1//===-- RenderScriptx86ABIFixups.cpp ----------------------------*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8
9#include <set>
10
11#include "llvm/ADT/StringRef.h"
12#include "llvm/IR/BasicBlock.h"
13#include "llvm/IR/CallSite.h"
14#include "llvm/IR/Constants.h"
15#include "llvm/IR/Function.h"
16#include "llvm/IR/Instruction.h"
17#include "llvm/IR/Instructions.h"
18#include "llvm/IR/Module.h"
19#include "llvm/IRReader/IRReader.h"
20#include "llvm/Pass.h"
21
22#include "lldb/Target/Process.h"
23#include "lldb/Utility/Log.h"
24
25using namespace lldb_private;
26namespace {
27
28bool isRSAPICall(llvm::Module &module, llvm::CallInst *call_inst) {
29  // TODO get the list of renderscript modules from lldb and check if
30  // this llvm::Module calls into any of them.
31  (void)module;
32  const auto func_name = call_inst->getCalledFunction()->getName();
33  if (func_name.startswith("llvm") || func_name.startswith("lldb"))
34    return false;
35
36  if (call_inst->getCalledFunction()->isIntrinsic())
37    return false;
38
39  return true;
40}
41
42bool isRSLargeReturnCall(llvm::Module &module, llvm::CallInst *call_inst) {
43  // i686 and x86_64 returns for large vectors in the RenderScript API are not
44  // handled as normal register pairs, but as a hidden sret type. This is not
45  // reflected in the debug info or mangled symbol name, and the android ABI
46  // for x86 and x86_64, (as well as the emulators) specifies there is no AVX,
47  // so bcc generates an sret function because we cannot natively return
48  // 256 bit vectors.
49  // This function simply checks whether a function has a > 128bit return type.
50  // It is perhaps an unreliable heuristic, and relies on bcc not generating
51  // AVX code, so if the android ABI one day provides for AVX, this function
52  // may go out of fashion.
53  (void)module;
54  if (!call_inst || !call_inst->getCalledFunction())
55    return false;
56
57  return call_inst->getCalledFunction()
58             ->getReturnType()
59             ->getPrimitiveSizeInBits() > 128;
60}
61
62bool isRSAllocationPtrTy(const llvm::Type *type) {
63  if (!type->isPointerTy())
64    return false;
65  auto ptr_type = type->getPointerElementType();
66
67  return ptr_type->isStructTy() &&
68         ptr_type->getStructName().startswith("struct.rs_allocation");
69}
70
71bool isRSAllocationTyCallSite(llvm::Module &module, llvm::CallInst *call_inst) {
72  (void)module;
73  if (!call_inst->hasByValArgument())
74    return false;
75  for (const auto *param : call_inst->operand_values())
76    if (isRSAllocationPtrTy(param->getType()))
77      return true;
78  return false;
79}
80
81llvm::FunctionType *cloneToStructRetFnTy(llvm::CallInst *call_inst) {
82  // on x86 StructReturn functions return a pointer to the return value, rather
83  // than the return value itself
84  // [ref](http://www.agner.org/optimize/calling_conventions.pdf section 6). We
85  // create a return type by getting the pointer type of the old return type,
86  // and inserting a new initial argument of pointer type of the original
87  // return type.
88  Log *log(
89      GetLogIfAnyCategoriesSet(LIBLLDB_LOG_LANGUAGE | LIBLLDB_LOG_EXPRESSIONS));
90
91  assert(call_inst && "no CallInst");
92  llvm::Function *orig = call_inst->getCalledFunction();
93  assert(orig && "CallInst has no called function");
94  llvm::FunctionType *orig_type = orig->getFunctionType();
95  auto name = orig->getName();
96  LLDB_LOGF(log, "%s - cloning to StructRet function for '%s'", __FUNCTION__,
97            name.str().c_str());
98
99  unsigned num_params = orig_type->getNumParams();
100  std::vector<llvm::Type *> new_params{num_params + 1, nullptr};
101  std::vector<llvm::Type *> params{orig_type->param_begin(),
102                                   orig_type->param_end()};
103
104  // This may not work if the function is somehow declared void as llvm is
105  // strongly typed and represents void* with i8*
106  assert(!orig_type->getReturnType()->isVoidTy() &&
107         "Cannot add StructRet attribute to void function");
108  llvm::PointerType *return_type_ptr_type =
109      llvm::PointerType::getUnqual(orig->getReturnType());
110  assert(return_type_ptr_type &&
111         "failed to get function return type PointerType");
112  if (!return_type_ptr_type)
113    return nullptr;
114
115  LLDB_LOGF(log,
116            "%s - return type pointer type for StructRet clone @ '0x%p':\n",
117            __FUNCTION__, (void *)return_type_ptr_type);
118  // put the sret pointer argument in place at the beginning of the
119  // argument list.
120  params.emplace(params.begin(), return_type_ptr_type);
121  assert(params.size() == num_params + 1);
122  return llvm::FunctionType::get(return_type_ptr_type, params,
123                                 orig->isVarArg());
124}
125
126bool findRSCallSites(llvm::Module &module,
127                     std::set<llvm::CallInst *> &rs_callsites,
128                     bool (*predicate)(llvm::Module &, llvm::CallInst *)) {
129  bool found = false;
130
131  for (auto &func : module.getFunctionList())
132    for (auto &block : func.getBasicBlockList())
133      for (auto &inst : block) {
134        llvm::CallInst *call_inst =
135            llvm::dyn_cast_or_null<llvm::CallInst>(&inst);
136        if (!call_inst || !call_inst->getCalledFunction())
137          // This is not the call-site you are looking for...
138          continue;
139        if (isRSAPICall(module, call_inst) && predicate(module, call_inst)) {
140          rs_callsites.insert(call_inst);
141          found = true;
142        }
143      }
144  return found;
145}
146
147bool fixupX86StructRetCalls(llvm::Module &module) {
148  bool changed = false;
149  // changing a basic block while iterating over it seems to have some
150  // undefined behaviour going on so we find all RS callsites first, then fix
151  // them up after consuming the iterator.
152  std::set<llvm::CallInst *> rs_callsites;
153  if (!findRSCallSites(module, rs_callsites, isRSLargeReturnCall))
154    return false;
155
156  for (auto call_inst : rs_callsites) {
157    llvm::FunctionType *new_func_type = cloneToStructRetFnTy(call_inst);
158    assert(new_func_type &&
159           "failed to clone functionType for Renderscript ABI fixup");
160
161    llvm::CallSite call_site(call_inst);
162    llvm::Function *func = call_inst->getCalledFunction();
163    assert(func && "cannot resolve function in RenderScriptRuntime");
164    // Copy the original call arguments
165    std::vector<llvm::Value *> new_call_args(call_site.arg_begin(),
166                                             call_site.arg_end());
167
168    // Allocate enough space to store the return value of the original function
169    // we pass a pointer to this allocation as the StructRet param, and then
170    // copy its value into the lldb return value
171    const llvm::DataLayout &DL = module.getDataLayout();
172    llvm::AllocaInst *return_value_alloc = new llvm::AllocaInst(
173      func->getReturnType(), DL.getAllocaAddrSpace(), "var_vector_return_alloc",
174      call_inst);
175    // use the new allocation as the new first argument
176    new_call_args.emplace(new_call_args.begin(),
177                          llvm::cast<llvm::Value>(return_value_alloc));
178    llvm::PointerType *new_func_ptr_type =
179        llvm::PointerType::get(new_func_type, 0);
180    // Create the type cast from the old function type to the new one
181    llvm::Constant *new_func_cast = llvm::ConstantExpr::getCast(
182        llvm::Instruction::BitCast, func, new_func_ptr_type);
183    // create an allocation for a new function pointer
184    llvm::AllocaInst *new_func_ptr =
185        new llvm::AllocaInst(new_func_ptr_type, DL.getAllocaAddrSpace(),
186                             "new_func_ptr", call_inst);
187    // store the new_func_cast to the newly allocated space
188    (new llvm::StoreInst(new_func_cast, new_func_ptr, call_inst))
189        ->setName("new_func_ptr_load_cast");
190    // load the new function address ready for a jump
191    llvm::LoadInst *new_func_addr_load =
192        new llvm::LoadInst(new_func_ptr, "load_func_pointer", call_inst);
193    // and create a callinstruction from it
194    llvm::CallInst *new_call_inst =
195        llvm::CallInst::Create(new_func_type, new_func_addr_load, new_call_args,
196                               "new_func_call", call_inst);
197    new_call_inst->setCallingConv(call_inst->getCallingConv());
198    new_call_inst->setTailCall(call_inst->isTailCall());
199    llvm::LoadInst *lldb_save_result_address =
200        new llvm::LoadInst(return_value_alloc, "save_return_val", call_inst);
201
202    // Now remove the old broken call
203    call_inst->replaceAllUsesWith(lldb_save_result_address);
204    call_inst->eraseFromParent();
205    changed = true;
206  }
207  return changed;
208}
209
210bool fixupRSAllocationStructByValCalls(llvm::Module &module) {
211  // On x86_64, calls to functions in the RS runtime that take an
212  // `rs_allocation` type argument are actually handled as by-ref params by
213  // bcc, but appear to be passed by value by lldb (the callsite all use
214  // `struct byval`). On x86_64 Linux, struct arguments are transferred in
215  // registers if the struct size is no bigger than 128bits
216  // [ref](http://www.agner.org/optimize/calling_conventions.pdf) section 7.1
217  // "Passing and returning objects" otherwise passed on the stack. an object
218  // of type `rs_allocation` is actually 256bits, so should be passed on the
219  // stack. However, code generated by bcc actually treats formal params of
220  // type `rs_allocation` as `rs_allocation *` so we need to convert the
221  // calling convention to pass by reference, and remove any hint of byval from
222  // formal parameters.
223  bool changed = false;
224  std::set<llvm::CallInst *> rs_callsites;
225  if (!findRSCallSites(module, rs_callsites, isRSAllocationTyCallSite))
226    return false;
227
228  std::set<llvm::Function *> rs_functions;
229
230  // for all call instructions
231  for (auto call_inst : rs_callsites) {
232    // add the called function to a set so that we can strip its byval
233    // attributes in another pass
234    rs_functions.insert(call_inst->getCalledFunction());
235
236    // get the function attributes
237    llvm::AttributeList call_attribs = call_inst->getAttributes();
238
239    // iterate over the argument attributes
240    for (unsigned I = call_attribs.index_begin(); I != call_attribs.index_end();
241         I++) {
242      // if this argument is passed by val
243      if (call_attribs.hasAttribute(I, llvm::Attribute::ByVal)) {
244        // strip away the byval attribute
245        call_inst->removeAttribute(I, llvm::Attribute::ByVal);
246        changed = true;
247      }
248    }
249  }
250
251  // for all called function decls
252  for (auto func : rs_functions) {
253    // inspect all of the arguments in the call
254    for (auto &arg : func->args()) {
255      if (arg.hasByValAttr()) {
256        arg.removeAttr(llvm::Attribute::ByVal);
257        changed = true;
258      }
259    }
260  }
261  return changed;
262}
263} // end anonymous namespace
264
265namespace lldb_private {
266namespace lldb_renderscript {
267
268bool fixupX86FunctionCalls(llvm::Module &module) {
269  return fixupX86StructRetCalls(module);
270}
271
272bool fixupX86_64FunctionCalls(llvm::Module &module) {
273  bool changed = false;
274  changed |= fixupX86StructRetCalls(module);
275  changed |= fixupRSAllocationStructByValCalls(module);
276  return changed;
277}
278
279} // end namespace lldb_renderscript
280} // end namespace lldb_private
281