RE: [RFC][PATCH] x86: Add straight-line-speculation mitigation

David Laight
2021-10-29T09:33:30Z

From: Peter Zijlstra
> Sent: 28 October 2021 12:44
>
> This little patch makes use of an upcomming GCC feature to mitigate
> straight-line-speculation for x86:
...

This all generates the instruction sequence:
ret
int3
because there are (apparently) times when the cpu will speculatively
execute the instruction following a 'ret'.

I suspect this is likely to have a small performance impact
on at least some cpu that has not been mentioned by anyone.
As well as the slight increase in code size I can think of
two more problems.

1) The cpu may not be able to quickly 'abort' the speculative
execution of the 'int3' instruction.
Since the is a slow instruction (not as slow as 'tan'!)
this might add quite a few clocks.
ISTR there have always been warnings about the problem
of speculative execution of trig functions - eg if non-code
follows a 'ret'.

2) int3 is almost certainly slow to decode.
Plausibly this might block the decoders from decoding
from the branch/return target.
Although I suspect the I-cache fetch will take longer
unless the decode time is really horrid.
The tables I have don't give execution times for int3.

While slightly longer, it may be that 'jmp .' is actually
a better instruction than 'int3'.
Since it will block speculative execution while still
being fast to decode and (not) execute.

David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)