[all-commits] [llvm/llvm-project] 0ee176: [AArch64] Introduce AArch64SLSHardeningPass, imple...

[Kristof Beyls via All-commits]

  Branch: refs/heads/master
  Home:   https://github.com/llvm/llvm-project
  Commit: 0ee176edc8b4a6f20527e907bfd026b07a27e7ef
      https://github.com/llvm/llvm-project/commit/0ee176edc8b4a6f20527e907bfd026b07a27e7ef
  Author: Kristof Beyls <kristof.beyls at arm.com>
  Date:   2020-06-11 (Thu, 11 Jun 2020)

  Changed paths:
    M llvm/lib/Target/AArch64/AArch64.h
    M llvm/lib/Target/AArch64/AArch64.td
    M llvm/lib/Target/AArch64/AArch64AsmPrinter.cpp
    M llvm/lib/Target/AArch64/AArch64InstrInfo.cpp
    M llvm/lib/Target/AArch64/AArch64InstrInfo.h
    M llvm/lib/Target/AArch64/AArch64InstrInfo.td
    A llvm/lib/Target/AArch64/AArch64SLSHardening.cpp
    M llvm/lib/Target/AArch64/AArch64Subtarget.h
    M llvm/lib/Target/AArch64/AArch64TargetMachine.cpp
    M llvm/lib/Target/AArch64/CMakeLists.txt
    M llvm/test/CodeGen/AArch64/O0-pipeline.ll
    M llvm/test/CodeGen/AArch64/O3-pipeline.ll
    A llvm/test/CodeGen/AArch64/speculation-hardening-sls.ll
    A llvm/test/CodeGen/AArch64/speculation-hardening-sls.mir

  Log Message:
  -----------
  [AArch64] Introduce AArch64SLSHardeningPass, implementing hardening of RET and BR instructions.

Some processors may speculatively execute the instructions immediately
following RET (returns) and BR (indirect jumps), even though
control flow should change unconditionally at these instructions.
To avoid a potential miss-speculatively executed gadget after these
instructions leaking secrets through side channels, this pass places a
speculation barrier immediately after every RET and BR instruction.

Since these barriers are never on the correct, architectural execution
path, performance overhead of this is expected to be low.

On targets that implement that Armv8.0-SB Speculation Barrier extension,
a single SB instruction is emitted that acts as a speculation barrier.
On other targets, a DSB SYS followed by a ISB is emitted to act as a
speculation barrier.

These speculation barriers are implemented as pseudo instructions to
avoid later passes to analyze them and potentially remove them.

Even though currently LLVM does not produce BRAA/BRAB/BRAAZ/BRABZ
instructions, these are also mitigated by the pass and tested through a
MIR test.

The mitigation is off by default and can be enabled by the
harden-sls-retbr subtarget feature.

Differential Revision:  https://reviews.llvm.org/D81400