> > +ENTRY(__x86.indirect_thunk) > > + CFI_STARTPROC > > + call retpoline_call_target > > +2: > > + lfence /* stop speculation */ > > + jmp 2b > > +retpoline_call_target: > > +#ifdef CONFIG_64BIT > > + lea 8(%rsp), %rsp > > +#else > > + lea 4(%esp), %esp > > +#endif > > + ret > > + CFI_ENDPROC > > +ENDPROC(__x86.indirect_thunk) > > + > > + EXPORT_SYMBOL(__x86.indirect_thunk) > > -- > > 2.14.3 > > > > Can someone actually explain WTF this mess is trying to accomplish?
Think of it as an 'indirect call that doesn't speculate' instruction. There isn't one in the processor but this specific sequence happens to make the micro-architecture do just that as efficiently as possible. What it's actually doing on the non-speculated path (ie the reachable code) is to call, put the address we want to hit over the existing return address and then return, to the address we want to indirectly go to. It's faster than doing a far branch or flushing branch predictors and the like. Alan
