lkml.org 
[lkml]   [2018]   [Feb]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Subject[PATCH v2 1/3] x86/entry: Clear extra registers beyond syscall arguments for 64bit kernels
From
Date
At entry userspace may have populated the extra registers outside the
syscall calling convention with values that could be useful in a
speculative execution attack. Clear them to minimize the kernel's attack
surface. Note, this only clears the extra registers and not the unused
registers for syscalls less than 6 arguments since those registers are
likely to be clobbered well before their values could be put to use
under speculation.

Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: x86@kernel.org
Cc: Andy Lutomirski <luto@kernel.org>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Reported-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
---
arch/x86/entry/calling.h | 17 +++++++++++++++++
arch/x86/entry/entry_64.S | 1 +
2 files changed, 18 insertions(+)

diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h
index 3f48f695d5e6..daee2d19e73d 100644
--- a/arch/x86/entry/calling.h
+++ b/arch/x86/entry/calling.h
@@ -147,6 +147,23 @@ For 32-bit we have the following conventions - kernel is built with
UNWIND_HINT_REGS offset=\offset
.endm

+ /*
+ * Sanitize extra registers of values that a speculation attack
+ * might want to exploit. In the CONFIG_FRAME_POINTER=y case,
+ * the expectation is that %ebp will be clobbered before it
+ * could be used.
+ */
+ .macro CLEAR_EXTRA_REGS_NOSPEC
+ xorq %r15, %r15
+ xorq %r14, %r14
+ xorq %r13, %r13
+ xorq %r12, %r12
+ xorl %ebx, %ebx
+#ifndef CONFIG_FRAME_POINTER
+ xorl %ebp, %ebp
+#endif
+ .endm
+
.macro POP_EXTRA_REGS
popq %r15
popq %r14
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index c752abe89d80..5de9a5922026 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -244,6 +244,7 @@ GLOBAL(entry_SYSCALL_64_after_hwframe)
pushq %r15 /* pt_regs->r15 */
UNWIND_HINT_REGS

+ CLEAR_EXTRA_REGS_NOSPEC
TRACE_IRQS_OFF

/* IRQs are off. */
\
 
 \ /
  Last update: 2018-02-04 18:53    [W:0.183 / U:0.204 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site