[PATCH] x86: Disable XCHG to MOV optimization
H.J. Lu
hjl.tools@gmail.com
Fri Jul 17 09:22:46 GMT 2026
On Fri, Jul 17, 2026 at 4:44 PM Jan Beulich <jbeulich@suse.com> wrote:
>
> On 15.07.2026 10:17, H.J. Lu wrote:
> > GNU assembler is used by GCC to generate binaries. GCC may not
> > always generate the optimal encoding. That is why I added -O to
> > assembler in the first place. There is no point in adding it if it isn't safe.
> > We can't break applications because of some assembler optimizations.
>
> So this kind of thing will break with any optimization changing encoding
> size:
>
> test eax, eax
> jnz $+9
> test rcx, 0x21
>
> (Intel syntax for all examples, as that's what I'm more used to.)
>
> This clearly breaks as well:
>
> test eax, eax
> jz 1f+2
> 1: test bx, 0x21
>
> As does this:
>
> test ecx, ecx
> jz $+4
> mov rcx, 0xc9634890
>
> While all of these may look contrived, I've seen code (not written by
> myself) doing similar things. A construct branching into the middle of
> an insn was (transiently) even considered to address one of the many
> speculation issues we've seen over the last 8+ years.
That is why I meant case by case. There are similar codes in i686 glibc.
When I added CET support, I had to deal with it:
commit be9ccd27c09ee76c5397125bfa0fefae318a2996
Author: H.J. Lu <hjl.tools@gmail.com>
AuthorDate: Tue Jul 17 16:11:13 2018 -0700
Commit: H.J. Lu <hjl.tools@gmail.com>
CommitDate: Tue Jul 17 16:11:44 2018 -0700
i386: Add _CET_ENDBR to indirect jump targets in add_n.S/sub_n.S
i386 add_n.S and sub_n.S use a trick to implement jump tables with LEA.
We can't use conditional branches nor normal jump tables since jump
table entries use EFLAGS set by jump table index. This patch adds
_CET_ENDBR to indirect jump targets and adjust destination for
_CET_ENDBR.
So far assembler optimizations haven't caused any issues for these
kinds of codes. But changing LEA encoding length may cause issues.
--
H.J.
More information about the Binutils
mailing list