[COFF] Use 32-bit jump table entries in .rdata for Win64

[rnk]

Summary

We were already using 32-bit jump table entries, but this was a
consequence of the default PIC model on Win64, and not an intentional
design decision. This patch ensures that we always use 32-bit label
difference jump table entries on Win64 regardless of the PIC model. This
is a good idea because it saves executable size and object file size.

Moving the jump tables to .rdata cleans up the disassembled object code
and reduces the available ROP targets, but it requires adding one more
RIP-relative lea to the code. COFF doesn't have relocations to express
the difference between two arbitrary symbols, so we can't use the jump
table label in the label difference like we do elsewhere.

Fixes PR31488

[majnemer]

LGTM

[wxiao3]

@rnk do you have plan to bring this back?

[rnk]

In D28141#4143347, @wxiao3 wrote:

@rnk do you have plan to bring this back?

As far as I can tell, the issue is currently fixed, see the usage of .section .rdata and .long directives from llc here: https://gcc.godbolt.org/z/1znoroP74

[wxiao3]

In D28141#4316637, @rnk wrote:

In D28141#4143347, @wxiao3 wrote:

@rnk do you have plan to bring this back?

As far as I can tell, the issue is currently fixed, see the usage of .section .rdata and .long directives from llc here: https://gcc.godbolt.org/z/1znoroP74

Yes, I fix it at: https://reviews.llvm.org/D144701

include/llvm/CodeGen/TargetLoweringObjectFileImpl.h

MCSection *SelectSectionForGlobal(const GlobalObject *GO, SectionKind Kind,
                                     const TargetMachine &TM) const override;
 
   void getNameWithPrefix(SmallVectorImpl<char> &OutName, const GlobalValue *GV,
                          const TargetMachine &TM) const override;
 
   MCSection *getSectionForJumpTable(const Function &F,
                                     const TargetMachine &TM) const override;
 
+  bool shouldPutJumpTableInFunctionSection(bool UsesLabelDifference,
+                                           const Function &F) const override;
+
   /// Emit Obj-C garbage collection and linker options. Only linker option
   /// emission is implemented for COFF.
   void emitModuleFlags(MCStreamer &Streamer,
                        ArrayRef<Module::ModuleFlagEntry> ModuleFlags,
                        const TargetMachine &TM) const override;
 
   MCSection *getStaticCtorSection(unsigned Priority,
                                   const MCSymbol *KeySym) const override;

lib/CodeGen/TargetLoweringObjectFileImpl.cpp

MCSection *TargetLoweringObjectFileCOFF::getSectionForJumpTable(
   unsigned Characteristics = getCOFFSectionFlags(Kind, TM);
   Characteristics |= COFF::IMAGE_SCN_LNK_COMDAT;
   unsigned UniqueID = NextUniqueID++;
 
   return getContext().getCOFFSection(Name, Characteristics, Kind, COMDATSymName,
                                      COFF::IMAGE_COMDAT_SELECT_ASSOCIATIVE, UniqueID);
 }
 
+bool TargetLoweringObjectFileCOFF::shouldPutJumpTableInFunctionSection(
+    bool UsesLabelDifference, const Function &F) const {
+  // We can always create relative relocations, so use another section
+  // that can be marked non-executable.
+  return false;
+}
+
 void TargetLoweringObjectFileCOFF::emitModuleFlags(
     MCStreamer &Streamer, ArrayRef<Module::ModuleFlagEntry> ModuleFlags,
     const TargetMachine &TM) const {
   MDNode *LinkerOptions = nullptr;
 
   for (const auto &MFE : ModuleFlags) {
     StringRef Key = MFE.Key->getString();
     if (Key == "Linker Options")

lib/Target/X86/X86ISelLowering.h

namespace llvm {
   //===--------------------------------------------------------------------===//
   //  X86 Implementation of the TargetLowering interface
   class X86TargetLowering final : public TargetLowering {
   public:
     explicit X86TargetLowering(const X86TargetMachine &TM,
                                const X86Subtarget &STI);
 
     unsigned getJumpTableEncoding() const override;
+    bool isJumpTableRelative() const override;
     bool useSoftFloat() const override;
 
     MVT getScalarShiftAmountTy(const DataLayout &, EVT) const override {
       return MVT::i8;
     }
 
     const MCExpr *
     LowerCustomJumpTableEntry(const MachineJumpTableInfo *MJTI,

lib/Target/X86/X86ISelLowering.cpp

 /// current function.  The returned value is a member of the
 /// MachineJumpTableInfo::JTEntryKind enum.
 unsigned X86TargetLowering::getJumpTableEncoding() const {
   // In GOT pic mode, each entry in the jump table is emitted as a @GOTOFF
   // symbol.
   if (isPositionIndependent() && Subtarget.isPICStyleGOT())
     return MachineJumpTableInfo::EK_Custom32;
 
+  // On Win64, we want to use both label differences and a separate section.
+  if (Subtarget.isTargetWin64())
+    return MachineJumpTableInfo::EK_LabelDifference32;
+
   // Otherwise, use the normal jump table encoding heuristics.
   return TargetLowering::getJumpTableEncoding();
 }
 
+bool X86TargetLowering::isJumpTableRelative() const {
+  if (Subtarget.isTargetWin64())
+    return true;
+  return TargetLowering::isJumpTableRelative();
+}
+
 bool X86TargetLowering::useSoftFloat() const {
   return Subtarget.useSoftFloat();
 }
 
 const MCExpr *
 X86TargetLowering::LowerCustomJumpTableEntry(const MachineJumpTableInfo *MJTI,
                                              const MachineBasicBlock *MBB,
                                              unsigned uid,MCContext &Ctx) const{
   assert(isPositionIndependent() && Subtarget.isPICStyleGOT());
   // In 32-bit ELF systems, our jump table entries are formed with @GOTOFF
   // entries.
   return MCSymbolRefExpr::create(MBB->getSymbol(),
                                  MCSymbolRefExpr::VK_GOTOFF, Ctx);
 }
 
 /// Returns relocation base for the given PIC jumptable.
 SDValue X86TargetLowering::getPICJumpTableRelocBase(SDValue Table,
                                                     SelectionDAG &DAG) const {
+  // COFF doesn't have relocations to take the difference between two arbitrary
+  // symbols. The assembler, however, can resolve a fixup between the function
+  // entry and a basic block label, so use the function entry as the base.
+  if (Subtarget.isTargetWin64())
+    return DAG.getGlobalAddress(DAG.getMachineFunction().getFunction(), SDLoc(),
+                                getPointerTy(DAG.getDataLayout()));
+
   if (!Subtarget.is64Bit())
     // This doesn't have SDLoc associated with it, but is not really the
     // same as a Register.
     return DAG.getNode(X86ISD::GlobalBaseReg, SDLoc(),
                        getPointerTy(DAG.getDataLayout()));
+
   return Table;
 }
 
 /// This returns the relocation base for the given PIC jumptable,
 /// the same as getPICJumpTableRelocBase, but as an MCExpr.
 const MCExpr *X86TargetLowering::
 getPICJumpTableRelocBaseExpr(const MachineFunction *MF, unsigned JTI,
                              MCContext &Ctx) const {
+  // COFF doesn't have relocations to take the difference between two arbitrary
+  // symbols. The assembler, however, can resolve a fixup between the function
+  // entry and a basic block label, so use the function entry as the base.
+  if (Subtarget.isTargetCOFF())
+    return MCSymbolRefExpr::create(
+        getTargetMachine().getSymbol(MF->getFunction()), Ctx);
+
   // X86-64 uses RIP relative addressing based on the jump table label.
   if (Subtarget.isPICStyleRIPRel())
     return TargetLowering::getPICJumpTableRelocBaseExpr(MF, JTI, Ctx);
 
   // Otherwise, the reference is relative to the PIC base.
   return MCSymbolRefExpr::create(MF->getPICBaseSymbol(), Ctx);
 }
 

test/CodeGen/X86/win64-jumptable.ll

sw.epilog:                                        ; preds = %entry, %sw.bb3, %sw.bb2, %sw.bb1, %sw.bb
   ret void
 }
 
 declare void @g(i32)
 
 ; CHECK: .text
 ; CHECK: f:
 ; CHECK: .seh_proc f
-; CHECK: jmpq    *.LJTI0_0
+; CHECK: movslq .LJTI0_0(,%{{.*}},4), %[[target:[^ ]*]]
+; CHECK: leaq f(%[[target]]), %[[target]]
+; CHECK: jmpq *%[[target]]
 ; CHECK: .LBB0_{{.*}}: # %sw.bb
 ; CHECK: .LBB0_{{.*}}: # %sw.bb1
 ; CHECK: .LBB0_{{.*}}: # %sw.bb2
 ; CHECK: .LBB0_{{.*}}: # %sw.bb3
 ; CHECK: callq g
 ; CHECK: jmp g # TAILCALL
 ; CHECK: .section        .rdata,"dr"
-; CHECK: .quad .LBB0_
-; CHECK: .quad .LBB0_
-; CHECK: .quad .LBB0_
-; CHECK: .quad .LBB0_
+; CHECK: .long .LBB0_{{.*}}-f
+; CHECK: .long .LBB0_{{.*}}-f
+; CHECK: .long .LBB0_{{.*}}-f
+; CHECK: .long .LBB0_{{.*}}-f
 ; CHECK: .seh_handlerdata
 
 ; It's important that we switch back to .text here, not .rdata.
 ; CHECK: .text
 ; CHECK: .seh_endproc