Re: [RFC PATCH 31/56] x86/alternative: Prepend nops with retpolines

Peter Zijlstra
2025-10-16T11:10:55Z

On Thu, Oct 16, 2025 at 01:07:17PM +0200, Peter Zijlstra wrote:
> On Mon, Oct 13, 2025 at 09:34:19AM -0500, David Kaplan wrote:
> > When patching retpolines, nops may be required for padding such as when
> > turning a 5-byte direct call into a 2-byte indirect call. Previously,
> > these were appended at the end so the code becomes "call *reg;nop;nop;nop"
> > for example. This was fine because it's always going from a larger
> > instruction to a smaller one.
> >
> > But this is a problem if the sequence is transformed from a 2-byte indirect
> > to the 5-byte direct call version at runtime because when the called
> > function returns, it will be in the middle of the 5-byte call instruction.
> >
> > To fix this, prepend the nops instead of appending them. Consequently, the
> > return site of the called function is always the same.
> >
>
> So this results in:
>
> NOP3; call *%r11

Also possible:

lfence; call *r11

(which is why we needed 6 bytes for reg>8)

> And you're saying a task can be on the other side of that call and then
> return lines up. But what if the task is preempted right after that
> NOP3?
>
> Same for all the alternative patching; what ensures no task is currently
> having a register state that is in the middle of things?