[PATCH] D75937: Add Support to X86 for Load Hardening to Mitigate Load Value Injection (LVI)

[Scott Constable via Phabricator via llvm-commits]

sconstab created this revision.
sconstab added reviewers: craig.topper, andrew.w.kaylor, chandlerc, zbrid.
Herald added subscribers: jfb, hiraditya.
Herald added a project: LLVM.

After finding all such gadgets in a given function, the pass minimally inserts LFENCE instructions in such a manner that the following property is satisfied: for all SOURCE+SINK pairs, all paths in the CFG from SOURCE to SINK contain at least one LFENCE instruction. The algorithm that implements this minimal insertion is influenced by an academic paper that minimally inserts memory fences for high-performance concurrent programs:

  http://www.cs.ucr.edu/~lesani/companion/oopsla15/OOPSLA15.pdf

The algorithm implemented in this pass is as follows:

1. Build a condensed CFG (i.e., a GadgetGraph) consisting only of the following components:
  - SOURCE instructions (also includes function arguments)
  - SINK instructions
  - Basic block entry points
  - Basic block terminators
  - LFENCE instructions
2. Analyze the GadgetGraph to determine which SOURCE+SINK pairs (i.e., gadgets) are already mitigated by existing LFENCEs. If all gadgets have been mitigated, go to step 6.
3. Use a heuristic or plugin to approximate minimal LFENCE insertion.
4. Insert one LFENCE along each CFG edge that was cut in step 3.
5. Go to step 2.
6. If any LFENCEs were inserted, return `true` from runOnFunction() to tell LLVM that the function was modified.

By default, the heuristic used in Step 3 is a greedy heuristic that avoids inserting LFENCEs into loops unless absolutely necessary. There is also a CLI option to load a plugin that can provide even better optimization, inserting fewer fences, while still mitigating all of the LVI gadgets.


https://reviews.llvm.org/D75937

Files:
  llvm/lib/Target/X86/X86LoadValueInjectionLoadHardening.cpp
  llvm/test/CodeGen/X86/lvi-hardening-loads.ll

-------------- next part --------------
A non-text attachment was scrubbed...
Name: D75937.249424.patch
Type: text/x-patch
Size: 19284 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20200310/1eea5db3/attachment-0001.bin>