Preface: Several companies are currently using Arm processors to create artificial intelligence-powered software to help make the driving experience safer. Some experts believe that artificial intelligence will affect human life. Yes it is real. The late Stephen Hawking speculated about this potential impact, but it looks like part of the process of human civilization. The man kind involves into automation life when smartphone and GUI was born. It was not possible to jump back. Perhaps this is the destinely. On the other hand, computer vulnerabilities is the effective way to against out of control AI. Perhaps it is a effective solution.
Background: Branch predictor hardware typically uses a form of cache to hold branch information. When vendor release announcement of their design weakness few years ago, a misunderstand was that it only appears on a single brand. But the truth is that properly not. When CPU designer intend improve the efficiency of CPU response time. It will be using it. The ARM architecture permits this branch predictor hardware to be visible to the functional behaviour of software, and so the branch predictor is not architecturally invisible.
The possible attack mechanism of Spectre-BHB: The branch target injection in the same software context (unlike Spectre v2, which injects branch targets across different exception levels) . If the attacker can poison branch history from user space to force the kernel to mispredict targets. When the victim executes an allegedly safe branch that is mis-predicted , redirecting the control flow to a gadget that, with attacker controlled registers. Therefore it triggered the vulnerability. For information on this attack mechanism and mitigations concept. Please refer to attached diagram.
Development in 2023: Arm announced a new generation of Armv9 CPUs, namely the Cortex-X3 and the Cortex-A715. The Armv9 CPU use L1 instruction cache Speculative memory accesses. The L1 instruction memory system provides an instruction stream to the decoder. To increase overall performance and reduce power consumption, the L1 instruction memory system uses dynamic branch prediction and instruction caching.
Whether is there any design weakness similar to branch prediction of this new design. Let’s keep our eyes open. stay tuned!