[ELF][PPC32] Fix canonical PLTs when the order does not match the PLT order

[MaskRay]

Add test

[Bdragon28]

This patch will be needed on FreeBSD to fix some crashes for an lld10-linked FreeBSD powerpc32 world, such as a crash running /usr/bin/objdump -D.

[Bdragon28]

AWESOME, this fixed the clang crash I was seeing with lld10 as well! I think it's possible this might be the last crashing bug blocking ppc32 lld migration.

[MaskRay]

Fix tests

[Bdragon28]

From a FreeBSD standpoint, I am very happy with this.

lld/ELF/Arch/PPC.cpp

static void writeFromHalf16(uint8_t *loc, uint32_t insn) {
   write32(config->isLE ? loc : loc - 2, insn);
 }
 
 void writePPC32GlinkSection(uint8_t *buf, size_t numEntries) {
   // Create canonical PLT entries for non-PIE code. Compilers don't generate
   // non-GOT-non-PLT relocations referencing external functions for -fpie/-fPIE.
   uint32_t glink = in.plt->getVA(); // VA of .glink
   if (!config->isPic) {
-    for (const Symbol *sym : in.plt->entries)
-      if (sym->needsPltAddr) {
-        writePPC32PltCallStub(buf, sym->getGotPltVA(), nullptr, 0);
-        buf += 16;
-        glink += 16;
-      }
+    for (const Symbol *sym : cast<PPC32GlinkSection>(in.plt)->canonical_plts) {
   }
 
   // On PPC Secure PLT ABI, bl foo@plt jumps to a call stub, which loads an
   // absolute address from a specific .plt slot (usually called .got.plt on
   // other targets) and jumps there.
   //
   // a) With immediate binding (BIND_NOW), the .plt entry is resolved at load
   // time. The .glink section is not used.

lld/ELF/Relocations.cpp

if (sym.isFunc()) {
       if (!sym.isDefined()) {
         replaceWithDefined(
             sym, in.plt,
             target->pltHeaderSize + target->pltEntrySize * sym.pltIndex, 0);
         if (config->emachine == EM_PPC) {
           // PPC32 canonical PLT entries are at the beginning of .glink
           cast<Defined>(sym).value = in.plt->headerSize;
           in.plt->headerSize += 16;
+          cast<PPC32GlinkSection>(in.plt)->canonical_plts.push_back(&sym);
         }
       }
       sym.needsPltAddr = true;
       sec.relocations.push_back({expr, type, offset, addend, &sym});
       return;
     }
   }
 

lld/ELF/SyntheticSections.h

public:
   void writeTo(uint8_t *buf) override;
   size_t getSize() const override;
   bool isNeeded() const override;
   void addSymbols();
   void addEntry(Symbol &sym);
   size_t getNumEntries() const { return entries.size(); }
 
   size_t headerSize;
-  size_t footerSize = 0;
 
   std::vector<const Symbol *> entries;
 };
 
 // Used for non-preemptible ifuncs. It does not have a header. Each entry is
 // associated with an IRELATIVE relocation, which will be resolved eagerly at
 // runtime. PltSection can only contain entries associated with JUMP_SLOT
 // relocations, so IPLT entries are in a separate section.
 class IpltSection final : public SyntheticSection {
   std::vector<const Symbol *> entries;
 
 public:
   IpltSection();
   void writeTo(uint8_t *buf) override;
   size_t getSize() const override;
   bool isNeeded() const override { return !entries.empty(); }
   void addSymbols();
   void addEntry(Symbol &sym);
 };
 
+class PPC32GlinkSection : public PltSection {
+public:
+  PPC32GlinkSection();
+  void writeTo(uint8_t *buf) override;
+  size_t getSize() const override;
+
+  std::vector<const Symbol *> canonical_plts;
+  static constexpr size_t footerSize = 64;
+};
+
 // This is x86-only.
 class IBTPltSection : public SyntheticSection {
 public:
   IBTPltSection();
   void writeTo(uint8_t *Buf) override;
   size_t getSize() const override;
 };
 

lld/ELF/SyntheticSections.cpp

for (const SymbolTableEntry &s : symTab->getSymbols()) {
     write32(buckets + hash, i);
   }
 }
 
 PltSection::PltSection()
     : SyntheticSection(SHF_ALLOC | SHF_EXECINSTR, SHT_PROGBITS, 16, ".plt"),
       headerSize(target->pltHeaderSize) {
   // On PowerPC, this section contains lazy symbol resolvers.
-  if (config->emachine == EM_PPC || config->emachine == EM_PPC64) {
+  if (config->emachine == EM_PPC64) {
     name = ".glink";
     alignment = 4;
-    // PLTresolve is at the end.
-    if (config->emachine == EM_PPC)
-      footerSize = 64;
   }
 
   // On x86 when IBT is enabled, this section contains the second PLT (lazy
   // symbol resolvers).
   if ((config->emachine == EM_386 || config->emachine == EM_X86_64) &&
       (config->andFeatures & GNU_PROPERTY_X86_FEATURE_1_IBT))
     name = ".plt.sec";
 
   // The PLT needs to be writable on SPARC as the dynamic linker will
   // modify the instructions in the PLT entries.
   if (config->emachine == EM_SPARCV9)
     this->flags |= SHF_WRITE;
 }
 
 void PltSection::writeTo(uint8_t *buf) {
-  if (config->emachine == EM_PPC) {
-    writePPC32GlinkSection(buf, entries.size());
-    return;
-  }
-
   // At beginning of PLT, we have code to call the dynamic
   // linker to resolve dynsyms at runtime. Write such code.
   target->writePltHeader(buf);
   size_t off = headerSize;
 
   for (const Symbol *sym : entries) {
     target->writePlt(buf + off, *sym, getVA() + off);
     off += target->pltEntrySize;
   }
 }
 
 void PltSection::addEntry(Symbol &sym) {
   sym.pltIndex = entries.size();
   entries.push_back(&sym);
 }
 
 size_t PltSection::getSize() const {
-  return headerSize + entries.size() * target->pltEntrySize + footerSize;
+  return headerSize + entries.size() * target->pltEntrySize;
 }
 
 bool PltSection::isNeeded() const {
   // For -z retpolineplt, .iplt needs the .plt header.
   return !entries.empty() || (config->zRetpolineplt && in.iplt->isNeeded());
 }
 
 // Used by ARM to add mapping symbols in the PLT section, which aid

 void IpltSection::addSymbols() {
   size_t off = 0;
   for (size_t i = 0, e = entries.size(); i != e; ++i) {
     target->addPltSymbols(*this, off);
     off += target->pltEntrySize;
   }
 }
 
+PPC32GlinkSection::PPC32GlinkSection() {
+  name = ".glink";
+  alignment = 4;
+}
+
+void PPC32GlinkSection::writeTo(uint8_t *buf) {
+  writePPC32GlinkSection(buf, entries.size());
+}
+
+size_t PPC32GlinkSection::getSize() const {
+  return headerSize + entries.size() * target->pltEntrySize + footerSize;
+}
+
 // This is an x86-only extra PLT section and used only when a security
 // enhancement feature called CET is enabled. In this comment, I'll explain what
 // the feature is and why we have two PLT sections if CET is enabled.
 //
 // So, what does CET do? CET introduces a new restriction to indirect jump
 // instructions. CET works this way. Assume that CET is enabled. Then, if you
 // execute an indirect jump instruction, the processor verifies that a special
 // "landing pad" instruction (which is actually a repurposed NOP instruction and

lld/ELF/Writer.cpp

template <class ELFT> void createSyntheticSections() {
   add(in.relaIplt);
 
   if ((config->emachine == EM_386 || config->emachine == EM_X86_64) &&
       (config->andFeatures & GNU_PROPERTY_X86_FEATURE_1_IBT)) {
     in.ibtPlt = make<IBTPltSection>();
     add(in.ibtPlt);
   }
 
-  in.plt = make<PltSection>();
+  in.plt = config->emachine == EM_PPC ? make<PPC32GlinkSection>()
+                                      : make<PltSection>();
   add(in.plt);
   in.iplt = make<IpltSection>();
   add(in.iplt);
 
   if (config->andFeatures)
     add(make<GnuPropertySection>());
 
   // .note.GNU-stack is always added when we are creating a re-linkable

lld/test/ELF/Inputs/canonical-plt-pcrel.s

-.globl func, ifunc
+.globl func, func2, ifunc
 .type func, @function
+.type func2, @function
 .type ifunc, @gnu_indirect_function
 func:
+func2:
 ifunc:

lld/test/ELF/ppc32-canonical-plt.s

 # REQUIRES: ppc
 
 ## Test that we create canonical PLT entries for -no-pie.
 
 # RUN: llvm-mc -filetype=obj -triple=powerpc %s -o %t.o
 # RUN: llvm-mc -filetype=obj -triple=powerpc %p/Inputs/canonical-plt-pcrel.s -o %t1.o
 # RUN: ld.lld %t1.o -o %t1.so -shared -soname=so
 
 # RUN: ld.lld %t.o %t1.so -o %t
 # RUN: llvm-readobj -r %t | FileCheck --check-prefix=REL %s
 # RUN: llvm-readelf -S -s %t | FileCheck --check-prefix=SYM %s
 # RUN: llvm-readelf -x .plt %t | FileCheck --check-prefix=HEX %s
 # RUN: llvm-objdump -d --no-show-raw-insn %t | FileCheck %s
 
 # REL:      Relocations [
 # REL-NEXT:   .rela.plt {
-# REL-NEXT:     R_PPC_JMP_SLOT func 0x0
-# REL-NEXT:     R_PPC_JMP_SLOT ifunc 0x0
+# REL-NEXT:     0x10030318 R_PPC_JMP_SLOT func 0x0
+# REL-NEXT:     0x1003031C R_PPC_JMP_SLOT func2 0x0
+# REL-NEXT:     0x10030320 R_PPC_JMP_SLOT ifunc 0x0
 # REL-NEXT:   }
 # REL-NEXT: ]
 
-# SYM: .glink PROGBITS 100101dc
+# SYM: .glink PROGBITS 1001022c
 
 ## st_value points to the canonical PLT entry in .glink
 # SYM: Symbol table '.dynsym'
-# SYM: 100101dc 0 FUNC GLOBAL DEFAULT UND func
-# SYM: 100101ec 0 FUNC GLOBAL DEFAULT UND ifunc
+# SYM: 1001023c 0 FUNC GLOBAL DEFAULT UND func
+# SYM: 1001022c 0 FUNC GLOBAL DEFAULT UND func2
+# SYM: 1001024c 0 FUNC GLOBAL DEFAULT UND ifunc
 # SYM: Symbol table '.symtab'
-# SYM: 100101dc 0 FUNC GLOBAL DEFAULT UND func
-# SYM: 100101ec 0 FUNC GLOBAL DEFAULT UND ifunc
-
-# HEX: 0x100302b4 100101fc 10010200
+# SYM: 1001023c 0 FUNC GLOBAL DEFAULT UND func
+# SYM: 1001022c 0 FUNC GLOBAL DEFAULT UND func2
+# SYM: 1001024c 0 FUNC GLOBAL DEFAULT UND ifunc
+
+# HEX: 0x10030318 1001025c 10010260 10010264
+
+## Canonical PLT entry of func2.
+## 0x1003031C = 65536*4099+796
+# CHECK:      1001022c .glink:
+# CHECK-NEXT:           lis 11, 4099
+# CHECK-NEXT:           lwz 11, 796(11)
+# CHECK-NEXT:           mtctr 11
+# CHECK-NEXT:           bctr
 
 ## Canonical PLT entry of func.
-## 0x100101dc + 4*2 + 64 = 0x10010224
-## 0x1001021c = 65536*4099+692
-# CHECK:      100101dc .glink:
-# CHECK-NEXT:           lis 11, 4099
-# CHECK-NEXT:           lwz 11, 692(11)
+## 0x10030318 = 65536*4099+792
+# CHECK-NEXT: 1001023c: lis 11, 4099
+# CHECK-NEXT:           lwz 11, 792(11)
 # CHECK-NEXT:           mtctr 11
 # CHECK-NEXT:           bctr
 
 ## Canonical PLT entry of ifunc.
-## 0x10010220 = 65536*4099+696
-# CHECK-NEXT: 100101ec: lis 11, 4099
-# CHECK-NEXT:           lwz 11, 696(11)
+## 0x10030320 = 65536*4099+800
+# CHECK-NEXT: 1001024c: lis 11, 4099
+# CHECK-NEXT:           lwz 11, 800(11)
 # CHECK-NEXT:           mtctr 11
 # CHECK-NEXT:           bctr
 
-## The 2 b instructions are referenced by .plt entries.
-# CHECK-NEXT: 100101fc: b .+8
+## The 3 b instructions are referenced by .plt entries.
+# CHECK-NEXT: 1001025c: b .+12
+# CHECK-NEXT:           b .+8
 # CHECK-NEXT:           b .+4
 
 ## PLTresolve of 64 bytes is at the end.
-## Operands of addis & addi: -0x100101fc = 65536*-4097-508
+## Operands of addis & addi: -0x1001025c = 65536*-4097-604
 # CHECK-NEXT:           lis 12, 0
 # CHECK-NEXT:           addis 11, 11, -4097
 # CHECK-NEXT:           lwz 0, 4(12)
-# CHECK-NEXT:           addi 11, 11, -508
+# CHECK-NEXT:           addi 11, 11, -604
 # CHECK-NEXT:           mtctr 0
 # CHECK-NEXT:           add 0, 11, 11
 # CHECK-NEXT:           lwz 12, 8(12)
 # CHECK-NEXT:           add 11, 0, 11
 # CHECK-NEXT:           bctr
 # CHECK-COUNT-7:        nop
 
 .globl _start
 _start:
+  b func
+  lis 3, func2@ha
+  la 3, func2@l(3)
   lis 3, func@ha
   la 3, func@l(3)
   lis 4, ifunc@ha
   la 4, ifunc@l(4)