<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.emailquote, li.emailquote, div.emailquote
{mso-style-name:emailquote;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:1.0pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US">Thanks: glad progress is being made.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif">--
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif">John Dallman<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif">DF PL TO OT PC PDE<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif">Technology & Innovation<o:p></o:p></span></p>
<p class="MsoNormal"><i><span lang="EN" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Nullius in verba<o:p></o:p></span></i></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif">Siemens Industry Sector<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif">Siemens Industry Software Limited
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif">Francis House, 112 Hills Road,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif">Cambridge CB2 1PH, United Kingdom
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif">Tel. :+44 (1223) 371554<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif">Fax :+44 (1223) 371700<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><a href="mailto:john.dallman@siemens.com"><span style="color:#0563C1">john.dallman@siemens.com
</span></a></span><span style="font-size:10.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif"><a href="www.siemens.com/plm"><span style="font-size:11.0pt;color:#0563C1">www.siemens.com/plm
</span></a><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> paul.robinson@sony.com [mailto:paul.robinson@sony.com]
<br>
<b>Sent:</b> Wednesday, March 21, 2018 3:19 PM<br>
<b>To:</b> Dallman, John (DF PL TO OT PC PDE) <john.dallman@siemens.com><br>
<b>Cc:</b> cfe-dev@lists.llvm.org<br>
<b>Subject:</b> RE: [cfe-dev] Clang insertion of fence instructions to mitigate Spectre variant 1?<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">There's a patch on Phabricator to implement a detector pass, in a more static-analysis mode; it seems to be doing better than the Microsoft option
but still isn't catching everything.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><a href="https://reviews.llvm.org/D43643">https://reviews.llvm.org/D43643</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">--paulr<o:p></o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose"></a><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma",sans-serif">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma",sans-serif"> cfe-dev [<a href="mailto:cfe-dev-bounces@lists.llvm.org">mailto:cfe-dev-bounces@lists.llvm.org</a>]
<b>On Behalf Of </b>Dallman, John via cfe-dev<br>
<b>Sent:</b> Wednesday, March 21, 2018 5:59 AM<br>
<b>To:</b> 'cfe-dev@lists.llvm.org'<br>
<b>Subject:</b> [cfe-dev] Clang insertion of fence instructions to mitigate Spectre variant 1?<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif">As far as I've been able to learn, the only way to avoid security vulnerabilities due to Spectre variant 1 (</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">CVE-2017-5753,
“bounds check bypass”) is to insert fences to control the relevant speculative reads. I'm interested in doing this because I work on a numerical modelling library that is used in many applications, which are used to handle valuable information. There's been
at least one piece of malware that specifically targeted one of those applications, so I work at a moderate level of paranoia.
</span><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">I've found information about __builtin_load_no_speculate, but inserting those by hand into ten million lines of branchy C code that's under active development
is not an attractive prospect.</span><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">MSVC has recently gained a /QSpectre option that tries to do this for you (<a href="https://blogs.msdn.microsoft.com/vcblog/2018/01/15/spectre-mitigations-in-msvc/"><span style="color:#0563C1">https://blogs.msdn.microsoft.com/vcblog/2018/01/15/spectre-mitigations-in-msvc/</span></a>).
It only handles a very limited range of cases at present (<a href="https://www.paulkocher.com/doc/MicrosoftCompilerSpectreMitigation.html"><span style="color:#0563C1">https://www.paulkocher.com/doc/MicrosoftCompilerSpectreMitigation.html</span></a>), but Microsoft
are working on improving that. Red Hat tell me that there is work underway to add something similar to GCC, although it's probably a year away.
</span><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">While such a capability can't be completely fool-proof, I can well believe that it's possible to do as good a job as bored humans, and it will be much cheaper.
</span><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif">Are there any plans to add something equivalent to Clang?
<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif">Thanks,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif">--
<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif">John Dallman<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif">DF PL TO OT PC PDE<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif">Technology & Innovation<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><i><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Nullius in verba</span></i><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif">Siemens Industry Sector<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif">Siemens Industry Software Limited
<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif">Francis House, 112 Hills Road,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif">Cambridge CB2 1PH, United Kingdom
<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif">Tel. :+44 (1223) 371554<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif">Fax :+44 (1223) 371700<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><a href="mailto:john.dallman@siemens.com"><span style="color:#0563C1">john.dallman@siemens.com
</span></a></span><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><a href="www.siemens.com/plm"><span style="color:#0563C1">www.siemens.com/plm
</span></a></span><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US" style="font-family:"Arial",sans-serif">-----------------<br>
Siemens Industry Software Limited is a limited company registered in England and Wales.<br>
Registered number: 3476850.<br>
Registered office: Faraday House, Sir William Siemens Square, Frimley, Surrey, GU16 8QD.
</span><span lang="EN-US" style="font-size:10.0pt;font-family:"Calibri",sans-serif"><o:p></o:p></span></p>
</div>
</div>
</div>
<p style="font-family:Arial; font-size:70%">-----------------<br>
Siemens Industry Software Limited is a limited company registered in England and Wales.<br>
Registered number: 3476850.<br>
Registered office: Faraday House, Sir William Siemens Square, Frimley, Surrey, GU16 8QD.
</p>
</body>
</html>