Re: Plumbers CF MCs

[Segher Boessenkool <segher@kernel.crashing.org>]

On Tue, Mar 23, 2021 at 08:53:58PM +0100, Peter Zijlstra wrote:
> On Tue, Mar 23, 2021 at 07:29:01PM +0000, Andrew Cooper wrote:
> > For the compiler folk here, the tl;dr is that indirect CALL/JMP (i.e.
> > function pointers, jump tables) and RET instructions may speculatively
> > execute the next sequential instruction(s) before taking the control
> > flow change into account. 
> 
> So JMP and RET can trivially have INT3 following in such a way that that
> instruction is never in the actual execution path. This is obviously not
> possible for CALL.

What about
  call ; jmp 0f ; int3 ; 0:
?  Only the jmp can be speculatively executed (if your (u)arch executes
jumps at all), but that cannot be a problem, no data is involved.

> > Having some toolchain support to deal with
> > this would be great, and preferable to some of the asm hackary currently
> > under suggestion.

I fail to see how it is anything more than some boring backend-specific
patches?  By nature you pretty much have to emit this as canned
instruction sequences, so all the rest of the compiler sees it is just a
call or jump or whathaveyou.


Segher