On Fri, 2018-01-05 at 17:45 +0100, Borislav Petkov wrote: > On Fri, Jan 05, 2018 at 04:41:46PM +0000, Woodhouse, David wrote: > > Nope, alternatives are broken. Only a jmp as the *first* opcode of > > altinstr gets handled by recompute_jump(), while any subsequent insn is > > just copied untouched. > > Not broken - simply no one needed it until now. I'm looking into it. > Looks like the insn decoder might come in handy finally.# I typed 'jmp __x86.indirect_thunk' and it actually jumped to an address which I believe is (__x86.indirect_thunk + &altinstr - &oldinstr). Which made me sad, and took a while to debug. Let's call it "not working for this use case", and I'll stick with X86_FEATURE_NO_RETPOLINE for now, so the jump can go in the oldinstr case not in altinstr.