All of lore.kernel.org
 help / color / mirror / Atom feed
From: tip-bot for Dan Williams <tipbot@zytor.com>
To: linux-tip-commits@vger.kernel.org
Cc: torvalds@linux-foundation.org, linux-kernel@vger.kernel.org,
	bp@alien8.de, dan.j.williams@intel.com, stable@vger.kernel.org,
	dvlasenk@redhat.com, mingo@kernel.org, hpa@zytor.com,
	brgerst@gmail.com, peterz@infradead.org, tglx@linutronix.de,
	jpoimboe@redhat.com, ak@linux.intel.com, luto@kernel.org
Subject: [tip:x86/pti] x86/entry/64: Clear extra registers beyond syscall arguments, to reduce speculation attack surface
Date: Tue, 6 Feb 2018 03:52:01 -0800	[thread overview]
Message-ID: <tip-8e1eb3fa009aa7c0b944b3c8b26b07de0efb3200@git.kernel.org> (raw)
In-Reply-To: <151787988577.7847.16733592218894189003.stgit@dwillia2-desk3.amr.corp.intel.com>

Commit-ID:  8e1eb3fa009aa7c0b944b3c8b26b07de0efb3200
Gitweb:     https://git.kernel.org/tip/8e1eb3fa009aa7c0b944b3c8b26b07de0efb3200
Author:     Dan Williams <dan.j.williams@intel.com>
AuthorDate: Mon, 5 Feb 2018 17:18:05 -0800
Committer:  Ingo Molnar <mingo@kernel.org>
CommitDate: Tue, 6 Feb 2018 08:30:27 +0100

x86/entry/64: Clear extra registers beyond syscall arguments, to reduce speculation attack surface

At entry userspace may have (maliciously) populated the extra registers
outside the syscall calling convention with arbitrary values that could
be useful in a speculative execution (Spectre style) attack.

Clear these registers to minimize the kernel's attack surface.

Note, this only clears the extra registers and not the unused
registers for syscalls less than 6 arguments, since those registers are
likely to be clobbered well before their values could be put to use
under speculation.

Note, Linus found that the XOR instructions can be executed with
minimized cost if interleaved with the PUSH instructions, and Ingo's
analysis found that R10 and R11 should be included in the register
clearing beyond the typical 'extra' syscall calling convention
registers.

Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Reported-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Cc: <stable@vger.kernel.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/151787988577.7847.16733592218894189003.stgit@dwillia2-desk3.amr.corp.intel.com
[ Made small improvements to the changelog and the code comments. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
 arch/x86/entry/entry_64.S | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index c752abe..065a71b 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -235,13 +235,26 @@ GLOBAL(entry_SYSCALL_64_after_hwframe)
 	pushq	%r8				/* pt_regs->r8 */
 	pushq	%r9				/* pt_regs->r9 */
 	pushq	%r10				/* pt_regs->r10 */
+	/*
+	 * Clear extra registers that a speculation attack might
+	 * otherwise want to exploit. Interleave XOR with PUSH
+	 * for better uop scheduling:
+	 */
+	xorq	%r10, %r10			/* nospec   r10 */
 	pushq	%r11				/* pt_regs->r11 */
+	xorq	%r11, %r11			/* nospec   r11 */
 	pushq	%rbx				/* pt_regs->rbx */
+	xorl	%ebx, %ebx			/* nospec   rbx */
 	pushq	%rbp				/* pt_regs->rbp */
+	xorl	%ebp, %ebp			/* nospec   rbp */
 	pushq	%r12				/* pt_regs->r12 */
+	xorq	%r12, %r12			/* nospec   r12 */
 	pushq	%r13				/* pt_regs->r13 */
+	xorq	%r13, %r13			/* nospec   r13 */
 	pushq	%r14				/* pt_regs->r14 */
+	xorq	%r14, %r14			/* nospec   r14 */
 	pushq	%r15				/* pt_regs->r15 */
+	xorq	%r15, %r15			/* nospec   r15 */
 	UNWIND_HINT_REGS
 
 	TRACE_IRQS_OFF

  reply	other threads:[~2018-02-06 11:58 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-02-06  1:18 [PATCH v3 0/3] x86/entry: Clear registers to sanitize speculative usages Dan Williams
2018-02-06  1:18 ` [PATCH v3 1/3] x86/entry: Clear extra registers beyond syscall arguments for 64bit kernels Dan Williams
2018-02-06 11:52   ` tip-bot for Dan Williams [this message]
2018-02-06  1:18 ` [PATCH v3 2/3] x86/entry: Clear registers for 64bit exceptions/interrupts Dan Williams
2018-02-06  9:04   ` Dominik Brodowski
2018-02-06 10:48     ` Ingo Molnar
2018-02-06  9:17   ` Dominik Brodowski
2018-02-06 10:51     ` Ingo Molnar
2018-02-06 10:57       ` Dominik Brodowski
2018-02-06 21:25       ` [PATCH tip-pti 1/2] x86/entry: remove SAVE_C_REGS_EXCEPT_* macros Dominik Brodowski
2018-02-06 22:56         ` Linus Torvalds
2018-02-06 21:32       ` [PATCH tip-pti 2/2] x86/entry: interleave XOR register clearing with PUSH/MOV instructions Dominik Brodowski
2018-02-06 22:30         ` Dan Williams
2018-02-06 22:48         ` Linus Torvalds
2018-02-06 23:05           ` Andy Lutomirski
2018-02-06 23:54           ` Andi Kleen
2018-02-07  1:30             ` Linus Torvalds
2018-02-07 15:18               ` Andi Kleen
2018-02-07 17:05                 ` Linus Torvalds
2018-02-07 17:37                   ` Linus Torvalds
2018-02-06 12:00   ` [tip:x86/pti] x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface tip-bot for Dan Williams
2018-02-06  1:18 ` [PATCH v3 3/3] x86/entry: Clear registers for compat syscalls Dan Williams
2018-02-06  7:26   ` Ingo Molnar
2018-02-06  7:53     ` Dan Williams
2018-02-06 12:00   ` [tip:x86/pti] x86/entry/64/compat: Clear registers for compat syscalls, to reduce speculation attack surface tip-bot for Dan Williams

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=tip-8e1eb3fa009aa7c0b944b3c8b26b07de0efb3200@git.kernel.org \
    --to=tipbot@zytor.com \
    --cc=ak@linux.intel.com \
    --cc=bp@alien8.de \
    --cc=brgerst@gmail.com \
    --cc=dan.j.williams@intel.com \
    --cc=dvlasenk@redhat.com \
    --cc=hpa@zytor.com \
    --cc=jpoimboe@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-tip-commits@vger.kernel.org \
    --cc=luto@kernel.org \
    --cc=mingo@kernel.org \
    --cc=peterz@infradead.org \
    --cc=stable@vger.kernel.org \
    --cc=tglx@linutronix.de \
    --cc=torvalds@linux-foundation.org \
    --subject='Re: [tip:x86/pti] x86/entry/64: Clear extra registers beyond syscall arguments, to reduce speculation attack surface' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.