-
Notifications
You must be signed in to change notification settings - Fork 72
Flags for retpoline mitigation #868
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
Important This issue is not meant to be used for technical discussion. There is a Zulip stream for that. Concerns or objections can formally be registered here by adding a comment.
Concerns can be lifted with:
See documentation at https://forge.rust-lang.org |
@rustbot second |
I think we should consider |
@rustbot label -final-comment-period +major-change-accepted |
Uh oh!
There was an error while loading. Please reload this page.
Proposal
Add two new flags to the compiler called
-Zretpoline
and-Zretpoline-external-thunk
to configure the compiler to generate return trampolines. The retpoline mitigation is used to mitigate a sidechannel vulnerability known as "Spectre".The flags will be implemented by enabling the following LLVM target features:
-Zretpoline-external-thunk
enables+retpoline-external-thunk
,+retpoline-indirect-branches
,+retpoline-indirect-calls
.-Zretpoline
enables+retpoline-indirect-branches
,+retpoline-indirect-calls
.The naming of these flags is taken from clang, where they are called
-mretpoline
and-mretpoline-external-thunk
respectively. For uncommon flags such as these, I believe matching the clang names is the best approach. Note that on clang, the latter flag implies the former.I suggest that the flags should utilize the target modifier infrastructure to prevent mixing compilation units with and without the flags because such misuse breaks the mitigation. However, the flag to opt-out from this check does not necessarily need the word "unsafe" because it's not actually part of the ABI
These flags are added with the intent of later stabilizing them, hence this MCP.
The Rust issue for this feature is rust-lang/rust#116852.
Comparison to GCC:
-mretpoline
is equivalent to-mindirect-branch=thunk-inline -mindirect-branch-register
on gcc.-mretpoline-external-thunk
is equivalent to-mindirect-branch=thunk-extern -mindirect-branch-register
on gcc.Process
The main points of the Major Change Process are as follows:
@rustbot second
.-C flag
, then full team check-off is required.@rfcbot fcp merge
on either the MCP or the PR.You can read more about Major Change Proposals on forge.
The text was updated successfully, but these errors were encountered: