mbox series

[committed,0/7] Arm: mitigation for AES erratum on Cortex-a57 and Cortex-A72

Message ID 20220120112724.830872-1-rearnsha@arm.com
Headers show
Series Arm: mitigation for AES erratum on Cortex-a57 and Cortex-A72 | expand

Message

Richard Earnshaw Jan. 20, 2022, 11:27 a.m. UTC 
The Cortex-A57 and Cortex-A72 processors have an erratum (#1742098
and #1655431 respectively) when running in Arm (32-bit) mode where an
instruction producing a 32-bit result that feeds into an AES encode or
decode can lead to an incorrect result.  The erratum does not occur when
operating in 64-bit (aarch64) mode.

The mitigation approach taken by this patch series is in two parts.
Firstly, to ensure that this cannot happen by inserting a special
128-bit copy operation before each operand to a potentially vulnerable
sequence.  This is overkill, but safe.  The copy operations are
independent instructions, so can be migrated out of loops by the GCSE
pass or other optimizations.

Secondly, we then allow the copy operations to be merged with common
cases where the producer is known to be unaffected by the erratum.
Currently that includes other AES instructions, loads and certain move
operations.

In combination this eliminates the majority of redundant instructions
for normal use cases.  I did consider adding a custom pass to do late
insertion of the mitigation, but decided against it.  A trivial
implemenation would be unable to hoist operations out of the loop, while
a more complex implementation would require a lot of data-flow
analysis to find the optimum location for each mitigation and might
need to insert mitigation instructions on multiple paths.  The pass
would be complex and likely to have difficult to test corner cases.

The series consists of 7 patches.  The first two patches are cleanups
to the existing code.  Patch 3 adds the command line options to enable
the mitigation and the corresponding documentation.  Patch 4 adds the
basic mitigation operation and patches 5 and 6 add various additional
patterns to elide the mitigation for common cases where it is not
needed.  The final patch adds a testcase.

Richard Earnshaw (7):
  arm: Disambiguate multiple crypto patterns with the same name.
  arm: Consistently use crypto_mode attribute in crypto patterns
  arm: Add option for mitigating against Cortex-A CPU erratum for AES
  arm: add basic mitigation for Cortex-A AES errata
  arm: suppress aes erratum when forwarding from aes
  arm: elide some cases where the AES erratum workaround is not
    required.
  arm: Add test for AES erratum mitigation

 gcc/config/arm/arm-cpus.in                    |   9 +-
 gcc/config/arm/arm.cc                         |   9 +
 gcc/config/arm/arm.opt                        |  10 +
 gcc/config/arm/crypto.md                      | 227 ++++++++++++++----
 gcc/config/arm/unspecs.md                     |   1 +
 gcc/doc/invoke.texi                           |  11 +
 .../gcc.target/arm/crypto-vaese-erratum1.c    |  28 +++
 7 files changed, 242 insertions(+), 53 deletions(-)
 create mode 100644 gcc/testsuite/gcc.target/arm/crypto-vaese-erratum1.c