Are you referring to retpolines? Browsers and JS are *extremely* virtual call heavy. Perf impact must be carefully considered.
-
See “same-CPU cross process” on https://github.com/marcan/speculation-bugs/blob/master/README.md … —
@marcan42 seems to agree that cross process is potentially vulnerable too…
Yeah, the only complete solutions are full IBRS/IBPB (enabled in both the kernel and userspace) or using retpolines everywhere, AFAICT.
-
-
and as I suppose you know, those are only complete solutions for variant 2, don’t help with 1
-
Of course. Insert rant about calling two different vulns by the same name. As I mentioned on the doc and Reddit, I don't think there's a fix for variant 1 other than making speculation barriers part of the CS curriculum.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.