X86IndirectThunks.cpp File Reference

Pass that injects an MI thunk that is used to lower indirect calls in a way that prevents speculation on some x86 processors and can be used to mitigate security vulnerabilities due to targeted speculative execution and side channels such as CVE-2017-5715. More...

#include "X86.h"
#include "X86InstrBuilder.h"
#include "X86Subtarget.h"
#include "llvm/CodeGen/IndirectThunks.h"
#include "llvm/CodeGen/MachineFunction.h"
#include "llvm/CodeGen/MachineInstrBuilder.h"
#include "llvm/CodeGen/MachineModuleInfo.h"
#include "llvm/CodeGen/Passes.h"
#include "llvm/CodeGen/TargetPassConfig.h"
#include "llvm/IR/Instructions.h"
#include "llvm/Target/TargetMachine.h"

Go to the source code of this file.

Macros
#define	DEBUG_TYPE   "x86-retpoline-thunks"

Variables
static const char	RetpolineNamePrefix [] = "__llvm_retpoline_"
static const char	R11RetpolineName [] = "__llvm_retpoline_r11"
static const char	EAXRetpolineName [] = "__llvm_retpoline_eax"
static const char	ECXRetpolineName [] = "__llvm_retpoline_ecx"
static const char	EDXRetpolineName [] = "__llvm_retpoline_edx"
static const char	EDIRetpolineName [] = "__llvm_retpoline_edi"
static const char	LVIThunkNamePrefix [] = "__llvm_lvi_thunk_"
static const char	R11LVIThunkName [] = "__llvm_lvi_thunk_r11"

Detailed Description

Pass that injects an MI thunk that is used to lower indirect calls in a way that prevents speculation on some x86 processors and can be used to mitigate security vulnerabilities due to targeted speculative execution and side channels such as CVE-2017-5715.

Currently supported thunks include:

• Retpoline – A RET-implemented trampoline that lowers indirect calls
• LVI Thunk – A CALL/JMP-implemented thunk that forces load serialization before making an indirect call/jump

Note that the reason that this is implemented as a MachineFunctionPass and not a ModulePass is that ModulePasses at this point in the LLVM X86 pipeline serialize all transformations, which can consume lots of memory.

TODO(chandlerc): All of this code could use better comments and documentation.

Definition in file X86IndirectThunks.cpp.

Macro Definition Documentation

DEBUG_TYPE

#define DEBUG_TYPE   "x86-retpoline-thunks"

Definition at line 43 of file X86IndirectThunks.cpp.

Variable Documentation

EAXRetpolineName

const char EAXRetpolineName[] = "__llvm_retpoline_eax"

static

Definition at line 47 of file X86IndirectThunks.cpp.

ECXRetpolineName

const char ECXRetpolineName[] = "__llvm_retpoline_ecx"

static

Definition at line 48 of file X86IndirectThunks.cpp.

EDIRetpolineName

const char EDIRetpolineName[] = "__llvm_retpoline_edi"

static

Definition at line 50 of file X86IndirectThunks.cpp.

EDXRetpolineName

const char EDXRetpolineName[] = "__llvm_retpoline_edx"

static

Definition at line 49 of file X86IndirectThunks.cpp.

LVIThunkNamePrefix

const char LVIThunkNamePrefix[] = "__llvm_lvi_thunk_"

static

Definition at line 52 of file X86IndirectThunks.cpp.

R11LVIThunkName

const char R11LVIThunkName[] = "__llvm_lvi_thunk_r11"

static

Definition at line 53 of file X86IndirectThunks.cpp.

R11RetpolineName

const char R11RetpolineName[] = "__llvm_retpoline_r11"

static

Definition at line 46 of file X86IndirectThunks.cpp.

RetpolineNamePrefix

const char RetpolineNamePrefix[] = "__llvm_retpoline_"

static

Definition at line 45 of file X86IndirectThunks.cpp.