I am on the hook to analysis some "timing channels" of some x86 binary code. I am posting one question to comprehend
So high-levelly, these two opcodes can be modeled as a "loop", which counts the leading and trailing zeros of a given operand. The
x86 manual has a good formalization of these opcodes, something like the following:
IF SRC = 0 THEN ZF ← 1; DEST is undefined; ELSE ZF ← 0; temp ← OperandSize – 1; WHILE Bit(SRC, temp) = 0 DO temp ← temp - 1; OD; DEST ← temp; FI;
But to my suprise,
bsf/bsr instructions seem to have fixed cpu cycles. According to some documents I found here: https://gmplib.org/~tege/x86-timing.pdf, seems that they always take 8 CPU cycles to finish.
So here are my questions:
I am confirming that these instructions have fixed cpu cycles. In other words, no matter what operand is given, they always take the same amount of time to process, and there is no "timing channel" behind. I cannot find corresponding specifications in Intel's official documents.
Then why it is possible? Apparently this is a "loop" or somewhat, at least high-levelly. What is the design decision behind? Easier for CPU pipelines?