1 //======- X86RetpolineThunks.cpp - Construct retpoline thunks for x86 --=====// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 /// \file 10 /// 11 /// Pass that injects an MI thunk implementing a "retpoline". This is 12 /// a RET-implemented trampoline that is used to lower indirect calls in a way 13 /// that prevents speculation on some x86 processors and can be used to mitigate 14 /// security vulnerabilities due to targeted speculative execution and side 15 /// channels such as CVE-2017-5715. 16 /// 17 /// TODO(chandlerc): All of this code could use better comments and 18 /// documentation. 19 /// 20 //===----------------------------------------------------------------------===// 21 22 #include "X86.h" 23 #include "X86InstrBuilder.h" 24 #include "X86Subtarget.h" 25 #include "llvm/CodeGen/MachineFunction.h" 26 #include "llvm/CodeGen/MachineInstrBuilder.h" 27 #include "llvm/CodeGen/MachineModuleInfo.h" 28 #include "llvm/CodeGen/Passes.h" 29 #include "llvm/CodeGen/TargetPassConfig.h" 30 #include "llvm/IR/IRBuilder.h" 31 #include "llvm/IR/Instructions.h" 32 #include "llvm/IR/Module.h" 33 #include "llvm/Support/CommandLine.h" 34 #include "llvm/Support/Debug.h" 35 #include "llvm/Support/raw_ostream.h" 36 37 using namespace llvm; 38 39 #define DEBUG_TYPE "x86-retpoline-thunks" 40 41 static const char ThunkNamePrefix[] = "__llvm_retpoline_"; 42 static const char R11ThunkName[] = "__llvm_retpoline_r11"; 43 static const char EAXThunkName[] = "__llvm_retpoline_eax"; 44 static const char ECXThunkName[] = "__llvm_retpoline_ecx"; 45 static const char EDXThunkName[] = "__llvm_retpoline_edx"; 46 static const char PushThunkName[] = "__llvm_retpoline_push"; 47 48 namespace { 49 class X86RetpolineThunks : public MachineFunctionPass { 50 public: 51 static char ID; 52 53 X86RetpolineThunks() : MachineFunctionPass(ID) {} 54 55 StringRef getPassName() const override { return "X86 Retpoline Thunks"; } 56 57 bool doInitialization(Module &M) override; 58 bool runOnMachineFunction(MachineFunction &F) override; 59 60 void getAnalysisUsage(AnalysisUsage &AU) const override { 61 MachineFunctionPass::getAnalysisUsage(AU); 62 AU.addRequired<MachineModuleInfo>(); 63 AU.addPreserved<MachineModuleInfo>(); 64 } 65 66 private: 67 MachineModuleInfo *MMI; 68 const TargetMachine *TM; 69 bool Is64Bit; 70 const X86Subtarget *STI; 71 const X86InstrInfo *TII; 72 73 bool InsertedThunks; 74 75 void createThunkFunction(Module &M, StringRef Name); 76 void insertRegReturnAddrClobber(MachineBasicBlock &MBB, unsigned Reg); 77 void insert32BitPushReturnAddrClobber(MachineBasicBlock &MBB); 78 void populateThunk(MachineFunction &MF, Optional<unsigned> Reg = None); 79 }; 80 81 } // end anonymous namespace 82 83 FunctionPass *llvm::createX86RetpolineThunksPass() { 84 return new X86RetpolineThunks(); 85 } 86 87 char X86RetpolineThunks::ID = 0; 88 89 bool X86RetpolineThunks::doInitialization(Module &M) { 90 InsertedThunks = false; 91 return false; 92 } 93 94 bool X86RetpolineThunks::runOnMachineFunction(MachineFunction &MF) { 95 DEBUG(dbgs() << getPassName() << '\n'); 96 97 TM = &MF.getTarget();; 98 STI = &MF.getSubtarget<X86Subtarget>(); 99 TII = STI->getInstrInfo(); 100 Is64Bit = TM->getTargetTriple().getArch() == Triple::x86_64; 101 102 MMI = &getAnalysis<MachineModuleInfo>(); 103 Module &M = const_cast<Module &>(*MMI->getModule()); 104 105 // If this function is not a thunk, check to see if we need to insert 106 // a thunk. 107 if (!MF.getName().startswith(ThunkNamePrefix)) { 108 // If we've already inserted a thunk, nothing else to do. 109 if (InsertedThunks) 110 return false; 111 112 // Only add a thunk if one of the functions has the retpoline feature 113 // enabled in its subtarget, and doesn't enable external thunks. 114 // FIXME: Conditionalize on indirect calls so we don't emit a thunk when 115 // nothing will end up calling it. 116 // FIXME: It's a little silly to look at every function just to enumerate 117 // the subtargets, but eventually we'll want to look at them for indirect 118 // calls, so maybe this is OK. 119 if (!STI->useRetpoline() || STI->useRetpolineExternalThunk()) 120 return false; 121 122 // Otherwise, we need to insert the thunk. 123 // WARNING: This is not really a well behaving thing to do in a function 124 // pass. We extract the module and insert a new function (and machine 125 // function) directly into the module. 126 if (Is64Bit) 127 createThunkFunction(M, R11ThunkName); 128 else 129 for (StringRef Name : 130 {EAXThunkName, ECXThunkName, EDXThunkName, PushThunkName}) 131 createThunkFunction(M, Name); 132 InsertedThunks = true; 133 return true; 134 } 135 136 // If this *is* a thunk function, we need to populate it with the correct MI. 137 if (Is64Bit) { 138 assert(MF.getName() == "__llvm_retpoline_r11" && 139 "Should only have an r11 thunk on 64-bit targets"); 140 141 // __llvm_retpoline_r11: 142 // callq .Lr11_call_target 143 // .Lr11_capture_spec: 144 // pause 145 // lfence 146 // jmp .Lr11_capture_spec 147 // .align 16 148 // .Lr11_call_target: 149 // movq %r11, (%rsp) 150 // retq 151 populateThunk(MF, X86::R11); 152 } else { 153 // For 32-bit targets we need to emit a collection of thunks for various 154 // possible scratch registers as well as a fallback that is used when 155 // there are no scratch registers and assumes the retpoline target has 156 // been pushed. 157 // __llvm_retpoline_eax: 158 // calll .Leax_call_target 159 // .Leax_capture_spec: 160 // pause 161 // jmp .Leax_capture_spec 162 // .align 16 163 // .Leax_call_target: 164 // movl %eax, (%esp) # Clobber return addr 165 // retl 166 // 167 // __llvm_retpoline_ecx: 168 // ... # Same setup 169 // movl %ecx, (%esp) 170 // retl 171 // 172 // __llvm_retpoline_edx: 173 // ... # Same setup 174 // movl %edx, (%esp) 175 // retl 176 // 177 // This last one is a bit more special and so needs a little extra 178 // handling. 179 // __llvm_retpoline_push: 180 // calll .Lpush_call_target 181 // .Lpush_capture_spec: 182 // pause 183 // lfence 184 // jmp .Lpush_capture_spec 185 // .align 16 186 // .Lpush_call_target: 187 // # Clear pause_loop return address. 188 // addl $4, %esp 189 // # Top of stack words are: Callee, RA. Exchange Callee and RA. 190 // pushl 4(%esp) # Push callee 191 // pushl 4(%esp) # Push RA 192 // popl 8(%esp) # Pop RA to final RA 193 // popl (%esp) # Pop callee to next top of stack 194 // retl # Ret to callee 195 if (MF.getName() == EAXThunkName) 196 populateThunk(MF, X86::EAX); 197 else if (MF.getName() == ECXThunkName) 198 populateThunk(MF, X86::ECX); 199 else if (MF.getName() == EDXThunkName) 200 populateThunk(MF, X86::EDX); 201 else if (MF.getName() == PushThunkName) 202 populateThunk(MF); 203 else 204 llvm_unreachable("Invalid thunk name on x86-32!"); 205 } 206 207 return true; 208 } 209 210 void X86RetpolineThunks::createThunkFunction(Module &M, StringRef Name) { 211 assert(Name.startswith(ThunkNamePrefix) && 212 "Created a thunk with an unexpected prefix!"); 213 214 LLVMContext &Ctx = M.getContext(); 215 auto Type = FunctionType::get(Type::getVoidTy(Ctx), false); 216 Function *F = 217 Function::Create(Type, GlobalValue::LinkOnceODRLinkage, Name, &M); 218 F->setVisibility(GlobalValue::HiddenVisibility); 219 F->setComdat(M.getOrInsertComdat(Name)); 220 221 // Add Attributes so that we don't create a frame, unwind information, or 222 // inline. 223 AttrBuilder B; 224 B.addAttribute(llvm::Attribute::NoUnwind); 225 B.addAttribute(llvm::Attribute::Naked); 226 F->addAttributes(llvm::AttributeList::FunctionIndex, B); 227 228 // Populate our function a bit so that we can verify. 229 BasicBlock *Entry = BasicBlock::Create(Ctx, "entry", F); 230 IRBuilder<> Builder(Entry); 231 232 Builder.CreateRetVoid(); 233 } 234 235 void X86RetpolineThunks::insertRegReturnAddrClobber(MachineBasicBlock &MBB, 236 unsigned Reg) { 237 const unsigned MovOpc = Is64Bit ? X86::MOV64mr : X86::MOV32mr; 238 const unsigned SPReg = Is64Bit ? X86::RSP : X86::ESP; 239 addRegOffset(BuildMI(&MBB, DebugLoc(), TII->get(MovOpc)), SPReg, false, 0) 240 .addReg(Reg); 241 } 242 243 void X86RetpolineThunks::insert32BitPushReturnAddrClobber( 244 MachineBasicBlock &MBB) { 245 // The instruction sequence we use to replace the return address without 246 // a scratch register is somewhat complicated: 247 // # Clear capture_spec from return address. 248 // addl $4, %esp 249 // # Top of stack words are: Callee, RA. Exchange Callee and RA. 250 // pushl 4(%esp) # Push callee 251 // pushl 4(%esp) # Push RA 252 // popl 8(%esp) # Pop RA to final RA 253 // popl (%esp) # Pop callee to next top of stack 254 // retl # Ret to callee 255 BuildMI(&MBB, DebugLoc(), TII->get(X86::ADD32ri), X86::ESP) 256 .addReg(X86::ESP) 257 .addImm(4); 258 addRegOffset(BuildMI(&MBB, DebugLoc(), TII->get(X86::PUSH32rmm)), X86::ESP, 259 false, 4); 260 addRegOffset(BuildMI(&MBB, DebugLoc(), TII->get(X86::PUSH32rmm)), X86::ESP, 261 false, 4); 262 addRegOffset(BuildMI(&MBB, DebugLoc(), TII->get(X86::POP32rmm)), X86::ESP, 263 false, 8); 264 addRegOffset(BuildMI(&MBB, DebugLoc(), TII->get(X86::POP32rmm)), X86::ESP, 265 false, 0); 266 } 267 268 void X86RetpolineThunks::populateThunk(MachineFunction &MF, 269 Optional<unsigned> Reg) { 270 // Set MF properties. We never use vregs... 271 MF.getProperties().set(MachineFunctionProperties::Property::NoVRegs); 272 273 MachineBasicBlock *Entry = &MF.front(); 274 Entry->clear(); 275 276 MachineBasicBlock *CaptureSpec = MF.CreateMachineBasicBlock(Entry->getBasicBlock()); 277 MachineBasicBlock *CallTarget = MF.CreateMachineBasicBlock(Entry->getBasicBlock()); 278 MF.push_back(CaptureSpec); 279 MF.push_back(CallTarget); 280 281 const unsigned CallOpc = Is64Bit ? X86::CALL64pcrel32 : X86::CALLpcrel32; 282 const unsigned RetOpc = Is64Bit ? X86::RETQ : X86::RETL; 283 284 BuildMI(Entry, DebugLoc(), TII->get(CallOpc)).addMBB(CallTarget); 285 Entry->addSuccessor(CallTarget); 286 Entry->addSuccessor(CaptureSpec); 287 CallTarget->setHasAddressTaken(); 288 289 // In the capture loop for speculation, we want to stop the processor from 290 // speculating as fast as possible. On Intel processors, the PAUSE instruction 291 // will block speculation without consuming any execution resources. On AMD 292 // processors, the PAUSE instruction is (essentially) a nop, so we also use an 293 // LFENCE instruction which they have advised will stop speculation as well 294 // with minimal resource utilization. We still end the capture with a jump to 295 // form an infinite loop to fully guarantee that no matter what implementation 296 // of the x86 ISA, speculating this code path never escapes. 297 BuildMI(CaptureSpec, DebugLoc(), TII->get(X86::PAUSE)); 298 BuildMI(CaptureSpec, DebugLoc(), TII->get(X86::LFENCE)); 299 BuildMI(CaptureSpec, DebugLoc(), TII->get(X86::JMP_1)).addMBB(CaptureSpec); 300 CaptureSpec->setHasAddressTaken(); 301 CaptureSpec->addSuccessor(CaptureSpec); 302 303 CallTarget->setAlignment(4); 304 if (Reg) { 305 insertRegReturnAddrClobber(*CallTarget, *Reg); 306 } else { 307 assert(!Is64Bit && "We only support non-reg thunks on 32-bit x86!"); 308 insert32BitPushReturnAddrClobber(*CallTarget); 309 } 310 BuildMI(CallTarget, DebugLoc(), TII->get(RetOpc)); 311 } 312