lkml.org 
[lkml]   [2018]   [Feb]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.15 067/202] [Variant 2/Spectre-v2] arm64: entry: Apply BP hardening for suspicious interrupts from EL0
    Date
    4.15-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Will Deacon <will.deacon@arm.com>


    Commit 30d88c0e3ace upstream.

    It is possible to take an IRQ from EL0 following a branch to a kernel
    address in such a way that the IRQ is prioritised over the instruction
    abort. Whilst an attacker would need to get the stars to align here,
    it might be sufficient with enough calibration so perform BP hardening
    in the rare case that we see a kernel address in the ELR when handling
    an IRQ from EL0.

    Reported-by: Dan Hettena <dhettena@nvidia.com>
    Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
    Signed-off-by: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    arch/arm64/kernel/entry.S | 5 +++++
    arch/arm64/mm/fault.c | 6 ++++++
    2 files changed, 11 insertions(+)

    --- a/arch/arm64/kernel/entry.S
    +++ b/arch/arm64/kernel/entry.S
    @@ -828,6 +828,11 @@ el0_irq_naked:
    #endif

    ct_user_exit
    +#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
    + tbz x22, #55, 1f
    + bl do_el0_irq_bp_hardening
    +1:
    +#endif
    irq_handler

    #ifdef CONFIG_TRACE_IRQFLAGS
    --- a/arch/arm64/mm/fault.c
    +++ b/arch/arm64/mm/fault.c
    @@ -707,6 +707,12 @@ asmlinkage void __exception do_mem_abort
    arm64_notify_die("", regs, &info, esr);
    }

    +asmlinkage void __exception do_el0_irq_bp_hardening(void)
    +{
    + /* PC has already been checked in entry.S */
    + arm64_apply_bp_hardening();
    +}
    +
    asmlinkage void __exception do_el0_ia_bp_hardening(unsigned long addr,
    unsigned int esr,
    struct pt_regs *regs)

    \
     
     \ /
      Last update: 2018-02-15 16:41    [W:4.045 / U:0.100 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site