arm64: entry: Apply BP hardening for suspicious interrupts from EL0

Web:        https://git.kernel.org/torvalds/c/30d88c0e3ace625a92eead9ca0ad94093a8f59fe
Commit:     30d88c0e3ace625a92eead9ca0ad94093a8f59fe
Parent:     5dfc6ed27710c42cbc15db5c0d4475699991da0a
Refname:    refs/heads/master
Author:     Will Deacon <[email protected]>
AuthorDate: Fri Feb 2 17:31:40 2018 +0000
Committer:  Catalin Marinas <[email protected]>
CommitDate: Tue Feb 6 22:53:46 2018 +0000

    arm64: entry: Apply BP hardening for suspicious interrupts from EL0
    
    It is possible to take an IRQ from EL0 following a branch to a kernel
    address in such a way that the IRQ is prioritised over the instruction
    abort. Whilst an attacker would need to get the stars to align here,
    it might be sufficient with enough calibration so perform BP hardening
    in the rare case that we see a kernel address in the ELR when handling
    an IRQ from EL0.
    
    Reported-by: Dan Hettena <[email protected]>
    Reviewed-by: Marc Zyngier <[email protected]>
    Signed-off-by: Will Deacon <[email protected]>
    Signed-off-by: Catalin Marinas <[email protected]>
---
 arch/arm64/kernel/entry.S | 5 +++++
 arch/arm64/mm/fault.c     | 6 ++++++
 2 files changed, 11 insertions(+)

diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index af22793103af..25e022c3b6c4 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -828,6 +828,11 @@ el0_irq_naked:
 #endif
 
 	ct_user_exit
+#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
+	tbz	x22, #55, 1f
+	bl	do_el0_irq_bp_hardening
+1:
+#endif
 	irq_handler
 
 #ifdef CONFIG_TRACE_IRQFLAGS
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 43b28a782ed4..8fd141233dec 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -708,6 +708,12 @@ asmlinkage void __exception do_mem_abort(unsigned long addr, unsigned int esr,
 	arm64_notify_die("", regs, &info, esr);
 }
 
+asmlinkage void __exception do_el0_irq_bp_hardening(void)
+{
+	/* PC has already been checked in entry.S */
+	arm64_apply_bp_hardening();
+}
+
 asmlinkage void __exception do_el0_ia_bp_hardening(unsigned long addr,
 						   unsigned int esr,
 						   struct pt_regs *regs)
--
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html