1648885 - Perform Spectre mitigations for WebAssembly on Cranelift/ARM64

Status: RESOLVED FIXED

(Core :: JavaScript: WebAssembly, defect, P1)

Description

[Chris Fallin [:cfallin]]

We need to Spectre-proof the heap bounds check for WebAssembly running on Cranelift on ARM64 (aarch64).

As per conversations with :bbouvier, it seems this should involve simply replicating the conditional-move protection that is seen in the ARM64 MacroAssembler's bounds-check code.

This work will entail landing a PR in Cranelift first, then updating our vendored version of Cranelift here.

Comment 1

[Chris Fallin [:cfallin]]

A PR is open for Cranelift here (#1930).

Comment 2

[Chris Fallin [:cfallin]]

Attachment: Bug 1648885 and Bug 1649432: vendor latest Cranelift to get Spectre mitigations and fix fuzzbug. r=bbouvier

This patch pulls in Cranelift revision
0a59a321bdecb6ddaab12c9097532cdb31f241f1, which incorporates several
relevant changes:

• It includes the Spectre mitigation for explicit heap bounds checks
  merged in PR bytecodealliance/wasmtime#1930, resolving Bug 1648885.

• It includes the fix for an out-of-bounds subtraction on large shift
  amounts merged in PR bytecodealliance/wasmtime#1954, resolving Bug
  1649432.

In order to adapt to the new Cranelift version's slight API changes in
the FuncEnvironment, we need to pull in cranelift-frontend as a
dependency (its type FunctionBuilder appears in the API now).

We also need to temporarily disable the wasm/limits.js jit-test
on Cranelift configurations because it now needs shared memory to work,
and the Cranelift backend does not support this yet. Given that this
should be ready in the next month at most (requires atomics support on
AArch64, which is currently being examined), it seems simpler to
temporarily disable the test on aarch64 than to try to disentangle the
bits that depend on shared memories explicitly.

Comment 3

[Chris Fallin [:cfallin]]

Adding dep to Bug 1649929; fixing the breakage would be a better solution than just disabling wasm/limits.js.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/da778e8edbdc
and Bug 1649432: vendor latest Cranelift to get Spectre mitigations and fix fuzzbug. r=bbouvier

Comment 5

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/da778e8edbdc