Interesting that they're using compiler analysis to identify at-risk code and insert fences instead of using a mitigation like retpolineshttps://twitter.com/apardoe/status/953054508984156160 …
-
My conjecture is that Variant 1 cannot be automatically fixed in all cases without significant performance impact. However, subsets of it can be mitigated automatically. MSVC seems to be mitigating the most obvious one (range checks) with /Qspectre. There are more, though.
Variant 2 *can* be completely fixed with retpolines and/or the microcode/OS fixes (specific requirements vary by CPU). Variant 3 can be fixed with KPTI or equivalent. Both are also fixable in newer silicon.
