Re: [PATCH] x86: Disable XCHG to MOV optimization

On Fri, Jul 17, 2026 at 4:44 PM Jan Beulich <[email protected]> wrote:
>
> On 15.07.2026 10:17, H.J. Lu wrote:
> > GNU assembler is used by GCC to generate binaries.  GCC may not
> > always generate the optimal encoding.   That is why I added -O to
> > assembler in the first place.  There is no point in adding it if it isn't safe.
> > We can't break applications because of some assembler optimizations.
>
> So this kind of thing will break with any optimization changing encoding
> size:
>
>         test    eax, eax
>         jnz     $+9
>         test    rcx, 0x21
>
> (Intel syntax for all examples, as that's what I'm more used to.)
>
> This clearly breaks as well:
>
>         test    eax, eax
>         jz      1f+2
> 1:      test    bx, 0x21
>
> As does this:
>
>         test    ecx, ecx
>         jz      $+4
>         mov     rcx, 0xc9634890
>
> While all of these may look contrived, I've seen code (not written by
> myself) doing similar things. A construct branching into the middle of
> an insn was (transiently) even considered to address one of the many
> speculation issues we've seen over the last 8+ years.

That is why I meant case by case.   There are similar codes in i686 glibc.
When I added CET support, I had to deal with it:

commit be9ccd27c09ee76c5397125bfa0fefae318a2996
Author:     H.J. Lu <[email protected]>
AuthorDate: Tue Jul 17 16:11:13 2018 -0700
Commit:     H.J. Lu <[email protected]>
CommitDate: Tue Jul 17 16:11:44 2018 -0700

    i386: Add _CET_ENDBR to indirect jump targets in add_n.S/sub_n.S

    i386 add_n.S and sub_n.S use a trick to implement jump tables with LEA.
    We can't use conditional branches nor normal jump tables since jump
    table entries use EFLAGS set by jump table index.  This patch adds
    _CET_ENDBR to indirect jump targets and adjust destination for
    _CET_ENDBR.

So far assembler optimizations haven't caused any issues for these
kinds of codes.  But changing LEA encoding length may cause issues.

-- 
H.J.