Introducing __builtin_speculation_safe_value

[kristof.beyls]

Summary

This is part of implementing a technique to mitigate against Spectre v1,
similar in spirit to what has been proposed by Chandler for X86_64 at
http://lists.llvm.org/pipermail/llvm-dev/2018-March/122085.html.

This patch adds a new builtin function that provides a mechanism for
limiting the effects of miss-speculation by a CPU.
This patch provides the clang-side of the needed functionality; there is
also an llvm-side patch this patch is dependent on.

We've tried to design this in such a way that it can be used for any
target where this might be necessary. The patch provides a generic
implementation of the builtin, with most of the target-specific
support in the LLVM counter part to this clang patch.

The signature of the new, polymorphic, builtin is:

T __builtin_speculation_safe_value(T v)

T can be any integral type (signed or unsigned char, int, short, long,
etc) or any pointer type.

The builtin assures that value v will be made 0 on execution paths that
are being executed under control flow miss-speculation by the CPU, when
the miss-speculated path originated due to misprediction of a direct
conditional branch.

Whereas this still leaves open the possibility of execution on a
miss-speculated path starting at misprediction of other control flow
instructions, our believe is that the above guarantee is still useful in
mitigating vulnerability to Spectre v1-style attacks and implementable
for most, if not all, target instruction sets.

This also introduces the predefined pre-processor macro
__HAVE_SPECULATION_SAFE_VALUE, that allows users to check if their
version of the compiler supports this intrinsic.

include/clang/Basic/Builtins.def

 BUILTIN(__xray_customevent, "vcC*z", "")
 BUILTIN(__xray_typedevent, "vzcC*z", "")
 
 // Win64-compatible va_list functions
 BUILTIN(__builtin_ms_va_start, "vc*&.", "nt")
 BUILTIN(__builtin_ms_va_end, "vc*&", "n")
 BUILTIN(__builtin_ms_va_copy, "vc*&c*&", "n")
 
+// T __builtin_speculation_safe_value (T val)
+BUILTIN(__builtin_speculation_safe_value, "vv", "t")
+
 #undef BUILTIN
 #undef LIBBUILTIN
 #undef LANGBUILTIN

include/clang/Basic/DiagnosticSemaKinds.td

def err_spaceship_argument_narrowing : Error<
   "%select{cannot be narrowed from type %1 to %2|"
   "evaluates to %1, which cannot be narrowed to type %2}0">;
 def err_std_compare_type_not_supported : Error<
   "standard library implementation of %0 is not supported; "
    "%select{member '%2' does not have expected form|"
    "member '%2' is missing|"
    "the type is not trivially copyable|"
    "the type does not have the expected form}1">;
+
+def err_specsafevalue_builtin_must_be_pointer_or_integral : Error<
+  "argument to speculation_safe_value builtin must be a pointer or integer "
+  "(%0 invalid)">;
 } // end of sema component.

include/clang/Sema/Sema.h

   bool SemaBuiltinLongjmp(CallExpr *TheCall);
   bool SemaBuiltinSetjmp(CallExpr *TheCall);
   ExprResult SemaBuiltinAtomicOverloaded(ExprResult TheCallResult);
   ExprResult SemaBuiltinNontemporalOverloaded(ExprResult TheCallResult);
   ExprResult SemaAtomicOpsOverloaded(ExprResult TheCallResult,
                                      AtomicExpr::AtomicOp Op);
   ExprResult SemaBuiltinOperatorNewDeleteOverloaded(ExprResult TheCallResult,
                                                     bool IsDelete);
+  ExprResult
+  SemaBuiltinSpeculationSafeValueOverloaded(ExprResult TheCallResult);
   bool SemaBuiltinConstantArg(CallExpr *TheCall, int ArgNum,
                               llvm::APSInt &Result);
   bool SemaBuiltinConstantArgRange(CallExpr *TheCall, int ArgNum, int Low,
                                    int High, bool RangeIsError = true);
   bool SemaBuiltinConstantArgMultiple(CallExpr *TheCall, int ArgNum,
                                       unsigned Multiple);
   bool SemaBuiltinARMSpecialReg(unsigned BuiltinID, CallExpr *TheCall,
                                 int ArgNum, unsigned ExpectedFieldNum,

lib/CodeGen/CGBuiltin.cpp

case Builtin::BI__builtin_ms_va_copy: {
     DestAddr = Address(Builder.CreateBitCast(DestAddr.getPointer(), BPP, "cp"),
                        DestAddr.getAlignment());
     SrcAddr = Address(Builder.CreateBitCast(SrcAddr.getPointer(), BPP, "ap"),
                       SrcAddr.getAlignment());
 
     Value *ArgPtr = Builder.CreateLoad(SrcAddr, "ap.val");
     return RValue::get(Builder.CreateStore(ArgPtr, DestAddr));
   }
+
+  case Builtin::BI__builtin_speculation_safe_value: {
+    Value *Val = EmitScalarExpr(E->getArg(0));
+
+    llvm::Type *T = ConvertType(E->getType());
+    assert((isa<llvm::IntegerType>(T) || isa<llvm::PointerType>(T)) &&
+           "unsupported type");
+
+    return RValue::get(Builder.CreateCall(
+        CGM.getIntrinsic(Intrinsic::speculationsafevalue, T), {Val}));
+  }
   }
 
   // If this is an alias for a lib function (e.g. __builtin_sin), emit
   // the call using the normal call path, but using the unmangled
   // version of the function name.
   if (getContext().BuiltinInfo.isLibFunction(BuiltinID))
     return emitLibraryCall(*this, FD, E,
                            CGM.getBuiltinLibFunction(FD, BuiltinID));

lib/Frontend/InitPreprocessor.cpp

#include "clang/Basic/OpenCLExtensions.def"
   if (TI.hasInt128Type() && LangOpts.CPlusPlus && LangOpts.GNUMode) {
     // For each extended integer type, g++ defines a macro mapping the
     // index of the type (0 in this case) in some list of extended types
     // to the type.
     Builder.defineMacro("__GLIBCXX_TYPE_INT_N_0", "__int128");
     Builder.defineMacro("__GLIBCXX_BITSIZE_INT_N_0", "128");
   }
 
+  Builder.defineMacro("__HAVE_SPECULATION_SAFE_VALUE");
+
   // Get other target #defines.
   TI.getTargetDefines(LangOpts, Builder);
 }
 
 /// InitializePreprocessor - Initialize the preprocessor getting it and the
 /// environment ready to process a single file. This returns true on error.
 ///
 void clang::InitializePreprocessor(

lib/Sema/SemaChecking.cpp

case Builtin::BIget_kernel_sub_group_count_for_ndrange:
     if (SemaOpenCLBuiltinNDRangeAndBlock(*this, TheCall))
       return ExprError();
     break;
   case Builtin::BI__builtin_os_log_format:
   case Builtin::BI__builtin_os_log_format_buffer_size:
     if (SemaBuiltinOSLogFormat(TheCall))
       return ExprError();
     break;
+  case Builtin::BI__builtin_speculation_safe_value:
+    return SemaBuiltinSpeculationSafeValueOverloaded(TheCallResult);
   }
 
   // Since the target specific builtins for each arch overlap, only check those
   // of the arch we are compiling for.
   if (Context.BuiltinInfo.isTSBuiltin(BuiltinID)) {
     switch (Context.getTargetInfo().getTriple().getArch()) {
       case llvm::Triple::arm:
       case llvm::Triple::armeb:
ExprResult Sema::SemaBuiltinNontemporalOverloaded(ExprResult TheCallResult) {
   if (ValArg.isInvalid())
     return ExprError();
 
   TheCall->setArg(0, ValArg.get());
   TheCall->setType(Context.VoidTy);
   return TheCallResult;
 }
 
+ExprResult
+Sema::SemaBuiltinSpeculationSafeValueOverloaded(ExprResult TheCallResult) {
+  CallExpr *TheCall = (CallExpr *)TheCallResult.get();
+  DeclRefExpr *DRE =
+      cast<DeclRefExpr>(TheCall->getCallee()->IgnoreParenCasts());
+  FunctionDecl *FDecl = cast<FunctionDecl>(DRE->getDecl());
+  unsigned BuiltinID = FDecl->getBuiltinID();
+  assert(BuiltinID == Builtin::BI__builtin_speculation_safe_value &&
+         "Unexpected speculation_safe_value builtin!");
+
+  // Too few args.
+  if (TheCall->getNumArgs() < 1)
+    return Diag(TheCall->getLocEnd(),
+                diag::err_typecheck_call_too_few_args_at_least)
+           << 0 /*function call*/ << 1 /* min args */ << TheCall->getNumArgs();
+
+  // Too many args.
+  if (TheCall->getNumArgs() > 1)
+    return Diag(TheCall->getArg(1)->getLocStart(),
+                diag::err_typecheck_call_too_many_args_at_most)
+           << 0 /*function call*/ << 1 << TheCall->getNumArgs()
+           << SourceRange(TheCall->getArg(1)->getLocStart(),
+                          (*(TheCall->arg_end() - 1))->getLocEnd());
+
+  // Derive the return type from the pointer argument.
+  ExprResult FirstArg =
+      DefaultFunctionArrayLvalueConversion(TheCall->getArg(0));
+  if (FirstArg.isInvalid())
+    return true;
+  TheCall->setArg(0, FirstArg.get());
+  QualType FirstArgType = FirstArg.get()->getType();
+
+  TheCall->setType(FirstArgType);
+
+  // The first argument must be an integer or pointer type.
+  if (!(FirstArgType->isIntegerType() || FirstArgType->isAnyPointerType()))
+    return Diag(TheCall->getArg(0)->getLocStart(),
+                diag::err_specsafevalue_builtin_must_be_pointer_or_integral)
+           << TheCall->getArg(0)->getType()
+           << TheCall->getArg(0)->getSourceRange();
+
+  return TheCallResult;
+}
+
 /// CheckObjCString - Checks that the argument to the builtin
 /// CFString constructor is correct
 /// Note: It might also make sense to do the UTF-16 conversion here (would
 /// simplify the backend).
 bool Sema::CheckObjCString(Expr *Arg) {
   Arg = Arg->IgnoreParenCasts();
   StringLiteral *Literal = dyn_cast<StringLiteral>(Arg);
 

test/CodeGen/builtin-speculation-safe-value.c

+// REQUIRES: aarch64-registered-target
+// RUN: %clang_cc1 -triple aarch64-linux-gnu -emit-llvm %s -o - | FileCheck -check-prefix=CHECK-SUPPORTED %s
+
+void test(char c, int i, void *p) {
+  // CHECK-LABEL-SUPPORTED: define void @test
+
+  char c_safe = __builtin_speculation_safe_value(c);
+  // CHECK-SUPPORTED: call i8 @llvm.speculationsafevalue.i8(i8 %{{[0-9a-z]+}})
+
+  int i_safe = __builtin_speculation_safe_value(i);
+  // CHECK-SUPPORTED: call i32 @llvm.speculationsafevalue.i32(i32 %{{[0-9a-z]+}})
+
+  void *p_safe = __builtin_speculation_safe_value(p);
+  // CHECK-SUPPORTED: call i8* @llvm.speculationsafevalue.p0i8(i8* %{{[0-9a-z]+}})
+
+  int arr[4];
+  int *arr_safe = __builtin_speculation_safe_value(arr);
+  // CHECK-SUPPORTED: call i32* @llvm.speculationsafevalue.p0i32(i32* %{{[0-9a-z]+}})
+}

test/Preprocessor/init.c

 // WEBASSEMBLY32-NEXT:#define __GCC_ATOMIC_SHORT_LOCK_FREE 2
 // WEBASSEMBLY32-NEXT:#define __GCC_ATOMIC_TEST_AND_SET_TRUEVAL 1
 // WEBASSEMBLY32-NEXT:#define __GCC_ATOMIC_WCHAR_T_LOCK_FREE 2
 // WEBASSEMBLY32-NEXT:#define __GNUC_MINOR__ {{.*}}
 // WEBASSEMBLY32-NEXT:#define __GNUC_PATCHLEVEL__ {{.*}}
 // WEBASSEMBLY32-NEXT:#define __GNUC_STDC_INLINE__ 1
 // WEBASSEMBLY32-NEXT:#define __GNUC__ {{.*}}
 // WEBASSEMBLY32-NEXT:#define __GXX_ABI_VERSION 1002
+// WEBASSEMBLY32-NEXT:#define __HAVE_SPECULATION_SAFE_VALUE 1
 // WEBASSEMBLY32-NEXT:#define __ILP32__ 1
 // WEBASSEMBLY32-NEXT:#define __INT16_C_SUFFIX__
 // WEBASSEMBLY32-NEXT:#define __INT16_FMTd__ "hd"
 // WEBASSEMBLY32-NEXT:#define __INT16_FMTi__ "hi"
 // WEBASSEMBLY32-NEXT:#define __INT16_MAX__ 32767
 // WEBASSEMBLY32-NEXT:#define __INT16_TYPE__ short
 // WEBASSEMBLY32-NEXT:#define __INT32_C_SUFFIX__
 // WEBASSEMBLY32-NEXT:#define __INT32_FMTd__ "d"

 // WEBASSEMBLY64-NEXT:#define __GCC_ATOMIC_SHORT_LOCK_FREE 2
 // WEBASSEMBLY64-NEXT:#define __GCC_ATOMIC_TEST_AND_SET_TRUEVAL 1
 // WEBASSEMBLY64-NEXT:#define __GCC_ATOMIC_WCHAR_T_LOCK_FREE 2
 // WEBASSEMBLY64-NEXT:#define __GNUC_MINOR__ {{.*}}
 // WEBASSEMBLY64-NEXT:#define __GNUC_PATCHLEVEL__ {{.*}}
 // WEBASSEMBLY64-NEXT:#define __GNUC_STDC_INLINE__ 1
 // WEBASSEMBLY64-NEXT:#define __GNUC__ {{.}}
 // WEBASSEMBLY64-NEXT:#define __GXX_ABI_VERSION 1002
+// WEBASSEMBLY64-NEXT:#define __HAVE_SPECULATION_SAFE_VALUE 1
 // WEBASSEMBLY64-NOT:#define __ILP32__
 // WEBASSEMBLY64-NEXT:#define __INT16_C_SUFFIX__
 // WEBASSEMBLY64-NEXT:#define __INT16_FMTd__ "hd"
 // WEBASSEMBLY64-NEXT:#define __INT16_FMTi__ "hi"
 // WEBASSEMBLY64-NEXT:#define __INT16_MAX__ 32767
 // WEBASSEMBLY64-NEXT:#define __INT16_TYPE__ short
 // WEBASSEMBLY64-NEXT:#define __INT32_C_SUFFIX__
 // WEBASSEMBLY64-NEXT:#define __INT32_FMTd__ "d"

test/Sema/builtin-speculation-safe-value.c

+// REQUIRES: aarch64-registered-target
+// RUN: %clang_cc1 -triple aarch64 -DENABLE_ERRORS -verify %s
+// RUN: %clang_cc1 -triple aarch64 %s -emit-llvm -o -
+
+void test_type() {
+  char c;
+  c = __builtin_speculation_safe_value(c);
+
+  short s;
+  s = __builtin_speculation_safe_value(s);
+
+  int i;
+  i = __builtin_speculation_safe_value(i);
+
+  long l;
+  l = __builtin_speculation_safe_value(l);
+
+  long long ll;
+  ll = __builtin_speculation_safe_value(ll);
+
+  int *ip;
+  ip = __builtin_speculation_safe_value(ip);
+
+  int (*fp)(int, int);
+  fp = __builtin_speculation_safe_value(fp);
+
+  enum {e1, e2} e;
+  e = __builtin_speculation_safe_value(e);
+
+#ifdef ENABLE_ERRORS
+  float f;
+  f = __builtin_speculation_safe_value(f); // expected-error {{argument to speculation_safe_value builtin must be a pointer or integer ('float' invalid)}}
+
+  struct S { int a; } S;
+  S = __builtin_speculation_safe_value(S); // expected-error {{argument to speculation_safe_value builtin must be a pointer or integer ('struct S' invalid)}}
+
+  union U { int a; } U;
+  U = __builtin_speculation_safe_value(U); // expected-error {{argument to speculation_safe_value builtin must be a pointer or integer ('union U' invalid)}}
+
+  char __attribute__((vector_size(16))) v;
+  v = __builtin_speculation_safe_value(v); // expected-error {{argument to speculation_safe_value builtin must be a pointer or integer ('__attribute__((__vector_size__(16 * sizeof(char)))) char' (vector of 16 'char' values) invalid)}}
+
+  c = __builtin_speculation_safe_value(); // expected-error {{too few arguments to function call, expected at least 1, have 0}}
+  c = __builtin_speculation_safe_value(c, s); // expected-error {{too many arguments to function call, expected at most 1, have 2}}
+#endif
+}

test/Sema/builtin-speculation-safe-value.cpp

+// REQUIRES: aarch64-registered-target
+// RUN: %clang_cc1 -triple aarch64 -x c++ -std=c++11 -DENABLE_ERRORS -verify %s
+// RUN: %clang_cc1 -triple aarch64 -x c++ -std=c++11 %s -emit-llvm -o -
+
+void test_type() {
+  char c;
+  c = __builtin_speculation_safe_value(c);
+
+  short s;
+  s = __builtin_speculation_safe_value(s);
+
+  int i;
+  i = __builtin_speculation_safe_value(i);
+
+  long l;
+  l = __builtin_speculation_safe_value(l);
+
+  long long ll;
+  ll = __builtin_speculation_safe_value(ll);
+
+  int *ip;
+  ip = __builtin_speculation_safe_value(ip);
+
+  int (*fp)(int, int);
+  fp = __builtin_speculation_safe_value(fp);
+
+  enum {e1, e2} e;
+  e = __builtin_speculation_safe_value(e);
+
+#ifdef enable_errors
+  float f;
+  f = __builtin_speculation_safe_value(f); // expected-error {{argument to speculation_safe_value builtin must be a pointer or integer ('float' invalid)}}
+
+  struct s { int a; } s;
+  s = __builtin_speculation_safe_value(s); // expected-error {{argument to speculation_safe_value builtin must be a pointer or integer ('struct s' invalid)}}
+
+  union u { int a; } u;
+  u = __builtin_speculation_safe_value(u); // expected-error {{argument to speculation_safe_value builtin must be a pointer or integer ('union u' invalid)}}
+
+  char __attribute__((vector_size(16))) v;
+  v = __builtin_speculation_safe_value(v); // expected-error {{argument to speculation_safe_value builtin must be a pointer or integer ('__attribute__((__vector_size__(16 * sizeof(char)))) char' (vector of 16 'char' values) invalid)}}
+#endif
+}
+
+#ifdef ENABLE_ERRORS
+template<typename T>
+T load(const T v) {
+  return __builtin_speculation_safe_value(v); // expected-error {{argument to speculation_safe_value builtin must be a pointer or integer ('float' invalid)}}
+}
+
+void test_templates() {
+  int i;
+  load(i);
+
+  float f;
+  load(f); // expected-note {{in instantiation of function template specialization 'load<float>' requested here}}
+}
+#endif