News for hackers. Stuff that matters.

A comment on New code for SIGILL faults to help identify misbranches on OpenBSD. Parent comment

Re:New code for SIGILL faults to help identify misbranches o... by MuffinFlavored on Thursday February 22, 2024 @08:10PM (#39475618)
> As a ROP mitigation measure some recent CPU models have a feature that can require code to branch to a special instruction signifying a valid target; jumps to an address that doesn't contain that instruction result in a CPU fault.

How much of a performance flow mitigation is this, 3-5%?

[ Parent | on HN ]
Re:New code for SIGILL faults to help identify misbranches o... by jeffbee on Thursday February 22, 2024 @08:35PM (#39475801)
Compiler-based CFI has low single digits impact. Hardware with ENDBR will be hard to notice, "none" being a reasonably accurate estimate of the impact, unless your code is weird and unusually dense with valid indirect branch targets.
[ Parent | on HN ]
Re:New code for SIGILL faults to help identify misbranches o... by kevingadd on Thursday February 22, 2024 @08:41PM (#39475849)
in fast paths almost all the code you're running is in icache, and even the decoded micro-ops are probably cached, so I bet it's even cheaper than that.
[ Parent | on HN ]