Re: [tip:x86/pti] x86/retpoline: Fill return stack buffer on vmexit

[Josh Poimboeuf]

On Thu, Jan 25, 2018 at 01:45:54PM +0100, Borislav Petkov wrote:
> > > +/* Like alternative_io, but for replacing a direct call with another one. */
> > > +#define alternative_void_call(oldfunc, newfunc, feature, input...)		\
> > > +	asm volatile (ALTERNATIVE("call %P[old]", "call %P[new]", feature)	\
> > > +		: : [old] "i" (oldfunc), [new] "i" (newfunc), ## input)
> > 
> > But you aren't doing the call at all in the other case, and
> > alternatives *always* handled the case where the first 'alternative'
> > instruction was a branch, didn't it?
> > 
> > So couldn't it just be alternative(nop, call __fill_rsb_func)?
> > 
> > But I still don't understand why it matters.
> 
> You need for both to be CALL instructions there so that gcc can manage
> the callee clobbers properly - i.e., recognize that there's a function
> call there.

Huh?  GCC doesn't even look inside the inline asm.  That's why we had to
implement ASM_CALL_CONSTRAINT.

And the seg fault is objtool's way of telling you you need a
ANNOTATE_NOSPEC_ALTERNATIVE above the alternative ;-)

(I know that's not the best answer, will fix it soon.)

-- 
Josh