[all-commits] [llvm/llvm-project] e97a3e: [X86] Add a Pass that builds a Condensed CFG for L...

[Scott Constable via All-commits]

  Branch: refs/heads/master
  Home:   https://github.com/llvm/llvm-project
  Commit: e97a3e5d9d428c4d455fa1b1982728bb71f0c397
      https://github.com/llvm/llvm-project/commit/e97a3e5d9d428c4d455fa1b1982728bb71f0c397
  Author: Scott Constable <scott.d.constable at intel.com>
  Date:   2020-05-11 (Mon, 11 May 2020)

  Changed paths:
    M clang/include/clang/Driver/Options.td
    M clang/lib/Driver/ToolChains/Arch/X86.cpp
    M clang/test/Driver/x86-target-features.c
    M llvm/lib/Target/X86/CMakeLists.txt
    A llvm/lib/Target/X86/ImmutableGraph.h
    M llvm/lib/Target/X86/X86.h
    M llvm/lib/Target/X86/X86.td
    A llvm/lib/Target/X86/X86LoadValueInjectionLoadHardening.cpp
    M llvm/lib/Target/X86/X86Subtarget.h
    M llvm/lib/Target/X86/X86TargetMachine.cpp
    M llvm/test/CodeGen/X86/O0-pipeline.ll
    M llvm/test/CodeGen/X86/O3-pipeline.ll
    A llvm/test/CodeGen/X86/lvi-hardening-gadget-graph.ll

  Log Message:
  -----------
  [X86] Add a Pass that builds a Condensed CFG for Load Value Injection (LVI) Gadgets

Adds a new data structure, ImmutableGraph, and uses RDF to find LVI gadgets and add them to a MachineGadgetGraph.

More specifically, a new X86 machine pass finds Load Value Injection (LVI) gadgets consisting of a load from memory (i.e., SOURCE), and any operation that may transmit the value loaded from memory over a covert channel, or use the value loaded from memory to determine a branch/call target (i.e., SINK).

Also adds a new target feature to X86: +lvi-load-hardening

The feature can be added via the clang CLI using -mlvi-hardening.

Differential Revision: https://reviews.llvm.org/D75936


  Commit: 8ce078c7503d4a7172dbb4ba01422f371a9d293f
      https://github.com/llvm/llvm-project/commit/8ce078c7503d4a7172dbb4ba01422f371a9d293f
  Author: Scott Constable <scott.d.constable at intel.com>
  Date:   2020-05-11 (Mon, 11 May 2020)

  Changed paths:
    M llvm/lib/Target/X86/X86LoadValueInjectionLoadHardening.cpp
    A llvm/test/CodeGen/X86/lvi-hardening-loads.ll

  Log Message:
  -----------
  [X86] Add Support for Load Hardening to Mitigate Load Value Injection (LVI)

After finding all such gadgets in a given function, the pass minimally inserts
LFENCE instructions in such a manner that the following property is satisfied:
for all SOURCE+SINK pairs, all paths in the CFG from SOURCE to SINK contain at
least one LFENCE instruction. The algorithm that implements this minimal
insertion is influenced by an academic paper that minimally inserts memory
fences for high-performance concurrent programs:

http://www.cs.ucr.edu/~lesani/companion/oopsla15/OOPSLA15.pdf

The algorithm implemented in this pass is as follows:

1. Build a condensed CFG (i.e., a GadgetGraph) consisting only of the following components:
  -SOURCE instructions (also includes function arguments)
  -SINK instructions
  -Basic block entry points
  -Basic block terminators
  -LFENCE instructions
2. Analyze the GadgetGraph to determine which SOURCE+SINK pairs (i.e., gadgets) are already mitigated by existing LFENCEs. If all gadgets have been mitigated, go to step 6.
3. Use a heuristic or plugin to approximate minimal LFENCE insertion.
4. Insert one LFENCE along each CFG edge that was cut in step 3.
5. Go to step 2.
6. If any LFENCEs were inserted, return true from runOnFunction() to tell LLVM that the function was modified.

By default, the heuristic used in Step 3 is a greedy heuristic that avoids
inserting LFENCEs into loops unless absolutely necessary. There is also a
CLI option to load a plugin that can provide even better optimization,
inserting fewer fences, while still mitigating all of the LVI gadgets.
The plugin can be found here: https://github.com/intel/lvi-llvm-optimization-plugin,
and a description of the pass's behavior with the plugin can be found here:
https://software.intel.com/security-software-guidance/insights/optimized-mitigation-approach-load-value-injection.

Differential Revision: https://reviews.llvm.org/D75937


Compare: https://github.com/llvm/llvm-project/compare/a1b04aaea210...8ce078c7503d