RE: [RFC][PATCH] x86: Add straight-line-speculation mitigation

[David Laight]

From: Peter Zijlstra
> Sent: 28 October 2021 12:44
> 
> This little patch makes use of an upcomming GCC feature to mitigate
> straight-line-speculation for x86:
...

This all generates the instruction sequence:
	ret
	int3
because there are (apparently) times when the cpu will speculatively
execute the instruction following a 'ret'.

I suspect this is likely to have a small performance impact
on at least some cpu that has not been mentioned by anyone.
As well as the slight increase in code size I can think of
two more problems.

1) The cpu may not be able to quickly 'abort' the speculative
   execution of the 'int3' instruction.
   Since the is a slow instruction (not as slow as 'tan'!)
   this might add quite a few clocks.
   ISTR there have always been warnings about the problem
   of speculative execution of trig functions - eg if non-code
   follows a 'ret'.

2) int3 is almost certainly slow to decode.
   Plausibly this might block the decoders from decoding
   from the branch/return target.
   Although I suspect the I-cache fetch will take longer
   unless the decode time is really horrid.
   The tables I have don't give execution times for int3.

While slightly longer, it may be that 'jmp .' is actually
a better instruction than 'int3'.
Since it will block speculative execution while still
being fast to decode and (not) execute.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)