x86/entry/64: Clear extra registers beyond syscall arguments, to reduce speculation attack surface

Web:        https://git.kernel.org/torvalds/c/8e1eb3fa009aa7c0b944b3c8b26b07de0efb3200
Commit:     8e1eb3fa009aa7c0b944b3c8b26b07de0efb3200
Parent:     b2ac58f90540e39324e7a29a7ad471407ae0bf48
Refname:    refs/heads/master
Author:     Dan Williams <[email protected]>
AuthorDate: Mon Feb 5 17:18:05 2018 -0800
Committer:  Ingo Molnar <[email protected]>
CommitDate: Tue Feb 6 08:30:27 2018 +0100

    x86/entry/64: Clear extra registers beyond syscall arguments, to reduce speculation attack surface
    
    At entry userspace may have (maliciously) populated the extra registers
    outside the syscall calling convention with arbitrary values that could
    be useful in a speculative execution (Spectre style) attack.
    
    Clear these registers to minimize the kernel's attack surface.
    
    Note, this only clears the extra registers and not the unused
    registers for syscalls less than 6 arguments, since those registers are
    likely to be clobbered well before their values could be put to use
    under speculation.
    
    Note, Linus found that the XOR instructions can be executed with
    minimized cost if interleaved with the PUSH instructions, and Ingo's
    analysis found that R10 and R11 should be included in the register
    clearing beyond the typical 'extra' syscall calling convention
    registers.
    
    Suggested-by: Linus Torvalds <[email protected]>
    Reported-by: Andi Kleen <[email protected]>
    Signed-off-by: Dan Williams <[email protected]>
    Cc: <[email protected]>
    Cc: Andy Lutomirski <[email protected]>
    Cc: Borislav Petkov <[email protected]>
    Cc: Brian Gerst <[email protected]>
    Cc: Denys Vlasenko <[email protected]>
    Cc: H. Peter Anvin <[email protected]>
    Cc: Josh Poimboeuf <[email protected]>
    Cc: Peter Zijlstra <[email protected]>
    Cc: Thomas Gleixner <[email protected]>
    Link: http://lkml.kernel.org/r/151787988577.7847.16733592218894189003.stgit@dwillia2-desk3.amr.corp.intel.com
    [ Made small improvements to the changelog and the code comments. ]
    Signed-off-by: Ingo Molnar <[email protected]>
---
 arch/x86/entry/entry_64.S | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index c752abe89d80..065a71b90808 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -235,13 +235,26 @@ GLOBAL(entry_SYSCALL_64_after_hwframe)
 	pushq	%r8				/* pt_regs->r8 */
 	pushq	%r9				/* pt_regs->r9 */
 	pushq	%r10				/* pt_regs->r10 */
+	/*
+	 * Clear extra registers that a speculation attack might
+	 * otherwise want to exploit. Interleave XOR with PUSH
+	 * for better uop scheduling:
+	 */
+	xorq	%r10, %r10			/* nospec   r10 */
 	pushq	%r11				/* pt_regs->r11 */
+	xorq	%r11, %r11			/* nospec   r11 */
 	pushq	%rbx				/* pt_regs->rbx */
+	xorl	%ebx, %ebx			/* nospec   rbx */
 	pushq	%rbp				/* pt_regs->rbp */
+	xorl	%ebp, %ebp			/* nospec   rbp */
 	pushq	%r12				/* pt_regs->r12 */
+	xorq	%r12, %r12			/* nospec   r12 */
 	pushq	%r13				/* pt_regs->r13 */
+	xorq	%r13, %r13			/* nospec   r13 */
 	pushq	%r14				/* pt_regs->r14 */
+	xorq	%r14, %r14			/* nospec   r14 */
 	pushq	%r15				/* pt_regs->r15 */
+	xorq	%r15, %r15			/* nospec   r15 */
 	UNWIND_HINT_REGS
 
 	TRACE_IRQS_OFF
--
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html