3 ms·

I think you can do it by tracking caches pulled in during speculation and dumping them if speculation failed. Perhaps on a new barrier instruction that's light

I think you can do it by tracking caches pulled in during speculation and dumping them if speculation failed. Perhaps on a new barrier instruction that's lighter weight than lfence (as you're just enabling a recording mode for cache snooping). Ultimately I don't think many speculative instructions actually pull in cache lines, so we can either clean up when they do, or stop speculating when a line would need to be loaded.

titzer 8y ago
The right mental model is that, in modern out-of-order CPUs, there is no difference between executing "in speculation" and "not in speculation". There is just a huge pile of u-ops (~200 on big Intel chips) in the reorder buffer, and some of them may be unexecuted branches. The fetch unit plows right on through branch instructions using branch prediction and jams code "from the future" into the reorder buffer. The CPU keeps on executing whatever instructions are ready (i.e. have data dependencies met), irrespective of the in-flight branches. When a mispredicted branch is retired (~0.1-1% of the time), the CPU can throw away the entire reorder buffer and start over. A CPU can also abort-on-execute, throwing away only work related to the given mispredicted branch. So probably 99% of all cycles are spent with at least one unexecuted branch somewhere in the reorder buffer--the CPU is essentially always speculating.
ghusbands 8y ago
You also need to somehow restore the cache lines that got removed, else there's still information disclosure.
- lallysingh 8y ago
  Fine point. So really, speculative instructions can't pull in cache lines.
tntn 8y ago
I don't see how this would really work. As soon as one core pulls in a cache line, all the other cores know about it, so somehow you would have to roll back all the coherency messaging as well.
- gpderetta 8y ago
  You can in a many-world interpretation of quantum mechanics. On a branch speculation, split the universe. Follow one branch in one universe, the other in another universe. If the CPU realizes that the speculation is wrong, destroy the universe (this is left as an exercise for the reader). As a bonus the CPU will have 100% speculation success. Unfortunately I think quantum mechanics itself might allow for side channels between universes.

titzer 8y ago

The right mental model is that, in modern out-of-order CPUs, there is no difference between executing "in speculation" and "not in speculation". There is just a huge pile of u-ops (~200 on big Intel chips) in the reorder buffer, and some of them may be unexecuted branches. The fetch unit plows right on through branch instructions using branch prediction and jams code "from the future" into the reorder buffer. The CPU keeps on executing whatever instructions are ready (i.e. have data dependencies met), irrespective of the in-flight branches. When a mispredicted branch is retired (~0.1-1% of the time), the CPU can throw away the entire reorder buffer and start over. A CPU can also abort-on-execute, throwing away only work related to the given mispredicted branch. So probably 99% of all cycles are spent with at least one unexecuted branch somewhere in the reorder buffer--the CPU is essentially always speculating.

ghusbands 8y ago

You also need to somehow restore the cache lines that got removed, else there's still information disclosure.

lallysingh 8y ago
Fine point. So really, speculative instructions can't pull in cache lines.

tntn 8y ago

I don't see how this would really work. As soon as one core pulls in a cache line, all the other cores know about it, so somehow you would have to roll back all the coherency messaging as well.

gpderetta 8y ago
You can in a many-world interpretation of quantum mechanics. On a branch speculation, split the universe. Follow one branch in one universe, the other in another universe. If the CPU realizes that the speculation is wrong, destroy the universe (this is left as an exercise for the reader). As a bonus the CPU will have 100% speculation success. Unfortunately I think quantum mechanics itself might allow for side channels between universes.