Create the second PLT for BND relocations

Intel MPX introduces 4 bound registers, which will be used for parameter
passing in x86-64.  Bound registers are cleared by branch instructions.
Branch instructions with BND prefix will keep bound register contents.
This leads to 2 requirements to 64-bit MPX run-time:

1. Dynamic linker (ld.so) should save and restore bound registers during
symbol lookup.
2. Change the current 16-byte PLT0:

  ff 35 08 00 00 00	pushq  GOT+8(%rip)
  ff 25 00 10 00	jmpq  *GOT+16(%rip)
  0f 1f 40 00		nopl   0x0(%rax)

and 16-byte PLT1:

  ff 25 00 00 00 00    	jmpq   *name@GOTPCREL(%rip)
  68 00 00 00 00       	pushq  $index
  e9 00 00 00 00       	jmpq   PLT0

which clear bound registers, to preserve bound registers.

We use 2 new relocations:

to mark branch instructions with BND prefix.

When linker sees any R_X86_64_PC32_BND or R_X86_64_PLT32_BND relocations,
it switches to a different PLT0:

  ff 35 08 00 00 00	pushq  GOT+8(%rip)
  f2 ff 25 00 10 00	bnd jmpq *GOT+16(%rip)
  0f 1f 00		nopl   (%rax)

to preserve bound registers for symbol lookup and it also creates an
external PLT section, .pl.bnd.  Linker will create a BND PLT1 entry
in .plt:

  68 00 00 00 00       	pushq  $index
  f2 e9 00 00 00 00     bnd jmpq PLT0
  0f 1f 44 00 00        nopl 0(%rax,%rax,1)

and a 8-byte BND PLT entry in .plt.bnd:

  f2 ff 25 00 00 00 00  bnd jmpq *name@GOTPCREL(%rip)
  90			nop

Otherwise, linker will create a legacy PLT1 entry in .plt:

  68 00 00 00 00       	pushq  $index
  e9 00 00 00 00        jmpq PLT0
  66 0f 1f 44 00 00     nopw 0(%rax,%rax,1)

and a 8-byte legacy PLT in .plt.bnd:

  ff 25 00 00 00 00     jmpq  *name@GOTPCREL(%rip)
  66 90                 xchg  %ax,%ax

The initial value of the GOT entry for "name" will be set to the the
"pushq" instruction in the corresponding entry in .plt.  Linker will
resolve reference of symbol "name" to the entry in the second PLT,
.plt.bnd.

Prelink stores the offset of pushq of PLT1 (plt_base + 0x10) in GOT[1]
and GOT[1] is stored in GOT[3].  We can undo prelink in GOT by computing
the corresponding the pushq offset with

GOT[1] + (GOT offset - &GOT[3]) * 2

Since for each entry in .plt except for PLT0 we create a 8-byte entry in
.plt.bnd, there is extra 8-byte per PLT symbol.

We also investigated the 16-byte entry for .plt.bnd.  We compared the
8-byte entry vs the the 16-byte entry for .plt.bnd on Sandy Bridge.
There are no performance differences in SPEC CPU 2000/2006 as well as
micro benchmarks.

Pros:
	No change to undo prelink in dynamic linker.
	Only 8-byte memory overhead for each PLT symbol.
Cons:
	Extra .plt.bnd section is needed.
	Extra 8 byte for legacy branches to PLT.
	GDB is unware of the new layout of .plt and .plt.bnd.

bfd/

	* elf64-x86-64.c (elf_x86_64_bnd_plt0_entry): New.
	(elf_x86_64_legacy_plt_entry): Likewise.
	(elf_x86_64_bnd_plt_entry): Likewise.
	(elf_x86_64_legacy_plt2_entry): Likewise.
	(elf_x86_64_bnd_plt2_entry): Likewise.
	(elf_x86_64_bnd_arch_bed): Likewise.
	(elf_x86_64_link_hash_entry): Add has_bnd_reloc and plt_bnd.
	(elf_x86_64_link_hash_table): Add plt_bnd.
	(elf_x86_64_link_hash_newfunc): Initialize has_bnd_reloc and
	plt_bnd.
	(elf_x86_64_copy_indirect_symbol): Also copy has_bnd_reloc.
	(elf_x86_64_check_relocs): Create the second PLT for Intel MPX
	in 64-bit mode.
	(elf_x86_64_allocate_dynrelocs): Handle the second PLT for IFUNC
	symbols.  Resolve call to the second PLT if it is created.
	(elf_x86_64_size_dynamic_sections): Keep the second PLT section.
	(elf_x86_64_relocate_section): Resolve PLT references to the
	second PLT if it is created.
	(elf_x86_64_finish_dynamic_symbol): Use BND PLT0 and fill the
	second PLT entry for BND relocation.
	(elf_x86_64_finish_dynamic_sections): Use MPX backend data if
	the second PLT is created.
	(elf_x86_64_get_synthetic_symtab): New.
	(bfd_elf64_get_synthetic_symtab): Likewise.  Undefine for NaCl.

ld/

	* emulparams/elf_x86_64.sh (TINY_READONLY_SECTION): New.

ld/testsuite/

	* ld-x86-64/mpx.exp: Run bnd-ifunc-1 and bnd-plt-1.
	* ld-x86-64/bnd-ifunc-1.d: New file.
	* ld-x86-64/bnd-ifunc-1.s: Likewise.
	* ld-x86-64/bnd-plt-1.d: Likewise.

7 files changed, 95 insertions, 0 deletions

diff --git a/ld/ChangeLog b/ld/ChangeLog
index aeb0d19..9930434 100644
--- a/ld/ChangeLog
+++ b/ld/ChangeLog
@@ -1,3 +1,8 @@
+2014-02-19  Igor Zamyatin  <igor.zamyatin@intel.com>
+	    H.J. Lu  <hongjiu.lu@intel.com>
+
+	* emulparams/elf_x86_64.sh (TINY_READONLY_SECTION): New.
+
 2014-02-19  Alan Modra  <amodra@gmail.com>
 
 	* emultempl/ppc64elf.em (params): Init new field.
diff --git a/ld/emulparams/elf_x86_64.sh b/ld/emulparams/elf_x86_64.sh
index 4842257..d8cb6bf 100644
--- a/ld/emulparams/elf_x86_64.sh
+++ b/ld/emulparams/elf_x86_64.sh
@@ -16,6 +16,8 @@ LARGE_SECTIONS=yes
 LARGE_BSS_AFTER_BSS=
 SEPARATE_GOTPLT="SIZEOF (.got.plt) >= 24 ? 24 : 0"
 IREL_IN_PLT=
+# Reuse TINY_READONLY_SECTION which is placed right after .plt section.
+TINY_READONLY_SECTION=".plt.bnd      ${RELOCATING-0} : { *(.plt.bnd) }"
 
 if [ "x${host}" = "x${target}" ]; then
   case " $EMULATION_LIBPATH " in
diff --git a/ld/testsuite/ChangeLog b/ld/testsuite/ChangeLog
index 4b37b0d..58d752a 100644
--- a/ld/testsuite/ChangeLog
+++ b/ld/testsuite/ChangeLog
@@ -1,3 +1,11 @@
+2014-02-19  Igor Zamyatin  <igor.zamyatin@intel.com>
+	    H.J. Lu  <hongjiu.lu@intel.com>
+
+	* ld-x86-64/mpx.exp: Run bnd-ifunc-1 and bnd-plt-1.
+	* ld-x86-64/bnd-ifunc-1.d: New file.
+	* ld-x86-64/bnd-ifunc-1.s: Likewise.
+	* ld-x86-64/bnd-plt-1.d: Likewise.
+
 2014-02-18  Jack Carter  <jack.carter@imgtec.com>
 
 	* ld-mips-elf/pic-and-nonpic-3a.sd: Check DYNAMIC segment flags.
diff --git a/ld/testsuite/ld-x86-64/bnd-ifunc-1.d b/ld/testsuite/ld-x86-64/bnd-ifunc-1.d
new file mode 100644
index 0000000..cdcb4f6
--- /dev/null
+++ b/ld/testsuite/ld-x86-64/bnd-ifunc-1.d
@@ -0,0 +1,7 @@
+#as: --64 -madd-bnd-prefix
+#ld: -shared -melf_x86_64
+#objdump: -dw
+
+#...
+[ 	]*[a-f0-9]+:	f2 e8 f0 ff ff ff    	bnd callq 220 <\*ABS\*\+0x228@plt>
+#pass
diff --git a/ld/testsuite/ld-x86-64/bnd-ifunc-1.s b/ld/testsuite/ld-x86-64/bnd-ifunc-1.s
new file mode 100644
index 0000000..82b64f0
--- /dev/null
+++ b/ld/testsuite/ld-x86-64/bnd-ifunc-1.s
@@ -0,0 +1,16 @@
+	.type foo, %gnu_indirect_function
+	.global __GI_foo
+	.hidden __GI_foo
+	.set __GI_foo, foo
+	.text
+.globl foo
+	.type	foo, @function
+foo:
+	ret
+	.size	foo, .-foo
+.globl bar
+	.type	bar, @function
+bar:
+	call	__GI_foo@PLT
+	ret
+	.size	bar, .-bar
diff --git a/ld/testsuite/ld-x86-64/bnd-plt-1.d b/ld/testsuite/ld-x86-64/bnd-plt-1.d
new file mode 100644
index 0000000..3cfe9e6
--- /dev/null
+++ b/ld/testsuite/ld-x86-64/bnd-plt-1.d
@@ -0,0 +1,55 @@
+#source: bnd-branch-1.s
+#as: --64
+#ld: -shared -melf_x86_64
+#objdump: -dw
+
+.*: +file format .*
+
+
+Disassembly of section .plt:
+
+0+2b0 <.plt>:
+[      ]*[a-f0-9]+:	ff 35 82 01 20 00    	pushq  0x200182\(%rip\)        # 200438 <_GLOBAL_OFFSET_TABLE_\+0x8>
+[      ]*[a-f0-9]+:	f2 ff 25 83 01 20 00 	bnd jmpq \*0x200183\(%rip\)        # 200440 <_GLOBAL_OFFSET_TABLE_\+0x10>
+[      ]*[a-f0-9]+:	0f 1f 00             	nopl   \(%rax\)
+[      ]*[a-f0-9]+:	68 00 00 00 00       	pushq  \$0x0
+[      ]*[a-f0-9]+:	e9 e6 ff ff ff       	jmpq   2b0 <foo2@plt-0x50>
+[      ]*[a-f0-9]+:	66 0f 1f 44 00 00    	nopw   0x0\(%rax,%rax,1\)
+[      ]*[a-f0-9]+:	68 01 00 00 00       	pushq  \$0x1
+[      ]*[a-f0-9]+:	f2 e9 d5 ff ff ff    	bnd jmpq 2b0 <foo2@plt-0x50>
+[      ]*[a-f0-9]+:	0f 1f 44 00 00       	nopl   0x0\(%rax,%rax,1\)
+[      ]*[a-f0-9]+:	68 02 00 00 00       	pushq  \$0x2
+[      ]*[a-f0-9]+:	f2 e9 c5 ff ff ff    	bnd jmpq 2b0 <foo2@plt-0x50>
+[      ]*[a-f0-9]+:	0f 1f 44 00 00       	nopl   0x0\(%rax,%rax,1\)
+[      ]*[a-f0-9]+:	68 03 00 00 00       	pushq  \$0x3
+[      ]*[a-f0-9]+:	e9 b6 ff ff ff       	jmpq   2b0 <foo2@plt-0x50>
+[      ]*[a-f0-9]+:	66 0f 1f 44 00 00    	nopw   0x0\(%rax,%rax,1\)
+
+Disassembly of section .plt.bnd:
+
+0+300 <foo2@plt>:
+[ 	]*[a-f0-9]+:	ff 25 42 01 20 00    	jmpq   \*0x200142\(%rip\)        # 200448 <_GLOBAL_OFFSET_TABLE_\+0x18>
+[ 	]*[a-f0-9]+:	66 90                	xchg   %ax,%ax
+
+0+308 <foo3@plt>:
+[ 	]*[a-f0-9]+:	f2 ff 25 41 01 20 00 	bnd jmpq \*0x200141\(%rip\)        # 200450 <_GLOBAL_OFFSET_TABLE_\+0x20>
+[ 	]*[a-f0-9]+:	90                   	nop
+
+0+310 <foo1@plt>:
+[ 	]*[a-f0-9]+:	f2 ff 25 41 01 20 00 	bnd jmpq \*0x200141\(%rip\)        # 200458 <_GLOBAL_OFFSET_TABLE_\+0x28>
+[ 	]*[a-f0-9]+:	90                   	nop
+
+0+318 <foo4@plt>:
+[ 	]*[a-f0-9]+:	ff 25 42 01 20 00    	jmpq   \*0x200142\(%rip\)        # 200460 <_GLOBAL_OFFSET_TABLE_\+0x30>
+[ 	]*[a-f0-9]+:	66 90                	xchg   %ax,%ax
+
+Disassembly of section .text:
+
+0+320 <_start>:
+[      ]*[a-f0-9]+:	f2 e9 ea ff ff ff    	bnd jmpq 310 <foo1@plt>
+[      ]*[a-f0-9]+:	e8 d5 ff ff ff       	callq  300 <foo2@plt>
+[      ]*[a-f0-9]+:	e9 d8 ff ff ff       	jmpq   308 <foo3@plt>
+[      ]*[a-f0-9]+:	e8 e3 ff ff ff       	callq  318 <foo4@plt>
+[      ]*[a-f0-9]+:	f2 e8 cd ff ff ff    	bnd callq 308 <foo3@plt>
+[      ]*[a-f0-9]+:	e9 d8 ff ff ff       	jmpq   318 <foo4@plt>
+#pass
diff --git a/ld/testsuite/ld-x86-64/mpx.exp b/ld/testsuite/ld-x86-64/mpx.exp
index df6bc6f..284ade3 100644
--- a/ld/testsuite/ld-x86-64/mpx.exp
+++ b/ld/testsuite/ld-x86-64/mpx.exp
@@ -78,3 +78,5 @@ set run_tests {
 run_ld_link_exec_tests [] $run_tests
 
 run_dump_test "bnd-branch-1"
+run_dump_test "bnd-ifunc-1"
+run_dump_test "bnd-plt-1"