aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--ELF/Arch/X86.cpp144
-rw-r--r--ELF/Arch/X86_64.cpp127
-rw-r--r--ELF/Config.h1
-rw-r--r--ELF/Driver.cpp1
-rw-r--r--test/ELF/i386-retpoline-nopic.s65
-rw-r--r--test/ELF/i386-retpoline-pic.s62
-rw-r--r--test/ELF/x86-64-retpoline-znow.s53
-rw-r--r--test/ELF/x86-64-retpoline.s66
8 files changed, 509 insertions, 10 deletions
diff --git a/ELF/Arch/X86.cpp b/ELF/Arch/X86.cpp
index 10517bef14f3..09c16db53e4b 100644
--- a/ELF/Arch/X86.cpp
+++ b/ELF/Arch/X86.cpp
@@ -21,7 +21,7 @@ using namespace lld;
using namespace lld::elf;
namespace {
-class X86 final : public TargetInfo {
+class X86 : public TargetInfo {
public:
X86();
RelExpr getRelExpr(RelType Type, const Symbol &S,
@@ -399,7 +399,145 @@ void X86::relaxTlsLdToLe(uint8_t *Loc, RelType Type, uint64_t Val) const {
memcpy(Loc - 2, Inst, sizeof(Inst));
}
+namespace {
+class RetpolinePic : public X86 {
+public:
+ RetpolinePic();
+ void writeGotPlt(uint8_t *Buf, const Symbol &S) const override;
+ void writePltHeader(uint8_t *Buf) const override;
+ void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
+ int32_t Index, unsigned RelOff) const override;
+};
+
+class RetpolineNoPic : public X86 {
+public:
+ RetpolineNoPic();
+ void writeGotPlt(uint8_t *Buf, const Symbol &S) const override;
+ void writePltHeader(uint8_t *Buf) const override;
+ void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
+ int32_t Index, unsigned RelOff) const override;
+};
+} // namespace
+
+RetpolinePic::RetpolinePic() {
+ PltHeaderSize = 48;
+ PltEntrySize = 32;
+}
+
+void RetpolinePic::writeGotPlt(uint8_t *Buf, const Symbol &S) const {
+ write32le(Buf, S.getPltVA() + 17);
+}
+
+void RetpolinePic::writePltHeader(uint8_t *Buf) const {
+ const uint8_t Insn[] = {
+ 0xff, 0xb3, 0, 0, 0, 0, // 0: pushl GOTPLT+4(%ebx)
+ 0x50, // 6: pushl %eax
+ 0x8b, 0x83, 0, 0, 0, 0, // 7: mov GOTPLT+8(%ebx), %eax
+ 0xe8, 0x0e, 0x00, 0x00, 0x00, // d: call next
+ 0xf3, 0x90, // 12: loop: pause
+ 0x0f, 0xae, 0xe8, // 14: lfence
+ 0xeb, 0xf9, // 17: jmp loop
+ 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 19: int3; .align 16
+ 0x89, 0x0c, 0x24, // 20: next: mov %ecx, (%esp)
+ 0x8b, 0x4c, 0x24, 0x04, // 23: mov 0x4(%esp), %ecx
+ 0x89, 0x44, 0x24, 0x04, // 27: mov %eax ,0x4(%esp)
+ 0x89, 0xc8, // 2b: mov %ecx, %eax
+ 0x59, // 2d: pop %ecx
+ 0xc3, // 2e: ret
+ };
+ memcpy(Buf, Insn, sizeof(Insn));
+
+ uint32_t Ebx = InX::Got->getVA() + InX::Got->getSize();
+ uint32_t GotPlt = InX::GotPlt->getVA() - Ebx;
+ write32le(Buf + 2, GotPlt + 4);
+ write32le(Buf + 9, GotPlt + 8);
+}
+
+void RetpolinePic::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
+ uint64_t PltEntryAddr, int32_t Index,
+ unsigned RelOff) const {
+ const uint8_t Insn[] = {
+ 0x50, // pushl %eax
+ 0x8b, 0x83, 0, 0, 0, 0, // mov foo@GOT(%ebx), %eax
+ 0xe8, 0, 0, 0, 0, // call plt+0x20
+ 0xe9, 0, 0, 0, 0, // jmp plt+0x12
+ 0x68, 0, 0, 0, 0, // pushl $reloc_offset
+ 0xe9, 0, 0, 0, 0, // jmp plt+0
+ };
+ memcpy(Buf, Insn, sizeof(Insn));
+
+ uint32_t Ebx = InX::Got->getVA() + InX::Got->getSize();
+ write32le(Buf + 3, GotPltEntryAddr - Ebx);
+ write32le(Buf + 8, -Index * PltEntrySize - PltHeaderSize - 12 + 32);
+ write32le(Buf + 13, -Index * PltEntrySize - PltHeaderSize - 17 + 18);
+ write32le(Buf + 18, RelOff);
+ write32le(Buf + 23, -Index * PltEntrySize - PltHeaderSize - 27);
+}
+
+RetpolineNoPic::RetpolineNoPic() {
+ PltHeaderSize = 48;
+ PltEntrySize = 32;
+}
+
+void RetpolineNoPic::writeGotPlt(uint8_t *Buf, const Symbol &S) const {
+ write32le(Buf, S.getPltVA() + 16);
+}
+
+void RetpolineNoPic::writePltHeader(uint8_t *Buf) const {
+ const uint8_t PltData[] = {
+ 0xff, 0x35, 0, 0, 0, 0, // 0: pushl GOTPLT+4
+ 0x50, // 6: pushl %eax
+ 0xa1, 0, 0, 0, 0, // 7: mov GOTPLT+8, %eax
+ 0xe8, 0x0f, 0x00, 0x00, 0x00, // c: call next
+ 0xf3, 0x90, // 11: loop: pause
+ 0x0f, 0xae, 0xe8, // 13: lfence
+ 0xeb, 0xf9, // 16: jmp loop
+ 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 18: int3
+ 0xcc, 0xcc, 0xcc, // 1f: int3; .align 16
+ 0x89, 0x0c, 0x24, // 20: next: mov %ecx, (%esp)
+ 0x8b, 0x4c, 0x24, 0x04, // 23: mov 0x4(%esp), %ecx
+ 0x89, 0x44, 0x24, 0x04, // 27: mov %eax ,0x4(%esp)
+ 0x89, 0xc8, // 2b: mov %ecx, %eax
+ 0x59, // 2d: pop %ecx
+ 0xc3, // 2e: ret
+ };
+ memcpy(Buf, PltData, sizeof(PltData));
+
+ uint32_t GotPlt = InX::GotPlt->getVA();
+ write32le(Buf + 2, GotPlt + 4);
+ write32le(Buf + 8, GotPlt + 8);
+}
+
+void RetpolineNoPic::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
+ uint64_t PltEntryAddr, int32_t Index,
+ unsigned RelOff) const {
+ const uint8_t Insn[] = {
+ 0x50, // 0: pushl %eax
+ 0xa1, 0, 0, 0, 0, // 1: mov foo_in_GOT, %eax
+ 0xe8, 0, 0, 0, 0, // 6: call plt+0x20
+ 0xe9, 0, 0, 0, 0, // b: jmp plt+0x11
+ 0x68, 0, 0, 0, 0, // 10: pushl $reloc_offset
+ 0xe9, 0, 0, 0, 0, // 15: jmp plt+0
+ };
+ memcpy(Buf, Insn, sizeof(Insn));
+
+ write32le(Buf + 2, GotPltEntryAddr);
+ write32le(Buf + 7, -Index * PltEntrySize - PltHeaderSize - 11 + 32);
+ write32le(Buf + 12, -Index * PltEntrySize - PltHeaderSize - 16 + 17);
+ write32le(Buf + 17, RelOff);
+ write32le(Buf + 22, -Index * PltEntrySize - PltHeaderSize - 26);
+}
+
TargetInfo *elf::getX86TargetInfo() {
- static X86 Target;
- return &Target;
+ if (Config->ZRetpolineplt) {
+ if (Config->Pic) {
+ static RetpolinePic T;
+ return &T;
+ }
+ static RetpolineNoPic T;
+ return &T;
+ }
+
+ static X86 T;
+ return &T;
}
diff --git a/ELF/Arch/X86_64.cpp b/ELF/Arch/X86_64.cpp
index c977d9247d92..3db391e9f01c 100644
--- a/ELF/Arch/X86_64.cpp
+++ b/ELF/Arch/X86_64.cpp
@@ -23,7 +23,7 @@ using namespace lld;
using namespace lld::elf;
namespace {
-template <class ELFT> class X86_64 final : public TargetInfo {
+template <class ELFT> class X86_64 : public TargetInfo {
public:
X86_64();
RelExpr getRelExpr(RelType Type, const Symbol &S,
@@ -460,12 +460,125 @@ void X86_64<ELFT>::relaxGot(uint8_t *Loc, uint64_t Val) const {
write32le(Loc - 1, Val + 1);
}
-TargetInfo *elf::getX32TargetInfo() {
- static X86_64<ELF32LE> Target;
- return &Target;
+namespace {
+template <class ELFT> class Retpoline : public X86_64<ELFT> {
+public:
+ Retpoline();
+ void writeGotPlt(uint8_t *Buf, const Symbol &S) const override;
+ void writePltHeader(uint8_t *Buf) const override;
+ void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
+ int32_t Index, unsigned RelOff) const override;
+};
+
+template <class ELFT> class RetpolineZNow : public X86_64<ELFT> {
+public:
+ RetpolineZNow();
+ void writeGotPlt(uint8_t *Buf, const Symbol &S) const override {}
+ void writePltHeader(uint8_t *Buf) const override;
+ void writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr, uint64_t PltEntryAddr,
+ int32_t Index, unsigned RelOff) const override;
+};
+} // namespace
+
+template <class ELFT> Retpoline<ELFT>::Retpoline() {
+ TargetInfo::PltHeaderSize = 48;
+ TargetInfo::PltEntrySize = 32;
+}
+
+template <class ELFT>
+void Retpoline<ELFT>::writeGotPlt(uint8_t *Buf, const Symbol &S) const {
+ write32le(Buf, S.getPltVA() + 17);
+}
+
+template <class ELFT> void Retpoline<ELFT>::writePltHeader(uint8_t *Buf) const {
+ const uint8_t Insn[] = {
+ 0xff, 0x35, 0, 0, 0, 0, // 0: pushq GOTPLT+8(%rip)
+ 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // 6: mov GOTPLT+16(%rip), %r11
+ 0xe8, 0x0e, 0x00, 0x00, 0x00, // d: callq next
+ 0xf3, 0x90, // 12: loop: pause
+ 0x0f, 0xae, 0xe8, // 14: lfence
+ 0xeb, 0xf9, // 17: jmp loop
+ 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, // 19: int3; .align 16
+ 0x4c, 0x89, 0x1c, 0x24, // 20: next: mov %r11, (%rsp)
+ 0xc3, // 24: ret
+ };
+ memcpy(Buf, Insn, sizeof(Insn));
+
+ uint64_t GotPlt = InX::GotPlt->getVA();
+ uint64_t Plt = InX::Plt->getVA();
+ write32le(Buf + 2, GotPlt - Plt - 6 + 8);
+ write32le(Buf + 9, GotPlt - Plt - 13 + 16);
+}
+
+template <class ELFT>
+void Retpoline<ELFT>::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
+ uint64_t PltEntryAddr, int32_t Index,
+ unsigned RelOff) const {
+ const uint8_t Insn[] = {
+ 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // 0: mov foo@GOTPLT(%rip), %r11
+ 0xe8, 0, 0, 0, 0, // 7: callq plt+0x20
+ 0xe9, 0, 0, 0, 0, // c: jmp plt+0x12
+ 0x68, 0, 0, 0, 0, // 11: pushq <relocation index>
+ 0xe9, 0, 0, 0, 0, // 16: jmp plt+0
+ };
+ memcpy(Buf, Insn, sizeof(Insn));
+
+ uint64_t Off = TargetInfo::PltHeaderSize + TargetInfo::PltEntrySize * Index;
+
+ write32le(Buf + 3, GotPltEntryAddr - PltEntryAddr - 7);
+ write32le(Buf + 8, -Off - 12 + 32);
+ write32le(Buf + 13, -Off - 17 + 18);
+ write32le(Buf + 18, Index);
+ write32le(Buf + 23, -Off - 27);
+}
+
+template <class ELFT> RetpolineZNow<ELFT>::RetpolineZNow() {
+ TargetInfo::PltHeaderSize = 32;
+ TargetInfo::PltEntrySize = 16;
+}
+
+template <class ELFT>
+void RetpolineZNow<ELFT>::writePltHeader(uint8_t *Buf) const {
+ const uint8_t Insn[] = {
+ 0xe8, 0x0b, 0x00, 0x00, 0x00, // 0: call next
+ 0xf3, 0x90, // 5: loop: pause
+ 0x0f, 0xae, 0xe8, // 7: lfence
+ 0xeb, 0xf9, // a: jmp loop
+ 0xcc, 0xcc, 0xcc, 0xcc, // c: int3; .align 16
+ 0x4c, 0x89, 0x1c, 0x24, // 10: next: mov %r11, (%rsp)
+ 0xc3, // 14: ret
+ };
+ memcpy(Buf, Insn, sizeof(Insn));
}
-TargetInfo *elf::getX86_64TargetInfo() {
- static X86_64<ELF64LE> Target;
- return &Target;
+template <class ELFT>
+void RetpolineZNow<ELFT>::writePlt(uint8_t *Buf, uint64_t GotPltEntryAddr,
+ uint64_t PltEntryAddr, int32_t Index,
+ unsigned RelOff) const {
+ const uint8_t Insn[] = {
+ 0x4c, 0x8b, 0x1d, 0, 0, 0, 0, // mov foo@GOTPLT(%rip), %r11
+ 0xe9, 0, 0, 0, 0, // jmp plt+0
+ };
+ memcpy(Buf, Insn, sizeof(Insn));
+
+ write32le(Buf + 3, GotPltEntryAddr - PltEntryAddr - 7);
+ write32le(Buf + 8,
+ -Index * TargetInfo::PltEntrySize - TargetInfo::PltHeaderSize - 12);
}
+
+template <class ELFT> TargetInfo *getTargetInfo() {
+ if (Config->ZRetpolineplt) {
+ if (Config->ZNow) {
+ static RetpolineZNow<ELFT> T;
+ return &T;
+ }
+ static Retpoline<ELFT> T;
+ return &T;
+ }
+
+ static X86_64<ELFT> T;
+ return &T;
+}
+
+TargetInfo *elf::getX32TargetInfo() { return getTargetInfo<ELF32LE>(); }
+TargetInfo *elf::getX86_64TargetInfo() { return getTargetInfo<ELF64LE>(); }
diff --git a/ELF/Config.h b/ELF/Config.h
index 74c325cb7cb1..ed425720965e 100644
--- a/ELF/Config.h
+++ b/ELF/Config.h
@@ -159,6 +159,7 @@ struct Configuration {
bool ZRelro;
bool ZRodynamic;
bool ZText;
+ bool ZRetpolineplt;
bool ExitEarly;
bool ZWxneeded;
DiscardPolicy Discard;
diff --git a/ELF/Driver.cpp b/ELF/Driver.cpp
index b159fe63eb18..326c7bca7122 100644
--- a/ELF/Driver.cpp
+++ b/ELF/Driver.cpp
@@ -674,6 +674,7 @@ void LinkerDriver::readConfigs(opt::InputArgList &Args) {
Config->ZNow = hasZOption(Args, "now");
Config->ZOrigin = hasZOption(Args, "origin");
Config->ZRelro = !hasZOption(Args, "norelro");
+ Config->ZRetpolineplt = hasZOption(Args, "retpolineplt");
Config->ZRodynamic = hasZOption(Args, "rodynamic");
Config->ZStackSize = args::getZOptionValue(Args, OPT_z, "stack-size", 0);
Config->ZText = !hasZOption(Args, "notext");
diff --git a/test/ELF/i386-retpoline-nopic.s b/test/ELF/i386-retpoline-nopic.s
new file mode 100644
index 000000000000..79dd5a63cd69
--- /dev/null
+++ b/test/ELF/i386-retpoline-nopic.s
@@ -0,0 +1,65 @@
+// REQUIRES: x86
+// RUN: llvm-mc -filetype=obj -triple=i386-unknown-linux %s -o %t1.o
+// RUN: llvm-mc -filetype=obj -triple=i386-unknown-linux %p/Inputs/shared.s -o %t2.o
+// RUN: ld.lld -shared %t2.o -o %t2.so
+
+// RUN: ld.lld %t1.o %t2.so -o %t.exe -z retpolineplt
+// RUN: llvm-objdump -d -s %t.exe | FileCheck %s
+
+// CHECK: Disassembly of section .plt:
+// CHECK-NEXT: .plt:
+// CHECK-NEXT: 11010: ff 35 04 20 01 00 pushl 73732
+// CHECK-NEXT: 11016: 50 pushl %eax
+// CHECK-NEXT: 11017: a1 08 20 01 00 movl 73736, %eax
+// CHECK-NEXT: 1101c: e8 0f 00 00 00 calll 15 <.plt+0x20>
+// CHECK-NEXT: 11021: f3 90 pause
+// CHECK-NEXT: 11023: 0f ae e8 lfence
+// CHECK-NEXT: 11026: eb f9 jmp -7 <.plt+0x11>
+// CHECK-NEXT: 11028: cc int3
+// CHECK-NEXT: 11029: cc int3
+// CHECK-NEXT: 1102a: cc int3
+// CHECK-NEXT: 1102b: cc int3
+// CHECK-NEXT: 1102c: cc int3
+// CHECK-NEXT: 1102d: cc int3
+// CHECK-NEXT: 1102e: cc int3
+// CHECK-NEXT: 1102f: cc int3
+// CHECK-NEXT: 11030: 89 0c 24 movl %ecx, (%esp)
+// CHECK-NEXT: 11033: 8b 4c 24 04 movl 4(%esp), %ecx
+// CHECK-NEXT: 11037: 89 44 24 04 movl %eax, 4(%esp)
+// CHECK-NEXT: 1103b: 89 c8 movl %ecx, %eax
+// CHECK-NEXT: 1103d: 59 popl %ecx
+// CHECK-NEXT: 1103e: c3 retl
+// CHECK-NEXT: 1103f: cc int3
+// CHECK-NEXT: 11040: 50 pushl %eax
+// CHECK-NEXT: 11041: a1 0c 20 01 00 movl 73740, %eax
+// CHECK-NEXT: 11046: e8 e5 ff ff ff calll -27 <.plt+0x20>
+// CHECK-NEXT: 1104b: e9 d1 ff ff ff jmp -47 <.plt+0x11>
+// CHECK-NEXT: 11050: 68 00 00 00 00 pushl $0
+// CHECK-NEXT: 11055: e9 b6 ff ff ff jmp -74 <.plt>
+// CHECK-NEXT: 1105a: cc int3
+// CHECK-NEXT: 1105b: cc int3
+// CHECK-NEXT: 1105c: cc int3
+// CHECK-NEXT: 1105d: cc int3
+// CHECK-NEXT: 1105e: cc int3
+// CHECK-NEXT: 1105f: cc int3
+// CHECK-NEXT: 11060: 50 pushl %eax
+// CHECK-NEXT: 11061: a1 10 20 01 00 movl 73744, %eax
+// CHECK-NEXT: 11066: e8 c5 ff ff ff calll -59 <.plt+0x20>
+// CHECK-NEXT: 1106b: e9 b1 ff ff ff jmp -79 <.plt+0x11>
+// CHECK-NEXT: 11070: 68 08 00 00 00 pushl $8
+// CHECK-NEXT: 11075: e9 96 ff ff ff jmp -106 <.plt>
+// CHECK-NEXT: 1107a: cc int3
+// CHECK-NEXT: 1107b: cc int3
+// CHECK-NEXT: 1107c: cc int3
+// CHECK-NEXT: 1107d: cc int3
+// CHECK-NEXT: 1107e: cc int3
+// CHECK-NEXT: 1107f: cc int3
+
+// CHECK: Contents of section .got.plt:
+// CHECK-NEXT: 00300100 00000000 00000000 50100100
+// CHECK-NEXT: 70100100
+
+.global _start
+_start:
+ jmp bar@PLT
+ jmp zed@PLT
diff --git a/test/ELF/i386-retpoline-pic.s b/test/ELF/i386-retpoline-pic.s
new file mode 100644
index 000000000000..3555950b168a
--- /dev/null
+++ b/test/ELF/i386-retpoline-pic.s
@@ -0,0 +1,62 @@
+// REQUIRES: x86
+// RUN: llvm-mc -filetype=obj -triple=i386-unknown-linux -position-independent %s -o %t1.o
+// RUN: llvm-mc -filetype=obj -triple=i386-unknown-linux -position-independent %p/Inputs/shared.s -o %t2.o
+// RUN: ld.lld -shared %t2.o -o %t2.so
+
+// RUN: ld.lld %t1.o %t2.so -o %t.exe -z retpolineplt -pie
+// RUN: llvm-objdump -d -s %t.exe | FileCheck %s
+
+// CHECK: Disassembly of section .plt:
+// CHECK-NEXT: .plt:
+// CHECK-NEXT: 1010: ff b3 04 20 00 00 pushl 8196(%ebx)
+// CHECK-NEXT: 1016: 50 pushl %eax
+// CHECK-NEXT: 1017: 8b 83 08 20 00 00 movl 8200(%ebx), %eax
+// CHECK-NEXT: 101d: e8 0e 00 00 00 calll 14 <.plt+0x20>
+// CHECK-NEXT: 1022: f3 90 pause
+// CHECK-NEXT: 1024: 0f ae e8 lfence
+// CHECK-NEXT: 1027: eb f9 jmp -7 <.plt+0x12>
+// CHECK-NEXT: 1029: cc int3
+// CHECK-NEXT: 102a: cc int3
+// CHECK-NEXT: 102b: cc int3
+// CHECK-NEXT: 102c: cc int3
+// CHECK-NEXT: 102d: cc int3
+// CHECK-NEXT: 102e: cc int3
+// CHECK-NEXT: 102f: cc int3
+// CHECK-NEXT: 1030: 89 0c 24 movl %ecx, (%esp)
+// CHECK-NEXT: 1033: 8b 4c 24 04 movl 4(%esp), %ecx
+// CHECK-NEXT: 1037: 89 44 24 04 movl %eax, 4(%esp)
+// CHECK-NEXT: 103b: 89 c8 movl %ecx, %eax
+// CHECK-NEXT: 103d: 59 popl %ecx
+// CHECK-NEXT: 103e: c3 retl
+// CHECK-NEXT: 103f: cc int3
+// CHECK-NEXT: 1040: 50 pushl %eax
+// CHECK-NEXT: 1041: 8b 83 0c 20 00 00 movl 8204(%ebx), %eax
+// CHECK-NEXT: 1047: e8 e4 ff ff ff calll -28 <.plt+0x20>
+// CHECK-NEXT: 104c: e9 d1 ff ff ff jmp -47 <.plt+0x12>
+// CHECK-NEXT: 1051: 68 00 00 00 00 pushl $0
+// CHECK-NEXT: 1056: e9 b5 ff ff ff jmp -75 <.plt>
+// CHECK-NEXT: 105b: cc int3
+// CHECK-NEXT: 105c: cc int3
+// CHECK-NEXT: 105d: cc int3
+// CHECK-NEXT: 105e: cc int3
+// CHECK-NEXT: 105f: cc int3
+// CHECK-NEXT: 1060: 50 pushl %eax
+// CHECK-NEXT: 1061: 8b 83 10 20 00 00 movl 8208(%ebx), %eax
+// CHECK-NEXT: 1067: e8 c4 ff ff ff calll -60 <.plt+0x20>
+// CHECK-NEXT: 106c: e9 b1 ff ff ff jmp -79 <.plt+0x12>
+// CHECK-NEXT: 1071: 68 08 00 00 00 pushl $8
+// CHECK-NEXT: 1076: e9 95 ff ff ff jmp -107 <.plt>
+// CHECK-NEXT: 107b: cc int3
+// CHECK-NEXT: 107c: cc int3
+// CHECK-NEXT: 107d: cc int3
+// CHECK-NEXT: 107e: cc int3
+// CHECK-NEXT: 107f: cc int3
+
+// CHECK: Contents of section .got.plt:
+// CHECK-NEXT: 2000 00300000 00000000 00000000 51100000
+// CHECK-NEXT: 2010 71100000
+
+.global _start
+_start:
+ jmp bar@PLT
+ jmp zed@PLT
diff --git a/test/ELF/x86-64-retpoline-znow.s b/test/ELF/x86-64-retpoline-znow.s
new file mode 100644
index 000000000000..6464e2c0971f
--- /dev/null
+++ b/test/ELF/x86-64-retpoline-znow.s
@@ -0,0 +1,53 @@
+// REQUIRES: x86
+// RUN: llvm-mc -filetype=obj -triple=x86_64-unknown-linux %s -o %t1.o
+// RUN: llvm-mc -filetype=obj -triple=x86_64-unknown-linux %p/Inputs/shared.s -o %t2.o
+// RUN: ld.lld -shared %t2.o -o %t2.so
+
+// RUN: ld.lld -shared %t1.o %t2.so -o %t.exe -z retpolineplt -z now
+// RUN: llvm-objdump -d -s %t.exe | FileCheck %s
+
+// CHECK: Disassembly of section .plt:
+// CHECK-NEXT: .plt:
+// CHECK-NEXT: 1010: e8 0b 00 00 00 callq 11 <.plt+0x10>
+// CHECK-NEXT: 1015: f3 90 pause
+// CHECK-NEXT: 1017: 0f ae e8 lfence
+// CHECK-NEXT: 101a: eb f9 jmp -7 <.plt+0x5>
+// CHECK-NEXT: 101c: cc int3
+// CHECK-NEXT: 101d: cc int3
+// CHECK-NEXT: 101e: cc int3
+// CHECK-NEXT: 101f: cc int3
+// CHECK-NEXT: 1020: 4c 89 1c 24 movq %r11, (%rsp)
+// CHECK-NEXT: 1024: c3 retq
+// CHECK-NEXT: 1025: cc int3
+// CHECK-NEXT: 1026: cc int3
+// CHECK-NEXT: 1027: cc int3
+// CHECK-NEXT: 1028: cc int3
+// CHECK-NEXT: 1029: cc int3
+// CHECK-NEXT: 102a: cc int3
+// CHECK-NEXT: 102b: cc int3
+// CHECK-NEXT: 102c: cc int3
+// CHECK-NEXT: 102d: cc int3
+// CHECK-NEXT: 102e: cc int3
+// CHECK-NEXT: 102f: cc int3
+// CHECK-NEXT: 1030: 4c 8b 1d c1 10 00 00 movq 4289(%rip), %r11
+// CHECK-NEXT: 1037: e9 d4 ff ff ff jmp -44 <.plt>
+// CHECK-NEXT: 103c: cc int3
+// CHECK-NEXT: 103d: cc int3
+// CHECK-NEXT: 103e: cc int3
+// CHECK-NEXT: 103f: cc int3
+// CHECK-NEXT: 1040: 4c 8b 1d b9 10 00 00 movq 4281(%rip), %r11
+// CHECK-NEXT: 1047: e9 c4 ff ff ff jmp -60 <.plt>
+// CHECK-NEXT: 104c: cc int3
+// CHECK-NEXT: 104d: cc int3
+// CHECK-NEXT: 104e: cc int3
+// CHECK-NEXT: 104f: cc int3
+
+// CHECK: Contents of section .got.plt:
+// CHECK-NEXT: 20e0 00200000 00000000 00000000 00000000
+// CHECK-NEXT: 20f0 00000000 00000000 00000000 00000000
+// CHECK-NEXT: 2100 00000000 00000000
+
+.global _start
+_start:
+ jmp bar@PLT
+ jmp zed@PLT
diff --git a/test/ELF/x86-64-retpoline.s b/test/ELF/x86-64-retpoline.s
new file mode 100644
index 000000000000..535f56533193
--- /dev/null
+++ b/test/ELF/x86-64-retpoline.s
@@ -0,0 +1,66 @@
+// REQUIRES: x86
+// RUN: llvm-mc -filetype=obj -triple=x86_64-unknown-linux %s -o %t1.o
+// RUN: llvm-mc -filetype=obj -triple=x86_64-unknown-linux %p/Inputs/shared.s -o %t2.o
+// RUN: ld.lld -shared %t2.o -o %t2.so
+
+// RUN: ld.lld -shared %t1.o %t2.so -o %t.exe -z retpolineplt
+// RUN: llvm-objdump -d -s %t.exe | FileCheck %s
+
+// CHECK: Disassembly of section .plt:
+// CHECK-NEXT: .plt:
+// CHECK-NEXT: 1010: ff 35 f2 0f 00 00 pushq 4082(%rip)
+// CHECK-NEXT: 1016: 4c 8b 1d f3 0f 00 00 movq 4083(%rip), %r11
+// CHECK-NEXT: 101d: e8 0e 00 00 00 callq 14 <.plt+0x20>
+// CHECK-NEXT: 1022: f3 90 pause
+// CHECK-NEXT: 1024: 0f ae e8 lfence
+// CHECK-NEXT: 1027: eb f9 jmp -7 <.plt+0x12>
+// CHECK-NEXT: 1029: cc int3
+// CHECK-NEXT: 102a: cc int3
+// CHECK-NEXT: 102b: cc int3
+// CHECK-NEXT: 102c: cc int3
+// CHECK-NEXT: 102d: cc int3
+// CHECK-NEXT: 102e: cc int3
+// CHECK-NEXT: 102f: cc int3
+// CHECK-NEXT: 1030: 4c 89 1c 24 movq %r11, (%rsp)
+// CHECK-NEXT: 1034: c3 retq
+// CHECK-NEXT: 1035: cc int3
+// CHECK-NEXT: 1036: cc int3
+// CHECK-NEXT: 1037: cc int3
+// CHECK-NEXT: 1038: cc int3
+// CHECK-NEXT: 1039: cc int3
+// CHECK-NEXT: 103a: cc int3
+// CHECK-NEXT: 103b: cc int3
+// CHECK-NEXT: 103c: cc int3
+// CHECK-NEXT: 103d: cc int3
+// CHECK-NEXT: 103e: cc int3
+// CHECK-NEXT: 103f: cc int3
+// CHECK-NEXT: 1040: 4c 8b 1d d1 0f 00 00 movq 4049(%rip), %r11
+// CHECK-NEXT: 1047: e8 e4 ff ff ff callq -28 <.plt+0x20>
+// CHECK-NEXT: 104c: e9 d1 ff ff ff jmp -47 <.plt+0x12>
+// CHECK-NEXT: 1051: 68 00 00 00 00 pushq $0
+// CHECK-NEXT: 1056: e9 b5 ff ff ff jmp -75 <.plt>
+// CHECK-NEXT: 105b: cc int3
+// CHECK-NEXT: 105c: cc int3
+// CHECK-NEXT: 105d: cc int3
+// CHECK-NEXT: 105e: cc int3
+// CHECK-NEXT: 105f: cc int3
+// CHECK-NEXT: 1060: 4c 8b 1d b9 0f 00 00 movq 4025(%rip), %r11
+// CHECK-NEXT: 1067: e8 c4 ff ff ff callq -60 <.plt+0x20>
+// CHECK-NEXT: 106c: e9 b1 ff ff ff jmp -79 <.plt+0x12>
+// CHECK-NEXT: 1071: 68 01 00 00 00 pushq $1
+// CHECK-NEXT: 1076: e9 95 ff ff ff jmp -107 <.plt>
+// CHECK-NEXT: 107b: cc int3
+// CHECK-NEXT: 107c: cc int3
+// CHECK-NEXT: 107d: cc int3
+// CHECK-NEXT: 107e: cc int3
+// CHECK-NEXT: 107f: cc int3
+
+// CHECK: Contents of section .got.plt:
+// CHECK-NEXT: 2000 00300000 00000000 00000000 00000000
+// CHECK-NEXT: 2010 00000000 00000000 51100000 00000000
+// CHECK-NEXT: 2020 71100000 00000000
+
+.global _start
+_start:
+ jmp bar@PLT
+ jmp zed@PLT