bpf, arm64: Sign return address for JITed code

Sign return address for JITed code when the kernel is built with pointer
authentication enabled:

1. Sign LR with paciasp instruction before LR is pushed to stack. Since
   paciasp acts like landing pads for function entry, no need to insert
   bti instruction before paciasp.

2. Authenticate LR with autiasp instruction after LR is popped from stack.

For BPF tail call, the stack frame constructed by the caller is reused by
the callee. That is, the stack frame is constructed by the caller and
destructed by the callee. Thus LR is signed and pushed to the stack in the
caller's prologue, and poped from the stack and authenticated in the
callee's epilogue.

For BPF2BPF call, the caller and callee construct their own stack frames,
and sign and authenticate their own LRs.

Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://events.static.linuxfound.org/sites/events/files/slides/slides_23.pdf
Link: https://lore.kernel.org/bpf/20220402073942.3782529-1-xukuohai@huawei.com

diff --git a/arch/arm64/net/bpf_jit.h b/arch/arm64/net/bpf_jit.h
index 3920213244f019f4ce0d387674c0d5ca541927c2..194c95ccc1cf76b9ffca0a9cb42bbc02f9eb119c 100644 (file)
--- a/arch/arm64/net/bpf_jit.h
+++ b/arch/arm64/net/bpf_jit.h
@@ -263,6 +263,9 @@
 /* HINTs */
 #define A64_HINT(x) aarch64_insn_gen_hint(x)
 
+#define A64_PACIASP A64_HINT(AARCH64_INSN_HINT_PACIASP)
+#define A64_AUTIASP A64_HINT(AARCH64_INSN_HINT_AUTIASP)
+
 /* BTI */
 #define A64_BTI_C  A64_HINT(AARCH64_INSN_HINT_BTIC)
 #define A64_BTI_J  A64_HINT(AARCH64_INSN_HINT_BTIJ)

diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index 093fa9ea1083bfe5f288cd0dfe221dcda0dc4b8f..8ab4035dea2742b704dc7501b0b2128320899b1e 100644 (file)
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -236,7 +236,8 @@ static bool is_lsi_offset(int offset, int scale)
 }
 
 /* Tail call offset to jump into */
-#if IS_ENABLED(CONFIG_ARM64_BTI_KERNEL)
+#if IS_ENABLED(CONFIG_ARM64_BTI_KERNEL) || \
+       IS_ENABLED(CONFIG_ARM64_PTR_AUTH_KERNEL)
 #define PROLOGUE_OFFSET 9
 #else
 #define PROLOGUE_OFFSET 8
@@ -278,8 +279,11 @@ static int build_prologue(struct jit_ctx *ctx, bool ebpf_from_cbpf)
         *
         */
 
+       /* Sign lr */
+       if (IS_ENABLED(CONFIG_ARM64_PTR_AUTH_KERNEL))
+               emit(A64_PACIASP, ctx);
        /* BTI landing pad */
-       if (IS_ENABLED(CONFIG_ARM64_BTI_KERNEL))
+       else if (IS_ENABLED(CONFIG_ARM64_BTI_KERNEL))
                emit(A64_BTI_C, ctx);
 
        /* Save FP and LR registers to stay align with ARM64 AAPCS */
@@ -580,6 +584,10 @@ static void build_epilogue(struct jit_ctx *ctx)
        /* Set return value */
        emit(A64_MOV(1, A64_R(0), r0), ctx);
 
+       /* Authenticate lr */
+       if (IS_ENABLED(CONFIG_ARM64_PTR_AUTH_KERNEL))
+               emit(A64_AUTIASP, ctx);
+
        emit(A64_RET(A64_LR), ctx);
 }