Received: by 10.223.185.116 with SMTP id b49csp4193926wrg; Mon, 26 Feb 2018 12:57:55 -0800 (PST) X-Google-Smtp-Source: AH8x224WZYGBNMooYvoNFs7o+cocv3b2ob9v/D6xvxqHTcdQbKnLN/vRwmgciPPYseTedDuYbaFK X-Received: by 2002:a17:902:7593:: with SMTP id j19-v6mr11222589pll.408.1519678675890; Mon, 26 Feb 2018 12:57:55 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519678675; cv=none; d=google.com; s=arc-20160816; b=zFwOpl7y8ag0zFvakkrbCjMuaSTjNp6PPjuopfQjvaGe+dwkaM/lsVwCYcFTXsBgF9 FRc+FxZWx0cE+kP4kJenBGMMYmxPW7QXwtX1pIki4Vcb58CCZ2g1W6OlDvtunfr/T/XT PxVs5aZqlZ1c0PZdkDWVH+BrBjpi8bRQtInHlj0MlEoWkGPKuwfBoaQsXSpQGMZf6q6r pydOd6LtTx9TdZEla+/G5bRVb4MrIGtCHo1BkFERtiwTr8FJeoCfB74X9B+abdSbuy2n 5g1+0IwXKoklkijvBxs8bjEE0lalscj7qFOhN12Bn5vWBK4g11hhBBHZUHDkWIlKNOmK pC2A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=hQtXKlz0k3jmicATKetmzwOxwdXUIomHybqNSgX1B7I=; b=cY0eQNMxuto1Q+eBieHHetFOHlI7gTBFYV6npstoJX4DHZQz5+VIBal0qJrr8J6xOD Dy313a39zLYPYVzviiUPO2+MzsHEMTiRtOvgrdi/HBCbBTxime7fzkO0Va1DrXsVhqXO 39BxoWuIdQUpJV/ETzt8ltT5KY9EFBa8T3FoxFtOMHLB8E7RkmDM1LGEGc/5db2np49X hBh7GXvXx9vjeyYkGMvg89lnoOw5B2yeFfvqbSy2JIhKSYifSN5Ln+FCc79PYD085bke 4kn5y2WgvGDIOU7/DA1R/YM+FcO8K2+0A9rgOOp1ueTHOGR6yFNrz5ikU/B0KpvIbYSw Bw5A== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id h3-v6si7269650plh.694.2018.02.26.12.57.39; Mon, 26 Feb 2018 12:57:55 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752595AbeBZUXG (ORCPT + 99 others); Mon, 26 Feb 2018 15:23:06 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:34654 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752065AbeBZUXE (ORCPT ); Mon, 26 Feb 2018 15:23:04 -0500 Received: from localhost (clnet-b04-243.ikbnet.co.at [83.175.124.243]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 21EF4E33; Mon, 26 Feb 2018 20:23:03 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Linus Torvalds , Andi Kleen , Dan Williams , Andy Lutomirski , Borislav Petkov , Brian Gerst , Denys Vlasenko , "H. Peter Anvin" , Josh Poimboeuf , Peter Zijlstra , Thomas Gleixner , Ingo Molnar Subject: [PATCH 4.9 39/39] x86/entry/64: Clear extra registers beyond syscall arguments, to reduce speculation attack surface Date: Mon, 26 Feb 2018 21:21:00 +0100 Message-Id: <20180226201645.379416320@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180226201643.660109883@linuxfoundation.org> References: <20180226201643.660109883@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Williams commit 8e1eb3fa009aa7c0b944b3c8b26b07de0efb3200 upstream. At entry userspace may have (maliciously) populated the extra registers outside the syscall calling convention with arbitrary values that could be useful in a speculative execution (Spectre style) attack. Clear these registers to minimize the kernel's attack surface. Note, this only clears the extra registers and not the unused registers for syscalls less than 6 arguments, since those registers are likely to be clobbered well before their values could be put to use under speculation. Note, Linus found that the XOR instructions can be executed with minimized cost if interleaved with the PUSH instructions, and Ingo's analysis found that R10 and R11 should be included in the register clearing beyond the typical 'extra' syscall calling convention registers. Suggested-by: Linus Torvalds Reported-by: Andi Kleen Signed-off-by: Dan Williams Cc: Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Brian Gerst Cc: Denys Vlasenko Cc: H. Peter Anvin Cc: Josh Poimboeuf Cc: Peter Zijlstra Cc: Thomas Gleixner Link: http://lkml.kernel.org/r/151787988577.7847.16733592218894189003.stgit@dwillia2-desk3.amr.corp.intel.com [ Made small improvements to the changelog and the code comments. ] Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman --- arch/x86/entry/entry_64.S | 13 +++++++++++++ 1 file changed, 13 insertions(+) --- a/arch/x86/entry/entry_64.S +++ b/arch/x86/entry/entry_64.S @@ -176,13 +176,26 @@ GLOBAL(entry_SYSCALL_64_after_swapgs) pushq %r8 /* pt_regs->r8 */ pushq %r9 /* pt_regs->r9 */ pushq %r10 /* pt_regs->r10 */ + /* + * Clear extra registers that a speculation attack might + * otherwise want to exploit. Interleave XOR with PUSH + * for better uop scheduling: + */ + xorq %r10, %r10 /* nospec r10 */ pushq %r11 /* pt_regs->r11 */ + xorq %r11, %r11 /* nospec r11 */ pushq %rbx /* pt_regs->rbx */ + xorl %ebx, %ebx /* nospec rbx */ pushq %rbp /* pt_regs->rbp */ + xorl %ebp, %ebp /* nospec rbp */ pushq %r12 /* pt_regs->r12 */ + xorq %r12, %r12 /* nospec r12 */ pushq %r13 /* pt_regs->r13 */ + xorq %r13, %r13 /* nospec r13 */ pushq %r14 /* pt_regs->r14 */ + xorq %r14, %r14 /* nospec r14 */ pushq %r15 /* pt_regs->r15 */ + xorq %r15, %r15 /* nospec r15 */ /* IRQs are off. */ movq %rsp, %rdi