Skip to content

Commit fb13965

Browse files
toppercJethro Beekman
topperc
authored and
Jethro Beekman
committed
[X86] Add inline assembly load hardening mitigation for Load Value Injection (LVI)
Added code to X86AsmParser::emitInstruction() to add an LFENCE after each instruction that may load, and emit a warning if it encounters an instruction that may be vulnerable, but cannot be automatically mitigated. Differential Revision: https://reviews.llvm.org/D76158
1 parent e54c3b9 commit fb13965

File tree

2 files changed

+262
-0
lines changed

2 files changed

+262
-0
lines changed

‎llvm/lib/Target/X86/AsmParser/X86AsmParser.cpp

+106
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
#include "llvm/MC/MCStreamer.h"
3232
#include "llvm/MC/MCSubtargetInfo.h"
3333
#include "llvm/MC/MCSymbol.h"
34+
#include "llvm/Support/CommandLine.h"
3435
#include "llvm/Support/SourceMgr.h"
3536
#include "llvm/Support/TargetRegistry.h"
3637
#include "llvm/Support/raw_ostream.h"
@@ -39,6 +40,11 @@
3940

4041
using namespace llvm;
4142

43+
static cl::opt<bool> LVIInlineAsmHardening(
44+
"x86-experimental-lvi-inline-asm-hardening",
45+
cl::desc("Harden inline assembly code that may be vulnerable to Load Value"
46+
" Injection (LVI). This feature is experimental."), cl::Hidden);
47+
4248
static bool checkScale(unsigned Scale, StringRef &ErrMsg) {
4349
if (Scale != 1 && Scale != 2 && Scale != 4 && Scale != 8) {
4450
ErrMsg = "scale factor in address must be 1, 2, 4 or 8";
@@ -927,6 +933,11 @@ class X86AsmParser : public MCTargetAsmParser {
927933
bool validateInstruction(MCInst &Inst, const OperandVector &Ops);
928934
bool processInstruction(MCInst &Inst, const OperandVector &Ops);
929935

936+
// Load Value Injection (LVI) Mitigations for machine code
937+
void emitWarningForSpecialLVIInstruction(SMLoc Loc);
938+
bool applyLVICFIMitigation(MCInst &Inst);
939+
bool applyLVILoadHardeningMitigation(MCInst &Inst, MCStreamer &Out);
940+
930941
/// Wrapper around MCStreamer::EmitInstruction(). Possibly adds
931942
/// instrumentation around Inst.
932943
void EmitInstruction(MCInst &Inst, OperandVector &Operands, MCStreamer &Out);
@@ -3096,9 +3107,104 @@ bool X86AsmParser::validateInstruction(MCInst &Inst, const OperandVector &Ops) {
30963107

30973108
static const char *getSubtargetFeatureName(uint64_t Val);
30983109

3110+
void X86AsmParser::emitWarningForSpecialLVIInstruction(SMLoc Loc) {
3111+
Warning(Loc, "Instruction may be vulnerable to LVI and "
3112+
"requires manual mitigation");
3113+
Note(SMLoc(), "See https://software.intel.com/"
3114+
"security-software-guidance/insights/"
3115+
"deep-dive-load-value-injection#specialinstructions"
3116+
" for more information");
3117+
}
3118+
3119+
/// RET instructions and also instructions that indirect calls/jumps from memory
3120+
/// combine a load and a branch within a single instruction. To mitigate these
3121+
/// instructions against LVI, they must be decomposed into separate load and
3122+
/// branch instructions, with an LFENCE in between. For more details, see:
3123+
/// - X86LoadValueInjectionRetHardening.cpp
3124+
/// - X86LoadValueInjectionIndirectThunks.cpp
3125+
/// - https://software.intel.com/security-software-guidance/insights/deep-dive-load-value-injection
3126+
///
3127+
/// Returns `true` if a mitigation was applied or warning was emitted.
3128+
bool X86AsmParser::applyLVICFIMitigation(MCInst &Inst) {
3129+
// Information on control-flow instructions that require manual mitigation can
3130+
// be found here:
3131+
// https://software.intel.com/security-software-guidance/insights/deep-dive-load-value-injection#specialinstructions
3132+
switch (Inst.getOpcode()) {
3133+
case X86::RETW:
3134+
case X86::RETL:
3135+
case X86::RETQ:
3136+
case X86::RETIL:
3137+
case X86::RETIQ:
3138+
case X86::RETIW:
3139+
case X86::JMP16m:
3140+
case X86::JMP32m:
3141+
case X86::JMP64m:
3142+
case X86::CALL16m:
3143+
case X86::CALL32m:
3144+
case X86::CALL64m:
3145+
emitWarningForSpecialLVIInstruction(Inst.getLoc());
3146+
return true;
3147+
}
3148+
return false;
3149+
}
3150+
3151+
/// To mitigate LVI, every instruction that performs a load can be followed by
3152+
/// an LFENCE instruction to squash any potential mis-speculation. There are
3153+
/// some instructions that require additional considerations, and may requre
3154+
/// manual mitigation. For more details, see:
3155+
/// https://software.intel.com/security-software-guidance/insights/deep-dive-load-value-injection
3156+
///
3157+
/// Returns `true` if a mitigation was applied or warning was emitted.
3158+
bool X86AsmParser::applyLVILoadHardeningMitigation(MCInst &Inst,
3159+
MCStreamer &Out) {
3160+
auto Opcode = Inst.getOpcode();
3161+
auto Flags = Inst.getFlags();
3162+
if ((Flags & X86::IP_HAS_REPEAT) || (Flags & X86::IP_HAS_REPEAT_NE)) {
3163+
// Information on REP string instructions that require manual mitigation can
3164+
// be found here:
3165+
// https://software.intel.com/security-software-guidance/insights/deep-dive-load-value-injection#specialinstructions
3166+
switch (Opcode) {
3167+
case X86::CMPSB:
3168+
case X86::CMPSW:
3169+
case X86::CMPSL:
3170+
case X86::CMPSQ:
3171+
case X86::SCASB:
3172+
case X86::SCASW:
3173+
case X86::SCASL:
3174+
case X86::SCASQ:
3175+
emitWarningForSpecialLVIInstruction(Inst.getLoc());
3176+
return true;
3177+
}
3178+
} else if (Opcode == X86::REP_PREFIX || Opcode == X86::REPNE_PREFIX) {
3179+
// If a REP instruction is found on its own line, it may or may not be
3180+
// followed by a vulnerable instruction. Emit a warning just in case.
3181+
emitWarningForSpecialLVIInstruction(Inst.getLoc());
3182+
return true;
3183+
}
3184+
3185+
const MCInstrDesc &MCID = MII.get(Inst.getOpcode());
3186+
// LFENCE has the mayLoad property, don't double fence.
3187+
if (MCID.mayLoad() && Inst.getOpcode() != X86::LFENCE) {
3188+
MCInst FenceInst;
3189+
FenceInst.setOpcode(X86::LFENCE);
3190+
FenceInst.setLoc(Inst.getLoc());
3191+
Out.EmitInstruction(FenceInst, getSTI());
3192+
return true;
3193+
}
3194+
return false;
3195+
}
3196+
30993197
void X86AsmParser::EmitInstruction(MCInst &Inst, OperandVector &Operands,
31003198
MCStreamer &Out) {
31013199
Out.EmitInstruction(Inst, getSTI());
3200+
3201+
if (LVIInlineAsmHardening) {
3202+
if (getSTI().getFeatureBits()[X86::FeatureLVIControlFlowIntegrity] &&
3203+
applyLVICFIMitigation(Inst))
3204+
return;
3205+
if (getSTI().getFeatureBits()[X86::FeatureLVILoadHardening])
3206+
applyLVILoadHardeningMitigation(Inst, Out);
3207+
}
31023208
}
31033209

31043210
bool X86AsmParser::MatchAndEmitInstruction(SMLoc IDLoc, unsigned &Opcode,

‎llvm/test/CodeGen/X86/lvi-hardening-inline-asm.ll

+156
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
; RUN: llc -verify-machineinstrs -mtriple=x86_64-unknown -mattr=+lvi-load-hardening -mattr=+lvi-cfi -x86-experimental-lvi-inline-asm-hardening < %s -o %t.out 2> %t.err
2+
; RUN: FileCheck %s --check-prefix=X86 < %t.out
3+
; RUN: FileCheck %s --check-prefix=WARN < %t.err
4+
5+
; Test module-level assembly
6+
module asm "pop %rbx"
7+
module asm "ret"
8+
; WARN: warning: Instruction may be vulnerable to LVI
9+
; WARN-NEXT: ret
10+
; WARN-NEXT: ^
11+
; WARN-NEXT: note: See https://software.intel.com/security-software-guidance/insights/deep-dive-load-value-injection#specialinstructions for more information
12+
13+
; Function Attrs: noinline nounwind optnone uwtable
14+
define dso_local void @test_inline_asm() {
15+
entry:
16+
; X86-LABEL: test_inline_asm:
17+
call void asm sideeffect "mov 0x3fed(%rip),%rax", "~{dirflag},~{fpsr},~{flags}"() #1
18+
; X86: movq 16365(%rip), %rax
19+
; X86-NEXT: lfence
20+
call void asm sideeffect "movdqa 0x0(%rip),%xmm0", "~{dirflag},~{fpsr},~{flags}"() #1
21+
; X86: movdqa (%rip), %xmm0
22+
; X86-NEXT: lfence
23+
call void asm sideeffect "movslq 0x3e5d(%rip),%rbx", "~{dirflag},~{fpsr},~{flags}"() #1
24+
; X86: movslq 15965(%rip), %rbx
25+
; X86-NEXT: lfence
26+
call void asm sideeffect "mov (%r12,%rax,8),%rax", "~{dirflag},~{fpsr},~{flags}"() #1
27+
; X86: movq (%r12,%rax,8), %rax
28+
; X86-NEXT: lfence
29+
call void asm sideeffect "movq (24)(%rsi), %r11", "~{dirflag},~{fpsr},~{flags}"() #1
30+
; X86: movq 24(%rsi), %r11
31+
; X86-NEXT: lfence
32+
call void asm sideeffect "cmove %r12,%rax", "~{dirflag},~{fpsr},~{flags}"() #1
33+
; X86: cmoveq %r12, %rax
34+
; X86-NOT: lfence
35+
call void asm sideeffect "cmove (%r12),%rax", "~{dirflag},~{fpsr},~{flags}"() #1
36+
; X86: cmoveq (%r12), %rax
37+
; X86-NEXT: lfence
38+
call void asm sideeffect "pop %rbx", "~{dirflag},~{fpsr},~{flags}"() #1
39+
; X86: popq %rbx
40+
; X86-NEXT: lfence
41+
call void asm sideeffect "popq %rbx", "~{dirflag},~{fpsr},~{flags}"() #1
42+
; X86: popq %rbx
43+
; X86-NEXT: lfence
44+
call void asm sideeffect "xchg (%r12),%rax", "~{dirflag},~{fpsr},~{flags}"() #1
45+
; X86: xchgq %rax, (%r12)
46+
; X86-NEXT: lfence
47+
call void asm sideeffect "cmpxchg %r12,(%rax)", "~{dirflag},~{fpsr},~{flags}"() #1
48+
; X86: cmpxchgq %r12, (%rax)
49+
; X86-NEXT: lfence
50+
call void asm sideeffect "vpxor (%rcx,%rdx,1),%ymm1,%ymm0", "~{dirflag},~{fpsr},~{flags}"() #1
51+
; X86: vpxor (%rcx,%rdx), %ymm1, %ymm0
52+
; X86-NEXT: lfence
53+
call void asm sideeffect "vpmuludq 0x20(%rsi),%ymm0,%ymm12", "~{dirflag},~{fpsr},~{flags}"() #1
54+
; X86: vpmuludq 32(%rsi), %ymm0, %ymm12
55+
; X86-NEXT: lfence
56+
call void asm sideeffect "vpexpandq 0x40(%rdi),%zmm8{%k2}{z}", "~{dirflag},~{fpsr},~{flags}"() #1
57+
; X86: vpexpandq 64(%rdi), %zmm8 {%k2} {z}
58+
; X86-NEXT: lfence
59+
call void asm sideeffect "addq (%r12),%rax", "~{dirflag},~{fpsr},~{flags}"() #1
60+
; X86: addq (%r12), %rax
61+
; X86-NEXT: lfence
62+
call void asm sideeffect "subq Lpoly+0(%rip), %rax", "~{dirflag},~{fpsr},~{flags}"() #1
63+
; X86: subq Lpoly+0(%rip), %rax
64+
; X86-NEXT: lfence
65+
call void asm sideeffect "adcq %r12,(%rax)", "~{dirflag},~{fpsr},~{flags}"() #1
66+
; X86: adcq %r12, (%rax)
67+
; X86-NEXT: lfence
68+
call void asm sideeffect "negq (%rax)", "~{dirflag},~{fpsr},~{flags}"() #1
69+
; X86: negq (%rax)
70+
; X86-NEXT: lfence
71+
call void asm sideeffect "incq %rax", "~{dirflag},~{fpsr},~{flags}"() #1
72+
; X86: incq %rax
73+
; X86-NOT: lfence
74+
call void asm sideeffect "mulq (%rax)", "~{dirflag},~{fpsr},~{flags}"() #1
75+
; X86: mulq (%rax)
76+
; X86-NEXT: lfence
77+
call void asm sideeffect "imulq (%rax),%rdx", "~{dirflag},~{fpsr},~{flags}"() #1
78+
; X86: imulq (%rax), %rdx
79+
; X86-NEXT: lfence
80+
call void asm sideeffect "shlq $$1,(%rax)", "~{dirflag},~{fpsr},~{flags}"() #1
81+
; X86: shlq (%rax)
82+
; X86-NEXT: lfence
83+
call void asm sideeffect "shrq $$1,(%rax)", "~{dirflag},~{fpsr},~{flags}"() #1
84+
; X86: shrq (%rax)
85+
; X86-NEXT: lfence
86+
call void asm sideeffect "repz cmpsb %es:(%rdi),%ds:(%rsi)", "~{dirflag},~{fpsr},~{flags}"() #1
87+
; WARN: warning: Instruction may be vulnerable to LVI
88+
; WARN-NEXT: repz cmpsb %es:(%rdi),%ds:(%rsi)
89+
; WARN-NEXT: ^
90+
; WARN-NEXT: note: See https://software.intel.com/security-software-guidance/insights/deep-dive-load-value-injection#specialinstructions for more information
91+
; X86: rep cmpsb %es:(%rdi), %ds:(%rsi)
92+
; X86-NOT: lfence
93+
call void asm sideeffect "repnz scasb", "~{dirflag},~{fpsr},~{flags}"() #1
94+
; WARN: warning: Instruction may be vulnerable to LVI
95+
; WARN-NEXT: repnz scasb
96+
; WARN-NEXT: ^
97+
; WARN-NEXT: note: See https://software.intel.com/security-software-guidance/insights/deep-dive-load-value-injection#specialinstructions for more information
98+
; X86: repne scasb %es:(%rdi), %al
99+
; X86-NOT: lfence
100+
call void asm sideeffect "repnz", ""() #1
101+
; WARN: warning: Instruction may be vulnerable to LVI
102+
; WARN-NEXT: repnz
103+
; WARN-NEXT: ^
104+
; WARN-NEXT: note: See https://software.intel.com/security-software-guidance/insights/deep-dive-load-value-injection#specialinstructions for more information
105+
call void asm sideeffect "pinsrw $$0x6,(%eax),%xmm0", "~{dirflag},~{fpsr},~{flags}"() #1
106+
; X86: pinsrw $6, (%eax), %xmm0
107+
; X86-NEXT: lfence
108+
call void asm sideeffect "ret", "~{dirflag},~{fpsr},~{flags}"() #1
109+
; WARN: warning: Instruction may be vulnerable to LVI
110+
; WARN-NEXT: ret
111+
; WARN-NEXT: ^
112+
; WARN-NEXT: note: See https://software.intel.com/security-software-guidance/insights/deep-dive-load-value-injection#specialinstructions for more information
113+
; X86: retq
114+
; X86-NOT: lfence
115+
call void asm sideeffect "ret $$8", "~{dirflag},~{fpsr},~{flags}"() #1
116+
; WARN: warning: Instruction may be vulnerable to LVI
117+
; WARN-NEXT: ret $8
118+
; WARN-NEXT: ^
119+
; WARN-NEXT: note: See https://software.intel.com/security-software-guidance/insights/deep-dive-load-value-injection#specialinstructions for more information
120+
; X86: retq $8
121+
; X86-NOT: lfence
122+
call void asm sideeffect "jmpq *(%rdx)", "~{dirflag},~{fpsr},~{flags}"() #1
123+
; WARN: warning: Instruction may be vulnerable to LVI
124+
; WARN-NEXT: jmpq *(%rdx)
125+
; WARN-NEXT: ^
126+
; WARN-NEXT: note: See https://software.intel.com/security-software-guidance/insights/deep-dive-load-value-injection#specialinstructions for more information
127+
; X86: jmpq *(%rdx)
128+
; X86-NOT: lfence
129+
call void asm sideeffect "jmpq *0x100(%rdx)", "~{dirflag},~{fpsr},~{flags}"() #1
130+
; WARN: warning: Instruction may be vulnerable to LVI
131+
; WARN-NEXT: jmpq *0x100(%rdx)
132+
; WARN-NEXT: ^
133+
; WARN-NEXT: note: See https://software.intel.com/security-software-guidance/insights/deep-dive-load-value-injection#specialinstructions for more information
134+
; X86: jmpq *256(%rdx)
135+
; X86-NOT: lfence
136+
call void asm sideeffect "callq *200(%rdx)", "~{dirflag},~{fpsr},~{flags}"() #1
137+
; WARN: warning: Instruction may be vulnerable to LVI
138+
; WARN-NEXT: callq *200(%rdx)
139+
; WARN-NEXT: ^
140+
; WARN-NEXT: note: See https://software.intel.com/security-software-guidance/insights/deep-dive-load-value-injection#specialinstructions for more information
141+
; X86: callq *200(%rdx)
142+
; X86-NOT: lfence
143+
call void asm sideeffect "fldt 0x8(%rbp)", "~{dirflag},~{fpsr},~{flags}"() #1
144+
; X86: fldt 8(%rbp)
145+
; X86-NEXT: lfence
146+
call void asm sideeffect "fld %st(0)", "~{dirflag},~{fpsr},~{flags}"() #1
147+
; X86: fld %st(0)
148+
; X86-NOT: lfence
149+
; Test assembler macros
150+
call void asm sideeffect ".macro mplus1 x\0Aincq (\5Cx)\0A.endm\0Amplus1 %rcx", "~{dirflag},~{fpsr},~{flags}"() #1
151+
; X86: incq (%rcx)
152+
; X86-NEXT: lfence
153+
ret void
154+
}
155+
156+
attributes #1 = { nounwind }

0 commit comments

Comments
 (0)