From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.alien8.de (mail.alien8.de [65.109.113.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 36E793EB0F5 for ; Tue, 16 Jun 2026 18:55:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=65.109.113.108 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781636142; cv=none; b=QZuu6Tayi9pkRTgGUSLTOPnYGC+C/6SpQYNTy9O+7EmOM05ouw/Wl5MchRVgtdqUkFTABfOpZKVsGJMpJ+eVTA6WroxTie9WGj7Ldz3z63a25DQgob/cLqMmsWxvLmlkrdCPf5QNSA67+pnzZLVQm1WaQXBur9MvHlROxZvKk/A= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781636142; c=relaxed/simple; bh=buda0Y5RsraMA/ZkBiXTXRw/kWV4eEUV4AtoW115SuA=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=OSPifR/arQ8ALEIwo7OyGp7YxUZb6BSGl/Mg/XhM3GCYfDFKTPg9oHuKKAPITVn22GB10OYuO34GKYZbFN0NCOGtmpoRmFf6ZPMFKCF8lfcKG2VfAubIJy6bLkCYNfFypsQSshUJdBf2ekUDOxWTQ9G8Qoi4Q2zwLMDnmv2sBok= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=alien8.de; spf=pass smtp.mailfrom=alien8.de; dkim=pass (4096-bit key) header.d=alien8.de header.i=@alien8.de header.b=KwHJHLq9; arc=none smtp.client-ip=65.109.113.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=alien8.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=alien8.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (4096-bit key) header.d=alien8.de header.i=@alien8.de header.b="KwHJHLq9" Received: from localhost (localhost.localdomain [127.0.0.1]) by mail.alien8.de (SuperMail on ZX Spectrum 128k) with ESMTP id 3825E40E01B4; Tue, 16 Jun 2026 18:55:29 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at mail.alien8.de Authentication-Results: mail.alien8.de (amavisd-new); dkim=pass (4096-bit key) header.d=alien8.de Received: from mail.alien8.de ([127.0.0.1]) by localhost (mail.alien8.de [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id XHSVqUQ8VriQ; Tue, 16 Jun 2026 18:55:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=alien8.de; s=alien8; t=1781636118; bh=KmlE0HKa+alvlSGueslmGBxKI+OGJAg3UooBy/yQYV4=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=KwHJHLq9rt1Cab9pavcpx4sJzqbkaGwPr1s4v5PhUrv/Cb61yHGHlYFMXNJyU9fDg HKmFuK/PsDeVocIwKANmS73daB4a4HamSSMswWVfirijDhSb57NAj1aFjhSYAXEdHj ix40Iik6O/IWPKBVst37HFqQkJORUdrpdUMIJAI/HNUQ7b4//UlO2mkkhF7INgMEUK 0vszaVmmcyfixpCTNJ8Z2+xDJHamwf93fCnkFO6xy7Tp+9C2dpzw8E/IiXwdaz47Tn YWEFF2Sy0PtE1mFJndgtY4G1FpU9ZsKuu2fIIw/2GrCuXG5XJVhahybkuH0EH3rg+X ljYXPg9NxfPpLgL8XkNFdP5aTZq0l9wPrgZsYaXPIfYNpVJlDGripvzNkm1aQTZ7J5 b1kQZo1oqR9DtM3QliYxOBBITxUwvbJt+IX772Bs3mYEU4ZnRbjjtXcP6Bt+JVed4Q aFjjRIYtdKTCy6jSmydk+7Thm5Q49/23bOo0KxapxklxLbuAFOVeM1uPdbKRY4dhoV PNHFugRaT+VlvnZnHJ/HxuUQe/Qw7knY1osn3M5FdQadggi2RXWQZknro+wu+L+TOu mEG5f1cxRa0u7HouJJA+dQ9ZePjuuYQSBIffk1VtfGjcIXnlf8fesqx2gQCsKnqBeh 75ZafMRjjkA3sGnU7oEba6zM= Received: from stx.tnic (unknown [IPv6:2600:1700:38ca:c00::3a]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail.alien8.de (SuperMail on ZX Spectrum 128k) with ESMTPSA id D468A40E0176; Tue, 16 Jun 2026 18:55:09 +0000 (UTC) Date: Tue, 16 Jun 2026 11:55:06 -0700 From: Borislav Petkov To: Peter Zijlstra Cc: x86@kernel.org, linux-kernel@vger.kernel.org, hpa@zystor.com, samitolvanen@google.com, kees@kernel.org, nathan@kernel.org, scott.d.constable@intel.com Subject: Re: [PATCH] x86/kcfi: Optimize call sequence Message-ID: <20260616185506.GAajGcCoqPoMuGKON6@fat_crate.local> References: <20260612071506.GQ187714@noisy.programming.kicks-ass.net> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20260612071506.GQ187714@noisy.programming.kicks-ass.net> On Fri, Jun 12, 2026 at 09:15:06AM +0200, Peter Zijlstra wrote: > > As noted in commit 85a2d4a890dc ("x86,ibt: Use UDB instead of 0xEA") Jcc should > be assumed not-taken, however the normal kCFI (ABI) emits the following sequence: > > movl $(-hash), %r10d > addl -15(%r11), %r10d > je 1f > ud2 > 1: cs call __x86_indirect_thunk_r11 > > (when used in conjunction with -mretpoline-external-thunk). > > Notably, the Jcc here is always taken, resulting in lower throughput than would > be ideal. Replace it with the following sequence on boot: > > movl $(-hash), %r10d > addl -15(%r11), %r10d > jne . + 3 > test $0xd6, %al > cs call __x86_indirect_thunk_r11 > > This jumps to the UDB instruction used as an immediate byte in the test > instruction. The test instruction will clobber eflags, but that is immaterial, > eflags is already changed by the preceding addl. > > Intel recommends the FineIBT sequence on platforms that support IBT; older > platforms are still widely used and would benefit from this. > > An earlier PoC was benchmarked by Scott: > > Indirect branch miss rate (br_misp_retired.indirect:k / br_inst_retired.indirect:k) > > BHI_DIS_S=1 > > Benchmark Baseline IBT kCFI kCFI-opt > ----------------------------------------------------------------------------- > iperf3 UDP 0.103764 0.103180 0.104311 0.102945 > hackbench 0.000885 0.000876 0.001996 0.000826 > lmbench syscall 0.005089 0.004486 0.016990 0.005852 > lmbench fork+exit 0.018454 0.019176 0.031085 0.015153 > lmbench fork+exec 0.017147 0.021613 0.029129 0.016337 > redis 0.032220 0.032655 0.045540 0.027946 > nginx+wrk 0.109033 0.112765 0.132557 0.102417 > fio randread 0.009704 0.009620 0.008548 0.000962 > fio seqwrite 0.006927 0.006707 0.019372 0.004590 > kbuild 0.056748 0.057324 0.064640 0.048136 > > BHI_DIS_S=0 > > Benchmark Baseline IBT kCFI kCFI-opt > ----------------------------------------------------------------------------- > iperf3 UDP 0.000077 0.000106 0.000186 0.000073 > hackbench 0.000123 0.000132 0.000367 0.000097 > lmbench syscall 0.023259 0.018319 0.040903 0.012772 > lmbench fork+exit 0.011494 0.011887 0.029079 0.016415 > lmbench fork+exec 0.037782 0.038994 0.055378 0.026381 > redis 0.002481 0.003152 0.017073 0.000184 > nginx+wrk 0.015478 0.016266 0.033637 0.000268 > fio randread 0.009836 0.007949 0.007096 0.000143 > fio seqwrite 0.014587 0.014165 0.041792 0.002157 > kbuild 0.055774 0.055249 0.062590 0.046546 > > Cc: Sami Tolvanen > Cc: Kees Cook > Cc: Nathan Chancellor > Cc: hpa@zystor.com > Suggested-by: Scott D Constable > Signed-off-by: Peter Zijlstra (Intel) > --- > arch/x86/kernel/alternative.c | 11 ++++++++++- > arch/x86/kernel/cfi.c | 6 ++++++ > 2 files changed, 16 insertions(+), 1 deletion(-) Acked-by: Borislav Petkov (AMD) -- Regards/Gruss, Boris. https://people.kernel.org/tglx/notes-about-netiquette