File xsa456-2.patch of Package xen.36362

Overview Repositories Revisions Requests Users Attributes Meta

File xsa456-2.patch of Package xen.36362

# Commit 0b66d7ce3c0290eaad28bdafb35200052d012b14
# Date 2024-04-09 16:37:30 +0100
# Author Andrew Cooper <andrew.cooper3@citrix.com>
# Committer Andrew Cooper <andrew.cooper3@citrix.com>
x86: Drop INDIRECT_JMP

Indirect JMPs which are not tailcalls can lead to an unwelcome form of
speculative type confusion, and we've removed the uses of INDIRECT_JMP to
compensate.  Remove the temptation to reintroduce new instances.

This is part of XSA-456 / CVE-2024-2201.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>

--- a/xen/include/asm-x86/indirect_thunk_asm.h
+++ b/xen/include/asm-x86/indirect_thunk_asm.h
@@ -13,10 +13,9 @@ asm ( "\t.include \"asm/indirect_thunk_a
 # endif
 #else
 
-.macro INDIRECT_BRANCH insn:req arg:req
+.macro INDIRECT_CALL arg:req
 /*
- * Create an indirect branch.  insn is one of call/jmp, arg is a single
- * register.
+ * Create an indirect call.  arg is a single register.
  *
  * With no compiler support, this degrades into a plain indirect call/jmp.
  * With compiler support, dispatch to the correct __x86_indirect_thunk_*
@@ -26,7 +25,7 @@ asm ( "\t.include \"asm/indirect_thunk_a
         $done = 0
         .irp reg, ax, cx, dx, bx, bp, si, di, 8, 9, 10, 11, 12, 13, 14, 15
         .ifeqs "\arg", "%r\reg"
-            \insn __x86_indirect_thunk_r\reg
+            call __x86_indirect_thunk_r\reg
             $done = 1
            .exitm
         .endif
@@ -37,19 +36,10 @@ asm ( "\t.include \"asm/indirect_thunk_a
         .endif
 
     .else
-        \insn *\arg
+        call *\arg
     .endif
 .endm
 
-/* Convenience wrappers. */
-.macro INDIRECT_CALL arg:req
-    INDIRECT_BRANCH call \arg
-.endm
-
-.macro INDIRECT_JMP arg:req
-    INDIRECT_BRANCH jmp \arg
-.endm
-
 #ifdef CONFIG_XEN_IBT
 # define ENDBR64 endbr64
 #else

Places

File xsa456-2.patch of Package xen.36362

Places