Subject: Re: [PATCH v3 bpf] bpf: introduce BPF_JIT_ALWAYS_ON config
To: Alexei Starovoitov <ast@kernel.org>, davem@davemloft.net
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
        kernel-team@fb.com
References: <20180109180429.1115005-1-ast@kernel.org>
From: Daniel Borkmann <daniel@iogearbox.net>
Message-ID: <606bf504-a39f-288d-11cd-56888ecbc165@iogearbox.net>
Date: Tue, 9 Jan 2018 22:39:07 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.3.0
MIME-Version: 1.0
In-Reply-To: <20180109180429.1115005-1-ast@kernel.org>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org

On 01/09/2018 07:04 PM, Alexei Starovoitov wrote:
> The BPF interpreter has been used as part of the spectre 2 attack CVE-2017-5715.
> 
> A quote from goolge project zero blog:
> "At this point, it would normally be necessary to locate gadgets in
> the host kernel code that can be used to actually leak data by reading
> from an attacker-controlled location, shifting and masking the result
> appropriately and then using the result of that as offset to an
> attacker-controlled address for a load. But piecing gadgets together
> and figuring out which ones work in a speculation context seems annoying.
> So instead, we decided to use the eBPF interpreter, which is built into
> the host kernel - while there is no legitimate way to invoke it from inside
> a VM, the presence of the code in the host kernel's text section is sufficient
> to make it usable for the attack, just like with ordinary ROP gadgets."
> 
> To make attacker job harder introduce BPF_JIT_ALWAYS_ON config
> option that removes interpreter from the kernel in favor of JIT-only mode.
> So far eBPF JIT is supported by:
> x64, arm64, arm32, sparc64, s390, powerpc64, mips64
> 
> The start of JITed program is randomized and code page is marked as read-only.
> In addition "constant blinding" can be turned on with net.core.bpf_jit_harden
> 
> v2->v3:
> - move __bpf_prog_ret0 under ifdef (Daniel)
> 
> v1->v2:
> - fix init order, test_bpf and cBPF (Daniel's feedback)
> - fix offloaded bpf (Jakub's feedback)
> - add 'return 0' dummy in case something can invoke prog->bpf_func
> - retarget bpf tree. For bpf-next the patch would need one extra hunk.
>   It will be sent when the trees are merged back to net-next
> 
> Considered doing:
>   int bpf_jit_enable __read_mostly = BPF_EBPF_JIT_DEFAULT;
> but it seems better to land the patch as-is and in bpf-next remove
> bpf_jit_enable global variable from all JITs, consolidate in one place
> and remove this jit_init() function.
> 
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>

Applied to bpf tree, thanks Alexei!