Commit 2cf7fd69 authored by Andy Polyakov's avatar Andy Polyakov Committed by Richard Levitte
Browse files

AArch64 assembly pack: authenticate return addresses. 



ARMv8.3 adds pointer authentication extension, which in this case allows
to ensure that, when offloaded to stack, return address is same at return
as at entry to the subroutine. The new instructions are nops on processors
that don't implement the extension, so that the vetification is backward
compatible.

Reviewed-by: default avatarKurt Roeckx <kurt@roeckx.be>
Reviewed-by: default avatarRichard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/8205)

(cherry picked from commit 9a18aae5f21efc59da8b697ad67d5d37b95ab322)
parent af250b36

crypto/aes/asm/aesv8-armx.pl

+2 −0
Original line number Diff line number Diff line
@@ -262,6 +262,7 @@ $code.=<<___; 
${prefix}_set_decrypt_key:

___

$code.=<<___	if ($flavour =~ /64/);

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-16]!

	add	x29,sp,#0

___
@@ -305,6 +306,7 @@ $code.=<<___ if ($flavour !~ /64/); 
___

$code.=<<___	if ($flavour =~ /64/);

	ldp	x29,x30,[sp],#16

	.inst	0xd50323bf		// autiasp

	ret

___

$code.=<<___;

crypto/aes/asm/vpaes-armv8.pl

+18 −0
Original line number Diff line number Diff line
@@ -255,6 +255,7 @@ _vpaes_encrypt_core: 
.type	vpaes_encrypt,%function

.align	4

vpaes_encrypt:

	.inst	0xd503233f			// paciasp

	stp	x29,x30,[sp,#-16]!

	add	x29,sp,#0
@@ -264,6 +265,7 @@ vpaes_encrypt: 
	st1	{v0.16b}, [$out]



	ldp	x29,x30,[sp],#16

	.inst	0xd50323bf			// autiasp

	ret

.size	vpaes_encrypt,.-vpaes_encrypt
@@ -486,6 +488,7 @@ _vpaes_decrypt_core: 
.type	vpaes_decrypt,%function

.align	4

vpaes_decrypt:

	.inst	0xd503233f			// paciasp

	stp	x29,x30,[sp,#-16]!

	add	x29,sp,#0
@@ -495,6 +498,7 @@ vpaes_decrypt: 
	st1	{v0.16b}, [$out]



	ldp	x29,x30,[sp],#16

	.inst	0xd50323bf			// autiasp

	ret

.size	vpaes_decrypt,.-vpaes_decrypt
@@ -665,6 +669,7 @@ _vpaes_key_preheat: 
.type	_vpaes_schedule_core,%function

.align	4

_vpaes_schedule_core:

	.inst	0xd503233f			// paciasp

	stp	x29, x30, [sp,#-16]!

	add	x29,sp,#0
@@ -829,6 +834,7 @@ _vpaes_schedule_core: 
	eor	v6.16b, v6.16b, v6.16b		// vpxor	%xmm6,	%xmm6,	%xmm6

	eor	v7.16b, v7.16b, v7.16b		// vpxor	%xmm7,	%xmm7,	%xmm7

	ldp	x29, x30, [sp],#16

	.inst	0xd50323bf			// autiasp

	ret

.size	_vpaes_schedule_core,.-_vpaes_schedule_core
@@ -1041,6 +1047,7 @@ _vpaes_schedule_mangle: 
.type	vpaes_set_encrypt_key,%function

.align	4

vpaes_set_encrypt_key:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-16]!

	add	x29,sp,#0

	stp	d8,d9,[sp,#-16]!	// ABI spec says so
@@ -1056,6 +1063,7 @@ vpaes_set_encrypt_key: 


	ldp	d8,d9,[sp],#16

	ldp	x29,x30,[sp],#16

	.inst	0xd50323bf		// autiasp

	ret

.size	vpaes_set_encrypt_key,.-vpaes_set_encrypt_key
@@ -1063,6 +1071,7 @@ vpaes_set_encrypt_key: 
.type	vpaes_set_decrypt_key,%function

.align	4

vpaes_set_decrypt_key:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-16]!

	add	x29,sp,#0

	stp	d8,d9,[sp,#-16]!	// ABI spec says so
@@ -1082,6 +1091,7 @@ vpaes_set_decrypt_key: 


	ldp	d8,d9,[sp],#16

	ldp	x29,x30,[sp],#16

	.inst	0xd50323bf		// autiasp

	ret

.size	vpaes_set_decrypt_key,.-vpaes_set_decrypt_key

___
@@ -1098,6 +1108,7 @@ vpaes_cbc_encrypt: 
	cmp	w5, #0			// check direction

	b.eq	vpaes_cbc_decrypt



	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-16]!

	add	x29,sp,#0
@@ -1120,6 +1131,7 @@ vpaes_cbc_encrypt: 
	st1	{v0.16b}, [$ivec]	// write ivec



	ldp	x29,x30,[sp],#16

	.inst	0xd50323bf		// autiasp

.Lcbc_abort:

	ret

.size	vpaes_cbc_encrypt,.-vpaes_cbc_encrypt
@@ -1127,6 +1139,7 @@ vpaes_cbc_encrypt: 
.type	vpaes_cbc_decrypt,%function

.align	4

vpaes_cbc_decrypt:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-16]!

	add	x29,sp,#0

	stp	d8,d9,[sp,#-16]!	// ABI spec says so
@@ -1168,6 +1181,7 @@ vpaes_cbc_decrypt: 
	ldp	d10,d11,[sp],#16

	ldp	d8,d9,[sp],#16

	ldp	x29,x30,[sp],#16

	.inst	0xd50323bf		// autiasp

	ret

.size	vpaes_cbc_decrypt,.-vpaes_cbc_decrypt

___
@@ -1177,6 +1191,7 @@ $code.=<<___; 
.type	vpaes_ecb_encrypt,%function

.align	4

vpaes_ecb_encrypt:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-16]!

	add	x29,sp,#0

	stp	d8,d9,[sp,#-16]!	// ABI spec says so
@@ -1210,6 +1225,7 @@ vpaes_ecb_encrypt: 
	ldp	d10,d11,[sp],#16

	ldp	d8,d9,[sp],#16

	ldp	x29,x30,[sp],#16

	.inst	0xd50323bf		// autiasp

	ret

.size	vpaes_ecb_encrypt,.-vpaes_ecb_encrypt
@@ -1217,6 +1233,7 @@ vpaes_ecb_encrypt: 
.type	vpaes_ecb_decrypt,%function

.align	4

vpaes_ecb_decrypt:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-16]!

	add	x29,sp,#0

	stp	d8,d9,[sp,#-16]!	// ABI spec says so
@@ -1250,6 +1267,7 @@ vpaes_ecb_decrypt: 
	ldp	d10,d11,[sp],#16

	ldp	d8,d9,[sp],#16

	ldp	x29,x30,[sp],#16

	.inst	0xd50323bf		// autiasp

	ret

.size	vpaes_ecb_decrypt,.-vpaes_ecb_decrypt

___

crypto/bn/asm/armv8-mont.pl

+4 −0
Original line number Diff line number Diff line
@@ -287,6 +287,7 @@ __bn_sqr8x_mont: 
	cmp	$ap,$bp

	b.ne	__bn_mul4x_mont

.Lsqr8x_mont:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-128]!

	add	x29,sp,#0

	stp	x19,x20,[sp,#16]
@@ -1040,6 +1041,7 @@ $code.=<<___; 
	ldp	x25,x26,[x29,#64]

	ldp	x27,x28,[x29,#80]

	ldr	x29,[sp],#128

	.inst	0xd50323bf		// autiasp

	ret

.size	__bn_sqr8x_mont,.-__bn_sqr8x_mont

___
@@ -1063,6 +1065,7 @@ $code.=<<___; 
.type	__bn_mul4x_mont,%function

.align	5

__bn_mul4x_mont:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-128]!

	add	x29,sp,#0

	stp	x19,x20,[sp,#16]
@@ -1496,6 +1499,7 @@ __bn_mul4x_mont: 
	ldp	x25,x26,[x29,#64]

	ldp	x27,x28,[x29,#80]

	ldr	x29,[sp],#128

	.inst	0xd50323bf		// autiasp

	ret

.size	__bn_mul4x_mont,.-__bn_mul4x_mont

___

crypto/chacha/asm/chacha-armv8.pl

+8 −0
Original line number Diff line number Diff line
@@ -157,6 +157,7 @@ ChaCha20_ctr32: 
	b.ne	ChaCha20_neon



.Lshort:

	.inst	0xd503233f			// paciasp

	stp	x29,x30,[sp,#-96]!

	add	x29,sp,#0
@@ -276,6 +277,7 @@ $code.=<<___; 
	ldp	x25,x26,[x29,#64]

	ldp	x27,x28,[x29,#80]

	ldp	x29,x30,[sp],#96

	.inst	0xd50323bf			// autiasp

.Labort:

	ret
@@ -332,6 +334,7 @@ $code.=<<___; 
	ldp	x25,x26,[x29,#64]

	ldp	x27,x28,[x29,#80]

	ldp	x29,x30,[sp],#96

	.inst	0xd50323bf			// autiasp

	ret

.size	ChaCha20_ctr32,.-ChaCha20_ctr32

___
@@ -377,6 +380,7 @@ $code.=<<___; 
.type	ChaCha20_neon,%function

.align	5

ChaCha20_neon:

	.inst	0xd503233f			// paciasp

	stp	x29,x30,[sp,#-96]!

	add	x29,sp,#0
@@ -575,6 +579,7 @@ $code.=<<___; 
	ldp	x25,x26,[x29,#64]

	ldp	x27,x28,[x29,#80]

	ldp	x29,x30,[sp],#96

	.inst	0xd50323bf			// autiasp

	ret



.Ltail_neon:
@@ -684,6 +689,7 @@ $code.=<<___; 
	ldp	x25,x26,[x29,#64]

	ldp	x27,x28,[x29,#80]

	ldp	x29,x30,[sp],#96

	.inst	0xd50323bf			// autiasp

	ret

.size	ChaCha20_neon,.-ChaCha20_neon

___
@@ -696,6 +702,7 @@ $code.=<<___; 
.type	ChaCha20_512_neon,%function

.align	5

ChaCha20_512_neon:

	.inst	0xd503233f			// paciasp

	stp	x29,x30,[sp,#-96]!

	add	x29,sp,#0
@@ -1114,6 +1121,7 @@ $code.=<<___; 
	ldp	x25,x26,[x29,#64]

	ldp	x27,x28,[x29,#80]

	ldp	x29,x30,[sp],#96

	.inst	0xd50323bf			// autiasp

	ret

.size	ChaCha20_512_neon,.-ChaCha20_512_neon

___

crypto/ec/asm/ecp_nistz256-armv8.pl

+27 −1
Original line number Diff line number Diff line
@@ -119,6 +119,7 @@ $code.=<<___; 
.type	ecp_nistz256_to_mont,%function

.align	6

ecp_nistz256_to_mont:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-32]!

	add	x29,sp,#0

	stp	x19,x20,[sp,#16]
@@ -134,6 +135,7 @@ ecp_nistz256_to_mont: 


	ldp	x19,x20,[sp,#16]

	ldp	x29,x30,[sp],#32

	.inst	0xd50323bf		// autiasp

	ret

.size	ecp_nistz256_to_mont,.-ecp_nistz256_to_mont
@@ -142,6 +144,7 @@ ecp_nistz256_to_mont: 
.type	ecp_nistz256_from_mont,%function

.align	4

ecp_nistz256_from_mont:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-32]!

	add	x29,sp,#0

	stp	x19,x20,[sp,#16]
@@ -157,6 +160,7 @@ ecp_nistz256_from_mont: 


	ldp	x19,x20,[sp,#16]

	ldp	x29,x30,[sp],#32

	.inst	0xd50323bf		// autiasp

	ret

.size	ecp_nistz256_from_mont,.-ecp_nistz256_from_mont
@@ -166,6 +170,7 @@ ecp_nistz256_from_mont: 
.type	ecp_nistz256_mul_mont,%function

.align	4

ecp_nistz256_mul_mont:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-32]!

	add	x29,sp,#0

	stp	x19,x20,[sp,#16]
@@ -180,6 +185,7 @@ ecp_nistz256_mul_mont: 


	ldp	x19,x20,[sp,#16]

	ldp	x29,x30,[sp],#32

	.inst	0xd50323bf		// autiasp

	ret

.size	ecp_nistz256_mul_mont,.-ecp_nistz256_mul_mont
@@ -188,6 +194,7 @@ ecp_nistz256_mul_mont: 
.type	ecp_nistz256_sqr_mont,%function

.align	4

ecp_nistz256_sqr_mont:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-32]!

	add	x29,sp,#0

	stp	x19,x20,[sp,#16]
@@ -201,6 +208,7 @@ ecp_nistz256_sqr_mont: 


	ldp	x19,x20,[sp,#16]

	ldp	x29,x30,[sp],#32

	.inst	0xd50323bf		// autiasp

	ret

.size	ecp_nistz256_sqr_mont,.-ecp_nistz256_sqr_mont
@@ -210,6 +218,7 @@ ecp_nistz256_sqr_mont: 
.type	ecp_nistz256_add,%function

.align	4

ecp_nistz256_add:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-16]!

	add	x29,sp,#0
@@ -223,6 +232,7 @@ ecp_nistz256_add: 
	bl	__ecp_nistz256_add



	ldp	x29,x30,[sp],#16

	.inst	0xd50323bf		// autiasp

	ret

.size	ecp_nistz256_add,.-ecp_nistz256_add
@@ -231,6 +241,7 @@ ecp_nistz256_add: 
.type	ecp_nistz256_div_by_2,%function

.align	4

ecp_nistz256_div_by_2:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-16]!

	add	x29,sp,#0
@@ -242,6 +253,7 @@ ecp_nistz256_div_by_2: 
	bl	__ecp_nistz256_div_by_2



	ldp	x29,x30,[sp],#16

	.inst	0xd50323bf		//  autiasp

	ret

.size	ecp_nistz256_div_by_2,.-ecp_nistz256_div_by_2
@@ -250,6 +262,7 @@ ecp_nistz256_div_by_2: 
.type	ecp_nistz256_mul_by_2,%function

.align	4

ecp_nistz256_mul_by_2:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-16]!

	add	x29,sp,#0
@@ -265,6 +278,7 @@ ecp_nistz256_mul_by_2: 
	bl	__ecp_nistz256_add	// ret = a+a	// 2*a



	ldp	x29,x30,[sp],#16

	.inst	0xd50323bf		// autiasp

	ret

.size	ecp_nistz256_mul_by_2,.-ecp_nistz256_mul_by_2
@@ -273,6 +287,7 @@ ecp_nistz256_mul_by_2: 
.type	ecp_nistz256_mul_by_3,%function

.align	4

ecp_nistz256_mul_by_3:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-16]!

	add	x29,sp,#0
@@ -299,6 +314,7 @@ ecp_nistz256_mul_by_3: 
	bl	__ecp_nistz256_add	// ret += a	// 2*a+a=3*a



	ldp	x29,x30,[sp],#16

	.inst	0xd50323bf		// autiasp

	ret

.size	ecp_nistz256_mul_by_3,.-ecp_nistz256_mul_by_3
@@ -308,6 +324,7 @@ ecp_nistz256_mul_by_3: 
.type	ecp_nistz256_sub,%function

.align	4

ecp_nistz256_sub:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-16]!

	add	x29,sp,#0
@@ -319,6 +336,7 @@ ecp_nistz256_sub: 
	bl	__ecp_nistz256_sub_from



	ldp	x29,x30,[sp],#16

	.inst	0xd50323bf		// autiasp

	ret

.size	ecp_nistz256_sub,.-ecp_nistz256_sub
@@ -327,6 +345,7 @@ ecp_nistz256_sub: 
.type	ecp_nistz256_neg,%function

.align	4

ecp_nistz256_neg:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-16]!

	add	x29,sp,#0
@@ -341,6 +360,7 @@ ecp_nistz256_neg: 
	bl	__ecp_nistz256_sub_from



	ldp	x29,x30,[sp],#16

	.inst	0xd50323bf		// autiasp

	ret

.size	ecp_nistz256_neg,.-ecp_nistz256_neg
@@ -701,6 +721,7 @@ $code.=<<___; 
.type	ecp_nistz256_point_double,%function

.align	5

ecp_nistz256_point_double:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-80]!

	add	x29,sp,#0

	stp	x19,x20,[sp,#16]
@@ -835,6 +856,7 @@ ecp_nistz256_point_double: 
	ldp	x19,x20,[x29,#16]

	ldp	x21,x22,[x29,#32]

	ldp	x29,x30,[sp],#80

	.inst	0xd50323bf		// autiasp

	ret

.size	ecp_nistz256_point_double,.-ecp_nistz256_point_double

___
@@ -857,6 +879,7 @@ $code.=<<___; 
.type	ecp_nistz256_point_add,%function

.align	5

ecp_nistz256_point_add:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-80]!

	add	x29,sp,#0

	stp	x19,x20,[sp,#16]
@@ -1100,6 +1123,7 @@ $code.=<<___; 
	ldp	x23,x24,[x29,#48]

	ldp	x25,x26,[x29,#64]

	ldp	x29,x30,[sp],#80

	.inst	0xd50323bf		// autiasp

	ret

.size	ecp_nistz256_point_add,.-ecp_nistz256_point_add

___
@@ -1121,6 +1145,7 @@ $code.=<<___; 
.type	ecp_nistz256_point_add_affine,%function

.align	5

ecp_nistz256_point_add_affine:

	.inst	0xd503233f		// paciasp

	stp	x29,x30,[sp,#-80]!

	add	x29,sp,#0

	stp	x19,x20,[sp,#16]
@@ -1309,6 +1334,7 @@ $code.=<<___; 
	ldp	x23,x24,[x29,#48]

	ldp	x25,x26,[x29,#64]

	ldp	x29,x30,[sp],#80

	.inst	0xd50323bf		// autiasp

	ret

.size	ecp_nistz256_point_add_affine,.-ecp_nistz256_point_add_affine

___