4 ms·

I know it's a joke, but this still branches, via an obscure mechanism of faulting, and mov instructions past the faulting instruction will speculatively execute

by pslam 9y ago

I know it's a joke, but this still branches, via an obscure mechanism of faulting, and mov instructions past the faulting instruction will speculatively execute.

describrion 9y ago
That's not quite true... the code (essentially) loops over itself infinitely; the only branch is a loop back to the beginning of the program. Since this branch has only one target, it can be a direct jump (as opposed to an indirect one), meaning it would not use the branch trace buffer, and would not cause speculative execution. The author used faulting for branches only to write the program in all mov instructions; if the last 'mov' is replaced with a direct jmp (which, it looks like, can be done with the --no-mov-loop flag to the compiler), no more speculative execution.
- Liquid_Fire 9y ago
  > direct jump Another important thing here is that it's an unconditional direct jump. A conditional direct jump can still cause speculative execution (e.g. could be vulnerable to Spectre variant 1).
  - deleted 9y ago
    [deleted]
yarg 9y ago
That's a pity, I was hoping that this could be converted to a SIMD architecture allowing you to run hundreds of staggeringly slow doom instances simultaneously on a GPU.
- animal531 9y ago
  It would be even better if each of the e.g. 1k instances also ran full networking, so you could have 1024 player splitscreen on the GPU.
fulafel 9y ago
One of the main ideas in OoO processors is that the processors are in many ways like dataflow machines, waiting for inputs to become available in order to start (potentially speculative) execution. So, encoding logic in dependent movs does not inherently address the cache side channel issue. History based branch prediction one difference with with explicit branches of course.
Liquid_Fire 9y ago
But the faulting mov instruction is the last instruction in the program. There are no instructions after it to speculatively execute.

by pslam 9y ago

I know it's a joke, but this still branches, via an obscure mechanism of faulting, and mov instructions past the faulting instruction will speculatively execute.

describrion 9y ago

That's not quite true... the code (essentially) loops over itself infinitely; the only branch is a loop back to the beginning of the program. Since this branch has only one target, it can be a direct jump (as opposed to an indirect one), meaning it would not use the branch trace buffer, and would not cause speculative execution. The author used faulting for branches only to write the program in all mov instructions; if the last 'mov' is replaced with a direct jmp (which, it looks like, can be done with the --no-mov-loop flag to the compiler), no more speculative execution.

Liquid_Fire 9y ago
> direct jump Another important thing here is that it's an unconditional direct jump. A conditional direct jump can still cause speculative execution (e.g. could be vulnerable to Spectre variant 1).
- deleted 9y ago
  [deleted]

yarg 9y ago

That's a pity, I was hoping that this could be converted to a SIMD architecture allowing you to run hundreds of staggeringly slow doom instances simultaneously on a GPU.

animal531 9y ago
It would be even better if each of the e.g. 1k instances also ran full networking, so you could have 1024 player splitscreen on the GPU.

fulafel 9y ago

One of the main ideas in OoO processors is that the processors are in many ways like dataflow machines, waiting for inputs to become available in order to start (potentially speculative) execution. So, encoding logic in dependent movs does not inherently address the cache side channel issue. History based branch prediction one difference with with explicit branches of course.

Liquid_Fire 9y ago

But the faulting mov instruction is the last instruction in the program. There are no instructions after it to speculatively execute.