On Thu, Apr 02, 2020 at 04:31:05PM +0100, Julien Thierry wrote:
My understanding is that once you find an intra-function call, either you
hit a return, ending the branch, so the return should undo the modification
the intra-function call did (whether is it a retpoline return or not).
Otherwise, the intra-function call branch will need to reach an end in some
way (e.g. hitting a CONTEXT_SWITCH instruction, calling a
dead_end_function).
Am I missing something?
The thing is basically doing:
mov $n, cx
1: call 2f
2: dec cx
jnz 1b
add 8*n, sp
So it does N calls to self, then subtracts N words from the stack.
The reason being that the CPU has a return-stack-buffer for predicting
returns, and call/ret being naturally paired, that works. The above
is a software flush of the RSB.