https://sourceware.org/bugzilla/show_bug.cgi?id=34224

            Bug ID: 34224
           Summary: [RISC-V] GNU ld.bfd false truncated JAL at positive
                    limit after relax
           Product: binutils
           Version: 2.45
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: ld
          Assignee: unassigned at sourceware dot org
          Reporter: l784896635 at gmail dot com
  Target Milestone: ---

I ran into this while reducing a RISC-V linker testcase. The reproducer is
already quite small, and I have been seeing the same result consistently across
three reruns.

Summary
=======
riscv64-unknown-elf-ld 2.45 --relax rejects the legal link with relocation
truncated to fit: R_RISCV_JAL against baz, while ld.lld 21.1.3 links the same
object and keeps the final foo to baz call as auipc ra,0x100 plus jalr
ra,0x0(ra).

Expected behavior
=================
A fixed-layout image performs many short direct calls to a nearby helper bar,
then makes one final far call from foo to baz. The last call sits exactly at
the positive jal overflow boundary, so a correct linker must keep it as auipc
plus jalr instead of forcing a jal relaxation.

Environment
===========
- product: binutils
- component: ld
- toolchain route: gas+ld.bfd with ld.lld control
- march: rv64i
- mabi: lp64
- first failing stage: link

Reduced testcase
================
--- case.s ---
        .section .text.a, "ax"
        .align 2
        .globl _start
_start:
        .rept 0x100
        call bar
        .endr
        .globl foo
foo:
        call baz

        .section .text.b, "ax"
        .align 2
        .globl bar
bar:
        nop

        .section .text.c, "ax"
        .align 2
        .globl baz
baz:
        nop

--- layout.ld ---
SECTIONS {
        .text.a 0x0 : { *(.text.a) }
        .text.b : { *(.text.b) }
        .text.c 0x100400 : { *(.text.c) }
}

Reproduction notes
==================
- This packaged root does not have a single canonical `run.ps1` wrapper.
- Use the reduced inputs under `case/` and follow the commands documented in
`case/README.md`.
- Stable witness outputs, when present, are preserved under
`verify/run1..run3/`.

What I checked
==============
- Reduced inputs are preserved under case/.
- Stable witness outputs are preserved under verify/run1..run3/.
- The strict recheck says stable normalized run signatures across three runs:
True.
- Tracker guidance link:
https://sourceware.org/binutils/docs/ld/Bug-Reporting.html
- evidence summary: 3 clean reproductions under
hunt/verify/bfd_false_truncated_jal_at_positive_limit/run1..run3 show stable
gas assembly success, stable ld.bfd link-time failure at .text.a+0x400 with
relocation truncated to fit: R_RISCV_JAL against baz, and stable ld.lld success
with final disassembly keeping foo at 0x400 and baz at 0x100400 connected by
auipc plus jalr rather than jal.

Notes
=====
local reduced fixed-address case derived from
bfd-relax-truncated-20260526T083500Z and upstream relax-truncated patch family

Root key: bfd.riscv.false_truncated_jal_at_positive_limit_after_relax
Case id: 20260526-bfd-false-truncated-jal-positive-limit

-- 
You are receiving this mail because:
You are on the CC list for the bug.

Reply via email to