Linux 7.3 Bringing A KCFI Optimization To Benefit Older Intel CPUs

Expected to be merged during the upcoming Linux 7.3 merge window is a Kernel Control Flow Integrity (KCFI) improvement intended to benefit older Intel processors.

Peter Zijlstra of Intel worked through a KCFI improvement for older platforms that lack support for FineIBT. Peter explained with the pending patch:

"As noted in commit 85a2d4a890dc ("x86,ibt: Use UDB instead of 0xEA") Jcc should be assumed not-taken, however the normal kCFI (ABI) emits the following sequence:

movl $(-hash), %r10d
addl -15(%r11), %r10d
je 1f
ud2
1: cs call __x86_indirect_thunk_r11

(when used in conjunction with -mretpoline-external-thunk).

Notably, the Jcc here is always taken, resulting in lower throughput than would be ideal. Replace it with the following sequence on boot:

movl $(-hash), %r10d
addl -15(%r11), %r10d
jne . + 3
test $0xd6, %al
cs call __x86_indirect_thunk_r11

This jumps to the UDB instruction used as an immediate byte in the test instruction. The test instruction will clobber eflags, but that is immaterial, eflags is already changed by the preceding addl.

Intel recommends the FineIBT sequence on platforms that support IBT; older platforms are still widely used and would benefit from this."

FineIBT / CET with Indirect Branch Tracking (IBT) is found with Intel Core 11th Gen "Tiger Lake" CPUs and newer.


Intel engineer Scott Constable ran some benchmarks on an earlier version of the patch to find the CFI optimization benefit:

The patch is queued into tip/tip.git's x86/core Git branch. With that code now in a TIP branch, it's expected to be submitted for the upcoming Linux 7.3 merge window.