181539 2018-01-11 09:37:39 -0800 Reserve a fast TLS key for GC TLC 2018-01-11 10:00:18 -0800 1 1 1 Unclassified WebKit Web Template Framework WebKit Nightly Build All All RESOLVED FIXED InRadar P2 Normal --- 1 fpizlo fpizlo benjamin cdumez cmarcelo dbates ews-watchlist webkit-bug-importer oldest_to_newest 1388263 0 fpizlo 2018-01-11 09:37:39 -0800 Who knew that thread-local caches would be an essential mitigation for timing attacks. But here's how it works: if we have TLCs then we can "context switch" them when we "context switch" origins. This allows us to put some minimal distance between objects from different origins, which gives us the ability to allow small overflows when doing certain bounds checks without creating a useful Spectre information leak. 1388264 1 331061 fpizlo 2018-01-11 09:48:31 -0800 Created attachment 331061 the patch 1388274 2 fpizlo 2018-01-11 09:59:26 -0800 Landed in http://trac.webkit.org/changeset/226784/webkit 1388275 3 webkit-bug-importer 2018-01-11 10:00:18 -0800 <rdar://problem/36441606> 331061 2018-01-11 09:48:31 -0800 2018-01-11 09:56:05 -0800 the patch blah.patch text/plain 1785 fpizlo SW5kZXg6IFNvdXJjZS9XVEYvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XVEYvQ2hh bmdlTG9nCShyZXZpc2lvbiAyMjY3ODMpCisrKyBTb3VyY2UvV1RGL0NoYW5nZUxvZwkod29ya2lu ZyBjb3B5KQpAQCAtMSwzICsxLDIxIEBACisyMDE4LTAxLTExICBGaWxpcCBQaXpsbyAgPGZwaXps b0BhcHBsZS5jb20+CisKKyAgICAgICAgUmVzZXJ2ZSBhIGZhc3QgVExTIGtleSBmb3IgR0MgVExD CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xODE1MzkK KworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKyAgICAgICAgCisgICAgICAg IFdobyBrbmV3IHRoYXQgdGhyZWFkLWxvY2FsIGNhY2hlcyB3b3VsZCBiZSBhIG1pdGlnYXRpb24g Zm9yIHRpbWluZyBhdHRhY2tzLiBIZXJlJ3MgaG93IGl0CisgICAgICAgIHdvcmtzOiBpZiB3ZSBo YXZlIFRMQ3MgdGhlbiB3ZSBjYW4gImNvbnRleHQgc3dpdGNoIiB0aGVtIHdoZW4gd2UgImNvbnRl eHQgc3dpdGNoIiBvcmlnaW5zLiAKKyAgICAgICAgVGhpcyBhbGxvd3MgdXMgdG8gcHV0IHNvbWUg bWluaW1hbCBkaXN0YW5jZSBiZXR3ZWVuIG9iamVjdHMgZnJvbSBkaWZmZXJlbnQgb3JpZ2lucywg d2hpY2gKKyAgICAgICAgZ2l2ZXMgdXMgdGhlIGFiaWxpdHkgdG8gYWxsb3cgc21hbGwgb3ZlcmZs b3dzIHdoZW4gZG9pbmcgY2VydGFpbiBib3VuZHMgY2hlY2tzIHdpdGhvdXQKKyAgICAgICAgY3Jl YXRpbmcgYSB1c2VmdWwgU3BlY3RyZSBpbmZvcm1hdGlvbiBsZWFrLgorICAgICAgICAKKyAgICAg ICAgU28gSSB0aGluayB0aGF0IG1lYW5zIHdlIGhhdmUgdG8gaW1wbGVtZW50IHRocmVhZC1sb2Nh bCBjYWNoZXMgKGFsc28ga25vd24gYXMgdGhyZWFkLWxvY2FsCisgICAgICAgIGFsbG9jYXRpb24g YnVmZmVycywgYnV0IEkgcHJlZmVyIHRoZSBUTEMgdGVybWlub2xvZ3kpLgorCisgICAgICAgICog d3RmL0Zhc3RUTFMuaDoKKwogMjAxOC0wMS0wNCAgRmlsaXAgUGl6bG8gIDxmcGl6bG9AYXBwbGUu Y29tPgogCiAgICAgICAgIENvZGVCbG9ja3Mgc2hvdWxkIGJlIGluIElzb1N1YnNwYWNlcwpJbmRl eDogU291cmNlL1dURi93dGYvRmFzdFRMUy5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XVEYvd3Rm L0Zhc3RUTFMuaAkocmV2aXNpb24gMjI2NzgzKQorKysgU291cmNlL1dURi93dGYvRmFzdFRMUy5o CSh3b3JraW5nIGNvcHkpCkBAIC00NSw3ICs0NSw4IEBAIG5hbWVzcGFjZSBXVEYgewogCiAjZGVm aW5lIFdURl9USFJFQURfREFUQV9LRVkgV1RGX0ZBU1RfVExTX0tFWTAKICNkZWZpbmUgV1RGX1dB U01fQ09OVEVYVF9LRVkgV1RGX0ZBU1RfVExTX0tFWTEKLSNkZWZpbmUgV1RGX1RFU1RJTkdfS0VZ IFdURl9GQVNUX1RMU19LRVkyCisjZGVmaW5lIFdURl9URVNUSU5HX0tFWSBXVEZfV0FTTV9DT05U RVhUX0tFWSAvLyBTbyBmYXIsIHRoaXMga2V5IGlzIG9ubHkgdXNlZCBpbiBwbGFjZXMgdGhhdCBk b24ndCBkbyBXZWJBc3NlbWJseSwgc28gaXQncyBPSyB0aGF0IHRoZXkgc2hhcmUgdGhlIHNhbWUg a2V5LgorI2RlZmluZSBXVEZfR0NfVExDX0tFWSBXVEZfRkFTVF9UTFNfS0VZMgogCiAjaWYgRU5B QkxFKEZBU1RfVExTX0pJVCkKIGlubGluZSB1bnNpZ25lZCBmYXN0VExTT2Zmc2V0Rm9yS2V5KHVu c2lnbmVkIGxvbmcgc2xvdCkK