mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 10:11:27 +01:00
Andrew Cooper
2eb1132f79
The Indirect Target Selection speculative vulnerability means that indirect branches (including RETs) are unsafe when in the first half of a cacheline. This means it's not safe for logic using the stubs to write raw 0xc3's. Introduce place_ret() which, for now, writes a raw 0xc3 but will contain additional logic when return thunks are in use. stub_selftest() doesn't strictly need to be converted as they only run on boot, but doing so gets us a partial test of place_ret() too. No functional change. This is part of XSA-469 / CVE-2024-28956 Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Roger Pau Monné <roger.pau@citrix.com>