From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 47CAD3858419; Wed, 27 Oct 2021 15:03:26 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 47CAD3858419 From: "hjl.tools at gmail dot com" To: gcc-bugs@gcc.gnu.org Subject: [Bug target/102952] New code-gen options for retpolines and straight line speculation Date: Wed, 27 Oct 2021 15:03:26 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: target X-Bugzilla-Version: 12.0 X-Bugzilla-Keywords: X-Bugzilla-Severity: enhancement X-Bugzilla-Who: hjl.tools at gmail dot com X-Bugzilla-Status: WAITING X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: hjl.tools at gmail dot com X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_status Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: gcc-bugs@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-bugs mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Oct 2021 15:03:26 -0000 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D102952 H.J. Lu changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |WAITING --- Comment #5 from H.J. Lu --- (In reply to Andrew Cooper from comment #0) > Hello >=20 > [FYI, this is being cross-requested of Clang too] >=20 > Linux and other kernel level software makes use of > -mindirect-branch=3Dthunk-extern to be able to alter the handling of indi= rect > branches at boot. It turns out to be advantageous to inline the thunks w= hen > retpoline is not in use.=20 > https://lore.kernel.org/lkml/20211026120132.613201817@infradead.org/ is s= ome > infrastructure to make this work. >=20 > In some cases, we want to be able to inline an `lfence; jmp *%reg` thunk.= =20 > This is fine for the low 8 registers, but not fine for %r{8..15} where the > REX prefix pushes the replacement size to being 6 bytes. >=20 > It would be very useful to have a code-gen option to write out `call > %cs:__x86_indirect_thunk_r{8..15}` where the redundant %cs prefix will > increase the instruction length to 6, allowing the non-retpoline form to = be > inlined. >=20 -mindirect-branch-cs-prefix > Relatedly, x86 straight line speculation has been discussed before, but > without any action taken. It would be helpful to have a code gen option > which would emit `int3` following any `ret` instruction, and any indirect > jump, as neither of these two cases have following architectural executio= n. >=20 > The reason these two are related is that if both options are in use, we w= ant > an extra byte of replacement space to be able to inline `lfence; jmp *%re= g; > int3`. >=20 -mharden-sls=3D[none|all|return|indirect-branch] Let me know if they work. I also need testcases. > Third (and possibly only for future optimisations), Clang has been observ= ed > to spot conditional tail calls as `Jcc __x86_indirect_thunk_*`. This is = a 6 > byte source size, but needs up to 9 bytes of space for inlining including= an > `int3` for straight line speculation reasons (See > https://lore.kernel.org/lkml/20211026120310.359986601@infradead.org/ for > full details). It might be enough to simply prohibit an optimisation like > this when trying to pad retpolines for inlineability. I don't think GCC does that at all.=