X86SpeculativeLoadHardening.cpp File Reference

Provide a pass which mitigates speculative execution attacks which operate by speculating incorrectly past some predicate (a type check, bounds check, or other condition) to reach a load with invalid inputs and leak the data accessed by that load using a side channel out of the speculative domain. More...

#include "X86.h"
#include "X86InstrInfo.h"
#include "X86Subtarget.h"
#include "llvm/ADT/ArrayRef.h"
#include "llvm/ADT/DenseMap.h"
#include "llvm/ADT/STLExtras.h"
#include "llvm/ADT/SmallPtrSet.h"
#include "llvm/ADT/SmallSet.h"
#include "llvm/ADT/SmallVector.h"
#include "llvm/ADT/SparseBitVector.h"
#include "llvm/ADT/Statistic.h"
#include "llvm/CodeGen/MachineBasicBlock.h"
#include "llvm/CodeGen/MachineConstantPool.h"
#include "llvm/CodeGen/MachineFunction.h"
#include "llvm/CodeGen/MachineFunctionPass.h"
#include "llvm/CodeGen/MachineInstr.h"
#include "llvm/CodeGen/MachineInstrBuilder.h"
#include "llvm/CodeGen/MachineModuleInfo.h"
#include "llvm/CodeGen/MachineOperand.h"
#include "llvm/CodeGen/MachineRegisterInfo.h"
#include "llvm/CodeGen/MachineSSAUpdater.h"
#include "llvm/CodeGen/RegisterClassInfo.h"
#include "llvm/CodeGen/TargetInstrInfo.h"
#include "llvm/CodeGen/TargetRegisterInfo.h"
#include "llvm/CodeGen/TargetSchedule.h"
#include "llvm/CodeGen/TargetSubtargetInfo.h"
#include "llvm/IR/DebugLoc.h"
#include "llvm/MC/MCSchedule.h"
#include "llvm/Pass.h"
#include "llvm/Support/Debug.h"
#include "llvm/Support/raw_ostream.h"
#include "llvm/Target/TargetMachine.h"
#include <cassert>
#include <iterator>
#include <optional>

Go to the source code of this file.

Macros
#define	PASS_KEY   "x86-slh"
#define	DEBUG_TYPE   PASS_KEY

Functions
	STATISTIC (NumCondBranchesTraced, "Number of conditional branches traced")
	STATISTIC (NumBranchesUntraced, "Number of branches unable to trace")
	STATISTIC (NumAddrRegsHardened, "Number of address mode used registers hardened")
	STATISTIC (NumPostLoadRegsHardened, "Number of post-load register values hardened")
	STATISTIC (NumCallsOrJumpsHardened, "Number of calls or jumps requiring extra hardening")
	STATISTIC (NumInstsInserted, "Number of instructions inserted")
	STATISTIC (NumLFENCEsInserted, "Number of lfence instructions inserted")
static MachineBasicBlock &	splitEdge (MachineBasicBlock &MBB, MachineBasicBlock &Succ, int SuccCount, MachineInstr *Br, MachineInstr *&UncondBr, const X86InstrInfo &TII)
static void	canonicalizePHIOperands (MachineFunction &MF)
	Removing duplicate PHI operands to leave the PHI in a canonical and predictable form.
static bool	hasVulnerableLoad (MachineFunction &MF)
	Helper to scan a function for loads vulnerable to misspeculation that we want to harden.
static const TargetRegisterClass *	getRegClassForUnfoldedLoad (const X86InstrInfo &TII, unsigned Opcode)
	Compute the register class for the unfolded load.
static bool	isEFLAGSDefLive (const MachineInstr &MI)
static bool	isEFLAGSLive (MachineBasicBlock &MBB, MachineBasicBlock::iterator I, const TargetRegisterInfo &TRI)
	INITIALIZE_PASS_BEGIN (X86SpeculativeLoadHardeningLegacy, PASS_KEY, "X86 speculative load hardener", false, false) INITIALIZE_PASS_END(X86SpeculativeLoadHardeningLegacy

Variables
	PASS_KEY
X86 speculative load	hardener
X86 speculative load	false

Detailed Description

Provide a pass which mitigates speculative execution attacks which operate by speculating incorrectly past some predicate (a type check, bounds check, or other condition) to reach a load with invalid inputs and leak the data accessed by that load using a side channel out of the speculative domain.

For details on the attacks, see the first variant in both the Project Zero writeup and the Spectre paper: https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html https://spectreattack.com/spectre.pdf

Definition in file X86SpeculativeLoadHardening.cpp.

Macro Definition Documentation

DEBUG_TYPE

#define DEBUG_TYPE   PASS_KEY

Definition at line 61 of file X86SpeculativeLoadHardening.cpp.

PASS_KEY

#define PASS_KEY   "x86-slh"

Definition at line 60 of file X86SpeculativeLoadHardening.cpp.

Function Documentation

canonicalizePHIOperands()

void canonicalizePHIOperands ( MachineFunction & MF )

static

Removing duplicate PHI operands to leave the PHI in a canonical and predictable form.

FIXME: It's really frustrating that we have to do this, but SSA-form in MIR isn't what you might expect. We may have multiple entries in PHI nodes for a single predecessor. This makes CFG-updating extremely complex, so here we simplify all PHI nodes to a model even simpler than the IR's model: exactly one entry per predecessor, regardless of how many edges there are.

Definition at line 298 of file X86SpeculativeLoadHardening.cpp.

References AbstractManglingParser< Derived, Alloc >::NumOps, llvm::SmallPtrSetImplBase::clear(), llvm::SmallVectorTemplateCommon< T, typename >::empty(), llvm::SmallPtrSetImpl< PtrType >::insert(), MBB, MI, llvm::SmallVectorImpl< T >::pop_back_val(), and llvm::SmallVectorTemplateBase< T, bool >::push_back().

getRegClassForUnfoldedLoad()

const TargetRegisterClass * getRegClassForUnfoldedLoad ( const X86InstrInfo & TII, unsigned Opcode )

static

Compute the register class for the unfolded load.

FIXME: This should probably live in X86InstrInfo, potentially by adding a way to unfold into a newly created vreg rather than requiring a register input.

Definition at line 807 of file X86SpeculativeLoadHardening.cpp.

References TII.

hasVulnerableLoad()

bool hasVulnerableLoad ( MachineFunction & MF )

static

Helper to scan a function for loads vulnerable to misspeculation that we want to harden.

We use this to avoid making changes to functions where there is nothing we need to do to harden against misspeculation.

Definition at line 341 of file X86SpeculativeLoadHardening.cpp.

References MBB, and MI.

INITIALIZE_PASS_BEGIN()

INITIALIZE_PASS_BEGIN	(	X86SpeculativeLoadHardeningLegacy	,
		PASS_KEY	,
		"X86 speculative load hardener"	,
		false	,
		false	)

References PASS_KEY.

isEFLAGSDefLive()

bool isEFLAGSDefLive ( const MachineInstr & MI )

static

Definition at line 1170 of file X86SpeculativeLoadHardening.cpp.

References MI.

isEFLAGSLive()

bool isEFLAGSLive ( MachineBasicBlock & MBB, MachineBasicBlock::iterator I, const TargetRegisterInfo & TRI )

static

Definition at line 1178 of file X86SpeculativeLoadHardening.cpp.

References I, llvm::make_range(), MBB, MI, llvm::reverse(), and TRI.

splitEdge()

MachineBasicBlock & splitEdge ( MachineBasicBlock & MBB, MachineBasicBlock & Succ, int SuccCount, MachineInstr * Br, MachineInstr *& UncondBr, const X86InstrInfo & TII )

static

Definition at line 194 of file X86SpeculativeLoadHardening.cpp.

References AbstractManglingParser< Derived, Alloc >::NumOps, llvm::MachineBasicBlock::addLiveIn(), llvm::MachineInstrBuilder::addMBB(), llvm::MachineBasicBlock::addSuccessor(), assert(), llvm::BuildMI(), Cond, llvm::MachineFunction::CreateMachineBasicBlock(), llvm::MachineOperand::CreateMBB(), llvm::dbgs(), llvm::dwarf_linker::DebugLoc, llvm::MachineInstr::getDebugLoc(), llvm::MachineOperand::getMBB(), llvm::MachineBasicBlock::getName(), llvm::MachineInstr::getOperand(), llvm::MachineFunction::insert(), llvm::MachineBasicBlock::isEHPad(), llvm::MachineBasicBlock::isLayoutSuccessor(), llvm::MachineOperand::isMBB(), llvm::MachineBasicBlock::liveins(), LLVM_DEBUG, MBB, MI, llvm::MachineOperand::setMBB(), and TII.

STATISTIC() [1/7]

STATISTIC	(	NumAddrRegsHardened	,
		"Number of address mode used registers hardened"	)

STATISTIC() [2/7]

STATISTIC	(	NumBranchesUntraced	,
		"Number of branches unable to trace"	)

STATISTIC() [3/7]

STATISTIC	(	NumCallsOrJumpsHardened	,
		"Number of calls or jumps requiring extra hardening"	)

STATISTIC() [4/7]

STATISTIC	(	NumCondBranchesTraced	,
		"Number of conditional branches traced"	)

STATISTIC() [5/7]

STATISTIC	(	NumInstsInserted	,
		"Number of instructions inserted"	)

STATISTIC() [6/7]

STATISTIC	(	NumLFENCEsInserted	,
		"Number of lfence instructions inserted"	)

STATISTIC() [7/7]

STATISTIC	(	NumPostLoadRegsHardened	,
		"Number of post-load register values hardened"	)

Variable Documentation

false

X86 speculative load false

Definition at line 2245 of file X86SpeculativeLoadHardening.cpp.

hardener

X86 speculative load hardener

Definition at line 2245 of file X86SpeculativeLoadHardening.cpp.

PASS_KEY

PASS_KEY

Definition at line 2244 of file X86SpeculativeLoadHardening.cpp.