[PATCH] D92468: [ARM] Harden indirect calls against SLS

[Kristof Beyls via Phabricator via llvm-commits]

kristof.beyls created this revision.
kristof.beyls added a reviewer: ostannard.
Herald added subscribers: llvm-commits, danielkiss, nikic, hiraditya.
Herald added a project: LLVM.
kristof.beyls requested review of this revision.

To make sure that no barrier gets placed on the architectural execution
path, each indirect call calling the function in register rN, it gets
transformed to a direct call to __llvm_slsblr_thunk_mode_rN.
mode is either arm or thumb, depending on the mode of where the indirect
call happens.

The llvm_slsblr_thunk_mode_rN thunk contains:

bx rN
<speculation barrier>

Therefore, the indirect call gets split into 2; one direct call and
one indirect jump.
This transformation results in not inserting a speculation barrier on
the architectural execution path.

The mitigation is off by default and can be enabled by the
harden-sls-blr subtarget feature.

As a linker is allowed to clobber r12 on function calls, the
above code transformation is not correct in case a linker does so.
Similarly, the transformation is not correct when register lr is used.
Avoiding r12/lr being used is done in a follow-on patch to make reviewing
this code easier.


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D92468

Files:
  llvm/lib/Target/ARM/ARM.h
  llvm/lib/Target/ARM/ARM.td
  llvm/lib/Target/ARM/ARMBaseInstrInfo.cpp
  llvm/lib/Target/ARM/ARMBaseInstrInfo.h
  llvm/lib/Target/ARM/ARMSLSHardening.cpp
  llvm/lib/Target/ARM/ARMSubtarget.h
  llvm/lib/Target/ARM/ARMTargetMachine.cpp
  llvm/test/CodeGen/ARM/O3-pipeline.ll
  llvm/test/CodeGen/ARM/speculation-hardening-sls.ll

-------------- next part --------------
A non-text attachment was scrubbed...
Name: D92468.308913.patch
Type: text/x-patch
Size: 23978 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20201202/b9a41422/attachment.bin>