Skip PLT for function pointer initialization

We use its PLT entry to initialize function pointer at run-time.  If
there is no other usage for the PLT entry, we can generate run-time
function pointer relocations in read-write section, which can be
resolved by dynamic linker, to initialize function pointers.  It avoids
the extra indirect branch overhead in PLT.

bfd/

	PR ld/18900
	* elf32-i386.c (elf_i386_link_hash_entry): Add
	func_pointer_refcount.
	(elf_i386_link_hash_newfunc): Clear func_pointer_refcount.
	(elf_i386_get_local_sym_hash): Likewise.
	(elf_i386_copy_indirect_symbol): Also copy
	func_pointer_refcount.
	(elf_i386_check_relocs): Increment func_pointer_refcount.
	(elf_i386_gc_sweep_hook): Decrement func_pointer_refcount.
	(elf_i386_allocate_dynrelocs): Don't create the PLT entry if
	there are only function pointer relocations which can be
	resolved at run-time.  Keep dynanamic relocations for run-time
	function pointer initialization.
	(elf_i386_relocate_section): Copy dynamic function pointer
	relocations.
	* elf64-x86-64.c (elf_x86_64_link_hash_entry): Add
	func_pointer_refcount.
	(elf_x86_64_link_hash_newfunc): Clear func_pointer_refcount.
	(elf_x86_64_get_local_sym_hash): Likewise.
	(elf_x86_64_copy_indirect_symbol): Also copy
	func_pointer_refcount.
	(elf_x86_64_check_relocs): Increment func_pointer_refcount.
	(elf_x86_64_gc_sweep_hook): Decrement func_pointer_refcount.
	(elf_x86_64_allocate_dynrelocs): Don't create the PLT entry if
	there are only function pointer relocations which can be
	resolved at run-time.  Keep dynanamic relocations for run-time
	function pointer initialization.
	(elf_x86_64_relocate_section): Copy dynamic function pointer
	relocations.

ld/testsuite/

	PR ld/18900
	* ld-i386/i386.exp: Run tests for PR ld/18900.
	* ld-x86-64/x86-64.exp: Likewise.
	* ld-i386/pr18900.out: New file.
	* ld-i386/pr18900a.c: Likewise.
	* ld-i386/pr18900a.c: Likewise.
	* ld-i386/pr18900a.rd: Likewise.
	* ld-i386/pr18900b.c: Likewise.
	* ld-i386/pr18900b.rd: Likewise.
	* ld-i386/pr18900c.c: Likewise.
	* ld-x86-64/pr18900.out: Likewise.
	* ld-x86-64/pr18900a.c: Likewise.
	* ld-x86-64/pr18900a.rd: Likewise.
	* ld-x86-64/pr18900b.c: Likewise.
	* ld-x86-64/pr18900b.rd: Likewise.
	* ld-x86-64/pr18900c.c: Likewise.
	* ld-x86-64/mpx3.dd: Updated.

3 files changed, 150 insertions, 17 deletions

diff --git a/bfd/ChangeLog b/bfd/ChangeLog
index b3ee41b..b614e3c 100644
--- a/bfd/ChangeLog
+++ b/bfd/ChangeLog
@@ -1,3 +1,35 @@
+2015-09-01  H.J. Lu  <hongjiu.lu@intel.com>
+
+	PR ld/18900
+	* elf32-i386.c (elf_i386_link_hash_entry): Add
+	func_pointer_refcount.
+	(elf_i386_link_hash_newfunc): Clear func_pointer_refcount.
+	(elf_i386_get_local_sym_hash): Likewise.
+	(elf_i386_copy_indirect_symbol): Also copy
+	func_pointer_refcount.
+	(elf_i386_check_relocs): Increment func_pointer_refcount.
+	(elf_i386_gc_sweep_hook): Decrement func_pointer_refcount.
+	(elf_i386_allocate_dynrelocs): Don't create the PLT entry if
+	there are only function pointer relocations which can be
+	resolved at run-time.  Keep dynanamic relocations for run-time
+	function pointer initialization.
+	(elf_i386_relocate_section): Copy dynamic function pointer
+	relocations.
+	* elf64-x86-64.c (elf_x86_64_link_hash_entry): Add
+	func_pointer_refcount.
+	(elf_x86_64_link_hash_newfunc): Clear func_pointer_refcount.
+	(elf_x86_64_get_local_sym_hash): Likewise.
+	(elf_x86_64_copy_indirect_symbol): Also copy
+	func_pointer_refcount.
+	(elf_x86_64_check_relocs): Increment func_pointer_refcount.
+	(elf_x86_64_gc_sweep_hook): Decrement func_pointer_refcount.
+	(elf_x86_64_allocate_dynrelocs): Don't create the PLT entry if
+	there are only function pointer relocations which can be
+	resolved at run-time.  Keep dynanamic relocations for run-time
+	function pointer initialization.
+	(elf_x86_64_relocate_section): Copy dynamic function pointer
+	relocations.
+
 2015-09-01  Alan Modra  <amodra@gmail.com>
 
 	* elf64-ppc.c (ppc64_elf_maybe_function_sym): Adjust symbol value
diff --git a/bfd/elf32-i386.c b/bfd/elf32-i386.c
index 7642d0f..85b7009 100644
--- a/bfd/elf32-i386.c
+++ b/bfd/elf32-i386.c
@@ -759,6 +759,10 @@ struct elf_i386_link_hash_entry
   /* Symbol is referenced by R_386_GOTOFF relocation.  */
   unsigned int gotoff_ref : 1;
 
+  /* Reference count of C/C++ function pointer relocations in read-write
+     section which can be resolved at run-time.  */
+  bfd_signed_vma func_pointer_refcount;
+
   /* Information about the GOT PLT entry. Filled when there are both
      GOT and PLT relocations against the same function.  */
   union gotplt_union plt_got;
@@ -883,6 +887,7 @@ elf_i386_link_hash_newfunc (struct bfd_hash_entry *entry,
       eh->dyn_relocs = NULL;
       eh->tls_type = GOT_UNKNOWN;
       eh->gotoff_ref = 0;
+      eh->func_pointer_refcount = 0;
       eh->plt_got.offset = (bfd_vma) -1;
       eh->tlsdesc_got = (bfd_vma) -1;
     }
@@ -952,6 +957,7 @@ elf_i386_get_local_sym_hash (struct elf_i386_link_hash_table *htab,
       ret->elf.indx = sec->id;
       ret->elf.dynstr_index = ELF32_R_SYM (rel->r_info);
       ret->elf.dynindx = -1;
+      ret->func_pointer_refcount = 0;
       ret->plt_got.offset = (bfd_vma) -1;
       *slot = ret;
     }
@@ -1138,7 +1144,15 @@ elf_i386_copy_indirect_symbol (struct bfd_link_info *info,
       dir->pointer_equality_needed |= ind->pointer_equality_needed;
     }
   else
-    _bfd_elf_link_hash_copy_indirect (info, dir, ind);
+    {
+      if (eind->func_pointer_refcount > 0)
+	{
+	  edir->func_pointer_refcount += eind->func_pointer_refcount;
+	  eind->func_pointer_refcount = 0;
+	}
+
+      _bfd_elf_link_hash_copy_indirect (info, dir, ind);
+    }
 }
 
 /* Return TRUE if the TLS access code sequence support transition
@@ -1759,7 +1773,13 @@ elf_i386_check_relocs (bfd *abfd,
 		 refers to is in a shared lib.  */
 	      h->plt.refcount += 1;
 	      if (r_type != R_386_PC32)
-		h->pointer_equality_needed = 1;
+		{
+		  h->pointer_equality_needed = 1;
+		  /* R_386_32 can be resolved at run-time.  */
+		  if (r_type == R_386_32
+		      && (sec->flags & SEC_READONLY) == 0)
+		    eh->func_pointer_refcount += 1;
+		}
 	    }
 
 	  size_reloc = FALSE;
@@ -2076,6 +2096,14 @@ elf_i386_gc_sweep_hook (bfd *abfd,
 	    {
 	      if (h->plt.refcount > 0)
 		h->plt.refcount -= 1;
+	      if (r_type == R_386_32
+		  && (sec->flags & SEC_READONLY) == 0)
+		{
+		  struct elf_i386_link_hash_entry *eh
+		    = (struct elf_i386_link_hash_entry *) h;
+		  if (eh->func_pointer_refcount > 0)
+		    eh->func_pointer_refcount -= 1;
+		}
 	    }
 	  break;
 
@@ -2298,6 +2326,11 @@ elf_i386_allocate_dynrelocs (struct elf_link_hash_entry *h, void *inf)
 
   plt_entry_size = GET_PLT_ENTRY_SIZE (info->output_bfd);
 
+  /* Clear the reference count of function pointer relocations if
+     symbol isn't a normal function.  */
+  if (h->type != STT_FUNC)
+    eh->func_pointer_refcount = 0;
+
   /* We can't use the GOT PLT if pointer equality is needed since
      finish_dynamic_symbol won't clear symbol value and the dynamic
      linker won't update the GOT slot.  We will get into an infinite
@@ -2323,11 +2356,18 @@ elf_i386_allocate_dynrelocs (struct elf_link_hash_entry *h, void *inf)
     return _bfd_elf_allocate_ifunc_dyn_relocs (info, h, &eh->dyn_relocs,
                                                plt_entry_size,
 					       plt_entry_size, 4);
+  /* Don't create the PLT entry if there are only function pointer
+     relocations which can be resolved at run-time.  */
   else if (htab->elf.dynamic_sections_created
-	   && (h->plt.refcount > 0 || eh->plt_got.refcount > 0))
+	   && (h->plt.refcount > eh->func_pointer_refcount
+	       || eh->plt_got.refcount > 0))
     {
       bfd_boolean use_plt_got;
 
+      /* Clear the reference count of function pointer relocations
+	 if PLT is used.  */
+      eh->func_pointer_refcount = 0;
+
       if ((info->flags & DF_BIND_NOW) && !h->pointer_equality_needed)
 	{
 	  /* Don't use the regular PLT for DF_BIND_NOW. */
@@ -2570,9 +2610,10 @@ elf_i386_allocate_dynrelocs (struct elf_link_hash_entry *h, void *inf)
     {
       /* For the non-shared case, discard space for relocs against
 	 symbols which turn out to need copy relocs or are not
-	 dynamic.  */
+	 dynamic.  Keep dynamic relocations for run-time function
+	 pointer initialization.  */
 
-      if (!h->non_got_ref
+      if ((!h->non_got_ref || eh->func_pointer_refcount > 0)
 	  && ((h->def_dynamic
 	       && !h->def_regular)
 	      || (htab->elf.dynamic_sections_created
@@ -2595,6 +2636,7 @@ elf_i386_allocate_dynrelocs (struct elf_link_hash_entry *h, void *inf)
 	}
 
       eh->dyn_relocs = NULL;
+      eh->func_pointer_refcount = 0;
 
     keep: ;
     }
@@ -3687,6 +3729,7 @@ elf_i386_relocate_section (bfd *output_bfd,
 	    }
 	}
 
+      eh = (struct elf_i386_link_hash_entry *) h;
       switch (r_type)
 	{
 	case R_386_GOT32:
@@ -3855,7 +3898,6 @@ elf_i386_relocate_section (bfd *output_bfd,
 	  if (h == NULL)
 	    break;
 
-	  eh = (struct elf_i386_link_hash_entry *) h;
 	  if ((h->plt.offset == (bfd_vma) -1
 	       && eh->plt_got.offset == (bfd_vma) -1)
 	      || htab->elf.splt == NULL)
@@ -3894,6 +3936,7 @@ elf_i386_relocate_section (bfd *output_bfd,
 	      || is_vxworks_tls)
 	    break;
 
+	  /* Copy dynamic function pointer relocations.  */
 	  if ((bfd_link_pic (info)
 	       && (h == NULL
 		   || ELF_ST_VISIBILITY (h->other) == STV_DEFAULT
@@ -3904,7 +3947,7 @@ elf_i386_relocate_section (bfd *output_bfd,
 		  && !bfd_link_pic (info)
 		  && h != NULL
 		  && h->dynindx != -1
-		  && !h->non_got_ref
+		  && (!h->non_got_ref || eh->func_pointer_refcount > 0)
 		  && ((h->def_dynamic
 		       && !h->def_regular)
 		      || h->root.type == bfd_link_hash_undefweak
diff --git a/bfd/elf64-x86-64.c b/bfd/elf64-x86-64.c
index f15d33e..f753c7a 100644
--- a/bfd/elf64-x86-64.c
+++ b/bfd/elf64-x86-64.c
@@ -767,6 +767,10 @@ struct elf_x86_64_link_hash_entry
   /* TRUE if symbol has at least one BND relocation.  */
   unsigned int has_bnd_reloc : 1;
 
+  /* Reference count of C/C++ function pointer relocations in read-write
+     section which can be resolved at run-time.  */
+  bfd_signed_vma func_pointer_refcount;
+
   /* Information about the GOT PLT entry. Filled when there are both
      GOT and PLT relocations against the same function.  */
   union gotplt_union plt_got;
@@ -906,6 +910,7 @@ elf_x86_64_link_hash_newfunc (struct bfd_hash_entry *entry,
       eh->tls_type = GOT_UNKNOWN;
       eh->needs_copy = 0;
       eh->has_bnd_reloc = 0;
+      eh->func_pointer_refcount = 0;
       eh->plt_bnd.offset = (bfd_vma) -1;
       eh->plt_got.offset = (bfd_vma) -1;
       eh->tlsdesc_got = (bfd_vma) -1;
@@ -976,6 +981,7 @@ elf_x86_64_get_local_sym_hash (struct elf_x86_64_link_hash_table *htab,
       ret->elf.indx = sec->id;
       ret->elf.dynstr_index = htab->r_sym (rel->r_info);
       ret->elf.dynindx = -1;
+      ret->func_pointer_refcount = 0;
       ret->plt_got.offset = (bfd_vma) -1;
       *slot = ret;
     }
@@ -1173,7 +1179,15 @@ elf_x86_64_copy_indirect_symbol (struct bfd_link_info *info,
       dir->pointer_equality_needed |= ind->pointer_equality_needed;
     }
   else
-    _bfd_elf_link_hash_copy_indirect (info, dir, ind);
+    {
+      if (eind->func_pointer_refcount > 0)
+	{
+	  edir->func_pointer_refcount += eind->func_pointer_refcount;
+	  eind->func_pointer_refcount = 0;
+	}
+
+      _bfd_elf_link_hash_copy_indirect (info, dir, ind);
+    }
 }
 
 static bfd_boolean
@@ -1950,7 +1964,22 @@ pointer:
 	      if (r_type != R_X86_64_PC32
 		  && r_type != R_X86_64_PC32_BND
 		  && r_type != R_X86_64_PC64)
-		h->pointer_equality_needed = 1;
+		{
+		  h->pointer_equality_needed = 1;
+		  /* At run-time, R_X86_64_64 can be resolved for both
+		     x86-64 and x32. But R_X86_64_32 and R_X86_64_32S
+		     can only be resolved for x32.  */
+		  if ((sec->flags & SEC_READONLY) == 0
+		      && (r_type == R_X86_64_64
+			  || (!ABI_64_P (abfd)
+			      && (r_type == R_X86_64_32
+				  || r_type == R_X86_64_32S))))
+		    {
+		      struct elf_x86_64_link_hash_entry *eh
+			= (struct elf_x86_64_link_hash_entry *) h;
+		      eh->func_pointer_refcount += 1;
+		    }
+		}
 	    }
 
 	  size_reloc = FALSE;
@@ -2177,6 +2206,7 @@ elf_x86_64_gc_sweep_hook (bfd *abfd, struct bfd_link_info *info,
       unsigned long r_symndx;
       unsigned int r_type;
       struct elf_link_hash_entry *h = NULL;
+      bfd_boolean pointer_reloc;
 
       r_symndx = htab->r_sym (rel->r_info);
       if (r_symndx >= symtab_hdr->sh_info)
@@ -2228,6 +2258,7 @@ elf_x86_64_gc_sweep_hook (bfd *abfd, struct bfd_link_info *info,
 				       rel, relend, h, r_symndx))
 	return FALSE;
 
+      pointer_reloc = FALSE;
       switch (r_type)
 	{
 	case R_X86_64_TLSLD:
@@ -2261,11 +2292,15 @@ elf_x86_64_gc_sweep_hook (bfd *abfd, struct bfd_link_info *info,
 	    }
 	  break;
 
-	case R_X86_64_8:
-	case R_X86_64_16:
 	case R_X86_64_32:
-	case R_X86_64_64:
 	case R_X86_64_32S:
+	  pointer_reloc = !ABI_64_P (abfd);
+	  goto pointer;
+
+	case R_X86_64_64:
+	  pointer_reloc = TRUE;
+	case R_X86_64_8:
+	case R_X86_64_16:
 	case R_X86_64_PC8:
 	case R_X86_64_PC16:
 	case R_X86_64_PC32:
@@ -2273,6 +2308,7 @@ elf_x86_64_gc_sweep_hook (bfd *abfd, struct bfd_link_info *info,
 	case R_X86_64_PC64:
 	case R_X86_64_SIZE32:
 	case R_X86_64_SIZE64:
+pointer:
 	  if (bfd_link_pic (info)
 	      && (h == NULL || h->type != STT_GNU_IFUNC))
 	    break;
@@ -2285,6 +2321,13 @@ elf_x86_64_gc_sweep_hook (bfd *abfd, struct bfd_link_info *info,
 	    {
 	      if (h->plt.refcount > 0)
 		h->plt.refcount -= 1;
+	      if (pointer_reloc && (sec->flags & SEC_READONLY) == 0)
+		{
+		  struct elf_x86_64_link_hash_entry *eh
+		    = (struct elf_x86_64_link_hash_entry *) h;
+		  if (eh->func_pointer_refcount > 0)
+		    eh->func_pointer_refcount -= 1;
+		}
 	    }
 	  break;
 
@@ -2516,6 +2559,11 @@ elf_x86_64_allocate_dynrelocs (struct elf_link_hash_entry *h, void * inf)
       eh->plt_got.refcount = 1;
     }
 
+  /* Clear the reference count of function pointer relocations if
+     symbol isn't a normal function.  */
+  if (h->type != STT_FUNC)
+    eh->func_pointer_refcount = 0;
+
   /* Since STT_GNU_IFUNC symbol must go through PLT, we handle it
      here if it is defined and referenced in a non-shared object.  */
   if (h->type == STT_GNU_IFUNC
@@ -2542,11 +2590,18 @@ elf_x86_64_allocate_dynrelocs (struct elf_link_hash_entry *h, void * inf)
       else
 	return FALSE;
     }
+  /* Don't create the PLT entry if there are only function pointer
+     relocations which can be resolved at run-time.  */
   else if (htab->elf.dynamic_sections_created
-	   && (h->plt.refcount > 0 || eh->plt_got.refcount > 0))
+	   && (h->plt.refcount > eh->func_pointer_refcount
+	       || eh->plt_got.refcount > 0))
     {
       bfd_boolean use_plt_got;
 
+      /* Clear the reference count of function pointer relocations
+	 if PLT is used.  */
+      eh->func_pointer_refcount = 0;
+
       if ((info->flags & DF_BIND_NOW) && !h->pointer_equality_needed)
 	{
 	  /* Don't use the regular PLT for DF_BIND_NOW. */
@@ -2791,9 +2846,10 @@ elf_x86_64_allocate_dynrelocs (struct elf_link_hash_entry *h, void * inf)
     {
       /* For the non-shared case, discard space for relocs against
 	 symbols which turn out to need copy relocs or are not
-	 dynamic.  */
+	 dynamic.  Keep dynamic relocations for run-time function
+	 pointer initialization.  */
 
-      if (!h->non_got_ref
+      if ((!h->non_got_ref || eh->func_pointer_refcount > 0)
 	  && ((h->def_dynamic
 	       && !h->def_regular)
 	      || (htab->elf.dynamic_sections_created
@@ -2814,6 +2870,7 @@ elf_x86_64_allocate_dynrelocs (struct elf_link_hash_entry *h, void * inf)
 	}
 
       eh->dyn_relocs = NULL;
+      eh->func_pointer_refcount = 0;
 
     keep: ;
     }
@@ -4346,7 +4403,8 @@ direct:
 
 	   /* Don't copy a pc-relative relocation into the output file
 	      if the symbol needs copy reloc or the symbol is undefined
-	      when building executable.  */
+	      when building executable.  Copy dynamic function pointer
+	      relocations.  */
 	  if ((bfd_link_pic (info)
 	       && !(bfd_link_executable (info)
 		    && h != NULL
@@ -4365,7 +4423,7 @@ direct:
 		  && !bfd_link_pic (info)
 		  && h != NULL
 		  && h->dynindx != -1
-		  && !h->non_got_ref
+		  && (!h->non_got_ref || eh->func_pointer_refcount > 0)
 		  && ((h->def_dynamic
 		       && !h->def_regular)
 		      || h->root.type == bfd_link_hash_undefweak