arm64: entry: Ensure branch through syscall table is bounded under speculation

In a similar manner to array_index_mask_nospec, this patch introduces an
assembly macro (mask_nospec64) which can be used to bound a value under
speculation. This macro is then used to ensure that the indirect branch
through the syscall table is bounded under speculation, with out-of-range
addresses speculating as calls to sys_io_setup (0).

Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

2 files changed, 13 insertions, 0 deletions

diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
index 1f44b4255a28..1241fb211293 100644
--- a/arch/arm64/include/asm/assembler.h
+++ b/arch/arm64/include/asm/assembler.h
@@ -123,6 +123,17 @@
         .endm
 
 /*
+ * Sanitise a 64-bit bounded index wrt speculation, returning zero if out
+ * of bounds.
+ */
+        .macro  mask_nospec64, idx, limit, tmp
+        sub     \tmp, \idx, \limit
+        bic     \tmp, \tmp, \idx
+        and     \idx, \idx, \tmp, asr #63
+        csdb
+        .endm
+
+/*
  * NOP sequence
  */
         .macro  nops, num
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index 17c15f741780..4dd1b5a46642 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -378,6 +378,7 @@ alternative_insn eret, nop, ARM64_UNMAP_KERNEL_AT_EL0
  * x7 is reserved for the system call number in 32-bit mode.
  */
 wsc_nr  .req    w25             // number of system calls
+xsc_nr  .req    x25             // number of system calls (zero-extended)
 wscno   .req    w26             // syscall number
 xscno   .req    x26             // syscall number (zero-extended)
 stbl    .req    x27             // syscall table pointer
@@ -935,6 +936,7 @@ el0_svc_naked:					// compat entry point
         b.ne    __sys_trace
         cmp     wscno, wsc_nr                   // check upper syscall limit
         b.hs    ni_sys
+        mask_nospec64 xscno, xsc_nr, x19        // enforce bounds for syscall number
         ldr     x16, [stbl, xscno, lsl #3]      // address in the syscall table
         blr     x16                             // call sys_* routine
         b       ret_fast_syscall