1 //===- bolt/Target/X86/X86MCPlusBuilder.cpp -------------------------------===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file provides X86-specific MCPlus builder. 10 // 11 //===----------------------------------------------------------------------===// 12 13 #include "MCTargetDesc/X86BaseInfo.h" 14 #include "MCTargetDesc/X86InstrRelaxTables.h" 15 #include "MCTargetDesc/X86MCTargetDesc.h" 16 #include "X86MCSymbolizer.h" 17 #include "bolt/Core/MCPlus.h" 18 #include "bolt/Core/MCPlusBuilder.h" 19 #include "llvm/BinaryFormat/ELF.h" 20 #include "llvm/MC/MCContext.h" 21 #include "llvm/MC/MCFixupKindInfo.h" 22 #include "llvm/MC/MCInst.h" 23 #include "llvm/MC/MCInstBuilder.h" 24 #include "llvm/MC/MCInstrInfo.h" 25 #include "llvm/MC/MCRegister.h" 26 #include "llvm/MC/MCRegisterInfo.h" 27 #include "llvm/Support/CommandLine.h" 28 #include "llvm/Support/DataExtractor.h" 29 #include "llvm/Support/Debug.h" 30 #include "llvm/Support/Errc.h" 31 #include "llvm/Support/ErrorHandling.h" 32 #include "llvm/Support/ErrorOr.h" 33 #include <set> 34 35 #define DEBUG_TYPE "mcplus" 36 37 using namespace llvm; 38 using namespace bolt; 39 40 namespace opts { 41 42 extern cl::OptionCategory BoltOptCategory; 43 44 static cl::opt<bool> X86StripRedundantAddressSize( 45 "x86-strip-redundant-address-size", 46 cl::desc("Remove redundant Address-Size override prefix"), cl::init(true), 47 cl::cat(BoltOptCategory)); 48 49 } // namespace opts 50 51 namespace { 52 53 unsigned getShortBranchOpcode(unsigned Opcode) { 54 switch (Opcode) { 55 default: 56 return Opcode; 57 case X86::JMP_2: return X86::JMP_1; 58 case X86::JMP_4: return X86::JMP_1; 59 case X86::JCC_2: return X86::JCC_1; 60 case X86::JCC_4: return X86::JCC_1; 61 } 62 } 63 64 unsigned getShortArithOpcode(unsigned Opcode) { 65 return X86::getShortOpcodeArith(Opcode); 66 } 67 68 bool isMOVSX64rm32(const MCInst &Inst) { 69 return Inst.getOpcode() == X86::MOVSX64rm32; 70 } 71 72 bool isADD64rr(const MCInst &Inst) { return Inst.getOpcode() == X86::ADD64rr; } 73 74 bool isADDri(const MCInst &Inst) { 75 return Inst.getOpcode() == X86::ADD64ri32 || 76 Inst.getOpcode() == X86::ADD64ri8; 77 } 78 79 #define GET_INSTRINFO_OPERAND_TYPES_ENUM 80 #define GET_INSTRINFO_OPERAND_TYPE 81 #define GET_INSTRINFO_MEM_OPERAND_SIZE 82 #include "X86GenInstrInfo.inc" 83 84 class X86MCPlusBuilder : public MCPlusBuilder { 85 public: 86 X86MCPlusBuilder(const MCInstrAnalysis *Analysis, const MCInstrInfo *Info, 87 const MCRegisterInfo *RegInfo) 88 : MCPlusBuilder(Analysis, Info, RegInfo) {} 89 90 std::unique_ptr<MCSymbolizer> 91 createTargetSymbolizer(BinaryFunction &Function) const override { 92 return std::make_unique<X86MCSymbolizer>(Function); 93 } 94 95 bool isBranch(const MCInst &Inst) const override { 96 return Analysis->isBranch(Inst) && !isTailCall(Inst); 97 } 98 99 bool isNoop(const MCInst &Inst) const override { 100 return X86::isNOP(Inst.getOpcode()); 101 } 102 103 unsigned getCondCode(const MCInst &Inst) const override { 104 unsigned Opcode = Inst.getOpcode(); 105 if (X86::isJCC(Opcode)) 106 return Inst.getOperand(Info->get(Opcode).NumOperands - 1).getImm(); 107 return X86::COND_INVALID; 108 } 109 110 unsigned getInvertedCondCode(unsigned CC) const override { 111 switch (CC) { 112 default: return X86::COND_INVALID; 113 case X86::COND_E: return X86::COND_NE; 114 case X86::COND_NE: return X86::COND_E; 115 case X86::COND_L: return X86::COND_GE; 116 case X86::COND_LE: return X86::COND_G; 117 case X86::COND_G: return X86::COND_LE; 118 case X86::COND_GE: return X86::COND_L; 119 case X86::COND_B: return X86::COND_AE; 120 case X86::COND_BE: return X86::COND_A; 121 case X86::COND_A: return X86::COND_BE; 122 case X86::COND_AE: return X86::COND_B; 123 case X86::COND_S: return X86::COND_NS; 124 case X86::COND_NS: return X86::COND_S; 125 case X86::COND_P: return X86::COND_NP; 126 case X86::COND_NP: return X86::COND_P; 127 case X86::COND_O: return X86::COND_NO; 128 case X86::COND_NO: return X86::COND_O; 129 } 130 } 131 132 unsigned getCondCodesLogicalOr(unsigned CC1, unsigned CC2) const override { 133 enum DecodedCondCode : uint8_t { 134 DCC_EQUAL = 0x1, 135 DCC_GREATER = 0x2, 136 DCC_LESSER = 0x4, 137 DCC_GREATER_OR_LESSER = 0x6, 138 DCC_UNSIGNED = 0x8, 139 DCC_SIGNED = 0x10, 140 DCC_INVALID = 0x20, 141 }; 142 143 auto decodeCondCode = [&](unsigned CC) -> uint8_t { 144 switch (CC) { 145 default: return DCC_INVALID; 146 case X86::COND_E: return DCC_EQUAL; 147 case X86::COND_NE: return DCC_GREATER | DCC_LESSER; 148 case X86::COND_L: return DCC_LESSER | DCC_SIGNED; 149 case X86::COND_LE: return DCC_EQUAL | DCC_LESSER | DCC_SIGNED; 150 case X86::COND_G: return DCC_GREATER | DCC_SIGNED; 151 case X86::COND_GE: return DCC_GREATER | DCC_EQUAL | DCC_SIGNED; 152 case X86::COND_B: return DCC_LESSER | DCC_UNSIGNED; 153 case X86::COND_BE: return DCC_EQUAL | DCC_LESSER | DCC_UNSIGNED; 154 case X86::COND_A: return DCC_GREATER | DCC_UNSIGNED; 155 case X86::COND_AE: return DCC_GREATER | DCC_EQUAL | DCC_UNSIGNED; 156 } 157 }; 158 159 uint8_t DCC = decodeCondCode(CC1) | decodeCondCode(CC2); 160 161 if (DCC & DCC_INVALID) 162 return X86::COND_INVALID; 163 164 if (DCC & DCC_SIGNED && DCC & DCC_UNSIGNED) 165 return X86::COND_INVALID; 166 167 switch (DCC) { 168 default: return X86::COND_INVALID; 169 case DCC_EQUAL | DCC_LESSER | DCC_SIGNED: return X86::COND_LE; 170 case DCC_EQUAL | DCC_LESSER | DCC_UNSIGNED: return X86::COND_BE; 171 case DCC_EQUAL | DCC_GREATER | DCC_SIGNED: return X86::COND_GE; 172 case DCC_EQUAL | DCC_GREATER | DCC_UNSIGNED: return X86::COND_AE; 173 case DCC_GREATER | DCC_LESSER | DCC_SIGNED: return X86::COND_NE; 174 case DCC_GREATER | DCC_LESSER | DCC_UNSIGNED: return X86::COND_NE; 175 case DCC_GREATER | DCC_LESSER: return X86::COND_NE; 176 case DCC_EQUAL | DCC_SIGNED: return X86::COND_E; 177 case DCC_EQUAL | DCC_UNSIGNED: return X86::COND_E; 178 case DCC_EQUAL: return X86::COND_E; 179 case DCC_LESSER | DCC_SIGNED: return X86::COND_L; 180 case DCC_LESSER | DCC_UNSIGNED: return X86::COND_B; 181 case DCC_GREATER | DCC_SIGNED: return X86::COND_G; 182 case DCC_GREATER | DCC_UNSIGNED: return X86::COND_A; 183 } 184 } 185 186 bool isValidCondCode(unsigned CC) const override { 187 return (CC != X86::COND_INVALID); 188 } 189 190 bool isBreakpoint(const MCInst &Inst) const override { 191 return Inst.getOpcode() == X86::INT3; 192 } 193 194 bool isPrefix(const MCInst &Inst) const override { 195 const MCInstrDesc &Desc = Info->get(Inst.getOpcode()); 196 return X86II::isPrefix(Desc.TSFlags); 197 } 198 199 bool isRep(const MCInst &Inst) const override { 200 return Inst.getFlags() == X86::IP_HAS_REPEAT; 201 } 202 203 bool deleteREPPrefix(MCInst &Inst) const override { 204 if (Inst.getFlags() == X86::IP_HAS_REPEAT) { 205 Inst.setFlags(0); 206 return true; 207 } 208 return false; 209 } 210 211 // FIXME: For compatibility with old LLVM only! 212 bool isTerminator(const MCInst &Inst) const override { 213 unsigned Opcode = Inst.getOpcode(); 214 return Info->get(Opcode).isTerminator() || X86::isUD1(Opcode) || 215 X86::isUD2(Opcode); 216 } 217 218 bool isIndirectCall(const MCInst &Inst) const override { 219 return isCall(Inst) && 220 ((getMemoryOperandNo(Inst) != -1) || Inst.getOperand(0).isReg()); 221 } 222 223 bool isPop(const MCInst &Inst) const override { 224 return getPopSize(Inst) == 0 ? false : true; 225 } 226 227 bool isTerminateBranch(const MCInst &Inst) const override { 228 return Inst.getOpcode() == X86::ENDBR32 || Inst.getOpcode() == X86::ENDBR64; 229 } 230 231 int getPopSize(const MCInst &Inst) const override { 232 switch (Inst.getOpcode()) { 233 case X86::POP16r: 234 case X86::POP16rmm: 235 case X86::POP16rmr: 236 case X86::POPF16: 237 case X86::POPA16: 238 case X86::POPDS16: 239 case X86::POPES16: 240 case X86::POPFS16: 241 case X86::POPGS16: 242 case X86::POPSS16: 243 return 2; 244 case X86::POP32r: 245 case X86::POP32rmm: 246 case X86::POP32rmr: 247 case X86::POPA32: 248 case X86::POPDS32: 249 case X86::POPES32: 250 case X86::POPF32: 251 case X86::POPFS32: 252 case X86::POPGS32: 253 case X86::POPSS32: 254 return 4; 255 case X86::POP64r: 256 case X86::POP64rmm: 257 case X86::POP64rmr: 258 case X86::POPF64: 259 case X86::POPFS64: 260 case X86::POPGS64: 261 return 8; 262 } 263 return 0; 264 } 265 266 bool isPush(const MCInst &Inst) const override { 267 return getPushSize(Inst) == 0 ? false : true; 268 } 269 270 int getPushSize(const MCInst &Inst) const override { 271 switch (Inst.getOpcode()) { 272 case X86::PUSH16i8: 273 case X86::PUSH16r: 274 case X86::PUSH16rmm: 275 case X86::PUSH16rmr: 276 case X86::PUSHA16: 277 case X86::PUSHCS16: 278 case X86::PUSHDS16: 279 case X86::PUSHES16: 280 case X86::PUSHF16: 281 case X86::PUSHFS16: 282 case X86::PUSHGS16: 283 case X86::PUSHSS16: 284 case X86::PUSHi16: 285 return 2; 286 case X86::PUSH32i8: 287 case X86::PUSH32r: 288 case X86::PUSH32rmm: 289 case X86::PUSH32rmr: 290 case X86::PUSHA32: 291 case X86::PUSHCS32: 292 case X86::PUSHDS32: 293 case X86::PUSHES32: 294 case X86::PUSHF32: 295 case X86::PUSHFS32: 296 case X86::PUSHGS32: 297 case X86::PUSHSS32: 298 case X86::PUSHi32: 299 return 4; 300 case X86::PUSH64i32: 301 case X86::PUSH64i8: 302 case X86::PUSH64r: 303 case X86::PUSH64rmm: 304 case X86::PUSH64rmr: 305 case X86::PUSHF64: 306 case X86::PUSHFS64: 307 case X86::PUSHGS64: 308 return 8; 309 } 310 return 0; 311 } 312 313 bool isSUB(const MCInst &Inst) const override { 314 return X86::isSUB(Inst.getOpcode()); 315 } 316 317 bool isLEA64r(const MCInst &Inst) const override { 318 return Inst.getOpcode() == X86::LEA64r; 319 } 320 321 bool isLeave(const MCInst &Inst) const override { 322 return Inst.getOpcode() == X86::LEAVE || Inst.getOpcode() == X86::LEAVE64; 323 } 324 325 bool isMoveMem2Reg(const MCInst &Inst) const override { 326 switch (Inst.getOpcode()) { 327 case X86::MOV16rm: 328 case X86::MOV32rm: 329 case X86::MOV64rm: 330 return true; 331 } 332 return false; 333 } 334 335 bool isUnsupportedBranch(unsigned Opcode) const override { 336 switch (Opcode) { 337 default: 338 return false; 339 case X86::LOOP: 340 case X86::LOOPE: 341 case X86::LOOPNE: 342 case X86::JECXZ: 343 case X86::JRCXZ: 344 return true; 345 } 346 } 347 348 bool isLoad(const MCInst &Inst) const override { 349 if (isPop(Inst)) 350 return true; 351 352 int MemOpNo = getMemoryOperandNo(Inst); 353 const MCInstrDesc &MCII = Info->get(Inst.getOpcode()); 354 355 if (MemOpNo == -1) 356 return false; 357 358 return MCII.mayLoad(); 359 } 360 361 bool isStore(const MCInst &Inst) const override { 362 if (isPush(Inst)) 363 return true; 364 365 int MemOpNo = getMemoryOperandNo(Inst); 366 const MCInstrDesc &MCII = Info->get(Inst.getOpcode()); 367 368 if (MemOpNo == -1) 369 return false; 370 371 return MCII.mayStore(); 372 } 373 374 bool isCleanRegXOR(const MCInst &Inst) const override { 375 switch (Inst.getOpcode()) { 376 case X86::XOR16rr: 377 case X86::XOR32rr: 378 case X86::XOR64rr: 379 break; 380 default: 381 return false; 382 } 383 return (Inst.getOperand(0).getReg() == Inst.getOperand(2).getReg()); 384 } 385 386 bool isPacked(const MCInst &Inst) const override { 387 const MCInstrDesc &Desc = Info->get(Inst.getOpcode()); 388 return (Desc.TSFlags & X86II::OpPrefixMask) == X86II::PD; 389 } 390 391 unsigned getTrapFillValue() const override { return 0xCC; } 392 393 struct IndJmpMatcherFrag1 : MCInstMatcher { 394 std::unique_ptr<MCInstMatcher> Base; 395 std::unique_ptr<MCInstMatcher> Scale; 396 std::unique_ptr<MCInstMatcher> Index; 397 std::unique_ptr<MCInstMatcher> Offset; 398 399 IndJmpMatcherFrag1(std::unique_ptr<MCInstMatcher> Base, 400 std::unique_ptr<MCInstMatcher> Scale, 401 std::unique_ptr<MCInstMatcher> Index, 402 std::unique_ptr<MCInstMatcher> Offset) 403 : Base(std::move(Base)), Scale(std::move(Scale)), 404 Index(std::move(Index)), Offset(std::move(Offset)) {} 405 406 bool match(const MCRegisterInfo &MRI, MCPlusBuilder &MIB, 407 MutableArrayRef<MCInst> InInstrWindow, int OpNum) override { 408 if (!MCInstMatcher::match(MRI, MIB, InInstrWindow, OpNum)) 409 return false; 410 411 if (CurInst->getOpcode() != X86::JMP64m) 412 return false; 413 414 int MemOpNo = MIB.getMemoryOperandNo(*CurInst); 415 if (MemOpNo == -1) 416 return false; 417 418 if (!Base->match(MRI, MIB, this->InstrWindow, MemOpNo + X86::AddrBaseReg)) 419 return false; 420 if (!Scale->match(MRI, MIB, this->InstrWindow, 421 MemOpNo + X86::AddrScaleAmt)) 422 return false; 423 if (!Index->match(MRI, MIB, this->InstrWindow, 424 MemOpNo + X86::AddrIndexReg)) 425 return false; 426 if (!Offset->match(MRI, MIB, this->InstrWindow, MemOpNo + X86::AddrDisp)) 427 return false; 428 return true; 429 } 430 431 void annotate(MCPlusBuilder &MIB, StringRef Annotation) override { 432 MIB.addAnnotation(*CurInst, Annotation, true); 433 Base->annotate(MIB, Annotation); 434 Scale->annotate(MIB, Annotation); 435 Index->annotate(MIB, Annotation); 436 Offset->annotate(MIB, Annotation); 437 } 438 }; 439 440 std::unique_ptr<MCInstMatcher> 441 matchIndJmp(std::unique_ptr<MCInstMatcher> Base, 442 std::unique_ptr<MCInstMatcher> Scale, 443 std::unique_ptr<MCInstMatcher> Index, 444 std::unique_ptr<MCInstMatcher> Offset) const override { 445 return std::unique_ptr<MCInstMatcher>( 446 new IndJmpMatcherFrag1(std::move(Base), std::move(Scale), 447 std::move(Index), std::move(Offset))); 448 } 449 450 struct IndJmpMatcherFrag2 : MCInstMatcher { 451 std::unique_ptr<MCInstMatcher> Reg; 452 453 IndJmpMatcherFrag2(std::unique_ptr<MCInstMatcher> Reg) 454 : Reg(std::move(Reg)) {} 455 456 bool match(const MCRegisterInfo &MRI, MCPlusBuilder &MIB, 457 MutableArrayRef<MCInst> InInstrWindow, int OpNum) override { 458 if (!MCInstMatcher::match(MRI, MIB, InInstrWindow, OpNum)) 459 return false; 460 461 if (CurInst->getOpcode() != X86::JMP64r) 462 return false; 463 464 return Reg->match(MRI, MIB, this->InstrWindow, 0); 465 } 466 467 void annotate(MCPlusBuilder &MIB, StringRef Annotation) override { 468 MIB.addAnnotation(*CurInst, Annotation, true); 469 Reg->annotate(MIB, Annotation); 470 } 471 }; 472 473 std::unique_ptr<MCInstMatcher> 474 matchIndJmp(std::unique_ptr<MCInstMatcher> Target) const override { 475 return std::unique_ptr<MCInstMatcher>( 476 new IndJmpMatcherFrag2(std::move(Target))); 477 } 478 479 struct LoadMatcherFrag1 : MCInstMatcher { 480 std::unique_ptr<MCInstMatcher> Base; 481 std::unique_ptr<MCInstMatcher> Scale; 482 std::unique_ptr<MCInstMatcher> Index; 483 std::unique_ptr<MCInstMatcher> Offset; 484 485 LoadMatcherFrag1(std::unique_ptr<MCInstMatcher> Base, 486 std::unique_ptr<MCInstMatcher> Scale, 487 std::unique_ptr<MCInstMatcher> Index, 488 std::unique_ptr<MCInstMatcher> Offset) 489 : Base(std::move(Base)), Scale(std::move(Scale)), 490 Index(std::move(Index)), Offset(std::move(Offset)) {} 491 492 bool match(const MCRegisterInfo &MRI, MCPlusBuilder &MIB, 493 MutableArrayRef<MCInst> InInstrWindow, int OpNum) override { 494 if (!MCInstMatcher::match(MRI, MIB, InInstrWindow, OpNum)) 495 return false; 496 497 if (CurInst->getOpcode() != X86::MOV64rm && 498 CurInst->getOpcode() != X86::MOVSX64rm32) 499 return false; 500 501 int MemOpNo = MIB.getMemoryOperandNo(*CurInst); 502 if (MemOpNo == -1) 503 return false; 504 505 if (!Base->match(MRI, MIB, this->InstrWindow, MemOpNo + X86::AddrBaseReg)) 506 return false; 507 if (!Scale->match(MRI, MIB, this->InstrWindow, 508 MemOpNo + X86::AddrScaleAmt)) 509 return false; 510 if (!Index->match(MRI, MIB, this->InstrWindow, 511 MemOpNo + X86::AddrIndexReg)) 512 return false; 513 if (!Offset->match(MRI, MIB, this->InstrWindow, MemOpNo + X86::AddrDisp)) 514 return false; 515 return true; 516 } 517 518 void annotate(MCPlusBuilder &MIB, StringRef Annotation) override { 519 MIB.addAnnotation(*CurInst, Annotation, true); 520 Base->annotate(MIB, Annotation); 521 Scale->annotate(MIB, Annotation); 522 Index->annotate(MIB, Annotation); 523 Offset->annotate(MIB, Annotation); 524 } 525 }; 526 527 std::unique_ptr<MCInstMatcher> 528 matchLoad(std::unique_ptr<MCInstMatcher> Base, 529 std::unique_ptr<MCInstMatcher> Scale, 530 std::unique_ptr<MCInstMatcher> Index, 531 std::unique_ptr<MCInstMatcher> Offset) const override { 532 return std::unique_ptr<MCInstMatcher>( 533 new LoadMatcherFrag1(std::move(Base), std::move(Scale), 534 std::move(Index), std::move(Offset))); 535 } 536 537 struct AddMatcher : MCInstMatcher { 538 std::unique_ptr<MCInstMatcher> A; 539 std::unique_ptr<MCInstMatcher> B; 540 541 AddMatcher(std::unique_ptr<MCInstMatcher> A, 542 std::unique_ptr<MCInstMatcher> B) 543 : A(std::move(A)), B(std::move(B)) {} 544 545 bool match(const MCRegisterInfo &MRI, MCPlusBuilder &MIB, 546 MutableArrayRef<MCInst> InInstrWindow, int OpNum) override { 547 if (!MCInstMatcher::match(MRI, MIB, InInstrWindow, OpNum)) 548 return false; 549 550 if (CurInst->getOpcode() == X86::ADD64rr || 551 CurInst->getOpcode() == X86::ADD64rr_DB || 552 CurInst->getOpcode() == X86::ADD64rr_REV) { 553 if (!A->match(MRI, MIB, this->InstrWindow, 1)) { 554 if (!B->match(MRI, MIB, this->InstrWindow, 1)) 555 return false; 556 return A->match(MRI, MIB, this->InstrWindow, 2); 557 } 558 559 if (B->match(MRI, MIB, this->InstrWindow, 2)) 560 return true; 561 562 if (!B->match(MRI, MIB, this->InstrWindow, 1)) 563 return false; 564 return A->match(MRI, MIB, this->InstrWindow, 2); 565 } 566 567 return false; 568 } 569 570 void annotate(MCPlusBuilder &MIB, StringRef Annotation) override { 571 MIB.addAnnotation(*CurInst, Annotation, true); 572 A->annotate(MIB, Annotation); 573 B->annotate(MIB, Annotation); 574 } 575 }; 576 577 virtual std::unique_ptr<MCInstMatcher> 578 matchAdd(std::unique_ptr<MCInstMatcher> A, 579 std::unique_ptr<MCInstMatcher> B) const override { 580 return std::unique_ptr<MCInstMatcher>( 581 new AddMatcher(std::move(A), std::move(B))); 582 } 583 584 struct LEAMatcher : MCInstMatcher { 585 std::unique_ptr<MCInstMatcher> Target; 586 587 LEAMatcher(std::unique_ptr<MCInstMatcher> Target) 588 : Target(std::move(Target)) {} 589 590 bool match(const MCRegisterInfo &MRI, MCPlusBuilder &MIB, 591 MutableArrayRef<MCInst> InInstrWindow, int OpNum) override { 592 if (!MCInstMatcher::match(MRI, MIB, InInstrWindow, OpNum)) 593 return false; 594 595 if (CurInst->getOpcode() != X86::LEA64r) 596 return false; 597 598 if (CurInst->getOperand(1 + X86::AddrScaleAmt).getImm() != 1 || 599 CurInst->getOperand(1 + X86::AddrIndexReg).getReg() != 600 X86::NoRegister || 601 (CurInst->getOperand(1 + X86::AddrBaseReg).getReg() != 602 X86::NoRegister && 603 CurInst->getOperand(1 + X86::AddrBaseReg).getReg() != X86::RIP)) 604 return false; 605 606 return Target->match(MRI, MIB, this->InstrWindow, 1 + X86::AddrDisp); 607 } 608 609 void annotate(MCPlusBuilder &MIB, StringRef Annotation) override { 610 MIB.addAnnotation(*CurInst, Annotation, true); 611 Target->annotate(MIB, Annotation); 612 } 613 }; 614 615 virtual std::unique_ptr<MCInstMatcher> 616 matchLoadAddr(std::unique_ptr<MCInstMatcher> Target) const override { 617 return std::unique_ptr<MCInstMatcher>(new LEAMatcher(std::move(Target))); 618 } 619 620 bool hasPCRelOperand(const MCInst &Inst) const override { 621 for (const MCOperand &Operand : Inst) 622 if (Operand.isReg() && Operand.getReg() == X86::RIP) 623 return true; 624 return false; 625 } 626 627 int getMemoryOperandNo(const MCInst &Inst) const override { 628 unsigned Opcode = Inst.getOpcode(); 629 const MCInstrDesc &Desc = Info->get(Opcode); 630 int MemOpNo = X86II::getMemoryOperandNo(Desc.TSFlags); 631 if (MemOpNo >= 0) 632 MemOpNo += X86II::getOperandBias(Desc); 633 return MemOpNo; 634 } 635 636 bool hasEVEXEncoding(const MCInst &Inst) const override { 637 const MCInstrDesc &Desc = Info->get(Inst.getOpcode()); 638 return (Desc.TSFlags & X86II::EncodingMask) == X86II::EVEX; 639 } 640 641 bool isMacroOpFusionPair(ArrayRef<MCInst> Insts) const override { 642 const auto *I = Insts.begin(); 643 while (I != Insts.end() && isPrefix(*I)) 644 ++I; 645 if (I == Insts.end()) 646 return false; 647 648 const MCInst &FirstInst = *I; 649 ++I; 650 while (I != Insts.end() && isPrefix(*I)) 651 ++I; 652 if (I == Insts.end()) 653 return false; 654 const MCInst &SecondInst = *I; 655 656 if (!isConditionalBranch(SecondInst)) 657 return false; 658 // Cannot fuse if the first instruction uses RIP-relative memory. 659 if (hasPCRelOperand(FirstInst)) 660 return false; 661 662 const X86::FirstMacroFusionInstKind CmpKind = 663 X86::classifyFirstOpcodeInMacroFusion(FirstInst.getOpcode()); 664 if (CmpKind == X86::FirstMacroFusionInstKind::Invalid) 665 return false; 666 667 X86::CondCode CC = static_cast<X86::CondCode>(getCondCode(SecondInst)); 668 X86::SecondMacroFusionInstKind BranchKind = 669 X86::classifySecondCondCodeInMacroFusion(CC); 670 if (BranchKind == X86::SecondMacroFusionInstKind::Invalid) 671 return false; 672 return X86::isMacroFused(CmpKind, BranchKind); 673 } 674 675 bool 676 evaluateX86MemoryOperand(const MCInst &Inst, unsigned *BaseRegNum, 677 int64_t *ScaleImm, unsigned *IndexRegNum, 678 int64_t *DispImm, unsigned *SegmentRegNum, 679 const MCExpr **DispExpr = nullptr) const override { 680 assert(BaseRegNum && ScaleImm && IndexRegNum && SegmentRegNum && 681 "one of the input pointers is null"); 682 int MemOpNo = getMemoryOperandNo(Inst); 683 if (MemOpNo < 0) 684 return false; 685 unsigned MemOpOffset = static_cast<unsigned>(MemOpNo); 686 687 if (MemOpOffset + X86::AddrSegmentReg >= MCPlus::getNumPrimeOperands(Inst)) 688 return false; 689 690 const MCOperand &Base = Inst.getOperand(MemOpOffset + X86::AddrBaseReg); 691 const MCOperand &Scale = Inst.getOperand(MemOpOffset + X86::AddrScaleAmt); 692 const MCOperand &Index = Inst.getOperand(MemOpOffset + X86::AddrIndexReg); 693 const MCOperand &Disp = Inst.getOperand(MemOpOffset + X86::AddrDisp); 694 const MCOperand &Segment = 695 Inst.getOperand(MemOpOffset + X86::AddrSegmentReg); 696 697 // Make sure it is a well-formed memory operand. 698 if (!Base.isReg() || !Scale.isImm() || !Index.isReg() || 699 (!Disp.isImm() && !Disp.isExpr()) || !Segment.isReg()) 700 return false; 701 702 *BaseRegNum = Base.getReg(); 703 *ScaleImm = Scale.getImm(); 704 *IndexRegNum = Index.getReg(); 705 if (Disp.isImm()) { 706 assert(DispImm && "DispImm needs to be set"); 707 *DispImm = Disp.getImm(); 708 if (DispExpr) 709 *DispExpr = nullptr; 710 } else { 711 assert(DispExpr && "DispExpr needs to be set"); 712 *DispExpr = Disp.getExpr(); 713 if (DispImm) 714 *DispImm = 0; 715 } 716 *SegmentRegNum = Segment.getReg(); 717 return true; 718 } 719 720 bool evaluateMemOperandTarget(const MCInst &Inst, uint64_t &Target, 721 uint64_t Address, 722 uint64_t Size) const override { 723 unsigned BaseRegNum; 724 int64_t ScaleValue; 725 unsigned IndexRegNum; 726 int64_t DispValue; 727 unsigned SegRegNum; 728 const MCExpr *DispExpr = nullptr; 729 if (!evaluateX86MemoryOperand(Inst, &BaseRegNum, &ScaleValue, &IndexRegNum, 730 &DispValue, &SegRegNum, &DispExpr)) 731 return false; 732 733 // Make sure it's a well-formed addressing we can statically evaluate. 734 if ((BaseRegNum != X86::RIP && BaseRegNum != X86::NoRegister) || 735 IndexRegNum != X86::NoRegister || SegRegNum != X86::NoRegister || 736 DispExpr) 737 return false; 738 739 Target = DispValue; 740 if (BaseRegNum == X86::RIP) { 741 assert(Size != 0 && "instruction size required in order to statically " 742 "evaluate RIP-relative address"); 743 Target += Address + Size; 744 } 745 return true; 746 } 747 748 MCInst::iterator getMemOperandDisp(MCInst &Inst) const override { 749 int MemOpNo = getMemoryOperandNo(Inst); 750 if (MemOpNo < 0) 751 return Inst.end(); 752 return Inst.begin() + (MemOpNo + X86::AddrDisp); 753 } 754 755 bool replaceMemOperandDisp(MCInst &Inst, MCOperand Operand) const override { 756 MCOperand *OI = getMemOperandDisp(Inst); 757 if (OI == Inst.end()) 758 return false; 759 *OI = Operand; 760 return true; 761 } 762 763 /// Get the registers used as function parameters. 764 /// This function is specific to the x86_64 abi on Linux. 765 BitVector getRegsUsedAsParams() const override { 766 BitVector Regs = BitVector(RegInfo->getNumRegs(), false); 767 Regs |= getAliases(X86::RSI); 768 Regs |= getAliases(X86::RDI); 769 Regs |= getAliases(X86::RDX); 770 Regs |= getAliases(X86::RCX); 771 Regs |= getAliases(X86::R8); 772 Regs |= getAliases(X86::R9); 773 return Regs; 774 } 775 776 void getCalleeSavedRegs(BitVector &Regs) const override { 777 Regs |= getAliases(X86::RBX); 778 Regs |= getAliases(X86::RBP); 779 Regs |= getAliases(X86::R12); 780 Regs |= getAliases(X86::R13); 781 Regs |= getAliases(X86::R14); 782 Regs |= getAliases(X86::R15); 783 } 784 785 void getDefaultDefIn(BitVector &Regs) const override { 786 assert(Regs.size() >= RegInfo->getNumRegs() && 787 "The size of BitVector is less than RegInfo->getNumRegs()."); 788 Regs.set(X86::RAX); 789 Regs.set(X86::RCX); 790 Regs.set(X86::RDX); 791 Regs.set(X86::RSI); 792 Regs.set(X86::RDI); 793 Regs.set(X86::R8); 794 Regs.set(X86::R9); 795 Regs.set(X86::XMM0); 796 Regs.set(X86::XMM1); 797 Regs.set(X86::XMM2); 798 Regs.set(X86::XMM3); 799 Regs.set(X86::XMM4); 800 Regs.set(X86::XMM5); 801 Regs.set(X86::XMM6); 802 Regs.set(X86::XMM7); 803 } 804 805 void getDefaultLiveOut(BitVector &Regs) const override { 806 assert(Regs.size() >= RegInfo->getNumRegs() && 807 "The size of BitVector is less than RegInfo->getNumRegs()."); 808 Regs |= getAliases(X86::RAX); 809 Regs |= getAliases(X86::RDX); 810 Regs |= getAliases(X86::RCX); 811 Regs |= getAliases(X86::XMM0); 812 Regs |= getAliases(X86::XMM1); 813 } 814 815 void getGPRegs(BitVector &Regs, bool IncludeAlias) const override { 816 if (IncludeAlias) { 817 Regs |= getAliases(X86::RAX); 818 Regs |= getAliases(X86::RBX); 819 Regs |= getAliases(X86::RBP); 820 Regs |= getAliases(X86::RSI); 821 Regs |= getAliases(X86::RDI); 822 Regs |= getAliases(X86::RDX); 823 Regs |= getAliases(X86::RCX); 824 Regs |= getAliases(X86::R8); 825 Regs |= getAliases(X86::R9); 826 Regs |= getAliases(X86::R10); 827 Regs |= getAliases(X86::R11); 828 Regs |= getAliases(X86::R12); 829 Regs |= getAliases(X86::R13); 830 Regs |= getAliases(X86::R14); 831 Regs |= getAliases(X86::R15); 832 return; 833 } 834 Regs.set(X86::RAX); 835 Regs.set(X86::RBX); 836 Regs.set(X86::RBP); 837 Regs.set(X86::RSI); 838 Regs.set(X86::RDI); 839 Regs.set(X86::RDX); 840 Regs.set(X86::RCX); 841 Regs.set(X86::R8); 842 Regs.set(X86::R9); 843 Regs.set(X86::R10); 844 Regs.set(X86::R11); 845 Regs.set(X86::R12); 846 Regs.set(X86::R13); 847 Regs.set(X86::R14); 848 Regs.set(X86::R15); 849 } 850 851 void getClassicGPRegs(BitVector &Regs) const override { 852 Regs |= getAliases(X86::RAX); 853 Regs |= getAliases(X86::RBX); 854 Regs |= getAliases(X86::RBP); 855 Regs |= getAliases(X86::RSI); 856 Regs |= getAliases(X86::RDI); 857 Regs |= getAliases(X86::RDX); 858 Regs |= getAliases(X86::RCX); 859 } 860 861 void getRepRegs(BitVector &Regs) const override { 862 Regs |= getAliases(X86::RCX); 863 } 864 865 MCPhysReg getAliasSized(MCPhysReg Reg, uint8_t Size) const override { 866 switch (Reg) { 867 case X86::RAX: case X86::EAX: case X86::AX: case X86::AL: case X86::AH: 868 switch (Size) { 869 case 8: return X86::RAX; case 4: return X86::EAX; 870 case 2: return X86::AX; case 1: return X86::AL; 871 default: llvm_unreachable("Unexpected size"); 872 } 873 case X86::RBX: case X86::EBX: case X86::BX: case X86::BL: case X86::BH: 874 switch (Size) { 875 case 8: return X86::RBX; case 4: return X86::EBX; 876 case 2: return X86::BX; case 1: return X86::BL; 877 default: llvm_unreachable("Unexpected size"); 878 } 879 case X86::RDX: case X86::EDX: case X86::DX: case X86::DL: case X86::DH: 880 switch (Size) { 881 case 8: return X86::RDX; case 4: return X86::EDX; 882 case 2: return X86::DX; case 1: return X86::DL; 883 default: llvm_unreachable("Unexpected size"); 884 } 885 case X86::RDI: case X86::EDI: case X86::DI: case X86::DIL: 886 switch (Size) { 887 case 8: return X86::RDI; case 4: return X86::EDI; 888 case 2: return X86::DI; case 1: return X86::DIL; 889 default: llvm_unreachable("Unexpected size"); 890 } 891 case X86::RSI: case X86::ESI: case X86::SI: case X86::SIL: 892 switch (Size) { 893 case 8: return X86::RSI; case 4: return X86::ESI; 894 case 2: return X86::SI; case 1: return X86::SIL; 895 default: llvm_unreachable("Unexpected size"); 896 } 897 case X86::RCX: case X86::ECX: case X86::CX: case X86::CL: case X86::CH: 898 switch (Size) { 899 case 8: return X86::RCX; case 4: return X86::ECX; 900 case 2: return X86::CX; case 1: return X86::CL; 901 default: llvm_unreachable("Unexpected size"); 902 } 903 case X86::RSP: case X86::ESP: case X86::SP: case X86::SPL: 904 switch (Size) { 905 case 8: return X86::RSP; case 4: return X86::ESP; 906 case 2: return X86::SP; case 1: return X86::SPL; 907 default: llvm_unreachable("Unexpected size"); 908 } 909 case X86::RBP: case X86::EBP: case X86::BP: case X86::BPL: 910 switch (Size) { 911 case 8: return X86::RBP; case 4: return X86::EBP; 912 case 2: return X86::BP; case 1: return X86::BPL; 913 default: llvm_unreachable("Unexpected size"); 914 } 915 case X86::R8: case X86::R8D: case X86::R8W: case X86::R8B: 916 switch (Size) { 917 case 8: return X86::R8; case 4: return X86::R8D; 918 case 2: return X86::R8W; case 1: return X86::R8B; 919 default: llvm_unreachable("Unexpected size"); 920 } 921 case X86::R9: case X86::R9D: case X86::R9W: case X86::R9B: 922 switch (Size) { 923 case 8: return X86::R9; case 4: return X86::R9D; 924 case 2: return X86::R9W; case 1: return X86::R9B; 925 default: llvm_unreachable("Unexpected size"); 926 } 927 case X86::R10: case X86::R10D: case X86::R10W: case X86::R10B: 928 switch (Size) { 929 case 8: return X86::R10; case 4: return X86::R10D; 930 case 2: return X86::R10W; case 1: return X86::R10B; 931 default: llvm_unreachable("Unexpected size"); 932 } 933 case X86::R11: case X86::R11D: case X86::R11W: case X86::R11B: 934 switch (Size) { 935 case 8: return X86::R11; case 4: return X86::R11D; 936 case 2: return X86::R11W; case 1: return X86::R11B; 937 default: llvm_unreachable("Unexpected size"); 938 } 939 case X86::R12: case X86::R12D: case X86::R12W: case X86::R12B: 940 switch (Size) { 941 case 8: return X86::R12; case 4: return X86::R12D; 942 case 2: return X86::R12W; case 1: return X86::R12B; 943 default: llvm_unreachable("Unexpected size"); 944 } 945 case X86::R13: case X86::R13D: case X86::R13W: case X86::R13B: 946 switch (Size) { 947 case 8: return X86::R13; case 4: return X86::R13D; 948 case 2: return X86::R13W; case 1: return X86::R13B; 949 default: llvm_unreachable("Unexpected size"); 950 } 951 case X86::R14: case X86::R14D: case X86::R14W: case X86::R14B: 952 switch (Size) { 953 case 8: return X86::R14; case 4: return X86::R14D; 954 case 2: return X86::R14W; case 1: return X86::R14B; 955 default: llvm_unreachable("Unexpected size"); 956 } 957 case X86::R15: case X86::R15D: case X86::R15W: case X86::R15B: 958 switch (Size) { 959 case 8: return X86::R15; case 4: return X86::R15D; 960 case 2: return X86::R15W; case 1: return X86::R15B; 961 default: llvm_unreachable("Unexpected size"); 962 } 963 default: 964 dbgs() << Reg << " (get alias sized)\n"; 965 llvm_unreachable("Unexpected reg number"); 966 break; 967 } 968 } 969 970 bool isUpper8BitReg(MCPhysReg Reg) const override { 971 switch (Reg) { 972 case X86::AH: 973 case X86::BH: 974 case X86::CH: 975 case X86::DH: 976 return true; 977 default: 978 return false; 979 } 980 } 981 982 bool cannotUseREX(const MCInst &Inst) const override { 983 switch (Inst.getOpcode()) { 984 case X86::MOV8mr_NOREX: 985 case X86::MOV8rm_NOREX: 986 case X86::MOV8rr_NOREX: 987 case X86::MOVSX32rm8_NOREX: 988 case X86::MOVSX32rr8_NOREX: 989 case X86::MOVZX32rm8_NOREX: 990 case X86::MOVZX32rr8_NOREX: 991 case X86::MOV8mr: 992 case X86::MOV8rm: 993 case X86::MOV8rr: 994 case X86::MOVSX32rm8: 995 case X86::MOVSX32rr8: 996 case X86::MOVZX32rm8: 997 case X86::MOVZX32rr8: 998 case X86::TEST8ri: 999 for (const MCOperand &Operand : MCPlus::primeOperands(Inst)) { 1000 if (!Operand.isReg()) 1001 continue; 1002 if (isUpper8BitReg(Operand.getReg())) 1003 return true; 1004 } 1005 LLVM_FALLTHROUGH; 1006 default: 1007 return false; 1008 } 1009 } 1010 1011 static uint8_t getMemDataSize(const MCInst &Inst, int MemOpNo) { 1012 using namespace llvm::X86; 1013 int OpType = getOperandType(Inst.getOpcode(), MemOpNo); 1014 return getMemOperandSize(OpType) / 8; 1015 } 1016 1017 /// Classifying a stack access as *not* "SIMPLE" here means we don't know how 1018 /// to change this instruction memory access. It will disable any changes to 1019 /// the stack layout, so we can't do the most aggressive form of shrink 1020 /// wrapping. We must do so in a way that keeps the original stack layout. 1021 /// Otherwise you need to adjust the offset of all instructions accessing the 1022 /// stack: we can't do that anymore because there is one instruction that is 1023 /// not simple. There are other implications as well. We have heuristics to 1024 /// detect when a register is callee-saved and thus eligible for shrink 1025 /// wrapping. If you are restoring a register using a non-simple stack access, 1026 /// then it is classified as NOT callee-saved, and it disables shrink wrapping 1027 /// for *that* register (but not for others). 1028 /// 1029 /// Classifying a stack access as "size 0" or detecting an indexed memory 1030 /// access (to address a vector, for example) here means we know there is a 1031 /// stack access, but we can't quite understand how wide is the access in 1032 /// bytes. This is very serious because we can't understand how memory 1033 /// accesses alias with each other for this function. This will essentially 1034 /// disable not only shrink wrapping but all frame analysis, it will fail it 1035 /// as "we don't understand this function and we give up on it". 1036 bool isStackAccess(const MCInst &Inst, bool &IsLoad, bool &IsStore, 1037 bool &IsStoreFromReg, MCPhysReg &Reg, int32_t &SrcImm, 1038 uint16_t &StackPtrReg, int64_t &StackOffset, uint8_t &Size, 1039 bool &IsSimple, bool &IsIndexed) const override { 1040 // Detect simple push/pop cases first 1041 if (int Sz = getPushSize(Inst)) { 1042 IsLoad = false; 1043 IsStore = true; 1044 IsStoreFromReg = true; 1045 StackPtrReg = X86::RSP; 1046 StackOffset = -Sz; 1047 Size = Sz; 1048 IsSimple = true; 1049 if (Inst.getOperand(0).isImm()) 1050 SrcImm = Inst.getOperand(0).getImm(); 1051 else if (Inst.getOperand(0).isReg()) 1052 Reg = Inst.getOperand(0).getReg(); 1053 else 1054 IsSimple = false; 1055 1056 return true; 1057 } 1058 if (int Sz = getPopSize(Inst)) { 1059 IsLoad = true; 1060 IsStore = false; 1061 if (Inst.getNumOperands() == 0 || !Inst.getOperand(0).isReg()) { 1062 IsSimple = false; 1063 } else { 1064 Reg = Inst.getOperand(0).getReg(); 1065 IsSimple = true; 1066 } 1067 StackPtrReg = X86::RSP; 1068 StackOffset = 0; 1069 Size = Sz; 1070 return true; 1071 } 1072 1073 struct InstInfo { 1074 // Size in bytes that Inst loads from memory. 1075 uint8_t DataSize; 1076 bool IsLoad; 1077 bool IsStore; 1078 bool StoreFromReg; 1079 bool Simple; 1080 }; 1081 1082 InstInfo I; 1083 int MemOpNo = getMemoryOperandNo(Inst); 1084 const MCInstrDesc &MCII = Info->get(Inst.getOpcode()); 1085 // If it is not dealing with a memory operand, we discard it 1086 if (MemOpNo == -1 || MCII.isCall()) 1087 return false; 1088 1089 switch (Inst.getOpcode()) { 1090 default: { 1091 bool IsLoad = MCII.mayLoad(); 1092 bool IsStore = MCII.mayStore(); 1093 // Is it LEA? (deals with memory but is not loading nor storing) 1094 if (!IsLoad && !IsStore) 1095 return false; 1096 uint8_t Sz = getMemDataSize(Inst, MemOpNo); 1097 I = {Sz, IsLoad, IsStore, false, false}; 1098 break; 1099 } 1100 case X86::MOV16rm: I = {2, true, false, false, true}; break; 1101 case X86::MOV32rm: I = {4, true, false, false, true}; break; 1102 case X86::MOV64rm: I = {8, true, false, false, true}; break; 1103 case X86::MOV16mr: I = {2, false, true, true, true}; break; 1104 case X86::MOV32mr: I = {4, false, true, true, true}; break; 1105 case X86::MOV64mr: I = {8, false, true, true, true}; break; 1106 case X86::MOV16mi: I = {2, false, true, false, true}; break; 1107 case X86::MOV32mi: I = {4, false, true, false, true}; break; 1108 } // end switch (Inst.getOpcode()) 1109 1110 unsigned BaseRegNum; 1111 int64_t ScaleValue; 1112 unsigned IndexRegNum; 1113 int64_t DispValue; 1114 unsigned SegRegNum; 1115 const MCExpr *DispExpr; 1116 if (!evaluateX86MemoryOperand(Inst, &BaseRegNum, &ScaleValue, &IndexRegNum, 1117 &DispValue, &SegRegNum, &DispExpr)) { 1118 LLVM_DEBUG(dbgs() << "Evaluate failed on "); 1119 LLVM_DEBUG(Inst.dump()); 1120 return false; 1121 } 1122 1123 // Make sure it's a stack access 1124 if (BaseRegNum != X86::RBP && BaseRegNum != X86::RSP) 1125 return false; 1126 1127 IsLoad = I.IsLoad; 1128 IsStore = I.IsStore; 1129 IsStoreFromReg = I.StoreFromReg; 1130 Size = I.DataSize; 1131 IsSimple = I.Simple; 1132 StackPtrReg = BaseRegNum; 1133 StackOffset = DispValue; 1134 IsIndexed = IndexRegNum != X86::NoRegister || SegRegNum != X86::NoRegister; 1135 1136 if (!I.Simple) 1137 return true; 1138 1139 // Retrieve related register in simple MOV from/to stack operations. 1140 unsigned MemOpOffset = static_cast<unsigned>(MemOpNo); 1141 if (I.IsLoad) { 1142 MCOperand RegOpnd = Inst.getOperand(0); 1143 assert(RegOpnd.isReg() && "unexpected destination operand"); 1144 Reg = RegOpnd.getReg(); 1145 } else if (I.IsStore) { 1146 MCOperand SrcOpnd = 1147 Inst.getOperand(MemOpOffset + X86::AddrSegmentReg + 1); 1148 if (I.StoreFromReg) { 1149 assert(SrcOpnd.isReg() && "unexpected source operand"); 1150 Reg = SrcOpnd.getReg(); 1151 } else { 1152 assert(SrcOpnd.isImm() && "unexpected source operand"); 1153 SrcImm = SrcOpnd.getImm(); 1154 } 1155 } 1156 1157 return true; 1158 } 1159 1160 void changeToPushOrPop(MCInst &Inst) const override { 1161 assert(!isPush(Inst) && !isPop(Inst)); 1162 1163 struct InstInfo { 1164 // Size in bytes that Inst loads from memory. 1165 uint8_t DataSize; 1166 bool IsLoad; 1167 bool StoreFromReg; 1168 }; 1169 1170 InstInfo I; 1171 switch (Inst.getOpcode()) { 1172 default: { 1173 llvm_unreachable("Unhandled opcode"); 1174 return; 1175 } 1176 case X86::MOV16rm: I = {2, true, false}; break; 1177 case X86::MOV32rm: I = {4, true, false}; break; 1178 case X86::MOV64rm: I = {8, true, false}; break; 1179 case X86::MOV16mr: I = {2, false, true}; break; 1180 case X86::MOV32mr: I = {4, false, true}; break; 1181 case X86::MOV64mr: I = {8, false, true}; break; 1182 case X86::MOV16mi: I = {2, false, false}; break; 1183 case X86::MOV32mi: I = {4, false, false}; break; 1184 } // end switch (Inst.getOpcode()) 1185 1186 unsigned BaseRegNum; 1187 int64_t ScaleValue; 1188 unsigned IndexRegNum; 1189 int64_t DispValue; 1190 unsigned SegRegNum; 1191 const MCExpr *DispExpr; 1192 if (!evaluateX86MemoryOperand(Inst, &BaseRegNum, &ScaleValue, &IndexRegNum, 1193 &DispValue, &SegRegNum, &DispExpr)) { 1194 llvm_unreachable("Evaluate failed"); 1195 return; 1196 } 1197 // Make sure it's a stack access 1198 if (BaseRegNum != X86::RBP && BaseRegNum != X86::RSP) { 1199 llvm_unreachable("Not a stack access"); 1200 return; 1201 } 1202 1203 unsigned MemOpOffset = getMemoryOperandNo(Inst); 1204 unsigned NewOpcode = 0; 1205 if (I.IsLoad) { 1206 switch (I.DataSize) { 1207 case 2: NewOpcode = X86::POP16r; break; 1208 case 4: NewOpcode = X86::POP32r; break; 1209 case 8: NewOpcode = X86::POP64r; break; 1210 default: 1211 llvm_unreachable("Unexpected size"); 1212 } 1213 unsigned RegOpndNum = Inst.getOperand(0).getReg(); 1214 Inst.clear(); 1215 Inst.setOpcode(NewOpcode); 1216 Inst.addOperand(MCOperand::createReg(RegOpndNum)); 1217 } else { 1218 MCOperand SrcOpnd = 1219 Inst.getOperand(MemOpOffset + X86::AddrSegmentReg + 1); 1220 if (I.StoreFromReg) { 1221 switch (I.DataSize) { 1222 case 2: NewOpcode = X86::PUSH16r; break; 1223 case 4: NewOpcode = X86::PUSH32r; break; 1224 case 8: NewOpcode = X86::PUSH64r; break; 1225 default: 1226 llvm_unreachable("Unexpected size"); 1227 } 1228 assert(SrcOpnd.isReg() && "Unexpected source operand"); 1229 unsigned RegOpndNum = SrcOpnd.getReg(); 1230 Inst.clear(); 1231 Inst.setOpcode(NewOpcode); 1232 Inst.addOperand(MCOperand::createReg(RegOpndNum)); 1233 } else { 1234 switch (I.DataSize) { 1235 case 2: NewOpcode = X86::PUSH16i8; break; 1236 case 4: NewOpcode = X86::PUSH32i8; break; 1237 case 8: NewOpcode = X86::PUSH64i32; break; 1238 default: 1239 llvm_unreachable("Unexpected size"); 1240 } 1241 assert(SrcOpnd.isImm() && "Unexpected source operand"); 1242 int64_t SrcImm = SrcOpnd.getImm(); 1243 Inst.clear(); 1244 Inst.setOpcode(NewOpcode); 1245 Inst.addOperand(MCOperand::createImm(SrcImm)); 1246 } 1247 } 1248 } 1249 1250 bool isStackAdjustment(const MCInst &Inst) const override { 1251 switch (Inst.getOpcode()) { 1252 default: 1253 return false; 1254 case X86::SUB64ri32: 1255 case X86::SUB64ri8: 1256 case X86::ADD64ri32: 1257 case X86::ADD64ri8: 1258 case X86::LEA64r: 1259 break; 1260 } 1261 1262 const MCInstrDesc &MCII = Info->get(Inst.getOpcode()); 1263 for (int I = 0, E = MCII.getNumDefs(); I != E; ++I) { 1264 const MCOperand &Operand = Inst.getOperand(I); 1265 if (Operand.isReg() && Operand.getReg() == X86::RSP) 1266 return true; 1267 } 1268 return false; 1269 } 1270 1271 bool 1272 evaluateStackOffsetExpr(const MCInst &Inst, int64_t &Output, 1273 std::pair<MCPhysReg, int64_t> Input1, 1274 std::pair<MCPhysReg, int64_t> Input2) const override { 1275 1276 auto getOperandVal = [&](MCPhysReg Reg) -> ErrorOr<int64_t> { 1277 if (Reg == Input1.first) 1278 return Input1.second; 1279 if (Reg == Input2.first) 1280 return Input2.second; 1281 return make_error_code(errc::result_out_of_range); 1282 }; 1283 1284 switch (Inst.getOpcode()) { 1285 default: 1286 return false; 1287 1288 case X86::SUB64ri32: 1289 case X86::SUB64ri8: 1290 if (!Inst.getOperand(2).isImm()) 1291 return false; 1292 if (ErrorOr<int64_t> InputVal = 1293 getOperandVal(Inst.getOperand(1).getReg())) 1294 Output = *InputVal - Inst.getOperand(2).getImm(); 1295 else 1296 return false; 1297 break; 1298 case X86::ADD64ri32: 1299 case X86::ADD64ri8: 1300 if (!Inst.getOperand(2).isImm()) 1301 return false; 1302 if (ErrorOr<int64_t> InputVal = 1303 getOperandVal(Inst.getOperand(1).getReg())) 1304 Output = *InputVal + Inst.getOperand(2).getImm(); 1305 else 1306 return false; 1307 break; 1308 case X86::ADD64i32: 1309 if (!Inst.getOperand(0).isImm()) 1310 return false; 1311 if (ErrorOr<int64_t> InputVal = getOperandVal(X86::RAX)) 1312 Output = *InputVal + Inst.getOperand(0).getImm(); 1313 else 1314 return false; 1315 break; 1316 1317 case X86::LEA64r: { 1318 unsigned BaseRegNum; 1319 int64_t ScaleValue; 1320 unsigned IndexRegNum; 1321 int64_t DispValue; 1322 unsigned SegRegNum; 1323 const MCExpr *DispExpr = nullptr; 1324 if (!evaluateX86MemoryOperand(Inst, &BaseRegNum, &ScaleValue, 1325 &IndexRegNum, &DispValue, &SegRegNum, 1326 &DispExpr)) 1327 return false; 1328 1329 if (BaseRegNum == X86::NoRegister || IndexRegNum != X86::NoRegister || 1330 SegRegNum != X86::NoRegister || DispExpr) 1331 return false; 1332 1333 if (ErrorOr<int64_t> InputVal = getOperandVal(BaseRegNum)) 1334 Output = *InputVal + DispValue; 1335 else 1336 return false; 1337 1338 break; 1339 } 1340 } 1341 return true; 1342 } 1343 1344 bool isRegToRegMove(const MCInst &Inst, MCPhysReg &From, 1345 MCPhysReg &To) const override { 1346 switch (Inst.getOpcode()) { 1347 default: 1348 return false; 1349 case X86::LEAVE: 1350 case X86::LEAVE64: 1351 To = getStackPointer(); 1352 From = getFramePointer(); 1353 return true; 1354 case X86::MOV64rr: 1355 To = Inst.getOperand(0).getReg(); 1356 From = Inst.getOperand(1).getReg(); 1357 return true; 1358 } 1359 } 1360 1361 MCPhysReg getStackPointer() const override { return X86::RSP; } 1362 MCPhysReg getFramePointer() const override { return X86::RBP; } 1363 MCPhysReg getFlagsReg() const override { return X86::EFLAGS; } 1364 1365 bool escapesVariable(const MCInst &Inst, 1366 bool HasFramePointer) const override { 1367 int MemOpNo = getMemoryOperandNo(Inst); 1368 const MCInstrDesc &MCII = Info->get(Inst.getOpcode()); 1369 const unsigned NumDefs = MCII.getNumDefs(); 1370 static BitVector SPBPAliases(BitVector(getAliases(X86::RSP)) |= 1371 getAliases(X86::RBP)); 1372 static BitVector SPAliases(getAliases(X86::RSP)); 1373 1374 // FIXME: PUSH can be technically a leak, but let's ignore this for now 1375 // because a lot of harmless prologue code will spill SP to the stack. 1376 // Unless push is clearly pushing an object address to the stack as 1377 // demonstrated by having a MemOp. 1378 bool IsPush = isPush(Inst); 1379 if (IsPush && MemOpNo == -1) 1380 return false; 1381 1382 // We use this to detect LEA (has memop but does not access mem) 1383 bool AccessMem = MCII.mayLoad() || MCII.mayStore(); 1384 bool DoesLeak = false; 1385 for (int I = 0, E = MCPlus::getNumPrimeOperands(Inst); I != E; ++I) { 1386 // Ignore if SP/BP is used to dereference memory -- that's fine 1387 if (MemOpNo != -1 && !IsPush && AccessMem && I >= MemOpNo && 1388 I <= MemOpNo + 5) 1389 continue; 1390 // Ignore if someone is writing to SP/BP 1391 if (I < static_cast<int>(NumDefs)) 1392 continue; 1393 1394 const MCOperand &Operand = Inst.getOperand(I); 1395 if (HasFramePointer && Operand.isReg() && SPBPAliases[Operand.getReg()]) { 1396 DoesLeak = true; 1397 break; 1398 } 1399 if (!HasFramePointer && Operand.isReg() && SPAliases[Operand.getReg()]) { 1400 DoesLeak = true; 1401 break; 1402 } 1403 } 1404 1405 // If potential leak, check if it is not just writing to itself/sp/bp 1406 if (DoesLeak) { 1407 for (int I = 0, E = NumDefs; I != E; ++I) { 1408 const MCOperand &Operand = Inst.getOperand(I); 1409 if (HasFramePointer && Operand.isReg() && 1410 SPBPAliases[Operand.getReg()]) { 1411 DoesLeak = false; 1412 break; 1413 } 1414 if (!HasFramePointer && Operand.isReg() && 1415 SPAliases[Operand.getReg()]) { 1416 DoesLeak = false; 1417 break; 1418 } 1419 } 1420 } 1421 return DoesLeak; 1422 } 1423 1424 bool addToImm(MCInst &Inst, int64_t &Amt, MCContext *Ctx) const override { 1425 unsigned ImmOpNo = -1U; 1426 int MemOpNo = getMemoryOperandNo(Inst); 1427 if (MemOpNo != -1) 1428 ImmOpNo = MemOpNo + X86::AddrDisp; 1429 else 1430 for (unsigned Index = 0; Index < MCPlus::getNumPrimeOperands(Inst); 1431 ++Index) 1432 if (Inst.getOperand(Index).isImm()) 1433 ImmOpNo = Index; 1434 if (ImmOpNo == -1U) 1435 return false; 1436 1437 MCOperand &Operand = Inst.getOperand(ImmOpNo); 1438 Amt += Operand.getImm(); 1439 Operand.setImm(Amt); 1440 // Check for the need for relaxation 1441 if (int64_t(Amt) == int64_t(int8_t(Amt))) 1442 return true; 1443 1444 // Relax instruction 1445 switch (Inst.getOpcode()) { 1446 case X86::SUB64ri8: 1447 Inst.setOpcode(X86::SUB64ri32); 1448 break; 1449 case X86::ADD64ri8: 1450 Inst.setOpcode(X86::ADD64ri32); 1451 break; 1452 default: 1453 // No need for relaxation 1454 break; 1455 } 1456 return true; 1457 } 1458 1459 /// TODO: this implementation currently works for the most common opcodes that 1460 /// load from memory. It can be extended to work with memory store opcodes as 1461 /// well as more memory load opcodes. 1462 bool replaceMemOperandWithImm(MCInst &Inst, StringRef ConstantData, 1463 uint64_t Offset) const override { 1464 enum CheckSignExt : uint8_t { 1465 NOCHECK = 0, 1466 CHECK8, 1467 CHECK32, 1468 }; 1469 1470 using CheckList = std::vector<std::pair<CheckSignExt, unsigned>>; 1471 struct InstInfo { 1472 // Size in bytes that Inst loads from memory. 1473 uint8_t DataSize; 1474 1475 // True when the target operand has to be duplicated because the opcode 1476 // expects a LHS operand. 1477 bool HasLHS; 1478 1479 // List of checks and corresponding opcodes to be used. We try to use the 1480 // smallest possible immediate value when various sizes are available, 1481 // hence we may need to check whether a larger constant fits in a smaller 1482 // immediate. 1483 CheckList Checks; 1484 }; 1485 1486 InstInfo I; 1487 1488 switch (Inst.getOpcode()) { 1489 default: { 1490 switch (getPopSize(Inst)) { 1491 case 2: I = {2, false, {{NOCHECK, X86::MOV16ri}}}; break; 1492 case 4: I = {4, false, {{NOCHECK, X86::MOV32ri}}}; break; 1493 case 8: I = {8, false, {{CHECK32, X86::MOV64ri32}, 1494 {NOCHECK, X86::MOV64rm}}}; break; 1495 default: return false; 1496 } 1497 break; 1498 } 1499 1500 // MOV 1501 case X86::MOV8rm: I = {1, false, {{NOCHECK, X86::MOV8ri}}}; break; 1502 case X86::MOV16rm: I = {2, false, {{NOCHECK, X86::MOV16ri}}}; break; 1503 case X86::MOV32rm: I = {4, false, {{NOCHECK, X86::MOV32ri}}}; break; 1504 case X86::MOV64rm: I = {8, false, {{CHECK32, X86::MOV64ri32}, 1505 {NOCHECK, X86::MOV64rm}}}; break; 1506 1507 // MOVZX 1508 case X86::MOVZX16rm8: I = {1, false, {{NOCHECK, X86::MOV16ri}}}; break; 1509 case X86::MOVZX32rm8: I = {1, false, {{NOCHECK, X86::MOV32ri}}}; break; 1510 case X86::MOVZX32rm16: I = {2, false, {{NOCHECK, X86::MOV32ri}}}; break; 1511 1512 // CMP 1513 case X86::CMP8rm: I = {1, false, {{NOCHECK, X86::CMP8ri}}}; break; 1514 case X86::CMP16rm: I = {2, false, {{CHECK8, X86::CMP16ri8}, 1515 {NOCHECK, X86::CMP16ri}}}; break; 1516 case X86::CMP32rm: I = {4, false, {{CHECK8, X86::CMP32ri8}, 1517 {NOCHECK, X86::CMP32ri}}}; break; 1518 case X86::CMP64rm: I = {8, false, {{CHECK8, X86::CMP64ri8}, 1519 {CHECK32, X86::CMP64ri32}, 1520 {NOCHECK, X86::CMP64rm}}}; break; 1521 1522 // TEST 1523 case X86::TEST8mr: I = {1, false, {{NOCHECK, X86::TEST8ri}}}; break; 1524 case X86::TEST16mr: I = {2, false, {{NOCHECK, X86::TEST16ri}}}; break; 1525 case X86::TEST32mr: I = {4, false, {{NOCHECK, X86::TEST32ri}}}; break; 1526 case X86::TEST64mr: I = {8, false, {{CHECK32, X86::TEST64ri32}, 1527 {NOCHECK, X86::TEST64mr}}}; break; 1528 1529 // ADD 1530 case X86::ADD8rm: I = {1, true, {{NOCHECK, X86::ADD8ri}}}; break; 1531 case X86::ADD16rm: I = {2, true, {{CHECK8, X86::ADD16ri8}, 1532 {NOCHECK, X86::ADD16ri}}}; break; 1533 case X86::ADD32rm: I = {4, true, {{CHECK8, X86::ADD32ri8}, 1534 {NOCHECK, X86::ADD32ri}}}; break; 1535 case X86::ADD64rm: I = {8, true, {{CHECK8, X86::ADD64ri8}, 1536 {CHECK32, X86::ADD64ri32}, 1537 {NOCHECK, X86::ADD64rm}}}; break; 1538 1539 // SUB 1540 case X86::SUB8rm: I = {1, true, {{NOCHECK, X86::SUB8ri}}}; break; 1541 case X86::SUB16rm: I = {2, true, {{CHECK8, X86::SUB16ri8}, 1542 {NOCHECK, X86::SUB16ri}}}; break; 1543 case X86::SUB32rm: I = {4, true, {{CHECK8, X86::SUB32ri8}, 1544 {NOCHECK, X86::SUB32ri}}}; break; 1545 case X86::SUB64rm: I = {8, true, {{CHECK8, X86::SUB64ri8}, 1546 {CHECK32, X86::SUB64ri32}, 1547 {NOCHECK, X86::SUB64rm}}}; break; 1548 1549 // AND 1550 case X86::AND8rm: I = {1, true, {{NOCHECK, X86::AND8ri}}}; break; 1551 case X86::AND16rm: I = {2, true, {{CHECK8, X86::AND16ri8}, 1552 {NOCHECK, X86::AND16ri}}}; break; 1553 case X86::AND32rm: I = {4, true, {{CHECK8, X86::AND32ri8}, 1554 {NOCHECK, X86::AND32ri}}}; break; 1555 case X86::AND64rm: I = {8, true, {{CHECK8, X86::AND64ri8}, 1556 {CHECK32, X86::AND64ri32}, 1557 {NOCHECK, X86::AND64rm}}}; break; 1558 1559 // OR 1560 case X86::OR8rm: I = {1, true, {{NOCHECK, X86::OR8ri}}}; break; 1561 case X86::OR16rm: I = {2, true, {{CHECK8, X86::OR16ri8}, 1562 {NOCHECK, X86::OR16ri}}}; break; 1563 case X86::OR32rm: I = {4, true, {{CHECK8, X86::OR32ri8}, 1564 {NOCHECK, X86::OR32ri}}}; break; 1565 case X86::OR64rm: I = {8, true, {{CHECK8, X86::OR64ri8}, 1566 {CHECK32, X86::OR64ri32}, 1567 {NOCHECK, X86::OR64rm}}}; break; 1568 1569 // XOR 1570 case X86::XOR8rm: I = {1, true, {{NOCHECK, X86::XOR8ri}}}; break; 1571 case X86::XOR16rm: I = {2, true, {{CHECK8, X86::XOR16ri8}, 1572 {NOCHECK, X86::XOR16ri}}}; break; 1573 case X86::XOR32rm: I = {4, true, {{CHECK8, X86::XOR32ri8}, 1574 {NOCHECK, X86::XOR32ri}}}; break; 1575 case X86::XOR64rm: I = {8, true, {{CHECK8, X86::XOR64ri8}, 1576 {CHECK32, X86::XOR64ri32}, 1577 {NOCHECK, X86::XOR64rm}}}; break; 1578 } 1579 1580 // Compute the immediate value. 1581 assert(Offset + I.DataSize <= ConstantData.size() && 1582 "invalid offset for given constant data"); 1583 int64_t ImmVal = 1584 DataExtractor(ConstantData, true, 8).getSigned(&Offset, I.DataSize); 1585 1586 // Compute the new opcode. 1587 unsigned NewOpcode = 0; 1588 for (const std::pair<CheckSignExt, unsigned> &Check : I.Checks) { 1589 NewOpcode = Check.second; 1590 if (Check.first == NOCHECK) 1591 break; 1592 if (Check.first == CHECK8 && isInt<8>(ImmVal)) 1593 break; 1594 if (Check.first == CHECK32 && isInt<32>(ImmVal)) 1595 break; 1596 } 1597 if (NewOpcode == Inst.getOpcode()) 1598 return false; 1599 1600 // Modify the instruction. 1601 MCOperand ImmOp = MCOperand::createImm(ImmVal); 1602 uint32_t TargetOpNum = 0; 1603 // Test instruction does not follow the regular pattern of putting the 1604 // memory reference of a load (5 MCOperands) last in the list of operands. 1605 // Since it is not modifying the register operand, it is not treated as 1606 // a destination operand and it is not the first operand as it is in the 1607 // other instructions we treat here. 1608 if (NewOpcode == X86::TEST8ri || NewOpcode == X86::TEST16ri || 1609 NewOpcode == X86::TEST32ri || NewOpcode == X86::TEST64ri32) 1610 TargetOpNum = getMemoryOperandNo(Inst) + X86::AddrNumOperands; 1611 1612 MCOperand TargetOp = Inst.getOperand(TargetOpNum); 1613 Inst.clear(); 1614 Inst.setOpcode(NewOpcode); 1615 Inst.addOperand(TargetOp); 1616 if (I.HasLHS) 1617 Inst.addOperand(TargetOp); 1618 Inst.addOperand(ImmOp); 1619 1620 return true; 1621 } 1622 1623 /// TODO: this implementation currently works for the most common opcodes that 1624 /// load from memory. It can be extended to work with memory store opcodes as 1625 /// well as more memory load opcodes. 1626 bool replaceMemOperandWithReg(MCInst &Inst, MCPhysReg RegNum) const override { 1627 unsigned NewOpcode; 1628 1629 switch (Inst.getOpcode()) { 1630 default: { 1631 switch (getPopSize(Inst)) { 1632 case 2: NewOpcode = X86::MOV16rr; break; 1633 case 4: NewOpcode = X86::MOV32rr; break; 1634 case 8: NewOpcode = X86::MOV64rr; break; 1635 default: return false; 1636 } 1637 break; 1638 } 1639 1640 // MOV 1641 case X86::MOV8rm: NewOpcode = X86::MOV8rr; break; 1642 case X86::MOV16rm: NewOpcode = X86::MOV16rr; break; 1643 case X86::MOV32rm: NewOpcode = X86::MOV32rr; break; 1644 case X86::MOV64rm: NewOpcode = X86::MOV64rr; break; 1645 } 1646 1647 // Modify the instruction. 1648 MCOperand RegOp = MCOperand::createReg(RegNum); 1649 MCOperand TargetOp = Inst.getOperand(0); 1650 Inst.clear(); 1651 Inst.setOpcode(NewOpcode); 1652 Inst.addOperand(TargetOp); 1653 Inst.addOperand(RegOp); 1654 1655 return true; 1656 } 1657 1658 bool isRedundantMove(const MCInst &Inst) const override { 1659 switch (Inst.getOpcode()) { 1660 default: 1661 return false; 1662 1663 // MOV 1664 case X86::MOV8rr: 1665 case X86::MOV16rr: 1666 case X86::MOV32rr: 1667 case X86::MOV64rr: 1668 break; 1669 } 1670 1671 assert(Inst.getOperand(0).isReg() && Inst.getOperand(1).isReg()); 1672 return Inst.getOperand(0).getReg() == Inst.getOperand(1).getReg(); 1673 } 1674 1675 bool requiresAlignedAddress(const MCInst &Inst) const override { 1676 const MCInstrDesc &Desc = Info->get(Inst.getOpcode()); 1677 for (unsigned int I = 0; I < Desc.getNumOperands(); ++I) { 1678 const MCOperandInfo &Op = Desc.OpInfo[I]; 1679 if (Op.OperandType != MCOI::OPERAND_REGISTER) 1680 continue; 1681 if (Op.RegClass == X86::VR128RegClassID) 1682 return true; 1683 } 1684 return false; 1685 } 1686 1687 bool convertJmpToTailCall(MCInst &Inst) override { 1688 if (isTailCall(Inst)) 1689 return false; 1690 1691 int NewOpcode; 1692 switch (Inst.getOpcode()) { 1693 default: 1694 return false; 1695 case X86::JMP_1: 1696 case X86::JMP_2: 1697 case X86::JMP_4: 1698 NewOpcode = X86::JMP_4; 1699 break; 1700 case X86::JMP16m: 1701 case X86::JMP32m: 1702 case X86::JMP64m: 1703 NewOpcode = X86::JMP32m; 1704 break; 1705 case X86::JMP16r: 1706 case X86::JMP32r: 1707 case X86::JMP64r: 1708 NewOpcode = X86::JMP32r; 1709 break; 1710 } 1711 1712 Inst.setOpcode(NewOpcode); 1713 setTailCall(Inst); 1714 return true; 1715 } 1716 1717 bool convertTailCallToJmp(MCInst &Inst) override { 1718 int NewOpcode; 1719 switch (Inst.getOpcode()) { 1720 default: 1721 return false; 1722 case X86::JMP_4: 1723 NewOpcode = X86::JMP_1; 1724 break; 1725 case X86::JMP32m: 1726 NewOpcode = X86::JMP64m; 1727 break; 1728 case X86::JMP32r: 1729 NewOpcode = X86::JMP64r; 1730 break; 1731 } 1732 1733 Inst.setOpcode(NewOpcode); 1734 removeAnnotation(Inst, MCPlus::MCAnnotation::kTailCall); 1735 clearOffset(Inst); 1736 return true; 1737 } 1738 1739 bool convertTailCallToCall(MCInst &Inst) override { 1740 int NewOpcode; 1741 switch (Inst.getOpcode()) { 1742 default: 1743 return false; 1744 case X86::JMP_4: 1745 NewOpcode = X86::CALL64pcrel32; 1746 break; 1747 case X86::JMP32m: 1748 NewOpcode = X86::CALL64m; 1749 break; 1750 case X86::JMP32r: 1751 NewOpcode = X86::CALL64r; 1752 break; 1753 } 1754 1755 Inst.setOpcode(NewOpcode); 1756 removeAnnotation(Inst, MCPlus::MCAnnotation::kTailCall); 1757 return true; 1758 } 1759 1760 bool convertCallToIndirectCall(MCInst &Inst, const MCSymbol *TargetLocation, 1761 MCContext *Ctx) override { 1762 assert((Inst.getOpcode() == X86::CALL64pcrel32 || 1763 (Inst.getOpcode() == X86::JMP_4 && isTailCall(Inst))) && 1764 "64-bit direct (tail) call instruction expected"); 1765 const auto NewOpcode = 1766 (Inst.getOpcode() == X86::CALL64pcrel32) ? X86::CALL64m : X86::JMP32m; 1767 Inst.setOpcode(NewOpcode); 1768 1769 // Replace the first operand and preserve auxiliary operands of 1770 // the instruction. 1771 Inst.erase(Inst.begin()); 1772 Inst.insert(Inst.begin(), 1773 MCOperand::createReg(X86::NoRegister)); // AddrSegmentReg 1774 Inst.insert(Inst.begin(), 1775 MCOperand::createExpr( // Displacement 1776 MCSymbolRefExpr::create(TargetLocation, 1777 MCSymbolRefExpr::VK_None, *Ctx))); 1778 Inst.insert(Inst.begin(), 1779 MCOperand::createReg(X86::NoRegister)); // IndexReg 1780 Inst.insert(Inst.begin(), 1781 MCOperand::createImm(1)); // ScaleAmt 1782 Inst.insert(Inst.begin(), 1783 MCOperand::createReg(X86::RIP)); // BaseReg 1784 1785 return true; 1786 } 1787 1788 void convertIndirectCallToLoad(MCInst &Inst, MCPhysReg Reg) override { 1789 bool IsTailCall = isTailCall(Inst); 1790 if (IsTailCall) 1791 removeAnnotation(Inst, MCPlus::MCAnnotation::kTailCall); 1792 if (Inst.getOpcode() == X86::CALL64m || 1793 (Inst.getOpcode() == X86::JMP32m && IsTailCall)) { 1794 Inst.setOpcode(X86::MOV64rm); 1795 Inst.insert(Inst.begin(), MCOperand::createReg(Reg)); 1796 return; 1797 } 1798 if (Inst.getOpcode() == X86::CALL64r || 1799 (Inst.getOpcode() == X86::JMP32r && IsTailCall)) { 1800 Inst.setOpcode(X86::MOV64rr); 1801 Inst.insert(Inst.begin(), MCOperand::createReg(Reg)); 1802 return; 1803 } 1804 LLVM_DEBUG(Inst.dump()); 1805 llvm_unreachable("not implemented"); 1806 } 1807 1808 bool shortenInstruction(MCInst &Inst, 1809 const MCSubtargetInfo &STI) const override { 1810 unsigned OldOpcode = Inst.getOpcode(); 1811 unsigned NewOpcode = OldOpcode; 1812 1813 int MemOpNo = getMemoryOperandNo(Inst); 1814 1815 // Check and remove redundant Address-Size override prefix. 1816 if (opts::X86StripRedundantAddressSize) { 1817 uint64_t TSFlags = Info->get(OldOpcode).TSFlags; 1818 unsigned Flags = Inst.getFlags(); 1819 1820 if (!X86_MC::needsAddressSizeOverride(Inst, STI, MemOpNo, TSFlags) && 1821 Flags & X86::IP_HAS_AD_SIZE) 1822 Inst.setFlags(Flags ^ X86::IP_HAS_AD_SIZE); 1823 } 1824 1825 // Check and remove EIZ/RIZ. These cases represent ambiguous cases where 1826 // SIB byte is present, but no index is used and modrm alone should have 1827 // been enough. Converting to NoRegister effectively removes the SIB byte. 1828 if (MemOpNo >= 0) { 1829 MCOperand &IndexOp = 1830 Inst.getOperand(static_cast<unsigned>(MemOpNo) + X86::AddrIndexReg); 1831 if (IndexOp.getReg() == X86::EIZ || IndexOp.getReg() == X86::RIZ) 1832 IndexOp = MCOperand::createReg(X86::NoRegister); 1833 } 1834 1835 if (isBranch(Inst)) { 1836 NewOpcode = getShortBranchOpcode(OldOpcode); 1837 } else if (OldOpcode == X86::MOV64ri) { 1838 if (Inst.getOperand(MCPlus::getNumPrimeOperands(Inst) - 1).isImm()) { 1839 const int64_t Imm = 1840 Inst.getOperand(MCPlus::getNumPrimeOperands(Inst) - 1).getImm(); 1841 if (int64_t(Imm) == int64_t(int32_t(Imm))) 1842 NewOpcode = X86::MOV64ri32; 1843 } 1844 } else { 1845 // If it's arithmetic instruction check if signed operand fits in 1 byte. 1846 const unsigned ShortOpcode = getShortArithOpcode(OldOpcode); 1847 if (ShortOpcode != OldOpcode && 1848 Inst.getOperand(MCPlus::getNumPrimeOperands(Inst) - 1).isImm()) { 1849 int64_t Imm = 1850 Inst.getOperand(MCPlus::getNumPrimeOperands(Inst) - 1).getImm(); 1851 if (int64_t(Imm) == int64_t(int8_t(Imm))) 1852 NewOpcode = ShortOpcode; 1853 } 1854 } 1855 1856 if (NewOpcode == OldOpcode) 1857 return false; 1858 1859 Inst.setOpcode(NewOpcode); 1860 return true; 1861 } 1862 1863 bool 1864 convertMoveToConditionalMove(MCInst &Inst, unsigned CC, bool AllowStackMemOp, 1865 bool AllowBasePtrStackMemOp) const override { 1866 // - Register-register moves are OK 1867 // - Stores are filtered out by opcode (no store CMOV) 1868 // - Non-stack loads are prohibited (generally unsafe) 1869 // - Stack loads are OK if AllowStackMemOp is true 1870 // - Stack loads with RBP are OK if AllowBasePtrStackMemOp is true 1871 if (isLoad(Inst)) { 1872 // If stack memory operands are not allowed, no loads are allowed 1873 if (!AllowStackMemOp) 1874 return false; 1875 1876 // If stack memory operands are allowed, check if it's a load from stack 1877 bool IsLoad, IsStore, IsStoreFromReg, IsSimple, IsIndexed; 1878 MCPhysReg Reg; 1879 int32_t SrcImm; 1880 uint16_t StackPtrReg; 1881 int64_t StackOffset; 1882 uint8_t Size; 1883 bool IsStackAccess = 1884 isStackAccess(Inst, IsLoad, IsStore, IsStoreFromReg, Reg, SrcImm, 1885 StackPtrReg, StackOffset, Size, IsSimple, IsIndexed); 1886 // Prohibit non-stack-based loads 1887 if (!IsStackAccess) 1888 return false; 1889 // If stack memory operands are allowed, check if it's RBP-based 1890 if (!AllowBasePtrStackMemOp && 1891 RegInfo->isSubRegisterEq(X86::RBP, StackPtrReg)) 1892 return false; 1893 } 1894 1895 unsigned NewOpcode = 0; 1896 switch (Inst.getOpcode()) { 1897 case X86::MOV16rr: 1898 NewOpcode = X86::CMOV16rr; 1899 break; 1900 case X86::MOV16rm: 1901 NewOpcode = X86::CMOV16rm; 1902 break; 1903 case X86::MOV32rr: 1904 NewOpcode = X86::CMOV32rr; 1905 break; 1906 case X86::MOV32rm: 1907 NewOpcode = X86::CMOV32rm; 1908 break; 1909 case X86::MOV64rr: 1910 NewOpcode = X86::CMOV64rr; 1911 break; 1912 case X86::MOV64rm: 1913 NewOpcode = X86::CMOV64rm; 1914 break; 1915 default: 1916 return false; 1917 } 1918 Inst.setOpcode(NewOpcode); 1919 // Insert CC at the end of prime operands, before annotations 1920 Inst.insert(Inst.begin() + MCPlus::getNumPrimeOperands(Inst), 1921 MCOperand::createImm(CC)); 1922 // CMOV is a 3-operand MCInst, so duplicate the destination as src1 1923 Inst.insert(Inst.begin(), Inst.getOperand(0)); 1924 return true; 1925 } 1926 1927 bool lowerTailCall(MCInst &Inst) override { 1928 if (Inst.getOpcode() == X86::JMP_4 && isTailCall(Inst)) { 1929 Inst.setOpcode(X86::JMP_1); 1930 removeAnnotation(Inst, MCPlus::MCAnnotation::kTailCall); 1931 return true; 1932 } 1933 return false; 1934 } 1935 1936 const MCSymbol *getTargetSymbol(const MCInst &Inst, 1937 unsigned OpNum = 0) const override { 1938 if (OpNum >= MCPlus::getNumPrimeOperands(Inst)) 1939 return nullptr; 1940 1941 const MCOperand &Op = Inst.getOperand(OpNum); 1942 if (!Op.isExpr()) 1943 return nullptr; 1944 1945 auto *SymExpr = dyn_cast<MCSymbolRefExpr>(Op.getExpr()); 1946 if (!SymExpr || SymExpr->getKind() != MCSymbolRefExpr::VK_None) 1947 return nullptr; 1948 1949 return &SymExpr->getSymbol(); 1950 } 1951 1952 // This is the same as the base class, but since we are overriding one of 1953 // getTargetSymbol's signatures above, we need to override all of them. 1954 const MCSymbol *getTargetSymbol(const MCExpr *Expr) const override { 1955 return &cast<const MCSymbolRefExpr>(Expr)->getSymbol(); 1956 } 1957 1958 bool analyzeBranch(InstructionIterator Begin, InstructionIterator End, 1959 const MCSymbol *&TBB, const MCSymbol *&FBB, 1960 MCInst *&CondBranch, 1961 MCInst *&UncondBranch) const override { 1962 auto I = End; 1963 1964 // Bottom-up analysis 1965 while (I != Begin) { 1966 --I; 1967 1968 // Ignore nops and CFIs 1969 if (isPseudo(*I)) 1970 continue; 1971 1972 // Stop when we find the first non-terminator 1973 if (!isTerminator(*I)) 1974 break; 1975 1976 if (!isBranch(*I)) 1977 break; 1978 1979 // Handle unconditional branches. 1980 if ((I->getOpcode() == X86::JMP_1 || I->getOpcode() == X86::JMP_2 || 1981 I->getOpcode() == X86::JMP_4) && 1982 !isTailCall(*I)) { 1983 // If any code was seen after this unconditional branch, we've seen 1984 // unreachable code. Ignore them. 1985 CondBranch = nullptr; 1986 UncondBranch = &*I; 1987 const MCSymbol *Sym = getTargetSymbol(*I); 1988 assert(Sym != nullptr && 1989 "Couldn't extract BB symbol from jump operand"); 1990 TBB = Sym; 1991 continue; 1992 } 1993 1994 // Handle conditional branches and ignore indirect branches 1995 if (!isUnsupportedBranch(I->getOpcode()) && 1996 getCondCode(*I) == X86::COND_INVALID) { 1997 // Indirect branch 1998 return false; 1999 } 2000 2001 if (CondBranch == nullptr) { 2002 const MCSymbol *TargetBB = getTargetSymbol(*I); 2003 if (TargetBB == nullptr) { 2004 // Unrecognized branch target 2005 return false; 2006 } 2007 FBB = TBB; 2008 TBB = TargetBB; 2009 CondBranch = &*I; 2010 continue; 2011 } 2012 2013 llvm_unreachable("multiple conditional branches in one BB"); 2014 } 2015 return true; 2016 } 2017 2018 template <typename Itr> 2019 std::pair<IndirectBranchType, MCInst *> 2020 analyzePICJumpTable(Itr II, Itr IE, MCPhysReg R1, MCPhysReg R2) const { 2021 // Analyze PIC-style jump table code template: 2022 // 2023 // lea PIC_JUMP_TABLE(%rip), {%r1|%r2} <- MemLocInstr 2024 // mov ({%r1|%r2}, %index, 4), {%r2|%r1} 2025 // add %r2, %r1 2026 // jmp *%r1 2027 // 2028 // (with any irrelevant instructions in-between) 2029 // 2030 // When we call this helper we've already determined %r1 and %r2, and 2031 // reverse instruction iterator \p II is pointing to the ADD instruction. 2032 // 2033 // PIC jump table looks like following: 2034 // 2035 // JT: ---------- 2036 // E1:| L1 - JT | 2037 // |----------| 2038 // E2:| L2 - JT | 2039 // |----------| 2040 // | | 2041 // ...... 2042 // En:| Ln - JT | 2043 // ---------- 2044 // 2045 // Where L1, L2, ..., Ln represent labels in the function. 2046 // 2047 // The actual relocations in the table will be of the form: 2048 // 2049 // Ln - JT 2050 // = (Ln - En) + (En - JT) 2051 // = R_X86_64_PC32(Ln) + En - JT 2052 // = R_X86_64_PC32(Ln + offsetof(En)) 2053 // 2054 LLVM_DEBUG(dbgs() << "Checking for PIC jump table\n"); 2055 MCInst *MemLocInstr = nullptr; 2056 const MCInst *MovInstr = nullptr; 2057 while (++II != IE) { 2058 MCInst &Instr = *II; 2059 const MCInstrDesc &InstrDesc = Info->get(Instr.getOpcode()); 2060 if (!InstrDesc.hasDefOfPhysReg(Instr, R1, *RegInfo) && 2061 !InstrDesc.hasDefOfPhysReg(Instr, R2, *RegInfo)) { 2062 // Ignore instructions that don't affect R1, R2 registers. 2063 continue; 2064 } 2065 if (!MovInstr) { 2066 // Expect to see MOV instruction. 2067 if (!isMOVSX64rm32(Instr)) { 2068 LLVM_DEBUG(dbgs() << "MOV instruction expected.\n"); 2069 break; 2070 } 2071 2072 // Check if it's setting %r1 or %r2. In canonical form it sets %r2. 2073 // If it sets %r1 - rename the registers so we have to only check 2074 // a single form. 2075 unsigned MovDestReg = Instr.getOperand(0).getReg(); 2076 if (MovDestReg != R2) 2077 std::swap(R1, R2); 2078 if (MovDestReg != R2) { 2079 LLVM_DEBUG(dbgs() << "MOV instruction expected to set %r2\n"); 2080 break; 2081 } 2082 2083 // Verify operands for MOV. 2084 unsigned BaseRegNum; 2085 int64_t ScaleValue; 2086 unsigned IndexRegNum; 2087 int64_t DispValue; 2088 unsigned SegRegNum; 2089 if (!evaluateX86MemoryOperand(Instr, &BaseRegNum, &ScaleValue, 2090 &IndexRegNum, &DispValue, &SegRegNum)) 2091 break; 2092 if (BaseRegNum != R1 || ScaleValue != 4 || 2093 IndexRegNum == X86::NoRegister || DispValue != 0 || 2094 SegRegNum != X86::NoRegister) 2095 break; 2096 MovInstr = &Instr; 2097 } else { 2098 if (!InstrDesc.hasDefOfPhysReg(Instr, R1, *RegInfo)) 2099 continue; 2100 if (!isLEA64r(Instr)) { 2101 LLVM_DEBUG(dbgs() << "LEA instruction expected\n"); 2102 break; 2103 } 2104 if (Instr.getOperand(0).getReg() != R1) { 2105 LLVM_DEBUG(dbgs() << "LEA instruction expected to set %r1\n"); 2106 break; 2107 } 2108 2109 // Verify operands for LEA. 2110 unsigned BaseRegNum; 2111 int64_t ScaleValue; 2112 unsigned IndexRegNum; 2113 const MCExpr *DispExpr = nullptr; 2114 int64_t DispValue; 2115 unsigned SegRegNum; 2116 if (!evaluateX86MemoryOperand(Instr, &BaseRegNum, &ScaleValue, 2117 &IndexRegNum, &DispValue, &SegRegNum, 2118 &DispExpr)) 2119 break; 2120 if (BaseRegNum != RegInfo->getProgramCounter() || 2121 IndexRegNum != X86::NoRegister || SegRegNum != X86::NoRegister || 2122 DispExpr == nullptr) 2123 break; 2124 MemLocInstr = &Instr; 2125 break; 2126 } 2127 } 2128 2129 if (!MemLocInstr) 2130 return std::make_pair(IndirectBranchType::UNKNOWN, nullptr); 2131 2132 LLVM_DEBUG(dbgs() << "checking potential PIC jump table\n"); 2133 return std::make_pair(IndirectBranchType::POSSIBLE_PIC_JUMP_TABLE, 2134 MemLocInstr); 2135 } 2136 2137 IndirectBranchType analyzeIndirectBranch( 2138 MCInst &Instruction, InstructionIterator Begin, InstructionIterator End, 2139 const unsigned PtrSize, MCInst *&MemLocInstrOut, unsigned &BaseRegNumOut, 2140 unsigned &IndexRegNumOut, int64_t &DispValueOut, 2141 const MCExpr *&DispExprOut, MCInst *&PCRelBaseOut) const override { 2142 // Try to find a (base) memory location from where the address for 2143 // the indirect branch is loaded. For X86-64 the memory will be specified 2144 // in the following format: 2145 // 2146 // {%rip}/{%basereg} + Imm + IndexReg * Scale 2147 // 2148 // We are interested in the cases where Scale == sizeof(uintptr_t) and 2149 // the contents of the memory are presumably an array of pointers to code. 2150 // 2151 // Normal jump table: 2152 // 2153 // jmp *(JUMP_TABLE, %index, Scale) <- MemLocInstr 2154 // 2155 // or 2156 // 2157 // mov (JUMP_TABLE, %index, Scale), %r1 <- MemLocInstr 2158 // ... 2159 // jmp %r1 2160 // 2161 // We handle PIC-style jump tables separately. 2162 // 2163 MemLocInstrOut = nullptr; 2164 BaseRegNumOut = X86::NoRegister; 2165 IndexRegNumOut = X86::NoRegister; 2166 DispValueOut = 0; 2167 DispExprOut = nullptr; 2168 2169 std::reverse_iterator<InstructionIterator> II(End); 2170 std::reverse_iterator<InstructionIterator> IE(Begin); 2171 2172 IndirectBranchType Type = IndirectBranchType::UNKNOWN; 2173 2174 // An instruction referencing memory used by jump instruction (directly or 2175 // via register). This location could be an array of function pointers 2176 // in case of indirect tail call, or a jump table. 2177 MCInst *MemLocInstr = nullptr; 2178 2179 if (MCPlus::getNumPrimeOperands(Instruction) == 1) { 2180 // If the indirect jump is on register - try to detect if the 2181 // register value is loaded from a memory location. 2182 assert(Instruction.getOperand(0).isReg() && "register operand expected"); 2183 const unsigned R1 = Instruction.getOperand(0).getReg(); 2184 // Check if one of the previous instructions defines the jump-on register. 2185 for (auto PrevII = II; PrevII != IE; ++PrevII) { 2186 MCInst &PrevInstr = *PrevII; 2187 const MCInstrDesc &PrevInstrDesc = Info->get(PrevInstr.getOpcode()); 2188 2189 if (!PrevInstrDesc.hasDefOfPhysReg(PrevInstr, R1, *RegInfo)) 2190 continue; 2191 2192 if (isMoveMem2Reg(PrevInstr)) { 2193 MemLocInstr = &PrevInstr; 2194 break; 2195 } 2196 if (isADD64rr(PrevInstr)) { 2197 unsigned R2 = PrevInstr.getOperand(2).getReg(); 2198 if (R1 == R2) 2199 return IndirectBranchType::UNKNOWN; 2200 std::tie(Type, MemLocInstr) = analyzePICJumpTable(PrevII, IE, R1, R2); 2201 break; 2202 } 2203 return IndirectBranchType::UNKNOWN; 2204 } 2205 if (!MemLocInstr) { 2206 // No definition seen for the register in this function so far. Could be 2207 // an input parameter - which means it is an external code reference. 2208 // It also could be that the definition happens to be in the code that 2209 // we haven't processed yet. Since we have to be conservative, return 2210 // as UNKNOWN case. 2211 return IndirectBranchType::UNKNOWN; 2212 } 2213 } else { 2214 MemLocInstr = &Instruction; 2215 } 2216 2217 const MCRegister RIPRegister = RegInfo->getProgramCounter(); 2218 2219 // Analyze the memory location. 2220 unsigned BaseRegNum, IndexRegNum, SegRegNum; 2221 int64_t ScaleValue, DispValue; 2222 const MCExpr *DispExpr; 2223 2224 if (!evaluateX86MemoryOperand(*MemLocInstr, &BaseRegNum, &ScaleValue, 2225 &IndexRegNum, &DispValue, &SegRegNum, 2226 &DispExpr)) 2227 return IndirectBranchType::UNKNOWN; 2228 2229 BaseRegNumOut = BaseRegNum; 2230 IndexRegNumOut = IndexRegNum; 2231 DispValueOut = DispValue; 2232 DispExprOut = DispExpr; 2233 2234 if ((BaseRegNum != X86::NoRegister && BaseRegNum != RIPRegister) || 2235 SegRegNum != X86::NoRegister) 2236 return IndirectBranchType::UNKNOWN; 2237 2238 if (MemLocInstr == &Instruction && 2239 (!ScaleValue || IndexRegNum == X86::NoRegister)) { 2240 MemLocInstrOut = MemLocInstr; 2241 return IndirectBranchType::POSSIBLE_FIXED_BRANCH; 2242 } 2243 2244 if (Type == IndirectBranchType::POSSIBLE_PIC_JUMP_TABLE && 2245 (ScaleValue != 1 || BaseRegNum != RIPRegister)) 2246 return IndirectBranchType::UNKNOWN; 2247 2248 if (Type != IndirectBranchType::POSSIBLE_PIC_JUMP_TABLE && 2249 ScaleValue != PtrSize) 2250 return IndirectBranchType::UNKNOWN; 2251 2252 MemLocInstrOut = MemLocInstr; 2253 2254 return Type; 2255 } 2256 2257 /// Analyze a callsite to see if it could be a virtual method call. This only 2258 /// checks to see if the overall pattern is satisfied, it does not guarantee 2259 /// that the callsite is a true virtual method call. 2260 /// The format of virtual method calls that are recognized is one of the 2261 /// following: 2262 /// 2263 /// Form 1: (found in debug code) 2264 /// add METHOD_OFFSET, %VtableReg 2265 /// mov (%VtableReg), %MethodReg 2266 /// ... 2267 /// call or jmp *%MethodReg 2268 /// 2269 /// Form 2: 2270 /// mov METHOD_OFFSET(%VtableReg), %MethodReg 2271 /// ... 2272 /// call or jmp *%MethodReg 2273 /// 2274 /// Form 3: 2275 /// ... 2276 /// call or jmp *METHOD_OFFSET(%VtableReg) 2277 /// 2278 bool analyzeVirtualMethodCall(InstructionIterator ForwardBegin, 2279 InstructionIterator ForwardEnd, 2280 std::vector<MCInst *> &MethodFetchInsns, 2281 unsigned &VtableRegNum, unsigned &MethodRegNum, 2282 uint64_t &MethodOffset) const override { 2283 VtableRegNum = X86::NoRegister; 2284 MethodRegNum = X86::NoRegister; 2285 MethodOffset = 0; 2286 2287 std::reverse_iterator<InstructionIterator> Itr(ForwardEnd); 2288 std::reverse_iterator<InstructionIterator> End(ForwardBegin); 2289 2290 MCInst &CallInst = *Itr++; 2291 assert(isIndirectBranch(CallInst) || isCall(CallInst)); 2292 2293 unsigned BaseReg, IndexReg, SegmentReg; 2294 int64_t Scale, Disp; 2295 const MCExpr *DispExpr; 2296 2297 // The call can just be jmp offset(reg) 2298 if (evaluateX86MemoryOperand(CallInst, &BaseReg, &Scale, &IndexReg, &Disp, 2299 &SegmentReg, &DispExpr)) { 2300 if (!DispExpr && BaseReg != X86::RIP && BaseReg != X86::RBP && 2301 BaseReg != X86::NoRegister) { 2302 MethodRegNum = BaseReg; 2303 if (Scale == 1 && IndexReg == X86::NoRegister && 2304 SegmentReg == X86::NoRegister) { 2305 VtableRegNum = MethodRegNum; 2306 MethodOffset = Disp; 2307 MethodFetchInsns.push_back(&CallInst); 2308 return true; 2309 } 2310 } 2311 return false; 2312 } 2313 if (CallInst.getOperand(0).isReg()) 2314 MethodRegNum = CallInst.getOperand(0).getReg(); 2315 else 2316 return false; 2317 2318 if (MethodRegNum == X86::RIP || MethodRegNum == X86::RBP) { 2319 VtableRegNum = X86::NoRegister; 2320 MethodRegNum = X86::NoRegister; 2321 return false; 2322 } 2323 2324 // find load from vtable, this may or may not include the method offset 2325 while (Itr != End) { 2326 MCInst &CurInst = *Itr++; 2327 const MCInstrDesc &Desc = Info->get(CurInst.getOpcode()); 2328 if (Desc.hasDefOfPhysReg(CurInst, MethodRegNum, *RegInfo)) { 2329 if (isLoad(CurInst) && 2330 evaluateX86MemoryOperand(CurInst, &BaseReg, &Scale, &IndexReg, 2331 &Disp, &SegmentReg, &DispExpr)) { 2332 if (!DispExpr && Scale == 1 && BaseReg != X86::RIP && 2333 BaseReg != X86::RBP && BaseReg != X86::NoRegister && 2334 IndexReg == X86::NoRegister && SegmentReg == X86::NoRegister && 2335 BaseReg != X86::RIP) { 2336 VtableRegNum = BaseReg; 2337 MethodOffset = Disp; 2338 MethodFetchInsns.push_back(&CurInst); 2339 if (MethodOffset != 0) 2340 return true; 2341 break; 2342 } 2343 } 2344 return false; 2345 } 2346 } 2347 2348 if (!VtableRegNum) 2349 return false; 2350 2351 // look for any adds affecting the method register. 2352 while (Itr != End) { 2353 MCInst &CurInst = *Itr++; 2354 const MCInstrDesc &Desc = Info->get(CurInst.getOpcode()); 2355 if (Desc.hasDefOfPhysReg(CurInst, VtableRegNum, *RegInfo)) { 2356 if (isADDri(CurInst)) { 2357 assert(!MethodOffset); 2358 MethodOffset = CurInst.getOperand(2).getImm(); 2359 MethodFetchInsns.insert(MethodFetchInsns.begin(), &CurInst); 2360 break; 2361 } 2362 } 2363 } 2364 2365 return true; 2366 } 2367 2368 bool createStackPointerIncrement(MCInst &Inst, int Size, 2369 bool NoFlagsClobber) const override { 2370 if (NoFlagsClobber) { 2371 Inst.setOpcode(X86::LEA64r); 2372 Inst.clear(); 2373 Inst.addOperand(MCOperand::createReg(X86::RSP)); 2374 Inst.addOperand(MCOperand::createReg(X86::RSP)); // BaseReg 2375 Inst.addOperand(MCOperand::createImm(1)); // ScaleAmt 2376 Inst.addOperand(MCOperand::createReg(X86::NoRegister)); // IndexReg 2377 Inst.addOperand(MCOperand::createImm(-Size)); // Displacement 2378 Inst.addOperand(MCOperand::createReg(X86::NoRegister)); // AddrSegmentReg 2379 return true; 2380 } 2381 Inst.setOpcode(X86::SUB64ri8); 2382 Inst.clear(); 2383 Inst.addOperand(MCOperand::createReg(X86::RSP)); 2384 Inst.addOperand(MCOperand::createReg(X86::RSP)); 2385 Inst.addOperand(MCOperand::createImm(Size)); 2386 return true; 2387 } 2388 2389 bool createStackPointerDecrement(MCInst &Inst, int Size, 2390 bool NoFlagsClobber) const override { 2391 if (NoFlagsClobber) { 2392 Inst.setOpcode(X86::LEA64r); 2393 Inst.clear(); 2394 Inst.addOperand(MCOperand::createReg(X86::RSP)); 2395 Inst.addOperand(MCOperand::createReg(X86::RSP)); // BaseReg 2396 Inst.addOperand(MCOperand::createImm(1)); // ScaleAmt 2397 Inst.addOperand(MCOperand::createReg(X86::NoRegister)); // IndexReg 2398 Inst.addOperand(MCOperand::createImm(Size)); // Displacement 2399 Inst.addOperand(MCOperand::createReg(X86::NoRegister)); // AddrSegmentReg 2400 return true; 2401 } 2402 Inst.setOpcode(X86::ADD64ri8); 2403 Inst.clear(); 2404 Inst.addOperand(MCOperand::createReg(X86::RSP)); 2405 Inst.addOperand(MCOperand::createReg(X86::RSP)); 2406 Inst.addOperand(MCOperand::createImm(Size)); 2407 return true; 2408 } 2409 2410 bool createSaveToStack(MCInst &Inst, const MCPhysReg &StackReg, int Offset, 2411 const MCPhysReg &SrcReg, int Size) const override { 2412 unsigned NewOpcode; 2413 switch (Size) { 2414 default: 2415 return false; 2416 case 2: NewOpcode = X86::MOV16mr; break; 2417 case 4: NewOpcode = X86::MOV32mr; break; 2418 case 8: NewOpcode = X86::MOV64mr; break; 2419 } 2420 Inst.setOpcode(NewOpcode); 2421 Inst.clear(); 2422 Inst.addOperand(MCOperand::createReg(StackReg)); // BaseReg 2423 Inst.addOperand(MCOperand::createImm(1)); // ScaleAmt 2424 Inst.addOperand(MCOperand::createReg(X86::NoRegister)); // IndexReg 2425 Inst.addOperand(MCOperand::createImm(Offset)); // Displacement 2426 Inst.addOperand(MCOperand::createReg(X86::NoRegister)); // AddrSegmentReg 2427 Inst.addOperand(MCOperand::createReg(SrcReg)); 2428 return true; 2429 } 2430 2431 bool createRestoreFromStack(MCInst &Inst, const MCPhysReg &StackReg, 2432 int Offset, const MCPhysReg &DstReg, 2433 int Size) const override { 2434 return createLoad(Inst, StackReg, /*Scale=*/1, /*IndexReg=*/X86::NoRegister, 2435 Offset, nullptr, /*AddrSegmentReg=*/X86::NoRegister, 2436 DstReg, Size); 2437 } 2438 2439 bool createLoad(MCInst &Inst, const MCPhysReg &BaseReg, int64_t Scale, 2440 const MCPhysReg &IndexReg, int64_t Offset, 2441 const MCExpr *OffsetExpr, const MCPhysReg &AddrSegmentReg, 2442 const MCPhysReg &DstReg, int Size) const override { 2443 unsigned NewOpcode; 2444 switch (Size) { 2445 default: 2446 return false; 2447 case 2: NewOpcode = X86::MOV16rm; break; 2448 case 4: NewOpcode = X86::MOV32rm; break; 2449 case 8: NewOpcode = X86::MOV64rm; break; 2450 } 2451 Inst.setOpcode(NewOpcode); 2452 Inst.clear(); 2453 Inst.addOperand(MCOperand::createReg(DstReg)); 2454 Inst.addOperand(MCOperand::createReg(BaseReg)); 2455 Inst.addOperand(MCOperand::createImm(Scale)); 2456 Inst.addOperand(MCOperand::createReg(IndexReg)); 2457 if (OffsetExpr) 2458 Inst.addOperand(MCOperand::createExpr(OffsetExpr)); // Displacement 2459 else 2460 Inst.addOperand(MCOperand::createImm(Offset)); // Displacement 2461 Inst.addOperand(MCOperand::createReg(AddrSegmentReg)); // AddrSegmentReg 2462 return true; 2463 } 2464 2465 void createLoadImmediate(MCInst &Inst, const MCPhysReg Dest, 2466 uint32_t Imm) const override { 2467 Inst.setOpcode(X86::MOV64ri32); 2468 Inst.clear(); 2469 Inst.addOperand(MCOperand::createReg(Dest)); 2470 Inst.addOperand(MCOperand::createImm(Imm)); 2471 } 2472 2473 bool createIncMemory(MCInst &Inst, const MCSymbol *Target, 2474 MCContext *Ctx) const override { 2475 2476 Inst.setOpcode(X86::LOCK_INC64m); 2477 Inst.clear(); 2478 Inst.addOperand(MCOperand::createReg(X86::RIP)); // BaseReg 2479 Inst.addOperand(MCOperand::createImm(1)); // ScaleAmt 2480 Inst.addOperand(MCOperand::createReg(X86::NoRegister)); // IndexReg 2481 2482 Inst.addOperand(MCOperand::createExpr( 2483 MCSymbolRefExpr::create(Target, MCSymbolRefExpr::VK_None, 2484 *Ctx))); // Displacement 2485 Inst.addOperand(MCOperand::createReg(X86::NoRegister)); // AddrSegmentReg 2486 return true; 2487 } 2488 2489 bool createIJmp32Frag(SmallVectorImpl<MCInst> &Insts, 2490 const MCOperand &BaseReg, const MCOperand &Scale, 2491 const MCOperand &IndexReg, const MCOperand &Offset, 2492 const MCOperand &TmpReg) const override { 2493 // The code fragment we emit here is: 2494 // 2495 // mov32 (%base, %index, scale), %tmpreg 2496 // ijmp *(%tmpreg) 2497 // 2498 MCInst IJmp; 2499 IJmp.setOpcode(X86::JMP64r); 2500 IJmp.addOperand(TmpReg); 2501 2502 MCInst Load; 2503 Load.setOpcode(X86::MOV32rm); 2504 Load.addOperand(TmpReg); 2505 Load.addOperand(BaseReg); 2506 Load.addOperand(Scale); 2507 Load.addOperand(IndexReg); 2508 Load.addOperand(Offset); 2509 Load.addOperand(MCOperand::createReg(X86::NoRegister)); 2510 2511 Insts.push_back(Load); 2512 Insts.push_back(IJmp); 2513 return true; 2514 } 2515 2516 bool createNoop(MCInst &Inst) const override { 2517 Inst.setOpcode(X86::NOOP); 2518 return true; 2519 } 2520 2521 bool createReturn(MCInst &Inst) const override { 2522 Inst.setOpcode(X86::RET64); 2523 return true; 2524 } 2525 2526 InstructionListType createInlineMemcpy(bool ReturnEnd) const override { 2527 InstructionListType Code; 2528 if (ReturnEnd) 2529 Code.emplace_back(MCInstBuilder(X86::LEA64r) 2530 .addReg(X86::RAX) 2531 .addReg(X86::RDI) 2532 .addImm(1) 2533 .addReg(X86::RDX) 2534 .addImm(0) 2535 .addReg(X86::NoRegister)); 2536 else 2537 Code.emplace_back(MCInstBuilder(X86::MOV64rr) 2538 .addReg(X86::RAX) 2539 .addReg(X86::RDI)); 2540 2541 Code.emplace_back(MCInstBuilder(X86::MOV32rr) 2542 .addReg(X86::ECX) 2543 .addReg(X86::EDX)); 2544 Code.emplace_back(MCInstBuilder(X86::REP_MOVSB_64)); 2545 2546 return Code; 2547 } 2548 2549 InstructionListType createOneByteMemcpy() const override { 2550 InstructionListType Code; 2551 Code.emplace_back(MCInstBuilder(X86::MOV8rm) 2552 .addReg(X86::CL) 2553 .addReg(X86::RSI) 2554 .addImm(0) 2555 .addReg(X86::NoRegister) 2556 .addImm(0) 2557 .addReg(X86::NoRegister)); 2558 Code.emplace_back(MCInstBuilder(X86::MOV8mr) 2559 .addReg(X86::RDI) 2560 .addImm(0) 2561 .addReg(X86::NoRegister) 2562 .addImm(0) 2563 .addReg(X86::NoRegister) 2564 .addReg(X86::CL)); 2565 Code.emplace_back(MCInstBuilder(X86::MOV64rr) 2566 .addReg(X86::RAX) 2567 .addReg(X86::RDI)); 2568 return Code; 2569 } 2570 2571 InstructionListType createCmpJE(MCPhysReg RegNo, int64_t Imm, 2572 const MCSymbol *Target, 2573 MCContext *Ctx) const override { 2574 InstructionListType Code; 2575 Code.emplace_back(MCInstBuilder(X86::CMP64ri8) 2576 .addReg(RegNo) 2577 .addImm(Imm)); 2578 Code.emplace_back(MCInstBuilder(X86::JCC_1) 2579 .addExpr(MCSymbolRefExpr::create( 2580 Target, MCSymbolRefExpr::VK_None, *Ctx)) 2581 .addImm(X86::COND_E)); 2582 return Code; 2583 } 2584 2585 Optional<Relocation> 2586 createRelocation(const MCFixup &Fixup, 2587 const MCAsmBackend &MAB) const override { 2588 const MCFixupKindInfo &FKI = MAB.getFixupKindInfo(Fixup.getKind()); 2589 2590 assert(FKI.TargetOffset == 0 && "0-bit relocation offset expected"); 2591 const uint64_t RelOffset = Fixup.getOffset(); 2592 2593 uint64_t RelType; 2594 if (FKI.Flags & MCFixupKindInfo::FKF_IsPCRel) { 2595 switch (FKI.TargetSize) { 2596 default: 2597 return NoneType(); 2598 case 8: RelType = ELF::R_X86_64_PC8; break; 2599 case 16: RelType = ELF::R_X86_64_PC16; break; 2600 case 32: RelType = ELF::R_X86_64_PC32; break; 2601 case 64: RelType = ELF::R_X86_64_PC64; break; 2602 } 2603 } else { 2604 switch (FKI.TargetSize) { 2605 default: 2606 return NoneType(); 2607 case 8: RelType = ELF::R_X86_64_8; break; 2608 case 16: RelType = ELF::R_X86_64_16; break; 2609 case 32: RelType = ELF::R_X86_64_32; break; 2610 case 64: RelType = ELF::R_X86_64_64; break; 2611 } 2612 } 2613 2614 // Extract a symbol and an addend out of the fixup value expression. 2615 // 2616 // Only the following limited expression types are supported: 2617 // Symbol + Addend 2618 // Symbol 2619 uint64_t Addend = 0; 2620 MCSymbol *Symbol = nullptr; 2621 const MCExpr *ValueExpr = Fixup.getValue(); 2622 if (ValueExpr->getKind() == MCExpr::Binary) { 2623 const auto *BinaryExpr = cast<MCBinaryExpr>(ValueExpr); 2624 assert(BinaryExpr->getOpcode() == MCBinaryExpr::Add && 2625 "unexpected binary expression"); 2626 const MCExpr *LHS = BinaryExpr->getLHS(); 2627 assert(LHS->getKind() == MCExpr::SymbolRef && "unexpected LHS"); 2628 Symbol = const_cast<MCSymbol *>(this->getTargetSymbol(LHS)); 2629 const MCExpr *RHS = BinaryExpr->getRHS(); 2630 assert(RHS->getKind() == MCExpr::Constant && "unexpected RHS"); 2631 Addend = cast<MCConstantExpr>(RHS)->getValue(); 2632 } else { 2633 assert(ValueExpr->getKind() == MCExpr::SymbolRef && "unexpected value"); 2634 Symbol = const_cast<MCSymbol *>(this->getTargetSymbol(ValueExpr)); 2635 } 2636 2637 return Relocation({RelOffset, Symbol, RelType, Addend, 0}); 2638 } 2639 2640 bool replaceImmWithSymbolRef(MCInst &Inst, const MCSymbol *Symbol, 2641 int64_t Addend, MCContext *Ctx, int64_t &Value, 2642 uint64_t RelType) const override { 2643 unsigned ImmOpNo = -1U; 2644 2645 for (unsigned Index = 0; Index < MCPlus::getNumPrimeOperands(Inst); 2646 ++Index) { 2647 if (Inst.getOperand(Index).isImm()) { 2648 ImmOpNo = Index; 2649 // TODO: this is a bit hacky. It finds the correct operand by 2650 // searching for a specific immediate value. If no value is 2651 // provided it defaults to the last immediate operand found. 2652 // This could lead to unexpected results if the instruction 2653 // has more than one immediate with the same value. 2654 if (Inst.getOperand(ImmOpNo).getImm() == Value) 2655 break; 2656 } 2657 } 2658 2659 if (ImmOpNo == -1U) 2660 return false; 2661 2662 Value = Inst.getOperand(ImmOpNo).getImm(); 2663 2664 setOperandToSymbolRef(Inst, ImmOpNo, Symbol, Addend, Ctx, RelType); 2665 2666 return true; 2667 } 2668 2669 bool replaceRegWithImm(MCInst &Inst, unsigned Register, 2670 int64_t Imm) const override { 2671 2672 enum CheckSignExt : uint8_t { 2673 NOCHECK = 0, 2674 CHECK8, 2675 CHECK32, 2676 }; 2677 2678 using CheckList = std::vector<std::pair<CheckSignExt, unsigned>>; 2679 struct InstInfo { 2680 // Size in bytes that Inst loads from memory. 2681 uint8_t DataSize; 2682 2683 // True when the target operand has to be duplicated because the opcode 2684 // expects a LHS operand. 2685 bool HasLHS; 2686 2687 // List of checks and corresponding opcodes to be used. We try to use the 2688 // smallest possible immediate value when various sizes are available, 2689 // hence we may need to check whether a larger constant fits in a smaller 2690 // immediate. 2691 CheckList Checks; 2692 }; 2693 2694 InstInfo I; 2695 2696 switch (Inst.getOpcode()) { 2697 default: { 2698 switch (getPushSize(Inst)) { 2699 2700 case 2: I = {2, false, {{CHECK8, X86::PUSH16i8}, {NOCHECK, X86::PUSHi16}}}; break; 2701 case 4: I = {4, false, {{CHECK8, X86::PUSH32i8}, {NOCHECK, X86::PUSHi32}}}; break; 2702 case 8: I = {8, false, {{CHECK8, X86::PUSH64i8}, 2703 {CHECK32, X86::PUSH64i32}, 2704 {NOCHECK, Inst.getOpcode()}}}; break; 2705 default: return false; 2706 } 2707 break; 2708 } 2709 2710 // MOV 2711 case X86::MOV8rr: I = {1, false, {{NOCHECK, X86::MOV8ri}}}; break; 2712 case X86::MOV16rr: I = {2, false, {{NOCHECK, X86::MOV16ri}}}; break; 2713 case X86::MOV32rr: I = {4, false, {{NOCHECK, X86::MOV32ri}}}; break; 2714 case X86::MOV64rr: I = {8, false, {{CHECK32, X86::MOV64ri32}, 2715 {NOCHECK, X86::MOV64ri}}}; break; 2716 2717 case X86::MOV8mr: I = {1, false, {{NOCHECK, X86::MOV8mi}}}; break; 2718 case X86::MOV16mr: I = {2, false, {{NOCHECK, X86::MOV16mi}}}; break; 2719 case X86::MOV32mr: I = {4, false, {{NOCHECK, X86::MOV32mi}}}; break; 2720 case X86::MOV64mr: I = {8, false, {{CHECK32, X86::MOV64mi32}, 2721 {NOCHECK, X86::MOV64mr}}}; break; 2722 2723 // MOVZX 2724 case X86::MOVZX16rr8: I = {1, false, {{NOCHECK, X86::MOV16ri}}}; break; 2725 case X86::MOVZX32rr8: I = {1, false, {{NOCHECK, X86::MOV32ri}}}; break; 2726 case X86::MOVZX32rr16: I = {2, false, {{NOCHECK, X86::MOV32ri}}}; break; 2727 2728 // CMP 2729 case X86::CMP8rr: I = {1, false, {{NOCHECK, X86::CMP8ri}}}; break; 2730 case X86::CMP16rr: I = {2, false, {{CHECK8, X86::CMP16ri8}, 2731 {NOCHECK, X86::CMP16ri}}}; break; 2732 case X86::CMP32rr: I = {4, false, {{CHECK8, X86::CMP32ri8}, 2733 {NOCHECK, X86::CMP32ri}}}; break; 2734 case X86::CMP64rr: I = {8, false, {{CHECK8, X86::CMP64ri8}, 2735 {CHECK32, X86::CMP64ri32}, 2736 {NOCHECK, X86::CMP64rr}}}; break; 2737 2738 // TEST 2739 case X86::TEST8rr: I = {1, false, {{NOCHECK, X86::TEST8ri}}}; break; 2740 case X86::TEST16rr: I = {2, false, {{NOCHECK, X86::TEST16ri}}}; break; 2741 case X86::TEST32rr: I = {4, false, {{NOCHECK, X86::TEST32ri}}}; break; 2742 case X86::TEST64rr: I = {8, false, {{CHECK32, X86::TEST64ri32}, 2743 {NOCHECK, X86::TEST64rr}}}; break; 2744 2745 // ADD 2746 case X86::ADD8rr: I = {1, true, {{NOCHECK, X86::ADD8ri}}}; break; 2747 case X86::ADD16rr: I = {2, true, {{CHECK8, X86::ADD16ri8}, 2748 {NOCHECK, X86::ADD16ri}}}; break; 2749 case X86::ADD32rr: I = {4, true, {{CHECK8, X86::ADD32ri8}, 2750 {NOCHECK, X86::ADD32ri}}}; break; 2751 case X86::ADD64rr: I = {8, true, {{CHECK8, X86::ADD64ri8}, 2752 {CHECK32, X86::ADD64ri32}, 2753 {NOCHECK, X86::ADD64rr}}}; break; 2754 2755 // SUB 2756 case X86::SUB8rr: I = {1, true, {{NOCHECK, X86::SUB8ri}}}; break; 2757 case X86::SUB16rr: I = {2, true, {{CHECK8, X86::SUB16ri8}, 2758 {NOCHECK, X86::SUB16ri}}}; break; 2759 case X86::SUB32rr: I = {4, true, {{CHECK8, X86::SUB32ri8}, 2760 {NOCHECK, X86::SUB32ri}}}; break; 2761 case X86::SUB64rr: I = {8, true, {{CHECK8, X86::SUB64ri8}, 2762 {CHECK32, X86::SUB64ri32}, 2763 {NOCHECK, X86::SUB64rr}}}; break; 2764 2765 // AND 2766 case X86::AND8rr: I = {1, true, {{NOCHECK, X86::AND8ri}}}; break; 2767 case X86::AND16rr: I = {2, true, {{CHECK8, X86::AND16ri8}, 2768 {NOCHECK, X86::AND16ri}}}; break; 2769 case X86::AND32rr: I = {4, true, {{CHECK8, X86::AND32ri8}, 2770 {NOCHECK, X86::AND32ri}}}; break; 2771 case X86::AND64rr: I = {8, true, {{CHECK8, X86::AND64ri8}, 2772 {CHECK32, X86::AND64ri32}, 2773 {NOCHECK, X86::AND64rr}}}; break; 2774 2775 // OR 2776 case X86::OR8rr: I = {1, true, {{NOCHECK, X86::OR8ri}}}; break; 2777 case X86::OR16rr: I = {2, true, {{CHECK8, X86::OR16ri8}, 2778 {NOCHECK, X86::OR16ri}}}; break; 2779 case X86::OR32rr: I = {4, true, {{CHECK8, X86::OR32ri8}, 2780 {NOCHECK, X86::OR32ri}}}; break; 2781 case X86::OR64rr: I = {8, true, {{CHECK8, X86::OR64ri8}, 2782 {CHECK32, X86::OR64ri32}, 2783 {NOCHECK, X86::OR64rr}}}; break; 2784 2785 // XOR 2786 case X86::XOR8rr: I = {1, true, {{NOCHECK, X86::XOR8ri}}}; break; 2787 case X86::XOR16rr: I = {2, true, {{CHECK8, X86::XOR16ri8}, 2788 {NOCHECK, X86::XOR16ri}}}; break; 2789 case X86::XOR32rr: I = {4, true, {{CHECK8, X86::XOR32ri8}, 2790 {NOCHECK, X86::XOR32ri}}}; break; 2791 case X86::XOR64rr: I = {8, true, {{CHECK8, X86::XOR64ri8}, 2792 {CHECK32, X86::XOR64ri32}, 2793 {NOCHECK, X86::XOR64rr}}}; break; 2794 } 2795 2796 // Compute the new opcode. 2797 unsigned NewOpcode = 0; 2798 for (const std::pair<CheckSignExt, unsigned> &Check : I.Checks) { 2799 NewOpcode = Check.second; 2800 if (Check.first == NOCHECK) 2801 break; 2802 if (Check.first == CHECK8 && isInt<8>(Imm)) 2803 break; 2804 if (Check.first == CHECK32 && isInt<32>(Imm)) 2805 break; 2806 } 2807 if (NewOpcode == Inst.getOpcode()) 2808 return false; 2809 2810 const MCInstrDesc &InstDesc = Info->get(Inst.getOpcode()); 2811 2812 unsigned NumFound = 0; 2813 for (unsigned Index = InstDesc.getNumDefs() + (I.HasLHS ? 1 : 0), 2814 E = InstDesc.getNumOperands(); 2815 Index != E; ++Index) 2816 if (Inst.getOperand(Index).isReg() && 2817 Inst.getOperand(Index).getReg() == Register) 2818 NumFound++; 2819 2820 if (NumFound != 1) 2821 return false; 2822 2823 MCOperand TargetOp = Inst.getOperand(0); 2824 Inst.clear(); 2825 Inst.setOpcode(NewOpcode); 2826 Inst.addOperand(TargetOp); 2827 if (I.HasLHS) 2828 Inst.addOperand(TargetOp); 2829 Inst.addOperand(MCOperand::createImm(Imm)); 2830 2831 return true; 2832 } 2833 2834 bool replaceRegWithReg(MCInst &Inst, unsigned ToReplace, 2835 unsigned ReplaceWith) const override { 2836 2837 // Get the HasLHS value so that iteration can be done 2838 bool HasLHS; 2839 if (X86::isAND(Inst.getOpcode()) || X86::isADD(Inst.getOpcode()) || 2840 X86::isSUB(Inst.getOpcode())) { 2841 HasLHS = true; 2842 } else if (isPop(Inst) || isPush(Inst) || X86::isCMP(Inst.getOpcode()) || 2843 X86::isTEST(Inst.getOpcode())) { 2844 HasLHS = false; 2845 } else { 2846 switch (Inst.getOpcode()) { 2847 case X86::MOV8rr: 2848 case X86::MOV8rm: 2849 case X86::MOV8mr: 2850 case X86::MOV8ri: 2851 case X86::MOV16rr: 2852 case X86::MOV16rm: 2853 case X86::MOV16mr: 2854 case X86::MOV16ri: 2855 case X86::MOV32rr: 2856 case X86::MOV32rm: 2857 case X86::MOV32mr: 2858 case X86::MOV32ri: 2859 case X86::MOV64rr: 2860 case X86::MOV64rm: 2861 case X86::MOV64mr: 2862 case X86::MOV64ri: 2863 case X86::MOVZX16rr8: 2864 case X86::MOVZX32rr8: 2865 case X86::MOVZX32rr16: 2866 case X86::MOVSX32rm8: 2867 case X86::MOVSX32rr8: 2868 case X86::MOVSX64rm32: 2869 case X86::LEA64r: 2870 HasLHS = false; 2871 break; 2872 default: 2873 return false; 2874 } 2875 } 2876 2877 const MCInstrDesc &InstDesc = Info->get(Inst.getOpcode()); 2878 2879 bool FoundOne = false; 2880 2881 // Iterate only through src operands that arent also dest operands 2882 for (unsigned Index = InstDesc.getNumDefs() + (HasLHS ? 1 : 0), 2883 E = InstDesc.getNumOperands(); 2884 Index != E; ++Index) { 2885 BitVector RegAliases = getAliases(ToReplace, true); 2886 if (!Inst.getOperand(Index).isReg() || 2887 !RegAliases.test(Inst.getOperand(Index).getReg())) 2888 continue; 2889 // Resize register if needed 2890 unsigned SizedReplaceWith = getAliasSized( 2891 ReplaceWith, getRegSize(Inst.getOperand(Index).getReg())); 2892 MCOperand NewOperand = MCOperand::createReg(SizedReplaceWith); 2893 Inst.getOperand(Index) = NewOperand; 2894 FoundOne = true; 2895 } 2896 2897 // Return true if at least one operand was replaced 2898 return FoundOne; 2899 } 2900 2901 bool createUncondBranch(MCInst &Inst, const MCSymbol *TBB, 2902 MCContext *Ctx) const override { 2903 Inst.setOpcode(X86::JMP_1); 2904 Inst.addOperand(MCOperand::createExpr( 2905 MCSymbolRefExpr::create(TBB, MCSymbolRefExpr::VK_None, *Ctx))); 2906 return true; 2907 } 2908 2909 bool createCall(MCInst &Inst, const MCSymbol *Target, 2910 MCContext *Ctx) override { 2911 Inst.setOpcode(X86::CALL64pcrel32); 2912 Inst.addOperand(MCOperand::createExpr( 2913 MCSymbolRefExpr::create(Target, MCSymbolRefExpr::VK_None, *Ctx))); 2914 return true; 2915 } 2916 2917 bool createTailCall(MCInst &Inst, const MCSymbol *Target, 2918 MCContext *Ctx) override { 2919 return createDirectCall(Inst, Target, Ctx, /*IsTailCall*/ true); 2920 } 2921 2922 void createLongTailCall(InstructionListType &Seq, const MCSymbol *Target, 2923 MCContext *Ctx) override { 2924 Seq.clear(); 2925 Seq.emplace_back(); 2926 createDirectCall(Seq.back(), Target, Ctx, /*IsTailCall*/ true); 2927 } 2928 2929 bool createTrap(MCInst &Inst) const override { 2930 Inst.clear(); 2931 Inst.setOpcode(X86::TRAP); 2932 return true; 2933 } 2934 2935 bool reverseBranchCondition(MCInst &Inst, const MCSymbol *TBB, 2936 MCContext *Ctx) const override { 2937 unsigned InvCC = getInvertedCondCode(getCondCode(Inst)); 2938 assert(InvCC != X86::COND_INVALID && "invalid branch instruction"); 2939 Inst.getOperand(Info->get(Inst.getOpcode()).NumOperands - 1).setImm(InvCC); 2940 Inst.getOperand(0) = MCOperand::createExpr( 2941 MCSymbolRefExpr::create(TBB, MCSymbolRefExpr::VK_None, *Ctx)); 2942 return true; 2943 } 2944 2945 bool replaceBranchCondition(MCInst &Inst, const MCSymbol *TBB, MCContext *Ctx, 2946 unsigned CC) const override { 2947 if (CC == X86::COND_INVALID) 2948 return false; 2949 Inst.getOperand(Info->get(Inst.getOpcode()).NumOperands - 1).setImm(CC); 2950 Inst.getOperand(0) = MCOperand::createExpr( 2951 MCSymbolRefExpr::create(TBB, MCSymbolRefExpr::VK_None, *Ctx)); 2952 return true; 2953 } 2954 2955 unsigned getCanonicalBranchCondCode(unsigned CC) const override { 2956 switch (CC) { 2957 default: return X86::COND_INVALID; 2958 2959 case X86::COND_E: return X86::COND_E; 2960 case X86::COND_NE: return X86::COND_E; 2961 2962 case X86::COND_L: return X86::COND_L; 2963 case X86::COND_GE: return X86::COND_L; 2964 2965 case X86::COND_LE: return X86::COND_G; 2966 case X86::COND_G: return X86::COND_G; 2967 2968 case X86::COND_B: return X86::COND_B; 2969 case X86::COND_AE: return X86::COND_B; 2970 2971 case X86::COND_BE: return X86::COND_A; 2972 case X86::COND_A: return X86::COND_A; 2973 2974 case X86::COND_S: return X86::COND_S; 2975 case X86::COND_NS: return X86::COND_S; 2976 2977 case X86::COND_P: return X86::COND_P; 2978 case X86::COND_NP: return X86::COND_P; 2979 2980 case X86::COND_O: return X86::COND_O; 2981 case X86::COND_NO: return X86::COND_O; 2982 } 2983 } 2984 2985 bool replaceBranchTarget(MCInst &Inst, const MCSymbol *TBB, 2986 MCContext *Ctx) const override { 2987 assert((isCall(Inst) || isBranch(Inst)) && !isIndirectBranch(Inst) && 2988 "Invalid instruction"); 2989 Inst.getOperand(0) = MCOperand::createExpr( 2990 MCSymbolRefExpr::create(TBB, MCSymbolRefExpr::VK_None, *Ctx)); 2991 return true; 2992 } 2993 2994 MCPhysReg getX86R11() const override { return X86::R11; } 2995 2996 MCPhysReg getIntArgRegister(unsigned ArgNo) const override { 2997 // FIXME: this should depend on the calling convention. 2998 switch (ArgNo) { 2999 case 0: return X86::RDI; 3000 case 1: return X86::RSI; 3001 case 2: return X86::RDX; 3002 case 3: return X86::RCX; 3003 case 4: return X86::R8; 3004 case 5: return X86::R9; 3005 default: return getNoRegister(); 3006 } 3007 } 3008 3009 void createPause(MCInst &Inst) const override { 3010 Inst.clear(); 3011 Inst.setOpcode(X86::PAUSE); 3012 } 3013 3014 void createLfence(MCInst &Inst) const override { 3015 Inst.clear(); 3016 Inst.setOpcode(X86::LFENCE); 3017 } 3018 3019 bool createDirectCall(MCInst &Inst, const MCSymbol *Target, MCContext *Ctx, 3020 bool IsTailCall) override { 3021 Inst.clear(); 3022 Inst.setOpcode(IsTailCall ? X86::JMP_4 : X86::CALL64pcrel32); 3023 Inst.addOperand(MCOperand::createExpr( 3024 MCSymbolRefExpr::create(Target, MCSymbolRefExpr::VK_None, *Ctx))); 3025 if (IsTailCall) 3026 setTailCall(Inst); 3027 return true; 3028 } 3029 3030 void createShortJmp(InstructionListType &Seq, const MCSymbol *Target, 3031 MCContext *Ctx, bool IsTailCall) override { 3032 Seq.clear(); 3033 MCInst Inst; 3034 Inst.setOpcode(X86::JMP_1); 3035 Inst.addOperand(MCOperand::createExpr( 3036 MCSymbolRefExpr::create(Target, MCSymbolRefExpr::VK_None, *Ctx))); 3037 if (IsTailCall) 3038 setTailCall(Inst); 3039 Seq.emplace_back(Inst); 3040 } 3041 3042 bool isConditionalMove(const MCInst &Inst) const override { 3043 unsigned OpCode = Inst.getOpcode(); 3044 return (OpCode == X86::CMOV16rr || OpCode == X86::CMOV32rr || 3045 OpCode == X86::CMOV64rr); 3046 } 3047 3048 bool isBranchOnMem(const MCInst &Inst) const override { 3049 unsigned OpCode = Inst.getOpcode(); 3050 if (OpCode == X86::CALL64m || (OpCode == X86::JMP32m && isTailCall(Inst)) || 3051 OpCode == X86::JMP64m) 3052 return true; 3053 3054 return false; 3055 } 3056 3057 bool isBranchOnReg(const MCInst &Inst) const override { 3058 unsigned OpCode = Inst.getOpcode(); 3059 if (OpCode == X86::CALL64r || (OpCode == X86::JMP32r && isTailCall(Inst)) || 3060 OpCode == X86::JMP64r) 3061 return true; 3062 3063 return false; 3064 } 3065 3066 void createPushRegister(MCInst &Inst, MCPhysReg Reg, 3067 unsigned Size) const override { 3068 Inst.clear(); 3069 unsigned NewOpcode = 0; 3070 if (Reg == X86::EFLAGS) { 3071 switch (Size) { 3072 case 2: NewOpcode = X86::PUSHF16; break; 3073 case 4: NewOpcode = X86::PUSHF32; break; 3074 case 8: NewOpcode = X86::PUSHF64; break; 3075 default: 3076 llvm_unreachable("Unexpected size"); 3077 } 3078 Inst.setOpcode(NewOpcode); 3079 return; 3080 } 3081 switch (Size) { 3082 case 2: NewOpcode = X86::PUSH16r; break; 3083 case 4: NewOpcode = X86::PUSH32r; break; 3084 case 8: NewOpcode = X86::PUSH64r; break; 3085 default: 3086 llvm_unreachable("Unexpected size"); 3087 } 3088 Inst.setOpcode(NewOpcode); 3089 Inst.addOperand(MCOperand::createReg(Reg)); 3090 } 3091 3092 void createPopRegister(MCInst &Inst, MCPhysReg Reg, 3093 unsigned Size) const override { 3094 Inst.clear(); 3095 unsigned NewOpcode = 0; 3096 if (Reg == X86::EFLAGS) { 3097 switch (Size) { 3098 case 2: NewOpcode = X86::POPF16; break; 3099 case 4: NewOpcode = X86::POPF32; break; 3100 case 8: NewOpcode = X86::POPF64; break; 3101 default: 3102 llvm_unreachable("Unexpected size"); 3103 } 3104 Inst.setOpcode(NewOpcode); 3105 return; 3106 } 3107 switch (Size) { 3108 case 2: NewOpcode = X86::POP16r; break; 3109 case 4: NewOpcode = X86::POP32r; break; 3110 case 8: NewOpcode = X86::POP64r; break; 3111 default: 3112 llvm_unreachable("Unexpected size"); 3113 } 3114 Inst.setOpcode(NewOpcode); 3115 Inst.addOperand(MCOperand::createReg(Reg)); 3116 } 3117 3118 void createPushFlags(MCInst &Inst, unsigned Size) const override { 3119 return createPushRegister(Inst, X86::EFLAGS, Size); 3120 } 3121 3122 void createPopFlags(MCInst &Inst, unsigned Size) const override { 3123 return createPopRegister(Inst, X86::EFLAGS, Size); 3124 } 3125 3126 void createAddRegImm(MCInst &Inst, MCPhysReg Reg, int64_t Value, 3127 unsigned Size) const { 3128 unsigned int Opcode; 3129 switch (Size) { 3130 case 1: Opcode = X86::ADD8ri; break; 3131 case 2: Opcode = X86::ADD16ri; break; 3132 case 4: Opcode = X86::ADD32ri; break; 3133 default: 3134 llvm_unreachable("Unexpected size"); 3135 } 3136 Inst.setOpcode(Opcode); 3137 Inst.clear(); 3138 Inst.addOperand(MCOperand::createReg(Reg)); 3139 Inst.addOperand(MCOperand::createReg(Reg)); 3140 Inst.addOperand(MCOperand::createImm(Value)); 3141 } 3142 3143 void createClearRegWithNoEFlagsUpdate(MCInst &Inst, MCPhysReg Reg, 3144 unsigned Size) const { 3145 unsigned int Opcode; 3146 switch (Size) { 3147 case 1: Opcode = X86::MOV8ri; break; 3148 case 2: Opcode = X86::MOV16ri; break; 3149 case 4: Opcode = X86::MOV32ri; break; 3150 // Writing to a 32-bit register always zeros the upper 32 bits of the 3151 // full-width register 3152 case 8: 3153 Opcode = X86::MOV32ri; 3154 Reg = getAliasSized(Reg, 4); 3155 break; 3156 default: 3157 llvm_unreachable("Unexpected size"); 3158 } 3159 Inst.setOpcode(Opcode); 3160 Inst.clear(); 3161 Inst.addOperand(MCOperand::createReg(Reg)); 3162 Inst.addOperand(MCOperand::createImm(0)); 3163 } 3164 3165 void createX86SaveOVFlagToRegister(MCInst &Inst, MCPhysReg Reg) const { 3166 Inst.setOpcode(X86::SETCCr); 3167 Inst.clear(); 3168 Inst.addOperand(MCOperand::createReg(Reg)); 3169 Inst.addOperand(MCOperand::createImm(X86::COND_O)); 3170 } 3171 3172 void createX86Lahf(MCInst &Inst) const { 3173 Inst.setOpcode(X86::LAHF); 3174 Inst.clear(); 3175 } 3176 3177 void createX86Sahf(MCInst &Inst) const { 3178 Inst.setOpcode(X86::SAHF); 3179 Inst.clear(); 3180 } 3181 3182 void createInstrIncMemory(InstructionListType &Instrs, const MCSymbol *Target, 3183 MCContext *Ctx, bool IsLeaf) const override { 3184 unsigned int I = 0; 3185 3186 Instrs.resize(IsLeaf ? 13 : 11); 3187 // Don't clobber application red zone (ABI dependent) 3188 if (IsLeaf) 3189 createStackPointerIncrement(Instrs[I++], 128, 3190 /*NoFlagsClobber=*/true); 3191 3192 // Performance improvements based on the optimization discussed at 3193 // https://reviews.llvm.org/D6629 3194 // LAHF/SAHF are used instead of PUSHF/POPF 3195 // PUSHF 3196 createPushRegister(Instrs[I++], X86::RAX, 8); 3197 createClearRegWithNoEFlagsUpdate(Instrs[I++], X86::RAX, 8); 3198 createX86Lahf(Instrs[I++]); 3199 createPushRegister(Instrs[I++], X86::RAX, 8); 3200 createClearRegWithNoEFlagsUpdate(Instrs[I++], X86::RAX, 8); 3201 createX86SaveOVFlagToRegister(Instrs[I++], X86::AL); 3202 // LOCK INC 3203 createIncMemory(Instrs[I++], Target, Ctx); 3204 // POPF 3205 createAddRegImm(Instrs[I++], X86::AL, 127, 1); 3206 createPopRegister(Instrs[I++], X86::RAX, 8); 3207 createX86Sahf(Instrs[I++]); 3208 createPopRegister(Instrs[I++], X86::RAX, 8); 3209 3210 if (IsLeaf) 3211 createStackPointerDecrement(Instrs[I], 128, 3212 /*NoFlagsClobber=*/true); 3213 } 3214 3215 void createSwap(MCInst &Inst, MCPhysReg Source, MCPhysReg MemBaseReg, 3216 int64_t Disp) const { 3217 Inst.setOpcode(X86::XCHG64rm); 3218 Inst.addOperand(MCOperand::createReg(Source)); 3219 Inst.addOperand(MCOperand::createReg(Source)); 3220 Inst.addOperand(MCOperand::createReg(MemBaseReg)); // BaseReg 3221 Inst.addOperand(MCOperand::createImm(1)); // ScaleAmt 3222 Inst.addOperand(MCOperand::createReg(X86::NoRegister)); // IndexReg 3223 Inst.addOperand(MCOperand::createImm(Disp)); // Displacement 3224 Inst.addOperand(MCOperand::createReg(X86::NoRegister)); // AddrSegmentReg 3225 } 3226 3227 void createIndirectBranch(MCInst &Inst, MCPhysReg MemBaseReg, 3228 int64_t Disp) const { 3229 Inst.setOpcode(X86::JMP64m); 3230 Inst.addOperand(MCOperand::createReg(MemBaseReg)); // BaseReg 3231 Inst.addOperand(MCOperand::createImm(1)); // ScaleAmt 3232 Inst.addOperand(MCOperand::createReg(X86::NoRegister)); // IndexReg 3233 Inst.addOperand(MCOperand::createImm(Disp)); // Displacement 3234 Inst.addOperand(MCOperand::createReg(X86::NoRegister)); // AddrSegmentReg 3235 } 3236 3237 InstructionListType createInstrumentedIndirectCall(const MCInst &CallInst, 3238 bool TailCall, 3239 MCSymbol *HandlerFuncAddr, 3240 int CallSiteID, 3241 MCContext *Ctx) override { 3242 // Check if the target address expression used in the original indirect call 3243 // uses the stack pointer, which we are going to clobber. 3244 static BitVector SPAliases(getAliases(X86::RSP)); 3245 bool UsesSP = false; 3246 // Skip defs. 3247 for (unsigned I = Info->get(CallInst.getOpcode()).getNumDefs(), 3248 E = MCPlus::getNumPrimeOperands(CallInst); 3249 I != E; ++I) { 3250 const MCOperand &Operand = CallInst.getOperand(I); 3251 if (Operand.isReg() && SPAliases[Operand.getReg()]) { 3252 UsesSP = true; 3253 break; 3254 } 3255 } 3256 3257 InstructionListType Insts; 3258 MCPhysReg TempReg = getIntArgRegister(0); 3259 // Code sequence used to enter indirect call instrumentation helper: 3260 // push %rdi 3261 // add $8, %rsp ;; $rsp may be used in target, so fix it to prev val 3262 // movq target, %rdi ;; via convertIndirectCallTargetToLoad 3263 // sub $8, %rsp ;; restore correct stack value 3264 // push %rdi 3265 // movq $CallSiteID, %rdi 3266 // push %rdi 3267 // callq/jmp HandlerFuncAddr 3268 Insts.emplace_back(); 3269 createPushRegister(Insts.back(), TempReg, 8); 3270 if (UsesSP) { // Only adjust SP if we really need to 3271 Insts.emplace_back(); 3272 createStackPointerDecrement(Insts.back(), 8, /*NoFlagsClobber=*/false); 3273 } 3274 Insts.emplace_back(CallInst); 3275 // Insts.back() and CallInst now share the same annotation instruction. 3276 // Strip it from Insts.back(), only preserving tail call annotation. 3277 stripAnnotations(Insts.back(), /*KeepTC=*/true); 3278 convertIndirectCallToLoad(Insts.back(), TempReg); 3279 if (UsesSP) { 3280 Insts.emplace_back(); 3281 createStackPointerIncrement(Insts.back(), 8, /*NoFlagsClobber=*/false); 3282 } 3283 Insts.emplace_back(); 3284 createPushRegister(Insts.back(), TempReg, 8); 3285 Insts.emplace_back(); 3286 createLoadImmediate(Insts.back(), TempReg, CallSiteID); 3287 Insts.emplace_back(); 3288 createPushRegister(Insts.back(), TempReg, 8); 3289 Insts.emplace_back(); 3290 createDirectCall(Insts.back(), HandlerFuncAddr, Ctx, 3291 /*TailCall=*/TailCall); 3292 // Carry over metadata 3293 for (int I = MCPlus::getNumPrimeOperands(CallInst), 3294 E = CallInst.getNumOperands(); 3295 I != E; ++I) 3296 Insts.back().addOperand(CallInst.getOperand(I)); 3297 3298 return Insts; 3299 } 3300 3301 InstructionListType createInstrumentedIndCallHandlerExitBB() const override { 3302 const MCPhysReg TempReg = getIntArgRegister(0); 3303 // We just need to undo the sequence created for every ind call in 3304 // instrumentIndirectTarget(), which can be accomplished minimally with: 3305 // popfq 3306 // pop %rdi 3307 // add $16, %rsp 3308 // xchg (%rsp), %rdi 3309 // jmp *-8(%rsp) 3310 InstructionListType Insts(5); 3311 createPopFlags(Insts[0], 8); 3312 createPopRegister(Insts[1], TempReg, 8); 3313 createStackPointerDecrement(Insts[2], 16, /*NoFlagsClobber=*/false); 3314 createSwap(Insts[3], TempReg, X86::RSP, 0); 3315 createIndirectBranch(Insts[4], X86::RSP, -8); 3316 return Insts; 3317 } 3318 3319 InstructionListType 3320 createInstrumentedIndTailCallHandlerExitBB() const override { 3321 const MCPhysReg TempReg = getIntArgRegister(0); 3322 // Same thing as above, but for tail calls 3323 // popfq 3324 // add $16, %rsp 3325 // pop %rdi 3326 // jmp *-16(%rsp) 3327 InstructionListType Insts(4); 3328 createPopFlags(Insts[0], 8); 3329 createStackPointerDecrement(Insts[1], 16, /*NoFlagsClobber=*/false); 3330 createPopRegister(Insts[2], TempReg, 8); 3331 createIndirectBranch(Insts[3], X86::RSP, -16); 3332 return Insts; 3333 } 3334 3335 InstructionListType 3336 createInstrumentedIndCallHandlerEntryBB(const MCSymbol *InstrTrampoline, 3337 const MCSymbol *IndCallHandler, 3338 MCContext *Ctx) override { 3339 const MCPhysReg TempReg = getIntArgRegister(0); 3340 // Code sequence used to check whether InstrTampoline was initialized 3341 // and call it if so, returns via IndCallHandler. 3342 // pushfq 3343 // mov InstrTrampoline,%rdi 3344 // cmp $0x0,%rdi 3345 // je IndCallHandler 3346 // callq *%rdi 3347 // jmpq IndCallHandler 3348 InstructionListType Insts; 3349 Insts.emplace_back(); 3350 createPushFlags(Insts.back(), 8); 3351 Insts.emplace_back(); 3352 createMove(Insts.back(), InstrTrampoline, TempReg, Ctx); 3353 InstructionListType cmpJmp = createCmpJE(TempReg, 0, IndCallHandler, Ctx); 3354 Insts.insert(Insts.end(), cmpJmp.begin(), cmpJmp.end()); 3355 Insts.emplace_back(); 3356 Insts.back().setOpcode(X86::CALL64r); 3357 Insts.back().addOperand(MCOperand::createReg(TempReg)); 3358 Insts.emplace_back(); 3359 createDirectCall(Insts.back(), IndCallHandler, Ctx, /*IsTailCall*/ true); 3360 return Insts; 3361 } 3362 3363 InstructionListType createNumCountersGetter(MCContext *Ctx) const override { 3364 InstructionListType Insts(2); 3365 MCSymbol *NumLocs = Ctx->getOrCreateSymbol("__bolt_num_counters"); 3366 createMove(Insts[0], NumLocs, X86::EAX, Ctx); 3367 createReturn(Insts[1]); 3368 return Insts; 3369 } 3370 3371 InstructionListType 3372 createInstrLocationsGetter(MCContext *Ctx) const override { 3373 InstructionListType Insts(2); 3374 MCSymbol *Locs = Ctx->getOrCreateSymbol("__bolt_instr_locations"); 3375 createLea(Insts[0], Locs, X86::EAX, Ctx); 3376 createReturn(Insts[1]); 3377 return Insts; 3378 } 3379 3380 InstructionListType createInstrTablesGetter(MCContext *Ctx) const override { 3381 InstructionListType Insts(2); 3382 MCSymbol *Locs = Ctx->getOrCreateSymbol("__bolt_instr_tables"); 3383 createLea(Insts[0], Locs, X86::EAX, Ctx); 3384 createReturn(Insts[1]); 3385 return Insts; 3386 } 3387 3388 InstructionListType createInstrNumFuncsGetter(MCContext *Ctx) const override { 3389 InstructionListType Insts(2); 3390 MCSymbol *NumFuncs = Ctx->getOrCreateSymbol("__bolt_instr_num_funcs"); 3391 createMove(Insts[0], NumFuncs, X86::EAX, Ctx); 3392 createReturn(Insts[1]); 3393 return Insts; 3394 } 3395 3396 InstructionListType createSymbolTrampoline(const MCSymbol *TgtSym, 3397 MCContext *Ctx) const override { 3398 InstructionListType Insts(1); 3399 createUncondBranch(Insts[0], TgtSym, Ctx); 3400 return Insts; 3401 } 3402 3403 InstructionListType createDummyReturnFunction(MCContext *Ctx) const override { 3404 InstructionListType Insts(1); 3405 createReturn(Insts[0]); 3406 return Insts; 3407 } 3408 3409 BlocksVectorTy indirectCallPromotion( 3410 const MCInst &CallInst, 3411 const std::vector<std::pair<MCSymbol *, uint64_t>> &Targets, 3412 const std::vector<std::pair<MCSymbol *, uint64_t>> &VtableSyms, 3413 const std::vector<MCInst *> &MethodFetchInsns, 3414 const bool MinimizeCodeSize, MCContext *Ctx) override { 3415 const bool IsTailCall = isTailCall(CallInst); 3416 const bool IsJumpTable = getJumpTable(CallInst) != 0; 3417 BlocksVectorTy Results; 3418 3419 // Label for the current code block. 3420 MCSymbol *NextTarget = nullptr; 3421 3422 // The join block which contains all the instructions following CallInst. 3423 // MergeBlock remains null if CallInst is a tail call. 3424 MCSymbol *MergeBlock = nullptr; 3425 3426 unsigned FuncAddrReg = X86::R10; 3427 3428 const bool LoadElim = !VtableSyms.empty(); 3429 assert((!LoadElim || VtableSyms.size() == Targets.size()) && 3430 "There must be a vtable entry for every method " 3431 "in the targets vector."); 3432 3433 if (MinimizeCodeSize && !LoadElim) { 3434 std::set<unsigned> UsedRegs; 3435 3436 for (unsigned int I = 0; I < MCPlus::getNumPrimeOperands(CallInst); ++I) { 3437 const MCOperand &Op = CallInst.getOperand(I); 3438 if (Op.isReg()) 3439 UsedRegs.insert(Op.getReg()); 3440 } 3441 3442 if (UsedRegs.count(X86::R10) == 0) 3443 FuncAddrReg = X86::R10; 3444 else if (UsedRegs.count(X86::R11) == 0) 3445 FuncAddrReg = X86::R11; 3446 else 3447 return Results; 3448 } 3449 3450 const auto jumpToMergeBlock = [&](InstructionListType &NewCall) { 3451 assert(MergeBlock); 3452 NewCall.push_back(CallInst); 3453 MCInst &Merge = NewCall.back(); 3454 Merge.clear(); 3455 createUncondBranch(Merge, MergeBlock, Ctx); 3456 }; 3457 3458 for (unsigned int i = 0; i < Targets.size(); ++i) { 3459 Results.emplace_back(NextTarget, InstructionListType()); 3460 InstructionListType *NewCall = &Results.back().second; 3461 3462 if (MinimizeCodeSize && !LoadElim) { 3463 // Load the call target into FuncAddrReg. 3464 NewCall->push_back(CallInst); // Copy CallInst in order to get SMLoc 3465 MCInst &Target = NewCall->back(); 3466 Target.clear(); 3467 Target.setOpcode(X86::MOV64ri32); 3468 Target.addOperand(MCOperand::createReg(FuncAddrReg)); 3469 if (Targets[i].first) { 3470 // Is this OK? 3471 Target.addOperand(MCOperand::createExpr(MCSymbolRefExpr::create( 3472 Targets[i].first, MCSymbolRefExpr::VK_None, *Ctx))); 3473 } else { 3474 const uint64_t Addr = Targets[i].second; 3475 // Immediate address is out of sign extended 32 bit range. 3476 if (int64_t(Addr) != int64_t(int32_t(Addr))) 3477 return BlocksVectorTy(); 3478 3479 Target.addOperand(MCOperand::createImm(Addr)); 3480 } 3481 3482 // Compare current call target to a specific address. 3483 NewCall->push_back(CallInst); 3484 MCInst &Compare = NewCall->back(); 3485 Compare.clear(); 3486 if (isBranchOnReg(CallInst)) 3487 Compare.setOpcode(X86::CMP64rr); 3488 else if (CallInst.getOpcode() == X86::CALL64pcrel32) 3489 Compare.setOpcode(X86::CMP64ri32); 3490 else 3491 Compare.setOpcode(X86::CMP64rm); 3492 3493 Compare.addOperand(MCOperand::createReg(FuncAddrReg)); 3494 3495 // TODO: Would be preferable to only load this value once. 3496 for (unsigned i = 0; 3497 i < Info->get(CallInst.getOpcode()).getNumOperands(); ++i) 3498 if (!CallInst.getOperand(i).isInst()) 3499 Compare.addOperand(CallInst.getOperand(i)); 3500 } else { 3501 // Compare current call target to a specific address. 3502 NewCall->push_back(CallInst); 3503 MCInst &Compare = NewCall->back(); 3504 Compare.clear(); 3505 if (isBranchOnReg(CallInst)) 3506 Compare.setOpcode(X86::CMP64ri32); 3507 else 3508 Compare.setOpcode(X86::CMP64mi32); 3509 3510 // Original call address. 3511 for (unsigned i = 0; 3512 i < Info->get(CallInst.getOpcode()).getNumOperands(); ++i) 3513 if (!CallInst.getOperand(i).isInst()) 3514 Compare.addOperand(CallInst.getOperand(i)); 3515 3516 // Target address. 3517 if (Targets[i].first || LoadElim) { 3518 const MCSymbol *Sym = 3519 LoadElim ? VtableSyms[i].first : Targets[i].first; 3520 const uint64_t Addend = LoadElim ? VtableSyms[i].second : 0; 3521 const MCExpr *Expr = MCSymbolRefExpr::create(Sym, *Ctx); 3522 if (Addend) 3523 Expr = MCBinaryExpr::createAdd( 3524 Expr, MCConstantExpr::create(Addend, *Ctx), *Ctx); 3525 Compare.addOperand(MCOperand::createExpr(Expr)); 3526 } else { 3527 const uint64_t Addr = Targets[i].second; 3528 // Immediate address is out of sign extended 32 bit range. 3529 if (int64_t(Addr) != int64_t(int32_t(Addr))) 3530 return BlocksVectorTy(); 3531 3532 Compare.addOperand(MCOperand::createImm(Addr)); 3533 } 3534 } 3535 3536 // jump to next target compare. 3537 NextTarget = 3538 Ctx->createNamedTempSymbol(); // generate label for the next block 3539 NewCall->push_back(CallInst); 3540 3541 if (IsJumpTable) { 3542 MCInst &Je = NewCall->back(); 3543 3544 // Jump to next compare if target addresses don't match. 3545 Je.clear(); 3546 Je.setOpcode(X86::JCC_1); 3547 if (Targets[i].first) 3548 Je.addOperand(MCOperand::createExpr(MCSymbolRefExpr::create( 3549 Targets[i].first, MCSymbolRefExpr::VK_None, *Ctx))); 3550 else 3551 Je.addOperand(MCOperand::createImm(Targets[i].second)); 3552 3553 Je.addOperand(MCOperand::createImm(X86::COND_E)); 3554 assert(!isInvoke(CallInst)); 3555 } else { 3556 MCInst &Jne = NewCall->back(); 3557 3558 // Jump to next compare if target addresses don't match. 3559 Jne.clear(); 3560 Jne.setOpcode(X86::JCC_1); 3561 Jne.addOperand(MCOperand::createExpr(MCSymbolRefExpr::create( 3562 NextTarget, MCSymbolRefExpr::VK_None, *Ctx))); 3563 Jne.addOperand(MCOperand::createImm(X86::COND_NE)); 3564 3565 // Call specific target directly. 3566 Results.emplace_back(Ctx->createNamedTempSymbol(), 3567 InstructionListType()); 3568 NewCall = &Results.back().second; 3569 NewCall->push_back(CallInst); 3570 MCInst &CallOrJmp = NewCall->back(); 3571 3572 CallOrJmp.clear(); 3573 3574 if (MinimizeCodeSize && !LoadElim) { 3575 CallOrJmp.setOpcode(IsTailCall ? X86::JMP32r : X86::CALL64r); 3576 CallOrJmp.addOperand(MCOperand::createReg(FuncAddrReg)); 3577 } else { 3578 CallOrJmp.setOpcode(IsTailCall ? X86::JMP_4 : X86::CALL64pcrel32); 3579 3580 if (Targets[i].first) 3581 CallOrJmp.addOperand(MCOperand::createExpr(MCSymbolRefExpr::create( 3582 Targets[i].first, MCSymbolRefExpr::VK_None, *Ctx))); 3583 else 3584 CallOrJmp.addOperand(MCOperand::createImm(Targets[i].second)); 3585 } 3586 if (IsTailCall) 3587 setTailCall(CallOrJmp); 3588 3589 if (CallOrJmp.getOpcode() == X86::CALL64r || 3590 CallOrJmp.getOpcode() == X86::CALL64pcrel32) { 3591 if (Optional<uint32_t> Offset = getOffset(CallInst)) 3592 // Annotated as duplicated call 3593 setOffset(CallOrJmp, *Offset); 3594 } 3595 3596 if (isInvoke(CallInst) && !isInvoke(CallOrJmp)) { 3597 // Copy over any EH or GNU args size information from the original 3598 // call. 3599 Optional<MCPlus::MCLandingPad> EHInfo = getEHInfo(CallInst); 3600 if (EHInfo) 3601 addEHInfo(CallOrJmp, *EHInfo); 3602 int64_t GnuArgsSize = getGnuArgsSize(CallInst); 3603 if (GnuArgsSize >= 0) 3604 addGnuArgsSize(CallOrJmp, GnuArgsSize); 3605 } 3606 3607 if (!IsTailCall) { 3608 // The fallthrough block for the most common target should be 3609 // the merge block. 3610 if (i == 0) { 3611 // Fallthrough to merge block. 3612 MergeBlock = Ctx->createNamedTempSymbol(); 3613 } else { 3614 // Insert jump to the merge block if we are not doing a fallthrough. 3615 jumpToMergeBlock(*NewCall); 3616 } 3617 } 3618 } 3619 } 3620 3621 // Cold call block. 3622 Results.emplace_back(NextTarget, InstructionListType()); 3623 InstructionListType &NewCall = Results.back().second; 3624 for (const MCInst *Inst : MethodFetchInsns) 3625 if (Inst != &CallInst) 3626 NewCall.push_back(*Inst); 3627 NewCall.push_back(CallInst); 3628 3629 // Jump to merge block from cold call block 3630 if (!IsTailCall && !IsJumpTable) { 3631 jumpToMergeBlock(NewCall); 3632 3633 // Record merge block 3634 Results.emplace_back(MergeBlock, InstructionListType()); 3635 } 3636 3637 return Results; 3638 } 3639 3640 BlocksVectorTy jumpTablePromotion( 3641 const MCInst &IJmpInst, 3642 const std::vector<std::pair<MCSymbol *, uint64_t>> &Targets, 3643 const std::vector<MCInst *> &TargetFetchInsns, 3644 MCContext *Ctx) const override { 3645 assert(getJumpTable(IJmpInst) != 0); 3646 uint16_t IndexReg = getAnnotationAs<uint16_t>(IJmpInst, "JTIndexReg"); 3647 if (IndexReg == 0) 3648 return BlocksVectorTy(); 3649 3650 BlocksVectorTy Results; 3651 3652 // Label for the current code block. 3653 MCSymbol *NextTarget = nullptr; 3654 3655 for (unsigned int i = 0; i < Targets.size(); ++i) { 3656 Results.emplace_back(NextTarget, InstructionListType()); 3657 InstructionListType *CurBB = &Results.back().second; 3658 3659 // Compare current index to a specific index. 3660 CurBB->emplace_back(MCInst()); 3661 MCInst &CompareInst = CurBB->back(); 3662 CompareInst.setLoc(IJmpInst.getLoc()); 3663 CompareInst.setOpcode(X86::CMP64ri32); 3664 CompareInst.addOperand(MCOperand::createReg(IndexReg)); 3665 3666 const uint64_t CaseIdx = Targets[i].second; 3667 // Immediate address is out of sign extended 32 bit range. 3668 if (int64_t(CaseIdx) != int64_t(int32_t(CaseIdx))) 3669 return BlocksVectorTy(); 3670 3671 CompareInst.addOperand(MCOperand::createImm(CaseIdx)); 3672 shortenInstruction(CompareInst, *Ctx->getSubtargetInfo()); 3673 3674 // jump to next target compare. 3675 NextTarget = 3676 Ctx->createNamedTempSymbol(); // generate label for the next block 3677 CurBB->push_back(MCInst()); 3678 3679 MCInst &JEInst = CurBB->back(); 3680 JEInst.setLoc(IJmpInst.getLoc()); 3681 3682 // Jump to target if indices match 3683 JEInst.setOpcode(X86::JCC_1); 3684 JEInst.addOperand(MCOperand::createExpr(MCSymbolRefExpr::create( 3685 Targets[i].first, MCSymbolRefExpr::VK_None, *Ctx))); 3686 JEInst.addOperand(MCOperand::createImm(X86::COND_E)); 3687 } 3688 3689 // Cold call block. 3690 Results.emplace_back(NextTarget, InstructionListType()); 3691 InstructionListType &CurBB = Results.back().second; 3692 for (const MCInst *Inst : TargetFetchInsns) 3693 if (Inst != &IJmpInst) 3694 CurBB.push_back(*Inst); 3695 3696 CurBB.push_back(IJmpInst); 3697 3698 return Results; 3699 } 3700 3701 private: 3702 bool createMove(MCInst &Inst, const MCSymbol *Src, unsigned Reg, 3703 MCContext *Ctx) const { 3704 Inst.setOpcode(X86::MOV64rm); 3705 Inst.addOperand(MCOperand::createReg(Reg)); 3706 Inst.addOperand(MCOperand::createReg(X86::RIP)); // BaseReg 3707 Inst.addOperand(MCOperand::createImm(1)); // ScaleAmt 3708 Inst.addOperand(MCOperand::createReg(X86::NoRegister)); // IndexReg 3709 Inst.addOperand(MCOperand::createExpr( 3710 MCSymbolRefExpr::create(Src, MCSymbolRefExpr::VK_None, 3711 *Ctx))); // Displacement 3712 Inst.addOperand(MCOperand::createReg(X86::NoRegister)); // AddrSegmentReg 3713 3714 return true; 3715 } 3716 3717 bool createLea(MCInst &Inst, const MCSymbol *Src, unsigned Reg, 3718 MCContext *Ctx) const { 3719 Inst.setOpcode(X86::LEA64r); 3720 Inst.addOperand(MCOperand::createReg(Reg)); 3721 Inst.addOperand(MCOperand::createReg(X86::RIP)); // BaseReg 3722 Inst.addOperand(MCOperand::createImm(1)); // ScaleAmt 3723 Inst.addOperand(MCOperand::createReg(X86::NoRegister)); // IndexReg 3724 Inst.addOperand(MCOperand::createExpr( 3725 MCSymbolRefExpr::create(Src, MCSymbolRefExpr::VK_None, 3726 *Ctx))); // Displacement 3727 Inst.addOperand(MCOperand::createReg(X86::NoRegister)); // AddrSegmentReg 3728 return true; 3729 } 3730 }; 3731 3732 } // namespace 3733 3734 namespace llvm { 3735 namespace bolt { 3736 3737 MCPlusBuilder *createX86MCPlusBuilder(const MCInstrAnalysis *Analysis, 3738 const MCInstrInfo *Info, 3739 const MCRegisterInfo *RegInfo) { 3740 return new X86MCPlusBuilder(Analysis, Info, RegInfo); 3741 } 3742 3743 } // namespace bolt 3744 } // namespace llvm 3745