4 ms·

Isn't Intel and AMD shipping new fence instructions that prevent speculative execution from progressing beyond a certain point? Why doesn't Webkit use those?

• om2 9y ago
  The fence instruction that Intel recommends (lfence) is way slower than the techniques described here. We measured a 5x slowdown on Web Assembly trying to use it. Also we have been working on these mitigations since well before Intel made their suggestion.
  • br1 9y ago
    Have you considered arr[max(i, arr.len)] instead of AND?
    • tetromino_ 9y ago
      Max() is not a CPU instruction. It's an abstraction, a function that could be implemented either using a branch (which defeats the whole purpose) or, on some architectures, with something like cmovXX. Perhaps they wanted a solution that works on Arm, which I think doesn't have cmovXX. Or maybe Intel does speculation with cmovXX used on array index.
      • olliej 9y ago
        Cmov can speculate as well (it makes sense from a performance standpoint but that isn’t the same as secure ;) )
        • om2 9y ago
          On some CPUs, cmov is known not to speculate, but in those cases it is apparently super slow.
• zzzcpan 9y ago
  I suspect fencing instructions are quite a bit slower than this, involve more work and don't even cover every CPU. Branchless bounds checking and type checking with masking and pointer poisoning is probably what we are going to see in other languages too.
• pizlonator 9y ago
  These mitigations are way cheaper than fences. For example, for WebAssembly, we measured that the fence instruction was a 5x regression. That’s nuts. Index masking is a rounding error by comparison.