsuite/ld-ifunc/ifunc-22-x86-64.d: Likewise.
	* testsuite/ld-x86-64/gotpcrel1.dd: Likewise.
	* testsuite/ld-x86-64/lea1a.d: Likewise.
	* testsuite/ld-x86-64/lea1b.d: Likewise.
	* testsuite/ld-x86-64/lea1c.d: Likewise.
	* testsuite/ld-x86-64/lea1d.d: Likewise.
	* testsuite/ld-x86-64/lea1e.d: Likewise.
	* testsuite/ld-x86-64/lea1f.d: Likewise.
	* testsuite/ld-x86-64/mov1b.d: Likewise.
	* testsuite/ld-x86-64/mov1d.d: Likewise.
	* testsuite/ld-x86-64/pr13082-3b.d: Likewise.
	* testsuite/ld-x86-64/pr13082-4b.d: Likewise.
	* testsuite/ld-x86-64/lea1.s: Add tests for 32-bit registers.
	* testsuite/ld-i386/pr19609-1.s: New file.
	* testsuite/ld-i386/pr19609-1a.d: Likewise.
	* testsuite/ld-i386/pr19609-1b.d: Likewise.
	* testsuite/ld-i386/pr19609-1c.d: Likewise.
	* testsuite/ld-i386/pr19609-1d.d: Likewise.
	* testsuite/ld-i386/pr19609-1e.d: Likewise.
	* testsuite/ld-i386/pr19609-1f.d: Likewise.
	* testsuite/ld-i386/pr19609-1g.d: Likewise.
	* testsuite/ld-i386/pr19609-1h.d: Likewise.
	* testsuite/ld-i386/pr19609-1i.d: Likewise.
	* testsuite/ld-i386/pr19609-2.s: Likewise.
	* testsuite/ld-i386/pr19609-2a.d: Likewise.
	* testsuite/ld-i386/pr19609-2b.d: Likewise.
	* testsuite/ld-i386/pr19609-2c.d: Likewise.
	* testsuite/ld-i386/undefweak.s: Likewise.
	* testsuite/ld-i386/undefweaka.d: Likewise.
	* testsuite/ld-i386/undefweakb.d: Likewise.
	* testsuite/ld-x86-64/pr13082-3c.d: Likewise.
	* testsuite/ld-x86-64/pr13082-3d.d: Likewise.
	* testsuite/ld-x86-64/pr19609-1.s: Likewise.
	* testsuite/ld-x86-64/pr19609-1a.d: Likewise.
	* testsuite/ld-x86-64/pr19609-1b.d: Likewise.
	* testsuite/ld-x86-64/pr19609-1c.d: Likewise.
	* testsuite/ld-x86-64/pr19609-1d.d: Likewise.
	* testsuite/ld-x86-64/pr19609-1e.d: Likewise.
	* testsuite/ld-x86-64/pr19609-1f.d: Likewise.
	* testsuite/ld-x86-64/pr19609-1g.d: Likewise.
	* testsuite/ld-x86-64/pr19609-1h.d: Likewise.
	* testsuite/ld-x86-64/pr19609-1i.d: Likewise.
	* testsuite/ld-x86-64/pr19609-1j.d: Likewise.
	* testsuite/ld-x86-64/pr19609-1k.d: Likewise.
	* testsuite/ld-x86-64/pr19609-1l.d: Likewise.
	* testsuite/ld-x86-64/pr19609-1m.d: Likewise.
	* testsuite/ld-x86-64/pr19609-2.s: Likewise.
	* testsuite/ld-x86-64/pr19609-2a.d: Likewise.
	* testsuite/ld-x86-64/pr19609-2b.d: Likewise.
	* testsuite/ld-x86-64/pr19609-2c.d: Likewise.
	* testsuite/ld-x86-64/pr19609-2d.d: Likewise.
	* testsuite/ld-x86-64/pr19609-3.s: Likewise.
	* testsuite/ld-x86-64/pr19609-3a.d: Likewise.
	* testsuite/ld-x86-64/pr19609-3b.d: Likewise.
	* testsuite/ld-x86-64/pr19609-4.s: Likewise.
	* testsuite/ld-x86-64/pr19609-4a.d: Likewise.
	* testsuite/ld-x86-64/pr19609-4b.d: Likewise.
	* testsuite/ld-x86-64/pr19609-4c.d: Likewise.
	* testsuite/ld-x86-64/pr19609-4d.d: Likewise.
	* testsuite/ld-x86-64/pr19609-4e.d: Likewise.
	* testsuite/ld-x86-64/pr19609-5.s: Likewise.
	* testsuite/ld-x86-64/pr19609-5a.d: Likewise.
	* testsuite/ld-x86-64/pr19609-5b.d: Likewise.
	* testsuite/ld-x86-64/pr19609-5c.d: Likewise.
	* testsuite/ld-x86-64/pr19609-5d.d: Likewise.
	* testsuite/ld-x86-64/pr19609-5e.d: Likewise.
	* testsuite/ld-x86-64/pr19609-6.s: Likewise.
	* testsuite/ld-x86-64/pr19609-6a.d: Likewise.
	* testsuite/ld-x86-64/pr19609-6b.d: Likewise.
	* testsuite/ld-x86-64/pr19609-6c.d: Likewise.
	* testsuite/ld-x86-64/pr19609-6d.d: Likewise.
	* testsuite/ld-x86-64/pr19609-7.s: Likewise.
	* testsuite/ld-x86-64/pr19609-7a.d: Likewise.
	* testsuite/ld-x86-64/pr19609-7b.d: Likewise.
	* testsuite/ld-x86-64/pr19609-7c.d: Likewise.
	* testsuite/ld-x86-64/pr19609-7d.d: Likewise.
	* testsuite/ld-i386/i386.exp: Run undefweak tests and tests for
	PR ld/19609.
	* testsuite/ld-x86-64/x86-64.exp: Run pr13082-3c, pr13082-3d
	and tests for PR ld/19609.

3 files changed, 204 insertions, 68 deletions

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index a2e5f1e..0b52c17 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,5 +1,20 @@
 2016-02-26  H.J. Lu  <hongjiu.lu@intel.com>
 
+	PR ld/19609
+	* elf32-i386.c (elf_i386_convert_load): Convert to R_386_32 for
+	load with locally bound symbols if PIC is false or there is no
+	base register.  Optimize branch to 0 if PIC is false.
+	(elf_i386_relocate_section): Don't generate dynamic relocations
+	against undefined weak symbols if PIC is false.
+	* elf64-x86-64.c (elf_x86_64_convert_load): Disable optimization
+	if we can't estimate relocation overflow with --no-relax.
+	Convert to R_X86_64_32S/R_X86_64_32 for load with locally bound
+	symbols if PIC is false.  Optimize branch to 0 if PIC is false.
+	(elf_x86_64_relocate_section): Don't generate dynamic relocations
+	against undefined weak symbols if PIC is false.
+
+2016-02-26  H.J. Lu  <hongjiu.lu@intel.com>
+
 	PR ld/19645
 	* bfd.c (bfd): Change flags to 20 bits.
 	(BFD_CONVERT_ELF_COMMON): New.
diff --git a/bfd/elf32-i386.c b/bfd/elf32-i386.c
index 2ae5e44..ab3945d 100644
--- a/bfd/elf32-i386.c
+++ b/bfd/elf32-i386.c
@@ -2863,6 +2863,7 @@ elf_i386_convert_load (bfd *abfd, asection *sec,
   struct elf_i386_link_hash_table *htab;
   bfd_boolean changed_contents;
   bfd_boolean changed_relocs;
+  bfd_boolean is_pic;
   bfd_signed_vma *local_got_refcounts;
 
   /* Don't even try to convert non-ELF outputs.  */
@@ -2889,6 +2890,8 @@ elf_i386_convert_load (bfd *abfd, asection *sec,
   changed_relocs = FALSE;
   local_got_refcounts = elf_local_got_refcounts (abfd);
 
+  is_pic = bfd_link_pic (link_info);
+
   /* Get the section contents.  */
   if (elf_section_data (sec)->this_hdr.contents != NULL)
     contents = elf_section_data (sec)->this_hdr.contents;
@@ -2913,6 +2916,7 @@ elf_i386_convert_load (bfd *abfd, asection *sec,
       unsigned int addend;
       unsigned int nop;
       bfd_vma nop_offset;
+      bfd_boolean to_reloc_32;
 
       if (r_type != R_386_GOT32 && r_type != R_386_GOT32X)
 	continue;
@@ -2929,9 +2933,7 @@ elf_i386_convert_load (bfd *abfd, asection *sec,
       modrm = bfd_get_8 (abfd, contents + roff - 1);
       baseless = (modrm & 0xc7) == 0x5;
 
-      if (r_type == R_386_GOT32X
-	  && baseless
-	  && bfd_link_pic (link_info))
+      if (r_type == R_386_GOT32X && baseless && is_pic)
 	{
 	  /* For PIC, disallow R_386_GOT32X without a base register
 	     since we don't know what the GOT base is.   Allow
@@ -2960,7 +2962,7 @@ elf_i386_convert_load (bfd *abfd, asection *sec,
 
       opcode = bfd_get_8 (abfd, contents + roff - 2);
 
-      /* It is OK to convert mov to lea.  */
+      /* Convert mov to lea since it has been done for a while.  */
       if (opcode != 0x8b)
 	{
 	  /* Only convert R_386_GOT32X relocation for call, jmp or
@@ -2968,14 +2970,12 @@ elf_i386_convert_load (bfd *abfd, asection *sec,
 	     instructions.  */
 	  if (r_type != R_386_GOT32X)
 	    continue;
-
-	  /* It is OK to convert indirect branch to direct branch.  It
-	     is OK to convert adc, add, and, cmp, or, sbb, sub, test,
-	     xor only when PIC is false.   */
-	  if (opcode != 0xff && bfd_link_pic (link_info))
-	    continue;
 	}
 
+      /* Convert to R_386_32 if PIC is false or there is no base
+	 register.  */
+      to_reloc_32 = !is_pic || baseless;
+
       /* Try to convert R_386_GOT32 and R_386_GOT32X.  Get the symbol
 	 referred to by the reloc.  */
       if (r_symndx < symtab_hdr->sh_info)
@@ -3010,6 +3010,27 @@ elf_i386_convert_load (bfd *abfd, asection *sec,
       if (h->type == STT_GNU_IFUNC)
 	continue;
 
+      /* Undefined weak symbol is only bound locally in executable
+	 and its reference is resolved as 0.  */
+      if (UNDEFINED_WEAK_RESOLVED_TO_ZERO (link_info,
+					   elf_i386_hash_entry (h)))
+	{
+	  if (opcode == 0xff)
+	    {
+	      /* No direct branch to 0 for PIC.  */
+	      if (is_pic)
+		continue;
+	      else
+		goto convert_branch;
+	    }
+	  else
+	    {
+	      /* We can convert load of address 0 to R_386_32.  */
+	      to_reloc_32 = TRUE;
+	      goto convert_load;
+	    }
+	}
+
       if (opcode == 0xff)
 	{
 	  /* We have "call/jmp *foo@GOT[(%reg)]".  */
@@ -3087,27 +3108,29 @@ convert_branch:
 convert_load:
 	      if (opcode == 0x8b)
 		{
-		  /* Convert "mov foo@GOT(%reg1), %reg2" to
-		     "lea foo@GOTOFF(%reg1), %reg2".  */
-		  if (r_type == R_386_GOT32X
-		      && (baseless || !bfd_link_pic (link_info)))
+		  if (to_reloc_32)
 		    {
+		      /* Convert "mov foo@GOT[(%reg1)], %reg2" to
+			 "mov $foo, %reg2" with R_386_32.  */
 		      r_type = R_386_32;
-		      /* For R_386_32, convert
-			 "lea foo@GOTOFF(%reg1), %reg2" to
-			 "lea foo@GOT, %reg2".  */
-		      if (!baseless)
-			{
-			  modrm = 0x5 | (modrm & 0x38);
-			  bfd_put_8 (abfd, modrm, contents + roff - 1);
-			}
+		      modrm = 0xc0 | (modrm & 0x38) >> 3;
+		      bfd_put_8 (abfd, modrm, contents + roff - 1);
+		      opcode = 0xc7;
 		    }
 		  else
-		    r_type = R_386_GOTOFF;
-		  opcode = 0x8d;
+		    {
+		      /* Convert "mov foo@GOT(%reg1), %reg2" to
+			 "lea foo@GOTOFF(%reg1), %reg2".  */
+		      r_type = R_386_GOTOFF;
+		      opcode = 0x8d;
+		    }
 		}
 	      else
 		{
+		  /* Only R_386_32 is supported.  */
+		  if (!to_reloc_32)
+		    continue;
+
 		  if (opcode == 0x85)
 		    {
 		      /* Convert "test %reg1, foo@GOT(%reg2)" to
@@ -4369,10 +4392,10 @@ r_386_got32:
 		      || eh->func_pointer_refcount > 0
 		      || (h->root.type == bfd_link_hash_undefweak
 			  && !resolved_to_zero))
-		  && ((h->def_dynamic
-		       && !h->def_regular)
-		      || h->root.type == bfd_link_hash_undefweak
-		      || h->root.type == bfd_link_hash_undefined)))
+		  && ((h->def_dynamic && !h->def_regular)
+		      /* Undefined weak symbol is bound locally when
+			 PIC is false.  */
+		      || h->root.type == bfd_link_hash_undefweak)))
 	    {
 	      Elf_Internal_Rela outrel;
 	      bfd_boolean skip, relocate;
diff --git a/bfd/elf64-x86-64.c b/bfd/elf64-x86-64.c
index 6ca3b2e..c696850 100644
--- a/bfd/elf64-x86-64.c
+++ b/bfd/elf64-x86-64.c
@@ -3070,6 +3070,8 @@ elf_x86_64_convert_load (bfd *abfd, asection *sec,
   bfd_boolean changed_relocs;
   bfd_signed_vma *local_got_refcounts;
   bfd_vma maxpagesize;
+  bfd_boolean is_pic;
+  bfd_boolean require_reloc_pc32;
 
   /* Don't even try to convert non-ELF outputs.  */
   if (!is_elf_hash_table (link_info->hash))
@@ -3105,6 +3107,13 @@ elf_x86_64_convert_load (bfd *abfd, asection *sec,
 	goto error_return;
     }
 
+  is_pic = bfd_link_pic (link_info);
+
+  /* TRUE if we can convert only to R_X86_64_PC32.  Enable it for
+     --no-relax.  */
+  require_reloc_pc32
+    = link_info->disable_target_specific_optimizations > 1;
+
   irelend = internal_relocs + sec->reloc_count;
   for (irel = internal_relocs; irel < irelend; irel++)
     {
@@ -3118,10 +3127,12 @@ elf_x86_64_convert_load (bfd *abfd, asection *sec,
       bfd_signed_vma raddend;
       unsigned int opcode;
       unsigned int modrm;
+      bfd_boolean relocx;
+      bfd_boolean to_reloc_pc32;
 
-      if (r_type != R_X86_64_GOTPCREL
-	  && r_type != R_X86_64_GOTPCRELX
-	  && r_type != R_X86_64_REX_GOTPCRELX)
+      relocx = (r_type == R_X86_64_GOTPCRELX
+		|| r_type == R_X86_64_REX_GOTPCRELX);
+      if (!relocx && r_type != R_X86_64_GOTPCREL)
 	continue;
 
       roff = irel->r_offset;
@@ -3135,26 +3146,27 @@ elf_x86_64_convert_load (bfd *abfd, asection *sec,
 
       opcode = bfd_get_8 (abfd, contents + roff - 2);
 
-      /* It is OK to convert mov to lea.  */
+      /* Convert mov to lea since it has been done for a while.  */
       if (opcode != 0x8b)
 	{
 	  /* Only convert R_X86_64_GOTPCRELX and R_X86_64_REX_GOTPCRELX
-	     for mov call, jmp or one of adc, add, and, cmp, or, sbb,
-	     sub, test, xor instructions.  */
-	  if (r_type != R_X86_64_GOTPCRELX
-	      && r_type != R_X86_64_REX_GOTPCRELX)
+	     for call, jmp or one of adc, add, and, cmp, or, sbb, sub,
+	     test, xor instructions.  */
+	  if (!relocx)
 	    continue;
-
-	  /* It is OK to convert indirect branch to direct branch.  */
-	  if (opcode != 0xff)
-	    {
-	      /* It is OK to convert adc, add, and, cmp, or, sbb, sub,
-		 test, xor only when PIC is false.   */
-	      if (bfd_link_pic (link_info))
-		continue;
-	    }
 	}
 
+      /* We convert only to R_X86_64_PC32:
+	 1. Branch.
+	 2. R_X86_64_GOTPCREL since we can't modify REX byte.
+	 3. require_reloc_pc32 is true.
+	 4. PIC.
+       */
+      to_reloc_pc32 = (opcode == 0xff
+		       || !relocx
+		       || require_reloc_pc32
+		       || is_pic);
+
       /* Get the symbol referred to by the reloc.  */
       if (r_symndx < symtab_hdr->sh_info)
 	{
@@ -3195,22 +3207,59 @@ elf_x86_64_convert_load (bfd *abfd, asection *sec,
 	  /* STT_GNU_IFUNC must keep GOTPCREL relocations.  We also
 	     avoid optimizing GOTPCREL relocations againt _DYNAMIC
 	     since ld.so may use its link-time address.  */
-	  if ((h->def_regular
-	       || h->root.type == bfd_link_hash_defined
-	       || h->root.type == bfd_link_hash_defweak)
-	      && h->type != STT_GNU_IFUNC
-	      && h != htab->elf.hdynamic
-	      && SYMBOL_REFERENCES_LOCAL (link_info, h))
+	  if (h->type == STT_GNU_IFUNC)
+	    continue;
+
+	  /* Undefined weak symbol is only bound locally in executable
+	     and its reference is resolved as 0 without relocation
+	     overflow.  We can only perform this optimization for
+	     GOTPCRELX relocations since we need to modify REX byte.
+	     It is OK convert mov with R_X86_64_GOTPCREL to
+	     R_X86_64_PC32.  */
+	  if ((relocx || opcode == 0x8b)
+	      && UNDEFINED_WEAK_RESOLVED_TO_ZERO (link_info,
+						  elf_x86_64_hash_entry (h)))
+	    {
+	      if (opcode == 0xff)
+		{
+		  /* Skip for branch instructions since R_X86_64_PC32
+		     may overflow.  */
+		  if (require_reloc_pc32)
+		    continue;
+		}
+	      else if (relocx)
+		{
+		  /* For non-branch instructions, we can convert to
+		     R_X86_64_32/R_X86_64_32S since we know if there
+		     is a REX byte.  */
+		  to_reloc_pc32 = FALSE;
+		}
+
+	      /* Since we don't know the current PC when PIC is true,
+		 we can't convert to R_X86_64_PC32.  */
+	      if (to_reloc_pc32 && is_pic)
+		continue;
+
+	      goto convert;
+	    }
+	  else if ((h->def_regular
+		    || h->root.type == bfd_link_hash_defined
+		    || h->root.type == bfd_link_hash_defweak)
+		   && h != htab->elf.hdynamic
+		   && SYMBOL_REFERENCES_LOCAL (link_info, h))
 	    {
 	      /* bfd_link_hash_new or bfd_link_hash_undefined is
-	         set by an assignment in a linker script in
-	         bfd_elf_record_link_assignment.  FIXME: If we
-		 ever get a linker error due relocation overflow,
-		 we will skip this optimization.  */
+		 set by an assignment in a linker script in
+		 bfd_elf_record_link_assignment.   */
 	      if (h->def_regular
 		  && (h->root.type == bfd_link_hash_new
 		      || h->root.type == bfd_link_hash_undefined))
-		goto convert;
+		{
+		  /* Skip since R_X86_64_32/R_X86_64_32S may overflow.  */
+		  if (require_reloc_pc32)
+		    continue;
+		  goto convert;
+		}
 	      tsec = h->root.u.def.section;
 	      toff = h->root.u.def.value;
 	      symtype = h->type;
@@ -3219,6 +3268,10 @@ elf_x86_64_convert_load (bfd *abfd, asection *sec,
 	    continue;
 	}
 
+      /* We can only estimate relocation overflow for R_X86_64_PC32.  */
+      if (!to_reloc_pc32)
+	goto convert;
+
       if (tsec->sec_info_type == SEC_INFO_TYPE_MERGE)
 	{
 	  /* At this stage in linking, no SEC_MERGE symbol has been
@@ -3342,15 +3395,55 @@ convert:
 	}
       else
 	{
+	  unsigned int rex;
+	  unsigned int rex_mask = REX_R;
+
+	  if (r_type == R_X86_64_REX_GOTPCRELX)
+	    rex = bfd_get_8 (abfd, contents + roff - 3);
+	  else
+	    rex = 0;
+
 	  if (opcode == 0x8b)
 	    {
-	      /* Convert "mov foo@GOTPCREL(%rip), %reg" to
-		 "lea foo(%rip), %reg".  */
-	      opcode = 0x8d;
-	      r_type = R_X86_64_PC32;
+	      if (to_reloc_pc32)
+		{
+		  /* Convert "mov foo@GOTPCREL(%rip), %reg" to
+		     "lea foo(%rip), %reg".  */
+		  opcode = 0x8d;
+		  r_type = R_X86_64_PC32;
+		}
+	      else
+		{
+		  /* Convert "mov foo@GOTPCREL(%rip), %reg" to
+		     "mov $foo, %reg".  */
+		  opcode = 0xc7;
+		  modrm = bfd_get_8 (abfd, contents + roff - 1);
+		  modrm = 0xc0 | (modrm & 0x38) >> 3;
+		  if ((rex & REX_W) != 0
+		      && ABI_64_P (link_info->output_bfd))
+		    {
+		      /* Keep the REX_W bit in REX byte for LP64.  */
+		      r_type = R_X86_64_32S;
+		      goto rewrite_modrm_rex;
+		    }
+		  else
+		    {
+		      /* If the REX_W bit in REX byte isn't needed,
+			 use R_X86_64_32 and clear the W bit to avoid
+			 sign-extend imm32 to imm64.  */
+		      r_type = R_X86_64_32;
+		      /* Clear the W bit in REX byte.  */
+		      rex_mask |= REX_W;
+		      goto rewrite_modrm_rex;
+		    }
+		}
 	    }
 	  else
 	    {
+	      /* R_X86_64_PC32 isn't supported.  */
+	      if (to_reloc_pc32)
+		continue;
+
 	      modrm = bfd_get_8 (abfd, contents + roff - 1);
 	      if (opcode == 0x85)
 		{
@@ -3366,18 +3459,23 @@ convert:
 		  modrm = 0xc0 | (modrm & 0x38) >> 3 | (opcode & 0x3c);
 		  opcode = 0x81;
 		}
+
+	      /* Use R_X86_64_32 with 32-bit operand to avoid relocation
+		 overflow when sign-extending imm32 to imm64.  */
+	      r_type = (rex & REX_W) != 0 ? R_X86_64_32S : R_X86_64_32;
+
+rewrite_modrm_rex:
 	      bfd_put_8 (abfd, modrm, contents + roff - 1);
 
-	      if (r_type == R_X86_64_REX_GOTPCRELX)
+	      if (rex)
 		{
 		  /* Move the R bit to the B bit in REX byte.  */
-		  unsigned int rex = bfd_get_8 (abfd, contents + roff - 3);
-		  rex = (rex & ~REX_R) | (rex & REX_R) >> 2;
+		  rex = (rex & ~rex_mask) | (rex & REX_R) >> 2;
 		  bfd_put_8 (abfd, rex, contents + roff - 3);
 		}
-	      /* No addend for R_X86_64_32S relocation.  */
+
+	      /* No addend for R_X86_64_32/R_X86_64_32S relocations.  */
 	      irel->r_addend = 0;
-	      r_type = R_X86_64_32S;
 	    }
 
 	  bfd_put_8 (abfd, opcode, contents + roff - 2);
@@ -4688,9 +4786,9 @@ direct:
 		      || eh->func_pointer_refcount > 0
 		      || (h->root.type == bfd_link_hash_undefweak
 			  && !resolved_to_zero))
-		  && ((h->def_dynamic
-		       && !h->def_regular)
-		      || h->root.type == bfd_link_hash_undefweak
+		  && ((h->def_dynamic && !h->def_regular)
+		      /* Undefined weak symbol is bound locally when
+			 PIC is false.  */
 		      || h->root.type == bfd_link_hash_undefined)))
 	    {
 	      Elf_Internal_Rela outrel;