mirror of
https://github.com/RPCS3/llvm-mirror.git
synced 2024-11-23 11:13:28 +01:00
40fb959a78
After finding all such gadgets in a given function, the pass minimally inserts LFENCE instructions in such a manner that the following property is satisfied: for all SOURCE+SINK pairs, all paths in the CFG from SOURCE to SINK contain at least one LFENCE instruction. The algorithm that implements this minimal insertion is influenced by an academic paper that minimally inserts memory fences for high-performance concurrent programs: http://www.cs.ucr.edu/~lesani/companion/oopsla15/OOPSLA15.pdf The algorithm implemented in this pass is as follows: 1. Build a condensed CFG (i.e., a GadgetGraph) consisting only of the following components: -SOURCE instructions (also includes function arguments) -SINK instructions -Basic block entry points -Basic block terminators -LFENCE instructions 2. Analyze the GadgetGraph to determine which SOURCE+SINK pairs (i.e., gadgets) are already mitigated by existing LFENCEs. If all gadgets have been mitigated, go to step 6. 3. Use a heuristic or plugin to approximate minimal LFENCE insertion. 4. Insert one LFENCE along each CFG edge that was cut in step 3. 5. Go to step 2. 6. If any LFENCEs were inserted, return true from runOnFunction() to tell LLVM that the function was modified. By default, the heuristic used in Step 3 is a greedy heuristic that avoids inserting LFENCEs into loops unless absolutely necessary. There is also a CLI option to load a plugin that can provide even better optimization, inserting fewer fences, while still mitigating all of the LVI gadgets. The plugin can be found here: https://github.com/intel/lvi-llvm-optimization-plugin, and a description of the pass's behavior with the plugin can be found here: https://software.intel.com/security-software-guidance/insights/optimized-mitigation-approach-load-value-injection. Differential Revision: https://reviews.llvm.org/D75937 |
||
|---|---|---|
| .. | ||
| Analysis | ||
| AsmParser | ||
| BinaryFormat | ||
| Bitcode | ||
| Bitstream | ||
| CodeGen | ||
| DebugInfo | ||
| Demangle | ||
| DWARFLinker | ||
| ExecutionEngine | ||
| Frontend | ||
| Fuzzer | ||
| FuzzMutate | ||
| IR | ||
| IRReader | ||
| LineEditor | ||
| Linker | ||
| LTO | ||
| MC | ||
| MCA | ||
| Object | ||
| ObjectYAML | ||
| Option | ||
| Passes | ||
| ProfileData | ||
| Remarks | ||
| Support | ||
| TableGen | ||
| Target | ||
| Testing | ||
| TextAPI | ||
| ToolDrivers | ||
| Transforms | ||
| WindowsManifest | ||
| XRay | ||
| CMakeLists.txt | ||
| LLVMBuild.txt | ||