<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<br class="">
<br class="">
<blockquote type="cite" class="">On 20 Jun 2020, at 09:41, Michał Górny <<a href="mailto:mgorny@gentoo.org" class="">mgorny@gentoo.org</a>> wrote:<br class="">
<br class="">
On Mon, 2020-06-08 at 15:20 +0000, Kristof Beyls via llvm-dev wrote:<br class="">
<blockquote type="cite" style="font-family: Menlo-Regular; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">
Hi,<br class="">
<br class="">
A new speculative cache side-channel vulnerability has been published at<br class="">
<a href="https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/downloads/straight-line-" class="">https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability/downloads/straight-line-</a>speculation,<br class="">
named "straight-line speculation”, CVE-2020-13844.<br class="">
<br class="">
In this email, I'd like to explain the toolchain mitigation we've prepared<br class="">
to mitigate against this vulnerability for AArch64. For the full details of the<br class="">
vulnerability, please follow the above link.<br class="">
The part of the vulnerability that is relevant to the toolchain mitigations<br class="">
is as follows.<br class="">
Some processors may speculatively execute the instructions immediately<br class="">
following what should be a change in control flow, including RET (returns), BR<br class="">
(indirect jumps) and BLR (indirect function calls). If the speculative<br class="">
execution path contains a suitable code sequence, often described as a "Spectre<br class="">
Revelation Gadget", such straight-line speculation could lead to changes in the<br class="">
caches and similar structures that are indicative of secrets, making those<br class="">
secrets vulnerable to revelation through timing analysis.<br class="">
<br class="">
The gist of the mitigation is that for RET and BR instructions, a speculation<br class="">
barrier is placed after them that prohibits incorrect speculation. Since these<br class="">
barriers are never on the correct, architectural execution path, performance<br class="">
overhead of this is expected to be low.<br class="">
<br class="">
The gist of the mitigation for the BLR instruction is a bit more complicated,<br class="">
to make sure that no barrier gets placed on the architectural execution path.<br class="">
In summary, a<br class="">
BLR x<N><br class="">
instruction gets transformed to<br class="">
BL __llvm_slsblr_thunk_x<N><br class="">
instruction, with __llvm_slsblr_thunk_x<N> a thunk that contains<br class="">
__llvm_slsblr_thunk_x<N>:<br class="">
BR x<N><br class="">
speculation barrier<br class="">
<br class="">
Therefore, the BLR instruction gets split into 2; one BL and one BR. This<br class="">
transformation results in not inserting a speculation barrier on the<br class="">
architectural execution path.<br class="">
<br class="">
Please find patches for these mitigations on the below reviews:<br class="">
<br class="">
1. https://reviews.llvm.org/D81399: [AArch64] Fix branch, terminator, etc properties for BRA* instructions.<br class="">
2. https://reviews.llvm.org/D81400: [AArch64] Introduce AArch64SLSHardeningPass, which implements the hardening of RET and BR instructions.<br class="">
3. https://reviews.llvm.org/D81401: [NFC] Refactor ThunkInserter to make it available for all targets.<br class="">
4. https://reviews.llvm.org/D81402: [AArch64] Extend AArch64SLSHardeningPass to harden BLR instructions.<br class="">
5. https://reviews.llvm.org/D81403: Work around GlobalISel limitation on Indirect Thunks.<br class="">
6. https://reviews.llvm.org/D81404: [AArch64] Add clang command line support for -mharden-sls=<br class="">
7. https://reviews.llvm.org/D81405: [AArch64] Avoid incompatibility between SLSBLR mitigation and BTI codegen, by only using X16 and X17 registers for BLRs.<br class="">
<br class="">
There are a few known places where this toolchain mitigation leaves<br class="">
instructions unmitigated:<br class="">
* Some accesses to thread-local variables use a code sequence with a BLR<br class="">
instruction. This code sequence is part of the binary interface between<br class="">
compiler and linker. If this BLR instruction needs to be mitigated, it'd<br class="">
probably be best to do so in the linker. It seems that the code sequence<br class="">
for thread-local variable access is unlikely to lead to a Spectre Revalation<br class="">
Gadget.<br class="">
* PLT stubs are produced by the linker and each contain a BLR instruction.<br class="">
It seems that at most only after the last PLT stub a spectre revalation<br class="">
gadget might appear.<br class="">
* Use of BR, RET and BLR instructions in assembly are not mitigated.<br class="">
* Use of BR, RET and BLR instructions in libraries and run-time library<br class="">
routines that are not recompiled with this toolchain mitigation are not<br class="">
mitigated.<br class="">
<br class="">
We're also posting patches with similar functionality to gcc.<br class="">
<br class="">
I'd like to request comments and feedback on the above patches.<br class="">
<br class="">
</blockquote>
<br class="">
Thanks for doing this. Are the patches suitable for backporting to<br class="">
10.0.1? I was trying to query on Bugzilla but it seems to be broken<br class="">
at the moment.<br class="">
</blockquote>
<br class="">
The patches do not intersect too much with the rest of the code base, so I would expect them to be relatively easily backportable.<br class="">
I’m not sure if 10.0.1 is still open for backporting patches.
<div class="">Tom, do you know?<br class="">
<br class="">
<br class="">
The full list of commits that would need to be cherry picked is:<br class="">
<br class="">
<a href="https://reviews.llvm.org/rG09d098506bb9e39d3b0284331a039c8e86eec6e3" class="">https://reviews.llvm.org/rG09d098506bb9e39d3b0284331a039c8e86eec6e3</a> [AArch64] Fix branch, terminator, etc properties for BRA* instructions.<br class="">
<a href="https://reviews.llvm.org/rG0ee176edc8b4a6f20527e907bfd026b07a27e7ef" class="">https://reviews.llvm.org/rG0ee176edc8b4a6f20527e907bfd026b07a27e7ef</a> [AArch64] Introduce AArch64SLSHardeningPass, implementing hardening of RET and…<br class="">
<a href="https://reviews.llvm.org/rG994748770c3565bcd2c25fcdd0ddb17f6cebab31" class="">https://reviews.llvm.org/rG994748770c3565bcd2c25fcdd0ddb17f6cebab31</a> [NFC] Refactor ThunkInserter to make it available for all targets.<br class="">
<a href="https://reviews.llvm.org/rGc35ed40f4f1bd8afd709c5342b36f33c7c5b0fbd" class="">https://reviews.llvm.org/rGc35ed40f4f1bd8afd709c5342b36f33c7c5b0fbd</a> [AArch64] Extend AArch64SLSHardeningPass to harden BLR instructions.<br class="">
<a href="https://reviews.llvm.org/rG503a26d8e4d07ed63f4dc46fa1a56468c2e53b5f" class="">https://reviews.llvm.org/rG503a26d8e4d07ed63f4dc46fa1a56468c2e53b5f</a> Silence GCC 7 warning<br class="">
<a href="https://reviews.llvm.org/rG3f0cc96a9694e499968544ebda6903982eaeb8a4" class="">https://reviews.llvm.org/rG3f0cc96a9694e499968544ebda6903982eaeb8a4</a> [AArch64] SLSHardening: compute correct thunk name for X29.<br class="">
<a href="https://reviews.llvm.org/rG832cfc767246442969c0805fd310a5297c3dbede" class="">https://reviews.llvm.org/rG832cfc767246442969c0805fd310a5297c3dbede</a> [IndirectThunks] Make generated MF structure as expected by all instruction…<br class="">
<a href="https://reviews.llvm.org/rGf7455da2633d14f1ce76aaa7c73ea682ac51ac37" class="">https://reviews.llvm.org/rGf7455da2633d14f1ce76aaa7c73ea682ac51ac37</a> [IndirectThunks] Tiny comment fix<br class="">
<a href="https://reviews.llvm.org/rGd938ec4509c47d461377527fc2877ae14b91275c" class="">https://reviews.llvm.org/rGd938ec4509c47d461377527fc2877ae14b91275c</a> [AArch64] Avoid incompatibility between SLSBLR mitigation and BTI codegen.<br class="">
<a href="https://reviews.llvm.org/rGc113b59ef52593818bcd207521fd490ba3deeaea" class="">https://reviews.llvm.org/rGc113b59ef52593818bcd207521fd490ba3deeaea</a> [AArch64] Add clang command line support for -mharden-sls=<br class="">
<br class="">
</div>
</body>
</html>