Looking At The LVI Mitigation Impact On Intel Cascade Lake Refresh

On Friday I posted some initial numbers looking at the LVI mitigation impact when using the LLVM Clang compiler with that open-source, multi-platform compiler having landed its mitigation this week for Intel's Load Value Injection (LVI) vulnerability that was disclosed in March. Through the weekend I have been running some additional tests of this compiler-based mitigation and in this article are some numbers off Cascade Lake Refresh, which while recently released is reported by Intel to still be vulnerable to this new disclosure.

As outlined in Friday's articles and past Phoronix articles on the LVI topic, mitigating this vulnerability requires compiler-based changes. LVI itself combines Spectre-style code gadgets with Meltdown-type illegal data flows to bypass existing defenses and allow injecting data into a victim's transient execution. With the newly-added LLVM mitigation for LVI, flipping on "-mlvi-cfi" enables its mitigation -- the approach used by LLVM is adding indirect thunk support that replaces each indirect call/jump with a direct call to a thunk that has a load fence (LFENCE) and then JMPQ.

While the new Intel Xeon Cascade Lake Refresh CPUs have hardware mitigations for L1TF, MDS, and Meltdown, these CPUs are still vulnerable to Load Value Injection according to Intel's list of affected CPUs.

With a pair of dual Intel Xeon Gold 5220R processors (their full Linux review is coming out in the next few days), I ran some tests off Ubuntu 20.04 LTS with LLVM Clang 11.0 Git when building with "-O3" and then again with "-O3 -mlvi-cfi" as the CFLAGS/CXXFLAGS and benchmarking this LVI mitigation impact for a range of open-source C/C++ benchmarks. Tests were conducted via the Phoronix Test Suite. No other changes were made during the testing process besides changing the compiler flags and all other hardware/software mitigations were left at their defaults in just looking at the LVI difference.