crypto/subtle: add speculation barrier after DIT

When enabling DIT on ARM64, add speculation barrier instructions to
ensure that subsequent instructions are executed using the updated
DIT state.

See https://developer.apple.com/documentation/xcode/writing-arm64-code-for-apple-platforms#Enable-DIT-for-constant-time-cryptographic-operations
which recommends doing this. The Arm documentation for DIT doesn't tell
you to do this, but it seems prudent.

Change-Id: Idbc87b332650a77b8cb3509c11377bf5c724f3cf
Reviewed-on: https://go-review.googlesource.com/c/go/+/726980
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Cherry Mui <cherryyz@google.com>

diff --git a/src/internal/runtime/sys/dit_arm64.s b/src/internal/runtime/sys/dit_arm64.s
index c27dfc9af3c1ec8b3813c0fc160e0956eec9e877..408b60c8c0a12c6f1a379556bfcc8dec0522212f 100644 (file)
--- a/src/internal/runtime/sys/dit_arm64.s
+++ b/src/internal/runtime/sys/dit_arm64.s
@@ -9,6 +9,11 @@ TEXT ·EnableDIT(SB),$0-1
     UBFX $24, R0, $1, R1
     MOVB R1, ret+0(FP)
     MSR $1, DIT
+    // TODO(roland): the SB instruction is significantly more
+    // performant when available. We should detect its availability
+    // and use it when we can.
+    DSB $7  // nsh
+    ISB $15 // sy
     RET
 
 TEXT ·DITEnabled(SB),$0-1