[PATCH] D43643: [RFC] Sceptre a Spectre variant 1 detector

[Robert Lougher via Phabricator via llvm-commits]

rob.lougher added a comment.

This is cut and pasted from an email reply as it's not showing up after over 2 hours...

We went with this approach because we were trying to catch the most likely vulnerabilities while also trying to limit the number of false positives. As speculative execution of a branch is fundamental to the Spectre exploit, linking the loads to conditional branches was an obvious way to try and limit the number of possibilities. We've worked closely with our internal users to come up with something that meets their requirements, and as a side effect decided to share our implementation with the wider LLVM community.  Our solution seems to match fairly closely that which we've observed to mitigate Variant 1 in the Linux Kernel [1] and by other compiler vendors such as Microsoft [2].  It's true that there is a danger of introducing a false sense of security. But the fact you can't guarantee to find all the vulnerabilies doesn't mean you do nothing.  To echo Paul, you don't leave your house unlocked because you can't make it 100% burglar-proof!

[1] https://lwn.net/Articles/743265/

[2] https://blogs.msdn.microsoft.com/vcblog/2018/01/15/spectre-mitigations-in-msvc/


Repository:
  rL LLVM

https://reviews.llvm.org/D43643