arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs

Browse source

commit 0dfefc2ea2 upstream.

A malicious BPF program may manipulate the branch history to influence
what the hardware speculates will happen next.

On exit from a BPF program, emit the BHB mititgation sequence.

This is only applied for 'classic' cBPF programs that are loaded by
seccomp.

Signed-off-by: James Morse <james.morse@arm.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

...

This commit is contained in:

James Morse 2021-12-09 15:13:24 +00:00 • committed by Greg Kroah-Hartman

parent f2aebb8ec6

commit 38c345fd54

3 changed files with 52 additions and 5 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

arch/arm64/include/asm/spectre.h

View file

2

arch/arm64/kernel/proton-pack.c

View file

54

arch/arm64/net/bpf_jit_comp.c

View file