Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752835AbeAIVjR (ORCPT + 1 other); Tue, 9 Jan 2018 16:39:17 -0500 Received: from www62.your-server.de ([213.133.104.62]:54109 "EHLO www62.your-server.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751842AbeAIVjP (ORCPT ); Tue, 9 Jan 2018 16:39:15 -0500 Subject: Re: [PATCH v3 bpf] bpf: introduce BPF_JIT_ALWAYS_ON config To: Alexei Starovoitov , davem@davemloft.net Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-team@fb.com References: <20180109180429.1115005-1-ast@kernel.org> From: Daniel Borkmann Message-ID: <606bf504-a39f-288d-11cd-56888ecbc165@iogearbox.net> Date: Tue, 9 Jan 2018 22:39:07 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: <20180109180429.1115005-1-ast@kernel.org> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Authenticated-Sender: daniel@iogearbox.net Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: On 01/09/2018 07:04 PM, Alexei Starovoitov wrote: > The BPF interpreter has been used as part of the spectre 2 attack CVE-2017-5715. > > A quote from goolge project zero blog: > "At this point, it would normally be necessary to locate gadgets in > the host kernel code that can be used to actually leak data by reading > from an attacker-controlled location, shifting and masking the result > appropriately and then using the result of that as offset to an > attacker-controlled address for a load. But piecing gadgets together > and figuring out which ones work in a speculation context seems annoying. > So instead, we decided to use the eBPF interpreter, which is built into > the host kernel - while there is no legitimate way to invoke it from inside > a VM, the presence of the code in the host kernel's text section is sufficient > to make it usable for the attack, just like with ordinary ROP gadgets." > > To make attacker job harder introduce BPF_JIT_ALWAYS_ON config > option that removes interpreter from the kernel in favor of JIT-only mode. > So far eBPF JIT is supported by: > x64, arm64, arm32, sparc64, s390, powerpc64, mips64 > > The start of JITed program is randomized and code page is marked as read-only. > In addition "constant blinding" can be turned on with net.core.bpf_jit_harden > > v2->v3: > - move __bpf_prog_ret0 under ifdef (Daniel) > > v1->v2: > - fix init order, test_bpf and cBPF (Daniel's feedback) > - fix offloaded bpf (Jakub's feedback) > - add 'return 0' dummy in case something can invoke prog->bpf_func > - retarget bpf tree. For bpf-next the patch would need one extra hunk. > It will be sent when the trees are merged back to net-next > > Considered doing: > int bpf_jit_enable __read_mostly = BPF_EBPF_JIT_DEFAULT; > but it seems better to land the patch as-is and in bpf-next remove > bpf_jit_enable global variable from all JITs, consolidate in one place > and remove this jit_init() function. > > Signed-off-by: Alexei Starovoitov Applied to bpf tree, thanks Alexei!