x86: Drop INDIRECT_JMP

Indirect JMPs which are not tailcalls can lead to an unwelcome form of
speculative type confusion, and we've removed the uses of INDIRECT_JMP to
compensate.  Remove the temptation to reintroduce new instances.

This is part of XSA-456 / CVE-2024-2201.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
This commit is contained in:
Andrew Cooper committed 2024-04-09 16:37:30 +01:00
1 parent 8e186f98ce
commit 0b66d7ce3c
1 file changed
+4 -14
+4 -14
View File
@@ -29,10 +29,9 @@
BUG /* Shouldn't return */
.endm
.macro INDIRECT_BRANCH insn:req, arg:req
.macro INDIRECT_CALL arg:req
/*
* Create an indirect branch. insn is one of call/jmp, arg is a single
* register.
* Create an indirect call. arg is a single register.
*
* With no compiler support, this degrades into a plain indirect call/jmp.
* With compiler support, dispatch to the correct __x86_indirect_thunk_*
@@ -42,7 +41,7 @@
$done = 0
.irp reg, ax, cx, dx, bx, bp, si, di, 8, 9, 10, 11, 12, 13, 14, 15
.ifeqs "\arg", "%r\reg"
\insn __x86_indirect_thunk_r\reg
call __x86_indirect_thunk_r\reg
$done = 1
.exitm
.endif
@@ -53,19 +52,10 @@
.endif
.else
\insn *\arg
call *\arg
.endif
.endm
/* Convenience wrappers. */
.macro INDIRECT_CALL arg:req
INDIRECT_BRANCH call, \arg
.endm
.macro INDIRECT_JMP arg:req
INDIRECT_BRANCH jmp, \arg
.endm
#ifdef CONFIG_XEN_IBT
# define ENDBR64 endbr64
#else
Reference in new issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.