1//===- X86MCLFIRewriter.cpp -------------------------------------*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file implements the X86MCLFIRewriter class, which rewrites X86-64
10// instructions for LFI (Lightweight Fault Isolation) sandboxing.
11//
12//===----------------------------------------------------------------------===//
13
14#include "X86MCLFIRewriter.h"
15#include "X86BaseInfo.h"
16#include "X86MCTargetDesc.h"
17#include "llvm/MC/MCContext.h"
18#include "llvm/MC/MCExpr.h"
19#include "llvm/MC/MCInst.h"
20#include "llvm/MC/MCStreamer.h"
21#include "llvm/MC/MCSubtargetInfo.h"
22
23using namespace llvm;
24
25// LFI reserved registers.
26static constexpr MCRegister LFIBaseReg = X86::R14;
27static constexpr MCRegister LFIScratchReg = X86::R11;
28static constexpr MCRegister LFITPReg = X86::R15;
29
30// Byte offset into the context register file (pointed to by R15) where the
31// thread pointer is stored.
32static constexpr int TPOffset = 16;
33
34static bool isSyscall(const MCInst &Inst) {
35 return Inst.getOpcode() == X86::SYSCALL;
36}
37
38// Find the index of the memory operand if it has an %fs segment override.
39// Returns -1 if there is no memory operand or no %fs override.
40static int findFSMemOperand(const MCInst &Inst, const MCInstrInfo &InstInfo) {
41 int MemIdx = X86II::getMemoryOperandIdx(Desc: InstInfo.get(Opcode: Inst.getOpcode()));
42 if (MemIdx < 0)
43 return -1;
44 const MCOperand &Seg = Inst.getOperand(i: MemIdx + X86::AddrSegmentReg);
45 if (Seg.isReg() && Seg.getReg() == X86::FS)
46 return MemIdx;
47 return -1;
48}
49
50// Return true if the instruction reads from Reg.
51static bool readsRegister(const MCInst &Inst, const MCInstrDesc &Desc,
52 MCRegister Reg, const MCRegisterInfo &RI) {
53 for (unsigned I = Desc.getNumDefs(), E = Inst.getNumOperands(); I < E; ++I) {
54 const MCOperand &Op = Inst.getOperand(i: I);
55 if (Op.isReg() && Op.getReg() && RI.regsOverlap(RegA: Op.getReg(), RegB: Reg))
56 return true;
57 }
58 for (MCPhysReg Use : Desc.implicit_uses())
59 if (RI.regsOverlap(RegA: Use, RegB: Reg))
60 return true;
61 return false;
62}
63
64// Return true if Reg is absent or a 64-bit general-purpose register.
65static bool isGR64OrNone(MCRegister Reg) {
66 return Reg == X86::NoRegister ||
67 getX86MCRegisterClass(RC: X86::GR64RegClassID).contains(Reg);
68}
69
70// syscall
71// ->
72// .bundle_lock
73// leaq .Ltmp(%rip), %r11
74// jmpq *(%r14)
75// .Ltmp:
76// .bundle_unlock
77void X86::X86MCLFIRewriter::rewriteSyscall(const MCInst &Inst, MCStreamer &Out,
78 const MCSubtargetInfo &STI) {
79 Out.emitBundleLock(/*AlignToEnd=*/false, STI);
80
81 MCSymbol *Symbol = Out.getContext().createTempSymbol();
82
83 // leaq .Ltmp(%rip), %r11
84 MCInst Lea;
85 Lea.setOpcode(X86::LEA64r);
86 Lea.addOperand(Op: MCOperand::createReg(Reg: LFIScratchReg));
87 Lea.addOperand(Op: MCOperand::createReg(Reg: X86::RIP));
88 Lea.addOperand(Op: MCOperand::createImm(Val: 1));
89 Lea.addOperand(Op: MCOperand::createReg(Reg: X86::NoRegister));
90 Lea.addOperand(
91 Op: MCOperand::createExpr(Val: MCSymbolRefExpr::create(Symbol, Ctx&: Out.getContext())));
92 Lea.addOperand(Op: MCOperand::createReg(Reg: X86::NoRegister));
93 Out.emitInstruction(Inst: Lea, STI);
94
95 // jmpq *(%r14)
96 MCInst Jmp;
97 Jmp.setOpcode(X86::JMP64m);
98 Jmp.addOperand(Op: MCOperand::createReg(Reg: LFIBaseReg));
99 Jmp.addOperand(Op: MCOperand::createImm(Val: 1));
100 Jmp.addOperand(Op: MCOperand::createReg(Reg: X86::NoRegister));
101 Jmp.addOperand(Op: MCOperand::createImm(Val: -8));
102 Jmp.addOperand(Op: MCOperand::createReg(Reg: X86::NoRegister));
103 Out.emitInstruction(Inst: Jmp, STI);
104
105 Out.emitLabel(Symbol);
106 Out.emitBundleUnlock(STI);
107}
108
109// Emit: movq TPOffset(%r15), %Reg
110static void emitTPLoad(MCRegister Reg, MCStreamer &Out,
111 const MCSubtargetInfo &STI) {
112 MCInst Mov;
113 Mov.setOpcode(X86::MOV64rm);
114 Mov.addOperand(Op: MCOperand::createReg(Reg));
115 Mov.addOperand(Op: MCOperand::createReg(Reg: LFITPReg));
116 Mov.addOperand(Op: MCOperand::createImm(Val: 1));
117 Mov.addOperand(Op: MCOperand::createReg(Reg: X86::NoRegister));
118 Mov.addOperand(Op: MCOperand::createImm(Val: TPOffset));
119 Mov.addOperand(Op: MCOperand::createReg(Reg: X86::NoRegister));
120 Out.emitInstruction(Inst: Mov, STI);
121}
122
123bool X86::X86MCLFIRewriter::isFSAccess(const MCInst &Inst) {
124 return (mayLoad(Inst) || mayStore(Inst)) &&
125 findFSMemOperand(Inst, InstInfo: *InstInfo) >= 0;
126}
127
128// Rewrite %fs-segment memory accesses to use the virtual thread pointer stored
129// at TPOffset(%r15). The actual memory access is currently unsandboxed because
130// load/store sandboxing is not yet supported. Example rewrites:
131//
132// movq %fs:0, %rax
133// ->
134// movq 16(%r15), %rax
135//
136// movq %fs:(%rdi), %rax
137// ->
138// movq 16(%r15), %rax
139// movq (%rax, %rdi), %rax
140//
141// movq %fs:8(%rdi, %rsi, 2), %rax
142// ->
143// movq 16(%r15), %rax
144// leaq (%rax, %rdi), %rax
145// movq 8(%rax, %rsi, 2), %rax
146void X86::X86MCLFIRewriter::rewriteFSAccess(const MCInst &Inst, MCStreamer &Out,
147 const MCSubtargetInfo &STI) {
148 int MemIdx = findFSMemOperand(Inst, InstInfo: *InstInfo);
149 assert(MemIdx >= 0);
150
151 MCRegister BaseReg = Inst.getOperand(i: MemIdx + X86::AddrBaseReg).getReg();
152 MCRegister IndexReg = Inst.getOperand(i: MemIdx + X86::AddrIndexReg).getReg();
153 bool HasBase = BaseReg != X86::NoRegister;
154 bool HasIndex = IndexReg != X86::NoRegister;
155 bool HasDisp = !Inst.getOperand(i: MemIdx + X86::AddrDisp).isImm() ||
156 Inst.getOperand(i: MemIdx + X86::AddrDisp).getImm() != 0;
157
158 // %fs:0 -> TPOffset(%r15)
159 if (!HasBase && !HasIndex && !HasDisp) {
160 MCInst Modified(Inst);
161 Modified.getOperand(i: MemIdx + X86::AddrBaseReg).setReg(LFITPReg);
162 Modified.getOperand(i: MemIdx + X86::AddrDisp).setImm(TPOffset);
163 Modified.getOperand(i: MemIdx + X86::AddrSegmentReg).setReg(X86::NoRegister);
164 return Out.emitInstruction(Inst: Modified, STI);
165 }
166
167 if (!isGR64OrNone(Reg: BaseReg) || !isGR64OrNone(Reg: IndexReg) ||
168 BaseReg == X86::RSP || BaseReg == X86::RIP)
169 return error(Inst, Msg: "unsupported addressing mode for %fs access");
170
171 const MCInstrDesc &Desc = InstInfo->get(Opcode: Inst.getOpcode());
172
173 // Reuse operand 0 as the TP temporary when the instruction writes it without
174 // also reading it, otherwise use %r11.
175 MCRegister TPDest = LFIScratchReg;
176 if (MemIdx > 0 && Inst.getOperand(i: 0).isReg()) {
177 MCRegister DestReg = Inst.getOperand(i: 0).getReg();
178 if (Desc.getNumDefs() > 0 &&
179 getX86MCRegisterClass(RC: X86::GR64RegClassID).contains(Reg: DestReg) &&
180 !readsRegister(Inst, Desc, Reg: DestReg, RI: *RegInfo))
181 TPDest = DestReg;
182 }
183
184 if (TPDest == LFIScratchReg &&
185 readsRegister(Inst, Desc, Reg: LFIScratchReg, RI: *RegInfo))
186 return error(Inst, Msg: "%fs access reads reserved register %r11");
187
188 emitTPLoad(Reg: TPDest, Out, STI);
189
190 // Both slots occupied: the compute base via lea. For example:
191 //
192 // movq %fs:8(%rdi,%rsi,2), %rax
193 // ->
194 // movq 16(%r15), %rax
195 // leaq (%rax,%rdi), %rax
196 // movq 8(%rax,%rsi,2), %rax
197 if (HasBase && HasIndex) {
198 MCInst Lea;
199 Lea.setOpcode(X86::LEA64r);
200 Lea.addOperand(Op: MCOperand::createReg(Reg: TPDest));
201 Lea.addOperand(Op: MCOperand::createReg(Reg: TPDest));
202 Lea.addOperand(Op: MCOperand::createImm(Val: 1));
203 Lea.addOperand(Op: MCOperand::createReg(Reg: BaseReg));
204 Lea.addOperand(Op: MCOperand::createImm(Val: 0));
205 Lea.addOperand(Op: MCOperand::createReg(Reg: X86::NoRegister));
206 Out.emitInstruction(Inst: Lea, STI);
207 }
208
209 // Emit the access with TPDest as the new base, and the original base
210 // (offset from %fs) as the new index. For example:
211 //
212 // movq %fs:(%rdi), %rax
213 // ->
214 // movq 16(%r15), %rax
215 // movq (%rax,%rdi), %rax
216 MCInst Modified(Inst);
217 Modified.getOperand(i: MemIdx + X86::AddrBaseReg).setReg(TPDest);
218 if (HasBase && !HasIndex)
219 Modified.getOperand(i: MemIdx + X86::AddrIndexReg).setReg(BaseReg);
220 Modified.getOperand(i: MemIdx + X86::AddrSegmentReg).setReg(X86::NoRegister);
221 Out.emitInstruction(Inst: Modified, STI);
222}
223
224void X86::X86MCLFIRewriter::doRewriteInst(const MCInst &Inst, MCStreamer &Out,
225 const MCSubtargetInfo &STI) {
226 if (mayModifyRegister(Inst, Reg: LFIBaseReg) || mayModifyRegister(Inst, Reg: LFITPReg))
227 return error(Inst, Msg: "illegal modification of reserved LFI register");
228
229 if (isSyscall(Inst))
230 return rewriteSyscall(Inst, Out, STI);
231
232 if (isFSAccess(Inst))
233 return rewriteFSAccess(Inst, Out, STI);
234
235 // Pass through all other instructions unchanged.
236 Out.emitInstruction(Inst, STI);
237}
238
239bool X86::X86MCLFIRewriter::rewriteInst(const MCInst &Inst, MCStreamer &Out,
240 const MCSubtargetInfo &STI) {
241 // The guard prevents rewrite-recursion when we emit instructions from inside
242 // the rewriter (such instructions should not be rewritten).
243 if (!Enabled || Guard)
244 return false;
245 Guard = true;
246
247 doRewriteInst(Inst, Out, STI);
248
249 Guard = false;
250 return true;
251}
252