/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp

Bug Summary

File:	lib/Target/X86/X86SpeculativeLoadHardening.cpp
Warning:	line 1867, column 3 Assigned value is garbage or undefined
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name X86SpeculativeLoadHardening.cpp -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-eagerly-assume -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=cplusplus -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -mrelocation-model pic -pic-level 2 -mthread-model posix -fmath-errno -masm-verbose -mconstructor-aliases -munwind-tables -fuse-init-array -target-cpu x86-64 -dwarf-column-info -debugger-tuning=gdb -momit-leaf-frame-pointer -ffunction-sections -fdata-sections -resource-dir /usr/lib/llvm-7/lib/clang/7.0.0 -D _DEBUG -D _GNU_SOURCE -D __STDC_CONSTANT_MACROS -D __STDC_FORMAT_MACROS -D __STDC_LIMIT_MACROS -I /build/llvm-toolchain-snapshot-7~svn337657/build-llvm/lib/Target/X86 -I /build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86 -I /build/llvm-toolchain-snapshot-7~svn337657/build-llvm/include -I /build/llvm-toolchain-snapshot-7~svn337657/include -U NDEBUG -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/x86_64-linux-gnu/c++/8 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/x86_64-linux-gnu/c++/8 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/8/../../../../include/c++/8/backward -internal-isystem /usr/include/clang/7.0.0/include/ -internal-isystem /usr/local/include -internal-isystem /usr/lib/llvm-7/lib/clang/7.0.0/include -internal-externc-isystem /usr/lib/gcc/x86_64-linux-gnu/8/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O2 -Wno-unused-parameter -Wwrite-strings -Wno-missing-field-initializers -Wno-long-long -Wno-maybe-uninitialized -Wno-class-memaccess -Wno-comment -std=c++11 -fdeprecated-macro -fdebug-compilation-dir /build/llvm-toolchain-snapshot-7~svn337657/build-llvm/lib/Target/X86 -ferror-limit 19 -fmessage-length 0 -fvisibility-inlines-hidden -fobjc-runtime=gcc -fdiagnostics-show-option -vectorize-loops -vectorize-slp -analyzer-output=html -analyzer-config stable-report-filename=true -o /tmp/scan-build-2018-07-23-043044-26795-1 -x c++ /build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp -faddrsig
1//====- X86SpeculativeLoadHardening.cpp - A Spectre v1 mitigation ---------===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9/// \file
10///
11/// Provide a pass which mitigates speculative execution attacks which operate
12/// by speculating incorrectly past some predicate (a type check, bounds check,
13/// or other condition) to reach a load with invalid inputs and leak the data
14/// accessed by that load using a side channel out of the speculative domain.
15///
16/// For details on the attacks, see the first variant in both the Project Zero
17/// writeup and the Spectre paper:
18/// https://googleprojectzero.blogspot.com/2018/01/reading-privileged-memory-with-side.html
19/// https://spectreattack.com/spectre.pdf
20///
21//===----------------------------------------------------------------------===//

23#include "X86.h"
24#include "X86InstrBuilder.h"
25#include "X86InstrInfo.h"
26#include "X86Subtarget.h"
27#include "llvm/ADT/ArrayRef.h"
28#include "llvm/ADT/DenseMap.h"
29#include "llvm/ADT/Optional.h"
30#include "llvm/ADT/STLExtras.h"
31#include "llvm/ADT/ScopeExit.h"
32#include "llvm/ADT/SmallPtrSet.h"
33#include "llvm/ADT/SmallSet.h"
34#include "llvm/ADT/SmallVector.h"
35#include "llvm/ADT/SparseBitVector.h"
36#include "llvm/ADT/Statistic.h"
37#include "llvm/CodeGen/MachineBasicBlock.h"
38#include "llvm/CodeGen/MachineConstantPool.h"
39#include "llvm/CodeGen/MachineFunction.h"
40#include "llvm/CodeGen/MachineFunctionPass.h"
41#include "llvm/CodeGen/MachineInstr.h"
42#include "llvm/CodeGen/MachineInstrBuilder.h"
43#include "llvm/CodeGen/MachineModuleInfo.h"
44#include "llvm/CodeGen/MachineOperand.h"
45#include "llvm/CodeGen/MachineRegisterInfo.h"
46#include "llvm/CodeGen/MachineSSAUpdater.h"
47#include "llvm/CodeGen/TargetInstrInfo.h"
48#include "llvm/CodeGen/TargetRegisterInfo.h"
49#include "llvm/CodeGen/TargetSchedule.h"
50#include "llvm/CodeGen/TargetSubtargetInfo.h"
51#include "llvm/IR/DebugLoc.h"
52#include "llvm/MC/MCSchedule.h"
53#include "llvm/Pass.h"
54#include "llvm/Support/CommandLine.h"
55#include "llvm/Support/Debug.h"
56#include "llvm/Support/raw_ostream.h"
57#include <algorithm>
58#include <cassert>
59#include <iterator>
60#include <utility>

62using namespace llvm;

64#define PASS_KEY"x86-speculative-load-hardening" "x86-speculative-load-hardening"
65#define DEBUG_TYPE"x86-speculative-load-hardening" PASS_KEY"x86-speculative-load-hardening"

67STATISTIC(NumCondBranchesTraced, "Number of conditional branches traced")static llvm::Statistic NumCondBranchesTraced = {"x86-speculative-load-hardening"
, "NumCondBranchesTraced", "Number of conditional branches traced"
, {0}, {false}};
68STATISTIC(NumBranchesUntraced, "Number of branches unable to trace")static llvm::Statistic NumBranchesUntraced = {"x86-speculative-load-hardening"
, "NumBranchesUntraced", "Number of branches unable to trace"
, {0}, {false}};
69STATISTIC(NumAddrRegsHardened,static llvm::Statistic NumAddrRegsHardened = {"x86-speculative-load-hardening"
, "NumAddrRegsHardened", "Number of address mode used registers hardaned"
, {0}, {false}}
        "Number of address mode used registers hardaned")static llvm::Statistic NumAddrRegsHardened = {"x86-speculative-load-hardening"
, "NumAddrRegsHardened", "Number of address mode used registers hardaned"
, {0}, {false}};
71STATISTIC(NumPostLoadRegsHardened,static llvm::Statistic NumPostLoadRegsHardened = {"x86-speculative-load-hardening"
, "NumPostLoadRegsHardened", "Number of post-load register values hardened"
, {0}, {false}}
        "Number of post-load register values hardened")static llvm::Statistic NumPostLoadRegsHardened = {"x86-speculative-load-hardening"
, "NumPostLoadRegsHardened", "Number of post-load register values hardened"
, {0}, {false}};
73STATISTIC(NumInstsInserted, "Number of instructions inserted")static llvm::Statistic NumInstsInserted = {"x86-speculative-load-hardening"
, "NumInstsInserted", "Number of instructions inserted", {0},
 {false}};
74STATISTIC(NumLFENCEsInserted, "Number of lfence instructions inserted")static llvm::Statistic NumLFENCEsInserted = {"x86-speculative-load-hardening"
, "NumLFENCEsInserted", "Number of lfence instructions inserted"
, {0}, {false}};

76static cl::opt<bool> HardenEdgesWithLFENCE(
  PASS_KEY"x86-speculative-load-hardening" "-lfence",
  cl::desc(
      "Use LFENCE along each conditional edge to harden against speculative "
      "loads rather than conditional movs and poisoned pointers."),
  cl::init(false), cl::Hidden);

83static cl::opt<bool> EnablePostLoadHardening(
  PASS_KEY"x86-speculative-load-hardening" "-post-load",
  cl::desc("Harden the value loaded *after* it is loaded by "
           "flushing the loaded bits to 1. This is hard to do "
           "in general but can be done easily for GPRs."),
  cl::init(true), cl::Hidden);

90static cl::opt<bool> FenceCallAndRet(
  PASS_KEY"x86-speculative-load-hardening" "-fence-call-and-ret",
  cl::desc("Use a full speculation fence to harden both call and ret edges "
           "rather than a lighter weight mitigation."),
  cl::init(false), cl::Hidden);

96static cl::opt<bool> HardenInterprocedurally(
  PASS_KEY"x86-speculative-load-hardening" "-ip",
  cl::desc("Harden interprocedurally by passing our state in and out of "
           "functions in the high bits of the stack pointer."),
  cl::init(true), cl::Hidden);

102static cl::opt<bool>
  HardenLoads(PASS_KEY"x86-speculative-load-hardening" "-loads",
              cl::desc("Sanitize loads from memory. When disable, no "
                       "significant security is provided."),
              cl::init(true), cl::Hidden);

108namespace llvm {

110void initializeX86SpeculativeLoadHardeningPassPass(PassRegistry &);

112} // end namespace llvm

114namespace {

116class X86SpeculativeLoadHardeningPass : public MachineFunctionPass {
117public:
X86SpeculativeLoadHardeningPass() : MachineFunctionPass(ID) {
  initializeX86SpeculativeLoadHardeningPassPass(
      *PassRegistry::getPassRegistry());
}

StringRef getPassName() const override {
  return "X86 speculative load hardening";
}
bool runOnMachineFunction(MachineFunction &MF) override;
void getAnalysisUsage(AnalysisUsage &AU) const override;

/// Pass identification, replacement for typeid.
static char ID;

132private:
/// The information about a block's conditional terminators needed to trace
/// our predicate state through the exiting edges.
struct BlockCondInfo {
  MachineBasicBlock *MBB;

  // We mostly have one conditional branch, and in extremely rare cases have
  // two. Three and more are so rare as to be unimportant for compile time.
  SmallVector<MachineInstr *, 2> CondBrs;

  MachineInstr *UncondBr;
};

/// Manages the predicate state traced through the program.
struct PredState {
  unsigned InitialReg;
  unsigned PoisonReg;

  const TargetRegisterClass *RC;
  MachineSSAUpdater SSA;

  PredState(MachineFunction &MF, const TargetRegisterClass *RC)
      : RC(RC), SSA(MF) {}
};

const X86Subtarget *Subtarget;
MachineRegisterInfo *MRI;
const X86InstrInfo *TII;
const TargetRegisterInfo *TRI;

Optional<PredState> PS;

void hardenEdgesWithLFENCE(MachineFunction &MF);

SmallVector<BlockCondInfo, 16> collectBlockCondInfo(MachineFunction &MF);

SmallVector<MachineInstr *, 16>
tracePredStateThroughCFG(MachineFunction &MF, ArrayRef<BlockCondInfo> Infos);

void checkAllLoads(MachineFunction &MF);

unsigned saveEFLAGS(MachineBasicBlock &MBB,
                    MachineBasicBlock::iterator InsertPt, DebugLoc Loc);
void restoreEFLAGS(MachineBasicBlock &MBB,
                   MachineBasicBlock::iterator InsertPt, DebugLoc Loc,
                   unsigned OFReg);

void mergePredStateIntoSP(MachineBasicBlock &MBB,
                          MachineBasicBlock::iterator InsertPt, DebugLoc Loc,
                          unsigned PredStateReg);
unsigned extractPredStateFromSP(MachineBasicBlock &MBB,
                                MachineBasicBlock::iterator InsertPt,
                                DebugLoc Loc);

void
hardenLoadAddr(MachineInstr &MI, MachineOperand &BaseMO,
               MachineOperand &IndexMO,
               SmallDenseMap<unsigned, unsigned, 32> &AddrRegToHardenedReg);
MachineInstr *
sinkPostLoadHardenedInst(MachineInstr &MI,
                         SmallPtrSetImpl<MachineInstr *> &HardenedInstrs);
bool canHardenRegister(unsigned Reg);
void hardenPostLoad(MachineInstr &MI);
void hardenReturnInstr(MachineInstr &MI);
196};

198} // end anonymous namespace

200char X86SpeculativeLoadHardeningPass::ID = 0;

202void X86SpeculativeLoadHardeningPass::getAnalysisUsage(
  AnalysisUsage &AU) const {
MachineFunctionPass::getAnalysisUsage(AU);
205}

207static MachineBasicBlock &splitEdge(MachineBasicBlock &MBB,
                                  MachineBasicBlock &Succ, int SuccCount,
                                  MachineInstr *Br, MachineInstr *&UncondBr,
                                  const X86InstrInfo &TII) {
assert(!Succ.isEHPad() && "Shouldn't get edges to EH pads!")(static_cast <bool> (!Succ.isEHPad() && "Shouldn't get edges to EH pads!"
) ? void (0) : __assert_fail ("!Succ.isEHPad() && \"Shouldn't get edges to EH pads!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 211, __extension__ __PRETTY_FUNCTION__));

MachineFunction &MF = *MBB.getParent();

MachineBasicBlock &NewMBB = *MF.CreateMachineBasicBlock();

// We have to insert the new block immediately after the current one as we
// don't know what layout-successor relationships the successor has and we
// may not be able to (and generally don't want to) try to fix those up.
MF.insert(std::next(MachineFunction::iterator(&MBB)), &NewMBB);

// Update the branch instruction if necessary.
if (Br) {
  assert(Br->getOperand(0).getMBB() == &Succ &&(static_cast <bool> (Br->getOperand(0).getMBB() == &
Succ && "Didn't start with the right target!") ? void
 (0) : __assert_fail ("Br->getOperand(0).getMBB() == &Succ && \"Didn't start with the right target!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 225, __extension__ __PRETTY_FUNCTION__))
         "Didn't start with the right target!")(static_cast <bool> (Br->getOperand(0).getMBB() == &
Succ && "Didn't start with the right target!") ? void
 (0) : __assert_fail ("Br->getOperand(0).getMBB() == &Succ && \"Didn't start with the right target!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 225, __extension__ __PRETTY_FUNCTION__));
  Br->getOperand(0).setMBB(&NewMBB);

  // If this successor was reached through a branch rather than fallthrough,
  // we might have *broken* fallthrough and so need to inject a new
  // unconditional branch.
  if (!UncondBr) {
    MachineBasicBlock &OldLayoutSucc =
        *std::next(MachineFunction::iterator(&NewMBB));
    assert(MBB.isSuccessor(&OldLayoutSucc) &&(static_cast <bool> (MBB.isSuccessor(&OldLayoutSucc
) && "Without an unconditional branch, the old layout successor should "
 "be an actual successor!") ? void (0) : __assert_fail ("MBB.isSuccessor(&OldLayoutSucc) && \"Without an unconditional branch, the old layout successor should \" \"be an actual successor!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 236, __extension__ __PRETTY_FUNCTION__))
           "Without an unconditional branch, the old layout successor should "(static_cast <bool> (MBB.isSuccessor(&OldLayoutSucc
) && "Without an unconditional branch, the old layout successor should "
 "be an actual successor!") ? void (0) : __assert_fail ("MBB.isSuccessor(&OldLayoutSucc) && \"Without an unconditional branch, the old layout successor should \" \"be an actual successor!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 236, __extension__ __PRETTY_FUNCTION__))
           "be an actual successor!")(static_cast <bool> (MBB.isSuccessor(&OldLayoutSucc
) && "Without an unconditional branch, the old layout successor should "
 "be an actual successor!") ? void (0) : __assert_fail ("MBB.isSuccessor(&OldLayoutSucc) && \"Without an unconditional branch, the old layout successor should \" \"be an actual successor!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 236, __extension__ __PRETTY_FUNCTION__));
    auto BrBuilder =
        BuildMI(&MBB, DebugLoc(), TII.get(X86::JMP_1)).addMBB(&OldLayoutSucc);
    // Update the unconditional branch now that we've added one.
    UncondBr = &*BrBuilder;
  }

  // Insert unconditional "jump Succ" instruction in the new block if
  // necessary.
  if (!NewMBB.isLayoutSuccessor(&Succ)) {
    SmallVector<MachineOperand, 4> Cond;
    TII.insertBranch(NewMBB, &Succ, nullptr, Cond, Br->getDebugLoc());
  }
} else {
  assert(!UncondBr &&(static_cast <bool> (!UncondBr && "Cannot have a branchless successor and an unconditional branch!"
) ? void (0) : __assert_fail ("!UncondBr && \"Cannot have a branchless successor and an unconditional branch!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 251, __extension__ __PRETTY_FUNCTION__))
         "Cannot have a branchless successor and an unconditional branch!")(static_cast <bool> (!UncondBr && "Cannot have a branchless successor and an unconditional branch!"
) ? void (0) : __assert_fail ("!UncondBr && \"Cannot have a branchless successor and an unconditional branch!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 251, __extension__ __PRETTY_FUNCTION__));
  assert(NewMBB.isLayoutSuccessor(&Succ) &&(static_cast <bool> (NewMBB.isLayoutSuccessor(&Succ
) && "A non-branch successor must have been a layout successor before "
 "and now is a layout successor of the new block.") ? void (0
) : __assert_fail ("NewMBB.isLayoutSuccessor(&Succ) && \"A non-branch successor must have been a layout successor before \" \"and now is a layout successor of the new block.\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 254, __extension__ __PRETTY_FUNCTION__))
         "A non-branch successor must have been a layout successor before "(static_cast <bool> (NewMBB.isLayoutSuccessor(&Succ
) && "A non-branch successor must have been a layout successor before "
 "and now is a layout successor of the new block.") ? void (0
) : __assert_fail ("NewMBB.isLayoutSuccessor(&Succ) && \"A non-branch successor must have been a layout successor before \" \"and now is a layout successor of the new block.\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 254, __extension__ __PRETTY_FUNCTION__))
         "and now is a layout successor of the new block.")(static_cast <bool> (NewMBB.isLayoutSuccessor(&Succ
) && "A non-branch successor must have been a layout successor before "
 "and now is a layout successor of the new block.") ? void (0
) : __assert_fail ("NewMBB.isLayoutSuccessor(&Succ) && \"A non-branch successor must have been a layout successor before \" \"and now is a layout successor of the new block.\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 254, __extension__ __PRETTY_FUNCTION__));
}

// If this is the only edge to the successor, we can just replace it in the
// CFG. Otherwise we need to add a new entry in the CFG for the new
// successor.
if (SuccCount == 1) {
  MBB.replaceSuccessor(&Succ, &NewMBB);
} else {
  MBB.splitSuccessor(&Succ, &NewMBB);
}

// Hook up the edge from the new basic block to the old successor in the CFG.
NewMBB.addSuccessor(&Succ);

// Fix PHI nodes in Succ so they refer to NewMBB instead of MBB.
for (MachineInstr &MI : Succ) {
  if (!MI.isPHI())
    break;
  for (int OpIdx = 1, NumOps = MI.getNumOperands(); OpIdx < NumOps;
       OpIdx += 2) {
    MachineOperand &OpV = MI.getOperand(OpIdx);
    MachineOperand &OpMBB = MI.getOperand(OpIdx + 1);
    assert(OpMBB.isMBB() && "Block operand to a PHI is not a block!")(static_cast <bool> (OpMBB.isMBB() && "Block operand to a PHI is not a block!"
) ? void (0) : __assert_fail ("OpMBB.isMBB() && \"Block operand to a PHI is not a block!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 277, __extension__ __PRETTY_FUNCTION__));
    if (OpMBB.getMBB() != &MBB)
      continue;

    // If this is the last edge to the succesor, just replace MBB in the PHI
    if (SuccCount == 1) {
      OpMBB.setMBB(&NewMBB);
      break;
    }

    // Otherwise, append a new pair of operands for the new incoming edge.
    MI.addOperand(MF, OpV);
    MI.addOperand(MF, MachineOperand::CreateMBB(&NewMBB));
    break;
  }
}

// Inherit live-ins from the successor
for (auto &LI : Succ.liveins())
  NewMBB.addLiveIn(LI);

LLVM_DEBUG(dbgs() << "  Split edge from '" << MBB.getName() << "' to '"do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Split edge from '"
 << MBB.getName() << "' to '" << Succ.getName
() << "'.\n"; } } while (false)
                  << Succ.getName() << "'.\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Split edge from '"
 << MBB.getName() << "' to '" << Succ.getName
() << "'.\n"; } } while (false);
return NewMBB;
301}

303/// Removing duplicate PHI operands to leave the PHI in a canonical and
304/// predictable form.
305///
306/// FIXME: It's really frustrating that we have to do this, but SSA-form in MIR
307/// isn't what you might expect. We may have multiple entries in PHI nodes for
308/// a single predecessor. This makes CFG-updating extremely complex, so here we
309/// simplify all PHI nodes to a model even simpler than the IR's model: exactly
310/// one entry per predecessor, regardless of how many edges there are.
311static void canonicalizePHIOperands(MachineFunction &MF) {
SmallPtrSet<MachineBasicBlock *, 4> Preds;
SmallVector<int, 4> DupIndices;
for (auto &MBB : MF)
  for (auto &MI : MBB) {
    if (!MI.isPHI())
      break;

    // First we scan the operands of the PHI looking for duplicate entries
    // a particular predecessor. We retain the operand index of each duplicate
    // entry found.
    for (int OpIdx = 1, NumOps = MI.getNumOperands(); OpIdx < NumOps;
         OpIdx += 2)
      if (!Preds.insert(MI.getOperand(OpIdx + 1).getMBB()).second)
        DupIndices.push_back(OpIdx);

    // Now walk the duplicate indices, removing both the block and value. Note
    // that these are stored as a vector making this element-wise removal
    // :w
    // potentially quadratic.
    //
    // FIXME: It is really frustrating that we have to use a quadratic
    // removal algorithm here. There should be a better way, but the use-def
    // updates required make that impossible using the public API.
    //
    // Note that we have to process these backwards so that we don't
    // invalidate other indices with each removal.
    while (!DupIndices.empty()) {
      int OpIdx = DupIndices.pop_back_val();
      // Remove both the block and value operand, again in reverse order to
      // preserve indices.
      MI.RemoveOperand(OpIdx + 1);
      MI.RemoveOperand(OpIdx);
    }

    Preds.clear();
  }
348}

350/// Helper to scan a function for loads vulnerable to misspeculation that we
351/// want to harden.
352///
353/// We use this to avoid making changes to functions where there is nothing we
354/// need to do to harden against misspeculation.
355static bool hasVulnerableLoad(MachineFunction &MF) {
for (MachineBasicBlock &MBB : MF) {
  for (MachineInstr &MI : MBB) {
    // Loads within this basic block after an LFENCE are not at risk of
    // speculatively executing with invalid predicates from prior control
    // flow. So break out of this block but continue scanning the function.
    if (MI.getOpcode() == X86::LFENCE)
      break;

    // Looking for loads only.
    if (!MI.mayLoad())
      continue;

    // An MFENCE is modeled as a load but isn't vulnerable to misspeculation.
    if (MI.getOpcode() == X86::MFENCE)
      continue;

    // We found a load.
    return true;
  }
}

// No loads found.
return false;
379}

381bool X86SpeculativeLoadHardeningPass::runOnMachineFunction(
  MachineFunction &MF) {
LLVM_DEBUG(dbgs() << "********** " << getPassName() << " : " << MF.getName()do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "********** "
 << getPassName() << " : " << MF.getName() <<
 " **********\n"; } } while (false)
                  << " **********\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "********** "
 << getPassName() << " : " << MF.getName() <<
 " **********\n"; } } while (false);

Subtarget = &MF.getSubtarget<X86Subtarget>();
MRI = &MF.getRegInfo();
TII = Subtarget->getInstrInfo();
TRI = Subtarget->getRegisterInfo();

// FIXME: Support for 32-bit.
PS.emplace(MF, &X86::GR64_NOSPRegClass);

if (MF.begin() == MF.end())
1
Taking false branch→
  // Nothing to do for a degenerate empty function...
  return false;

// We support an alternative hardening technique based on a debug flag.
if (HardenEdgesWithLFENCE) {
2
←
Assuming the condition is false→
3
←
Taking false branch→
  hardenEdgesWithLFENCE(MF);
  return true;
}

// Create a dummy debug loc to use for all the generated code here.
DebugLoc Loc;

MachineBasicBlock &Entry = *MF.begin();
auto EntryInsertPt = Entry.SkipPHIsLabelsAndDebug(Entry.begin());

// Do a quick scan to see if we have any checkable loads.
bool HasVulnerableLoad = hasVulnerableLoad(MF);

// See if we have any conditional branching blocks that we will need to trace
// predicate state through.
SmallVector<BlockCondInfo, 16> Infos = collectBlockCondInfo(MF);

// If we have no interesting conditions or loads, nothing to do here.
if (!HasVulnerableLoad && Infos.empty())
4
←
Taking false branch→
  return true;

// The poison value is required to be an all-ones value for many aspects of
// this mitigation.
const int PoisonVal = -1;
PS->PoisonReg = MRI->createVirtualRegister(PS->RC);
BuildMI(Entry, EntryInsertPt, Loc, TII->get(X86::MOV64ri32), PS->PoisonReg)
    .addImm(PoisonVal);
++NumInstsInserted;

// If we have loads being hardened and we've asked for call and ret edges to
// get a full fence-based mitigation, inject that fence.
if (HasVulnerableLoad && FenceCallAndRet) {
  // We need to insert an LFENCE at the start of the function to suspend any
  // incoming misspeculation from the caller. This helps two-fold: the caller
  // may not have been protected as this code has been, and this code gets to
  // not take any specific action to protect across calls.
  // FIXME: We could skip this for functions which unconditionally return
  // a constant.
  BuildMI(Entry, EntryInsertPt, Loc, TII->get(X86::LFENCE));
  ++NumInstsInserted;
  ++NumLFENCEsInserted;
}

// If we guarded the entry with an LFENCE and have no conditionals to protect
// in blocks, then we're done.
if (FenceCallAndRet && Infos.empty())
5
←
Assuming the condition is false→
  // We may have changed the function's code at this point to insert fences.
  return true;

// For every basic block in the function which can b
if (HardenInterprocedurally && !FenceCallAndRet) {
6
←
Assuming the condition is true→
7
←
Taking true branch→
  // Set up the predicate state by extracting it from the incoming stack
  // pointer so we pick up any misspeculation in our caller.
  PS->InitialReg = extractPredStateFromSP(Entry, EntryInsertPt, Loc);
} else {
  // Otherwise, just build the predicate state itself by zeroing a register
  // as we don't need any initial state.
  PS->InitialReg = MRI->createVirtualRegister(PS->RC);
  unsigned PredStateSubReg = MRI->createVirtualRegister(&X86::GR32RegClass);
  auto ZeroI = BuildMI(Entry, EntryInsertPt, Loc, TII->get(X86::MOV32r0),
                       PredStateSubReg);
  ++NumInstsInserted;
  MachineOperand *ZeroEFLAGSDefOp =
      ZeroI->findRegisterDefOperand(X86::EFLAGS);
  assert(ZeroEFLAGSDefOp && ZeroEFLAGSDefOp->isImplicit() &&(static_cast <bool> (ZeroEFLAGSDefOp && ZeroEFLAGSDefOp
->isImplicit() && "Must have an implicit def of EFLAGS!"
) ? void (0) : __assert_fail ("ZeroEFLAGSDefOp && ZeroEFLAGSDefOp->isImplicit() && \"Must have an implicit def of EFLAGS!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 465, __extension__ __PRETTY_FUNCTION__))
         "Must have an implicit def of EFLAGS!")(static_cast <bool> (ZeroEFLAGSDefOp && ZeroEFLAGSDefOp
->isImplicit() && "Must have an implicit def of EFLAGS!"
) ? void (0) : __assert_fail ("ZeroEFLAGSDefOp && ZeroEFLAGSDefOp->isImplicit() && \"Must have an implicit def of EFLAGS!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 465, __extension__ __PRETTY_FUNCTION__));
  ZeroEFLAGSDefOp->setIsDead(true);
  BuildMI(Entry, EntryInsertPt, Loc, TII->get(X86::SUBREG_TO_REG),
          PS->InitialReg)
      .addImm(0)
      .addReg(PredStateSubReg)
      .addImm(X86::sub_32bit);
}

// We're going to need to trace predicate state throughout the function's
// CFG. Prepare for this by setting up our initial state of PHIs with unique
// predecessor entries and all the initial predicate state.
canonicalizePHIOperands(MF);

// Track the updated values in an SSA updater to rewrite into SSA form at the
// end.
PS->SSA.Initialize(PS->InitialReg);
PS->SSA.AddAvailableValue(&Entry, PS->InitialReg);

// Trace through the CFG.
auto CMovs = tracePredStateThroughCFG(MF, Infos);

// We may also enter basic blocks in this function via exception handling
// control flow. Here, if we are hardening interprocedurally, we need to
// re-capture the predicate state from the throwing code. In the Itanium ABI,
// the throw will always look like a call to __cxa_throw and will have the
// predicate state in the stack pointer, so extract fresh predicate state from
// the stack pointer and make it available in SSA.
// FIXME: Handle non-itanium ABI EH models.
if (HardenInterprocedurally) {
8
←
Assuming the condition is false→
9
←
Taking false branch→
  for (MachineBasicBlock &MBB : MF) {
    assert(!MBB.isEHScopeEntry() && "Only Itanium ABI EH supported!")(static_cast <bool> (!MBB.isEHScopeEntry() && "Only Itanium ABI EH supported!"
) ? void (0) : __assert_fail ("!MBB.isEHScopeEntry() && \"Only Itanium ABI EH supported!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 496, __extension__ __PRETTY_FUNCTION__));
    assert(!MBB.isEHFuncletEntry() && "Only Itanium ABI EH supported!")(static_cast <bool> (!MBB.isEHFuncletEntry() &&
 "Only Itanium ABI EH supported!") ? void (0) : __assert_fail
 ("!MBB.isEHFuncletEntry() && \"Only Itanium ABI EH supported!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 497, __extension__ __PRETTY_FUNCTION__));
    assert(!MBB.isCleanupFuncletEntry() && "Only Itanium ABI EH supported!")(static_cast <bool> (!MBB.isCleanupFuncletEntry() &&
 "Only Itanium ABI EH supported!") ? void (0) : __assert_fail
 ("!MBB.isCleanupFuncletEntry() && \"Only Itanium ABI EH supported!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 498, __extension__ __PRETTY_FUNCTION__));
    if (!MBB.isEHPad())
      continue;
    PS->SSA.AddAvailableValue(
        &MBB,
        extractPredStateFromSP(MBB, MBB.SkipPHIsAndLabels(MBB.begin()), Loc));
  }
}

// Now check all of the loads using the predicate state.
checkAllLoads(MF);
10
←
Calling 'X86SpeculativeLoadHardeningPass::checkAllLoads'→

// Now rewrite all the uses of the pred state using the SSA updater so that
// we track updates through the CFG.
for (MachineInstr *CMovI : CMovs)
  for (MachineOperand &Op : CMovI->operands()) {
    if (!Op.isReg() || Op.getReg() != PS->InitialReg)
      continue;

    PS->SSA.RewriteUse(Op);
  }

// If we are hardening interprocedurally, find each returning block and
// protect the caller from being returned to through misspeculation.
if (HardenInterprocedurally)
  for (MachineBasicBlock &MBB : MF) {
    if (MBB.empty())
      continue;

    MachineInstr &MI = MBB.back();
    if (!MI.isReturn())
      continue;

    hardenReturnInstr(MI);
  }

LLVM_DEBUG(dbgs() << "Final speculative load hardened function:\n"; MF.dump();do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "Final speculative load hardened function:\n"
; MF.dump(); dbgs() << "\n"; MF.verify(this); } } while
 (false)
           dbgs() << "\n"; MF.verify(this))do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "Final speculative load hardened function:\n"
; MF.dump(); dbgs() << "\n"; MF.verify(this); } } while
 (false);
return true;
537}

539/// Implements the naive hardening approach of putting an LFENCE after every
540/// potentially mis-predicted control flow construct.
541///
542/// We include this as an alternative mostly for the purpose of comparison. The
543/// performance impact of this is expected to be extremely severe and not
544/// practical for any real-world users.
545void X86SpeculativeLoadHardeningPass::hardenEdgesWithLFENCE(
  MachineFunction &MF) {
// First, we scan the function looking for blocks that are reached along edges
// that we might want to harden.
SmallSetVector<MachineBasicBlock *, 8> Blocks;
for (MachineBasicBlock &MBB : MF) {
  // If there are no or only one successor, nothing to do here.
  if (MBB.succ_size() <= 1)
    continue;

  // Skip blocks unless their terminators start with a branch. Other
  // terminators don't seem interesting for guarding against misspeculation.
  auto TermIt = MBB.getFirstTerminator();
  if (TermIt == MBB.end() || !TermIt->isBranch())
    continue;

  // Add all the non-EH-pad succossors to the blocks we want to harden. We
  // skip EH pads because there isn't really a condition of interest on
  // entering.
  for (MachineBasicBlock *SuccMBB : MBB.successors())
    if (!SuccMBB->isEHPad())
      Blocks.insert(SuccMBB);
}

for (MachineBasicBlock *MBB : Blocks) {
  auto InsertPt = MBB->SkipPHIsAndLabels(MBB->begin());
  BuildMI(*MBB, InsertPt, DebugLoc(), TII->get(X86::LFENCE));
  ++NumInstsInserted;
  ++NumLFENCEsInserted;
}
575}

577SmallVector<X86SpeculativeLoadHardeningPass::BlockCondInfo, 16>
578X86SpeculativeLoadHardeningPass::collectBlockCondInfo(MachineFunction &MF) {
SmallVector<BlockCondInfo, 16> Infos;

// Walk the function and build up a summary for each block's conditions that
// we need to trace through.
for (MachineBasicBlock &MBB : MF) {
  // If there are no or only one successor, nothing to do here.
  if (MBB.succ_size() <= 1)
    continue;

  // We want to reliably handle any conditional branch terminators in the
  // MBB, so we manually analyze the branch. We can handle all of the
  // permutations here, including ones that analyze branch cannot.
  //
  // The approach is to walk backwards across the terminators, resetting at
  // any unconditional non-indirect branch, and track all conditional edges
  // to basic blocks as well as the fallthrough or unconditional successor
  // edge. For each conditional edge, we track the target and the opposite
  // condition code in order to inject a "no-op" cmov into that successor
  // that will harden the predicate. For the fallthrough/unconditional
  // edge, we inject a separate cmov for each conditional branch with
  // matching condition codes. This effectively implements an "and" of the
  // condition flags, even if there isn't a single condition flag that would
  // directly implement that. We don't bother trying to optimize either of
  // these cases because if such an optimization is possible, LLVM should
  // have optimized the conditional *branches* in that way already to reduce
  // instruction count. This late, we simply assume the minimal number of
  // branch instructions is being emitted and use that to guide our cmov
  // insertion.

  BlockCondInfo Info = {&MBB, {}, nullptr};

  // Now walk backwards through the terminators and build up successors they
  // reach and the conditions.
  for (MachineInstr &MI : llvm::reverse(MBB)) {
    // Once we've handled all the terminators, we're done.
    if (!MI.isTerminator())
      break;

    // If we see a non-branch terminator, we can't handle anything so bail.
    if (!MI.isBranch()) {
      Info.CondBrs.clear();
      break;
    }

    // If we see an unconditional branch, reset our state, clear any
    // fallthrough, and set this is the "else" successor.
    if (MI.getOpcode() == X86::JMP_1) {
      Info.CondBrs.clear();
      Info.UncondBr = &MI;
      continue;
    }

    // If we get an invalid condition, we have an indirect branch or some
    // other unanalyzable "fallthrough" case. We model this as a nullptr for
    // the destination so we can still guard any conditional successors.
    // Consider code sequences like:
    // ```
    //   jCC L1
    //   jmpq *%rax
    // ```
    // We still want to harden the edge to `L1`.
    if (X86::getCondFromBranchOpc(MI.getOpcode()) == X86::COND_INVALID) {
      Info.CondBrs.clear();
      Info.UncondBr = &MI;
      continue;
    }

    // We have a vanilla conditional branch, add it to our list.
    Info.CondBrs.push_back(&MI);
  }
  if (Info.CondBrs.empty()) {
    ++NumBranchesUntraced;
    LLVM_DEBUG(dbgs() << "WARNING: unable to secure successors of block:\n";do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "WARNING: unable to secure successors of block:\n"
; MBB.dump(); } } while (false)
               MBB.dump())do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "WARNING: unable to secure successors of block:\n"
; MBB.dump(); } } while (false);
    continue;
  }

  Infos.push_back(Info);
}

return Infos;
660}

662/// Trace the predicate state through the CFG, instrumenting each conditional
663/// branch such that misspeculation through an edge will poison the predicate
664/// state.
665///
666/// Returns the list of inserted CMov instructions so that they can have their
667/// uses of the predicate state rewritten into proper SSA form once it is
668/// complete.
669SmallVector<MachineInstr *, 16>
670X86SpeculativeLoadHardeningPass::tracePredStateThroughCFG(
  MachineFunction &MF, ArrayRef<BlockCondInfo> Infos) {
// Collect the inserted cmov instructions so we can rewrite their uses of the
// predicate state into SSA form.
SmallVector<MachineInstr *, 16> CMovs;

// Now walk all of the basic blocks looking for ones that end in conditional
// jumps where we need to update this register along each edge.
for (const BlockCondInfo &Info : Infos) {
  MachineBasicBlock &MBB = *Info.MBB;
  const SmallVectorImpl<MachineInstr *> &CondBrs = Info.CondBrs;
  MachineInstr *UncondBr = Info.UncondBr;

  LLVM_DEBUG(dbgs() << "Tracing predicate through block: " << MBB.getName()do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "Tracing predicate through block: "
 << MBB.getName() << "\n"; } } while (false)
                    << "\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "Tracing predicate through block: "
 << MBB.getName() << "\n"; } } while (false);
  ++NumCondBranchesTraced;

  // Compute the non-conditional successor as either the target of any
  // unconditional branch or the layout successor.
  MachineBasicBlock *UncondSucc =
      UncondBr ? (UncondBr->getOpcode() == X86::JMP_1
                      ? UncondBr->getOperand(0).getMBB()
                      : nullptr)
               : &*std::next(MachineFunction::iterator(&MBB));

  // Count how many edges there are to any given successor.
  SmallDenseMap<MachineBasicBlock *, int> SuccCounts;
  if (UncondSucc)
    ++SuccCounts[UncondSucc];
  for (auto *CondBr : CondBrs)
    ++SuccCounts[CondBr->getOperand(0).getMBB()];

  // A lambda to insert cmov instructions into a block checking all of the
  // condition codes in a sequence.
  auto BuildCheckingBlockForSuccAndConds =
      [&](MachineBasicBlock &MBB, MachineBasicBlock &Succ, int SuccCount,
          MachineInstr *Br, MachineInstr *&UncondBr,
          ArrayRef<X86::CondCode> Conds) {
        // First, we split the edge to insert the checking block into a safe
        // location.
        auto &CheckingMBB =
            (SuccCount == 1 && Succ.pred_size() == 1)
                ? Succ
                : splitEdge(MBB, Succ, SuccCount, Br, UncondBr, *TII);

        bool LiveEFLAGS = Succ.isLiveIn(X86::EFLAGS);
        if (!LiveEFLAGS)
          CheckingMBB.addLiveIn(X86::EFLAGS);

        // Now insert the cmovs to implement the checks.
        auto InsertPt = CheckingMBB.begin();
        assert((InsertPt == CheckingMBB.end() || !InsertPt->isPHI()) &&(static_cast <bool> ((InsertPt == CheckingMBB.end() || !
InsertPt->isPHI()) && "Should never have a PHI in the initial checking block as it "
 "always has a single predecessor!") ? void (0) : __assert_fail
 ("(InsertPt == CheckingMBB.end() || !InsertPt->isPHI()) && \"Should never have a PHI in the initial checking block as it \" \"always has a single predecessor!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 723, __extension__ __PRETTY_FUNCTION__))
               "Should never have a PHI in the initial checking block as it "(static_cast <bool> ((InsertPt == CheckingMBB.end() || !
InsertPt->isPHI()) && "Should never have a PHI in the initial checking block as it "
 "always has a single predecessor!") ? void (0) : __assert_fail
 ("(InsertPt == CheckingMBB.end() || !InsertPt->isPHI()) && \"Should never have a PHI in the initial checking block as it \" \"always has a single predecessor!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 723, __extension__ __PRETTY_FUNCTION__))
               "always has a single predecessor!")(static_cast <bool> ((InsertPt == CheckingMBB.end() || !
InsertPt->isPHI()) && "Should never have a PHI in the initial checking block as it "
 "always has a single predecessor!") ? void (0) : __assert_fail
 ("(InsertPt == CheckingMBB.end() || !InsertPt->isPHI()) && \"Should never have a PHI in the initial checking block as it \" \"always has a single predecessor!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 723, __extension__ __PRETTY_FUNCTION__));

        // We will wire each cmov to each other, but need to start with the
        // incoming pred state.
        unsigned CurStateReg = PS->InitialReg;

        for (X86::CondCode Cond : Conds) {
          int PredStateSizeInBytes = TRI->getRegSizeInBits(*PS->RC) / 8;
          auto CMovOp = X86::getCMovFromCond(Cond, PredStateSizeInBytes);

          unsigned UpdatedStateReg = MRI->createVirtualRegister(PS->RC);
          // Note that we intentionally use an empty debug location so that
          // this picks up the preceding location.
          auto CMovI = BuildMI(CheckingMBB, InsertPt, DebugLoc(),
                               TII->get(CMovOp), UpdatedStateReg)
                           .addReg(CurStateReg)
                           .addReg(PS->PoisonReg);
          // If this is the last cmov and the EFLAGS weren't originally
          // live-in, mark them as killed.
          if (!LiveEFLAGS && Cond == Conds.back())
            CMovI->findRegisterUseOperand(X86::EFLAGS)->setIsKill(true);

          ++NumInstsInserted;
          LLVM_DEBUG(dbgs() << "  Inserting cmov: "; CMovI->dump();do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Inserting cmov: "
; CMovI->dump(); dbgs() << "\n"; } } while (false)
                     dbgs() << "\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Inserting cmov: "
; CMovI->dump(); dbgs() << "\n"; } } while (false);

          // The first one of the cmovs will be using the top level
          // `PredStateReg` and need to get rewritten into SSA form.
          if (CurStateReg == PS->InitialReg)
            CMovs.push_back(&*CMovI);

          // The next cmov should start from this one's def.
          CurStateReg = UpdatedStateReg;
        }

        // And put the last one into the available values for SSA form of our
        // predicate state.
        PS->SSA.AddAvailableValue(&CheckingMBB, CurStateReg);
      };

  std::vector<X86::CondCode> UncondCodeSeq;
  for (auto *CondBr : CondBrs) {
    MachineBasicBlock &Succ = *CondBr->getOperand(0).getMBB();
    int &SuccCount = SuccCounts[&Succ];

    X86::CondCode Cond = X86::getCondFromBranchOpc(CondBr->getOpcode());
    X86::CondCode InvCond = X86::GetOppositeBranchCondition(Cond);
    UncondCodeSeq.push_back(Cond);

    BuildCheckingBlockForSuccAndConds(MBB, Succ, SuccCount, CondBr, UncondBr,
                                      {InvCond});

    // Decrement the successor count now that we've split one of the edges.
    // We need to keep the count of edges to the successor accurate in order
    // to know above when to *replace* the successor in the CFG vs. just
    // adding the new successor.
    --SuccCount;
  }

  // Since we may have split edges and changed the number of successors,
  // normalize the probabilities. This avoids doing it each time we split an
  // edge.
  MBB.normalizeSuccProbs();

  // Finally, we need to insert cmovs into the "fallthrough" edge. Here, we
  // need to intersect the other condition codes. We can do this by just
  // doing a cmov for each one.
  if (!UncondSucc)
    // If we have no fallthrough to protect (perhaps it is an indirect jump?)
    // just skip this and continue.
    continue;

  assert(SuccCounts[UncondSucc] == 1 &&(static_cast <bool> (SuccCounts[UncondSucc] == 1 &&
 "We should never have more than one edge to the unconditional "
 "successor at this point because every other edge must have been "
 "split above!") ? void (0) : __assert_fail ("SuccCounts[UncondSucc] == 1 && \"We should never have more than one edge to the unconditional \" \"successor at this point because every other edge must have been \" \"split above!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 798, __extension__ __PRETTY_FUNCTION__))
         "We should never have more than one edge to the unconditional "(static_cast <bool> (SuccCounts[UncondSucc] == 1 &&
 "We should never have more than one edge to the unconditional "
 "successor at this point because every other edge must have been "
 "split above!") ? void (0) : __assert_fail ("SuccCounts[UncondSucc] == 1 && \"We should never have more than one edge to the unconditional \" \"successor at this point because every other edge must have been \" \"split above!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 798, __extension__ __PRETTY_FUNCTION__))
         "successor at this point because every other edge must have been "(static_cast <bool> (SuccCounts[UncondSucc] == 1 &&
 "We should never have more than one edge to the unconditional "
 "successor at this point because every other edge must have been "
 "split above!") ? void (0) : __assert_fail ("SuccCounts[UncondSucc] == 1 && \"We should never have more than one edge to the unconditional \" \"successor at this point because every other edge must have been \" \"split above!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 798, __extension__ __PRETTY_FUNCTION__))
         "split above!")(static_cast <bool> (SuccCounts[UncondSucc] == 1 &&
 "We should never have more than one edge to the unconditional "
 "successor at this point because every other edge must have been "
 "split above!") ? void (0) : __assert_fail ("SuccCounts[UncondSucc] == 1 && \"We should never have more than one edge to the unconditional \" \"successor at this point because every other edge must have been \" \"split above!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 798, __extension__ __PRETTY_FUNCTION__));

  // Sort and unique the codes to minimize them.
  llvm::sort(UncondCodeSeq.begin(), UncondCodeSeq.end());
  UncondCodeSeq.erase(std::unique(UncondCodeSeq.begin(), UncondCodeSeq.end()),
                      UncondCodeSeq.end());

  // Build a checking version of the successor.
  BuildCheckingBlockForSuccAndConds(MBB, *UncondSucc, /*SuccCount*/ 1,
                                    UncondBr, UncondBr, UncondCodeSeq);
}

return CMovs;
811}

813/// Returns true if the instruction has no behavior (specified or otherwise)
814/// that is based on the value of any of its register operands
815///
816/// A classical example of something that is inherently not data invariant is an
817/// indirect jump -- the destination is loaded into icache based on the bits set
818/// in the jump destination register.
819///
820/// FIXME: This should become part of our instruction tables.
821static bool isDataInvariant(MachineInstr &MI) {
switch (MI.getOpcode()) {
default:
  // By default, assume that the instruction is not data invariant.
  return false;

  // Some target-independent operations that trivially lower to data-invariant
  // instructions.
case TargetOpcode::COPY:
case TargetOpcode::INSERT_SUBREG:
case TargetOpcode::SUBREG_TO_REG:
  return true;

// On x86 it is believed that imul is constant time w.r.t. the loaded data.
// However, they set flags and are perhaps the most surprisingly constant
// time operations so we call them out here separately.
case X86::IMUL16rr:
case X86::IMUL16rri8:
case X86::IMUL16rri:
case X86::IMUL32rr:
case X86::IMUL32rri8:
case X86::IMUL32rri:
case X86::IMUL64rr:
case X86::IMUL64rri32:
case X86::IMUL64rri8:

// Bit scanning and counting instructions that are somewhat surprisingly
// constant time as they scan across bits and do other fairly complex
// operations like popcnt, but are believed to be constant time on x86.
// However, these set flags.
case X86::BSF16rr:
case X86::BSF32rr:
case X86::BSF64rr:
case X86::BSR16rr:
case X86::BSR32rr:
case X86::BSR64rr:
case X86::LZCNT16rr:
case X86::LZCNT32rr:
case X86::LZCNT64rr:
case X86::POPCNT16rr:
case X86::POPCNT32rr:
case X86::POPCNT64rr:
case X86::TZCNT16rr:
case X86::TZCNT32rr:
case X86::TZCNT64rr:

// Bit manipulation instructions are effectively combinations of basic
// arithmetic ops, and should still execute in constant time. These also
// set flags.
case X86::BLCFILL32rr:
case X86::BLCFILL64rr:
case X86::BLCI32rr:
case X86::BLCI64rr:
case X86::BLCIC32rr:
case X86::BLCIC64rr:
case X86::BLCMSK32rr:
case X86::BLCMSK64rr:
case X86::BLCS32rr:
case X86::BLCS64rr:
case X86::BLSFILL32rr:
case X86::BLSFILL64rr:
case X86::BLSI32rr:
case X86::BLSI64rr:
case X86::BLSIC32rr:
case X86::BLSIC64rr:
case X86::BLSMSK32rr:
case X86::BLSMSK64rr:
case X86::BLSR32rr:
case X86::BLSR64rr:
case X86::TZMSK32rr:
case X86::TZMSK64rr:

// Bit extracting and clearing instructions should execute in constant time,
// and set flags.
case X86::BEXTR32rr:
case X86::BEXTR64rr:
case X86::BEXTRI32ri:
case X86::BEXTRI64ri:
case X86::BZHI32rr:
case X86::BZHI64rr:

// Shift and rotate.
case X86::ROL8r1:  case X86::ROL16r1:  case X86::ROL32r1:  case X86::ROL64r1:
case X86::ROL8rCL: case X86::ROL16rCL: case X86::ROL32rCL: case X86::ROL64rCL:
case X86::ROL8ri:  case X86::ROL16ri:  case X86::ROL32ri:  case X86::ROL64ri:
case X86::ROR8r1:  case X86::ROR16r1:  case X86::ROR32r1:  case X86::ROR64r1:
case X86::ROR8rCL: case X86::ROR16rCL: case X86::ROR32rCL: case X86::ROR64rCL:
case X86::ROR8ri:  case X86::ROR16ri:  case X86::ROR32ri:  case X86::ROR64ri:
case X86::SAR8r1:  case X86::SAR16r1:  case X86::SAR32r1:  case X86::SAR64r1:
case X86::SAR8rCL: case X86::SAR16rCL: case X86::SAR32rCL: case X86::SAR64rCL:
case X86::SAR8ri:  case X86::SAR16ri:  case X86::SAR32ri:  case X86::SAR64ri:
case X86::SHL8r1:  case X86::SHL16r1:  case X86::SHL32r1:  case X86::SHL64r1:
case X86::SHL8rCL: case X86::SHL16rCL: case X86::SHL32rCL: case X86::SHL64rCL:
case X86::SHL8ri:  case X86::SHL16ri:  case X86::SHL32ri:  case X86::SHL64ri:
case X86::SHR8r1:  case X86::SHR16r1:  case X86::SHR32r1:  case X86::SHR64r1:
case X86::SHR8rCL: case X86::SHR16rCL: case X86::SHR32rCL: case X86::SHR64rCL:
case X86::SHR8ri:  case X86::SHR16ri:  case X86::SHR32ri:  case X86::SHR64ri:
case X86::SHLD16rrCL: case X86::SHLD32rrCL: case X86::SHLD64rrCL:
case X86::SHLD16rri8: case X86::SHLD32rri8: case X86::SHLD64rri8:
case X86::SHRD16rrCL: case X86::SHRD32rrCL: case X86::SHRD64rrCL:
case X86::SHRD16rri8: case X86::SHRD32rri8: case X86::SHRD64rri8:

// Basic arithmetic is constant time on the input but does set flags.
case X86::ADC8rr:   case X86::ADC8ri:
case X86::ADC16rr:  case X86::ADC16ri:   case X86::ADC16ri8:
case X86::ADC32rr:  case X86::ADC32ri:   case X86::ADC32ri8:
case X86::ADC64rr:  case X86::ADC64ri8:  case X86::ADC64ri32:
case X86::ADD8rr:   case X86::ADD8ri:
case X86::ADD16rr:  case X86::ADD16ri:   case X86::ADD16ri8:
case X86::ADD32rr:  case X86::ADD32ri:   case X86::ADD32ri8:
case X86::ADD64rr:  case X86::ADD64ri8:  case X86::ADD64ri32:
case X86::AND8rr:   case X86::AND8ri:
case X86::AND16rr:  case X86::AND16ri:   case X86::AND16ri8:
case X86::AND32rr:  case X86::AND32ri:   case X86::AND32ri8:
case X86::AND64rr:  case X86::AND64ri8:  case X86::AND64ri32:
case X86::OR8rr:    case X86::OR8ri:
case X86::OR16rr:   case X86::OR16ri:    case X86::OR16ri8:
case X86::OR32rr:   case X86::OR32ri:    case X86::OR32ri8:
case X86::OR64rr:   case X86::OR64ri8:   case X86::OR64ri32:
case X86::SBB8rr:   case X86::SBB8ri:
case X86::SBB16rr:  case X86::SBB16ri:   case X86::SBB16ri8:
case X86::SBB32rr:  case X86::SBB32ri:   case X86::SBB32ri8:
case X86::SBB64rr:  case X86::SBB64ri8:  case X86::SBB64ri32:
case X86::SUB8rr:   case X86::SUB8ri:
case X86::SUB16rr:  case X86::SUB16ri:   case X86::SUB16ri8:
case X86::SUB32rr:  case X86::SUB32ri:   case X86::SUB32ri8:
case X86::SUB64rr:  case X86::SUB64ri8:  case X86::SUB64ri32:
case X86::XOR8rr:   case X86::XOR8ri:
case X86::XOR16rr:  case X86::XOR16ri:   case X86::XOR16ri8:
case X86::XOR32rr:  case X86::XOR32ri:   case X86::XOR32ri8:
case X86::XOR64rr:  case X86::XOR64ri8:  case X86::XOR64ri32:
// Arithmetic with just 32-bit and 64-bit variants and no immediates.
case X86::ADCX32rr: case X86::ADCX64rr:
case X86::ADOX32rr: case X86::ADOX64rr:
case X86::ANDN32rr: case X86::ANDN64rr:
// Unary arithmetic operations.
case X86::DEC8r: case X86::DEC16r: case X86::DEC32r: case X86::DEC64r:
case X86::INC8r: case X86::INC16r: case X86::INC32r: case X86::INC64r:
case X86::NEG8r: case X86::NEG16r: case X86::NEG32r: case X86::NEG64r:
  // Check whether the EFLAGS implicit-def is dead. We assume that this will
  // always find the implicit-def because this code should only be reached
  // for instructions that do in fact implicitly def this.
  if (!MI.findRegisterDefOperand(X86::EFLAGS)->isDead()) {
    // If we would clobber EFLAGS that are used, just bail for now.
    LLVM_DEBUG(dbgs() << "    Unable to harden post-load due to EFLAGS: ";do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "    Unable to harden post-load due to EFLAGS: "
; MI.dump(); dbgs() << "\n"; } } while (false)
               MI.dump(); dbgs() << "\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "    Unable to harden post-load due to EFLAGS: "
; MI.dump(); dbgs() << "\n"; } } while (false);
    return false;
  }

  // Otherwise, fallthrough to handle these the same as instructions that
  // don't set EFLAGS.
  LLVM_FALLTHROUGH[[clang::fallthrough]];

// Unlike other arithmetic, NOT doesn't set EFLAGS.
case X86::NOT8r: case X86::NOT16r: case X86::NOT32r: case X86::NOT64r:

// Various move instructions used to zero or sign extend things. Note that we
// intentionally don't support the _NOREX variants as we can't handle that
// register constraint anyways.
case X86::MOVSX16rr8:
case X86::MOVSX32rr8: case X86::MOVSX32rr16:
case X86::MOVSX64rr8: case X86::MOVSX64rr16: case X86::MOVSX64rr32:
case X86::MOVZX16rr8:
case X86::MOVZX32rr8: case X86::MOVZX32rr16:
case X86::MOVZX64rr8: case X86::MOVZX64rr16:
case X86::MOV32rr:

// Arithmetic instructions that are both constant time and don't set flags.
case X86::RORX32ri:
case X86::RORX64ri:
case X86::SARX32rr:
case X86::SARX64rr:
case X86::SHLX32rr:
case X86::SHLX64rr:
case X86::SHRX32rr:
case X86::SHRX64rr:

// LEA doesn't actually access memory, and its arithmetic is constant time.
case X86::LEA16r:
case X86::LEA32r:
case X86::LEA64_32r:
case X86::LEA64r:
  return true;
}
1005}

1007/// Returns true if the instruction has no behavior (specified or otherwise)
1008/// that is based on the value loaded from memory or the value of any
1009/// non-address register operands.
1010///
1011/// For example, if the latency of the instruction is dependent on the
1012/// particular bits set in any of the registers *or* any of the bits loaded from
1013/// memory.
1014///
1015/// A classical example of something that is inherently not data invariant is an
1016/// indirect jump -- the destination is loaded into icache based on the bits set
1017/// in the jump destination register.
1018///
1019/// FIXME: This should become part of our instruction tables.
1020static bool isDataInvariantLoad(MachineInstr &MI) {
switch (MI.getOpcode()) {
default:
  // By default, assume that the load will immediately leak.
  return false;

// On x86 it is believed that imul is constant time w.r.t. the loaded data.
// However, they set flags and are perhaps the most surprisingly constant
// time operations so we call them out here separately.
case X86::IMUL16rm:
case X86::IMUL16rmi8:
case X86::IMUL16rmi:
case X86::IMUL32rm:
case X86::IMUL32rmi8:
case X86::IMUL32rmi:
case X86::IMUL64rm:
case X86::IMUL64rmi32:
case X86::IMUL64rmi8:

// Bit scanning and counting instructions that are somewhat surprisingly
// constant time as they scan across bits and do other fairly complex
// operations like popcnt, but are believed to be constant time on x86.
// However, these set flags.
case X86::BSF16rm:
case X86::BSF32rm:
case X86::BSF64rm:
case X86::BSR16rm:
case X86::BSR32rm:
case X86::BSR64rm:
case X86::LZCNT16rm:
case X86::LZCNT32rm:
case X86::LZCNT64rm:
case X86::POPCNT16rm:
case X86::POPCNT32rm:
case X86::POPCNT64rm:
case X86::TZCNT16rm:
case X86::TZCNT32rm:
case X86::TZCNT64rm:

// Bit manipulation instructions are effectively combinations of basic
// arithmetic ops, and should still execute in constant time. These also
// set flags.
case X86::BLCFILL32rm:
case X86::BLCFILL64rm:
case X86::BLCI32rm:
case X86::BLCI64rm:
case X86::BLCIC32rm:
case X86::BLCIC64rm:
case X86::BLCMSK32rm:
case X86::BLCMSK64rm:
case X86::BLCS32rm:
case X86::BLCS64rm:
case X86::BLSFILL32rm:
case X86::BLSFILL64rm:
case X86::BLSI32rm:
case X86::BLSI64rm:
case X86::BLSIC32rm:
case X86::BLSIC64rm:
case X86::BLSMSK32rm:
case X86::BLSMSK64rm:
case X86::BLSR32rm:
case X86::BLSR64rm:
case X86::TZMSK32rm:
case X86::TZMSK64rm:

// Bit extracting and clearing instructions should execute in constant time,
// and set flags.
case X86::BEXTR32rm:
case X86::BEXTR64rm:
case X86::BEXTRI32mi:
case X86::BEXTRI64mi:
case X86::BZHI32rm:
case X86::BZHI64rm:

// Basic arithmetic is constant time on the input but does set flags.
case X86::ADC8rm:
case X86::ADC16rm:
case X86::ADC32rm:
case X86::ADC64rm:
case X86::ADCX32rm:
case X86::ADCX64rm:
case X86::ADD8rm:
case X86::ADD16rm:
case X86::ADD32rm:
case X86::ADD64rm:
case X86::ADOX32rm:
case X86::ADOX64rm:
case X86::AND8rm:
case X86::AND16rm:
case X86::AND32rm:
case X86::AND64rm:
case X86::ANDN32rm:
case X86::ANDN64rm:
case X86::OR8rm:
case X86::OR16rm:
case X86::OR32rm:
case X86::OR64rm:
case X86::SBB8rm:
case X86::SBB16rm:
case X86::SBB32rm:
case X86::SBB64rm:
case X86::SUB8rm:
case X86::SUB16rm:
case X86::SUB32rm:
case X86::SUB64rm:
case X86::XOR8rm:
case X86::XOR16rm:
case X86::XOR32rm:
case X86::XOR64rm:
  // Check whether the EFLAGS implicit-def is dead. We assume that this will
  // always find the implicit-def because this code should only be reached
  // for instructions that do in fact implicitly def this.
  if (!MI.findRegisterDefOperand(X86::EFLAGS)->isDead()) {
    // If we would clobber EFLAGS that are used, just bail for now.
    LLVM_DEBUG(dbgs() << "    Unable to harden post-load due to EFLAGS: ";do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "    Unable to harden post-load due to EFLAGS: "
; MI.dump(); dbgs() << "\n"; } } while (false)
               MI.dump(); dbgs() << "\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "    Unable to harden post-load due to EFLAGS: "
; MI.dump(); dbgs() << "\n"; } } while (false);
    return false;
  }

  // Otherwise, fallthrough to handle these the same as instructions that
  // don't set EFLAGS.
  LLVM_FALLTHROUGH[[clang::fallthrough]];

// Integer multiply w/o affecting flags is still believed to be constant
// time on x86. Called out separately as this is among the most surprising
// instructions to exhibit that behavior.
case X86::MULX32rm:
case X86::MULX64rm:

// Arithmetic instructions that are both constant time and don't set flags.
case X86::RORX32mi:
case X86::RORX64mi:
case X86::SARX32rm:
case X86::SARX64rm:
case X86::SHLX32rm:
case X86::SHLX64rm:
case X86::SHRX32rm:
case X86::SHRX64rm:

// Conversions are believed to be constant time and don't set flags.
case X86::CVTTSD2SI64rm: case X86::VCVTTSD2SI64rm: case X86::VCVTTSD2SI64Zrm:
case X86::CVTTSD2SIrm:   case X86::VCVTTSD2SIrm:   case X86::VCVTTSD2SIZrm:
case X86::CVTTSS2SI64rm: case X86::VCVTTSS2SI64rm: case X86::VCVTTSS2SI64Zrm:
case X86::CVTTSS2SIrm:   case X86::VCVTTSS2SIrm:   case X86::VCVTTSS2SIZrm:
case X86::CVTSI2SDrm:    case X86::VCVTSI2SDrm:    case X86::VCVTSI2SDZrm:
case X86::CVTSI2SSrm:    case X86::VCVTSI2SSrm:    case X86::VCVTSI2SSZrm:
case X86::CVTSI642SDrm:  case X86::VCVTSI642SDrm:  case X86::VCVTSI642SDZrm:
case X86::CVTSI642SSrm:  case X86::VCVTSI642SSrm:  case X86::VCVTSI642SSZrm:
case X86::CVTSS2SDrm:    case X86::VCVTSS2SDrm:    case X86::VCVTSS2SDZrm:
case X86::CVTSD2SSrm:    case X86::VCVTSD2SSrm:    case X86::VCVTSD2SSZrm:
// AVX512 added unsigned integer conversions.
case X86::VCVTTSD2USI64Zrm:
case X86::VCVTTSD2USIZrm:
case X86::VCVTTSS2USI64Zrm:
case X86::VCVTTSS2USIZrm:
case X86::VCVTUSI2SDZrm:
case X86::VCVTUSI642SDZrm:
case X86::VCVTUSI2SSZrm:
case X86::VCVTUSI642SSZrm:

// Loads to register don't set flags.
case X86::MOV8rm:
case X86::MOV8rm_NOREX:
case X86::MOV16rm:
case X86::MOV32rm:
case X86::MOV64rm:
case X86::MOVSX16rm8:
case X86::MOVSX32rm16:
case X86::MOVSX32rm8:
case X86::MOVSX32rm8_NOREX:
case X86::MOVSX64rm16:
case X86::MOVSX64rm32:
case X86::MOVSX64rm8:
case X86::MOVZX16rm8:
case X86::MOVZX32rm16:
case X86::MOVZX32rm8:
case X86::MOVZX32rm8_NOREX:
case X86::MOVZX64rm16:
case X86::MOVZX64rm8:
  return true;
}
1201}

1203static bool isEFLAGSLive(MachineBasicBlock &MBB, MachineBasicBlock::iterator I,
                       const TargetRegisterInfo &TRI) {
// Check if EFLAGS are alive by seeing if there is a def of them or they
// live-in, and then seeing if that def is in turn used.
for (MachineInstr &MI : llvm::reverse(llvm::make_range(MBB.begin(), I))) {
  if (MachineOperand *DefOp = MI.findRegisterDefOperand(X86::EFLAGS)) {
    // If the def is dead, then EFLAGS is not live.
    if (DefOp->isDead())
      return false;

    // Otherwise we've def'ed it, and it is live.
    return true;
  }
  // While at this instruction, also check if we use and kill EFLAGS
  // which means it isn't live.
  if (MI.killsRegister(X86::EFLAGS, &TRI))
    return false;
}

// If we didn't find anything conclusive (neither definitely alive or
// definitely dead) return whether it lives into the block.
return MBB.isLiveIn(X86::EFLAGS);
1225}

1227void X86SpeculativeLoadHardeningPass::checkAllLoads(MachineFunction &MF) {
// If the actual checking of loads is disabled, skip doing anything here.
if (!HardenLoads)
11
←
Assuming the condition is false→
12
←
Taking false branch→
  return;

SmallPtrSet<MachineInstr *, 16> HardenPostLoad;
SmallPtrSet<MachineInstr *, 16> HardenLoadAddr;

SmallSet<unsigned, 16> HardenedAddrRegs;

SmallDenseMap<unsigned, unsigned, 32> AddrRegToHardenedReg;

// Track the set of load-dependent registers through the basic block. Because
// the values of these registers have an existing data dependency on a loaded
// value which we would have checked, we can omit any checks on them.
SparseBitVector<> LoadDepRegs;

for (MachineBasicBlock &MBB : MF) {
  // We harden the loads of a basic block in several passes:
  //
  // 1) Collect all the loads which can have their loaded value hardened
  //    and all the loads that instead need their address hardened. During
  //    this walk we propagate load dependence for address hardened loads and
  //    also look for LFENCE to stop hardening wherever possible. When
  //    deciding whether or not to harden the loaded value or not, we check
  //    to see if any registers used in the address will have been hardened
  //    at this point and if so, harden any remaining address registers as
  //    that often successfully re-uses hardened addresses and minimizes
  //    instructions. FIXME: We should consider an aggressive mode where we
  //    continue to keep as many loads value hardened even when some address
  //    register hardening would be free (due to reuse).
  for (MachineInstr &MI : MBB) {
    // We naively assume that all def'ed registers of an instruction have
    // a data dependency on all of their operands.
    // FIXME: Do a more careful analysis of x86 to build a conservative model
    // here.
    if (llvm::any_of(MI.uses(), [&](MachineOperand &Op) {
          return Op.isReg() && LoadDepRegs.test(Op.getReg());
        }))
      for (MachineOperand &Def : MI.defs())
        if (Def.isReg())
          LoadDepRegs.set(Def.getReg());

    // Both Intel and AMD are guiding that they will change the semantics of
    // LFENCE to be a speculation barrier, so if we see an LFENCE, there is
    // no more need to guard things in this block.
    if (MI.getOpcode() == X86::LFENCE)
      break;

    // If this instruction cannot load, nothing to do.
    if (!MI.mayLoad())
      continue;

    // Some instructions which "load" are trivially safe or unimportant.
    if (MI.getOpcode() == X86::MFENCE)
      continue;

    // Extract the memory operand information about this instruction.
    // FIXME: This doesn't handle loading pseudo instructions which we often
    // could handle with similarly generic logic. We probably need to add an
    // MI-layer routine similar to the MC-layer one we use here which maps
    // pseudos much like this maps real instructions.
    const MCInstrDesc &Desc = MI.getDesc();
    int MemRefBeginIdx = X86II::getMemoryOperandNo(Desc.TSFlags);
    if (MemRefBeginIdx < 0) {
      LLVM_DEBUG(dbgs() << "WARNING: unable to harden loading instruction: ";do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "WARNING: unable to harden loading instruction: "
; MI.dump(); } } while (false)
                 MI.dump())do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "WARNING: unable to harden loading instruction: "
; MI.dump(); } } while (false);
      continue;
    }

    MemRefBeginIdx += X86II::getOperandBias(Desc);

    MachineOperand &BaseMO = MI.getOperand(MemRefBeginIdx + X86::AddrBaseReg);
    MachineOperand &IndexMO =
        MI.getOperand(MemRefBeginIdx + X86::AddrIndexReg);

    // If we have at least one (non-frame-index, non-RIP) register operand,
    // and neither operand is load-dependent, we need to check the load.
    unsigned BaseReg = 0, IndexReg = 0;
    if (!BaseMO.isFI() && BaseMO.getReg() != X86::RIP &&
        BaseMO.getReg() != X86::NoRegister)
      BaseReg = BaseMO.getReg();
    if (IndexMO.getReg() != X86::NoRegister)
      IndexReg = IndexMO.getReg();

    if (!BaseReg && !IndexReg)
      // No register operands!
      continue;

    // If any register operand is dependent, this load is dependent and we
    // needn't check it.
    // FIXME: Is this true in the case where we are hardening loads after
    // they complete? Unclear, need to investigate.
    if ((BaseReg && LoadDepRegs.test(BaseReg)) ||
        (IndexReg && LoadDepRegs.test(IndexReg)))
      continue;

    // If post-load hardening is enabled, this load is compatible with
    // post-load hardening, and we aren't already going to harden one of the
    // address registers, queue it up to be hardened post-load. Notably, even
    // once hardened this won't introduce a useful dependency that could prune
    // out subsequent loads.
    if (EnablePostLoadHardening && isDataInvariantLoad(MI) &&
        MI.getDesc().getNumDefs() == 1 && MI.getOperand(0).isReg() &&
        canHardenRegister(MI.getOperand(0).getReg()) &&
        !HardenedAddrRegs.count(BaseReg) &&
        !HardenedAddrRegs.count(IndexReg)) {
      HardenPostLoad.insert(&MI);
      HardenedAddrRegs.insert(MI.getOperand(0).getReg());
      continue;
    }

    // Record this instruction for address hardening and record its register
    // operands as being address-hardened.
    HardenLoadAddr.insert(&MI);
    if (BaseReg)
      HardenedAddrRegs.insert(BaseReg);
    if (IndexReg)
      HardenedAddrRegs.insert(IndexReg);

    for (MachineOperand &Def : MI.defs())
      if (Def.isReg())
        LoadDepRegs.set(Def.getReg());
  }

  // Now re-walk the instructions in the basic block, and apply whichever
  // hardening strategy we have elected. Note that we do this in a second
  // pass specifically so that we have the complete set of instructions for
  // which we will do post-load hardening and can defer it in certain
  // circumstances.
  //
  // FIXME: This could probably be made even more effective by doing it
  // across the entire function. Rather than just walking the flat list
  // backwards here, we could walk the function in PO and each block bottom
  // up, allowing us to in some cases sink hardening across block blocks. As
  // long as the in-block predicate state is used at the eventual hardening
  // site, this remains safe.
  for (MachineInstr &MI : MBB) {
    // We cannot both require hardening the def of a load and its address.
    assert(!(HardenLoadAddr.count(&MI) && HardenPostLoad.count(&MI)) &&(static_cast <bool> (!(HardenLoadAddr.count(&MI) &&
 HardenPostLoad.count(&MI)) && "Requested to harden both the address and def of a load!"
) ? void (0) : __assert_fail ("!(HardenLoadAddr.count(&MI) && HardenPostLoad.count(&MI)) && \"Requested to harden both the address and def of a load!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1367, __extension__ __PRETTY_FUNCTION__))
           "Requested to harden both the address and def of a load!")(static_cast <bool> (!(HardenLoadAddr.count(&MI) &&
 HardenPostLoad.count(&MI)) && "Requested to harden both the address and def of a load!"
) ? void (0) : __assert_fail ("!(HardenLoadAddr.count(&MI) && HardenPostLoad.count(&MI)) && \"Requested to harden both the address and def of a load!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1367, __extension__ __PRETTY_FUNCTION__));

    // Check if this is a load whose address needs to be hardened.
    if (HardenLoadAddr.erase(&MI)) {
13
←
Assuming the condition is false→
14
←
Taking false branch→
      const MCInstrDesc &Desc = MI.getDesc();
      int MemRefBeginIdx = X86II::getMemoryOperandNo(Desc.TSFlags);
      assert(MemRefBeginIdx >= 0 && "Cannot have an invalid index here!")(static_cast <bool> (MemRefBeginIdx >= 0 && "Cannot have an invalid index here!"
) ? void (0) : __assert_fail ("MemRefBeginIdx >= 0 && \"Cannot have an invalid index here!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1373, __extension__ __PRETTY_FUNCTION__));

      MemRefBeginIdx += X86II::getOperandBias(Desc);

      MachineOperand &BaseMO =
          MI.getOperand(MemRefBeginIdx + X86::AddrBaseReg);
      MachineOperand &IndexMO =
          MI.getOperand(MemRefBeginIdx + X86::AddrIndexReg);
      hardenLoadAddr(MI, BaseMO, IndexMO, AddrRegToHardenedReg);
      continue;
    }

    // Test if this instruction is one of our post load instructions (and
    // remove it from the set if so).
    if (HardenPostLoad.erase(&MI)) {
15
←
Assuming the condition is true→
16
←
Taking true branch→
      assert(!MI.isCall() && "Must not try to post-load harden a call!")(static_cast <bool> (!MI.isCall() && "Must not try to post-load harden a call!"
) ? void (0) : __assert_fail ("!MI.isCall() && \"Must not try to post-load harden a call!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1388, __extension__ __PRETTY_FUNCTION__));

      // If this is a data-invariant load, we want to try and sink any
      // hardening as far as possible.
      if (isDataInvariantLoad(MI)) {
17
←
Assuming the condition is false→
18
←
Taking false branch→
        // Sink the instruction we'll need to harden as far as we can down the
        // graph.
        MachineInstr *SunkMI = sinkPostLoadHardenedInst(MI, HardenPostLoad);

        // If we managed to sink this instruction, update everything so we
        // harden that instruction when we reach it in the instruction
        // sequence.
        if (SunkMI != &MI) {
          // If in sinking there was no instruction needing to be hardened,
          // we're done.
          if (!SunkMI)
            continue;

          // Otherwise, add this to the set of defs we harden.
          HardenPostLoad.insert(SunkMI);
          continue;
        }
      }

      // The register def'ed by this instruction is trivially hardened so map
      // it to itself.
      AddrRegToHardenedReg[MI.getOperand(0).getReg()] =
          MI.getOperand(0).getReg();

      hardenPostLoad(MI);
19
←
Calling 'X86SpeculativeLoadHardeningPass::hardenPostLoad'→
      continue;
    }

    // After we finish processing the instruction and doing any hardening
    // necessary for it, we need to handle transferring the predicate state
    // into a call and recovering it after the call returns (if it returns).
    if (!MI.isCall())
      continue;

    // If we're not hardening interprocedurally, we can just skip calls.
    if (!HardenInterprocedurally)
      continue;

    auto InsertPt = MI.getIterator();
    DebugLoc Loc = MI.getDebugLoc();

    // First, we transfer the predicate state into the called function by
    // merging it into the stack pointer. This will kill the current def of
    // the state.
    unsigned StateReg = PS->SSA.GetValueAtEndOfBlock(&MBB);
    mergePredStateIntoSP(MBB, InsertPt, Loc, StateReg);

    // If this call is also a return (because it is a tail call) we're done.
    if (MI.isReturn())
      continue;

    // Otherwise we need to step past the call and recover the predicate
    // state from SP after the return, and make this new state available.
    ++InsertPt;
    unsigned NewStateReg = extractPredStateFromSP(MBB, InsertPt, Loc);
    PS->SSA.AddAvailableValue(&MBB, NewStateReg);
  }

  HardenPostLoad.clear();
  HardenLoadAddr.clear();
  HardenedAddrRegs.clear();
  AddrRegToHardenedReg.clear();

  // Currently, we only track data-dependent loads within a basic block.
  // FIXME: We should see if this is necessary or if we could be more
  // aggressive here without opening up attack avenues.
  LoadDepRegs.clear();
}
1461}

1463/// Save EFLAGS into the returned GPR. This can in turn be restored with
1464/// `restoreEFLAGS`.
1465///
1466/// Note that LLVM can only lower very simple patterns of saved and restored
1467/// EFLAGS registers. The restore should always be within the same basic block
1468/// as the save so that no PHI nodes are inserted.
1469unsigned X86SpeculativeLoadHardeningPass::saveEFLAGS(
  MachineBasicBlock &MBB, MachineBasicBlock::iterator InsertPt,
  DebugLoc Loc) {
// FIXME: Hard coding this to a 32-bit register class seems weird, but matches
// what instruction selection does.
unsigned Reg = MRI->createVirtualRegister(&X86::GR32RegClass);
// We directly copy the FLAGS register and rely on later lowering to clean
// this up into the appropriate setCC instructions.
BuildMI(MBB, InsertPt, Loc, TII->get(X86::COPY), Reg).addReg(X86::EFLAGS);
++NumInstsInserted;
return Reg;
1480}

1482/// Restore EFLAGS from the provided GPR. This should be produced by
1483/// `saveEFLAGS`.
1484///
1485/// This must be done within the same basic block as the save in order to
1486/// reliably lower.
1487void X86SpeculativeLoadHardeningPass::restoreEFLAGS(
  MachineBasicBlock &MBB, MachineBasicBlock::iterator InsertPt, DebugLoc Loc,
  unsigned Reg) {
BuildMI(MBB, InsertPt, Loc, TII->get(X86::COPY), X86::EFLAGS).addReg(Reg);
++NumInstsInserted;
1492}

1494/// Takes the current predicate state (in a register) and merges it into the
1495/// stack pointer. The state is essentially a single bit, but we merge this in
1496/// a way that won't form non-canonical pointers and also will be preserved
1497/// across normal stack adjustments.
1498void X86SpeculativeLoadHardeningPass::mergePredStateIntoSP(
  MachineBasicBlock &MBB, MachineBasicBlock::iterator InsertPt, DebugLoc Loc,
  unsigned PredStateReg) {
unsigned TmpReg = MRI->createVirtualRegister(PS->RC);
// FIXME: This hard codes a shift distance based on the number of bits needed
// to stay canonical on 64-bit. We should compute this somehow and support
// 32-bit as part of that.
auto ShiftI = BuildMI(MBB, InsertPt, Loc, TII->get(X86::SHL64ri), TmpReg)
                  .addReg(PredStateReg, RegState::Kill)
                  .addImm(47);
ShiftI->addRegisterDead(X86::EFLAGS, TRI);
++NumInstsInserted;
auto OrI = BuildMI(MBB, InsertPt, Loc, TII->get(X86::OR64rr), X86::RSP)
               .addReg(X86::RSP)
               .addReg(TmpReg, RegState::Kill);
OrI->addRegisterDead(X86::EFLAGS, TRI);
++NumInstsInserted;
1515}

1517/// Extracts the predicate state stored in the high bits of the stack pointer.
1518unsigned X86SpeculativeLoadHardeningPass::extractPredStateFromSP(
  MachineBasicBlock &MBB, MachineBasicBlock::iterator InsertPt,
  DebugLoc Loc) {
unsigned PredStateReg = MRI->createVirtualRegister(PS->RC);
unsigned TmpReg = MRI->createVirtualRegister(PS->RC);

// We know that the stack pointer will have any preserved predicate state in
// its high bit. We just want to smear this across the other bits. Turns out,
// this is exactly what an arithmetic right shift does.
BuildMI(MBB, InsertPt, Loc, TII->get(TargetOpcode::COPY), TmpReg)
    .addReg(X86::RSP);
auto ShiftI =
    BuildMI(MBB, InsertPt, Loc, TII->get(X86::SAR64ri), PredStateReg)
        .addReg(TmpReg, RegState::Kill)
        .addImm(TRI->getRegSizeInBits(*PS->RC) - 1);
ShiftI->addRegisterDead(X86::EFLAGS, TRI);
++NumInstsInserted;

return PredStateReg;
1537}

1539void X86SpeculativeLoadHardeningPass::hardenLoadAddr(
  MachineInstr &MI, MachineOperand &BaseMO, MachineOperand &IndexMO,
  SmallDenseMap<unsigned, unsigned, 32> &AddrRegToHardenedReg) {
MachineBasicBlock &MBB = *MI.getParent();
DebugLoc Loc = MI.getDebugLoc();

// Check if EFLAGS are alive by seeing if there is a def of them or they
// live-in, and then seeing if that def is in turn used.
bool EFLAGSLive = isEFLAGSLive(MBB, MI.getIterator(), *TRI);

SmallVector<MachineOperand *, 2> HardenOpRegs;

if (BaseMO.isFI()) {
  // A frame index is never a dynamically controllable load, so only
  // harden it if we're covering fixed address loads as well.
  LLVM_DEBUG(do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Skipping hardening base of explicit stack frame load: "
; MI.dump(); dbgs() << "\n"; } } while (false)
      dbgs() << "  Skipping hardening base of explicit stack frame load: ";do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Skipping hardening base of explicit stack frame load: "
; MI.dump(); dbgs() << "\n"; } } while (false)
      MI.dump(); dbgs() << "\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Skipping hardening base of explicit stack frame load: "
; MI.dump(); dbgs() << "\n"; } } while (false);
} else if (BaseMO.getReg() == X86::RIP ||
           BaseMO.getReg() == X86::NoRegister) {
  // For both RIP-relative addressed loads or absolute loads, we cannot
  // meaningfully harden them because the address being loaded has no
  // dynamic component.
  //
  // FIXME: When using a segment base (like TLS does) we end up with the
  // dynamic address being the base plus -1 because we can't mutate the
  // segment register here. This allows the signed 32-bit offset to point at
  // valid segment-relative addresses and load them successfully.
  LLVM_DEBUG(do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Cannot harden base of "
 << (BaseMO.getReg() == X86::RIP ? "RIP-relative" : "no-base"
) << " address in a load!"; } } while (false)
      dbgs() << "  Cannot harden base of "do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Cannot harden base of "
 << (BaseMO.getReg() == X86::RIP ? "RIP-relative" : "no-base"
) << " address in a load!"; } } while (false)
             << (BaseMO.getReg() == X86::RIP ? "RIP-relative" : "no-base")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Cannot harden base of "
 << (BaseMO.getReg() == X86::RIP ? "RIP-relative" : "no-base"
) << " address in a load!"; } } while (false)
             << " address in a load!")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Cannot harden base of "
 << (BaseMO.getReg() == X86::RIP ? "RIP-relative" : "no-base"
) << " address in a load!"; } } while (false);
} else {
  assert(BaseMO.isReg() &&(static_cast <bool> (BaseMO.isReg() && "Only allowed to have a frame index or register base."
) ? void (0) : __assert_fail ("BaseMO.isReg() && \"Only allowed to have a frame index or register base.\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1573, __extension__ __PRETTY_FUNCTION__))
         "Only allowed to have a frame index or register base.")(static_cast <bool> (BaseMO.isReg() && "Only allowed to have a frame index or register base."
) ? void (0) : __assert_fail ("BaseMO.isReg() && \"Only allowed to have a frame index or register base.\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1573, __extension__ __PRETTY_FUNCTION__));
  HardenOpRegs.push_back(&BaseMO);
}

if (IndexMO.getReg() != X86::NoRegister &&
    (HardenOpRegs.empty() ||
     HardenOpRegs.front()->getReg() != IndexMO.getReg()))
  HardenOpRegs.push_back(&IndexMO);

assert((HardenOpRegs.size() == 1 || HardenOpRegs.size() == 2) &&(static_cast <bool> ((HardenOpRegs.size() == 1 || HardenOpRegs
.size() == 2) && "Should have exactly one or two registers to harden!"
) ? void (0) : __assert_fail ("(HardenOpRegs.size() == 1 || HardenOpRegs.size() == 2) && \"Should have exactly one or two registers to harden!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1583, __extension__ __PRETTY_FUNCTION__))
       "Should have exactly one or two registers to harden!")(static_cast <bool> ((HardenOpRegs.size() == 1 || HardenOpRegs
.size() == 2) && "Should have exactly one or two registers to harden!"
) ? void (0) : __assert_fail ("(HardenOpRegs.size() == 1 || HardenOpRegs.size() == 2) && \"Should have exactly one or two registers to harden!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1583, __extension__ __PRETTY_FUNCTION__));
assert((HardenOpRegs.size() == 1 ||(static_cast <bool> ((HardenOpRegs.size() == 1 || HardenOpRegs
[0]->getReg() != HardenOpRegs[1]->getReg()) && "Should not have two of the same registers!"
) ? void (0) : __assert_fail ("(HardenOpRegs.size() == 1 || HardenOpRegs[0]->getReg() != HardenOpRegs[1]->getReg()) && \"Should not have two of the same registers!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1586, __extension__ __PRETTY_FUNCTION__))
        HardenOpRegs[0]->getReg() != HardenOpRegs[1]->getReg()) &&(static_cast <bool> ((HardenOpRegs.size() == 1 || HardenOpRegs
[0]->getReg() != HardenOpRegs[1]->getReg()) && "Should not have two of the same registers!"
) ? void (0) : __assert_fail ("(HardenOpRegs.size() == 1 || HardenOpRegs[0]->getReg() != HardenOpRegs[1]->getReg()) && \"Should not have two of the same registers!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1586, __extension__ __PRETTY_FUNCTION__))
       "Should not have two of the same registers!")(static_cast <bool> ((HardenOpRegs.size() == 1 || HardenOpRegs
[0]->getReg() != HardenOpRegs[1]->getReg()) && "Should not have two of the same registers!"
) ? void (0) : __assert_fail ("(HardenOpRegs.size() == 1 || HardenOpRegs[0]->getReg() != HardenOpRegs[1]->getReg()) && \"Should not have two of the same registers!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1586, __extension__ __PRETTY_FUNCTION__));

// Remove any registers that have alreaded been checked.
llvm::erase_if(HardenOpRegs, [&](MachineOperand *Op) {
  // See if this operand's register has already been checked.
  auto It = AddrRegToHardenedReg.find(Op->getReg());
  if (It == AddrRegToHardenedReg.end())
    // Not checked, so retain this one.
    return false;

  // Otherwise, we can directly update this operand and remove it.
  Op->setReg(It->second);
  return true;
});
// If there are none left, we're done.
if (HardenOpRegs.empty())
  return;

// Compute the current predicate state.
unsigned StateReg = PS->SSA.GetValueAtEndOfBlock(&MBB);

auto InsertPt = MI.getIterator();

// If EFLAGS are live and we don't have access to instructions that avoid
// clobbering EFLAGS we need to save and restore them. This in turn makes
// the EFLAGS no longer live.
unsigned FlagsReg = 0;
if (EFLAGSLive && !Subtarget->hasBMI2()) {
  EFLAGSLive = false;
  FlagsReg = saveEFLAGS(MBB, InsertPt, Loc);
}

for (MachineOperand *Op : HardenOpRegs) {
  unsigned OpReg = Op->getReg();
  auto *OpRC = MRI->getRegClass(OpReg);
  unsigned TmpReg = MRI->createVirtualRegister(OpRC);

  // If this is a vector register, we'll need somewhat custom logic to handle
  // hardening it.
  if (!Subtarget->hasVLX() && (OpRC->hasSuperClassEq(&X86::VR128RegClass) ||
                               OpRC->hasSuperClassEq(&X86::VR256RegClass))) {
    assert(Subtarget->hasAVX2() && "AVX2-specific register classes!")(static_cast <bool> (Subtarget->hasAVX2() &&
 "AVX2-specific register classes!") ? void (0) : __assert_fail
 ("Subtarget->hasAVX2() && \"AVX2-specific register classes!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1627, __extension__ __PRETTY_FUNCTION__));
    bool Is128Bit = OpRC->hasSuperClassEq(&X86::VR128RegClass);

    // Move our state into a vector register.
    // FIXME: We could skip this at the cost of longer encodings with AVX-512
    // but that doesn't seem likely worth it.
    unsigned VStateReg = MRI->createVirtualRegister(&X86::VR128RegClass);
    auto MovI =
        BuildMI(MBB, InsertPt, Loc, TII->get(X86::VMOV64toPQIrr), VStateReg)
            .addReg(StateReg);
    (void)MovI;
    ++NumInstsInserted;
    LLVM_DEBUG(dbgs() << "  Inserting mov: "; MovI->dump(); dbgs() << "\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Inserting mov: "
; MovI->dump(); dbgs() << "\n"; } } while (false);

    // Broadcast it across the vector register.
    unsigned VBStateReg = MRI->createVirtualRegister(OpRC);
    auto BroadcastI = BuildMI(MBB, InsertPt, Loc,
                              TII->get(Is128Bit ? X86::VPBROADCASTQrr
                                                : X86::VPBROADCASTQYrr),
                              VBStateReg)
                          .addReg(VStateReg);
    (void)BroadcastI;
    ++NumInstsInserted;
    LLVM_DEBUG(dbgs() << "  Inserting broadcast: "; BroadcastI->dump();do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Inserting broadcast: "
; BroadcastI->dump(); dbgs() << "\n"; } } while (false
)
               dbgs() << "\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Inserting broadcast: "
; BroadcastI->dump(); dbgs() << "\n"; } } while (false
);

    // Merge our potential poison state into the value with a vector or.
    auto OrI =
        BuildMI(MBB, InsertPt, Loc,
                TII->get(Is128Bit ? X86::VPORrr : X86::VPORYrr), TmpReg)
            .addReg(VBStateReg)
            .addReg(OpReg);
    (void)OrI;
    ++NumInstsInserted;
    LLVM_DEBUG(dbgs() << "  Inserting or: "; OrI->dump(); dbgs() << "\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Inserting or: "
; OrI->dump(); dbgs() << "\n"; } } while (false);
  } else if (OpRC->hasSuperClassEq(&X86::VR128XRegClass) ||
             OpRC->hasSuperClassEq(&X86::VR256XRegClass) ||
             OpRC->hasSuperClassEq(&X86::VR512RegClass)) {
    assert(Subtarget->hasAVX512() && "AVX512-specific register classes!")(static_cast <bool> (Subtarget->hasAVX512() &&
 "AVX512-specific register classes!") ? void (0) : __assert_fail
 ("Subtarget->hasAVX512() && \"AVX512-specific register classes!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1665, __extension__ __PRETTY_FUNCTION__));
    bool Is128Bit = OpRC->hasSuperClassEq(&X86::VR128XRegClass);
    bool Is256Bit = OpRC->hasSuperClassEq(&X86::VR256XRegClass);
    if (Is128Bit || Is256Bit)
      assert(Subtarget->hasVLX() && "AVX512VL-specific register classes!")(static_cast <bool> (Subtarget->hasVLX() && "AVX512VL-specific register classes!"
) ? void (0) : __assert_fail ("Subtarget->hasVLX() && \"AVX512VL-specific register classes!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1669, __extension__ __PRETTY_FUNCTION__));

    // Broadcast our state into a vector register.
    unsigned VStateReg = MRI->createVirtualRegister(OpRC);
    unsigned BroadcastOp =
        Is128Bit ? X86::VPBROADCASTQrZ128r
                 : Is256Bit ? X86::VPBROADCASTQrZ256r : X86::VPBROADCASTQrZr;
    auto BroadcastI =
        BuildMI(MBB, InsertPt, Loc, TII->get(BroadcastOp), VStateReg)
            .addReg(StateReg);
    (void)BroadcastI;
    ++NumInstsInserted;
    LLVM_DEBUG(dbgs() << "  Inserting broadcast: "; BroadcastI->dump();do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Inserting broadcast: "
; BroadcastI->dump(); dbgs() << "\n"; } } while (false
)
               dbgs() << "\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Inserting broadcast: "
; BroadcastI->dump(); dbgs() << "\n"; } } while (false
);

    // Merge our potential poison state into the value with a vector or.
    unsigned OrOp = Is128Bit ? X86::VPORQZ128rr
                             : Is256Bit ? X86::VPORQZ256rr : X86::VPORQZrr;
    auto OrI = BuildMI(MBB, InsertPt, Loc, TII->get(OrOp), TmpReg)
                   .addReg(VStateReg)
                   .addReg(OpReg);
    (void)OrI;
    ++NumInstsInserted;
    LLVM_DEBUG(dbgs() << "  Inserting or: "; OrI->dump(); dbgs() << "\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Inserting or: "
; OrI->dump(); dbgs() << "\n"; } } while (false);
  } else {
    // FIXME: Need to support GR32 here for 32-bit code.
    assert(OpRC->hasSuperClassEq(&X86::GR64RegClass) &&(static_cast <bool> (OpRC->hasSuperClassEq(&X86::
GR64RegClass) && "Not a supported register class for address hardening!"
) ? void (0) : __assert_fail ("OpRC->hasSuperClassEq(&X86::GR64RegClass) && \"Not a supported register class for address hardening!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1696, __extension__ __PRETTY_FUNCTION__))
           "Not a supported register class for address hardening!")(static_cast <bool> (OpRC->hasSuperClassEq(&X86::
GR64RegClass) && "Not a supported register class for address hardening!"
) ? void (0) : __assert_fail ("OpRC->hasSuperClassEq(&X86::GR64RegClass) && \"Not a supported register class for address hardening!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1696, __extension__ __PRETTY_FUNCTION__));

    if (!EFLAGSLive) {
      // Merge our potential poison state into the value with an or.
      auto OrI = BuildMI(MBB, InsertPt, Loc, TII->get(X86::OR64rr), TmpReg)
                     .addReg(StateReg)
                     .addReg(OpReg);
      OrI->addRegisterDead(X86::EFLAGS, TRI);
      ++NumInstsInserted;
      LLVM_DEBUG(dbgs() << "  Inserting or: "; OrI->dump(); dbgs() << "\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Inserting or: "
; OrI->dump(); dbgs() << "\n"; } } while (false);
    } else {
      // We need to avoid touching EFLAGS so shift out all but the least
      // significant bit using the instruction that doesn't update flags.
      auto ShiftI =
          BuildMI(MBB, InsertPt, Loc, TII->get(X86::SHRX64rr), TmpReg)
              .addReg(OpReg)
              .addReg(StateReg);
      (void)ShiftI;
      ++NumInstsInserted;
      LLVM_DEBUG(dbgs() << "  Inserting shrx: "; ShiftI->dump();do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Inserting shrx: "
; ShiftI->dump(); dbgs() << "\n"; } } while (false)
                 dbgs() << "\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Inserting shrx: "
; ShiftI->dump(); dbgs() << "\n"; } } while (false);
    }
  }

  // Record this register as checked and update the operand.
  assert(!AddrRegToHardenedReg.count(Op->getReg()) &&(static_cast <bool> (!AddrRegToHardenedReg.count(Op->
getReg()) && "Should not have checked this register yet!"
) ? void (0) : __assert_fail ("!AddrRegToHardenedReg.count(Op->getReg()) && \"Should not have checked this register yet!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1722, __extension__ __PRETTY_FUNCTION__))
         "Should not have checked this register yet!")(static_cast <bool> (!AddrRegToHardenedReg.count(Op->
getReg()) && "Should not have checked this register yet!"
) ? void (0) : __assert_fail ("!AddrRegToHardenedReg.count(Op->getReg()) && \"Should not have checked this register yet!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1722, __extension__ __PRETTY_FUNCTION__));
  AddrRegToHardenedReg[Op->getReg()] = TmpReg;
  Op->setReg(TmpReg);
  ++NumAddrRegsHardened;
}

// And restore the flags if needed.
if (FlagsReg)
  restoreEFLAGS(MBB, InsertPt, Loc, FlagsReg);
1731}

1733MachineInstr *X86SpeculativeLoadHardeningPass::sinkPostLoadHardenedInst(
  MachineInstr &InitialMI, SmallPtrSetImpl<MachineInstr *> &HardenedInstrs) {
assert(isDataInvariantLoad(InitialMI) &&(static_cast <bool> (isDataInvariantLoad(InitialMI) &&
 "Cannot get here with a non-invariant load!") ? void (0) : __assert_fail
 ("isDataInvariantLoad(InitialMI) && \"Cannot get here with a non-invariant load!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1736, __extension__ __PRETTY_FUNCTION__))
       "Cannot get here with a non-invariant load!")(static_cast <bool> (isDataInvariantLoad(InitialMI) &&
 "Cannot get here with a non-invariant load!") ? void (0) : __assert_fail
 ("isDataInvariantLoad(InitialMI) && \"Cannot get here with a non-invariant load!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1736, __extension__ __PRETTY_FUNCTION__));

// See if we can sink hardening the loaded value.
auto SinkCheckToSingleUse =
    [&](MachineInstr &MI) -> Optional<MachineInstr *> {
  unsigned DefReg = MI.getOperand(0).getReg();

  // We need to find a single use which we can sink the check. We can
  // primarily do this because many uses may already end up checked on their
  // own.
  MachineInstr *SingleUseMI = nullptr;
  for (MachineInstr &UseMI : MRI->use_instructions(DefReg)) {
    // If we're already going to harden this use, it is data invariant and
    // within our block.
    if (HardenedInstrs.count(&UseMI)) {
      if (!isDataInvariantLoad(UseMI)) {
        // If we've already decided to harden a non-load, we must have sunk
        // some other post-load hardened instruction to it and it must itself
        // be data-invariant.
        assert(isDataInvariant(UseMI) &&(static_cast <bool> (isDataInvariant(UseMI) && "Data variant instruction being hardened!"
) ? void (0) : __assert_fail ("isDataInvariant(UseMI) && \"Data variant instruction being hardened!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1756, __extension__ __PRETTY_FUNCTION__))
               "Data variant instruction being hardened!")(static_cast <bool> (isDataInvariant(UseMI) && "Data variant instruction being hardened!"
) ? void (0) : __assert_fail ("isDataInvariant(UseMI) && \"Data variant instruction being hardened!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1756, __extension__ __PRETTY_FUNCTION__));
        continue;
      }

      // Otherwise, this is a load and the load component can't be data
      // invariant so check how this register is being used.
      const MCInstrDesc &Desc = UseMI.getDesc();
      int MemRefBeginIdx = X86II::getMemoryOperandNo(Desc.TSFlags);
      assert(MemRefBeginIdx >= 0 &&(static_cast <bool> (MemRefBeginIdx >= 0 && "Should always have mem references here!"
) ? void (0) : __assert_fail ("MemRefBeginIdx >= 0 && \"Should always have mem references here!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1765, __extension__ __PRETTY_FUNCTION__))
             "Should always have mem references here!")(static_cast <bool> (MemRefBeginIdx >= 0 && "Should always have mem references here!"
) ? void (0) : __assert_fail ("MemRefBeginIdx >= 0 && \"Should always have mem references here!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1765, __extension__ __PRETTY_FUNCTION__));
      MemRefBeginIdx += X86II::getOperandBias(Desc);

      MachineOperand &BaseMO =
          UseMI.getOperand(MemRefBeginIdx + X86::AddrBaseReg);
      MachineOperand &IndexMO =
          UseMI.getOperand(MemRefBeginIdx + X86::AddrIndexReg);
      if ((BaseMO.isReg() && BaseMO.getReg() == DefReg) ||
          (IndexMO.isReg() && IndexMO.getReg() == DefReg))
        // The load uses the register as part of its address making it not
        // invariant.
        return {};

      continue;
    }

    if (SingleUseMI)
      // We already have a single use, this would make two. Bail.
      return {};

    // If this single use isn't data invariant, isn't in this block, or has
    // interfering EFLAGS, we can't sink the hardening to it.
    if (!isDataInvariant(UseMI) || UseMI.getParent() != MI.getParent())
      return {};

    // If this instruction defines multiple registers bail as we won't harden
    // all of them.
    if (UseMI.getDesc().getNumDefs() > 1)
      return {};

    // If this register isn't a virtual register we can't walk uses of sanely,
    // just bail. Also check that its register class is one of the ones we
    // can harden.
    unsigned UseDefReg = UseMI.getOperand(0).getReg();
    if (!TRI->isVirtualRegister(UseDefReg) ||
        !canHardenRegister(UseDefReg))
      return {};

    SingleUseMI = &UseMI;
  }

  // If SingleUseMI is still null, there is no use that needs its own
  // checking. Otherwise, it is the single use that needs checking.
  return {SingleUseMI};
};

MachineInstr *MI = &InitialMI;
while (Optional<MachineInstr *> SingleUse = SinkCheckToSingleUse(*MI)) {
  // Update which MI we're checking now.
  MI = *SingleUse;
  if (!MI)
    break;
}

return MI;
1820}

1822bool X86SpeculativeLoadHardeningPass::canHardenRegister(unsigned Reg) {
auto *RC = MRI->getRegClass(Reg);
int RegBytes = TRI->getRegSizeInBits(*RC) / 8;
if (RegBytes > 8)
  // We don't support post-load hardening of vectors.
  return false;

// If this register class is explicitly constrained to a class that doesn't
// require REX prefix, we may not be able to satisfy that constraint when
// emitting the hardening instructions, so bail out here.
// FIXME: This seems like a pretty lame hack. The way this comes up is when we
// end up both with a NOREX and REX-only register as operands to the hardening
// instructions. It would be better to fix that code to handle this situation
// rather than hack around it in this way.
const TargetRegisterClass *NOREXRegClasses[] = {
    &X86::GR8_NOREXRegClass, &X86::GR16_NOREXRegClass,
    &X86::GR32_NOREXRegClass, &X86::GR64_NOREXRegClass};
if (RC == NOREXRegClasses[Log2_32(RegBytes)])
  return false;

const TargetRegisterClass *GPRRegClasses[] = {
    &X86::GR8RegClass, &X86::GR16RegClass, &X86::GR32RegClass,
    &X86::GR64RegClass};
return RC->hasSuperClassEq(GPRRegClasses[Log2_32(RegBytes)]);
1846}

1848// We can harden non-leaking loads into register without touching the address
1849// by just hiding all of the loaded bits. We use an `or` instruction to do
1850// this because having the poison value be all ones allows us to use the same
1851// value below. And the goal is just for the loaded bits to not be exposed to
1852// execution and coercing them to one is sufficient.
1853void X86SpeculativeLoadHardeningPass::hardenPostLoad(MachineInstr &MI) {
MachineBasicBlock &MBB = *MI.getParent();
DebugLoc Loc = MI.getDebugLoc();

// For all of these, the def'ed register operand is operand zero.
auto &DefOp = MI.getOperand(0);
unsigned OldDefReg = DefOp.getReg();
assert(canHardenRegister(OldDefReg) &&(static_cast <bool> (canHardenRegister(OldDefReg) &&
 "Cannot harden this instruction's defined register!") ? void
 (0) : __assert_fail ("canHardenRegister(OldDefReg) && \"Cannot harden this instruction's defined register!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1861, __extension__ __PRETTY_FUNCTION__))
       "Cannot harden this instruction's defined register!")(static_cast <bool> (canHardenRegister(OldDefReg) &&
 "Cannot harden this instruction's defined register!") ? void
 (0) : __assert_fail ("canHardenRegister(OldDefReg) && \"Cannot harden this instruction's defined register!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1861, __extension__ __PRETTY_FUNCTION__));

auto *DefRC = MRI->getRegClass(OldDefReg);
int DefRegBytes = TRI->getRegSizeInBits(*DefRC) / 8;

unsigned OrOpCodes[] = {X86::OR8rr, X86::OR16rr, X86::OR32rr, X86::OR64rr};
unsigned OrOpCode = OrOpCodes[Log2_32(DefRegBytes)];
20
←
Assigned value is garbage or undefined

unsigned SubRegImms[] = {X86::sub_8bit, X86::sub_16bit, X86::sub_32bit};

auto GetStateRegInRC = [&](const TargetRegisterClass &RC) {
  unsigned StateReg = PS->SSA.GetValueAtEndOfBlock(&MBB);

  int Bytes = TRI->getRegSizeInBits(RC) / 8;
  // FIXME: Need to teach this about 32-bit mode.
  if (Bytes != 8) {
    unsigned SubRegImm = SubRegImms[Log2_32(Bytes)];
    unsigned NarrowStateReg = MRI->createVirtualRegister(&RC);
    BuildMI(MBB, MI.getIterator(), Loc, TII->get(TargetOpcode::COPY),
            NarrowStateReg)
        .addReg(StateReg, 0, SubRegImm);
    StateReg = NarrowStateReg;
  }
  return StateReg;
};

auto InsertPt = std::next(MI.getIterator());
unsigned FlagsReg = 0;
bool EFLAGSLive = isEFLAGSLive(MBB, InsertPt, *TRI);
if (EFLAGSLive && !Subtarget->hasBMI2()) {
  FlagsReg = saveEFLAGS(MBB, InsertPt, Loc);
  EFLAGSLive = false;
}

if (!EFLAGSLive) {
  unsigned StateReg = GetStateRegInRC(*DefRC);
  unsigned NewDefReg = MRI->createVirtualRegister(DefRC);
  DefOp.setReg(NewDefReg);
  auto OrI = BuildMI(MBB, InsertPt, Loc, TII->get(OrOpCode), OldDefReg)
                 .addReg(StateReg)
                 .addReg(NewDefReg);
  OrI->addRegisterDead(X86::EFLAGS, TRI);
  ++NumInstsInserted;
  LLVM_DEBUG(dbgs() << "  Inserting or: "; OrI->dump(); dbgs() << "\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Inserting or: "
; OrI->dump(); dbgs() << "\n"; } } while (false);
} else {
  assert(Subtarget->hasBMI2() &&(static_cast <bool> (Subtarget->hasBMI2() &&
 "Cannot harden loads and preserve EFLAGS without BMI2!") ? void
 (0) : __assert_fail ("Subtarget->hasBMI2() && \"Cannot harden loads and preserve EFLAGS without BMI2!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1907, __extension__ __PRETTY_FUNCTION__))
         "Cannot harden loads and preserve EFLAGS without BMI2!")(static_cast <bool> (Subtarget->hasBMI2() &&
 "Cannot harden loads and preserve EFLAGS without BMI2!") ? void
 (0) : __assert_fail ("Subtarget->hasBMI2() && \"Cannot harden loads and preserve EFLAGS without BMI2!\""
, "/build/llvm-toolchain-snapshot-7~svn337657/lib/Target/X86/X86SpeculativeLoadHardening.cpp"
, 1907, __extension__ __PRETTY_FUNCTION__));

  unsigned ShiftOpCode = DefRegBytes < 4 ? X86::SHRX32rr : X86::SHRX64rr;
  auto &ShiftRC =
      DefRegBytes < 4 ? X86::GR32_NOSPRegClass : X86::GR64_NOSPRegClass;
  int ShiftRegBytes = TRI->getRegSizeInBits(ShiftRC) / 8;
  unsigned DefSubRegImm = SubRegImms[Log2_32(DefRegBytes)];

  unsigned StateReg = GetStateRegInRC(ShiftRC);

  // First have the def instruction def a temporary register.
  unsigned TmpReg = MRI->createVirtualRegister(DefRC);
  DefOp.setReg(TmpReg);
  // Now copy it into a register of the shift RC.
  unsigned ShiftInputReg = TmpReg;
  if (DefRegBytes != ShiftRegBytes) {
    unsigned UndefReg = MRI->createVirtualRegister(&ShiftRC);
    BuildMI(MBB, InsertPt, Loc, TII->get(X86::IMPLICIT_DEF), UndefReg);
    ShiftInputReg = MRI->createVirtualRegister(&ShiftRC);
    BuildMI(MBB, InsertPt, Loc, TII->get(X86::INSERT_SUBREG), ShiftInputReg)
        .addReg(UndefReg)
        .addReg(TmpReg)
        .addImm(DefSubRegImm);
  }

  // We shift this once if the shift is wider than the def and thus we can
  // shift *all* of the def'ed bytes out. Otherwise we need to do two shifts.

  unsigned ShiftedReg = MRI->createVirtualRegister(&ShiftRC);
  auto Shift1I =
      BuildMI(MBB, InsertPt, Loc, TII->get(ShiftOpCode), ShiftedReg)
          .addReg(ShiftInputReg)
          .addReg(StateReg);
  (void)Shift1I;
  ++NumInstsInserted;
  LLVM_DEBUG(dbgs() << "  Inserting shrx: "; Shift1I->dump(); dbgs() << "\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Inserting shrx: "
; Shift1I->dump(); dbgs() << "\n"; } } while (false);

  // The only way we have a bit left is if all 8 bytes were defined. Do an
  // extra shift to get the last bit in this case.
  if (DefRegBytes == ShiftRegBytes) {
    // We can just directly def the old def register as its the same size.
    ShiftInputReg = ShiftedReg;
    auto Shift2I =
        BuildMI(MBB, InsertPt, Loc, TII->get(ShiftOpCode), OldDefReg)
            .addReg(ShiftInputReg)
            .addReg(StateReg);
    (void)Shift2I;
    ++NumInstsInserted;
    LLVM_DEBUG(dbgs() << "  Inserting shrx: "; Shift2I->dump();do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Inserting shrx: "
; Shift2I->dump(); dbgs() << "\n"; } } while (false)
               dbgs() << "\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("x86-speculative-load-hardening")) { dbgs() << "  Inserting shrx: "
; Shift2I->dump(); dbgs() << "\n"; } } while (false);
  } else {
    // When we have different size shift register we need to fix up the
    // class. We can do that as we copy into the old def register.
    BuildMI(MBB, InsertPt, Loc, TII->get(TargetOpcode::COPY), OldDefReg)
        .addReg(ShiftedReg, 0, DefSubRegImm);
  }
}

if (FlagsReg)
  restoreEFLAGS(MBB, InsertPt, Loc, FlagsReg);

++NumPostLoadRegsHardened;
1969}

1971/// Harden a return instruction.
1972///
1973/// Returns implicitly perform a load which we need to harden. Without hardening
1974/// this load, an attacker my speculatively write over the return address to
1975/// steer speculation of the return to an attacker controlled address. This is
1976/// called Spectre v1.1 or Bounds Check Bypass Store (BCBS) and is described in
1977/// this paper:
1978/// https://people.csail.mit.edu/vlk/spectre11.pdf
1979///
1980/// We can harden this by introducing an LFENCE that will delay any load of the
1981/// return address until prior instructions have retired (and thus are not being
1982/// speculated), or we can harden the address used by the implicit load: the
1983/// stack pointer.
1984///
1985/// If we are not using an LFENCE, hardening the stack pointer has an additional
1986/// benefit: it allows us to pass the predicate state accumulated in this
1987/// function back to the caller. In the absence of a BCBS attack on the return,
1988/// the caller will typically be resumed and speculatively executed due to the
1989/// Return Stack Buffer (RSB) prediction which is very accurate and has a high
1990/// priority. It is possible that some code from the caller will be executed
1991/// speculatively even during a BCBS-attacked return until the steering takes
1992/// effect. Whenever this happens, the caller can recover the (poisoned)
1993/// predicate state from the stack pointer and continue to harden loads.
1994void X86SpeculativeLoadHardeningPass::hardenReturnInstr(MachineInstr &MI) {
MachineBasicBlock &MBB = *MI.getParent();
DebugLoc Loc = MI.getDebugLoc();
auto InsertPt = MI.getIterator();

if (FenceCallAndRet) {
  // Simply forcibly block speculation of loads out of the function by using
  // an LFENCE. This is potentially a heavy-weight mitigation strategy, but
  // should be secure, is simple from an ABI perspective, and the cost can be
  // minimized through inlining.
  //
  // FIXME: We should investigate ways to establish a strong data-dependency
  // on the return. However, poisoning the stack pointer is unlikely to work
  // because the return is *predicted* rather than relying on the load of the
  // return address to actually resolve.
  BuildMI(MBB, InsertPt, Loc, TII->get(X86::LFENCE));
  ++NumInstsInserted;
  ++NumLFENCEsInserted;
  return;
}

// Take our predicate state, shift it to the high 17 bits (so that we keep
// pointers canonical) and merge it into RSP. This will allow the caller to
// extract it when we return (speculatively).
mergePredStateIntoSP(MBB, InsertPt, Loc, PS->SSA.GetValueAtEndOfBlock(&MBB));
2019}

2021INITIALIZE_PASS_BEGIN(X86SpeculativeLoadHardeningPass, DEBUG_TYPE,static void *initializeX86SpeculativeLoadHardeningPassPassOnce
(PassRegistry &Registry) {
                    "X86 speculative load hardener", false, false)static void *initializeX86SpeculativeLoadHardeningPassPassOnce
(PassRegistry &Registry) {
2023INITIALIZE_PASS_END(X86SpeculativeLoadHardeningPass, DEBUG_TYPE,PassInfo *PI = new PassInfo( "X86 speculative load hardener",
 "x86-speculative-load-hardening", &X86SpeculativeLoadHardeningPass
::ID, PassInfo::NormalCtor_t(callDefaultCtor<X86SpeculativeLoadHardeningPass
>), false, false); Registry.registerPass(*PI, true); return
 PI; } static llvm::once_flag InitializeX86SpeculativeLoadHardeningPassPassFlag
; void llvm::initializeX86SpeculativeLoadHardeningPassPass(PassRegistry
 &Registry) { llvm::call_once(InitializeX86SpeculativeLoadHardeningPassPassFlag
, initializeX86SpeculativeLoadHardeningPassPassOnce, std::ref
(Registry)); }
                  "X86 speculative load hardener", false, false)PassInfo *PI = new PassInfo( "X86 speculative load hardener",
 "x86-speculative-load-hardening", &X86SpeculativeLoadHardeningPass
::ID, PassInfo::NormalCtor_t(callDefaultCtor<X86SpeculativeLoadHardeningPass
>), false, false); Registry.registerPass(*PI, true); return
 PI; } static llvm::once_flag InitializeX86SpeculativeLoadHardeningPassPassFlag
; void llvm::initializeX86SpeculativeLoadHardeningPassPass(PassRegistry
 &Registry) { llvm::call_once(InitializeX86SpeculativeLoadHardeningPassPassFlag
, initializeX86SpeculativeLoadHardeningPassPassOnce, std::ref
(Registry)); }

2026FunctionPass *llvm::createX86SpeculativeLoadHardeningPass() {
return new X86SpeculativeLoadHardeningPass();
2028}