[coldcode]

I remember doing tricks like this in 6502 assembly and in other early processors. Amazing that to stop these attacks you have to come up with clever tricks again. Back in the 80's I would have never imagined this type of attack being something to worry about.

[FLUX-YOU]

>early processors

Early processors had speculative execution? I thought this had been added to Intel/AMD/ARM about 20 years ago?

[dzdt]

I guess he means the retpoline. On the 6502 there is no indirect jump instruction, so you need such tricks just to achieve an indirect jump at all.

[pubby]

There's an indirect jump instruction. It's not very good though, and has a notorious bug with addresses ending in 0xFF.

[dzdt]

Gah, you're right. Guess my memory is fading. There is indirect JMP, but no indirect JSR or indirect branches. And the indirect JMP as you say is not very useful.

[DiThi]

I think it means they're tricks for better performance when you _don't_ have speculative execution.

[gpderetta]

Speculative execution is as old as branch prediction, which is very, very old.