From patchwork Thu Apr 12 11:11:18 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 133217 Delivered-To: patch@linaro.org Received: by 10.46.84.29 with SMTP id i29csp1572024ljb; Thu, 12 Apr 2018 04:13:04 -0700 (PDT) X-Google-Smtp-Source: AIpwx48z3DSPcRijxg6QC/9OvQj2kbUZ/cyGN+ykdfclgfz3V3ODKm6ZMFLstC3KYYl66wqP49eT X-Received: by 10.99.123.24 with SMTP id w24mr377324pgc.82.1523531584804; Thu, 12 Apr 2018 04:13:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523531584; cv=none; d=google.com; s=arc-20160816; b=ZUFJXn1UDHqlrPYQFzl/pLcdPI0afZBoRwxByb0VLI1Ml4joWWjJYTkxFMX/QcZuXs KUT0CLrF9IbBzlFBFQrQJ/2BMxbcQp1njOM6algRs7/KQaIy+PnhxetDVeqpSFkZG1SV 9+EsShGlaW71grL+xHsE+8fIzD03qQxS/WXMNJnPiORfmPNJ9NDdKWj8XeHKNhTctGr2 mBDCOY3xRrdAcXdNQNI/lAd9VLJx7il0Bf6L243+Wrmeh9o9iIue8bgfDEaxLoywzpqG OnJEANk54dNsZZRs3zdJXmN+M1PKYOuDV0Mn2MoPQta2oBx76MNXHA0ErLZa2gDk9QX6 Qagw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=4WJAFaMz8J308pN/ObeiLLsBtSSy0TUiijx0U6LoY0U=; b=h0cUupw+9mlpD8skkxwhlc3F/p7FQNLdR1ftlvUa/aB6xPW6CzeA47pHjHJtACG5oE 3JJtL+lVYe9Nv2u09x2MR+qOGTJaIIWq4c8PvK0Isi0gqYf74nqrMu1ABDTp3eknIFj9 cOpplSVrXbU0ol7sjswaK10ZsEZjzIuYgdBKqhE8LltJq0E4gDdkXm2PmGEFLBVRZ+xm qEwCPznGEFJJLN1+2J1NDqkXBuFtjY2KVnTG93MF1J85gMcxYqhPArMbthFkI20/f55I BLRtCN1TrxP0xrT+uGJRpTKDCJtJBY6xGM0gJO3R2P7kjmFSRDoCyawV7G7Jnkpcti4B U9oA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id bg3-v6si3001807plb.118.2018.04.12.04.13.04; Thu, 12 Apr 2018 04:13:04 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752920AbeDLLND (ORCPT + 11 others); Thu, 12 Apr 2018 07:13:03 -0400 Received: from foss.arm.com ([217.140.101.70]:59504 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752916AbeDLLND (ORCPT ); Thu, 12 Apr 2018 07:13:03 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 67DA580D; Thu, 12 Apr 2018 04:13:03 -0700 (PDT) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 677883F24A; Thu, 12 Apr 2018 04:13:01 -0700 (PDT) From: Mark Rutland To: stable@vger.kernel.org Cc: mark.brown@linaro.org, ard.biesheuvel@linaro.org, marc.zyngier@arm.com, will.deacon@arm.com, catalin.marinas@arm.com, ghackmann@google.com, shankerd@codeaurora.org Subject: [PATCH v4.9.y 22/42] arm64: entry: Apply BP hardening for suspicious interrupts from EL0 Date: Thu, 12 Apr 2018 12:11:18 +0100 Message-Id: <20180412111138.40990-23-mark.rutland@arm.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20180412111138.40990-1-mark.rutland@arm.com> References: <20180412111138.40990-1-mark.rutland@arm.com> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Will Deacon commit 30d88c0e3ace625a92eead9ca0ad94093a8f59fe upstream. It is possible to take an IRQ from EL0 following a branch to a kernel address in such a way that the IRQ is prioritised over the instruction abort. Whilst an attacker would need to get the stars to align here, it might be sufficient with enough calibration so perform BP hardening in the rare case that we see a kernel address in the ELR when handling an IRQ from EL0. Reported-by: Dan Hettena Reviewed-by: Marc Zyngier Signed-off-by: Will Deacon Signed-off-by: Catalin Marinas Signed-off-by: Mark Rutland [v4.9 backport] --- arch/arm64/kernel/entry.S | 5 +++++ arch/arm64/mm/fault.c | 6 ++++++ 2 files changed, 11 insertions(+) -- 2.11.0 diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S index 30f4331d477a..b79e302d2a3e 100644 --- a/arch/arm64/kernel/entry.S +++ b/arch/arm64/kernel/entry.S @@ -686,6 +686,11 @@ el0_irq_naked: #endif ct_user_exit +#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR + tbz x22, #55, 1f + bl do_el0_irq_bp_hardening +1: +#endif irq_handler #ifdef CONFIG_TRACE_IRQFLAGS diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 6120a1486054..ad49ae8f3967 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -590,6 +590,12 @@ asmlinkage void __exception do_mem_abort(unsigned long addr, unsigned int esr, arm64_notify_die("", regs, &info, esr); } +asmlinkage void __exception do_el0_irq_bp_hardening(void) +{ + /* PC has already been checked in entry.S */ + arm64_apply_bp_hardening(); +} + asmlinkage void __exception do_el0_ia_bp_hardening(unsigned long addr, unsigned int esr, struct pt_regs *regs)