[PATCH] D42453: Use branch funnels for virtual calls when retpoline mitigation is enabled.

[Peter Collingbourne via Phabricator via llvm-commits]

pcc created this revision.
pcc added reviewers: eugenis, vlad.tsyrklevich.
Herald added subscribers: mgrang, hiraditya, Prazek, mehdi_amini.

The retpoline mitigation for variant 2 of CVE-2017-5715 inhibits the
branch predictor, and as a result it can lead to a measurable loss of
performance. We can reduce the performance impact of retpolined virtual
calls by replacing them with a special construct known as a branch
funnel, which is an instruction sequence that implements virtual calls
to a set of known targets using a binary tree of direct branches. This
allows the processor to speculately execute valid implementations of the
virtual function without allowing for speculative execution of of calls
to arbitrary addresses.

This patch extends the whole-program devirtualization pass to replace
certain virtual calls with calls to branch funnels, which are
represented using a new llvm.icall.jumptable intrinsic. It also extends
the LowerTypeTests pass to recognize the new intrinsic, generate code
for the branch funnels (x86_64 only for now) and lay out virtual tables
as required for each branch funnel.

The implementation supports full LTO as well as ThinLTO, and extends the
ThinLTO summary format used for whole-program devirtualization to
support branch funnels.

For more details see RFC:
http://lists.llvm.org/pipermail/llvm-dev/2018-January/120672.html


https://reviews.llvm.org/D42453

Files:
  compiler-rt/test/cfi/simple-pass.cpp
  llvm/include/llvm/ADT/PointerUnion.h
  llvm/include/llvm/IR/Intrinsics.td
  llvm/include/llvm/IR/ModuleSummaryIndex.h
  llvm/include/llvm/IR/ModuleSummaryIndexYAML.h
  llvm/lib/Transforms/IPO/LowerTypeTests.cpp
  llvm/lib/Transforms/IPO/WholeProgramDevirt.cpp
  llvm/test/Transforms/LowerTypeTests/icall-jumptable.ll
  llvm/test/Transforms/WholeProgramDevirt/Inputs/import-jumptable.yaml
  llvm/test/Transforms/WholeProgramDevirt/Inputs/import-vcp-jumptable.yaml
  llvm/test/Transforms/WholeProgramDevirt/import.ll
  llvm/test/Transforms/WholeProgramDevirt/jumptable.ll

-------------- next part --------------
A non-text attachment was scrubbed...
Name: D42453.131172.patch
Type: text/x-patch
Size: 52609 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20180124/718b7555/attachment.bin>