Bug 181539

Summary: Reserve a fast TLS key for GC TLC
Product: WebKit Reporter: Filip Pizlo <fpizlo>
Component: Web Template FrameworkAssignee: Filip Pizlo <fpizlo>
Status: RESOLVED FIXED    
Severity: Normal CC: benjamin, cdumez, cmarcelo, dbates, ews-watchlist, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: All   
OS: All   
Attachments:
Description Flags
the patch ap: review+

Filip Pizlo
Reported 2018-01-11 09:37:39 PST
Who knew that thread-local caches would be an essential mitigation for timing attacks. But here's how it works: if we have TLCs then we can "context switch" them when we "context switch" origins. This allows us to put some minimal distance between objects from different origins, which gives us the ability to allow small overflows when doing certain bounds checks without creating a useful Spectre information leak.
Attachments
the patch (1.74 KB, patch)
2018-01-11 09:48 PST, Filip Pizlo 		ap: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Filip Pizlo
Comment 1 2018-01-11 09:48:31 PST
Created attachment 331061 [details] the patch
Filip Pizlo
Comment 2 2018-01-11 09:59:26 PST
Landed in http://trac.webkit.org/changeset/226784/webkit
Radar WebKit Bug Importer
Comment 3 2018-01-11 10:00:18 PST
<rdar://problem/36441606>
Note You need to log in before you can comment on or make changes to this bug.