arm64: entry: Apply BP hardening for suspicious interrupts from EL0

Browse source

It is possible to take an IRQ from EL0 following a branch to a kernel
address in such a way that the IRQ is prioritised over the instruction
abort. Whilst an attacker would need to get the stars to align here,
it might be sufficient with enough calibration so perform BP hardening
in the rare case that we see a kernel address in the ELR when handling
an IRQ from EL0.

Reported-by: Dan Hettena <dhettena@nvidia.com>
Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

...

This commit is contained in:

Will Deacon 2018-02-02 17:31:40 +00:00 • committed by Catalin Marinas

parent 5dfc6ed277

commit 30d88c0e3a

2 changed files with 11 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

arch/arm64/kernel/entry.S

View file

6

arch/arm64/mm/fault.c

View file