4 ms·
The author's Clang patch is interesting, but I wonder if what he really wants is, like, a new optimization level "-Obranchless" which is like O2/O3 but disables
by quuxplusone 2y ago
The author's Clang patch is interesting, but I wonder if what he really wants is, like, a new optimization level "-Obranchless" which is like O2/O3 but disables all optimizations which might introduce new conditional branches. Presumably optimizations that _remove_ branches are fine; it's just that you don't want any deliberately branchless subexpression being replaced with a branch.
Basically like today's "-Og/-Odebug" or "-fno-omit-frame-pointers" but for this specific niche.
I'd be interested to see a post comparing the performance and vulnerability of the mentioned crypto code with and without this (hypothetical) -Obranchless.
- quuxplusone 2y ago... except that even my idea fails to help with software math. If the programmer writes `uint128 a, b; ... a /= b` under -Obranchless, does that mean they don't want us calling a C++-runtime software division routine (__udiv3 or however it's spelled) that might contain branches? And if so, then what on earth do we do instead? — well, just give an error at compile time, I guess.
- nolist_policy 2y agoNot branchless, they just need it to be constant-time. That is definitely doable with pure software division.
- detaro 2y agoYes, a compile failure would IMHO be the only useful result in that case.