This is an archive of the discontinued LLVM Phabricator instance.

[ARM] Implement harden-sls-retbr for ARM mode
ClosedPublic

Authored by kristof.beyls on Dec 1 2020, 8:17 AM.

Details

Summary

Some processors may speculatively execute the instructions immediately
following indirect control flow, such as returns, indirect jumps and
indirect function calls.

To avoid a potential miss-speculatively executed gadget after these
instructions leaking secrets through side channels, this pass places a
speculation barrier immediately after every indirect control flow where
control flow doesn't return to the next instruction, such as returns and
indirect jumps, but not indirect function calls.

Hardening of indirect function calls will be done in a later,
independent patch.

This patch is implementing the same functionality as the AArch64 counter
part implemented in https://reviews.llvm.org/D81400.
For AArch64, returns and indirect jumps only occur on RET and BR
instructions and hence the function attribute to control the hardening
is called "harden-sls-retbr" there. On AArch32, there is a wider
variety of instructions that can trigger an indirect unconditional
control flow change. I've decided to stick with the name
"harden-sls-retbr" as introduced for the corresponding AArch64
mitigation.

This patch implements this for ARM mode. A future patch will extend this
to also support Thumb mode.

The inserted barriers are never on the correct, architectural execution
path, and therefore performance overhead of this is expected to be low.
To ensure these barriers are never on an architecturally executed path,
when the harden-sls-retbr function attribute is present, indirect
control flow is never conditionalized/predicated.

On targets that implement that Armv8.0-SB Speculation Barrier extension,
a single SB instruction is emitted that acts as a speculation barrier.
On other targets, a DSB SYS followed by a ISB is emitted to act as a
speculation barrier.

These speculation barriers are implemented as pseudo instructions to
avoid later passes to analyze them and potentially remove them.

The mitigation is off by default and can be enabled by the
harden-sls-retbr subtarget feature.

Diff Detail

Event Timeline

kristof.beyls created this revision.Dec 1 2020, 8:17 AM
Herald added a project: Restricted Project. · View Herald TranscriptDec 1 2020, 8:17 AM
kristof.beyls requested review of this revision.Dec 1 2020, 8:17 AM
ostannard added inline comments.Dec 17 2020, 1:41 AM
llvm/lib/Target/ARM/ARMBaseInstrInfo.cpp
341

s/values and predicated/values, predicated/

684

Should this be above the return isV8EligibleForIT(&MI); above?

Updated patch based on review feedback.

kristof.beyls marked 2 inline comments as done.Dec 18 2020, 6:02 AM
kristof.beyls added inline comments.
llvm/lib/Target/ARM/ARMBaseInstrInfo.cpp
684

Thanks for catching that, now fixed.

This revision is now accepted and ready to land.Dec 18 2020, 6:18 AM
This revision was automatically updated to reflect the committed changes.
kristof.beyls marked an inline comment as done.