1 //===- AArch64SpeculationHardening.cpp - Harden Against Missspeculation --===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file contains a pass to insert code to mitigate against side channel
11 // vulnerabilities that may happen under control flow miss-speculation.
13 // The pass implements tracking of control flow miss-speculation into a "taint"
14 // register. That taint register can then be used to mask off registers with
15 // sensitive data when executing under miss-speculation, a.k.a. "transient
17 // This pass is aimed at mitigating against SpectreV1-style vulnarabilities.
19 // It also implements speculative load hardening, i.e. using the taint register
20 // to automatically mask off loaded data.
22 // As a possible follow-on improvement, also an intrinsics-based approach as
23 // explained at https://lwn.net/Articles/759423/ could be implemented on top of
24 // the current design.
26 // For AArch64, the following implementation choices are made to implement the
27 // tracking of control flow miss-speculation into a taint register:
28 // Some of these are different than the implementation choices made in
29 // the similar pass implemented in X86SpeculativeLoadHardening.cpp, as
30 // the instruction set characteristics result in different trade-offs.
31 // - The speculation hardening is done after register allocation. With a
32 // relative abundance of registers, one register is reserved (X16) to be
33 // the taint register. X16 is expected to not clash with other register
34 // reservation mechanisms with very high probability because:
35 // . The AArch64 ABI doesn't guarantee X16 to be retained across any call.
36 // . The only way to request X16 to be used as a programmer is through
37 // inline assembly. In the rare case a function explicitly demands to
38 // use X16/W16, this pass falls back to hardening against speculation
39 // by inserting a DSB SYS/ISB barrier pair which will prevent control
41 // - It is easy to insert mask operations at this late stage as we have
42 // mask operations available that don't set flags.
43 // - The taint variable contains all-ones when no miss-speculation is detected,
44 // and contains all-zeros when miss-speculation is detected. Therefore, when
45 // masking, an AND instruction (which only changes the register to be masked,
46 // no other side effects) can easily be inserted anywhere that's needed.
47 // - The tracking of miss-speculation is done by using a data-flow conditional
48 // select instruction (CSEL) to evaluate the flags that were also used to
49 // make conditional branch direction decisions. Speculation of the CSEL
50 // instruction can be limited with a CSDB instruction - so the combination of
51 // CSEL + a later CSDB gives the guarantee that the flags as used in the CSEL
52 // aren't speculated. When conditional branch direction gets miss-speculated,
53 // the semantics of the inserted CSEL instruction is such that the taint
54 // register will contain all zero bits.
55 // One key requirement for this to work is that the conditional branch is
56 // followed by an execution of the CSEL instruction, where the CSEL
57 // instruction needs to use the same flags status as the conditional branch.
58 // This means that the conditional branches must not be implemented as one
59 // of the AArch64 conditional branches that do not use the flags as input
60 // (CB(N)Z and TB(N)Z). This is implemented by ensuring in the instruction
61 // selectors to not produce these instructions when speculation hardening
62 // is enabled. This pass will assert if it does encounter such an instruction.
63 // - On function call boundaries, the miss-speculation state is transferred from
64 // the taint register X16 to be encoded in the SP register as value 0.
66 // For the aspect of automatically hardening loads, using the taint register,
67 // (a.k.a. speculative load hardening, see
68 // https://llvm.org/docs/SpeculativeLoadHardening.html), the following
69 // implementation choices are made for AArch64:
70 // - Many of the optimizations described at
71 // https://llvm.org/docs/SpeculativeLoadHardening.html to harden fewer
72 // loads haven't been implemented yet - but for some of them there are
73 // FIXMEs in the code.
74 // - loads that load into general purpose (X or W) registers get hardened by
75 // masking the loaded data. For loads that load into other registers, the
76 // address loaded from gets hardened. It is expected that hardening the
77 // loaded data may be more efficient; but masking data in registers other
78 // than X or W is not easy and may result in being slower than just
79 // hardening the X address register loaded from.
80 // - On AArch64, CSDB instructions are inserted between the masking of the
81 // register and its first use, to ensure there's no non-control-flow
82 // speculation that might undermine the hardening mechanism.
84 // Future extensions/improvements could be:
85 // - Implement this functionality using full speculation barriers, akin to the
86 // x86-slh-lfence option. This may be more useful for the intrinsics-based
87 // approach than for the SLH approach to masking.
88 // Note that this pass already inserts the full speculation barriers if the
89 // function for some niche reason makes use of X16/W16.
90 // - no indirect branch misprediction gets protected/instrumented; but this
91 // could be done for some indirect branches, such as switch jump tables.
92 //===----------------------------------------------------------------------===//
94 #include "AArch64InstrInfo.h"
95 #include "AArch64Subtarget.h"
96 #include "Utils/AArch64BaseInfo.h"
97 #include "llvm/ADT/BitVector.h"
98 #include "llvm/ADT/SmallVector.h"
99 #include "llvm/CodeGen/MachineBasicBlock.h"
100 #include "llvm/CodeGen/MachineFunction.h"
101 #include "llvm/CodeGen/MachineFunctionPass.h"
102 #include "llvm/CodeGen/MachineInstr.h"
103 #include "llvm/CodeGen/MachineInstrBuilder.h"
104 #include "llvm/CodeGen/MachineOperand.h"
105 #include "llvm/CodeGen/MachineRegisterInfo.h"
106 #include "llvm/IR/DebugLoc.h"
107 #include "llvm/Pass.h"
108 #include "llvm/Support/CodeGen.h"
109 #include "llvm/Target/TargetMachine.h"
112 using namespace llvm;
114 #define DEBUG_TYPE "aarch64-speculation-hardening"
116 #define AARCH64_SPECULATION_HARDENING_NAME "AArch64 speculation hardening pass"
118 cl::opt<bool> HardenLoads("aarch64-slh-loads", cl::Hidden,
119 cl::desc("Sanitize loads from memory."),
124 class AArch64SpeculationHardening : public MachineFunctionPass {
126 const TargetInstrInfo *TII;
127 const TargetRegisterInfo *TRI;
131 AArch64SpeculationHardening() : MachineFunctionPass(ID) {
132 initializeAArch64SpeculationHardeningPass(*PassRegistry::getPassRegistry());
135 bool runOnMachineFunction(MachineFunction &Fn) override;
137 StringRef getPassName() const override {
138 return AARCH64_SPECULATION_HARDENING_NAME;
142 unsigned MisspeculatingTaintReg;
143 unsigned MisspeculatingTaintReg32Bit;
144 bool UseControlFlowSpeculationBarrier;
145 BitVector RegsNeedingCSDBBeforeUse;
146 BitVector RegsAlreadyMasked;
148 bool functionUsesHardeningRegister(MachineFunction &MF) const;
149 bool instrumentControlFlow(MachineBasicBlock &MBB);
150 bool endsWithCondControlFlow(MachineBasicBlock &MBB, MachineBasicBlock *&TBB,
151 MachineBasicBlock *&FBB,
152 AArch64CC::CondCode &CondCode) const;
153 void insertTrackingCode(MachineBasicBlock &SplitEdgeBB,
154 AArch64CC::CondCode &CondCode, DebugLoc DL) const;
155 void insertSPToRegTaintPropagation(MachineBasicBlock *MBB,
156 MachineBasicBlock::iterator MBBI) const;
157 void insertRegToSPTaintPropagation(MachineBasicBlock *MBB,
158 MachineBasicBlock::iterator MBBI,
159 unsigned TmpReg) const;
161 bool slhLoads(MachineBasicBlock &MBB);
162 bool makeGPRSpeculationSafe(MachineBasicBlock &MBB,
163 MachineBasicBlock::iterator MBBI,
164 MachineInstr &MI, unsigned Reg);
165 bool lowerSpeculationSafeValuePseudos(MachineBasicBlock &MBB);
166 bool expandSpeculationSafeValue(MachineBasicBlock &MBB,
167 MachineBasicBlock::iterator MBBI);
168 bool insertCSDB(MachineBasicBlock &MBB, MachineBasicBlock::iterator MBBI,
172 } // end anonymous namespace
174 char AArch64SpeculationHardening::ID = 0;
176 INITIALIZE_PASS(AArch64SpeculationHardening, "aarch64-speculation-hardening",
177 AARCH64_SPECULATION_HARDENING_NAME, false, false)
179 bool AArch64SpeculationHardening::endsWithCondControlFlow(
180 MachineBasicBlock &MBB, MachineBasicBlock *&TBB, MachineBasicBlock *&FBB,
181 AArch64CC::CondCode &CondCode) const {
182 SmallVector<MachineOperand, 1> analyzeBranchCondCode;
183 if (TII->analyzeBranch(MBB, TBB, FBB, analyzeBranchCondCode, false))
186 // Ignore if the BB ends in an unconditional branch/fall-through.
187 if (analyzeBranchCondCode.empty())
190 // If the BB ends with a single conditional branch, FBB will be set to
191 // nullptr (see API docs for TII->analyzeBranch). For the rest of the
192 // analysis we want the FBB block to be set always.
193 assert(TBB != nullptr);
195 FBB = MBB.getFallThrough();
197 // If both the true and the false condition jump to the same basic block,
198 // there isn't need for any protection - whether the branch is speculated
199 // correctly or not, we end up executing the architecturally correct code.
203 assert(MBB.succ_size() == 2);
204 // translate analyzeBranchCondCode to CondCode.
205 assert(analyzeBranchCondCode.size() == 1 && "unknown Cond array format");
206 CondCode = AArch64CC::CondCode(analyzeBranchCondCode[0].getImm());
210 void AArch64SpeculationHardening::insertTrackingCode(
211 MachineBasicBlock &SplitEdgeBB, AArch64CC::CondCode &CondCode,
213 if (UseControlFlowSpeculationBarrier) {
214 // insert full control flow speculation barrier (DSB SYS + ISB)
215 BuildMI(SplitEdgeBB, SplitEdgeBB.begin(), DL, TII->get(AArch64::ISB))
217 BuildMI(SplitEdgeBB, SplitEdgeBB.begin(), DL, TII->get(AArch64::DSB))
220 BuildMI(SplitEdgeBB, SplitEdgeBB.begin(), DL, TII->get(AArch64::CSELXr))
221 .addDef(MisspeculatingTaintReg)
222 .addUse(MisspeculatingTaintReg)
223 .addUse(AArch64::XZR)
225 SplitEdgeBB.addLiveIn(AArch64::NZCV);
229 bool AArch64SpeculationHardening::instrumentControlFlow(
230 MachineBasicBlock &MBB) {
231 LLVM_DEBUG(dbgs() << "Instrument control flow tracking on MBB: " << MBB);
233 bool Modified = false;
234 MachineBasicBlock *TBB = nullptr;
235 MachineBasicBlock *FBB = nullptr;
236 AArch64CC::CondCode CondCode;
238 if (!endsWithCondControlFlow(MBB, TBB, FBB, CondCode)) {
239 LLVM_DEBUG(dbgs() << "... doesn't end with CondControlFlow\n");
242 // "CSEL MisSpeculatingR, MisSpeculatingR, XZR, cond" on the True edge and
243 // "CSEL MisSpeculatingR, MisSpeculatingR, XZR, Invertcond" on the False
245 AArch64CC::CondCode InvCondCode = AArch64CC::getInvertedCondCode(CondCode);
247 MachineBasicBlock *SplitEdgeTBB = MBB.SplitCriticalEdge(TBB, *this);
248 MachineBasicBlock *SplitEdgeFBB = MBB.SplitCriticalEdge(FBB, *this);
250 assert(SplitEdgeTBB != nullptr);
251 assert(SplitEdgeFBB != nullptr);
254 if (MBB.instr_end() != MBB.instr_begin())
255 DL = (--MBB.instr_end())->getDebugLoc();
257 insertTrackingCode(*SplitEdgeTBB, CondCode, DL);
258 insertTrackingCode(*SplitEdgeFBB, InvCondCode, DL);
260 LLVM_DEBUG(dbgs() << "SplitEdgeTBB: " << *SplitEdgeTBB << "\n");
261 LLVM_DEBUG(dbgs() << "SplitEdgeFBB: " << *SplitEdgeFBB << "\n");
265 // Perform correct code generation around function calls and before returns.
267 SmallVector<MachineInstr *, 4> ReturnInstructions;
268 SmallVector<MachineInstr *, 4> CallInstructions;
270 for (MachineInstr &MI : MBB) {
272 ReturnInstructions.push_back(&MI);
273 else if (MI.isCall())
274 CallInstructions.push_back(&MI);
278 (ReturnInstructions.size() > 0) || (CallInstructions.size() > 0);
280 for (MachineInstr *Return : ReturnInstructions)
281 insertRegToSPTaintPropagation(Return->getParent(), Return, AArch64::X17);
282 for (MachineInstr *Call : CallInstructions) {
283 // Just after the call:
284 MachineBasicBlock::iterator i = Call;
286 insertSPToRegTaintPropagation(Call->getParent(), i);
287 // Just before the call:
288 insertRegToSPTaintPropagation(Call->getParent(), Call, AArch64::X17);
295 void AArch64SpeculationHardening::insertSPToRegTaintPropagation(
296 MachineBasicBlock *MBB, MachineBasicBlock::iterator MBBI) const {
297 // If full control flow speculation barriers are used, emit a control flow
298 // barrier to block potential miss-speculation in flight coming in to this
300 if (UseControlFlowSpeculationBarrier) {
301 // insert full control flow speculation barrier (DSB SYS + ISB)
302 BuildMI(*MBB, MBBI, DebugLoc(), TII->get(AArch64::DSB)).addImm(0xf);
303 BuildMI(*MBB, MBBI, DebugLoc(), TII->get(AArch64::ISB)).addImm(0xf);
307 // CMP SP, #0 === SUBS xzr, SP, #0
308 BuildMI(*MBB, MBBI, DebugLoc(), TII->get(AArch64::SUBSXri))
309 .addDef(AArch64::XZR)
312 .addImm(0); // no shift
313 // CSETM x16, NE === CSINV x16, xzr, xzr, EQ
314 BuildMI(*MBB, MBBI, DebugLoc(), TII->get(AArch64::CSINVXr))
315 .addDef(MisspeculatingTaintReg)
316 .addUse(AArch64::XZR)
317 .addUse(AArch64::XZR)
318 .addImm(AArch64CC::EQ);
321 void AArch64SpeculationHardening::insertRegToSPTaintPropagation(
322 MachineBasicBlock *MBB, MachineBasicBlock::iterator MBBI,
323 unsigned TmpReg) const {
324 // If full control flow speculation barriers are used, there will not be
325 // miss-speculation when returning from this function, and therefore, also
326 // no need to encode potential miss-speculation into the stack pointer.
327 if (UseControlFlowSpeculationBarrier)
330 // mov Xtmp, SP === ADD Xtmp, SP, #0
331 BuildMI(*MBB, MBBI, DebugLoc(), TII->get(AArch64::ADDXri))
335 .addImm(0); // no shift
336 // and Xtmp, Xtmp, TaintReg === AND Xtmp, Xtmp, TaintReg, #0
337 BuildMI(*MBB, MBBI, DebugLoc(), TII->get(AArch64::ANDXrs))
338 .addDef(TmpReg, RegState::Renamable)
339 .addUse(TmpReg, RegState::Kill | RegState::Renamable)
340 .addUse(MisspeculatingTaintReg, RegState::Kill)
342 // mov SP, Xtmp === ADD SP, Xtmp, #0
343 BuildMI(*MBB, MBBI, DebugLoc(), TII->get(AArch64::ADDXri))
345 .addUse(TmpReg, RegState::Kill)
347 .addImm(0); // no shift
350 bool AArch64SpeculationHardening::functionUsesHardeningRegister(
351 MachineFunction &MF) const {
352 for (MachineBasicBlock &MBB : MF) {
353 for (MachineInstr &MI : MBB) {
354 // treat function calls specially, as the hardening register does not
355 // need to remain live across function calls.
358 if (MI.readsRegister(MisspeculatingTaintReg, TRI) ||
359 MI.modifiesRegister(MisspeculatingTaintReg, TRI))
366 // Make GPR register Reg speculation-safe by putting it through the
367 // SpeculationSafeValue pseudo instruction, if we can't prove that
368 // the value in the register has already been hardened.
369 bool AArch64SpeculationHardening::makeGPRSpeculationSafe(
370 MachineBasicBlock &MBB, MachineBasicBlock::iterator MBBI, MachineInstr &MI,
372 assert(AArch64::GPR32allRegClass.contains(Reg) ||
373 AArch64::GPR64allRegClass.contains(Reg));
375 // Loads cannot directly load a value into the SP (nor WSP).
376 // Therefore, if Reg is SP or WSP, it is because the instruction loads from
377 // the stack through the stack pointer.
379 // Since the stack pointer is never dynamically controllable, don't harden it.
380 if (Reg == AArch64::SP || Reg == AArch64::WSP)
383 // Do not harden the register again if already hardened before.
384 if (RegsAlreadyMasked[Reg])
387 const bool Is64Bit = AArch64::GPR64allRegClass.contains(Reg);
388 LLVM_DEBUG(dbgs() << "About to harden register : " << Reg << "\n");
389 BuildMI(MBB, MBBI, MI.getDebugLoc(),
390 TII->get(Is64Bit ? AArch64::SpeculationSafeValueX
391 : AArch64::SpeculationSafeValueW))
394 RegsAlreadyMasked.set(Reg);
398 bool AArch64SpeculationHardening::slhLoads(MachineBasicBlock &MBB) {
399 bool Modified = false;
401 LLVM_DEBUG(dbgs() << "slhLoads running on MBB: " << MBB);
403 RegsAlreadyMasked.reset();
405 MachineBasicBlock::iterator MBBI = MBB.begin(), E = MBB.end();
406 MachineBasicBlock::iterator NextMBBI;
407 for (; MBBI != E; MBBI = NextMBBI) {
408 MachineInstr &MI = *MBBI;
409 NextMBBI = std::next(MBBI);
410 // Only harden loaded values or addresses used in loads.
414 LLVM_DEBUG(dbgs() << "About to harden: " << MI);
416 // For general purpose register loads, harden the registers loaded into.
417 // For other loads, harden the address loaded from.
418 // Masking the loaded value is expected to result in less performance
419 // overhead, as the load can still execute speculatively in comparison to
420 // when the address loaded from gets masked. However, masking is only
421 // easy to do efficiently on GPR registers, so for loads into non-GPR
422 // registers (e.g. floating point loads), mask the address loaded from.
423 bool AllDefsAreGPR = llvm::all_of(MI.defs(), [&](MachineOperand &Op) {
424 return Op.isReg() && (AArch64::GPR32allRegClass.contains(Op.getReg()) ||
425 AArch64::GPR64allRegClass.contains(Op.getReg()));
427 // FIXME: it might be a worthwhile optimization to not mask loaded
428 // values if all the registers involved in address calculation are already
429 // hardened, leading to this load not able to execute on a miss-speculated
431 bool HardenLoadedData = AllDefsAreGPR;
432 bool HardenAddressLoadedFrom = !HardenLoadedData;
434 // First remove registers from AlreadyMaskedRegisters if their value is
435 // updated by this instruction - it makes them contain a new value that is
436 // not guaranteed to already have been masked.
437 for (MachineOperand Op : MI.defs())
438 for (MCRegAliasIterator AI(Op.getReg(), TRI, true); AI.isValid(); ++AI)
439 RegsAlreadyMasked.reset(*AI);
441 // FIXME: loads from the stack with an immediate offset from the stack
442 // pointer probably shouldn't be hardened, which could result in a
443 // significant optimization. See section "Don’t check loads from
444 // compile-time constant stack offsets", in
445 // https://llvm.org/docs/SpeculativeLoadHardening.html
447 if (HardenLoadedData)
448 for (auto Def : MI.defs()) {
450 // Do not mask a register that is not used further.
452 // FIXME: For pre/post-increment addressing modes, the base register
453 // used in address calculation is also defined by this instruction.
454 // It might be a worthwhile optimization to not harden that
455 // base register increment/decrement when the increment/decrement is
457 Modified |= makeGPRSpeculationSafe(MBB, NextMBBI, MI, Def.getReg());
460 if (HardenAddressLoadedFrom)
461 for (auto Use : MI.uses()) {
464 unsigned Reg = Use.getReg();
465 // Some loads of floating point data have implicit defs/uses on a
466 // super register of that floating point data. Some examples:
467 // $s0 = LDRSui $sp, 22, implicit-def $q0
468 // $q0 = LD1i64 $q0, 1, renamable $x0
469 // We need to filter out these uses for non-GPR register which occur
470 // because the load partially fills a non-GPR register with the loaded
471 // data. Just skipping all non-GPR registers is safe (for now) as all
472 // AArch64 load instructions only use GPR registers to perform the
473 // address calculation. FIXME: However that might change once we can
474 // produce SVE gather instructions.
475 if (!(AArch64::GPR32allRegClass.contains(Reg) ||
476 AArch64::GPR64allRegClass.contains(Reg)))
478 Modified |= makeGPRSpeculationSafe(MBB, MBBI, MI, Reg);
484 /// \brief If MBBI references a pseudo instruction that should be expanded
485 /// here, do the expansion and return true. Otherwise return false.
486 bool AArch64SpeculationHardening::expandSpeculationSafeValue(
487 MachineBasicBlock &MBB, MachineBasicBlock::iterator MBBI) {
488 MachineInstr &MI = *MBBI;
489 unsigned Opcode = MI.getOpcode();
495 case AArch64::SpeculationSafeValueW:
498 case AArch64::SpeculationSafeValueX:
499 // Just remove the SpeculationSafe pseudo's if control flow
500 // miss-speculation isn't happening because we're already inserting barriers
501 // to guarantee that.
502 if (!UseControlFlowSpeculationBarrier) {
503 unsigned DstReg = MI.getOperand(0).getReg();
504 unsigned SrcReg = MI.getOperand(1).getReg();
505 // Mark this register and all its aliasing registers as needing to be
506 // value speculation hardened before its next use, by using a CSDB
507 // barrier instruction.
508 for (MachineOperand Op : MI.defs())
509 for (MCRegAliasIterator AI(Op.getReg(), TRI, true); AI.isValid(); ++AI)
510 RegsNeedingCSDBBeforeUse.set(*AI);
512 // Mask off with taint state.
513 BuildMI(MBB, MBBI, MI.getDebugLoc(),
514 Is64Bit ? TII->get(AArch64::ANDXrs) : TII->get(AArch64::ANDWrs))
516 .addUse(SrcReg, RegState::Kill)
517 .addUse(Is64Bit ? MisspeculatingTaintReg
518 : MisspeculatingTaintReg32Bit)
521 MI.eraseFromParent();
527 bool AArch64SpeculationHardening::insertCSDB(MachineBasicBlock &MBB,
528 MachineBasicBlock::iterator MBBI,
530 assert(!UseControlFlowSpeculationBarrier && "No need to insert CSDBs when "
531 "control flow miss-speculation "
532 "is already blocked");
533 // insert data value speculation barrier (CSDB)
534 BuildMI(MBB, MBBI, DL, TII->get(AArch64::HINT)).addImm(0x14);
535 RegsNeedingCSDBBeforeUse.reset();
539 bool AArch64SpeculationHardening::lowerSpeculationSafeValuePseudos(
540 MachineBasicBlock &MBB) {
541 bool Modified = false;
543 RegsNeedingCSDBBeforeUse.reset();
545 // The following loop iterates over all instructions in the basic block,
546 // and performs 2 operations:
547 // 1. Insert a CSDB at this location if needed.
548 // 2. Expand the SpeculationSafeValuePseudo if the current instruction is
551 // The insertion of the CSDB is done as late as possible (i.e. just before
552 // the use of a masked register), in the hope that that will reduce the
553 // total number of CSDBs in a block when there are multiple masked registers
555 MachineBasicBlock::iterator MBBI = MBB.begin(), E = MBB.end();
558 MachineInstr &MI = *MBBI;
559 DL = MI.getDebugLoc();
560 MachineBasicBlock::iterator NMBBI = std::next(MBBI);
562 // First check if a CSDB needs to be inserted due to earlier registers
563 // that were masked and that are used by the next instruction.
564 // Also emit the barrier on any potential control flow changes.
565 bool NeedToEmitBarrier = false;
566 if (RegsNeedingCSDBBeforeUse.any() && (MI.isCall() || MI.isTerminator()))
567 NeedToEmitBarrier = true;
568 if (!NeedToEmitBarrier)
569 for (MachineOperand Op : MI.uses())
570 if (Op.isReg() && RegsNeedingCSDBBeforeUse[Op.getReg()]) {
571 NeedToEmitBarrier = true;
575 if (NeedToEmitBarrier)
576 Modified |= insertCSDB(MBB, MBBI, DL);
578 Modified |= expandSpeculationSafeValue(MBB, MBBI);
583 if (RegsNeedingCSDBBeforeUse.any())
584 Modified |= insertCSDB(MBB, MBBI, DL);
589 bool AArch64SpeculationHardening::runOnMachineFunction(MachineFunction &MF) {
590 if (!MF.getFunction().hasFnAttribute(Attribute::SpeculativeLoadHardening))
593 MisspeculatingTaintReg = AArch64::X16;
594 MisspeculatingTaintReg32Bit = AArch64::W16;
595 TII = MF.getSubtarget().getInstrInfo();
596 TRI = MF.getSubtarget().getRegisterInfo();
597 RegsNeedingCSDBBeforeUse.resize(TRI->getNumRegs());
598 RegsAlreadyMasked.resize(TRI->getNumRegs());
599 UseControlFlowSpeculationBarrier = functionUsesHardeningRegister(MF);
601 bool Modified = false;
603 // Step 1: Enable automatic insertion of SpeculationSafeValue.
606 dbgs() << "***** AArch64SpeculationHardening - automatic insertion of "
607 "SpeculationSafeValue intrinsics *****\n");
609 Modified |= slhLoads(MBB);
612 // 2.a Add instrumentation code to function entry and exits.
615 << "***** AArch64SpeculationHardening - track control flow *****\n");
617 SmallVector<MachineBasicBlock *, 2> EntryBlocks;
618 EntryBlocks.push_back(&MF.front());
619 for (const LandingPadInfo &LPI : MF.getLandingPads())
620 EntryBlocks.push_back(LPI.LandingPadBlock);
621 for (auto Entry : EntryBlocks)
622 insertSPToRegTaintPropagation(
623 Entry, Entry->SkipPHIsLabelsAndDebug(Entry->begin()));
625 // 2.b Add instrumentation code to every basic block.
627 Modified |= instrumentControlFlow(MBB);
629 LLVM_DEBUG(dbgs() << "***** AArch64SpeculationHardening - Lowering "
630 "SpeculationSafeValue Pseudos *****\n");
631 // Step 3: Lower SpeculationSafeValue pseudo instructions.
633 Modified |= lowerSpeculationSafeValuePseudos(MBB);
638 /// \brief Returns an instance of the pseudo instruction expansion pass.
639 FunctionPass *llvm::createAArch64SpeculationHardeningPass() {
640 return new AArch64SpeculationHardening();