1 //===-- MipsNaClELFStreamer.cpp - ELF Object Output for Mips NaCl ---------===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file implements MCELFStreamer for Mips NaCl. It emits .o object files
11 // as required by NaCl's SFI sandbox. It inserts address-masking instructions
12 // before dangerous control-flow and memory access instructions. It inserts
13 // address-masking instructions after instructions that change the stack
14 // pointer. It ensures that the mask and the dangerous instruction are always
15 // emitted in the same bundle. It aligns call + branch delay to the bundle end,
16 // so that return address is always aligned to the start of next bundle.
18 //===----------------------------------------------------------------------===//
21 #include "MipsELFStreamer.h"
22 #include "MipsMCNaCl.h"
23 #include "llvm/MC/MCELFStreamer.h"
27 #define DEBUG_TYPE "mips-mc-nacl"
31 const unsigned IndirectBranchMaskReg = Mips::T6;
32 const unsigned LoadStoreStackMaskReg = Mips::T7;
34 /// Extend the generic MCELFStreamer class so that it can mask dangerous
37 class MipsNaClELFStreamer : public MipsELFStreamer {
39 MipsNaClELFStreamer(MCContext &Context, MCAsmBackend &TAB, raw_ostream &OS,
40 MCCodeEmitter *Emitter, const MCSubtargetInfo &STI)
41 : MipsELFStreamer(Context, TAB, OS, Emitter, STI), PendingCall(false) {}
43 ~MipsNaClELFStreamer() {}
46 // Whether we started the sandboxing sequence for calls. Calls are bundled
47 // with branch delays and aligned to the bundle end.
50 bool isIndirectJump(const MCInst &MI) {
51 return MI.getOpcode() == Mips::JR || MI.getOpcode() == Mips::RET;
54 bool isStackPointerFirstOperand(const MCInst &MI) {
55 return (MI.getNumOperands() > 0 && MI.getOperand(0).isReg()
56 && MI.getOperand(0).getReg() == Mips::SP);
59 bool isCall(unsigned Opcode, bool *IsIndirectCall) {
60 *IsIndirectCall = false;
73 *IsIndirectCall = true;
78 void emitMask(unsigned AddrReg, unsigned MaskReg,
79 const MCSubtargetInfo &STI) {
81 MaskInst.setOpcode(Mips::AND);
82 MaskInst.addOperand(MCOperand::CreateReg(AddrReg));
83 MaskInst.addOperand(MCOperand::CreateReg(AddrReg));
84 MaskInst.addOperand(MCOperand::CreateReg(MaskReg));
85 MipsELFStreamer::EmitInstruction(MaskInst, STI);
88 // Sandbox indirect branch or return instruction by inserting mask operation
90 void sandboxIndirectJump(const MCInst &MI, const MCSubtargetInfo &STI) {
91 unsigned AddrReg = MI.getOperand(0).getReg();
93 EmitBundleLock(false);
94 emitMask(AddrReg, IndirectBranchMaskReg, STI);
95 MipsELFStreamer::EmitInstruction(MI, STI);
99 // Sandbox memory access or SP change. Insert mask operation before and/or
100 // after the instruction.
101 void sandboxLoadStoreStackChange(const MCInst &MI, unsigned AddrIdx,
102 const MCSubtargetInfo &STI, bool MaskBefore,
104 EmitBundleLock(false);
106 // Sandbox memory access.
107 unsigned BaseReg = MI.getOperand(AddrIdx).getReg();
108 emitMask(BaseReg, LoadStoreStackMaskReg, STI);
110 MipsELFStreamer::EmitInstruction(MI, STI);
112 // Sandbox SP change.
113 unsigned SPReg = MI.getOperand(0).getReg();
114 assert((Mips::SP == SPReg) && "Unexpected stack-pointer register.");
115 emitMask(SPReg, LoadStoreStackMaskReg, STI);
121 /// This function is the one used to emit instruction data into the ELF
122 /// streamer. We override it to mask dangerous instructions.
123 void EmitInstruction(const MCInst &Inst,
124 const MCSubtargetInfo &STI) override {
125 // Sandbox indirect jumps.
126 if (isIndirectJump(Inst)) {
128 report_fatal_error("Dangerous instruction in branch delay slot!");
129 sandboxIndirectJump(Inst, STI);
133 // Sandbox loads, stores and SP changes.
136 bool IsMemAccess = isBasePlusOffsetMemoryAccess(Inst.getOpcode(), &AddrIdx,
138 bool IsSPFirstOperand = isStackPointerFirstOperand(Inst);
139 if (IsMemAccess || IsSPFirstOperand) {
140 bool MaskBefore = (IsMemAccess
141 && baseRegNeedsLoadStoreMask(Inst.getOperand(AddrIdx)
143 bool MaskAfter = IsSPFirstOperand && !IsStore;
144 if (MaskBefore || MaskAfter) {
146 report_fatal_error("Dangerous instruction in branch delay slot!");
147 sandboxLoadStoreStackChange(Inst, AddrIdx, STI, MaskBefore, MaskAfter);
153 // Sandbox calls by aligning call and branch delay to the bundle end.
154 // For indirect calls, emit the mask before the call.
156 if (isCall(Inst.getOpcode(), &IsIndirectCall)) {
158 report_fatal_error("Dangerous instruction in branch delay slot!");
160 // Start the sandboxing sequence by emitting call.
161 EmitBundleLock(true);
162 if (IsIndirectCall) {
163 unsigned TargetReg = Inst.getOperand(1).getReg();
164 emitMask(TargetReg, IndirectBranchMaskReg, STI);
166 MipsELFStreamer::EmitInstruction(Inst, STI);
171 // Finish the sandboxing sequence by emitting branch delay.
172 MipsELFStreamer::EmitInstruction(Inst, STI);
178 // None of the sandboxing applies, just emit the instruction.
179 MipsELFStreamer::EmitInstruction(Inst, STI);
183 } // end anonymous namespace
187 bool isBasePlusOffsetMemoryAccess(unsigned Opcode, unsigned *AddrIdx,
196 // Load instructions with base address register in position 1.
210 // Store instructions with base address register in position 1.
223 // Store instructions with base address register in position 2.
232 bool baseRegNeedsLoadStoreMask(unsigned Reg) {
233 // The contents of SP and thread pointer register do not require masking.
234 return Reg != Mips::SP && Reg != Mips::T8;
237 MCELFStreamer *createMipsNaClELFStreamer(MCContext &Context, MCAsmBackend &TAB,
239 MCCodeEmitter *Emitter,
240 const MCSubtargetInfo &STI,
241 bool RelaxAll, bool NoExecStack) {
242 MipsNaClELFStreamer *S = new MipsNaClELFStreamer(Context, TAB, OS, Emitter,
245 S->getAssembler().setRelaxAll(true);
247 S->getAssembler().setNoExecStack(true);
249 // Set bundle-alignment as required by the NaCl ABI for the target.
250 S->EmitBundleAlignMode(MIPS_NACL_BUNDLE_ALIGN);