3 ms·
This doesn't seem to mention the overhead that ARM64EC imposes on indirect calls. Indirect calls are required by the ARM64EC ABI to use a CFG-like check against
by ack_complete 3y ago
This doesn't seem to mention the overhead that ARM64EC imposes on indirect calls. Indirect calls are required by the ARM64EC ABI to use a CFG-like check against the architecture bitmap, adding overhead to both function pointers and virtual calls:
https://gcc.godbolt.org/z/8aT793GMf https://gcc.godbolt.org/z/8aT793GMf
This is explained in the docs:
https://learn.microsoft.com/en-us/windows/arm/arm64ec-abi https://learn.microsoft.com/en-us/windows/arm/arm64ec-abi
> Call checkers are optional on all other Windows ABIs, but mandatory on Arm64EC. On Arm64EC, call checkers accumulate the task of verifying the architecture of the function being called. They verify whether the call is another EC (“Emulation Compatible”) function or an x64 function that must be executed under emulation. In many cases, this can only be verified at runtime.
- dmitrygr 3y agoThe check can be done just once per {destination, sourceArch} pair and cached, so overall the amortized impact should be just one extra load
- rep_lodsb 3y agoI'm wondering why you couldn't rely on pages containing non-native code being marked "no execute" instead. Trapping into kernel mode might be slower, but for binaries that are mostly ARM, the expected case would be that the bitmap check always succeeds - and it there was such a fallback method of switching to emulated code, the compiler would then be free to either omit the check or leave it in, based on profiling information?
- saagarjha 3y agoThis is what Rosetta does IIRC