https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102772
--- Comment #19 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
If it is the linker, you can always objdump -dr the binary to see what is in
there after linking. s@ntpoff in my understanding is a relocation that should
supply at link time the offset from the TLS base and at least on the GCC side
it can appear anywhere where 32-bit immediate appears in an instruction (or in
data section too), not necessarily in addl imm, %eax instruction.
Perhaps also try to have 2 different functions, one with
movl %gs:0, %eax
addl $s@ntpoff, %eax
ret
and another with
pushl %ebx
movl %gs:0, %ebx
addl $s@ntpoff, %ebx
popl %ebx
ret
and see what they do at runtime (if they both print the same address in each
thread or not).