leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

bpf, arm64: Sign return address for JITed code

Browse Source 
Sign return address for JITed code when the kernel is built with pointer
authentication enabled:

1. Sign LR with paciasp instruction before LR is pushed to stack. Since
   paciasp acts like landing pads for function entry, no need to insert
   bti instruction before paciasp.

2. Authenticate LR with autiasp instruction after LR is popped from stack.

For BPF tail call, the stack frame constructed by the caller is reused by
the callee. That is, the stack frame is constructed by the caller and
destructed by the callee. Thus LR is signed and pushed to the stack in the
caller's prologue, and poped from the stack and authenticated in the
callee's epilogue.

For BPF2BPF call, the caller and callee construct their own stack frames,
and sign and authenticate their own LRs.

Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://events.static.linuxfound.org/sites/events/files/slides/slides_23.pdf
Link: https://lore.kernel.org/bpf/20220402073942.3782529-1-xukuohai@huawei.com
This commit is contained in:
Xu Kuohai 2022-04-02 03:39:42 -04:00 committed by Daniel Borkmann
parent 9a7ef9f86b
commit 042152c27c
2 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
arch/arm64/net/bpf_jit.h
View File

@ -263,6 +263,9 @@
/* HINTs */ /* HINTs */
#define A64_HINT(x) aarch64_insn_gen_hint(x) #define A64_HINT(x) aarch64_insn_gen_hint(x)
#define A64_PACIASP A64_HINT(AARCH64_INSN_HINT_PACIASP)
#define A64_AUTIASP A64_HINT(AARCH64_INSN_HINT_AUTIASP)
/* BTI */ /* BTI */
#define A64_BTI_C A64_HINT(AARCH64_INSN_HINT_BTIC) #define A64_BTI_C A64_HINT(AARCH64_INSN_HINT_BTIC)
#define A64_BTI_J A64_HINT(AARCH64_INSN_HINT_BTIJ) #define A64_BTI_J A64_HINT(AARCH64_INSN_HINT_BTIJ)

12
arch/arm64/net/bpf_jit_comp.c
View File

@ -236,7 +236,8 @@ static bool is_lsi_offset(int offset, int scale)
} }
/* Tail call offset to jump into */ /* Tail call offset to jump into */
#if IS_ENABLED(CONFIG_ARM64_BTI_KERNEL) #if IS_ENABLED(CONFIG_ARM64_BTI_KERNEL) || \
IS_ENABLED(CONFIG_ARM64_PTR_AUTH_KERNEL)
#define PROLOGUE_OFFSET 9 #define PROLOGUE_OFFSET 9
#else #else
#define PROLOGUE_OFFSET 8 #define PROLOGUE_OFFSET 8
@ -278,8 +279,11 @@ static int build_prologue(struct jit_ctx *ctx, bool ebpf_from_cbpf)
* *
*/ */
/* Sign lr */
if (IS_ENABLED(CONFIG_ARM64_PTR_AUTH_KERNEL))
emit(A64_PACIASP, ctx);
/* BTI landing pad */ /* BTI landing pad */
if (IS_ENABLED(CONFIG_ARM64_BTI_KERNEL)) else if (IS_ENABLED(CONFIG_ARM64_BTI_KERNEL))
emit(A64_BTI_C, ctx); emit(A64_BTI_C, ctx);
/* Save FP and LR registers to stay align with ARM64 AAPCS */ /* Save FP and LR registers to stay align with ARM64 AAPCS */
@ -580,6 +584,10 @@ static void build_epilogue(struct jit_ctx *ctx)
/* Set return value */ /* Set return value */
emit(A64_MOV(1, A64_R(0), r0), ctx); emit(A64_MOV(1, A64_R(0), r0), ctx);
/* Authenticate lr */
if (IS_ENABLED(CONFIG_ARM64_PTR_AUTH_KERNEL))
emit(A64_AUTIASP, ctx);
emit(A64_RET(A64_LR), ctx); emit(A64_RET(A64_LR), ctx);
} }