diff options
author | Will Deacon <will.deacon@arm.com> | 2018-02-02 17:31:40 +0000 |
---|---|---|
committer | Catalin Marinas <catalin.marinas@arm.com> | 2018-02-06 22:53:46 +0000 |
commit | 30d88c0e3ace625a92eead9ca0ad94093a8f59fe (patch) | |
tree | 84996f5e1a90fe3e95cd54b821da1e624007970d /arch/arm64/kernel/entry.S | |
parent | 5dfc6ed27710c42cbc15db5c0d4475699991da0a (diff) |
arm64: entry: Apply BP hardening for suspicious interrupts from EL0
It is possible to take an IRQ from EL0 following a branch to a kernel
address in such a way that the IRQ is prioritised over the instruction
abort. Whilst an attacker would need to get the stars to align here,
it might be sufficient with enough calibration so perform BP hardening
in the rare case that we see a kernel address in the ELR when handling
an IRQ from EL0.
Reported-by: Dan Hettena <dhettena@nvidia.com>
Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Diffstat (limited to 'arch/arm64/kernel/entry.S')
-rw-r--r-- | arch/arm64/kernel/entry.S | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S index af22793103af..25e022c3b6c4 100644 --- a/arch/arm64/kernel/entry.S +++ b/arch/arm64/kernel/entry.S @@ -828,6 +828,11 @@ el0_irq_naked: #endif ct_user_exit +#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR + tbz x22, #55, 1f + bl do_el0_irq_bp_hardening +1: +#endif irq_handler #ifdef CONFIG_TRACE_IRQFLAGS |