On Wed, 2018-01-10 at 07:15 +0000, David Woodhouse wrote:
> I'd really like to know what went wrong though. Did we merge Borislav's
> attempt to peek at jumps inside alternatives, perchance? Will take a
> look...

Ah, it only happens if I run in KVM, not with Qemu's CPU; that's why it
didn't show up in my testing. And it seems to have been introduced by
the addition of '.align 16' at the start of the RETPOLINE_JMP macro. So
this fixes it:

--- a/arch/x86/include/asm/nospec-branch.h
+++ b/arch/x86/include/asm/nospec-branch.h
@@ -15,7 +15,6 @@
  * invocation below less ugly.
  */
 .macro RETPOLINE_JMP reg:req
-       .align  16
        call    .Ldo_rop_\@
 .Lspec_trap_\@:
        pause

Borislav? Want to take a look at that please?

I'm going to go ahead and apply Andi's patches anyway. Once I admit
that I shoved the .align in there to precisely match up with Paul's
sequence, and since Linus got me to inline the thing at all the call
sites instead of using the out-of-line thunk, I don't think an
objection of "but it adds some extra bytes for the separate lfence" is
going to work... :)

But actually, I think I may also rip out the .align there. Because
inside alternatives it doesn't make a lot of sense. It may have aligned
the code by padding with NOPs in its *original* location, but once it
gets copied into the place it's executed from, the alignment could be
different.