At entry userspace may have populated the extra registers outside the
syscall calling convention with values that could be useful in a
speculative execution attack. Clear them to minimize the kernel's attack
surface. Note, this only clears the extra registers and not the unused
registers for syscalls less than 6 arguments since those registers are
likely to be clobbered well before their values could be put to use
under speculation.

Cc: Thomas Gleixner <t...@linutronix.de>
Cc: Ingo Molnar <mi...@redhat.com>
Cc: "H. Peter Anvin" <h...@zytor.com>
Cc: x...@kernel.org
Cc: Andy Lutomirski <l...@kernel.org>
Suggested-by: Linus Torvalds <torva...@linux-foundation.org>
Reported-by: Andi Kleen <a...@linux.intel.com>
Signed-off-by: Dan Williams <dan.j.willi...@intel.com>
---
 arch/x86/entry/calling.h  |   17 +++++++++++++++++
 arch/x86/entry/entry_64.S |    1 +
 2 files changed, 18 insertions(+)

diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h
index 3f48f695d5e6..daee2d19e73d 100644
--- a/arch/x86/entry/calling.h
+++ b/arch/x86/entry/calling.h
@@ -147,6 +147,23 @@ For 32-bit we have the following conventions - kernel is 
built with
        UNWIND_HINT_REGS offset=\offset
        .endm
 
+       /*
+        * Sanitize extra registers of values that a speculation attack
+        * might want to exploit. In the CONFIG_FRAME_POINTER=y case,
+        * the expectation is that %ebp will be clobbered before it
+        * could be used.
+        */
+       .macro CLEAR_EXTRA_REGS_NOSPEC
+       xorq %r15, %r15
+       xorq %r14, %r14
+       xorq %r13, %r13
+       xorq %r12, %r12
+       xorl %ebx, %ebx
+#ifndef CONFIG_FRAME_POINTER
+       xorl %ebp, %ebp
+#endif
+       .endm
+
        .macro POP_EXTRA_REGS
        popq %r15
        popq %r14
diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
index c752abe89d80..5de9a5922026 100644
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -244,6 +244,7 @@ GLOBAL(entry_SYSCALL_64_after_hwframe)
        pushq   %r15                            /* pt_regs->r15 */
        UNWIND_HINT_REGS
 
+       CLEAR_EXTRA_REGS_NOSPEC
        TRACE_IRQS_OFF
 
        /* IRQs are off. */

Reply via email to