x86/core updates for v7.3:

- Optimize the kcfi call sequence (Peter Zijlstra)
  - Use sfence for wmb() if SSE is available (Yao Zi)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqC4LMRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hXnA/9GnPxgwNrauwIk+gH9DyGDYa93byd+JtE
 SKVc3RWipSYqrG6cgQoNDnGCN+TLO2lIrCriXRXfisu3F5HMR+VZ+H6KNt0zy3eK
 EZrMFQpIEX98penD+w9Ae42LBCdLKPKyN9obkdUftIYMYAsW/LtZE9PAy3WqH/0L
 iyYs1EwpIQuZGRJNxQYbNNVCs+fi1PCP5WmGitO5QHUUqVmyf9g9jFkS3rAAP28v
 WvDLDWbHBz/1MVV34/jdftuMhOSz8FpwASseozsq7LXPV5yiknlCIf7rgiVlxR89
 tmxFYN5Trjk8ORiR0TpknmAxduXtAAt0Mu1vE6ABbLgyaYv99+O21g0dN2KdUdxh
 9P8azSVY1rNn8rnrQSNsfoEv+TrPT+22iTcQd4Z2/wKc0D51CoGxX4+uY98ybwj5
 U47ZUZCVZcnNk4sNnNxevoAEmgCUd092/qcgyOM7PXCsNl/X2g9NfwNu/XtRaog3
 3Y1T5TUk+apNKNs2bul2OTvcrwS4GUFLTZTRZp4BuvqkCiuZvv2InWnVVDOjaUXU
 vpMANFVy8ARYS25Elxeje3v1Dwya/5ZAl8sJhTx9QX7OhTzW1Cn71q2Ur3GYojjz
 CNGs/rik586HM+NFpRZcHXAnN/nLMZVQjDQxuD3istp3ozqgXKjHqBnecwV6JZKb
 tAmymfqtYXU=
 =C/Mp
 -----END PGP SIGNATURE-----

Merge tag 'x86-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 core updates from Ingo Molnar:

 - Optimize the kcfi call sequence (Peter Zijlstra)

 - Use sfence for wmb() if SSE is available (Yao Zi)

* tag 'x86-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/locking: Use sfence for wmb() if SSE is available
  x86/kcfi: Optimize call sequence

arch/x86/include/asm/barrier.h

@@ -17,7 +17,7 @@
 #define rmb() asm volatile(ALTERNATIVE("lock addl $0,-4(%%esp)", "lfence", \
 				       X86_FEATURE_XMM2) ::: "memory", "cc")
 #define wmb() asm volatile(ALTERNATIVE("lock addl $0,-4(%%esp)", "sfence", \
-				       X86_FEATURE_XMM2) ::: "memory", "cc")
+				       X86_FEATURE_XMM) ::: "memory", "cc")
 #else
 #define __mb()	asm volatile("mfence":::"memory")
 #define __rmb()	asm volatile("lfence":::"memory")

arch/x86/kernel/alternative.c

@@ -1356,6 +1356,20 @@ early_param("cfi", cfi_parse_cmdline);
  *  "Make conditional jumps most often not taken: The efficiency and throughput
  *   for not-taken branches is better than for taken branches on most
  *   processors. Therefore, it is good to place the most frequent branch first"
+ *
+ * NOTE: Update the kCFI caller sequence to make use of this observation:
+ *
+ * kCFI						kCFI-OPT
+ *
+ * caller:					caller:
+ *	movl	$(-0x12345678),%r10d	 // 6	     movl	$(-0x12345678),%r10d	 // 6
+ *	addl	$-15(%r11),%r10d	 // 4	     addl	$-15(%r11),%r10d	 // 4
+ *	je	1f			 // 2	     jne	. + 3                    // 2
+ *	ud2				 // 2        test	$0xd6, %al		 // 2
+ * 1:	cs call	__x86_indirect_thunk_r11 // 6	1:   cs call	__x86_indirect_thunk_r11 // 6
+ *
+ * This new test clobbers eflags, but those are clobbered by the hash test
+ * anyway.
  */
 
 /*
@@ -1518,8 +1532,9 @@ static int cfi_disable_callers(s32 *start, s32 *end)
 static int cfi_enable_callers(s32 *start, s32 *end)
 {
 	/*
-	 * Re-enable kCFI, undo what cfi_disable_callers() did.
+	 * Re-enable (and update) kCFI, undo what cfi_disable_callers() did.
 	 */
+	const u8 udne[] = { 0x75, 0x01, 0xa8, 0xd6 };
 	const u8 mov[] = { 0x41, 0xba };
 	s32 *s;
 
@@ -1532,6 +1547,10 @@ static int cfi_enable_callers(s32 *start, s32 *end)
 		if (!hash) /* nocfi callers */
 			continue;
 
+		/*
+		 * See the kCFI/FineIBT comment above -- update note.
+		 */
+		text_poke_early(addr + 10, udne, 4);
 		text_poke_early(addr, mov, 2);
 	}
 

arch/x86/kernel/cfi.c

@@ -72,8 +72,15 @@ enum bug_trap_type handle_cfi_failure(struct pt_regs *regs)
 
 	switch (cfi_mode) {
 	case CFI_KCFI:
-		if (!is_cfi_trap(addr))
-			return BUG_TRAP_TYPE_NONE;
+		if (!is_cfi_trap(addr)) {
+			/*
+			 * The updated kCFI sequence has "test $0xd6, %al" instead of
+			 * "ud2", adjust the offset.
+			 */
+			addr -= 1;
+			if (!is_cfi_trap(addr))
+				return BUG_TRAP_TYPE_NONE;
+		}
 
 		if (!decode_cfi_insn(regs, &target, &type))
 			return report_cfi_failure_noaddr(regs, addr);