mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 02:01:24 +01:00
x86: Drop INDIRECT_JMP
Indirect JMPs which are not tailcalls can lead to an unwelcome form of speculative type confusion, and we've removed the uses of INDIRECT_JMP to compensate. Remove the temptation to reintroduce new instances. This is part of XSA-456 / CVE-2024-2201. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
This commit is contained in:
1 parent
8e186f98ce
commit
0b66d7ce3c
1 file changed
+4
-14
@@ -29,10 +29,9 @@
|
||||
BUG /* Shouldn't return */
|
||||
.endm
|
||||
|
||||
.macro INDIRECT_BRANCH insn:req, arg:req
|
||||
.macro INDIRECT_CALL arg:req
|
||||
/*
|
||||
* Create an indirect branch. insn is one of call/jmp, arg is a single
|
||||
* register.
|
||||
* Create an indirect call. arg is a single register.
|
||||
*
|
||||
* With no compiler support, this degrades into a plain indirect call/jmp.
|
||||
* With compiler support, dispatch to the correct __x86_indirect_thunk_*
|
||||
@@ -42,7 +41,7 @@
|
||||
$done = 0
|
||||
.irp reg, ax, cx, dx, bx, bp, si, di, 8, 9, 10, 11, 12, 13, 14, 15
|
||||
.ifeqs "\arg", "%r\reg"
|
||||
\insn __x86_indirect_thunk_r\reg
|
||||
call __x86_indirect_thunk_r\reg
|
||||
$done = 1
|
||||
.exitm
|
||||
.endif
|
||||
@@ -53,19 +52,10 @@
|
||||
.endif
|
||||
|
||||
.else
|
||||
\insn *\arg
|
||||
call *\arg
|
||||
.endif
|
||||
.endm
|
||||
|
||||
/* Convenience wrappers. */
|
||||
.macro INDIRECT_CALL arg:req
|
||||
INDIRECT_BRANCH call, \arg
|
||||
.endm
|
||||
|
||||
.macro INDIRECT_JMP arg:req
|
||||
INDIRECT_BRANCH jmp, \arg
|
||||
.endm
|
||||
|
||||
#ifdef CONFIG_XEN_IBT
|
||||
# define ENDBR64 endbr64
|
||||
#else
|
||||
|
||||